v0.37.8 Release 🎉
This release includes security fixes, Go standard library updates, dependency upgrades, and improvements to plugin handling and bundle processing.
What's Changed
Security Fixes
- Fix Go standard library CVEs: Updated Go from 1.25.13 to 1.26.10 to address CVEs. (#3137, #3371)
- Fix gRPC-Go security vulnerabilities: Updated gRPC-related dependencies to address security advisories. (#3133, #3330, #3372)
- Prevent insecure bundle handling: Gate name.Insecure behind the --remote-skip-tls flag to address CWE-319. (#3234)
- Harden plugin directory validation: Reject relative plugin directories to prevent unintended current-working-directory fallback (CWE-426). (#3226)
- Prevent excessive memory allocation: Fix unbounded tar layer allocation during bundle processing. (#3235)
- Improve plugin security: Add an executable-bit check when locating plugins. (#3239)
Dependency Updates
- Sigstore: Updated github.com/sigstore/sigstore from 1.10.8 to 1.10.9, and subsequently to 1.10.11. (#3104, #3292)
- Cosign: Updated github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5. (#3112)
- Go container registry: Updated github.com/google/go-containerregistry from 0.21.7 to 0.21.9. (#3113)
- gRPC-Go: Updated google.golang.org/grpc to v1.83.2 to address CVE-2026-84304. (#3372)
- Kubernetes and Go dependencies: Updated dependencies in the Go/Kubernetes dependency group. (#3173, #3310)
CI/CD and Developer Workflow Improvements
-
Updated chainguard-dev/actions/kind-diag through versions 1.6.29, 1.6.30, 1.6.31, 1.6.32, 1.6.33, 1.6.34, 1.6.35, 1.6.36, 1.6.37, 1.6.40, and 1.6.41. (#3092, #3117, #3148, #3165, #3188, #3210, #3257, #3285, #3305, #3342, #3361)
-
Added slash command workflows for rebasing and cherry-picking changes. (#3225)
-
Updated Tekton release references and fixed a ConfigMap timing issue. (#3335)
Changelog
- 8e0f636 New version v0.37.8
Full Changelog: v0.37.7...v0.37.8