fabriziosalmi/certmate v2.55.1

v2.55.1 (security updates for the image, and two fixes)

on GitHub

v2.55.1 (security updates for the image, and two fixes)

A patch release. It adds no feature and the API contract stays at 2.61. The image published as v2.55.0 carries the three security findings below, and this one does not.

• Security: libbrotli1 1.1.0-2+deb13u1 (CVE-2026-111497, critical in Trivy). The library is in the image as a dependency of curl. A build that reused the apt layer from the registry cache kept the earlier 1.1.0-2+b7 on a Dockerfile that had not changed, so the Dockerfile now upgrades libbrotli1 in the same step as perl-base (#1390).
• Security: pyasn1 0.6.5 (GHSA-2qm8-x737-gmw5, GHSA-9m75-vc3g-4x39, GHSA-fm9c-5rcf-2q5p and GHSA-mm57-4v3p-rchx, all high). Versions up to 0.6.4 decode some BER, CER and DER structures in quadratic time (#1390).
• Security: joserfc 1.7.7 (GHSA-9pg5-8c7x-5hfx, medium). Before 1.7.6 a compact JWS is allocated before its size is checked (#1390).
• Fix: the email given when a local user is created is kept (#1384, #1387). The create form sent it and the server dropped it, so settings.json held null and an existing account could not be linked by OIDC with just-in-time provisioning off. The server keeps it and refuses an address that is not valid, on create and on update (an empty value on update still clears it). The user list has a new action to set or change the email.
• Fix: a certificate that never had a CA recorded gets the one that renews it (#1383, #1391). A certificate issued before ca_provider existed renewed without ever writing it, so the inventory kept saying it was issued before CertMate stored it. After a successful renewal the CA is read from the server line of the certificate's own renewal configuration and recorded when it is a directory CertMate pins (Let's Encrypt, its staging directory, ZeroSSL, Google, SSL.com, Actalis). It is never taken from the default CA, and a private CA or a directory set per account is left unrecorded. A certificate gets it at its next renewal, not before.
• Fix: the inventory calls a certificate at a managed domain managed (#1378), not "issued by CertMate".
• Dependencies: boto3 1.43.118 with botocore 1.43.123, sqlalchemy 2.1.6, the vendored Alpine at 3.17.5 (@alpinejs/csp), and the GitHub Actions the workflows pin by commit (#1388, #1381, #1389, #1382).

Under the hood: scripts/regenerate_lockfiles.sh hands its arguments to uv for the two locks the image installs from, so --upgrade-package NAME works, where it was ignored; the Homebrew tap job taps homebrew/core before it installs (#1377).