Gatekeeper Policy Manager release v2.1.1

Welcome to the release of Gatekeeper Policy Manager v2.1.1, maintained with ❤️ by the team SIGHUP by ReeVo.

This is a security release. It stops GPM from trusting the eMudhra intermediate certificates whose private keys are compromised, and it fixes vulnerabilities in the Go standard library and in golang.org/x/net. We recommend that all users upgrade.

Security fixes 🔒

• GPM no longer trusts the compromised eMudhra intermediate certificates. The private keys of eight eMudhra intermediate CAs are compromised. An attacker with one of these keys can make a certificate for any host name. GPM connects over HTTPS to your OIDC provider, or to the JWK set of your authenticating proxy, to get the keys that sign your users' tokens. The v2.1.0 image trusts these intermediates, because its root store holds AAA Certificate Services and emSign ECC Root CA - G3. Thus an attacker can impersonate your identity provider and sign tokens that GPM accepts. GPM is now built with Go 1.26.10, which rejects these intermediates also when the root store trusts their roots. The image also uses the current distroless base, which no longer holds the two roots. For more information, read the eMudhra intermediate CA compromise report.
• Go 1.26.10 fixes vulnerabilities in the standard library. The fixes are in net/http, crypto/tls, html/template and net/textproto (GO-2026-6599 to GO-2026-6617).
• golang.org/x/net v0.60.0 fixes five vulnerabilities. These are GO-2026-6603, GO-2026-6610, GO-2026-6611, GO-2026-6612 and GO-2026-6617.

Other changes

• Dependency updates. k8s.io/client-go, k8s.io/api and k8s.io/apimachinery 0.37.1, github.com/labstack/echo/v4 4.16.0, github.com/yuin/goldmark 1.8.6, and Alpine.js 3.17.4.

Upgrade procedure

This release needs no action. Update the image tag, then apply the manifests or upgrade the Helm release as usual.