Technology

pgsty/minio Fork

A community-maintained AGPL v3 fork of MinIO created after the upstream repository was archived in February 2026 and permanently re-archived on April 25, 2026. Lives at github.com/pgsty/minio, ships compiled binaries and admin console, and backports CVE patches that MinIO Inc. now ships only in proprietary AIStor.

7 connections 3 resources

Summary

What it is

Where it fits

The immediate-term answer for organizations running existing MinIO Community Edition deployments who need CVE coverage without migrating to a different object store or paying for AIStor. Maintained as part of the Pigsty PostgreSQL distribution ecosystem.

Misconceptions / Traps

pgsty/minio is a CVE-coverage fork, not a license-change fork — it inherits the AGPL v3 burden of upstream MinIO. If AGPL is the migration driver, this fork does not help.
Single-maintainer / single-project risk — no foundation backing. Longevity depends on continued Pigsty team commitment.
CVE-2026-39414 is the canonical example: the upstream advisory explicitly lists only an AIStor-tagged RELEASE in patched_versions, leaving the OSS line unpatched. pgsty backports that fix.

Key Connections

alternative_to MinIO — same binary footprint, restored admin console, backported security patches
competes_with AIStor — same feature surface, AGPL instead of commercial license
implements S3 API — full inherited compatibility from the MinIO codebase
constrained_by AGPL Licensing Risk — same downstream-commercial copyleft burden as upstream MinIO

Definition

What it is

A community-maintained fork of **MinIO**, created after MinIO Inc. archived the upstream OSS repository in February 2026 and again, permanently, on April 25, 2026. The fork lives at [github.com/pgsty/minio](https://github.com/pgsty/minio) (1,520+ stars as of April 2026, AGPL-3.0) and applies CVE backports plus critical bug fixes that MinIO Inc. now ships only in proprietary **AIStor**. Maintained as part of the **Pigsty** PostgreSQL distribution ecosystem, the fork keeps the original AGPL v3 license intact while restoring the binary distribution pipeline and admin console that the upstream OSS line no longer ships.

Why it exists

When MinIO shifted all engineering to commercial AIStor, organizations running MinIO Community Edition were left with multiple unpatched advisories. The clearest example is **CVE-2026-39414** (DoS via unbounded memory in S3 Select CSV parsing), which the [GHSA-h749-fxx7-pwpg advisory](https://github.com/minio/minio/security/advisories/GHSA-h749-fxx7-pwpg) lists as patched **only** in `MinIO AIStor RELEASE.2025-12-20T04-58-37Z` — the OSS line gets no fix. The pgsty fork stepped in to backport the CVE patches and provide compiled binaries so existing MinIO deployments can stay in the supported security window without committing to a full migration.

Primary use cases

Drop-in replacement for existing MinIO Community Edition deployments, CVE-patched S3-compatible storage where AIStor licensing is unacceptable, bridge storage while planning migration to RustFS / SeaweedFS / Garage.

Recent developments

Latest signals

"MinIO is Dead, Long Live MinIO" — the fork is the founder's own narrative. Per the Vonng project page and the February 14, 2026 post "MinIO is Dead, Long Live MinIO" (Vonng's Chinese-language analysis), the pgsty fork's maintainer publicly documented the rationale: MinIO's main repo is officially archived and abandoned; the community fork restores the admin console and ships binaries via CI/CD pipelines for RPM, DEB, and Docker images. The fork's existence is anchored in a single maintainer's commitment, which is both its strength (decisive action while upstream stalls) and its risk (single-bus-factor longevity).
Two months in: 1,300 stars, 50k+ Docker pulls, four CVEs patched. The maintainer posted concrete adoption numbers alongside a deliberately narrow scope commitment — no new features, only compatibility, supply-chain, and fixes — to keep migration cheap for existing MinIO OSS users (Docker image swap, RPM/DEB via pig, or source). Per Vonng — Two months into maintaining a MinIO fork.
Grafana Loki's Helm chart switched its bundled MinIO subchart images to the pgsty fork to sidestep an unresolved upstream CVE — a concrete production-adoption signal beyond community chatter. The chart now pulls docker.io/pgsty/minio:RELEASE.2026-03-14T12-00-00Z instead of minio/minio. Per Grafana Loki Helm Chart CHANGELOG.
The April 17, 2026 release closed four CVEs in one pass — spanning OIDC, LDAP STS, S3 Select, replication metadata, unsigned-trailer flows, and Snowball upload — continuing the patch cadence beyond the single CVE-2026-39414 already documented. The prior March 14 release had already swapped in a community-maintained console fork and moved to Go 1.26. Per SILO Release Notes.
The fork now has a name — SILO — and it's spreading through distributions. The project documents itself as SILO at silo.pigsty.io, Pigsty v4.3 (May 4, 2026) ships the fork's packages by default alongside Ubuntu 26.04 support per the Pigsty v4.3 release announcement, and NixOS contributors are packaging release RELEASE.2026-04-17T07-06-42Z as silo per the NixOS Discourse packaging thread. Distribution-level packaging is the strongest counter yet to the single-maintainer-risk concern — downstream packagers now share the delivery pipeline.
Star count has climbed to ~7.4k with 1.4k forks. Per the pgsty GitHub organization page (April 2026), a sharp jump from the ~1,300 stars the maintainer reported at the two-month mark — adoption momentum rather than a curiosity spike. Sources: Vonng project (English landing) · MinIO Is Dead, Long Live MinIO — Vonng's analysis (Chinese) · Tech Field Day MinIO performance review

Connections 7

Outbound 6

scoped_to2

implements1

alternative_to1

competes_with1

constrained_by1

Inbound 1

solved_by1

MinIO Deletion Inconsistency

Resources 3

GitHubHigh

github.com/pgsty/minio

Community-maintained AGPL-3.0 fork of MinIO. Ships compiled binaries and admin console plus CVE backports that the now-archived upstream OSS line no longer receives.

GitHubHigh

github.com/pgsty/pigsty

Parent Pigsty PostgreSQL distribution project — context for the team maintaining the MinIO fork and the broader open-source operational stack they ship.

AdvisoryHigh

github.com/minio/minio/security/advisories/GHSA-h749-fxx7-pw...

Smoking-gun advisory for the OSS/AIStor patch split — `patched_versions` lists only `MinIO AIStor RELEASE.2025-12-20T04-58-37Z`, so the OSS line does not receive the CVE-2026-39414 fix. Drives the case for pgsty/minio (or migration entirely).