Table of Contents

• Changelog for 8.0.8

Changes in 8.0.8

Summary

• Security - Bump golang.org/x/image to v0.45.0: #12808
• Security - Bump Go to 1.25.13: #12832
• Bugfix - Fix share metadata corruption during concurrent share operations: #12621
• Bugfix - Cache LDAP instance mapper lookups: #12823
• Enhancement - Add TLS support for NATS store and registry connections: #12765

Details

• Security - Bump golang.org/x/image to v0.45.0: #12808

  Upgraded golang.org/x/image from v0.44.0 to v0.45.0 to address GO-2026-6222:
  excessive memory allocation during VP8L decoding.

  #12808

• Security - Bump Go to 1.25.13: #12832

  Fixes a stdlib CVE vulnerability flagged by the release image scan.

  #12832

• Bugfix - Fix share metadata corruption during concurrent share operations: #12621

  When multiple sharing service replicas processed share operations concurrently
  for the same user, the share metadata could become corrupted with references to
  missing data, making all shares inaccessible to that user. The received share
  cache now uses compare-and-swap (etag) validation to detect concurrent writes
  and retries gracefully, preventing metadata corruption.

  #12621

• Bugfix - Cache LDAP instance mapper lookups: #12823

  In multi-instance deployments, resolving a user's instance name/ID during GET /graph/v1.0/users (and group member expansion) issued a fresh, uncached LDAP
  search per instance/guest attribute value on every request. Under load this
  multiplied into large numbers of redundant LDAP round-trips per page of users,
  saturating the LDAP connection pool and causing request timeouts. The LDAP
  identity backend now caches instance mapper lookups, including negative
  (not-found) results, for a configurable TTL
  (OCIS_LDAP_INSTANCE_MAPPER_CACHE_TTL, default 60s).

  #12823

• Enhancement - Add TLS support for NATS store and registry connections: #12765

  All nats-js-kv store, cache, and service registry connections now support TLS.
  Configure via OCIS_CACHE_ENABLE_TLS, OCIS_PERSISTENT_STORE_ENABLE_TLS, and
  MICRO_REGISTRY_ENABLE_TLS, with corresponding *_TLS_INSECURE and
  *_TLS_ROOT_CA_CERTIFICATE variants per connection type.

  #12765