From 57b8f36bfe8e84a4251600c410db8711d2f2a18f Mon Sep 17 00:00:00 2001 From: TrueCharts Bot Date: Sun, 31 May 2026 03:26:27 +0200 Subject: [PATCH] =?UTF-8?q?fix(sftpgo):=20update=20image=20ghcr.io/drakkan?= =?UTF-8?q?/sftpgo=20v2.7.1=20=E2=86=92=20v2.7.3=20(#48653)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/drakkan/sftpgo](https://redirect.github.com/drakkan/sftpgo) | patch | `036a669` → `4d47ba4` | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/18710) for more information. Add the preset `:preserveSemverRanges` to your config if you don't want to pin your dependencies. --- ### Release Notes
drakkan/sftpgo (ghcr.io/drakkan/sftpgo) ### [`v2.7.3`](https://redirect.github.com/drakkan/sftpgo/releases/tag/v2.7.3) [Compare Source](https://redirect.github.com/drakkan/sftpgo/compare/v2.7.1...v2.7.3) ##### New features - Added a configurable minimum-entropy check (`common.secret_min_entropy`, default 80) for data-at-rest encryption secrets (CryptFs passphrase, S3 SSE-C key), to reject trivially weak key material at submission time. - Logs: added the virtual path to transfer/command logs and to event-log CSV exports. - WebClient: replaced glightbox with a custom lightbox implementation for better CSP compatibility. ##### Bug fixes - IP list: fixed matching when an IP is covered by multiple conflicting entries. - Fixed comparison of unordered slices. - Shares: enforce `max_tokens` atomically via a guarded conditional update, closing a check-then-write race that could let a usage-capped share be used more times than allowed under concurrent access. - In-memory reset-code manager: check code expiry at retrieval time instead of relying only on the background cleanup. ##### Security fixes - Fixed a path-confinement bypass in the public browsable-share partial ZIP download. CVE-2026-49244. - Fixed a stored XSS where the `inline` parameter on browsable-share and authenticated user file downloads suppressed `Content-Disposition: attachment`, allowing an attacker-supplied HTML file to execute in SFTPGo's web origin. These endpoints now always respond with `Content-Disposition: attachment` and the `inline` parameter has been removed. CVE-2026-49245. ##### Hardening - Neutralized CSV formula injection in the Event Manager and event-log CSV exports: cells starting with `=`, `+`, `-`, `@`, tab or CR are now prefixed with a single quote. - Username, folder, group and other object names now reject invisible Unicode formatting characters (e.g. zero-width joiners, bidirectional overrides, BOM) and line/paragraph separators, preventing the creation of invisible or visually confusable names and newline-like codepoints that could appear in paths and logs. - WebClient: trigger a defender event on share login failure.
--- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://redirect.github.com/renovatebot/renovate). --- charts/stable/sftpgo/Chart.yaml | 4 ++-- charts/stable/sftpgo/values.yaml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/charts/stable/sftpgo/Chart.yaml b/charts/stable/sftpgo/Chart.yaml index b06270cf7c0..43bc5abb3b3 100644 --- a/charts/stable/sftpgo/Chart.yaml +++ b/charts/stable/sftpgo/Chart.yaml @@ -9,7 +9,7 @@ annotations: trueforge.org/min_helm_version: "3.14" trueforge.org/train: stable apiVersion: v2 -appVersion: 2.7.1 +appVersion: 2.7.3 dependencies: - name: common version: 29.3.4 @@ -36,5 +36,5 @@ sources: - https://github.com/drakkan/sftpgo - https://github.com/trueforge-org/truecharts/tree/master/charts/stable/sftpgo type: application -version: 10.3.0 +version: 10.3.1 diff --git a/charts/stable/sftpgo/values.yaml b/charts/stable/sftpgo/values.yaml index 0de92f88b36..f9d3b1e7601 100644 --- a/charts/stable/sftpgo/values.yaml +++ b/charts/stable/sftpgo/values.yaml @@ -2,7 +2,7 @@ image: pullPolicy: IfNotPresent repository: ghcr.io/drakkan/sftpgo - tag: v2.7.1-plugins@sha256:036a6695a13e227300f2728ee98d62f5ad18d78495173bca1a1450278f1f783f + tag: v2.7.3-plugins@sha256:4d47ba4007a1ddf08739ff4af61b7cec94e8327e57721776bd3f204c029b90d0 securityContext: container: runAsNonRoot: false