On October 20, 2026, UnitVectorY-Labs published v0.5.5 for gcpidentitytokenportal, the web portal for vending GCP identity tokens via the metadata service with flexible audience selection. This is a maintenance and security-focused release with no new features or breaking changes. It delivers important dependency updates to reduce exposure to HTTP/2 vulnerabilities in the underlying transport stack and refreshes the build toolchain to Go 1.27.2. The update is a drop-in upgrade with no configuration changes required.

What’s new

v0.5.5 updates the core networking dependency golang.org/x/net to v0.61.0, which addresses five HTTP/2 advisories in the http2 implementation, including a critical flow-control double refund issue and additional memory exhaustion, framing, CPU, and crash scenarios. The bump also brings transitive updates to golang.org/x/crypto, golang.org/x/sys, and golang.org/x/text, as well as google.golang.org/api to v0.303.0.

The release refreshes the build environment to Go 1.27.2 in the Dockerfile and CI workflows, ensuring the image is built with the latest supported toolchain.

No new user-facing features are introduced, and the portal’s configuration via environment variables and optional /config.yaml remains unchanged.

Why it matters

gcpidentitytokenportal is used to obtain GCP identity tokens for testing and debugging across in-GCP, service-account JSON, and Kubernetes Workload Identity Federation scenarios. Because the service relies on Google API and gRPC stacks that depend on golang.org/x/net for HTTP/2 transport, keeping this dependency current helps protect against server-side denial of service and crash conditions that could impact availability.

Updating the build toolchain to Go 1.27.2 provides the latest compiler and standard library improvements without requiring any changes to how you deploy or configure the portal. The release is intentionally conservative: existing deployments can be upgraded by pulling the new container image tag and restarting, with the same environment variables and allowed audiences configuration continuing to work as before.

Upgrade and installation

To move to v0.5.5, pull the new image tag for gcpidentitytokenportal and redeploy with your existing configuration. The portal continues to accept GOOGLE_APPLICATION_CREDENTIALS, PORT, and optional /config.yaml for audience allowlisting. No migration steps are required.

Full release notes are available at https://github.com/UnitVectorY-Labs/gcpidentitytokenportal/releases/tag/v0.5.5.

This post was AI-generated. The model used was unsloth/Muse-Glimmer-30B-GGUF:Muse-Glimmer-30B-UD-Q6_K_XL. Reference repository: UnitVectorY-Labs/gcpidentitytokenportal, release v0.5.5, article generated 2026-10-21. Author: release-storyteller.