Skip to content

Containly 2.6.2

Choose a tag to compare

View all tags
@amslertec amslertec released this 16 Oct 09:57
· 7 commits to main since this release
v2.6.2
45b2e2d

Security

  • Base image moved to Alpine 3.23. Both build stages of the app and demo images now use
    node:22-alpine3.23 pinned by digest (Node.js 22.23.3), with current OS package fixes applied
    at build time.
  • Samba client 4.22.10 fixes CVE-2026-2340. The SMB client used for SMB backup targets moves
    from 4.21.9 to 4.22.10-r0, the Alpine release that fixes CVE-2026-2340. SMB backups keep running
    through the same confined, encrypted SMB3 client; it was re-tested against a real Samba server.
  • OpenLDAP libraries 2.6.13 (were 2.6.8), pulled in by the Samba client. Some scanners report
    CVE-2026-22185 against this package; that issue is in the LMDB mdb_load tool, which the
    OpenLDAP package does not build and Containly never runs.
  • Known findings without an upstream fix: CVE-2025-60876 (BusyBox wget) and CVE-2025-62813
    (lz4) have no fixed package in Alpine yet. Containly does not call wget, and lz4 is only a
    library dependency of the Samba client with no fixed release available; both will be picked up
    automatically by the next image build once Alpine ships a fix.

Full changelog: v2.6.1...v2.6.2

Assets 2
Loading