Neo SPCC released updates to the NeoFS REST Gateway and web management Panel on Oct. 9, completing the removal of RANGE EACL support across the NeoFS access layer and aligning both tools with the latest storage node and SDK releases. The updates deliver reliability fixes, security hardening, and stricter input validation.

Both releases follow the Node v0.57.0 and SDK RC23 batch shipped on Sept. 30, which introduced container revisions, online FSTree reshaping, and the complete removal of the GetRange object service method.

REST Gateway v0.20.0

The REST Gateway serves as the HTTP bridge between web applications and NeoFS storage. Version 0.20.0 adds a container revision field to ContainerInfo, exposing the versioning metadata introduced in Node v0.57.0 so REST clients can track container configuration changes.

A clock skew fix addresses an issue where freshly issued v2 session tokens were rejected when the validating node’s clock drifted slightly from the issuer’s. The gateway also corrects a parsing bug that returned empty rules instead of properly handling GETRANGEHASH records in container EACL, an issue first mitigated in REST Gateway v0.19.1 by skipping unsupported operations gracefully.

Object uploads with non-numeric __NEOFS__EXPIRATION_EPOCH attributes are now rejected with an HTTP 400 status, preventing malformed expiration metadata from entering the storage network. RANGE EACL operation support has been removed entirely, and the underlying NeoFS SDK Go dependency has been upgraded from RC22 to RC23, alongside updates to several other dependencies including kin-openapi, viper, and grpc.

Panel v0.11.1

The NeoFS Panel, accessible at panel.fs.neo.org, receives compatibility and security improvements in v0.11.1. The release updates the Panel for compatibility with S3 Gateway 0.47.0 and the updated authboxsrv credential service, following the S3 credential issuance feature added in Panel v0.11.0.

Security hardening includes restricting object previews to safe content types only and fixing a prototype pollution vulnerability when building the object tree. The release also hardens handling of failed metadata fetches and network error states.

Several wallet and session reliability fixes address practical usability issues:

  • Fractional GAS amounts now accepted for withdrawal.
  • Wallet selection corrected after canceling a NeoLine connection.
  • OneGate session restoration fixed when WalletConnect initialization fails.
  • Profile loading no longer stalls after failed requests.
  • S3 credentials dialog can now be closed before issuance completes.

An additional fix prevents unintended EACL rule changes during drag-and-drop operations, and token validation has been corrected to properly display signing status for expired tokens and missing permissions. As with the REST Gateway, RANGE EACL support has been removed. The Docker build image has been upgraded to Node 22.

GetRange removal arc

The RANGE EACL removal in both tools completes a cleanup that spans multiple NeoFS components. Node v0.57.0 removed the GetRange object service method entirely, SDK RC22 dropped GetRangeHash, and the REST Gateway and Panel now remove RANGE from EACL handling as the operation no longer exists in the protocol.

The Panel v0.11.1 release notes can be found at the link below:
https://github.com/nspcc-dev/panel-fs-neo-org/releases/tag/v0.11.1

The REST Gateway v0.20.0 release notes can be found at the link below:
https://github.com/nspcc-dev/neofs-rest-gw/releases/tag/v0.20.0

Tags: ,