Skip to content

v1.34.0

Latest
Latest

Choose a tag to compare

View all tags
@rdeavila rdeavila released this 16 Aug 15:02
v1.34.0
834c32d
This commit was signed with the committer’s verified signature.
rdeavila Rodrigo de Avila
SSH Key Fingerprint: xXq4TkfOzfM1+Vgy+QWSxHVraOXLlPHj0yS7D/MVRvA
Verified
Learn about vigilant mode.

Highlights

This release removes the kernel vulnerability flags (Copy Fail, Dirty Frag and Fragnesia). Vulnerability tracking is now handled exclusively by the OSV pipeline.

These three flags were only the first of a large and still growing group of kernel vulnerabilities. Keeping up with all of them was not feasible, and tracking only the first three gave a false sense of coverage — an asset with no badges looked clean when it simply had not been checked for anything else.

Removed

  • Kernel vulnerability flags Copy Fail (CVE-2026-31431), Dirty Frag and
    Fragnesia, along with:
    • the CF/DF/FN badges in the Topology view;
    • the "Vulnerabilities Found" panel in Asset details;
    • the copyfail:true / copyfail:false search keyword;
    • the explanation/copy-fail-detection documentation page;
    • the copy_fail, dirty_frag and fragnesia fields from the execution API
      payload.

Upgrade notes

Important

A migration drops the copy_fail, dirty_frag and fragnesia columns from
the assets and executions tables. Historical values are discarded on
upgrade — the down migration recreates the columns, but cannot restore the
data.

Agents still sending these fields keep working with no changes required: the unknown JSON keys are simply ignored. Any saved search using copyfail: will no longer match and should be removed.

Changed

  • Update Go version to 1.26.6.
  • Bump @cloudflare/kumo from 2.8.0 to 2.10.0 and regenerate the minified
    Tailwind CSS and the UI Kit reference page.
  • Bump Go dependencies: github.com/bytedance/sonic/loader 0.5.1 → 0.5.2,
    github.com/gabriel-vasile/mimetype 1.4.13 → 1.4.15,
    github.com/go-openapi/swag/* 0.27.3 → 0.28.0,
    github.com/klauspost/compress 1.19.1 → 1.19.2,
    github.com/leodido/go-urn 1.4.0 → 1.5.0,
    github.com/mattn/go-isatty 0.0.23 → 0.0.24,
    github.com/montanaflynn/stats 0.12.2 → 0.12.3,
    github.com/oapi-codegen/runtime 1.6.0 → 1.7.0,
    github.com/quic-go/quic-go 0.60.0 → 0.61.0,
    github.com/rabbitmq/amqp091-go 1.12.0 → 1.13.0,
    github.com/redis/go-redis/v9 9.21.0 → 9.22.0,
    github.com/ugorji/go/codec 1.3.1 → 1.3.2,
    go.yaml.in/yaml/v3 3.0.4 → 3.0.5,
    golang.org/x/arch 0.29.0 → 0.30.0,
    golang.org/x/crypto 0.54.0 → 0.55.0,
    golang.org/x/mod 0.38.0 → 0.40.0,
    golang.org/x/net 0.57.0 → 0.58.0,
    golang.org/x/text 0.40.0 → 0.41.0,
    golang.org/x/tools 0.48.0 → 0.49.0,
    google.golang.org/protobuf 1.36.11 → 1.36.12.

Fixed

  • Assets: The /assets page and search no longer return inactive assets
    when searching by machine_id.
  • Assets: Fixed an issue where the same hostname could appear multiple times
    in the active assets list if a machine was reprovisioned with a new
    machine_id. Re-claiming a hostname now correctly deactivates the old asset.
  • Dashboard: The OS distribution, Agent distribution, and Most updated
    packages charts now correctly consider only the most recent active hostname
    when a machine has been reprovisioned.
  • Controllers: Fixed missing rows.Err() checks in root_controller.go to
    ensure proper error handling during database row iteration.

Docker Image

docker pull ghcr.io/txlog/server:v1.34.0

Full Changelog: v1.33.1...v1.34.0

Assets 2
Loading