Dependency Upgrades / CVE fixes:

• Upgraded Go toolchain from 1.26.9 to 1.26.10
• Upgraded github.com/go-jose/go-jose/v4 from v4.1.4 to v4.1.6
• Upgraded golang.org/x/net from v0.60.0 to v0.62.0
• Upgraded golang.org/x/crypto from v0.57.0 to v0.58.0

New Features:

• Renamed the fs/ops_latency metric to fs/ops_latencies, and introduced the --metrics-enable-new-metrics-schema flag to allow toggling between new and legacy names. PR#5100
• Added the metadata_cache/read_count metric that captures hits and misses when reading metadata_cache along with details like positive/negative entry and reasons for miss like ttl_expiration, entry not in cache. PR#5093

Bug fixes & Improvements:

• gRPC Read-Stall Protection: Incorporated permanent fix and retry mechanism for gRPC read stalls to prevent socket/connection stall issues. PR#5114

Dependency Upgrades / CVE fixes:

• Go Toolchain & Dependencies: Upgraded Go toolchain to 1.27.2 and updated golang.org/x/net and golang.org/x/crypto dependencies for CVE remediation. PR#5157

Dependency Upgrades / CVE fixes:

Upgrading dependencies (crypto & go-toml) package

• Updating cyrpto package to v0.56

• Upgrading go-toml package to v2.4.3

Upgrading dependencies to fix CVEs

New Features:

• Integrated atomic GCS Compose API which deletes source objects on the server-side by default. This eliminates early deletion billing spikes for colder tiers, and "soft delete" retention charges for append-heavy AI/ML workloads PR#4804

Bug fixes & Improvements:

• Ensured read operations from rapid buckets are reliably aborted when a cancellation or interrupt occurs PR#5043
• Increased reliability for non-GKE customers by removing enforced direct path checks in gRPC . PR#5077
• Kernel reader improvements: Aligned Read ahead size with Max Request size.PR#5080

Dependency Upgrades / CVE fixes:

• Go Toolchain & Dependencies: Upgraded Go toolchain to 1.27.0 and bumped direct dependencies to latest, including google.golang.org/grpc to v1.83.2. PR#5045

Important Changes

• Config Normalization: The --only-dir flag is now normalized by stripping any leading slashes (e.g., --only-dir=/some/path is treated as some/path).
  Note: As a result, objects whose names actually start with a leading slash can no longer be reached through the --only-dir mount. A leading slash creates an empty path component, which is incompatible with standard file systems and is therefore not recommended in file-systems. This was already not possible via objects created via fuse and now, is normalized in only-dir flag as well PR#4991