chore(release): v0.12.1

2026-09-20 20:56:05 +02:00
parent 1093c5bad8
commit 24d85f3738
5 changed files with 22 additions and 4 deletions
@@ -9,6 +9,24 @@ generated trace matrix lives in [docs/traceability.md](docs/traceability.md).
 For how long each fixed defect had been shipping before it was found, see
 [docs/defect-windows.md](docs/defect-windows.md).

+## v0.12.1
+
+One change: the TLS library every connection to the server goes through has a
+published vulnerability, and this build carries the fixed release of it. Nothing
+in JellyTau itself changed.
+
+### 🔒 Security
+
+- **Updated the TLS library (rustls) to 0.23.45** for
+  [RUSTSEC-2026-0285](https://rustsec.org/advisories/RUSTSEC-2026-0285). The
+  version in v0.12.0 accepted TLS 1.3 handshake messages sent at the wrong
+  encryption level — the same fault as Go's CVE-2025-61730. The handshake stays
+  authenticated, so someone on the network could not alter or complete a
+  connection with it; the practical effect was that a server could send in
+  plaintext what should have been encrypted without the app refusing. Every
+  JellyTau build from the first release used an affected version. Found by the
+  dependency-advisory gate in CI, which is what it is there for.
+
 ## v0.12.0

 JellyTau works against Jellyfin 12. Jellyfin 12.0 shipped on 2026-09-08 and