Release 0.3.4: patch JOSE and network dependencies

.github/workflows/ci.yml

@@ -29,15 +29,15 @@ jobs:
 
       - name: Run release gate
         env:
-          VERSION_OVERRIDE: v0.3.3
+          VERSION_OVERRIDE: v0.3.4
           SOURCE_DATE_EPOCH: "0"
         run: ./scripts/ci
 
       - name: Record the verified release product
         shell: bash
         run: |
           set -euo pipefail
-          artifact=dist/artifacts/secret-delivery-api-0.3.3-linux-amd64.tar.xz
+          artifact=dist/artifacts/secret-delivery-api-0.3.4-linux-amd64.tar.xz
           test -f "$artifact"
           mkdir -p release-evidence
           git rev-parse HEAD > release-evidence/source-revision.txt

README.md

@@ -8,7 +8,9 @@ PastureStack is an independent community effort to preserve, audit, and moderniz
 
 ## Project status
 
-The maintenance source builds `v0.3.3` from the preserved upstream `v0.2.2` boundary. It uses Go modules and the exact Go 1.27.3 toolchain, x/net 0.60.0, deterministic Release packaging, bounded JSON requests, HTTP resource timeouts, scoped Vault storage operations, neutral product naming, race tests, a 70% critical-path coverage gate, and a loopback local-key API integration test. Go 1.27.3 includes the [crypto/x509 mitigation for CVE-2026-111943](https://pkg.go.dev/vuln/GO-2026-6809). Published versions and immutable assets are listed in [GitHub Releases](https://github.com/PastureStack/secret-delivery-api/releases/latest). Production deployment remains disabled until the matching Server integration has passed in an isolated VM.
+The maintenance source builds `v0.3.4` from the preserved upstream `v0.2.2` boundary. It uses Go modules and the exact Go 1.27.3 toolchain, go-jose/v4 4.1.6, x/net 0.62.0, deterministic Release packaging, bounded JSON requests, HTTP resource timeouts, scoped Vault storage operations, neutral product naming, race tests, a 70% critical-path coverage gate, and a loopback local-key API integration test. Go 1.27.3 includes the [crypto/x509 mitigation for CVE-2026-111943](https://pkg.go.dev/vuln/GO-2026-6809). Published versions and immutable assets are listed in [GitHub Releases](https://github.com/PastureStack/secret-delivery-api/releases/latest). Production deployment remains disabled until the matching Server integration has passed in an isolated VM.
+
+Version 0.3.4 updates the official dependencies for the go-jose [RSA JWK resource limit](https://github.com/go-jose/go-jose/security/advisories/GHSA-mgcc-cww5-fp2q), [CBC-HMAC panic](https://github.com/go-jose/go-jose/security/advisories/GHSA-4w3g-jfj2-cw2q), and [JSON nesting](https://github.com/go-jose/go-jose/security/advisories/GHSA-vvm8-gf78-28g4) fixes, plus x/net HTML parsing/rendering fixes [GO-2026-6860](https://pkg.go.dev/vuln/GO-2026-6860) and [GO-2026-6866](https://pkg.go.dev/vuln/GO-2026-6866). The Vault transit protocol, local-key behavior, and Go toolchain remain unchanged. Release build information and a binary-derived CycloneDX SBOM identify the dependencies actually shipped; this component release does not establish Server integration acceptance.
 
 The `none` backend is an insecure compatibility fixture and is disabled by default. It can be enabled only with `--allow-insecure-none-backend` or `ALLOW_INSECURE_NONE_BACKEND=true` for an explicitly reviewed legacy migration. The supported Server path uses the `localkey` backend on the loopback interface.
 
@@ -24,7 +26,7 @@ make package
 make ci
 ```
 
-For the maintenance build, set `VERSION_OVERRIDE=v0.3.3` and `SOURCE_DATE_EPOCH=0`. Packaging produces `secret-delivery-api-0.3.3-linux-amd64.tar.xz`. Use only the immutable asset from its matching published GitHub Release; a source version is not proof of publication. PastureStack Server verifies that asset's SHA-256 digest and installs the executable under the preserved `secrets-api` compatibility name. Operators do not need to host an artifact mirror.
+For the maintenance build, set `VERSION_OVERRIDE=v0.3.4` and `SOURCE_DATE_EPOCH=0`. Packaging produces `secret-delivery-api-0.3.4-linux-amd64.tar.xz`. Use only the immutable asset from its matching published GitHub Release; a source version is not proof of publication. PastureStack Server verifies that asset's SHA-256 digest and installs the executable under the preserved `secrets-api` compatibility name. Operators do not need to host an artifact mirror.
 
 See [COMPATIBILITY.md](COMPATIBILITY.md), [SECURITY.md](SECURITY.md), [ORIGIN.md](ORIGIN.md), and [THIRD-PARTY-NOTICES.md](THIRD-PARTY-NOTICES.md).
 

go.mod

@@ -15,7 +15,7 @@ require (
 require (
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
-	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.6 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
@@ -29,8 +29,8 @@ require (
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/ryanuber/go-glob v1.0.0 // indirect
-	golang.org/x/net v0.60.0 // indirect
-	golang.org/x/sys v0.48.0 // indirect
-	golang.org/x/text v0.42.0 // indirect
+	golang.org/x/net v0.62.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
+	golang.org/x/text v0.43.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
 )

go.sum

@@ -8,8 +8,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
 github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
-github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
-github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/go-jose/go-jose/v4 v4.1.6 h1:sNRkftxFJxwsILiQukqp5z83QBSmntVwmgRY7AqBDO4=
+github.com/go-jose/go-jose/v4 v4.1.6/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
 github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
 github.com/gorilla/context v1.1.2 h1:WRkNAv2uoa03QNIc1A6u4O7DAGMUVoopZhkiXWA2V1o=
@@ -68,12 +68,12 @@ github.com/urfave/cli v1.22.17 h1:SYzXoiPfQjHBbkYxbew5prZHS1TOLT3ierW8SYLqtVQ=
 github.com/urfave/cli v1.22.17/go.mod h1:b0ht0aqgH/6pBYzzxURyrM4xXNgsoT/n2ZzwQiEhNVo=
 go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
 go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
-golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
-golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
-golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
-golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
-golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
-golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
+golang.org/x/net v0.62.0 h1:18ELalfM5+XNRwzM2nYqXsZQ9ByS1uhj2O/U7+5jqRY=
+golang.org/x/net v0.62.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=