Overview
Important
This is a strongly recommended release for all op-conductor operators. It contains security fixes for the compromised eMudhra certificate authority (CVE-2026-111943), Go and dependency security updates, a move of the image to apko, Raft logs that now follow --log.level, and the removal of unused RPC server metrics.
This release includes the changes tagged as op-conductor/v0.9.5, which was not published separately.
Other changes
Image
- The image is now built with apko on a Wolfi base, replacing the Alpine 3.20 Docker image. It keeps the same contract: the binary is at
/usr/local/bin/op-conductor, the default command isop-conductor, and it still runs as root so the existing Raft data volume stays writable. No deployment changes are needed
Logging
- Raft logs now follow op-conductor's
--log.leveland log format. Previously Raft logged independently to stderr at debug level, which log collectors could classify as errors. With the defaultinfolevel, Raft debug logs are no longer emitted (#22194)
Metrics
- The
op_conductor_rpc_server_*RPC server metrics are no longer emitted. No published dashboard or alert uses them (#23114)
Security
- The image is built with Go 1.26.10, up from Go 1.24.13. Go 1.26.10 makes
crypto/x509reject the compromised eMudhra intermediate certificates (CVE-2026-111943), and the update includes the security fixes in every Go release since 1.24.13 (#23546) quic-gois updated from v0.46.0 to v0.60.0 andwebtransport-gofrom v0.8.0 to v0.11.1, fixing seven vulnerabilities reachable in op-conductor v0.9.4: CVE-2024-53259, CVE-2025-64702 and CVE-2026-40898 inquic-go, and CVE-2026-21434, CVE-2026-21435, CVE-2026-21438 and CVE-2026-57497 inwebtransport-go(#21762, #21854, #22066)- The image's CA trust store (
ca-certificates-bundle20260909-r3) no longer includes the eMudhra emSign Root CA G3, C1 and C3 roots (#23566)
Full Changelog: op-conductor/v0.9.4...op-conductor/v0.9.6
🚢 Docker Image: