v1.16.1
This release moves resterm to Go 1.27.3.
Important: Please update. This release blocks certificates from a compromised certificate authority (eMudhra).
Compromised eMudhra certificates
The private keys of eight intermediate certificates from the certificate authority eMudhra were so weak that anyone could recover them from the public certificates. With those keys, anyone can issue a valid HTTPS certificate for any website. eMudhra has revoked the certificates, and browsers and operating systems are blocking them. (CVE-2026-111943, Mozilla's write-up)
resterm 1.16.1 rejects any certificate chain through these intermediates on every platform. resterm 1.16.0 can still accept them on systems whose certificate store doesn't block them yet.
Before you update
macOS 12 Monterey is no longer supported. The macOS binaries need macOS 13 Ventura or newer. On macOS 12, do not run resterm --update, because it installs a binary your system does not support. Instead, build 1.16.1 with Go 1.26.10 or a newer 1.26 release, which has the same certificate fix:
go install github.com/unkn0wn-root/resterm/cmd/resterm@v1.16.1Some TLS-inspecting proxies may drop HTTPS connections. resterm now offers post-quantum (ML-DSA) signature algorithms when it opens a TLS connection. Some proxies and load balancers reset these connections. Reports so far name Palo Alto Prisma Access and F5 BIG-IP (golang/go#81199). If HTTPS requests fail with EOF or connection reset by peer after you update, build with Go 1.26.10.
Fixes
- An SSE stream that stops at its size or event limit now closes its connection right away instead of reading on in the background.
- Go security fixes for net/http, crypto/tls, net/textproto and html/template: CVE-2026-97031, CVE-2026-94440, CVE-2026-97032, CVE-2026-94439, CVE-2026-78663, CVE-2026-78669, CVE-2026-78660, CVE-2026-78667, CVE-2026-56866, CVE-2026-78659, CVE-2026-97030, CVE-2026-94448.
Other changes
- GODEBUG=tlsrsakex=1 and GODEBUG=tls3des=1 no longer turn RSA key exchange or 3DES back on for old servers.