From 2ee371e3668bbfead47468bae8502912046a2f15 Mon Sep 17 00:00:00 2001 From: Sanika Chavan Date: Thu, 21 Aug 2025 13:08:22 +0530 Subject: [PATCH 1/7] Update security-scan.hcl --- .release/security-scan.hcl | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/.release/security-scan.hcl b/.release/security-scan.hcl index 643dab20..8e5b5b07 100644 --- a/.release/security-scan.hcl +++ b/.release/security-scan.hcl @@ -5,6 +5,14 @@ container { dependencies = true alpine_secdb = true secrets = true + triage { + suppress { + vulnerabilites = [ + "CVE-2024-58251", # fix unavailable at time of writing + "CVE-2025-46394" # fix unavailable at time of writing + ] + } + } } binary { @@ -13,4 +21,4 @@ binary { osv = true oss_index = false nvd = false -} \ No newline at end of file +} From 04d83b5be9a071ab0da5833f86bd715da2c6dfe8 Mon Sep 17 00:00:00 2001 From: Sanika Chavan Date: Thu, 21 Aug 2025 13:25:03 +0530 Subject: [PATCH 2/7] Update CHANGELOG.md --- CHANGELOG.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index fb9e8010..51279d7b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,14 @@ ## v0.13.3 (Jan 17, 2025) +SECURITY: +* Critical Golang vulnerability in v0.13.3 [[GH-380](https://github.com/hashicorp/envconsul/pull/380)] + +IMPROVEMENTS: +* Update Golang from 1.22 to 1.24.6 [[GH-368](https://github.com/hashicorp/envconsul/pull/368)] + +## v0.13.3 (Jan 17, 2025) + SECURITY: * Critical Golang vulnerability in v0.13.2 [[GH-366](https://github.com/hashicorp/envconsul/pull/366) From 9d20fe306c7992d101681c5de0ec65ae42be3820 Mon Sep 17 00:00:00 2001 From: Sanika Chavan Date: Thu, 21 Aug 2025 13:25:35 +0530 Subject: [PATCH 3/7] Update CHANGELOG.md --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 51279d7b..1f1c9fc3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,6 @@ ## envconsul CHANGELOG -## v0.13.3 (Jan 17, 2025) +## v0.13.4 (Jan 17, 2025) SECURITY: * Critical Golang vulnerability in v0.13.3 [[GH-380](https://github.com/hashicorp/envconsul/pull/380)] From 767b1643c2f06c829ae93a42d9497a003de09164 Mon Sep 17 00:00:00 2001 From: Sanika Chavan Date: Thu, 21 Aug 2025 13:25:56 +0530 Subject: [PATCH 4/7] Update CHANGELOG.md --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1f1c9fc3..94abc04f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,6 @@ ## envconsul CHANGELOG -## v0.13.4 (Jan 17, 2025) +## v0.13.4 (Aug 21, 2025) SECURITY: * Critical Golang vulnerability in v0.13.3 [[GH-380](https://github.com/hashicorp/envconsul/pull/380)] From c3c4976f56cc771f44200157896af617c9f3c692 Mon Sep 17 00:00:00 2001 From: Sanika Chavan Date: Thu, 21 Aug 2025 13:31:15 +0530 Subject: [PATCH 5/7] Update CHANGELOG.md --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 94abc04f..92b809e9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,7 +3,7 @@ ## v0.13.4 (Aug 21, 2025) SECURITY: -* Critical Golang vulnerability in v0.13.3 [[GH-380](https://github.com/hashicorp/envconsul/pull/380)] +* Critical Golang vulnerabilities (CVE-2025-22869, CVE-2025-22871) in v0.13.3 [[GH-380](https://github.com/hashicorp/envconsul/pull/380)] IMPROVEMENTS: * Update Golang from 1.22 to 1.24.6 [[GH-368](https://github.com/hashicorp/envconsul/pull/368)] From 3973642a850bada98e80a903f06f634215e27d20 Mon Sep 17 00:00:00 2001 From: Sanika Chavan Date: Thu, 21 Aug 2025 13:42:26 +0530 Subject: [PATCH 6/7] Update CHANGELOG.md --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 92b809e9..43c419bf 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,7 +6,7 @@ SECURITY: * Critical Golang vulnerabilities (CVE-2025-22869, CVE-2025-22871) in v0.13.3 [[GH-380](https://github.com/hashicorp/envconsul/pull/380)] IMPROVEMENTS: -* Update Golang from 1.22 to 1.24.6 [[GH-368](https://github.com/hashicorp/envconsul/pull/368)] +* Update Golang from 1.22 to 1.25 [[GH-381](https://github.com/hashicorp/envconsul/pull/381)] ## v0.13.3 (Jan 17, 2025) From a3f18b229c0554a21af18e0dbe51ef1f0f15a98f Mon Sep 17 00:00:00 2001 From: Sanika Chavan Date: Thu, 21 Aug 2025 13:56:16 +0530 Subject: [PATCH 7/7] Update CHANGELOG.md --- CHANGELOG.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 43c419bf..e80afe2d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,8 +3,7 @@ ## v0.13.4 (Aug 21, 2025) SECURITY: -* Critical Golang vulnerabilities (CVE-2025-22869, CVE-2025-22871) in v0.13.3 [[GH-380](https://github.com/hashicorp/envconsul/pull/380)] - +* fix: critical Golang vulnerabilities (CVE-2025-22869, CVE-2025-22871) [[GH-380](https://github.com/hashicorp/envconsul/pull/380)] IMPROVEMENTS: * Update Golang from 1.22 to 1.25 [[GH-381](https://github.com/hashicorp/envconsul/pull/381)]