Skip to content

2.0.2

Choose a tag to compare

View all tags
@SyniRon SyniRon released this 01 Apr 22:10
2.0.2
54f33c2
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security

Dependency updates addressing 12 Dependabot alerts:

Critical

  • google.golang.org/grpc v1.72.0 → v1.79.3 (CVE: AuthZ bypass via missing leading slash in :path)

High

  • github.com/opencontainers/selinux v1.12.0 → v1.13.0 (CVE-2025-52881: runc container escape via procfs write redirects)
  • github.com/containerd/containerd v1.7.25 → v1.7.29 (local privesc via wide CRI directory permissions)
  • github.com/docker/cli v28.1.1 → v29.2.0 (local privesc via uncontrolled search path on Windows)

Medium

  • github.com/containerd/containerd v1.7.25 → v1.7.29 (host memory exhaustion, integer overflow in UID handling)
  • github.com/quic-go/quic-go v0.51.0 → v0.57.0 (HTTP/3 QPACK header expansion DoS)
  • golang.org/x/crypto v0.38.0 → v0.46.0 (ssh/agent panic, unbounded memory consumption)
  • github.com/go-chi/chi/v5 v5.2.1 → v5.2.2 (host header injection / open redirect)

Low

  • github.com/redis/go-redis/v9 v9.7.0 → v9.7.3 (out-of-order responses on CLIENT SETINFO timeout)
  • filippo.io/edwards25519 v1.1.0 → v1.1.1 (invalid MultiScalarMult results)

Other

  • Fixed two latent Printf-directive bugs surfaced by Go 1.24 vet
Assets 2
Loading