Latest relesae v0.3.1 has CVE GO-2026-4337

[yhzs8]

Observed behavior

Latest v0.3.1 (built with go1.25.6) has CVE vulnerability https://pkg.go.dev/vuln/GO-2026-4337, can we release a new version with go1.25.7?

Expected behavior

No CVE vulnerability reported

Server and client version

v0.3.1

Host environment

No response

Steps to reproduce

No response

[ripienaar]

There will be a release in the next few weeks when the next server major release lands.

[yhzs8]

For now we manually built v0.3.1 using go1.25.7

[ktarplee]

Now that nats-server v2.12.6 is released can we also get that dependency updated in this project. github.com/nats-io/nats-server/v2 v2.12.1-0.20260319152329-5b63063e858f is being used currently.

[ripienaar]

As above, when the next major server release lands which will be in a few weeks. The server libraries are used to access their structs only - apart from one experimental feature that's hidden and not used. So it's low risk.

[ktarplee]

Is it possible to make a patch release (v0.3.2 just off of your v0.3.1 tag, not main) in the mean time? I help maintain the IronBank images for Synadia. The nats-box image is in bad shape until the CVEs in the nats CLI are removed. https://repo1.dso.mil/dsop/opensource/synadia/nats-box/-/jobs/56234461

[ripienaar]

Will take a look though no doubt goreleaser will make it difficult :(

[ripienaar]

@ktarplee lets try https://github.com/nats-io/natscli/releases/tag/v0.3.2