v1.4.1: security and component updates

.github/workflows/docker.yaml

@@ -9,11 +9,11 @@ jobs:
     strategy:
       matrix:
         pgpool_version:
-          - 4.5.4
-          - 4.4.9
-          - 4.3.12
-          - 4.2.19
-          - 4.1.22
+          - 4.5.8
+          - 4.4.13
+          - 4.3.16
+          - 4.2.23
+          - 4.1.23
     runs-on: ubuntu-latest
     steps:
       - name: Set up Docker Buildx

COPYING

@@ -1,4 +1,4 @@
-Copyright 2021-2024 Oden Technologies Inc. except as noted below.
+Copyright 2021-2025 Oden Technologies Inc. except as noted below.
 
 Licensed under the Apache License, Version 2.0 (the "License"); you may not use
 this file except in compliance with the License.  You may obtain a copy of the

Dockerfile

@@ -12,8 +12,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-ARG ALPINE_VERSION=3.21
-ARG GO_VERSION=1.24
+ARG ALPINE_VERSION=3.22
+ARG GO_VERSION=1.25
 ARG PLATFORM=linux/amd64
 ###
 ### Build PGPool-II from source in a build container

README.md

@@ -44,6 +44,7 @@ instance no matter what.  This is configureable at deploy time as
 
 Old Version | New Version | Upgrade Guide
 --- | --- | ---
+v1.4.0 | v1.4.1 | [link](UPGRADE.md#v140--v141)
 v1.3.3 | v1.4.0 | [link](UPGRADE.md#v133--v140)
 v1.3.2 | v1.3.3 | [link](UPGRADE.md#v132--v133)
 v1.3.1 | v1.3.2 | [link](UPGRADE.md#v131--v132)
@@ -76,7 +77,7 @@ helm repo update
 ```sh
 export RELEASE_NAME=my-pgpool-service # a name (you will need 1 installed chart for each primary DB)
 export NAMESPACE=my-k8s-namespace     # a kubernetes namespace
-export CHART_VERSION=1.4.0            # a chart version: https://github.com/odenio/pgpool-cloudsql/releases
+export CHART_VERSION=1.4.1            # a chart version: https://github.com/odenio/pgpool-cloudsql/releases
 export VALUES_FILE=./my_values.yaml   # your values file
 
 helm install \

UPGRADE.md

@@ -1,5 +1,24 @@
 # Upgrading Steps
 
+## `v1.4.0` → `v1.4.1`
+
+### SECURITY
+
+This release addresses [CVE-2025-46801](https://nvd.nist.gov/vuln/detail/CVE-2025-46801)
+and is strongly recommended for all users.  The available version of pgpool
+in each release channel is bumped to the latest:
+
+- `4.5.8`
+- `4.4.13`
+- `4.3.16`
+- `4.2.23`
+- `4.1.23`
+
+Additionally:
+
+* the version of the Go runtime used to build the envtpl package is bumped from 1.24 to 1.25
+* the Alpine Linux base image is updated from v3.21 to v3.22
+
 ## `v1.3.3` → `v1.4.0`
 
 The 1.4.0 release removes support for using

charts/pgpool-cloudsql/Chart.yaml

@@ -15,7 +15,7 @@ apiVersion: v2
 description: the pgpool-ii connection pooling postgres proxy with automatic discovery of GCP CloudSQL backends
 name: pgpool-cloudsql
 type: application
-version: 1.4.0
+version: 1.4.1
 keywords:
 - postgresql
 - pgpool
@@ -29,5 +29,5 @@ maintainers:
 - name: odenio
   email: tech@oden.io
   url: https://oden.io
-appVersion: 4.5.4
+appVersion: 4.5.8
 icon: https://www.postgresql.org/media/img/about/press/elephant.png