-
v1.2.33
StableAll checks were successfulSecret Scan / gitleaks (push) Successful in 26sSource Security Scan / source-security (push) Successful in 46sGolang Tests / test-go (push) Successful in 1m3slint / lint (push) Successful in 1m45sImage Security Scan / image-security (push) Successful in 2m38sRust Tests / test-rust (rust/rperf-client, cargo) (push) Successful in 3m18sRust Tests / test-rust (rust/consumers/zen, cargo) (push) Successful in 3m42sRust Tests / test-rust (rust/trapd, cargo) (push) Successful in 3m45sRust Tests / test-rust (rust/log-collector, cargo) (push) Successful in 4m22sRust Tests / test-rust (//rust/rperf-server:rperf, rust/rperf-server, bazel) (push) Successful in 5m12sRust Tests / test-rust (rust/srql, cargo) (push) Successful in 6m38sPublish Release Artifacts / publish (push) Successful in 12m44s
Ghost
released this
2026-05-06 17:32:50 +00:00 | 1296 commits to staging since this releaseServiceRadar v1.2.33
Dependency security refresh for Rust, Go, and dashboard JavaScript packages, including the rperf migration needed to clear stale crate alerts.
Whats New
1.2.33
- Updated vulnerable Rust dependencies across the workspace, including OpenSSL, Diesel, rustls-webpki, rand, async-nats, and SPIFFE-related integrations.
- Patched the reqsign Google and Azure Storage crates locally to move Zen transitive authentication dependencies onto the fixed jsonwebtoken stack until upstream publishes compatible releases.
- Reworked rperf packaging so ServiceRadar builds and ships a patched local rperf binary instead of depending on the stale crates.io rperf package and its vulnerable dependency graph.
- Updated Go dependencies and moved the Go/Bazel toolchain target to Go 1.26.2, including the pgx security update.
- Updated dashboard and documentation npm lockfiles and overrides for Dependabot-reported packages such as postcss, fast-xml-parser, and uuid.
- Fixed core coordinator advisory-lock error handling so failed lock attempts stop their dedicated Postgrex pool instead of leaking idle connections until Postgres refuses new clients.
- Fixed the web-ng FieldSurvey ADBC database URI builder so pooler-backed
verify-fulldeployments keep routing through the configured CNPG pooler while still verifying the cluster CA. - Fixed Bazel crate metadata for patched reqsign crates and the updated OpenSSL source crate so release image publishing can analyze the full
//:pushgraph in CI. - Fixed Bazel provider dependencies for the patched reqsign Azure and Google crates so release image builds can compile Zen's reqsign-enabled dependency graph.
- Updated the pinned TinyGo toolchain to 0.41.1 so first-party Wasm plugin publishing remains compatible with the Go 1.26 release toolchain.
Downloads
-
Source code (ZIP)
0 downloads
-
Source code (TAR.GZ)
0 downloads