Plik 1.4.3
Hi, today we're releasing Plik 1.4.3, a security release !
The 1.4.2 Docker image is affected by several critical and high severity vulnerabilities
in its Alpine base (OpenSSL CVE-2026-31789, musl, zlib) and in its Go dependencies
(pgx CVE-2026-33815 / CVE-2026-33816, golang.org/x/net, golang.org/x/crypto, gRPC) and
standard library. The 1.4.3 image has no known fixable critical or high vulnerability,
upgrading is strongly recommended.
Here is the changelog:
New:
- PKCE (S256) for all OAuth providers: Google, GitHub and OIDC (#730)
- Display the basic auth credentials in the share card after an upload
Fix:
- Charset-aware decoding in the file viewer (UTF-16 and other non UTF-8 text files)
- CLI: identify OIDC users by their real ID in user/token commands
- Self-host the Inter font instead of loading it from the Google Fonts CDN (@mouddane)
- Helm: add the missing serviceaccount.yaml template (@rupertbenbrook)
- Move the ? tooltips after the toggle switches in the upload sidebar
Misc:
- Docker image based on Alpine 3.24
Dependency upgrades:
- Bump Go to 1.27.3 (crypto/x509 GO-2026-6809), golang.org/x/net to v0.60.0 and golang.org/x/crypto to v0.58.0
- Bump github.com/jackc/pgx/v5 to v5.10.0 (fixes CVE-2026-33815, CVE-2026-33816)
- Bump google.golang.org/grpc to v1.83.2
- Bump gorm to v1.31.2, gorm postgres driver to v1.6.3, gormigrate to v2.1.7
- Bump filippo.io/age to v1.3.2, golang.org/x/oauth2 to v0.37.0, mimetype to v1.4.16
- Webapp security updates (Vue server renderer, DOMPurify, markdown-it, mermaid, lodash-es)
- Bump GitHub Actions: checkout v7, setup-go v7, setup-node v7
Binaries will be built with Go 1.27.3
Faithfully,
The Plik team