v1.3.5

Grafana xk6 v1.3.5 is here! 🎉

This release introduces subcommand extension support for greater extensibility and includes a critical security update that addresses multiple CVEs by updating to Go 1.25.7.

New Features

• Add support for subcommand extensions (#417) - Implements native support for k6 subcommand extensions in xk6, enabling developers to build and run subcommand extensions more efficiently.

Security

• Update Go to 1.25.7 to fix security vulnerabilities (#431):

  • CVE-2025-68121
  • CVE-2025-61732
  • CVE-2025-61731
  • CVE-2025-61726
  • CVE-2025-68119
  • CVE-2026-25210
  • CVE-2025-60876
  • CVE-2025-61728
  • CVE-2025-61730

• Update github.com/go-git/go-git/v5 to v5.16.5 to address security issues (#424, #423)

Bug Fixes

• Fix missing .exe extension when cross-compiling to Windows from other platforms (#429, fixes #427)

Docker

• Update Go version to 1.25.7-alpine3.23 in Dockerfiles (#431)

Dependencies

• Update github.com/lmittmann/tint to v1.1.3 (#422)

Maintenance

• Update GitHub Actions workflows:
  • Update bats-core/bats-action action to v4 (#426)
  • Update actions/checkout digest (#421)
• Update gosec to v2.23.0 (#425)