Skip to content

v3.1.47

Choose a tag to compare

View all tags
@svaroqui svaroqui released this 01 Nov 22:50
· 199 commits to develop since this release
v3.1.47
a8cab4b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security release

Advisories fixed

  • Unauthenticated dashboard token / MCP settings admin-password exposure (GHSA-9r6c-2h3q-mh4w)
  • Replayable database-jobs secret-login (GHSA-vvqx-3fmg-9956)
  • Account password in the GitLab OAuth callback redirect URL (GHSA-6cx4-fvqw-7rh6)
  • Database account passwords exposed in clear in served text (GHSA-fxx6-cm45-c7wg)

Dependency / toolchain

  • Build moved to the Go 1.26 line (go 1.26.10); x/crypto, x/net and otel bumped, clearing the exploitable Go standard-library entries from the SBOM.

See the SBOM attached to this release for the full vulnerability analysis.

Assets 9
Loading