Skip to content

Release 26.06_2

Choose a tag to compare

View all tags
@github-actions github-actions released this 16 Jun 17:17
26.06_2
112e6eb
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Zentinel 26.06_2

Cargo version: 0.6.17

What's Changed

Added

  • Enforce agent request/response body limits and bound per-key limiter state. Agent body inspection now enforces the configured max-request-body-bytes / max-response-body-bytes, and per-key rate-limiter state is bounded so it can no longer grow without limit — closing latent unbounded-growth paths and bringing runtime behavior in line with the Manifesto's "bounded by design" principle. (#273)
  • Route-level retry-policy parsing. The retry-policy block inside a route is now parsed instead of being silently dropped by the KDL parser. max-attempts is honored (it bounds upstream peer-selection attempts); timeout-ms, backoff-base-ms, backoff-max-ms, and retryable-status-codes are parsed but not yet applied at runtime (each logs "parsed, but not implemented"). Resolves the docs↔parser mismatch in #262; the remaining retry behavior is tracked in #279. (#267)

Fixed

  • Bound hidden unbounded state and run pool maintenance. Fixes several latent bugs surfaced during the hardening audit: the agent-pool maintenance loop was never spawned, per-request correlation affinity could leak, and max_series was not enforced. Runtime behavior now matches the documented bounds. (#274)

Security

  • Bump Pingora 0.8.0 → 0.8.1 (cloudflare/pingora release). Brings in two security-relevant changes: bounded default HTTP/2 server limits to mitigate memory exhaustion, and the upstream dev-dep bumps that resolve RUSTSEC-2026-0098 / RUSTSEC-2026-0099 (rustls-webpki). Fork rev bumped to b8d0c00 via zentinelproxy/pingora#4. (#270)

Changed

  • Bump rust-minor group (9 updates). (#276)
  • Bump alpine Docker base 3.23 → 3.24. (#275)

Installation

From crates.io

cargo install zentinel-proxy

From binary

Download the appropriate archive for your platform and extract:

tar -xzf zentinel-26.06_2-linux-amd64.tar.gz
sudo mv zentinel /usr/local/bin/

Docker

docker pull ghcr.io/zentinelproxy/zentinel:26.06_2

Supply Chain Security

All release archives are signed with Sigstore cosign using keyless signing tied to GitHub Actions OIDC identity. SLSA v1.0 provenance is attached to this release.

Verify a binary

cosign verify-blob --bundle zentinel-26.06_2-linux-amd64.tar.gz.bundle \
  --certificate-identity-regexp "github.com/zentinelproxy/zentinel" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  zentinel-26.06_2-linux-amd64.tar.gz

Verify the container image

cosign verify ghcr.io/zentinelproxy/zentinel:26.06_2 \
  --certificate-identity-regexp "github.com/zentinelproxy/zentinel" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

Checksums

Verify downloads with the .sha256 files.

Software Bill of Materials

CycloneDX 1.5 and SPDX 2.3 SBOMs are attached as release assets.

Assets 18
Loading