v1.3.6

1.3.6 (July 15, 2024)

SECURITY:

• Upgrade envoy version to 1.27.7 to address CVE-2024-39305 [GH-580]
• Upgrade go version to address CVE-2024-24791 [GH-573]
• Upgrade to support Envoy 1.27.6. [GH-542]

IMPROVEMENTS:

• Upgrade Go to use 1.22.4. [GH-529]

v1.1.12

1.1.12 (July 15, 2024)

SECURITY:

• Upgrade envoy version to 1.27.7 to address CVE-2024-39305 [GH-579]
• Upgrade go version to address CVE-2024-24791 [GH-573]
• Upgrade to support Envoy 1.27.6. [GH-543]

v1.5.0

1.5.0 (June 12, 2024)

IMPROVEMENTS:

• Upgrade Go to use 1.22.4. [GH-529]
• Upgrade to support Envoy 1.29.5. [GH-533]
• dns: queries proxied by consul-dataplane now assume the same namespace/partition/ACL token as the service registered to the dataplane instance. [GH-172]

v1.4.2

1.4.2 (May 21, 2024)

SECURITY:

• Upgrade Go to use 1.21.10. This addresses CVEs
  CVE-2024-24787 and
  CVE-2024-24788 [GH-487]
• Upgrade to support Envoy 1.28.2. This resolves CVE
  CVE-2024-27919 (http2). [GH-474]
• Upgrade to support Envoy 1.28.3. This resolves CVE
  CVE-2024-32475. [GH-496]
• Upgrade to use Go 1.21.9. This resolves CVE
  CVE-2023-45288 (http2). [GH-474]
• Upgrade to use golang.org/x/net v0.24.0. This resolves CVE
  CVE-2023-45288 (x/net). [GH-474]

IMPROVEMENTS:

• Upgrade Go to use 1.22.3. [GH-501]

v1.3.5

1.3.5 (May 24, 2024)

SECURITY:

• Upgrade Go to use 1.21.10. This addresses CVEs
  CVE-2024-24787 and
  CVE-2024-24788 [GH-487]
• Upgrade to support Envoy 1.27.4. This resolves CVE
  CVE-2024-27919 (http2). [GH-477]
• Upgrade to support Envoy 1.27.5. This resolves CVE
  CVE-2024-32475. [GH-497]
• Upgrade to use Go 1.21.9. This resolves CVE
  CVE-2023-45288 (http2). [GH-477]
• Upgrade to use golang.org/x/net v0.24.0. This resolves CVE
  CVE-2023-45288 (x/net). [GH-477]

IMPROVEMENTS:

• Upgrade Go to use 1.22.3. [GH-501]

v1.2.8

1.2.8 (May 24, 2024)

SECURITY:

• Upgrade Go to use 1.21.10. This addresses CVEs
  CVE-2024-24787 and
  CVE-2024-24788 [GH-487]
• Upgrade to support Envoy 1.26.8. This resolves CVE
  CVE-2024-27919 (http2). [GH-476]
• Upgrade to support Envoy 1.27.5. This resolves CVE
  CVE-2024-32475. [GH-498]
• Upgrade to use Go 1.21.9. This resolves CVE
  CVE-2023-45288 (http2). [GH-476]
• Upgrade to use golang.org/x/net v0.24.0. This resolves CVE
  CVE-2023-45288 (x/net). [GH-476]

IMPROVEMENTS:

• Upgrade Go to use 1.22.3. [GH-501]

v1.1.11

1.1.11 (May 20, 2024)

SECURITY:

• Upgrade Go to use 1.21.10. This addresses CVEs
  CVE-2024-24787 and
  CVE-2024-24788 [GH-487]
• Upgrade to support Envoy 1.26.8. This resolves CVE
  CVE-2024-27919 (http2). [GH-475]
• Upgrade to support Envoy 1.27.5. This resolves CVE
  CVE-2024-32475. [GH-499]
• Upgrade to use Go 1.21.9. This resolves CVE
  CVE-2023-45288 (http2). [GH-475]
• Upgrade to use golang.org/x/net v0.24.0. This resolves CVE
  CVE-2023-45288 (x/net). [GH-475]

IMPROVEMENTS:

• Upgrade Go to use 1.22.3. [GH-501]

v1.4.1

1.4.1 (March 28, 2024)

SECURITY:

• Update google.golang.org/protobuf to v1.33.0 to address CVE-2024-24786. [GH-460]
• Upgrade to use Go 1.21.8. This resolves CVEs
  CVE-2024-24783 (crypto/x509).
  CVE-2023-45290 (net/http).
  CVE-2023-45289 (net/http, net/http/cookiejar).
  CVE-2024-24785 (html/template).
  CVE-2024-24784 (net/mail). [GH-465]

v1.3.4

1.3.4 (March 28, 2024)

SECURITY:

• Update google.golang.org/protobuf to v1.33.0 to address CVE-2024-24786. [GH-460]
• Upgrade consul-dataplane-fips OpenShift container image to use ubi9-minimal:9.3 as the base image. [GH-434]
• Upgrade to use Go 1.21.8. This resolves CVEs
  CVE-2024-24783 (crypto/x509).
  CVE-2023-45290 (net/http).
  CVE-2023-45289 (net/http, net/http/cookiejar).
  CVE-2024-24785 (html/template).
  CVE-2024-24784 (net/mail). [GH-465]

v1.2.7

1.2.7 (March 28, 2024)

SECURITY:

• Update google.golang.org/protobuf to v1.33.0 to address CVE-2024-24786. [GH-460]
• Upgrade consul-dataplane-fips OpenShift container image to use ubi9-minimal:9.3 as the base image. [GH-434]
• Upgrade to use Go 1.21.8. This resolves CVEs
  CVE-2024-24783 (crypto/x509).
  CVE-2023-45290 (net/http).
  CVE-2023-45289 (net/http, net/http/cookiejar).
  CVE-2024-24785 (html/template).
  CVE-2024-24784 (net/mail). [GH-465]