openstack/glance — Week of 2026-09-05

Import and web-download hardening. The bulk of the week — roughly 1,600 lines across nine changes — tightens Glance's handling of external URLs used for image imports. Web-download import URIs now block restricted addresses, HTTP image locations reject restricted hosts when added, and import downloads are pinned to validated destination addresses to defeat DNS rebinding. A companion fix properly enforces the size limit on web-download image fetches. Each of these landed on master and was fanned out across stable branches as parallel backports, indicating a coordinated security fix; see the pinning change as the representative patch.

Reliability. The filesystem store now surfaces I/O timeouts as HTTP 503 rather than propagating opaque failures, giving clients a clean retryable signal when the backend stalls.

Legacy cleanup. Two sizable removals strip out the remaining logic supporting identity v1/v2 APIs and drop the now-unused management_url, together shedding ~670 lines of dead auth-era code.

Elsewhere. A test was updated to avoid live DNS resolution, requests was made an unconditional requirement, and the cursive repository path was refreshed.