[chen21019]

Security update

Release 0.3.4 upgrades official go-jose/v4 4.1.4 to 4.1.6 and x/net 0.60.0 to 0.62.0, including required x/sys 0.49.0 and x/text 0.43.0. This removes all five fixable findings attributed to the secret-delivery-api binary in the current Server scan: CVE-2026-116585, CVE-2026-116586, CVE-2026-116587, CVE-2026-78661 and CVE-2026-97045.

Go 1.27.3, Vault 1.23.0, the Vault transit protocol, TLS configuration, local-key behavior and the product API remain unchanged. The release gate and README target 0.3.4; no checks or security thresholds are reduced. The release will attach the verified main CI archive, build metadata and binary-derived CycloneDX SBOM.

Validation

• go mod verify and go mod tidy -diff: pass.
• Existing Vault, localkey and service tests: pass.
• Official focused RSA JWK, CBC-HMAC (including empty ciphertext with a valid tag), JSON and HTML parsing/rendering regressions: pass.
• Direct before/after check: old 4.1.4 accepts 10,001-level JSON arrays/objects and a 4,097-bit RSA JWK; 4.1.6 rejects them. Ordinary JSON and the 2,048-bit JWK control remain accepted.
• Independent read-only compatibility review: no blocking finding.
• Required CI and CodeQL must pass before normal merge. This component release does not claim Server integration acceptance.