Security
This release fixes nine security advisories reported by @grische. All operators should upgrade.
| Severity | Advisory | Issue |
|---|---|---|
| Critical | GHSA-cp28-pjjc-j435 | OIDC login vulnerable to ID token replay |
| High | GHSA-jq7f-qgpg-h89m | Session cookie missing the HttpOnly flag
|
| High | GHSA-5x2q-699x-3h63 | OIDC accessClaim not enforced for providers under auth.multiple
|
| Moderate | GHSA-2x34-vgm5-p43r | Session cookie sent on cross-site requests (SameSite=None)
|
| Moderate | GHSA-3r9j-j2hq-jqjq | Cross-user device disclosure (incl. preshared keys) in the in-memory backend |
| Moderate | GHSA-j62x-qc44-h6pj | Race in device IP allocation allows duplicate tunnel IPs |
| Moderate | GHSA-874h-2q53-hqq5 | Metadata sync could resurrect revoked devices |
| Moderate | GHSA-h44x-pmxc-7mc7 | Rolled-back writes emitted spurious peer events on SQLite/MySQL |
| Low | GHSA-57jm-pfvc-fjfm | DNS cache poisoning via duplicate EDNS0 Client Subnet options |
Upgrade notes
- The session cookie is now
HttpOnlyandSameSite=Lax. Existing sessions keep working; the cookie is no longer readable from JavaScript and is no longer sent on cross-site subrequests. - New option
auth.sessionStore.secure(defaultfalse) marks the session cookieSecure. Turn it on if your web UI is only reachable over HTTPS. It is off by default because the UI is also served over plain HTTP onport, where aSecurecookie would silently break login. - OIDC logins now send a
nonce, and it is verified wheneverclaimsFromIDToken: trueis set. Thenonceparameter is mandatory in the OpenID Connect spec; verify your IdP handles it if you run a non-standard one. - Go 1.26 is now required to build from source. Container images are unaffected.
Features
- Expose per-device Prometheus metrics (#1202)
Fixes
- Correct casing for the persistent keepalive configuration (#1121)
- Guard the in-memory store against a concurrent map crash (#1181)
- Force LF line endings for shell scripts via
.gitattributes(#1201) - Drop the no-op
SingleInflightoption from the DNS clients — it has done nothing since miekg/dns v1.1.52
Maintenance
- Dependency updates across Go modules, npm, Docker base images and GitHub Actions
- golangci-lint bumped to v2.13 so it can lint a Go 1.26 module
What's Changed
- Fix casing for persistent keepalive configuration by @T0biii in #1121
- build(deps): bump crate-ci/typos from 1.45.0 to 1.46.0 by @dependabot[bot] in #1131
- build(deps): bump docker/login-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #1132
- build(deps): bump postcss from 8.5.8 to 8.5.13 in /website in the npm_and_yarn group across 1 directory by @dependabot[bot] in #1139
- build(deps): bump node from 25.8.2-bookworm to 25.9.0-bookworm in /proto by @dependabot[bot] in #1138
- build(deps): bump golang from 1.26.1-alpine to 1.26.2-alpine in /proto by @dependabot[bot] in #1137
- build(deps-dev): bump typescript from 6.0.2 to 6.0.3 in /website by @dependabot[bot] in #1136
- build(deps): bump golang.org/x/crypto from 0.49.0 to 0.50.0 by @dependabot[bot] in #1133
- build(deps): bump github.com/coreos/go-oidc/v3 from 3.17.0 to 3.18.0 by @dependabot[bot] in #1129
- build(deps): bump alpine from 3.23.3 to 3.23.4 by @dependabot[bot] in #1128
- build(deps): bump actions/cache from 5.0.3 to 5.0.5 by @dependabot[bot] in #1126
- build(deps): bump docker/build-push-action from 7.0.0 to 7.1.0 by @dependabot[bot] in #1123
- build(deps): bump node from 25.8.2-bookworm to 25.9.0-bookworm by @dependabot[bot] in #1124
- build(deps): bump golang from 1.26.1-alpine to 1.26.2-alpine by @dependabot[bot] in #1122
- build(deps): bump docker/metadata-action from 5.10.0 to 6.0.0 by @dependabot[bot] in #1125
- build(deps): bump react-router-dom from 7.13.2 to 7.14.2 in /website by @dependabot[bot] in #1135
- build(deps): bump react from 19.2.4 to 19.2.6 in /website by @dependabot[bot] in #1127
- build(deps): bump react-dom from 19.2.4 to 19.2.6 in /website by @dependabot[bot] in #1134
- build(deps-dev): bump fast-uri from 3.1.0 to 3.1.2 in /website in the npm_and_yarn group across 1 directory by @dependabot[bot] in #1140
- build(deps): bump react-router from 7.14.2 to 7.16.0 in /website in the npm_and_yarn group across 1 directory by @dependabot[bot] in #1157
- build(deps): bump node from 25.9.0-bookworm to 26.3.0-bookworm in /proto by @dependabot[bot] in #1156
- build(deps): bump golang from 1.26.2-alpine to 1.26.4-alpine in /proto by @dependabot[bot] in #1155
- build(deps): bump date-fns from 4.1.0 to 4.4.0 in /website by @dependabot[bot] in #1153
- build(deps-dev): bump @vitejs/plugin-react from 6.0.1 to 6.0.2 in /website by @dependabot[bot] in #1152
- build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #1150
- build(deps-dev): bump vite-plugin-svgr from 5.0.0 to 5.2.0 in /website by @dependabot[bot] in #1149
- build(deps): bump google.golang.org/grpc from 1.80.0 to 1.81.1 by @dependabot[bot] in #1148
- build(deps): bump gacts/gitleaks from 1.3.1 to 1.3.2 by @dependabot[bot] in #1147
- build(deps): bump golang.org/x/crypto from 0.50.0 to 0.52.0 by @dependabot[bot] in #1146
- build(deps): bump react-router-dom from 7.16.0 to 7.17.0 in /website by @dependabot[bot] in #1151
- build(deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #1145
- build(deps): bump golang from 1.26.2-alpine to 1.26.4-alpine by @dependabot[bot] in #1143
- build(deps): bump crate-ci/typos from 1.46.0 to 1.47.1 by @dependabot[bot] in #1144
- build(deps): bump node from 25.9.0-bookworm to 26.3.0-bookworm by @dependabot[bot] in #1142
- build(deps): bump actions/setup-go from 6.3.0 to 6.4.0 by @dependabot[bot] in #1141
- build(deps-dev): bump vite from 8.0.5 to 8.0.16 in /website in the npm_and_yarn group across 1 directory by @dependabot[bot] in #1158
- build(deps): bump js-yaml from 4.1.1 to 4.2.0 in /website in the npm_and_yarn group across 1 directory by @dependabot[bot] in #1159
- build(deps-dev): bump @vitejs/plugin-react from 6.0.2 to 6.0.3 in /website by @dependabot[bot] in #1176
- build(deps): bump node from 26.3.0-bookworm to 26.4.0-bookworm in /proto by @dependabot[bot] in #1177
- build(deps): update pymdown-extensions requirement from ~=10.21 to ~=11.0 by @dependabot[bot] in #1175
- build(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 in the go_modules group across 1 directory by @dependabot[bot] in #1160
- build(deps): bump github.com/tg123/go-htpasswd from 1.2.4 to 1.2.5 by @dependabot[bot] in #1162
- build(deps): bump node from 26.3.0-bookworm to 26.4.0-bookworm by @dependabot[bot] in #1161
- build(deps): bump docker/metadata-action from 6.0.0 to 6.1.0 by @dependabot[bot] in #1173
- build(deps): bump actions/cache from 5.0.5 to 6.1.0 by @dependabot[bot] in #1172
- build(deps-dev): bump prettier from 3.8.1 to 3.9.4 in /website by @dependabot[bot] in #1171
- build(deps): bump alpine from 3.23.4 to 3.24.1 by @dependabot[bot] in #1163
- build(deps): bump docker/login-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #1169
- build(deps): bump docker/setup-qemu-action from 4.0.0 to 4.2.0 by @dependabot[bot] in #1167
- build(deps): bump github.com/coreos/go-oidc/v3 from 3.18.0 to 3.19.0 by @dependabot[bot] in #1168
- build(deps): bump mobx from 6.15.0 to 6.16.1 in /website by @dependabot[bot] in #1166
- build(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 by @dependabot[bot] in #1164
- build(deps): bump docker/build-push-action from 7.1.0 to 7.3.0 by @dependabot[bot] in #1165
- build(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 by @dependabot[bot] in #1170
- build(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 in the go_modules group across 1 directory by @dependabot[bot] in #1179
- build(deps): bump the npm_and_yarn group across 1 directory with 2 updates by @dependabot[bot] in #1180
- build(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.3.0 by @dependabot[bot] in #1199
- fix(storage): guard in-memory store to prevent concurrent map crash by @grische in #1181
- build(deps-dev): bump brace-expansion from 1.1.12 to 1.1.18 in /website in the npm_and_yarn group across 1 directory by @dependabot[bot] in #1200
- fix: force LF for shell scripts via .gitattributes by @sampletext32 in #1201
- build(deps): bump golang.org/x/crypto from 0.53.0 to 0.55.0 by @dependabot[bot] in #1206
- build(deps): bump the npm_and_yarn group across 1 directory with 3 updates by @dependabot[bot] in #1215
- build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 in the go_modules group across 1 directory by @dependabot[bot] in #1214
- build(deps): bump golang from 1.26.4-alpine to 1.27.1-alpine by @dependabot[bot] in #1203
- build(deps): bump node from 26.4.0-bookworm to 26.8.1-bookworm in /proto by @dependabot[bot] in #1210
- build(deps): bump golang from 1.26.4-alpine to 1.27.0-alpine in /proto by @dependabot[bot] in #1209
- build(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12 by @dependabot[bot] in #1205
- build(deps): bump react and @types/react in /website by @dependabot[bot] in #1192
- build(deps-dev): bump prettier from 3.9.4 to 3.9.6 in /website by @dependabot[bot] in #1193
- build(deps): bump actions/checkout from 6.0.3 to 7.0.1 by @dependabot[bot] in #1183
- build(deps): bump github.com/coreos/go-oidc/v3 from 3.19.0 to 3.20.0 by @dependabot[bot] in #1186
- build(deps): update mkdocs-material requirement from ~=9.7.6 to ~=9.7.7 by @dependabot[bot] in #1189
- build(deps): bump github.com/prometheus/client_golang from 1.23.2 to 1.24.1 by @dependabot[bot] in #1190
- build(deps): bump github/codeql-action/init from 4.32.4 to 4.37.9 by @dependabot[bot] in #1211
- build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1 by @dependabot[bot] in #1208
- build(deps): bump actions/setup-go from 6.4.0 to 7.0.0 by @dependabot[bot] in #1198
- build(deps): bump docker/setup-buildx-action from 4.1.0 to 4.3.0 by @dependabot[bot] in #1213
- build(deps): bump github/codeql-action/analyze from 4.32.4 to 4.37.9 by @dependabot[bot] in #1212
- build(deps): update pygments requirement from ~=2.20.0 to ~=2.21.0 by @dependabot[bot] in #1207
- build(deps): bump node from 26.4.0-bookworm to 26.8.1-bookworm by @dependabot[bot] in #1204
- Expose per-device Prometheus metrics by @sampletext32 in #1202
- build(deps-dev): bump the npm_and_yarn group across 1 directory with 2 updates by @dependabot[bot] in #1217
- build(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 in the go_modules group across 1 directory by @dependabot[bot] in #1216
- chores: update deps by @GoliathLabs in #1218
- linting: fix eslint findings & configure linter by @GoliathLabs in #1219
New Contributors
Full Changelog: v1.0.0...v1.1.0
goliath@Zimtschnecke:~/wg-access-server$