# Security Policy

## Supported Versions

We always provide security updates for the [latest release](https://github.com/minio/minio/releases/latest).
Whenever there is a security update you just need to upgrade to the latest version.

## Reporting a Vulnerability

All security bugs in [minio/minio](https://github,com/minio/minio) (or other minio/* repositories)
should be reported by email to ******@****.***. Your email will be acknowledged within 48 hours,

///

<details>
<summary>Dockerfile Preview 👀</summary>

```Dockerfile
FROM python:3.14

WORKDIR /code

COPY ./requirements.txt /code/requirements.txt

RUN pip install --no-cache-dir --upgrade -r /code/requirements.txt

COPY ./app /code/app

CMD ["fastapi", "run", "app/main.py", "--port", "80"]

# If running behind a proxy like Nginx or Traefik add --proxy-headers

  /** The HTTP {@code Upgrade} header field name. */
  public static final String UPGRADE = "Upgrade";

  /**
   * The HTTP <a href="https://w3c.github.io/webappsec-upgrade-insecure-requests/#preference">{@code
   * Upgrade-Insecure-Requests}</a> header field name.
   *
   * @since 28.1
   */
  public static final String UPGRADE_INSECURE_REQUESTS = "Upgrade-Insecure-Requests";

        listen       9000;
        listen  [::]:9000;
        server_name  localhost;

         # To allow special characters in headers
         ignore_invalid_headers off;
         # Allow any size file to be uploaded.
         # Set to a value such as 1000m; to restrict file size to a specific value
         client_max_body_size 0;
         # To disable buffering
         proxy_buffering off;

        location / {

      What change are you proposing to the upload configuration, and why?
      For new upload configuration, which new counters will be collected, what
      do they measure, and why is it important to collect them?
      Note that uploaded data must not carry sensitive user information.
      See [go.dev/doc/telemetry#proposals](https://go.dev/doc/telemetry#proposals)
      for more details on telemetry proposals.
  validations:
    required: true

        return builder(Tools.MVNSHELL_CMD, Tools.MVNSHELL_NAME, args, messageBuilderFactory);
    }

    /**
     * Creates a new Builder instance for constructing a Maven Upgrade Tool ParserRequest.
     *
     * @param args the command-line arguments
     * @param messageBuilderFactory the factory for creating message builders
     * @return a new Builder instance
     */
    @Nonnull

helm get values my-release > old_values.yaml
```

Then change the field `image.tag` in `old_values.yaml` file with MinIO image tag you want to use. Now update the chart using

```bash
helm upgrade -f old_values.yaml my-release minio/minio
```

Default upgrade strategies are specified in the `values.yaml` file. Update these fields if you'd like to use a different strategy.

### Configuration

You should add tests for your app.

With **FastAPI** it's very easy (thanks to Starlette), check the docs: [Testing](../tutorial/testing.md)

After you have tests, then you can upgrade the **FastAPI** version to a more recent one, and make sure that all your code is working correctly by running your tests.

        if: matrix.ldap == 'ldaphost:389'
        env:
          _MINIO_LDAP_TEST_SERVER: ${{ matrix.ldap }}
        run: |
          make test-iam-ldap-upgrade-import
      - name: Test LDAP for automatic site replication
        if: matrix.ldap == 'localhost:389'
        run: |
          make test-site-replication-ldap
      - name: Test OIDC for automatic site replication

                        .thenReturn(UpgradeResult.empty());

                checkGoal.execute(context);

                // Verify that the Check-specific header is logged
                verify(context.logger).info("Maven Upgrade Tool - Check");
            } finally {
                // Clean up - delete all files in the directory first
                try {
                    Files.walk(tempDir)