v2.0.0

[2.0.0] - 2026-07-15

Added

• TCP connectors (pg, mysql, mssql) now support a database credential that
  pins the backend session to the operator-configured database.
  See Security hardening. CNJR-13756.
• A [SECURITY] warning is emitted at startup when a TCP service binds to a
  non-loopback address. See Security hardening.

Changed

• Breaking: HTTP connector requests that match no configured service are now
  rejected with HTTP 403. Previously, requests whose URL did not match any
  authenticateURLsMatching pattern were forwarded as an unauthenticated open
  proxy to the client-supplied destination, allowing network-adjacent attackers
  to pivot through the broker into backend networks (SSRF). Only requests that
  match a configured subservice are now forwarded. CNJR-13754.
• Breaking: HTTP connectors now enforce TLS by default (forceSSL: true).
  The generic HTTP connector and the basic_auth and conjur connectors
  built on it previously defaulted forceSSL to false, which allowed the
  injected backend credential (e.g. the Authorization header) to be sent to
  the upstream over plaintext http. Deployments that intentionally rely on a plaintext http
  upstream must now explicitly set forceSSL: false in the connector config
  to keep working; otherwise the upstream must support TLS (recommended). When
  forceSSL: false is set, a [SECURITY] startup warning is emitted so that
  intentional cleartext credential transmission is visible in logs.
  See the field reference in
  internal/plugin/connectors/http/generic/README.md.
• forceSSL can now also be set on HTTP handlers in v1 file configs and
  Kubernetes CRD resources, so those deployments have
  the same forceSSL: false opt-out as v2 file configs. Previously the v1/CRD
  path could not express forceSSL at all.
  Operators must re-apply the updated definition kubectl apply -f resource-definitions/secretless-resource-definition.yaml CNJR-13759.

v1.7.32

[1.7.32] - 2026-02-04

Changed

• Upgrade base docker images from Debian Bookworm to Trixie.
• Upgrade Go packages. (CNJR-7655)

Security

• Add message length limits to PostgreSQL protocol handler to prevent potential
  denial-of-service via memory exhaustion. Startup messages are limited to 10KB
  (matching PostgreSQL's MAX_STARTUP_PACKET_LENGTH) and authentication messages
  are limited to 64KB (matching PostgreSQL's PG_MAX_AUTH_TOKEN_LENGTH). (CONJSE-2078)

v1.7.31

[1.7.31] - 2026-01-07

Changed

• Migrate AWS SDK for Go from v1 to v2 in:
  • internal/providers/awssecrets/provider.go
  • internal/plugin/connectors/http/aws/aws.go (HTTP v4 signing)
• Use localhost instead of 0.0.0.0 for listening addresses in k8s examples (CONJSE-2078)

v1.7.30

[1.7.30] - 2025-11-06

Changed

• Upgrade Go to 1.25 (CONJSE-2067)
• Update Go dependencies

v1.7.29

[1.7.29] - 2025-09-03

Changed

• Update README to align with Conjur's name change to CyberArk Secrets Manager and update SECURITY.md. CNJR-10966
• Upgrade base docker images from Debian Bullseye to Bookworm.
• Migrate from MySQL 8.1 to MySQL LTS and enable mysql_native_password plugin in the configuration files.
• Remove deprecated docker compose version declarations
• Update gosec security scanning configuration to use securego/gosec:latest docker image.

v1.7.28

[1.7.28] - 2025-04-01

Changed

• Upgrade Go to 1.24.x

v1.7.27

[1.7.27] - 2025-01-10

Security

• Update multiple dependencies to latest versions

v1.7.26

[1.7.26] - 2024-12-27

Security

• Update golang.org/x/net to v0.33.0 to resolve CVE-2024-45338

v1.7.25

[1.7.25] - 2024-12-16

Security

• Update golang.org/x/crypto to v0.31.0 to resolve CVE-2024-45337

v1.7.24

[1.7.24] - 2024-07-25

Security

• Update golang.org/x/net to v0.24.0