openstack/swift — Week of 2026-05-30

Security hardening. The biggest change of the week tightens pickle unmarshalling across Swift, restricting what classes can be reconstructed from on-disk and on-wire pickled data (988826, ~400 lines touched). A small follow-up cleans up the bandit warnings that fell out of the audit.

Timestamps and versioning. Swift's Timestamp type gained richer offset support through __invert__, with a follow-up refining the offset semantics. Object versioning was reworked to use x-backend-timestamp as the source version, replacing the previous approach for picking which version to restore.

s3api aws-chunked. Truncated aws-chunked uploads are now rejected with an explicit error rather than being silently accepted, landing alongside functional tests that exercise the truncation path and a second round of functional coverage for additional cases.

CI and docs. A new swift-multinode-rolling-upgrade-gazpacho job joins the rolling-upgrade matrix and the dalmatian variant got a small fix; the py310 unit-test job is pinned to stable/2026.1 constraints. The SAIO setup guide was trimmed of outdated instructions, and a flaky sharder test was made more robust.