From 12c9c5c4875f5fa3df11442e866f6fc8a9bcd3d8 Mon Sep 17 00:00:00 2001 From: "release-please[bot]" <55107282+release-please[bot]@users.noreply.github.com> Date: Wed, 14 Oct 2026 18:18:04 +0000 Subject: [PATCH 1/2] chore(main): release 2.26.1 --- CHANGELOG.md | 7 +++++++ README.md | 22 +++++++++++----------- cmd/root.go | 2 +- cmd/version.txt | 2 +- docs/cmd/cloud-sql-proxy.md | 2 +- examples/k8s-health-check/README.md | 2 +- examples/k8s-service/README.md | 2 +- examples/k8s-sidecar/README.md | 2 +- 8 files changed, 24 insertions(+), 17 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index a08a49573..e86aec71d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,12 @@ # Changelog +## [2.26.1](https://github.com/GoogleCloudPlatform/cloud-sql-proxy/compare/v2.26.0...v2.26.1) (2026-10-14) + + +### Bug Fixes + +* keep structured logs when --quiet is set ([#2694](https://github.com/GoogleCloudPlatform/cloud-sql-proxy/issues/2694)) ([4b77b57](https://github.com/GoogleCloudPlatform/cloud-sql-proxy/commit/4b77b57ce788b89ecd91d131658bcc1e0de30321)) + ## [2.26.0](https://github.com/GoogleCloudPlatform/cloud-sql-proxy/compare/v2.25.4...v2.26.0) (2026-09-28) diff --git a/README.md b/README.md index c98981e36..6c067f39b 100644 --- a/README.md +++ b/README.md @@ -78,7 +78,7 @@ following instructions for your OS and CPU architecture. ```sh # see Releases for other versions -URL="https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.0" +URL="https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.1" curl "$URL/cloud-sql-proxy.linux.amd64" -o cloud-sql-proxy @@ -92,7 +92,7 @@ chmod +x cloud-sql-proxy ```sh # see Releases for other versions -URL="https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.0" +URL="https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.1" curl "$URL/cloud-sql-proxy.linux.386" -o cloud-sql-proxy @@ -106,7 +106,7 @@ chmod +x cloud-sql-proxy ```sh # see Releases for other versions -URL="https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.0" +URL="https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.1" curl "$URL/cloud-sql-proxy.linux.arm64" -o cloud-sql-proxy @@ -120,7 +120,7 @@ chmod +x cloud-sql-proxy ```sh # see Releases for other versions -URL="https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.0" +URL="https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.1" curl "$URL/cloud-sql-proxy.linux.arm" -o cloud-sql-proxy @@ -134,7 +134,7 @@ chmod +x cloud-sql-proxy ```sh # see Releases for other versions -URL="https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.0" +URL="https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.1" curl "$URL/cloud-sql-proxy.darwin.amd64" -o cloud-sql-proxy @@ -148,7 +148,7 @@ chmod +x cloud-sql-proxy ```sh # see Releases for other versions -URL="https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.0" +URL="https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.1" curl "$URL/cloud-sql-proxy.darwin.arm64" -o cloud-sql-proxy @@ -162,7 +162,7 @@ chmod +x cloud-sql-proxy ```sh # see Releases for other versions -curl https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.0/cloud-sql-proxy.x64.exe -o cloud-sql-proxy.exe +curl https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.1/cloud-sql-proxy.x64.exe -o cloud-sql-proxy.exe ``` @@ -172,7 +172,7 @@ curl https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.0 ```sh # see Releases for other versions -curl https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.0/cloud-sql-proxy.x86.exe -o cloud-sql-proxy.exe +curl https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.1/cloud-sql-proxy.x86.exe -o cloud-sql-proxy.exe ``` @@ -600,13 +600,13 @@ currently supported: The `$VERSION` is the Proxy version without the leading "v" (e.g., -`2.26.0`). +`2.26.1`). For example, to pull a particular version, use a command like: ``` shell -# $VERSION is 2.26.0 -docker pull gcr.io/cloud-sql-connectors/cloud-sql-proxy:2.26.0 +# $VERSION is 2.26.1 +docker pull gcr.io/cloud-sql-connectors/cloud-sql-proxy:2.26.1 ``` diff --git a/cmd/root.go b/cmd/root.go index ec83469d4..bc0b58560 100644 --- a/cmd/root.go +++ b/cmd/root.go @@ -310,7 +310,7 @@ Third Party Licenses To view all licenses for third party dependencies used within this distribution please see: - https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.0/third_party/licenses.tar.gz {x-release-please-version} + https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.1/third_party/licenses.tar.gz {x-release-please-version} ` var waitHelp = ` diff --git a/cmd/version.txt b/cmd/version.txt index 7a25c70f9..f34083e03 100644 --- a/cmd/version.txt +++ b/cmd/version.txt @@ -1 +1 @@ -2.26.0 +2.26.1 diff --git a/docs/cmd/cloud-sql-proxy.md b/docs/cmd/cloud-sql-proxy.md index fc619b4d4..41323cc71 100644 --- a/docs/cmd/cloud-sql-proxy.md +++ b/docs/cmd/cloud-sql-proxy.md @@ -219,7 +219,7 @@ Third Party Licenses distribution please see: - https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.0/third_party/licenses.tar.gz + https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.26.1/third_party/licenses.tar.gz diff --git a/examples/k8s-health-check/README.md b/examples/k8s-health-check/README.md index ab32f8d9b..7cf7c2d81 100644 --- a/examples/k8s-health-check/README.md +++ b/examples/k8s-health-check/README.md @@ -172,7 +172,7 @@ for more than 1 minute. initContainers: - name: cloud-sql-proxy restartPolicy: Always - image: gcr.io/cloud-sql-connectors/cloud-sql-proxy:2.26.0 + image: gcr.io/cloud-sql-connectors/cloud-sql-proxy:2.26.1 args: # Set the --max-connections flag to 50 - "--max-connections" diff --git a/examples/k8s-service/README.md b/examples/k8s-service/README.md index 04a8ae928..12113234a 100644 --- a/examples/k8s-service/README.md +++ b/examples/k8s-service/README.md @@ -174,7 +174,7 @@ For the PgBouncer deployment, we add the proxy as a sidecar, starting it on port initContainers: - name: cloud-sql-proxy restartPolicy: Always - image: gcr.io/cloud-sql-connectors/cloud-sql-proxy:2.26.0 # make sure to use the latest version + image: gcr.io/cloud-sql-connectors/cloud-sql-proxy:2.26.1 # make sure to use the latest version args: # Replace DB_PORT with the port the proxy should listen on - "--port=" diff --git a/examples/k8s-sidecar/README.md b/examples/k8s-sidecar/README.md index 69043a615..684fefdaf 100644 --- a/examples/k8s-sidecar/README.md +++ b/examples/k8s-sidecar/README.md @@ -185,7 +185,7 @@ as a separate service for several reasons: restartPolicy: Always # It is recommended to use the latest version of the Cloud SQL Auth Proxy # Make sure to update on a regular schedule! - image: gcr.io/cloud-sql-connectors/cloud-sql-proxy:2.26.0 # make sure to use the latest version + image: gcr.io/cloud-sql-connectors/cloud-sql-proxy:2.26.1 # make sure to use the latest version args: # If connecting from a VPC-native GKE cluster, you can use the # following flag to have the proxy connect over private IP From 71ad143c90001f9ad78621be90f129f540cb9709 Mon Sep 17 00:00:00 2001 From: kgala2 Date: Wed, 14 Oct 2026 18:22:22 +0000 Subject: [PATCH 2/2] docs: add CVE fixed table to 2.26.1 changelog --- CHANGELOG.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index e86aec71d..9a2a12d28 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,20 @@ ### Bug Fixes * keep structured logs when --quiet is set ([#2694](https://github.com/GoogleCloudPlatform/cloud-sql-proxy/issues/2694)) ([4b77b57](https://github.com/GoogleCloudPlatform/cloud-sql-proxy/commit/4b77b57ce788b89ecd91d131658bcc1e0de30321)) +* update all dependencies to latest ([#2699](https://github.com/GoogleCloudPlatform/cloud-sql-proxy/issues/2699)) ([ea92a21](https://github.com/GoogleCloudPlatform/cloud-sql-proxy/commit/ea92a21528d9c520dbb8d35a00681e8a07f62dd0)) +* update cloud.google.com/go/cloudsqlconn to v1.25.4 ([#2685](https://github.com/GoogleCloudPlatform/cloud-sql-proxy/issues/2685)) ([ddf693e](https://github.com/GoogleCloudPlatform/cloud-sql-proxy/commit/ddf693ed2c99dfe9b8c434d331f1f960ff665581)) + +### Security / CVE Fixes + +Updates `golang.org/x/net` from `v0.59.0` to `v0.61.0`, resolving the following HTTP/2 vulnerabilities: + +| Advisory | CVE | Description | Affected Package | Fixed Version | +| --- | --- | --- | --- | --- | +| [GO-2026-6603](https://pkg.go.dev/vuln/GO-2026-6603) | [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) | HTTP/2 server memory exhaustion due to Trailer headers | `golang.org/x/net` | `v0.61.0` | +| [GO-2026-6610](https://pkg.go.dev/vuln/GO-2026-6610) | [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) | HTTP/2 transport accepts malformed framing-related headers | `golang.org/x/net` | `v0.61.0` | +| [GO-2026-6611](https://pkg.go.dev/vuln/GO-2026-6611) | [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) | Excessive CPU consumption from repeated initial window changes | `golang.org/x/net` | `v0.61.0` | +| [GO-2026-6612](https://pkg.go.dev/vuln/GO-2026-6612) | [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) | Double flow control refund on HTTP/2 server streams | `golang.org/x/net` | `v0.61.0` | +| [GO-2026-6617](https://pkg.go.dev/vuln/GO-2026-6617) | [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) | HTTP/2 server crash due to HPACK encoder race | `golang.org/x/net` | `v0.61.0` | ## [2.26.0](https://github.com/GoogleCloudPlatform/cloud-sql-proxy/compare/v2.25.4...v2.26.0) (2026-09-28)