This release is built with Go 1.26.10 to address CVE-2026-111943.
Certificate verification now rejects chains containing eight revoked eMudhra intermediate certificates whose private keys were compromised.
The blocked intermediates are:
- Domain-validated TLS:
EM DV TLS CA - G3BandEM DV TLS CA - G3C - Organization-validated TLS:
EM OV TLS CA - G3BandEM OV TLS CA - G3C - Extended-validation TLS:
EM EV TLS CA - G3BandEM EV TLS CA - G3C - Code signing:
EM OV CS CA - G3BandEM OV CS CA - G3C
The G3B intermediates belong to eMudhra BV, and the G3C intermediates belong to eMudhra Inc. See the eMudhra Intermediate CA Compromise for more details.
There are no functional changes in geoip-updater itself compared to v1.13.0.
Full Changelog: v1.13.0...v1.13.1