Skip to content

Version 1.4.1

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 23 Oct 03:17
v1.4.1
b875b84
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release Build (from refs/tags/v1.4.1/b875b84c446539b2bd6fdf66db459afe0f7f649b)

This is a security release. certstrap's code is unchanged since v1.4.0. Only the Go toolchain and dependencies changed.

Upgrade notes

  • Release binaries are built with Go 1.27.3. The v1.4.0 binaries were built with Go 1.24.13, which no longer gets security fixes. Upgrading fixes standard library denial-of-service bugs that hostile input could trigger, such as unbounded recursion in encoding/asn1 (GO-2026-5972), which CSR parsing reaches.
  • Go 1.27.3 or later is required to build certstrap from source or to import its packages. Go 1.27.3 adds a crypto/x509 denylist of compromised intermediate certificates (GO-2026-6809). That matters for programs that call pkix.Certificate.VerifyHost. The certstrap CLI doesn't call it.
  • Dependencies: go.step.sm/crypto 0.91.0 and golang.org/x/crypto 0.58.0.

What's Changed

Full Changelog: v1.4.0...v1.4.1

Contributors

mbyczkowski
Assets 8
Loading