Full Changelog: v1.12.2...v1.12.3

Fixed

• Fixes a bug where fs.Chmod would change the symlink target possibly allowing a malicious user to modify files outside their home directory.
• Improved error handling when downloading files to not log as a 500-level error, preferring a 400-level response.
• Fixes JWT verification logic to confirm that the token has the required scopes for the target subsystem.

Added

• Add mount for /etc/machine-id for servers for Hytale (#292)

Fixed

• CVE-2025-68954
• CVE-2025-69199
• CVE-2026-21696
• Fixes folders not being sorted before files when returning list of directory contents (#5078)
• User-defined labels not being passed to environment (#191)
• Fixes handling of termination signals for containers (#192)
• Fixes logic to use base2 (1024, *bibyte) when calculating memory limits (#190)
• Fixes hard-links being counted multiple times when calculating disk usage (#181)

Added

• Support relative file paths for the Wings config (#180)
• Support mounting generated /etc/passwd files to containers (#197)

Fixed

• Auto-configure not working (#5087)
• Individual files unable to be decompressed (#5034)

SHA256 Checksum

aca5fa45ddf1c10f092c16dd758b920d8a3fa9f91c37aacc62745e72958bf71a  wings_linux_amd64
a3d71e8c67e261fdd287f73dcab98d2a55dbba9ce001794e0006e4ed88fafe6a  wings_linux_arm64

Fixed

• Arbitrary File Write/Read (GHSA-gqmf-jqgv-v8fw)
• Server-side Request Forgery (SSRF) during remote file pull (GHSA-qq22-jj8x-4wwv)
• Invalid Content-Type being used with the wings diagnostics command (#186)

SHA256 Checksum

4bcbd3a71bed9afed37d132980ac553e4bd39a38b5ae53c477d02933746de856  wings_linux_amd64
af5582e05a34228e9ff423ee982fedddf96e374f243fd2bfa0fe42083f821bdf  wings_linux_arm64

Fixed

• Backups missing content when a .pteroignore file is used
• Archives originating from a subdirectory not containing any files (#5030)

SHA256 Checksum

320272339ca71c5254d1879f10c2a5d5df9c39cec73dd7385bd96fa93c874b0a  wings_linux_amd64
06f5b6eb36a1fbeea18a09ea266fe42f78a4f94eefd93dd18242d7474993196a  wings_linux_arm64

Fixed

• Archives randomly ignoring files and directories (#5027)
• Crash when deleting or transferring a server (#5028)

SHA256 Checksum

4f324bc0a85c2f7014b5b5fed9ce6abeb4d17de736ca2a5a2eb3802e8c687fbd  wings_linux_amd64
b21d454541b0993800be23380b387950b3b64ee19d441c1da6014694340e5fa8  wings_linux_arm64

Changed

• Release binaries are now built with Go 1.21.8
• Updated Go dependencies

Fixed

• CVE-2024-27102

SHA256 Checksum

a2a3d28f2556ba7596d049df89d54d9a24c1dc92024b99ec1c68c660249262c4  wings_linux_amd64
b6deeb16737f0c454013f646e9f6d4fabe32036ef5bd69f0fe8b61097a19894f  wings_linux_arm64

Changed

• Release binaries are now built with Go 1.20.10 (resolves CVE-2023-44487)
• Updated Go dependencies

SHA256 Checksum

4aa1e22797e92c01c33766d291e57a48c45c736aad8c736cb6f602aa3a091ec0  wings_linux_amd64
d1b2450adaf254a8574ecf264f4c93a56aa246823a0e34cf2d1504c0ea623386  wings_linux_arm64