diff --git a/CHANGELOG.md b/CHANGELOG.md index 382380e06..53a2ff329 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,20 @@ # Changelog +## [2.26.3](https://github.com/GoogleCloudPlatform/cloud-sql-proxy/compare/v2.26.2...v2.26.3) (2026-10-22) + + +### Bug Fixes + +* update dependencies and container base image digests ([#2708](https://github.com/GoogleCloudPlatform/cloud-sql-proxy/issues/2708)) ([e58f8fb](https://github.com/GoogleCloudPlatform/cloud-sql-proxy/commit/e58f8fb639c9806c73ec7207d3ed368751031f01)), refs [#2707](https://github.com/GoogleCloudPlatform/cloud-sql-proxy/issues/2707) + +### Security / CVE Fixes + +Updates `gcr.io/distroless/static:nonroot` and `alpine:3` container base image digests to remove distrusted `emSign ECC Root CA - G3` and `AAA Certificate Services` root certificates (`ca-certificates`), and rebuilds the proxy binaries with Go `1.27.3` / `1.26.10`: + +| Advisory | CVE | Description | Affected Component | Fixed Version | +| --- | --- | --- | --- | --- | +| [GO-2026-6809](https://pkg.go.dev/vuln/GO-2026-6809) | [CVE-2026-111943](https://nvd.nist.gov/vuln/detail/CVE-2026-111943) | Distrust compromised intermediate certificates in `crypto/x509` and container OS root CA bundle (`ca-certificates`) | `crypto/x509` (stdlib), `gcr.io/distroless/static:nonroot`, `alpine:3` | `go1.26.10` / `go1.27.3`, `distroless@d620678`, `alpine:3.24.3@71e9b7b` | + ## [2.26.2](https://github.com/GoogleCloudPlatform/cloud-sql-proxy/compare/v2.26.1...v2.26.2) (2026-10-14) diff --git a/README.md b/README.md index ccc8c7aec..640c14c78 100644 --- a/README.md +++ b/README.md @@ -78,7 +78,7 @@ following instructions for your OS and CPU architecture. ```sh # see Releases for other versions -URL="https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.2" +URL="https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.3" curl "$URL/cloud-sql-proxy.linux.amd64" -o cloud-sql-proxy @@ -92,7 +92,7 @@ chmod +x cloud-sql-proxy ```sh # see Releases for other versions -URL="https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.2" +URL="https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.3" curl "$URL/cloud-sql-proxy.linux.386" -o cloud-sql-proxy @@ -106,7 +106,7 @@ chmod +x cloud-sql-proxy ```sh # see Releases for other versions -URL="https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.2" +URL="https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.3" curl "$URL/cloud-sql-proxy.linux.arm64" -o cloud-sql-proxy @@ -120,7 +120,7 @@ chmod +x cloud-sql-proxy ```sh # see Releases for other versions -URL="https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.2" +URL="https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.3" curl "$URL/cloud-sql-proxy.linux.arm" -o cloud-sql-proxy @@ -134,7 +134,7 @@ chmod +x cloud-sql-proxy ```sh # see Releases for other versions -URL="https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.2" +URL="https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.3" curl "$URL/cloud-sql-proxy.darwin.amd64" -o cloud-sql-proxy @@ -148,7 +148,7 @@ chmod +x cloud-sql-proxy ```sh # see Releases for other versions -URL="https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.2" +URL="https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.3" curl "$URL/cloud-sql-proxy.darwin.arm64" -o cloud-sql-proxy @@ -162,7 +162,7 @@ chmod +x cloud-sql-proxy ```sh # see Releases for other versions -curl https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.2/cloud-sql-proxy.x64.exe -o cloud-sql-proxy.exe +curl https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.3/cloud-sql-proxy.x64.exe -o cloud-sql-proxy.exe ``` @@ -172,7 +172,7 @@ curl https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.2 ```sh # see Releases for other versions -curl https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.2/cloud-sql-proxy.x86.exe -o cloud-sql-proxy.exe +curl https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.3/cloud-sql-proxy.x86.exe -o cloud-sql-proxy.exe ``` @@ -600,13 +600,13 @@ currently supported: The `$VERSION` is the Proxy version without the leading "v" (e.g., -`2.26.2`). +`2.26.3`). For example, to pull a particular version, use a command like: ``` shell -# $VERSION is 2.26.2 -docker pull gcr.io/cloud-sql-connectors/cloud-sql-proxy:2.26.2 +# $VERSION is 2.26.3 +docker pull gcr.io/cloud-sql-connectors/cloud-sql-proxy:2.26.3 ``` diff --git a/cmd/root.go b/cmd/root.go index 382be9671..a5fd07f4c 100644 --- a/cmd/root.go +++ b/cmd/root.go @@ -310,7 +310,7 @@ Third Party Licenses To view all licenses for third party dependencies used within this distribution please see: - https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.2/third_party/licenses.tar.gz {x-release-please-version} + https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.3/third_party/licenses.tar.gz {x-release-please-version} ` var waitHelp = ` diff --git a/cmd/version.txt b/cmd/version.txt index ed1d60050..3953e8ad5 100644 --- a/cmd/version.txt +++ b/cmd/version.txt @@ -1 +1 @@ -2.26.2 +2.26.3 diff --git a/docs/cmd/cloud-sql-proxy.md b/docs/cmd/cloud-sql-proxy.md index 2da43b567..4a32d860e 100644 --- a/docs/cmd/cloud-sql-proxy.md +++ b/docs/cmd/cloud-sql-proxy.md @@ -219,7 +219,7 @@ Third Party Licenses distribution please see: - https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.2/third_party/licenses.tar.gz + https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.3/third_party/licenses.tar.gz diff --git a/examples/k8s-health-check/README.md b/examples/k8s-health-check/README.md index e2a04a86e..003e0ac11 100644 --- a/examples/k8s-health-check/README.md +++ b/examples/k8s-health-check/README.md @@ -172,7 +172,7 @@ for more than 1 minute. initContainers: - name: cloud-sql-proxy restartPolicy: Always - image: gcr.io/cloud-sql-connectors/cloud-sql-proxy:2.26.2 + image: gcr.io/cloud-sql-connectors/cloud-sql-proxy:2.26.3 args: # Set the --max-connections flag to 50 - "--max-connections" diff --git a/examples/k8s-service/README.md b/examples/k8s-service/README.md index a376d24f2..985db7418 100644 --- a/examples/k8s-service/README.md +++ b/examples/k8s-service/README.md @@ -174,7 +174,7 @@ For the PgBouncer deployment, we add the proxy as a sidecar, starting it on port initContainers: - name: cloud-sql-proxy restartPolicy: Always - image: gcr.io/cloud-sql-connectors/cloud-sql-proxy:2.26.2 # make sure to use the latest version + image: gcr.io/cloud-sql-connectors/cloud-sql-proxy:2.26.3 # make sure to use the latest version args: # Replace DB_PORT with the port the proxy should listen on - "--port=" diff --git a/examples/k8s-sidecar/README.md b/examples/k8s-sidecar/README.md index 1c3a5bc7f..4c71bfd05 100644 --- a/examples/k8s-sidecar/README.md +++ b/examples/k8s-sidecar/README.md @@ -185,7 +185,7 @@ as a separate service for several reasons: restartPolicy: Always # It is recommended to use the latest version of the Cloud SQL Auth Proxy # Make sure to update on a regular schedule! - image: gcr.io/cloud-sql-connectors/cloud-sql-proxy:2.26.2 # make sure to use the latest version + image: gcr.io/cloud-sql-connectors/cloud-sql-proxy:2.26.3 # make sure to use the latest version args: # If connecting from a VPC-native GKE cluster, you can use the # following flag to have the proxy connect over private IP