v7.14.3

HKUDS/LightRAGv7.14.3Feb 26, 2026by github-actions[bot]

AI Summary

This release upgrades Go to 1.25.7 and dependencies to fix a specific CVE (CVE-2025-68121). It also adds security checks to the release workflow to prevent command injection. Additionally, it allows configuring Redis URL parameters for username, password, and max idle connection timeout.

Key Highlights

Go 1.25.7 upgrade and dependency updates
Fix for CVE-2025-68121
Redis URL parameter configuration (username, password, timeout)
Improved supply chain security workflow

New Features

Security vulnerability fix
Redis configuration options
Workflow security improvements

Full Release Notes

## Release Highlights

- 🔵 Go1.25.7 and upgrade of dependencies to latest versions (@tuunit)
  - Fixes [CVE-2025-68121](https://nvd.nist.gov/vuln/detail/cve-2025-68121)
- 🐛 Bug fixes
  - Allow Redis URL parameters to configure username, password and max idle connection timeout if the matching configuration is empty.

## Important Notes

We improved our supply chain security by added additional checks to prevent potential command injection in the publish release workflow and to ensure that it can only be triggered from branches originating in the local repository. This potential issue was reported by automated systems as well as a couple of security researchers, and we want to thank everyone for their diligence in looking out for the security of the project. Especially Aastha Aggarwal for her detailed report and follow-up. @Aastha2602


## Breaking Changes

## Changes since v7.14.2

- [#3183](https://github.com/oauth2-proxy/oauth2-proxy/pull/3183) fix: allow URL parameters to configure username, password and max idle connection timeout if the matching configuration is empty. (@Richard87)