Community
Mercure 1.1.5 is a maintenance release with updated dependencies. Binaries and images are built with Go 1.27.3, which fixes GO-2026-6809 (compromised intermediate certificates are now distrusted in crypto/x509). It also prepares the Hub for automated security scanning.
🔒 Security
- Prepare the Hub for Anthropic's OSS Scanner: add a scanner build image and a threat model describing the Hub's entry points and how we rate severity, and list
contact+security@mercure.rocksfor Hub reports inSECURITY.md. The enrollment itself has not been validated yet. by @dunglas in #1459
📦 Dependencies
Enterprise
Mercure Enterprise v1.1.5 includes the authorization fixes from Mercure 1.1.3 and 1.1.4, so read the 1.1.4 upgrade notes before upgrading a hub running protocol_version_compatibility. It also makes the Redis/Valkey transport more reliable when connections to the server sit idle, and updates dependencies.
Mercure Cloud hubs are upgraded automatically: use Mercure Cloud to get fixes like these without managing upgrades yourself.
Enterprise releases ship under the Enterprise SLA, with prioritized patches and direct support. Contact contact@mercure.rocks for the managed Cloud offering, on-premise licenses, custom development, consulting, and training.
Full Changelog: v1.1.4...v1.1.5