Security
- Engine: bump the Go toolchain to 1.26.7 and
golang.org/x/mod to v0.40.0, and digest-pin the rds-refresh Alpine base image (!1183)
- Engine: bump
golang.org/x/crypto to v0.55.0 (!1184)
- Engine: track the
docker-cli 29.x series instead of an exact -rN pin, so image rebuilds pick up upstream security releases (!1152, !1186)
- CE UI: bump
cypress to 15.x, which drops the extract-zip and enquirer advisories that had no upstream fix (!1184)
- CE UI: refresh the
pnpm overrides for dompurify, qs, nanoid and @babel/core (!1184)
- CE UI: add the
postcss, brace-expansion, form-data, tmp, fast-uri, immutable, js-yaml and ws overrides (!1186)
- CE UI: pin
vite to 6.4.3, fixing a server.fs.deny bypass and an NTLMv2 hash disclosure through launch-editor (!1186)
Internal
- CI: install
google-cloud-cli instead of the retired google-cloud-sdk package, which no longer resolves on Debian trixie (!1183)
Full diff
Diff between versions 4.1.3 and 4.1.4
