Skip to content

v2.4.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 31 Oct 17:26
· 77 commits to main since this release
v2.4.1
3bb9f9c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v2.4.1

[2.4.1] - 2026-10-31

v2.4.1 protects exec targets, refreshes the CA certificate bundle and removes unnecessary Buildx setup from the published-image Grype scan. It carries v2.4.0.

Security

  • Refuse Docker and native Podman exec create/start against containers labeled com.sockguard.exec=deny. The official Sockguard image carries this label by default, protecting the proxy even when interactive exec and root commands are enabled. Exec-create pins the inspected container ID so a concurrent rename cannot swap in another target.

  • Update the Chainguard static image to refresh the CA certificate bundle for CVE-2026-91403. The previous image carried ca-certificates-bundle 20260413-r0 and failed the critical-severity image scan.

Changed

  • The published-image Grype scan no longer sets up Buildx. It only needs docker buildx imagetools inspect, which the runner already has, and setting up a builder under the release egress block was refused and ran the job past its 20-minute limit on both v2.4.0 publisher runs. The digest lookup now retries on its own with a five-minute limit.
Assets 20
Loading