Skip to content

v3.14.2

Choose a tag to compare

View all tags
@Vonng Vonng released this 15 Oct 13:32
· 10 commits to main since this release
v3.14.2
c683514
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

silo-pkg v3.14.2 updates the upstream S3 SDK and security dependencies. It is a source-only Go module release for the maintained SILO stack.

Changes

  • Update minio-go to v7.4.1. Failed multipart uploads are cleaned up even after caller cancellation, retention timestamps are serialized in UTC, and STS duration requests are preserved. Projected Kubernetes token files are supported. Parallel GET and ComposeObject remain opt-in.
  • Update go-jose to v4.1.6 for GHSA-mgcc-cww5-fp2q, which addresses excessive CPU use when parsing crafted RSA JWKs.
  • Update LDAP to v3.4.15, msgp to v1.6.5, and etcd client modules to v3.7.2.
  • Update x/crypto to v0.58.0, x/net to v0.61.0, x/sys to v0.49.0, and x/text to v0.43.0. This includes the October x/net HTTP/2 security fixes.
  • Develop and test with Go 1.27.2, golangci-lint v2.14.0, and govulncheck v1.9.0. Retain the Go 1.26 library floor and the go-systemd v22.6.0 NetBSD replacement.

Compatibility and adoption

require github.com/pgsty/silo-pkg/v3 v3.14.2

Public SILO package signatures and existing password-policy semantics are unchanged. go-jose now limits RSA keys parsed from JWKs to 4096 bits by default; consumers with larger identity-provider keys must review that configuration. STS durations below one hour are now sent as requested instead of being raised to one hour, so invalid short durations can be rejected by the server.

Consumers upgrading from before v3.14.0 must still account for its password-authorization split. See the migration guide. This library release does not upgrade an installed Server, Console, or mcli.

Validation

  • Complete lint and race tests on Go 1.27.2; complete race tests on Go 1.26.9.
  • OpenLDAP integration, module tidiness and checksum verification.
  • govulncheck v1.9.0: no reachable or imported-package vulnerabilities. The unused OpenPGP module-only advisory remains. The newly published go-jose advisory was checked directly against upstream in addition to the vulnerability database scan.

Changes since v3.14.1 · PR #10

Released commit: c6835145176f. All main-branch checks passed at this commit: LDAP Config Validator, VulnCheck, Go.

Assets 2
Loading