A bug-fix release with two security fixes, along with routine correctness fixes and Go toolchain dependency updates. The security changes affect users of the static grpc auth plugin or twopcz handler; the release also updates Go to go1. and go1..
Check if affected (2)
securityConstant-time password comparison in the
static grpc auth pluginApplies if you use the
static grpc auth plugin.The
static grpc auth pluginnow uses a constant-time password comparison. This security fix ships in release-24.0.securityEscaping of reflected form values in the
twopcz handlerApplies if you use the
twopcz handler.The
twopcz handlernow escapes reflected form values. This security fix ships in release-24.0.