v23.0.1

Fixed CVEs:

• CVE-2026-25680: Parsing arbitrary HTML can consume excessive CPU time, possibly leadin ...
• CVE-2026-25681: Parsing arbitrary HTML which is then rendered using Render can result ...
• CVE-2026-27136: Parsing arbitrary HTML which is then rendered using Render can result ...
• CVE-2026-33814: When processing HTTP/2 SETTINGS frames, transport will enter an infini ...
• CVE-2026-39821: golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
• CVE-2026-42502: Parsing arbitrary HTML which is then rendered using Render can result ...
• CVE-2026-42506: Parsing arbitrary HTML which is then rendered using Render can result ...

What's Changed

• CI: use GOPROXY when bumping deps by @aramprice in #74
• ci: update azs by @KauzClay in #73
• CI: add GOSUMDB by @aramprice in #75
• Move pipeline to https://bosh.ci.cloudfoundry.org/teams/main/pipelines/os-conf-release by @aramprice in #76
• Add github actions to lint golang; remove useless envrc by @aramprice in #77

New Contributors

• @aramprice made their first contribution in #74
• @KauzClay made their first contribution in #73

Full Changelog: v23.0.0...v23.0.1

v23.0.0

What's Changed

• feat: add iptables job by @maxmoehl in #72

New Contributors

• @maxmoehl made their first contribution in #72

Full Changelog: v22.3.1...v23.0.0

v22.3.1

Fixed CVEs:

• CVE-2024-45338: golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html

What's Changed

• Update pre-start.sh.erb in harden_ssh for noble stemcell by @fmoehler in #70

New Contributors

• @fmoehler made their first contribution in #70

Full Changelog: v22.3.0...v22.3.1

v22.3.0

What's Changed

• Add post-stop job by @winkingturtle-vmw in #69

New Contributors

• @winkingturtle-vmw made their first contribution in #69

Full Changelog: v22.2.1...v22.3.0

v22.2.1

Fixed CVEs:

• CVE-2023-39325: golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)

v22.2.0

• Make auditd job more robust by introducing a new property to delay the start and by repeatedly attempting to bring up auditd in the event of a failure.

Full Changelog: v22.1.3...v22.2.0

v22.1.3

What's Changed

• add jammy compability by @nouseforaname in #65

New Contributors

• @nouseforaname made their first contribution in #65

Full Changelog: v22.1.2...v22.1.3

v22.1.2

What's Changed

• Run acceptance tests on bionic stemcell by @yatzek in #61
• Adding the option to delete system certificates to the job ca_certs by @danielfor in #62
• Updated Go to v1.17

New Contributors

• @yatzek made their first contribution in #61
• @danielfor made their first contribution in #62

Full Changelog: v22.1.1...v22.1.2

v22.1.1

Features

• adds a post-deploy-script job #56

Updates

• Bumped to go 1.16

v22.1.0

• [#55] Added harden_sshd job to disable ssh port forwarding