Neo SPCC released NeoFS Node v0.58.0, codenamed “Gopado,” on Oct. 28, enforcing request validity windows, implementing server-side time-based object expiration, and upgrading session key encryption to HPKE. The release also hardens erasure coding operations, removes several legacy features, and fixes multiple stability issues including panic-inducing bugs.

The update coordinates with NeoFS SDK Go RC24 and neofs-contract v0.28.0, both released in the days prior, continuing Neo SPCC’s pattern of bundled infrastructure releases.

Request validity enforcement

Storage nodes now require API version 2.22 or higher for all requests, with inner ring nodes similarly denying container creation and eACL operations below that threshold. Nodes also enforce request time expiration checks, blocking stale or expired requests. The changes tighten protocol semantics, preventing replay or delayed execution and requiring clients to upgrade to remain compatible.

Time-based object expiration

v0.58.0 adds server-side support for time-based object expiration, complementing the client-side implementation introduced in SDK RC24. Objects can now expire based on Unix timestamps rather than abstract NeoFS epochs, bringing expiration behavior closer to conventional storage semantics. Storage nodes enforce the timestamp metadata and incorporate it into garbage collection logic.

Erasure coding hardening

Erasure coding operations receive several clarifications. A dedicated ec_part_id field replaces the previous use of X-Headers for EC part selection in GET and HEAD operations, with the CLI gaining an --ec-part flag to match. Storage nodes now block ambiguous EC GET requests that set the payload_only flag without specifying a part index. Cross-rules EC parts restoration has been added for improved redundancy management.

X-Headers are deprecated across the stack and are no longer forwarded between storage nodes. Integrators using the CLI --xhdr flag should remove it.

Session security upgrade

Session key encryption has been upgraded to HPKE (Hybrid Public Key Encryption), an IETF standard defined in RFC 9180. Session token storage is now indexed by expiration epoch, improving cleanup efficiency.

Session records stored at the persistent state path automatically migrate to the new epoch-indexed format with HPKE encryption on startup. The migration is irreversible, meaning records become unreadable by older node versions. Operators should back up persistent state data before upgrading.

Legacy removals

v0.58.0 removes support for compressed FSTree objects, multiaddr configuration in the CLI and node, the container contract create method in inner ring, and homomorphic hashing output from the CLI netinfo command. Container contract Created and Removed event support has also been removed from storage nodes, aligning with neofs-contract v0.28.0 changes.

Operators with compressed objects in FSTree must use the fstree-decompress utility from v0.57.0 before upgrading, as the tool is no longer included. Multiaddr entries in node configuration should be replaced with plain URIs.

Bug fixes and performance

The release fixes panics in AccountingService.Balance handling, write-cache counter restoration on startup, and neofs-lancet metabase migration. A garbage collection stall caused by expired objects protected by LOCKs stored on other shards has been resolved. GET and HEAD operations now traverse nodes strictly by weight before falling back to local storage, and the policer uses an in-memory queue for redundant object removal to reduce metabase writes.

The full release notes can be found at the link below:
https://github.com/nspcc-dev/neofs-node/releases/tag/v0.58.0

Tags: ,