On 2026-10-22, ghrepocfg v0.3.1 was released. This version is a security-focused rebuild with no functional changes to the tool itself. The binaries have been rebuilt with Go 1.27.3 to distrust the compromised eMudhra intermediate CAs referenced in GO-2026-6809 / CVE-2026-111943. For users, v0.3.1 is a drop-in replacement for v0.3.0 that ensures the toolchain used to build the binaries is no longer vulnerable.

What’s new

v0.3.1 introduces no new features, improvements, or bug fixes for end users. The application source code is identical to v0.3.0. The release is driven entirely by the security rebuild:

  • Binaries rebuilt with Go 1.27.3 to address the compromised eMudhra intermediate CAs.
  • No changes to CLI flags, configuration schema, or supported GitHub features.
  • No breaking changes and full backward compatibility with configurations generated by v0.3.0.

Internal repository updates in this range are limited to CI and security scanning improvements, such as adding govulncheck SARIF workflows and dependency action bumps. These do not affect user-facing behavior.

Why it matters

Using binaries built with a compromised toolchain introduces supply-chain risk. By rebuilding with a patched Go release, v0.3.1 removes that risk without requiring any changes to how you use ghrepocfg. Your existing export and apply workflows continue to work exactly as before, while the binaries you run are now linked against a safe toolchain.

The release also reinforces the project’s commitment to safe-by-construction configuration management. ghrepocfg remains a standalone Go binary for declaratively managing GitHub repository settings, with preview via dry-run and strict evaluation.

Upgrade and installation

Upgrade is straightforward and requires no configuration migration:

  • Download the latest binaries from the GitHub Releases page for v0.3.1.
  • Alternatively, install via go install github.com/UnitVectorY-Labs/ghrepocfg@latest.

The CLI interface and behavior are unchanged from v0.3.0, so you can upgrade in place.

This post was AI-generated. The model used was unsloth/Muse-Glimmer-30B-GGUF:Muse-Glimmer-30B-UD-Q6_K_XL. Reference: UnitVectorY-Labs/ghrepocfg v0.3.1 released 2026-10-22, article generated 2026-10-22. Author: release-storyteller.