Fixed in this release
A reachable crash in the HTTP server (GO-2026-6617). A race in the HTTP/2
HPACK encoder in Go's net/http and golang.org/x/net could bring the process
down from a crafted request. The dashboard and The Dispatch are both served
over net/http, so this was reachable by anyone who could open a connection
to either. Fixed by moving the build to Go 1.27.2 and x/net 0.60.0, which
carry the patch in both halves.
The CI security job was pinned to Go 1.25 and could not see a fix that only
existed on newer Go lines, which is how this one hid. Every workflow now follows
the Go version declared in go.mod, so a stdlib advisory turns the job red the
day it is published, not the day someone looks.
Upgrading is the fix. There is no workaround short of not exposing the
dashboard or The Dispatch.
Also in this release. Static analysis bumped to staticcheck 0.8.2, CodeQL
to v4, Vite to 8.2.2 in the dashboard build, and a single aggregate CI gate so
one green check means every job passed. The README now says plainly what runs
on OpenWrt today and what the 1.5 router release will add.