Skip to content

v2.26.1

Choose a tag to compare

View all tags
@release-please release-please released this 14 Oct 20:43
v2.26.1
5f85dd7
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

2.26.1 (2026-10-14)

Bug Fixes

  • keep structured logs when --quiet is set (#2694) (4b77b57)
  • update all dependencies to latest (#2699) (ea92a21)
  • update cloud.google.com/go/cloudsqlconn to v1.25.4 (#2685) (ddf693e)

Security / CVE Fixes

Updates golang.org/x/net from v0.59.0 to v0.61.0, resolving the following HTTP/2 vulnerabilities:

Advisory CVE Description Affected Package Fixed Version
GO-2026-6603 CVE-2026-78659 HTTP/2 server memory exhaustion due to Trailer headers golang.org/x/net v0.61.0
GO-2026-6610 CVE-2026-78660 HTTP/2 transport accepts malformed framing-related headers golang.org/x/net v0.61.0
GO-2026-6611 CVE-2026-78669 Excessive CPU consumption from repeated initial window changes golang.org/x/net v0.61.0
GO-2026-6612 CVE-2026-78663 Double flow control refund on HTTP/2 server streams golang.org/x/net v0.61.0
GO-2026-6617 CVE-2026-97032 HTTP/2 server crash due to HPACK encoder race golang.org/x/net v0.61.0
Assets 2
Loading