Skip to content

v0.12.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Oct 23:13
· 7 commits to main since this release
v0.12.1
This tag was signed with the committer’s verified signature.
kwisatzh Vijay
GPG key ID: 9272956FD1758DDC
Verified
Learn about vigilant mode.
0d7db95
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

fleetdiff v0.12.1

This security patch rebuilds fleetdiff with Go 1.26.10 for
GO-2026-6809 (CVE-2026-111943).

Go's crypto/x509.Certificate.Verify now rejects chains containing the affected
intermediate certificates. The fix covers the narrow cases where system trust
stores have not been updated to distrust them. Keep system trust stores updated
as well.

The native LiteLLM database export, recorded-usage calculations, summary formats
and offline commands retain their v0.12.0 behavior. CI and release builds use the
patched toolchain; the scheduled security job uses the corresponding Go 1.27.3
fix. The calibration manifest's CI hash tracks the workflow update, with no
change to measurement data or arithmetic.

Documentation-only image generation now uses hash-locked Pillow 13.0.0 and
requires Python 3.11 or newer; this does not affect the fleetdiff runtime.

This release introduces no breaking changes.

After publication, select v0.12.1 with the verified installer and check the
release checksums and provenance for the Linux or macOS archive you install.

Assets 10
Loading