v0.352.1: Go 1.27.4 (GO-2026-6859, felhom.eu R-1391)

CHANGELOG.md

@@ -1,3 +1,28 @@
+## v0.352.1 (2026-11-14) — Go 1.27.4: the security fix GO-2026-6859 (felhom.eu R-1391) — release 1 of four („dates”)
+
+### 2026-11-14
+
+**MinAgent: 0.158.1** (unchanged).
+
+**Why.** Go 1.27.3 has GO-2026-6859: an HTTP/1 server can crash with a runtime panic when a `MaxBytesReader` limit is
+hit while the handler reads the request body and writes a response header at the same time. Fixed in Go 1.27.4
+(published; checked on go.dev and on Docker Hub before the change).
+
+**What changed.** `controller/go.mod` `go 1.27.4`; the builder image
+`golang:1.27.4-trixie@sha256:b54b2639de8c1bfe538ec5ffc45f29b1932235ac5f6d63c059853646677112d9` (version and digest,
+as before). No source change.
+
+**Reach, read 2026-11-14 (20-minute read).** Seven places wrap a body in `MaxBytesReader` (`api/router.go limitBody`,
+`web/poweroff_handlers.go`, `web/handler_export_upload.go` ×4, `web/escrow_handlers.go`). Each one reads the body to
+its end in the handler's own goroutine and writes the answer after it; none starts a goroutine that reads the body,
+and the controller has no `TimeoutHandler` and no `EnableFullDuplex`. So no controller handler matches the crash
+pattern. The release is hygiene, not an urgent fix.
+
+**Not in this release: HSTS one year (felhom.eu R-1050, `09` §3 decision 249).** The ruling allows it on or after
+2026-11-15; this release was built on 2026-11-14 and the operator's words „one day early is OK” were not given.
+
+**Tests.** `go build`, `go vet`, `go test ./...` green on Go 1.27.4; `controller_gates.py --fast` green.
+
 ## v0.352.0 (2026-11-10) — R-1371: one fill warning per filesystem — RELEASED (image `sha256:3c785dd3…`, from `3dbb68c1`, CI 2615; rc.1 on scratch guest 9202); per-box floors 15:16 UTC, global floor 2026-11-10 15:31 UTC (MinAgent 0.158.1)
 
 ### 2026-11-10

controller/Dockerfile

@@ -8,7 +8,7 @@
 # R-972 (v0.322.0): a supported, patched Go, pinned by version AND digest (no moving tag). Go 1.24 had no security fixes
 # left (go.dev/doc/devel/release#policy). The builder's Debian does not reach the runtime (a static CGO-free binary).
 # upstream: osv:Go/stdlib
-FROM golang:1.27.3-trixie@sha256:fbb7ae40b62ff8afe31662df570d39b4f5052ac32b90dae8e60d7657a20a74f4 AS builder
+FROM golang:1.27.4-trixie@sha256:b54b2639de8c1bfe538ec5ffc45f29b1932235ac5f6d63c059853646677112d9 AS builder
 
 ARG TARGETOS=linux
 ARG TARGETARCH

controller/go.mod

@@ -1,6 +1,6 @@
 module gitea.dooplex.hu/admin/felhom-controller
 
-go 1.27.3
+go 1.27.4
 
 require (
 	github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6