kubefwd 이전 버전 및 전체 버전

kubefwd v1.25.18
Security release. Everyone on v1.25.17 or earlier should upgrade.
v1.25.17 shipped with known vulnerabilities in golang.org/x/net, golang.org/x/crypto and golang.org/x/text. This release updates those modules and has no other changes. It includes all of v1.25.17's bug fixes. See the v1.25.17 notes for those.

Advisories fixed (#623)
───────────────────────────────────┬────────┬──────────────────────┬────────────────────────────────────────────────────
Advisory │Module │Reachable from kubefwd│Summary
───────────────────────────────────┼────────┼──────────────────────┼────────────────────────────────────────────────────
GO-2026-6617 │x/net │yes │HTTP/2 server crash from an HPACK encoder race
───────────────────────────────────┼────────┼──────────────────────┼────────────────────────────────────────────────────
GO-2026-6612 │x/net │yes │Double flow-control refund on HTTP/2 server streams
───────────────────────────────────┼────────┼──────────────────────┼────────────────────────────────────────────────────
GO-2026-6611 │x/net │yes │Excessive CPU from repeated initial window changes
───────────────────────────────────┼────────┼──────────────────────┼────────────────────────────────────────────────────
GO-2026-6610 │x/net │yes │HTTP/2 transport accepts malformed framing headers
───────────────────────────────────┼────────┼──────────────────────┼────────────────────────────────────────────────────
GO-2026-6603 │x/net │yes │HTTP/2 server memory exhaustion from Trailer headers
───────────────────────────────────┼────────┼──────────────────────┼────────────────────────────────────────────────────
GO-2026-6355, GO-2026-6354 │x/crypto│no (ssh) │DoS on deadlocked SSH channels
───────────────────────────────────┼────────┼──────────────────────┼────────────────────────────────────────────────────
GO-2026-6303 │x/crypto│no (ssh) │SSH source-address option not enforced
───────────────────────────────────┼────────┼──────────────────────┼────────────────────────────────────────────────────
GO-2026-6629 │x/text │no (precis) │Panic parsing crafted input
───────────────────────────────────┴────────┴──────────────────────┴────────────────────────────────────────────────────
"Reachable" is govulncheck's call-graph result for kubefwd's source.
───────────────────┬────────┬────────
Module │v1.25.17│v1.25.18
───────────────────┼────────┼────────
golang.org/x/net │0.57.0 │0.60.0
───────────────────┼────────┼────────
golang.org/x/crypto│0.54.0 │0.57.0
───────────────────┼────────┼────────
golang.org/x/text │0.40.0 │0.42.0
───────────────────┼────────┼────────
golang.org/x/sync │0.22.0 │0.23.0
───────────────────┼────────┼────────
golang.org/x/term │0.45.0 │0.46.0
───────────────────┴────────┴────────
The integration-test module also moves to x/crypto 0.57.0 and x/sys 0.48.0. That module isn't part of the binary.

Verification
Built with Go 1.26.9. govulncheck reports no vulnerabilities in:
- kubefwd's source, the root module (./...)
- the integration-test module (-tags=integration ./...)
- an unstripped binary built from the release commit (-mode binary)
Scanning the released binaries (-mode binary on kubefwd_Darwin_arm64 and kubefwd_Linux_x86_64) reports one advisory, GO-2026-5932: the golang.org/x/crypto/openpgp package is deprecated, and no fixed version exists. This is a false positive:
- kubefwd doesn't include the package. go list -deps on the release build configuration shows no openpgp package.
- The scanner can't check symbols in release binaries. They're stripped (-ldflags "-s -w"), so govulncheck falls back to matching the whole x/crypto module.
- Stripping is the only difference. The same code built unstripped scans clean.
Check the build provenance of any asset:
gh attestation verify kubefwd_Darwin_arm64.tar.gz --repo txn2/kubefwd
Checksums are in kubefwd_checksums.txt, which also has a sigstore bundle.

Install / upgrade
# Homebrew (macOS / Linux)
brew upgrade kubefwd # or: brew install txn2/tap/kubefwd
# Docker
docker pull

kubefwd v1.25.16
This release modernizes the interactive Terminal UI by moving it onto the Charm v2 library line, hardens API-key startup logging, and rolls up routine dependency and CI maintenance.

Highlights

TUI migrated to Charm v2 (#527, closes #517)
The entire interactive TUI (--tui) has been migrated from the v1 Charm libraries to their v2 equivalents under the charm.land/... module path:
──────────────────────────────────────────┬────────────────────────────────────────
Before │After
──────────────────────────────────────────┼────────────────────────────────────────
github.com/charmbracelet/bubbletea v1.3.10│charm.land/bubbletea/v2 v2.0.7
──────────────────────────────────────────┼────────────────────────────────────────
github.com/charmbracelet/lipgloss v1.1.0 │charm.land/lipgloss/v2 v2.0.4
──────────────────────────────────────────┼────────────────────────────────────────
github.com/charmbracelet/bubbles v1.0.0 │charm.land/bubbles/v2 v2.1.0
──────────────────────────────────────────┼────────────────────────────────────────
github.com/evertras/bubble-table v0.19.2 │github.com/evertras/bubble-table v0.22.3
──────────────────────────────────────────┴────────────────────────────────────────
These are distinct, incompatible type systems, so this was a full API migration rather than a version bump. Notable changes handled under the hood:
- View() returns tea.View - alt-screen and mouse capture moved from the removed tea.WithAltScreen() / tea.WithMouseCellMotion() program options to the AltScreen / MouseMode fields on the returned view, applied on every render path.
- Keys - tea.KeyMsg is now an interface; all handlers (services, logs, detail, browse, and help) dispatch on the concrete tea.KeyPressMsg.
- Mouse - tea.MouseMsg split into tea.MouseWheelMsg / tea.MouseClickMsg, with renamed button constants; all wheel-scroll and click-to-focus behavior preserved.
- Styling - lipgloss.Color is now a function returning image/color.Color; viewport sizing moved to SetWidth() / SetHeight() and option-based construction.
No user-facing behavior changes. All keyboard shortcuts (j/k, Enter, Tab, /, r, b, ?, q), traffic metrics, log streaming, theme switching, and auto-reconnect work exactly as before. The dark/light theme workaround was re-validated under lipgloss v2. Verified on ubuntu + macOS with go build, go vet, golangci-lint (0 issues), and the full test suite.

API-key authentication: docs and safer startup logging (#526)
Follow-up to the API-key auth feature (#508):
- Security: the API key is now only printed at startup when kubefwd generated it. A user-supplied KUBEFWD_API_KEY is referenced by name and never echoed to logs.
- Docs: the Authentication sections of openapi.yaml, api-reference.md, and mcp-integration.md were rewritten to cover the Bearer header, KUBEFWD_API_KEY / kubefwd mcp --api-key, the /api/health exemption, and the 401 response.

Dependency updates
- k8s.io/streaming 0.36.1 -> 0.36.2 (#523)
- k8s.io/kubectl 0.36.1 -> 0.36.2 (#525)
- k8s.io/cli-runtime 0.36.1 -> 0.36.2 (#522)
- golang.org/x/sys 0.45.0 -> 0.46.0 (#518)
- github.com/txn2/txeh 1.8.0 -> 1.8.1 (#516)
- github.com/quic-go/quic-go bump (#511)

CI / build
- codecov/codecov-action 6.0.1 -> 7.0.0 (#521)
- github/codeql-action 4.36.0 -> 4.36.1 -> 4.36.2 (#512, #520)
- actions/checkout 6.0.2 -> 6.0.3 (#514)
- docker/setup-qemu-action 4.0.0 -> 4.1.0 (#513)

Install / upgrade
# Homebrew (macOS / Linux)
brew install txn2/tap/kubefwd
brew upgrade kubefwd
# Or download a binary for your platform from the assets below.
Run it (requires root for /etc/hosts and loopback aliases):
sudo -E kubefwd svc -n <namespace> --tui