Sourced from github.com/letsencrypt/boulder's releases.
v0.20260420.0
What's Changed
- bump pkimetal to v1.41.0 and ignore new ctlint warning by
@mcpherrinmin letsencrypt/boulder#8713- observer: use new URL for AllCertificates by
@jshain letsencrypt/boulder#8718- observer: use CCADB AllCertificates V5 URL by
@jshain letsencrypt/boulder#8719Full Changelog: https://github.com/letsencrypt/boulder/compare/v0.20260413.0...v0.20260420.0
Sourced from github.com/libdns/route53's releases.
v1.6.2
Fixed
- Concurrent
AppendRecordscalls targeting the same(name, type)no longer lose values. The provider now serializes the read-merge-UPSERT cycle per(zone, name, type). Previously, two goroutines (e.g. ACME challenges forexample.comand*.example.comsharing_acme-challenge.example.comTXT) could both observe pre-write state and the later UPSERT would clobber the earlier — causing dropped tokens and validation failures.SetRecordswith multiple input records sharing the same(name, type)now keeps all values. The previous per-record loop UPSERTed each independently, leaving only the last value.- Pre-existing filter bug in the
AppendRecords/DeleteRecordsmerge path:getRecordsreturns relative names but the filter compared againstlibdns.AbsoluteName(...), so existing values were never matched. The merge silently treated the set as empty, which (combined with UPSERT replacing the entire RecordSet) could overwrite data. Fixed.Added
- Regression tests in
libdnstest/:TestAppendRecords_Concurrent(10 goroutines into one shared name) andTestSetRecords_MultiValue.Internal
Provider.initnow usessync.Oncefor AWS client construction (was a non-atomicnilcheck).- Removed dead code:
createRecord,changeRecord,updateRecord(orphaned by #294 and theSetRecordsrewrite).quote.go: addressgosecG115 andstaticcheckQF1012 warnings.Note on multi-process deployments
The lock is in-process. Multiple processes writing to the same RecordSet still need external coordination —
certmagic's per-identifier storage lock does not cover this case because racing identifiers (e.g.foo.example.comvs*.foo.example.com) share a common parent RecordSet.v1.6.1
Fixed
AppendRecordsno longer fails when the target ResourceRecordSet already exists. Single-record appends now merge with existing values via UPSERT, matching the multi-record path. Resolves stale ACME challenge TXT failures (#294, thanks@andrewseddon).Added
Provider.Logger *slog.Loggerfor structured logging. Defaults to a discard handler. Wrappers (e.g. caddy-dns/route53) can adapt their own logger viaslog.Handler— for zap, seego.uber.org/zap/exp/zapslog. Events are Debug-level except ambiguous zone resolution (Warn).Internal
840c612
Fix quote.go lint warnings14cb77f
Serialize per-tuple record-set RMW; fix multi-value SetRecordsa2820be
Add structured logging via slog7ebfd9f
Fix libdnstest module: bump libdns, drop stale replace7399dbe
Merge pull request #293
from libdns/dependabot/github_actions/actions/checkout-6d14a81a
Merge pull request #292
from libdns/dependabot/github_actions/golangci/golang...351c9e6
Merge pull request #294
from andrewseddon/fix-append-records-upsert2687fa6
fix: use UPSERT instead of CREATE in AppendRecords for single
records35a512a
chore(deps): bump actions/checkout from 5 to 638b146f
chore(deps): bump golangci/golangci-lint-action from 8 to 9c7496f1
More validation of delegated OCSP responders (#378)cdc4eb2
fix: Normalization IPv6 addresses for ACME challenge (#376)2cf7e08
Revert "Fix HTTP-01 challenge for IPv6 literal addresses (#377)"3e3363f
readme: add dark-mode banner for GitHub UI (#379)3229642
go.mod: Upgrade indirect dependencies60d9d8b
Fix HTTP-01 challenge for IPv6 literal addresses (#377)e03792e
Modernize TLSConfig() (close #375)fa1257f
Unblock ManageAsync() by putting manageOne() in a goroutine (#374)b9e85a9
Don't log nil errors when stapling OCSP (fix #362)a7a8ce3
logging: Disable stack traces, fix logger name (#372)