Skip to content

v1.5.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 28 Jul 22:53
· 70 commits to main since this release
Immutable release. Only release title and notes can be modified.
v1.5.1
This tag was signed with the committer’s verified signature.
CybotTM Sebastian Mendel
SSH Key Fingerprint: NOxv8dcZlMFz3wrLdHILVNSnF6xskqAjN3bnn0i7K30
Verified
Learn about vigilant mode.
f68381b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

A maintenance release. No feature changes and no behaviour changes; the substance is a toolchain bump that clears real advisories, and two quality gates that were reporting less than they appeared to.

Security

The Go toolchain moves to 1.26.5 (module go 1.26, toolchain go1.26.5). This clears the standard-library advisories govulncheck reported as affecting the binary — among them GO-2026-5856 (crypto/tls), GO-2026-5039 (net/textproto), GO-2026-5037 (crypto/x509) and GO-2026-4971 (net).

Not a security fix, despite appearances

gosec became a blocking check and flagged four sites here. None was a defect. They previously carried //nolint:gosec comments, which only golangci-lint reads; they now carry #nosec annotations that state a reason gosec itself records. No code behaviour changed.

  • G402 (TLS verification disabled) — TLSSkipVerify is a plain bool, default false, set only by an operator through LDAP_TLS_SKIP_VERIFY / --tls-skip-verify, and enabling it logs a startup warning. It is never derived from request data.
  • G404 (weak randomness) — supplies backoff jitter in internal/retry. No token, nonce or session ID.
  • G103 (unsafe) ×2 — the test-fixture helpers write simple-ldap-go's unexported Object.dn/cn through reflection, because that library exposed no constructor taking them. It now has one as of v1.14.0; the unsafe goes once that release is picked up here.

Mutation testing was measuring nothing

The *_templ.go sources are generated and not committed, so gremlins could not compile internal/web/templates — nor internal/web and cmd/ldap-manager, which depend on it. It reported the three as [build failed] and stopped without producing a score at all, so the job published 0% and stayed green. internal/web is the handler, auth and routing layer.

The run now generates the templ sources first, and a build failure fails the job instead of passing silently. First score over the full tree: 57.07%.

Dependencies

github.com/gofiber/storage/bbolt/v2 v2.1.8 → v2.1.9.

Full changelog: v1.5.0...v1.5.1

Assets 37
Loading