txlog/server v1.34.0

on GitHub

Highlights

This release removes the kernel vulnerability flags (Copy Fail, Dirty Frag and Fragnesia). Vulnerability tracking is now handled exclusively by the OSV pipeline.

These three flags were only the first of a large and still growing group of kernel vulnerabilities. Keeping up with all of them was not feasible, and tracking only the first three gave a false sense of coverage — an asset with no badges looked clean when it simply had not been checked for anything else.

Removed

• Kernel vulnerability flags Copy Fail (CVE-2026-31431), Dirty Frag and
  Fragnesia, along with:
  • the CF/DF/FN badges in the Topology view;
  • the "Vulnerabilities Found" panel in Asset details;
  • the copyfail:true / copyfail:false search keyword;
  • the explanation/copy-fail-detection documentation page;
  • the copy_fail, dirty_frag and fragnesia fields from the execution API
    payload.

Upgrade notes

Agents still sending these fields keep working with no changes required: the unknown JSON keys are simply ignored. Any saved search using copyfail: will no longer match and should be removed.

Changed

• Update Go version to 1.26.6.
• Bump @cloudflare/kumo from 2.8.0 to 2.10.0 and regenerate the minified
  Tailwind CSS and the UI Kit reference page.
• Bump Go dependencies: github.com/bytedance/sonic/loader 0.5.1 → 0.5.2,
  github.com/gabriel-vasile/mimetype 1.4.13 → 1.4.15,
  github.com/go-openapi/swag/* 0.27.3 → 0.28.0,
  github.com/klauspost/compress 1.19.1 → 1.19.2,
  github.com/leodido/go-urn 1.4.0 → 1.5.0,
  github.com/mattn/go-isatty 0.0.23 → 0.0.24,
  github.com/montanaflynn/stats 0.12.2 → 0.12.3,
  github.com/oapi-codegen/runtime 1.6.0 → 1.7.0,
  github.com/quic-go/quic-go 0.60.0 → 0.61.0,
  github.com/rabbitmq/amqp091-go 1.12.0 → 1.13.0,
  github.com/redis/go-redis/v9 9.21.0 → 9.22.0,
  github.com/ugorji/go/codec 1.3.1 → 1.3.2,
  go.yaml.in/yaml/v3 3.0.4 → 3.0.5,
  golang.org/x/arch 0.29.0 → 0.30.0,
  golang.org/x/crypto 0.54.0 → 0.55.0,
  golang.org/x/mod 0.38.0 → 0.40.0,
  golang.org/x/net 0.57.0 → 0.58.0,
  golang.org/x/text 0.40.0 → 0.41.0,
  golang.org/x/tools 0.48.0 → 0.49.0,
  google.golang.org/protobuf 1.36.11 → 1.36.12.

Fixed

• Assets: The /assets page and search no longer return inactive assets
  when searching by machine_id.
• Assets: Fixed an issue where the same hostname could appear multiple times
  in the active assets list if a machine was reprovisioned with a new
  machine_id. Re-claiming a hostname now correctly deactivates the old asset.
• Dashboard: The OS distribution, Agent distribution, and Most updated
  packages charts now correctly consider only the most recent active hostname
  when a machine has been reprovisioned.
• Controllers: Fixed missing rows.Err() checks in root_controller.go to
  ensure proper error handling during database row iteration.

Docker Image

docker pull ghcr.io/txlog/server:v1.34.0

Full Changelog: v1.33.1...v1.34.0