GateKey v1.15.0

GateKey v1.15.0 moves the Go and Node builds, VPN runtimes, and web runtime to Chainguard images and updates dependencies to address known security advisories.

Changes

• Chainguard Go and Node builders, Wolfi gateway/hub runtimes, and nginx web runtime.
• The control plane retains its nonroot Chainguard static runtime. Existing HTTP ports and VPN networking tools remain supported.
• Go minimum version 1.26.8; updated cryptography, gRPC, OpenTelemetry, and frontend dependencies.
• Obsolete CLI binaries are excluded from the web image; existing download routes remain proxied to the control plane.
• Frontend CI uses Node 26 and enforces TypeScript checks. Release packaging stops when compilation fails.
• Application reverse proxy migrated to Go's Rewrite API, with regression coverage for routing and authenticated identity headers.
• README documents container security and removes the retired Go Report Card badge.

Validation

• All 47 CI jobs and the CodeQL/security workflow passed. Local Go race tests, vet, golangci-lint, and frontend production build passed.
• govulncheck found no vulnerabilities in called code or imported packages; npm audit reported zero vulnerabilities.
• Trivy reported zero findings across all six published container images on both amd64 and arm64 under the existing repository policy on 2026-09-22. The existing exception for the unused, deprecated x/crypto/openpgp package is unchanged. Scan summary and image digests.
• Tested the published server, web, and gateway image digests in k3s context default using the Firestar chainguard-test overlay: server migration/startup, HTTP health, UI rendering, login, authorization, install scripts, and VPN networking tools. This was an isolated test deployment; full external SSO and end-to-end VPN connectivity were not exercised.

Container vulnerability counts can change as new advisories appear. Keep deployments on current releases and rebuild custom images with fresh base images.