v1.14.2 — Patch a high-severity npm advisory in the container base image
·
39 commits
to main
since this release
Immutable
release. Only release title and notes can be modified.
Patch a high-severity npm advisory in the container base image.
This patch re-pins the container base image to clear a fixable high-severity advisory. It carries the post-quantum certificate migration and security hardening of the v1.14 line unchanged.
Security
- Bump the container base image to clear CVE-2026-14257 — The runtime base image is re-pinned to a Chainguard rebuild carrying npm 12.0.1-r2, clearing a fixable high-severity brace-expansion denial-of-service advisory (CVE-2026-14257) bundled in npm. npm is not used at runtime; the image ships no known fixable high-severity vulnerabilities.