Change8

v3.15.6

📦 quay-ioView on GitHub →
🐛 7 fixes🔧 8 symbols

Summary

This release addresses several CVEs by updating various dependencies including PyJWT, shell-quote, urllib3, kafka-python, and form-data. It also includes improvements to the proxy cache and Clair rescans.

🐛 Bug Fixes

  • PROJQUAY-11675: Fixed CVE-2026-48526 in PyJWT.
  • PROJQUAY-11734: Fixed CVE-2026-9277 in shell-quote.
  • PROJQUAY-11596: Fixed CVE-2026-44432 in urllib3.
  • PROJQUAY-11719: Fixed CVE-2026-10143 by bumping kafka-python.
  • PROJQUAY-11873: Fixed CVE-2026-12143 in form-data.
  • PROJQUAY-9369: Trigger Clair rescan after proxy cache completes blob downloads.
  • PROJQUAY-10892: Prevented SSRF in proxy cache upstream registry configuration.

Affected Symbols