v0.45.3 Release 🎉
This release includes security fixes, Go toolchain updates, dependency upgrades, and improvements to plugin security, bundle processing, and Tekton release handling.
Security Fixes
- Fix CVE-2026-84304 (gRPC-Go): Updated gRPC-Go dependencies to address the reported security vulnerability. (#3332, #3346)
- Update Go toolchain to address CVEs: Updated Go from 1.26.6 to 1.26.10 to address CVE-2026-111943. (#3370)
- Prevent excessive memory allocation: Fixed unbounded tar layer allocation during bundle processing. (#3229)
- Harden plugin directory validation: Reject relative plugin directories to prevent unintended current-working-directory fallback (CWE-426). (#3219)
- Improve bundle security: Gate name.Insecure behind the --remote-skip-tls flag to address CWE-319. (#3231)
- Improve plugin validation: Add an executable-bit check when locating plugins. (#3237)
Dependency Updates
- gRPC-Go: Updated google.golang.org/grpc from 1.82.1 to 1.82.2, followed by an update to v1.83.2. (#3194, #3346)
- Go JOSE: Updated github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.5, followed by an update to 4.1.6. (#3216, #3363)
- Sigstore: Updated github.com/sigstore/sigstore from 1.10.9 to 1.10.11. (#3288)
- Kubernetes and Go dependencies: Updated dependencies in the Go/Kubernetes dependency group. (#3172, #3317)
- Additional dependencies: Updated two dependencies through the automated dependency update group. (#3347)
Improvements and Maintenance
- Version management: Updated the CLI version to the latest patch version. (#3202)
- Tekton release resolution: Updated Tekton release references and fixed a ConfigMap timing issue. (#3323)
- CI diagnostics: Updated chainguard-dev/actions/kind-diag through versions 1.6.32, 1.6.33, 1.6.34, 1.6.35, 1.6.36, 1.6.37, and 1.6.41. (#3168, #3191, #3213, #3250, #3286, #3308, #3364)
- Developer workflows: Added slash command workflows for rebasing and cherry-picking changes. (#3223)
Changelog
- 752f827 New version v0.45.3
Full Changelog: v0.45.2...v0.45.3