Skip to content

v2026.6.8

Choose a tag to compare

View all tags
@github-actions github-actions released this 25 Jun 11:23
v2026.6.8
8c59b9d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security

  • Bumped dompurify to 3.4.11 in the dashboard frontend (GHSA-cmwh-pvxp-8882). DOMPurify 3.4.10, pulled transitively by posthog-js, had a moderate ALLOWED_ATTR pollution issue via setConfig() (an incomplete fix of the 3.4.7 hook-pollution patch); 3.4.11 is the patched release. It resolves within posthog-js's existing ^3.3.2 range, so no posthog-js change was needed and the dashboard build is unaffected.
  • Confirmed the pydantic-settings bump to 2.14.2 shipped in 2026.6.7 resolves GHSA-4xgf-cpjx-pc3j (NestedSecretsSettingsSource symlink read, bypassing secrets_dir_max_size); no further change required.
Assets 4
Loading