Repository navigation
Desk v0.13.2
Desk updates github.com/go-jose/go-jose/v4 from 4.1.5 to 4.1.6 to address GHSA-mgcc-cww5-fp2q, a denial-of-service risk from excessive CPU use while parsing crafted RSA private JWKs. The updated parser applies a default 4096-bit maximum RSA modulus size.
RSA JWKs above 4096 bits are rejected. If a JWKS contains supported keys and any one of them exceeds this limit, parsing rejects the supported key set, including otherwise valid keys in that set. Operators whose identity provider publishes RSA keys larger than 4096 bits should coordinate key rotation with the provider and confirm that its JWKS contains keys within the supported limit before upgrading. Desk does not provide an override for this cap.
Platforms
This release contains complete Linux/amd64, macOS Apple Silicon (arm64), and
macOS Intel (amd64) archives. All three archives were built and smoke-tested on
native GitHub-hosted runners before publication; neither macOS archive is merely
cross-compiled. Component versions come from the same release lock.
macOS executables are not Developer ID signed or notarized. Gatekeeper may block
downloaded executables; verify the release and checksums, then use Apple's
Privacy & Security → Open Anyway procedure
for the blocked executable. Native CI does not exercise these dialogs. The Codex
subscription subprocess bridge remains Linux-only.
No Windows archive is published. Windows execution is untested, and the managed
installer supports only Linux and macOS.