Skip to content

v0.11.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 15 Oct 07:23
· 32 commits to main since this release
v0.11.2
This tag was signed with the committer’s verified signature.
uplg Léonard.
GPG key ID: 134F9304E6334F65
Verified
Learn about vigilant mode.
d23640a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

A security release: rustls moves to 0.23.46, which fixes four advisories
published on 2026-10-14. Hora uses rustls for its outbound TLS (HTTPS and
TLS probes, notification channels, the release check). No other change.

Security

  • rustls 0.23.46. Fixes RUSTSEC-2026-0346 (Debug output of client
    session values could expose TLS secrets), RUSTSEC-2026-0347 (buffered
    data sent to the outer server after an ECH rejection), RUSTSEC-2026-0348
    (Brotli certificate decompression could allocate up to 1 GiB before
    authentication) and RUSTSEC-2026-0349 (an unauthenticated ServerHello
    could downgrade later connections to classical key exchange). The other
    dependencies take their compatible patch releases (tokio 1.53.3, hyper
    1.12, aws-lc-rs 1.18.2, among others).
Assets 2
Loading