Skip to content

kkRepo 1.3.4

Latest
Latest

Choose a tag to compare

View all tags
@klboke klboke released this 23 Oct 06:05
v1.3.4
18e1bd1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

kkRepo 1.3.4 is a security patch release.

Security

  • Harden login, logout, password, and OIDC return-target validation across server and UI paths. See GHSA-vvvm-fx67-445x.
  • Escape Browse asset download URLs and add a restrictive script-src Content Security Policy. See GHSA-fxj4-cwgv-rcqp.

Upgrade Notes

  • Upgrade every JVM and Native replica to 1.3.4.
  • No database migration is introduced; MySQL and PostgreSQL remain at Flyway V59.
  • Back up the relational database and blob store together before upgrading a production deployment.

Images

  • ghcr.io/klboke/kkrepo:1.3.4
  • ghcr.io/klboke/kkrepo:1.3.4-native
  • ghcr.io/klboke/kkrepo-scanner:1.3.4
Assets 9
Loading