From 2d53000e6db7b51973ad1d2a43813e759167f7f9 Mon Sep 17 00:00:00 2001 From: Jan Larwig Date: Thu, 26 Feb 2026 14:54:40 +0100 Subject: [PATCH] doc: release note v7.14.3 Signed-off-by: Jan Larwig --- CHANGELOG.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 321eead4..4542945f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -12,8 +12,16 @@ ## Release Highlights +- 🔵 Go1.25.7 and upgrade of dependencies to latest versions + - Fixes [CVE-2025-68121](https://nvd.nist.gov/vuln/detail/cve-2025-68121) +- 🐛 Bug fixes + - Allow Redis URL parameters to configure username, password and max idle connection timeout if the matching configuration is empty. + ## Important Notes +We improved our supply chain security by added additional checks to prevent potential command injection in the publish release workflow and to ensure that it can only be triggered from branches originating in the local repository. This potential issue was reported by automated systems as well as a couple of security researchers, and we want to thank everyone for their diligence in looking out for the security of the project. Especially Aastha Aggarwal for her detailed report and follow-up. @Aastha2602 + + ## Breaking Changes ## Changes since v7.14.2