Release 26.07_3

Zentinel 26.07_3

Cargo version: 0.6.22

What's Changed

Security

• Bump serde_with 3.18.0 → 3.21.0 — fixes GHSA-7gcf-g7xr-8hxj, a serialization
  panic (DoS) in KeyValueMap. Zentinel's exposure was low (transitive via
  ip2location, no KeyValueMap usage), resolved regardless. (#307)

Changed

• Bump tokio-tungstenite 0.29.0 → 0.30.0. (#306)
• Bump jsonschema 0.46.10 → 0.48.1. (#305)
• Bump the rust-minor group (bytes 1.12.1, uuid, regex, sysinfo 0.39.6). (#309)
• Bump the rust-minor group (tokio 1.53, rustls 0.23.42, uuid 1.24,
  regex 1.13.1, http-body-util, toml, clap, redis 1.4.1,
  xxhash-rust). (#310)

Installation

From crates.io

cargo install zentinel-proxy

From binary

Download the appropriate archive for your platform and extract:

tar -xzf zentinel-26.07_3-linux-amd64.tar.gz
sudo mv zentinel /usr/local/bin/

Docker

docker pull ghcr.io/zentinelproxy/zentinel:26.07_3

Supply Chain Security

All release archives are signed with Sigstore cosign using keyless signing tied to GitHub Actions OIDC identity. SLSA v1.0 provenance is attached to this release.

Verify a binary

cosign verify-blob --bundle zentinel-26.07_3-linux-amd64.tar.gz.bundle \
  --certificate-identity-regexp "github.com/zentinelproxy/zentinel" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  zentinel-26.07_3-linux-amd64.tar.gz

Verify the container image

cosign verify ghcr.io/zentinelproxy/zentinel:26.07_3 \
  --certificate-identity-regexp "github.com/zentinelproxy/zentinel" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

Checksums

Verify downloads with the .sha256 files.

Software Bill of Materials

CycloneDX 1.5 and SPDX 2.3 SBOMs are attached as release assets.