Releases: 7Cav/api
Releases · 7Cav/api
2.0.2
Security
Dependency updates addressing 12 Dependabot alerts:
Critical
google.golang.org/grpcv1.72.0 → v1.79.3 (CVE: AuthZ bypass via missing leading slash in:path)
High
github.com/opencontainers/selinuxv1.12.0 → v1.13.0 (CVE-2025-52881: runc container escape via procfs write redirects)github.com/containerd/containerdv1.7.25 → v1.7.29 (local privesc via wide CRI directory permissions)github.com/docker/cliv28.1.1 → v29.2.0 (local privesc via uncontrolled search path on Windows)
Medium
github.com/containerd/containerdv1.7.25 → v1.7.29 (host memory exhaustion, integer overflow in UID handling)github.com/quic-go/quic-gov0.51.0 → v0.57.0 (HTTP/3 QPACK header expansion DoS)golang.org/x/cryptov0.38.0 → v0.46.0 (ssh/agent panic, unbounded memory consumption)github.com/go-chi/chi/v5v5.2.1 → v5.2.2 (host header injection / open redirect)
Low
github.com/redis/go-redis/v9v9.7.0 → v9.7.3 (out-of-order responses on CLIENT SETINFO timeout)filippo.io/edwards25519v1.1.0 → v1.1.1 (invalid MultiScalarMult results)
Other
- Fixed two latent Printf-directive bugs surfaced by Go 1.24 vet