Skip to content

v3.1.2

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 20 Oct 13:45
· 7 commits to main since this release
v3.1.2
fb2783d

Security rebuild. Same code as v3.1.1 — no behaviour change, no dependency change, no configuration change. The only reason this release exists is the toolchain the binaries are compiled with.

Why

The v3.1.1 binaries were built with go1.26.7 and therefore carry three fixable HIGH advisories in the Go standard library linked into them. All three are denial-of-service issues, and they are not purely theoretical here: fpm-exporter serves Prometheus metrics over HTTP on :9114.

CVE Package Issue
CVE-2026-78667 net/http DoS via crafted HTTP Range headers
CVE-2026-78669 net/http2 DoS via excessive HTTP/2 SETTINGS frames
CVE-2026-97031 crypto/tls DoS via multiple ECH outer extension references

All three are fixed in go1.26.9. These binaries are built with go1.26.10.

What changed

  • GO_VERSION → 1.26.10 in release.yml and test.yml. Release builds run at the tag's ref, so the pin has to live on this branch.
  • toolchain go1.26.10 added to go.mod. The CI pin only governs CI; without a floor in the module itself a local go build on an older toolchain silently produces a binary carrying the same advisories. The go directive stays at 1.25.0, so the module's minimum language version is unchanged.
  • sbom.json regenerated. v3.1.1 reported golang.org/x/sys@v0.32.0 and golang.org/x/text@v0.21.0 while its own go.mod pinned v0.47.0 and v0.41.0 — the dependency bump in #19 landed without regenerating the SBOM. Only those two versions and their hashes change; no dependency moves.

No Go source file differs from v3.1.1.

Verification

Both published Linux binaries embed go1.26.10 (go version -m), and scanning them the way downstream image CVE gates do reports zero findings:

trivy rootfs --severity CRITICAL,HIGH --ignore-unfixed fpm-exporter-linux-amd64   # 0
trivy rootfs --severity CRITICAL,HIGH --ignore-unfixed fpm-exporter-linux-arm64   # 0

The same scan against the v3.1.1 binary reports the three CVEs above.

Full gate green on the release commit: gofmt, go mod tidy no-op, go vet, go test -race -cover, golangci-lint v2.12.2 (0 issues), govulncheck (no vulnerabilities), license-check, make sbom-check, and the full linux/darwin × amd64/arm64 build matrix.

Checksums

69b78e1ffbb6f1e9bc31b84a257d0379f1c58b039d6bcb9c3473e9c225237940  fpm-exporter-linux-amd64
b6e53628030d63bd5503faa7f8227de7fc1762f3b13b81fbad7879f4c9738b9d  fpm-exporter-linux-arm64

checksums.txt covers every published asset.

Note on lineage

Cut from the v3.1.1 tag, not from main. main carries the phpfpm-library refactor and six other unreleased commits, so it could not ship as a no-behaviour-change patch. The equivalent toolchain fix for main is #23.

Assets 7
Loading