Merge pull request #3900 from dtrudg/prep-4.3.6

chore: Prepare for 4.3.6 release

Author: dtrudg

.circleci/config.yml

@@ -6,7 +6,7 @@ orbs:
 parameters:
   go-version:
     type: string
-    default: '1.25.4'
+    default: '1.25.5'
 
 executors:
   node:

CHANGELOG.md

@@ -1,5 +1,13 @@
 # SingularityCE Changelog
 
+## 4.3.6 \[2025-12-16\]
+
+### Security Related Fixes
+
+- Updates bundled CNI plugins to v1.9.0, to fix
+  [CVE-2025-67499](https://github.com/containernetworking/plugins/security/advisories/GHSA-jv3w-x3r3-g6rm)
+  Portmap nftables backend can intercept non-local traffic.
+
 ## 4.3.5 \[2025-12-02\]
 
 ### Security Related Fixes

INSTALL.md

@@ -163,7 +163,7 @@ _**NOTE:** if you are updating Go from a older version, make sure you remove
 `/usr/local/go` before reinstalling it._
 
 ```sh
-export VERSION=1.25.3 OS=linux ARCH=amd64  # change this as you need
+export VERSION=1.25.5 OS=linux ARCH=amd64  # change this as you need
 
 wget -O /tmp/go${VERSION}.${OS}-${ARCH}.tar.gz \
   https://dl.google.com/go/go${VERSION}.${OS}-${ARCH}.tar.gz
@@ -228,11 +228,11 @@ git submodule update --init
 By default your clone will be on the `main` branch which is where development
 of SingularityCE happens. To build a specific version of SingularityCE, check
 out a [release tag](https://github.com/sylabs/singularity/tags) before
-compiling. E.g. to build the 4.3.5 release, checkout the
-`v4.3.5` tag:
+compiling. E.g. to build the 4.3.6 release, checkout the
+`v4.3.6` tag:
 
 ```sh
-git checkout --recurse-submodules v4.3.5
+git checkout --recurse-submodules v4.3.6
 ```
 
 ## Compiling SingularityCE

e2e/testdata/Dockerfile.nested

@@ -1,6 +1,6 @@
 FROM ubuntu:25.04
 
-ARG GOVERSION="go1.25.3"
+ARG GOVERSION="go1.25.5"
 ARG GOOS="linux"
 ARG GOARCH="amd64"
 ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/go/bin