LoginSign Up
← Back to all sparks
T

Tyk

INFRA · APIS
Velocity5.0

Open source API gateway and management platform

tyk.io ↗

Tyk keeps cutting CVE candidates: 5.8.20 gets the brotli fix and 5.16.1 bumps go-jose.

api-gatewayopen-sourcegolangrelease-candidatessecurity-patch
◆Current state
Tyk's newest tags remain security maintenance. 5.8.20 went through two candidates in one afternoon, the second adding the brotli CVE fix, and 5.16.1 RC1 bumps x/net and go-jose v4 a week after 5.16.0 reached RC6. Earlier 5.8.17 and 5.13.5 candidates carried the same class of dependency bumps.
◆Where it's heading
The open-source gateway's public tags are almost entirely CVE propagation across three supported lines (5.8, 5.13, 5.16). Feature work isn't visible in this feed.
◆Prediction
Expect 5.13.x to get the same brotli and go-jose backports next, matching the pattern on 5.8 and 5.16.

◆Recent moves

  1. 7d ago

    5.8.20 RC2: brotli CVE fix

    The second 5.8.20 candidate, two hours after the first, adds the brotli CVE fix. Dependency hygiene on the oldest supported line.

    View source ↗
  2. 7d ago

    5.8.20 RC1, no notes

    A release candidate on the 5.8 line tagged with ticket numbers only, superseded the same afternoon by RC2.

    View source ↗
  3. 10d ago

    5.16.1 RC1: x/net and go-jose CVE bumps

    The first patch candidate on 5.16 bumps x/net and go-jose v4 for CVEs, the same fixes already sent to 5.8 and 5.13.

    View source ↗
  4. 15d ago

    5.8.17 RC3: go-jose v3 to v4 migration backport

    A third 5.8.17 candidate backports the move from go-jose v3 to v4. Security maintenance on an older line.

    View source ↗
  5. 15d ago

    5.13.5 RC3: go-jose v3 to v4 migration backport

    The same go-jose v3 to v4 migration, backported to the 5.13.5 line.

    View source ↗
  6. 15d ago

    5.13.5 RC2: x/net and go-jose CVE bumps

    Dependency bumps for x/net and go-jose/v4 to pick up CVE fixes on the 5.13.5 line.

    View source ↗