GitLab

shaw authored Apr 08, 2026 and 陈曦 committed Apr 08, 2026

Fixes GO-2026-4947, GO-2026-4946, GO-2026-4870, GO-2026-4869,
GO-2026-4866, GO-2026-4865 in crypto/x509, crypto/tls, archive/tar,
and html/template.

Docker named volumes and host bind-mounts may be owned by root,
causing "open data/model_pricing.sha256: permission denied" when
the container runs as the non-root sub2api user.

Add an entrypoint script that fixes /app/data ownership before
dropping to sub2api via su-exec. Replace USER directive with the
entrypoint approach across all three Dockerfiles and update both
GoReleaser configs to include the script in Docker build contexts.

GO-2026-4602 (os), GO-2026-4601 (net/url), GO-2026-4600 and
GO-2026-4599 (crypto/x509). The crypto/x509 fixes are only
available in go1.26.1+, not backported to go1.25.x.

实现直连 Sora 客户端、媒体落地与清理策略\n更新网关与前端配置以支持 Sora 平台\n补齐单元测试与契约测试，新增 curl 测试脚本\n\n测试: go test ./... -tags=unit

修复GO-2026-4341和GO-2026-4340两个标准库漏洞

主要改动：
- 固定 Go 1.25.5 与 CI 校验并更新扫描流程
- 升级 quic-go、x/crypto、req 等依赖并通过 govulncheck
- 强化 JWT 校验、TLS 配置与 xlsx 动态加载
- 新增审计豁免清单与校验脚本

- 修复 Dockerfile 使用 pnpm 替代 npm ci（适配 pnpm 迁移）
- 为 docker-compose-test.yml 添加自动构建配置
- 更新测试配置文档说明一键构建命令

🤖 Generated with [Claude Code](https://claude.com/claude-code

)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

允许通过构建参数/脚本选项切换基础镜像来源，避免镜像源 403 影响构建

golang 1.24-> 1.25
node 20 -> node 24
具体提升请查看官方文档
Co-authored-by: yangjianbo <yangjianbo@leagsoft.com>

golang 1.24-> 1.25
node 20 -> node 24
具体提升请查看官方文档

- Add -tags=embed flag to GoReleaser builds
- Add -tags embed flag to Dockerfile builds
- Fix Dockerfile COPY order to prevent frontend dist being overwritten
- Update README build instructions with embed tag explanation