Merge pull request #103 from wollomatic/main

prepare 1.11.4

Author: wollomatic

.github/workflows/dependency-review.yml

@@ -17,11 +17,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
         with:
           egress-policy: audit
 
       - name: 'Checkout Repository'
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: 'Dependency Review'
         uses: actions/dependency-review-action@05fe4576374b728f0c523d6a13d64c25081e0803 # v4.8.3

.github/workflows/docker-image-release.yaml

@@ -20,7 +20,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up Go
-        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version: '1.26'
 

.github/workflows/docker-image-testing.yaml

@@ -22,7 +22,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up Go
-        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version: '1.26'
 

Dockerfile

@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:1
-FROM --platform=$BUILDPLATFORM golang:1.26.0-alpine3.23@sha256:d4c4845f5d60c6a974c6000ce58ae079328d03ab7f721a0734277e69905473e5 AS build
+FROM --platform=$BUILDPLATFORM golang:1.26.1-alpine3.23@sha256:2389ebfa5b7f43eeafbd6be0c3700cc46690ef842ad962f6c5bd6be49ed82039 AS build
 WORKDIR /application
 COPY . ./
 ARG TARGETOS

README.md

@@ -1,7 +1,7 @@
 # socket-proxy
 
 ## Latest image
-- `wollomatic/socket-proxy:1.11.3` / `ghcr.io/wollomatic/socket-proxy:1.11.3`
+- `wollomatic/socket-proxy:1.11.4` / `ghcr.io/wollomatic/socket-proxy:1.11.4`
 - `wollomatic/socket-proxy:1` / `ghcr.io/wollomatic/socket-proxy:1`
 
 > [!IMPORTANT]

SECURITY.md

@@ -1,5 +1,5 @@
 -----BEGIN PGP SIGNED MESSAGE-----
-Hash: SHA256
+Hash: SHA512
 
 # Security Policy
 
@@ -11,22 +11,22 @@ As no breaking changes to existing features are planned, only the most recent ve
 
 The docker images are signed with cosign. The public key is available in the repository, on [https://wollomatic.de/socket-proxy/cosign.pub](https://wollomatic.de/socket-proxy/cosign.pub) and here:
 ```
-- -----BEGIN PUBLIC KEY-----
+- - - -----BEGIN PUBLIC KEY-----
 MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEYdXlfRbkO6KqPU7Khn1mSjbOIaD3
 um421A0NeT1wi840iWNp6MVKyj3tpnAyaQcLgd5/22O+eEHY+5+EHwB+eA==
-- -----END PUBLIC KEY-----
+- - - -----END PUBLIC KEY-----
 ```
 
 The signature is stored at Docker hub as well. For more information about cosign, see [https://github.com/sigstore/cosign#readme](https://github.com/sigstore/cosign#readme).
 
 ## Reporting a Vulnerability
 
-Please report vulnerabilities to security2025(at)wollomatic.de
+Please report vulnerabilities to git2026(at)wollomatic.dev
 
 Feel free to encrypt the message if you like:
-
+[Download PGP public key 9123F130](https://wollomatic.dev/gpg/9123F130.gpg.asc)
 ```
-- - -----BEGIN PGP PUBLIC KEY BLOCK-----
+- - - - -----BEGIN PGP PUBLIC KEY BLOCK-----
 Comment: Benutzer-ID:	<security2025(at)wollomatic.de>
 Comment: Gültig seit:	30.12.2021 18:15
 Comment: Gültig bis:	31.12.2025 12:00
@@ -83,21 +83,12 @@ AGx0J/IYKvNwbYErCoOsqM78lZZ20hvKwDCW1jNEZibqiL98yhQhoEymTu9FHShR
 WrjWE3RoPNCEPKwCVSh08Y/bVcUyfkDNKkN3l8lT34TIEUOkzdXD2JLL6cogLpn2
 Q/PCqEw9
 =6UYI
-- - -----END PGP PUBLIC KEY BLOCK-----
+- - - - -----END PGP PUBLIC KEY BLOCK-----
 ```
 -----BEGIN PGP SIGNATURE-----
 
-iQIzBAEBCAAdFiEE1XQkrHwmL0tE9FtXVYa3pNFebKcFAmUlklgACgkQVYa3pNFe
-bKf0IA/9ECqre6kojV3oE4KK5JRjHLHCNcwDHcu8WBOcf7gcZmAdkBf3oh3iBB8H
-wPhBcE3UWYRwT6dCGiTNct9KmpiB82JWX/kbGWNY501m8UTP04TB4M6Pp0ZowkkR
-GQgqcXSgFRyd6wvoVQVuQSLjCWwvjh+jzdQL24l038eskrXN6GaLXQbasCABDcma
-VeTe0BMtkQ+5EBRssMFQimgOod37AuMc3haJoAj4tfsJuH4pOCcU4v9NTF1fOc1u
-Gz3jty7v4LmQ/qShrYPXR0O5Id2Jttg5yqpYtox3ULN637UXlkGQSEREVep6lgYE
-+9zBLm7lyjmX0jBI/YgJxWE8+BVL7SujnIl+MB8Jx9ySh+JYVQ/qDk79hL+1Cykk
-TFPtk9OWqjIHXvsePOCIpx5OhzGdV96OI+m5UapNbBw1EfYgEDGmF2R23bMQECVd
-HeGYgVeK/PqOc/sP1fVN9c7qbtEplU4AIcys3rugnn4XVsiHTY7SbxoUx+hZnYLO
-Dn0/xj8hIaV9kgVwIzIWhfAF47UsxlN162Rx2Kmqyr1INA7TWa+k+v6x5vc5iMul
-xTIJoNUgwtjneyZEceNFwJkjfAn1aT4Ruy4R2s0rWkvWYj/rbR9dgWurhgpnjJke
-kgnVHf8ZLligrqyP1HNZnm8bYGCnefdmlNPRt91/996219jKq7Y=
-=RUM/
+iHUEARYKAB0WIQQX7u5MQzQWc4kIq7Te/gx2oe2rbQUCaaybJwAKCRDe/gx2oe2r
+bYhkAQCRbh/Bn1+/7sFlP2jU9BKfNUkSy/Ss5PA9DpYlHu4SaAD/RJXH70xYb7jW
+t90C39ppKOCFyshcaTWPGWmE5treYQo=
+=er7Z
 -----END PGP SIGNATURE-----