v0.37.7 Release 🎉
This patch release addresses the following CVEs: CVE-2026-33811, CVE-2026-39833, CVE-2026-42505, CVE-2026-39830, CVE-2026-25680, CVE-2026-22772, and CVE-2026-49835. It also updates the Go version to 1.25.12, which includes fixes for Go standard library vulnerabilities.
Changelog
- 05822dd New version v0.37.
What's Changed
- [release-v0.37.x] CI: Use goinstall mode for golangci-lint action by @vdemeester in #2990
- [release-v0.37.x] cherry-pick: OWNERS, CI summary, Dockerfile fix by @divyansh42 in #3013
- chore(deps): bump the all group across 1 directory with 3 updates by @dependabot[bot] in #3001
- [release-v0.37.x] cherry-pick: fix alibabacloud-go/cr-20160607 license by @divyansh42 in #3018
- [release-v0.37.x] bump github.com/docker/cli from 29.0.3+incompatible to 29.0.4+incompatible in the go-docker-dependencies group across 1 directory by @dependabot[bot] in #2946
- [release-v0.37.x] fix: resolve golangci-lint errors (cherry-pick from main) by @divyansh42 in #3024
- fix(cve): CVE-2026-42499, CVE-2026-39820 - update Go 1.25.9 to 1.25.10 [release-v0.37.x] by @divyansh42 in #2922
- fix(cve): CVE-2026-39828, CVE-2026-39829, CVE-2026-39830 - update golang.org/x/crypto to v0.52.0 [release-v0.37.x] by @divyansh42 in #2909
- fix(cve): CVE-2026-33811, CVE-2026-39833 - update Go stdlib and x/crypto [release-v0.37.x] by @divyansh42 in #2923
- [release-v0.37.x] bump github.com/sigstore/cosign/v2 from 2.6.2 to 2.6.3 by @dependabot[bot] in #2975
- [release-v0.37.x] bump github.com/creack/pty from 1.1.21 to 1.1.24 by @dependabot[bot] in #2963
- [release-v0.37.x] bump the go-k8s-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #2957
- [release-v0.37.x] bump github.com/google/go-containerregistry from 0.20.7 to 0.20.8 by @dependabot[bot] in #2969
- [release-v0.37.x] bump github.com/tektoncd/hub from 1.17.0 to 1.17.3 by @dependabot[bot] in #3032
- [release-v0.37.x] bump github.com/tektoncd/pipeline from 0.59.5 to 0.59.6 by @dependabot[bot] in #3033
- [release-v0.37.x] bump github.com/sigstore/sigstore from 1.10.3 to 1.10.8 by @dependabot[bot] in #3035
- [release-v0.37.x] bump github.com/sigstore/cosign/v2 from 2.6.3 to 2.6.4 by @dependabot[bot] in #3050
- [release-v0.37.x] bump chainguard-dev/actions/kind-diag from 1.6.26 to 1.6.27 in the all group by @dependabot[bot] in #3053
- [release-v0.37.x] Security: Fix CVE-2026-42505 - update Go to 1.25.12 (crypto/tls ECH privacy leak) by @divyansh42 in #3067
- fix(cve): fix few critical CVEs by @pratap0007 in #3058
- [release-v0.37.x] bump the go-k8s-dependencies group with 3 updates by @dependabot[bot] in #3082
- [release-v0.37.x] bump chainguard-dev/actions/kind-diag from 1.6.27 to 1.6.28 in the all group by @dependabot[bot] in #3076
Full Changelog: v0.37.6...v0.37.7