1.8.4 (2026-10-22)
Bug Fixes
Security / CVE Fixes
Updates gcr.io/distroless/static:nonroot container base image digests to remove distrusted emSign ECC Root CA - G3 and AAA Certificate Services root certificates (ca-certificates), bumps the default Cloud SQL Auth Proxy image to v2.26.3, and updates dependencies:
| Advisory | CVE | Description | Affected Component | Fixed Version |
|---|---|---|---|---|
| GO-2026-6809 | CVE-2026-111943 | Distrust compromised intermediate certificates in crypto/x509 and container OS root CA bundle (ca-certificates)
| gcr.io/distroless/static:nonroot, default proxy image
| distroless@d620678, cloud-sql-proxy:2.26.3
|
| GO-2026-6617 | CVE-2026-78659 | Multiple HTTP/2 and networking vulnerabilities in golang.org/x/net
| golang.org/x/net
| v0.61.0
|