Skip to content

silo-pkg v3.16.0

Latest
Latest

Choose a tag to compare

View all tags
@Vonng Vonng released this 08 Nov 14:16
v3.16.0
This tag was signed with the committer’s verified signature.
Vonng Feng Ruohang
GPG key ID: E7935D8DB9BD8B20
Verified
Learn about vigilant mode.
b7aeea8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

silo-pkg v3.16.0 updates the shared dependency baseline while preserving public package APIs and IAM policy semantics. Consumers require Go 1.27.3.

  • Upgrade go-jose/v4 from v4.1.6 to v4.1.9, including the five security fixes in v4.1.7 and the subsequent OpaqueSigner and unsupported-key error fixes. Applicability of individual advisories depends on the consuming application's JOSE usage.
  • Publish x/net v0.62.0 and x/crypto v0.58.1-0.20261009181718-2f1f834330b2, which were already selected by the maintained application roots.
  • Upgrade cpuid/v2 to v2.4.2 for correct XSAVE/OSXSAVE detection and YAML v3 to v3.0.6 so literal << configuration keys survive save/load.
  • Refresh the English and Chinese READMEs and clarify the existing infraAdmin batch-job permissions.

Go 1.27.3, the upstream minio-go selection v7.4.2-0.20261025165926-320af050c445, and the output/NetBSD compatibility pins are retained. This is a source-only Go module release, with no binary or container image. Server, Console and mcli must adopt v3.16.0 and rebuild independently.

go get github.com/pgsty/silo-pkg/v3@v3.16.0
go mod tidy

Validation: full lint and race tests, live LDAP CI, module verification and tidy checks, plus the exact go-jose and coreos OIDC dependency race suites. The new YAML round-trip regression fails with v3.0.5 and passes with v3.0.6. govulncheck reported no vulnerabilities; this is the scanner's result, not a claim that every dependency advisory is reachable or irrelevant.

Release source: b7aeea85e84e8888d6ab424c7123a1297711bc3f.

Assets 2
Loading