Skip to content

v1.4.2

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 18 Aug 07:29
· 15 commits to main since this release
v1.4.2
This tag was signed with the committer’s verified signature.
mattrobinsonsre
SSH Key Fingerprint: IFGyNlxfCbw6q+3Ja0XdM/yJzGiwR4LD4LjQdptX83U
Verified
Learn about vigilant mode.
89ed06b
This commit was signed with the committer’s verified signature.
mattrobinsonsre
SSH Key Fingerprint: IFGyNlxfCbw6q+3Ja0XdM/yJzGiwR4LD4LjQdptX83U
Verified
Learn about vigilant mode.

A security patch for the v1.4 line. No features, no behaviour changes — the fix without the features, which is what a patch on an older line is for.

Operators on v1.4.x should upgrade. Operators on v1.5.0 are unaffected and need do nothing: it was scanned alongside this and reported no findings.

Security

Clears every finding the scheduled re-scan reported against v1.4.1 — 19 HIGH, all with fixes available upstream that did not exist, or were not taken, when v1.4.1 was cut.

  • Go standard library (8 HIGH) — the terrapod-query binary baked into the api and runner images was built with Go 1.26.5. Now built with 1.26.6, clearing CVE-2026-33818, CVE-2026-39821, CVE-2026-46600, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860 and CVE-2026-56862.

  • Debian base packages (11 HIGH) — the util-linux family (bsdutils, libblkid1, liblastlog2-2, libmount1, libsmartcols1, libuuid1, login, mount, util-linux) for CVE-2026-53615, and libpq5 / postgresql-client-17 for CVE-2026-6473.

    These were fixed upstream in Debian after v1.4.1 was built on 13 August; rebuilding the line is what brings them in. CI dates the images' package-refresh daily, so this is the expected shape of an ageing release rather than anything stuck — and it is exactly what the scheduled re-scan exists to surface.

  • pip's vendored bundle — refreshing the base image surfaced setuptools 70.3.0 (CVE-2025-47273) and msgpack 1.1.2 (GHSA-6v7p-g79w-8964) inside pip/_vendor. Not fixable by upgrading — the current pip vendors exactly those versions — so pip is now removed from the runtime images, which do not use it. The packages Terrapod actually imports were already clean.

Verified against the published image with the same scanner settings the release gate uses: zero HIGH or CRITICAL findings.

Upgrade notes

Drop-in. No migrations, no configuration changes, no API, Helm-value or wire-protocol changes. helm upgrade to chart 1.4.2.

Full Changelog: v1.4.1...v1.4.2

Assets 46
Loading