What's Changed
This patch release addresses security vulnerabilities in the Go standard library and in a dependency. There are no configuration or behaviour changes, so upgrading from 2.9.7 needs no config edits.
Refinery 2.x reached the end of its maintenance window on 1 April 2026. This release is a targeted security patch published outside that window, because moving from 2.x to 3.x requires configuration changes rather than a straight version bump. It is not a general dependency refresh. Other dependency vulnerabilities remain in the 2.x line and will not be addressed, so upgrading to Refinery 3 is still the recommended path.
🛠 Maintenance
- maint: upgrade to go1.27.3 for CVE-2026-111943 by @MikeGoldsmith in #1874
- maint: bump golang.org/x/net for HTTP/2 server CVEs by @MikeGoldsmith in #1875
- maint: publish 2.9.x release images to all public registries by @robbkidd in #1879
Full Changelog: v2.9.7...v2.9.8