Overview
Important
This is a recommended release for all operators. It updates a dependency, the Go toolchain and the image's base packages to fix vulnerabilities that image scanners can report against v1.6.5, including CVE-2026-116591 and CVE-2026-84243. None of the vulnerable code is reachable in op-dispute-mon, and there are no other operator-visible changes.
Other changes
Security
github.com/klauspost/compressis updated to v1.20.2, fixing CVE-2026-116591 (GHSA-fpmh-frq8-7rj8), a panic in the zstd decoder on two-block frames. op-dispute-mon uses this decoder only to unpack its compiled-in superchain registry, so no external input reaches it (#23965)- The image ships Wolfi's
glibc-2.44andlibcrypt1-2.442.44-r18, which fix CVE-2026-84243 inlibcrypt1(fixed in2.44-r16) - op-dispute-mon is built with Go 1.26.11, whose security fixes include CVE-2026-97054 in
net/http. op-dispute-mon serves no HTTP handler wrapped inMaxBytesReaderorMaxBytesHandler, so it was not exposed. The other fixes are build-time cgo issues
Full Changelog: op-dispute-mon/v1.6.5...op-dispute-mon/v1.6.6
🚢 Docker Image: