●Change8

v3.16.5

📦 quay-ioView on GitHub →
🐛 11 fixes🔧 9 symbols

Summary

This release addresses several CVEs by updating various dependencies including PyJWT, urllib3, shell-quote, kafka-python, FastUri, form-data, and decode-uri-component. It also includes improvements to CI processes and proxy cache functionality.

🐛 Bug Fixes

  • Fixed CVE-2026-48526 in PyJWT.
  • Fixed CVE-2026-44432 in urllib3.
  • Fixed CVE-2026-9277 in shell-quote.
  • Fixed CVE-2026-10143 by bumping kafka-python.
  • Fixed CVE-2026-6322 in FastUri.
  • Prevented deadlock in test_has_garbage under parallel execution (PROJQUAY-11089).
  • Fixed CVE-2026-12143 in form-data.
  • Fixed CVE-2026-45822 in decode-uri-component.
  • Triggered Clair rescan after proxy cache completes blob downloads (PROJQUAY-9369).
  • Fixed CVE-2026-13676 in FastUri.
  • Prevented SSRF in proxy cache upstream registry configuration (PROJQUAY-10893).

Affected Symbols

axiosPyJWTurllib3shell-quotekafka-pythonFastUriform-datadecode-uri-componentgolang.org/x/net