v1.6.3

A security patch for the 1.6 line, clearing dependency advisories in the web image and in the Go client binaries. No functional change, and nothing here was exploitable against a running deployment — detail below, because a patch billed as security should say what it actually protects you from.

Security

Web image — both are direct-upgrade only; package.json is unchanged since the declared ranges already admitted the fixed versions.

• sharp 0.35.3 → 0.35.4, clearing GHSA-rgj7-g3m4-5g8c (HIGH) — vulnerabilities in libheif. sharp is in the image because Next.js bundles it for image optimisation; Terrapod never invokes that path (no next/image usage, no remotePatterns, no image-upload surface), so the affected decoder is never handed input. Cleared because the package is physically present and an operator scanning the image sees a HIGH regardless.
• js-yaml 4.3.1 → 4.3.2, clearing GHSA-2883-xcg3-v3hh (HIGH) — CPU exhaustion via YAML merge keys. Build-time only; not present in any published image.

Go client binaries — the Terraform provider, terrapod-migrate, terrapod-publish and terrapod-query, which ship as release assets:

Package	Advisory	Severity	Modules
golang.org/x/crypto	CVE-2026-56854	CRITICAL	migrate, publish
google.golang.org/grpc	CVE-2026-84445	HIGH	provider, migrate
golang.org/x/mod	CVE-2026-56864	HIGH	migrate, query

These are client-side binaries you download and run, not server components — none is reachable from a running Terrapod deployment, so the practical exposure is well below what the severities suggest in isolation. They are fixed because the binaries are published artifacts and your scanner will flag the versions.

Only the two gRPC findings had been reported. The rest, including both criticals, were found by adding Go dependency scanning: until now nothing scanned Go at all. Trivy covers the images, and these modules build release assets rather than image contents, so they sat in a gap between the two. CI and the scheduled release re-scan now cover every Go module, which is the more durable outcome of this release.

Upgrading

Drop-in. No API, wire-protocol, configuration, Helm-value or database-schema change — take the new images and, if you use them, the new client binaries.

Status

Stable. 1.6 is the current line. The 1.5 line carries the same Go advisories and will pick up these bumps in its next release.

Full Changelog: v1.6.2...v1.6.3