A clock skew fix addresses an issue where freshly issued v2 session tokens were rejected when the validating node’s clock drifted slightly from the issuer’s. The gateway also corrects a parsing bug that returned empty rules instead of properly handling GETRANGEHASH records in container EACL, an issue first mitigated in REST Gateway v0.19.1 by skipping unsupported operations gracefully.
Object uploads with non-numeric __NEOFS__EXPIRATION_EPOCH attributes are now rejected with an HTTP 400 status, preventing malformed expiration metadata from entering the storage network. RANGE EACL operation support has been removed entirely, and the underlying NeoFS SDK Go dependency has been upgraded from RC22 to RC23, alongside updates to several other dependencies including kin-openapi, viper, and grpc.
Panel v0.11.1
The NeoFS Panel, accessible at panel.fs.neo.org, receives compatibility and security improvements in v0.11.1. The release updates the Panel for compatibility with S3 Gateway 0.47.0 and the updated authboxsrv credential service, following the S3 credential issuance feature added in Panel v0.11.0.
Security hardening includes restricting object previews to safe content types only and fixing a prototype pollution vulnerability when building the object tree. The release also hardens handling of failed metadata fetches and network error states.
Several wallet and session reliability fixes address practical usability issues:
- Fractional GAS amounts now accepted for withdrawal.
- Wallet selection corrected after canceling a NeoLine connection.
- OneGate session restoration fixed when WalletConnect initialization fails.
- Profile loading no longer stalls after failed requests.
- S3 credentials dialog can now be closed before issuance completes.
An additional fix prevents unintended EACL rule changes during drag-and-drop operations, and token validation has been corrected to properly display signing status for expired tokens and missing permissions. As with the REST Gateway, RANGE EACL support has been removed. The Docker build image has been upgraded to Node 22.
GetRange removal arc
The RANGE EACL removal in both tools completes a cleanup that spans multiple NeoFS components. Node v0.57.0 removed the GetRange object service method entirely, SDK RC22 dropped GetRangeHash, and the REST Gateway and Panel now remove RANGE from EACL handling as the operation no longer exists in the protocol.
The Panel v0.11.1 release notes can be found at the link below:
https://github.com/nspcc-dev/panel-fs-neo-org/releases/tag/v0.11.1
The REST Gateway v0.20.0 release notes can be found at the link below:
https://github.com/nspcc-dev/neofs-rest-gw/releases/tag/v0.20.0