A security patch for the 1.6 line, clearing dependency advisories in the web image and in the Go client binaries. No functional change, and nothing here was exploitable against a running deployment — detail below, because a patch billed as security should say what it actually protects you from.
Security
Web image — both are direct-upgrade only; package.json is unchanged since the declared ranges already admitted the fixed versions.
sharp0.35.3 → 0.35.4, clearing GHSA-rgj7-g3m4-5g8c (HIGH) — vulnerabilities in libheif.sharpis in the image because Next.js bundles it for image optimisation; Terrapod never invokes that path (nonext/imageusage, noremotePatterns, no image-upload surface), so the affected decoder is never handed input. Cleared because the package is physically present and an operator scanning the image sees a HIGH regardless.js-yaml4.3.1 → 4.3.2, clearing GHSA-2883-xcg3-v3hh (HIGH) — CPU exhaustion via YAML merge keys. Build-time only; not present in any published image.
Go client binaries — the Terraform provider, terrapod-migrate, terrapod-publish and terrapod-query, which ship as release assets:
| Package | Advisory | Severity | Modules |
|---|---|---|---|
golang.org/x/crypto
| CVE-2026-56854 | CRITICAL | migrate, publish
|
google.golang.org/grpc
| CVE-2026-84445 | HIGH | provider, migrate
|
golang.org/x/mod
| CVE-2026-56864 | HIGH | migrate, query
|
These are client-side binaries you download and run, not server components — none is reachable from a running Terrapod deployment, so the practical exposure is well below what the severities suggest in isolation. They are fixed because the binaries are published artifacts and your scanner will flag the versions.
Only the two gRPC findings had been reported. The rest, including both criticals, were found by adding Go dependency scanning: until now nothing scanned Go at all. Trivy covers the images, and these modules build release assets rather than image contents, so they sat in a gap between the two. CI and the scheduled release re-scan now cover every Go module, which is the more durable outcome of this release.
Upgrading
Drop-in. No API, wire-protocol, configuration, Helm-value or database-schema change — take the new images and, if you use them, the new client binaries.
Status
Stable. 1.6 is the current line. The 1.5 line carries the same Go advisories and will pick up these bumps in its next release.
Full Changelog: v1.6.2...v1.6.3