docker/egress/v1.1.5

Alishahryar1/free-claude-codedocker/egress/v1.1.5Jul 27, 2026by Pangjiping

AI Summary

This release adds experimental support for intercepting extra TCP ports beyond 80/443, fixes npm scoped package 403 errors under Credential Vault, and patches critical security vulnerabilities in Go dependencies.

Key Highlights

Experimental interception of extra TCP ports beyond 80/443.
Fixed npm scoped packages no longer 403 under Credential Vault.
Fixed DNS surviving `deny.always` overlays containing 127.0.0.0/8.
Patched CVEs for Go dependencies (grpc, postcss, x/net, x/crypto).

New Features

Intercept extra TCP ports via `OPENSANDBOX_EGRESS_MITMPROXY_EXTRA_PORTS`.
Fixed npm scoped packages access.
Fixed DNS loopback deny rules.
Updated Go dependencies to version 1.25.

Full Release Notes

## What's New

### ✨ Features

- **Intercept extra TCP ports beyond 80/443 (experimental).** New env var `OPENSANDBOX_EGRESS_MITMPROXY_EXTRA_PORTS` (comma-separated) appends extra destination ports to the transparent-mitm REDIRECT rule, with fail-closed validation. Note: extra ports are decrypted and logged but not yet matched against credential bindings. (#1379)

### 🐛 Bug Fixes

- **npm scoped packages no longer 403 under Credential Vault.** A single-layer `%2f` (e.g. `/@scope%2fname`) is now allowed, while `%2f` that crosses a credential binding boundary — plus nested encodings, backslashes, and dot-segments — is still rejected. (#1369)

- **DNS survives `deny.always` overlays containing `127.0.0.0/8`.** In `dns+nft` mode, DNS redirected to `127.0.0.1:15353` is now accepted before the deny sets, so a loopback deny rule no longer breaks sandbox DNS under Docker. (#1380)

- **Purge stale mitmproxy CA on startup.** egress now erases the exported CA early in startup so a co-restarting agent doesn't install a stale CA, fixing `unable to get local issuer certificate` on HTTPS from the agent. (#1371)

### 🔒 Security

- **CVE patches for Go dependencies.** `grpc` → v1.82.1 (xDS RBAC / HTTP/2) and `postcss` → 8.5.11 (#1385); `x/net` → v0.55.0 (HTML parser DoS) and `x/crypto` → v0.52.0 (13 SSH advisories), bringing modules to Go 1.25. (#1250)

### 📦 Misc

- **License headers.** Added missing Apache 2.0 headers to fix the `verify-license` CI workflow. (#1313)

## 👥 Contributors

Thanks to these contributors ❤️

- @LorenzoRD2003
- @Pangjiping

---
- Docker Hub: opensandbox/egress:v1.1.5
- Aliyun Registry: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:v1.1.5
- GHCR: ghcr.io/opensandbox-group/opensandbox/egress:v1.1.5