juju

v4.0.11 Security

This release includes 5 security fixes for security teams reviewing exposed deployments.

Published 1d Containers & Orchestration

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 5 known CVEs

Topics

containers devops go juju kubernetes operations

Affected surfaces

deps

ReleasePort's take

Moderate signal

editorial:auto 1d

This release resolves critical security vulnerabilities in the golang.org/x/crypto/ssh and golang.org/x/net/html dependencies.

Why it matters: Addresses high‑severity (severity 90) security issues affecting core Go SSH and HTML parsing libraries; operators should update immediately to mitigate risk.

Summary

AI summary

Broad release touches fix, chore, feat, and test.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Resolves security vulnerability in golang.org/x/crypto/ssh. Resolves security vulnerability in golang.org/x/crypto/ssh. Source: llm_adapter@2026-06-02 Confidence: high	—
Security	Critical	Resolves security vulnerabilities in golang.org/x/net/html. Resolves security vulnerabilities in golang.org/x/net/html. Source: llm_adapter@2026-06-02 Confidence: high	—
Feature	Medium	Adds '--file' support to the `update-cloud` command. Adds '--file' support to the `update-cloud` command. Source: llm_adapter@2026-06-02 Confidence: high	—
Feature	Medium	Updates DQLite to version 1.18.6. Updates DQLite to version 1.18.6. Source: llm_adapter@2026-06-02 Confidence: high	—
Bugfix
Bugfix	Medium	Gracefully handles missing storage backing status during backup. Gracefully handles missing storage backing status during backup. Source: llm_adapter@2026-06-02 Confidence: high	—
Bugfix	Medium	Ensures backup creation works after Juju upgrade. Ensures backup creation works after Juju upgrade. Source: llm_adapter@2026-06-02 Confidence: high	—
Bugfix	Medium	Ensures controller application is exposed after upgrade. Ensures controller application is exposed after upgrade. Source: llm_adapter@2026-06-02 Confidence: high	—
Bugfix	Medium	Disallows updating storage provider type. Disallows updating storage provider type. Source: llm_adapter@2026-06-02 Confidence: high	—
Bugfix	Medium	Adds robust “not found” error handling in firewallers. Adds robust “not found” error handling in firewallers. Source: llm_adapter@2026-06-02 Confidence: high	—
Bugfix	Medium	Validates subnets atomically when adding network spaces. Validates subnets atomically when adding network spaces. Source: llm_adapter@2026-06-02 Confidence: high	—

Full changelog

The Juju team is proud to release Juju 4.0.11!

This is a point release to the stable 4.0 series of Juju.

Checkout the Juju 4.0.11 Release Notes

What's Changed

chore: update juju/charm/v8 to v8.1.0 by @wallyworld in https://github.com/juju/juju/pull/22063
fix(bundle): treat compare integral float values as ints by @raineszm in https://github.com/juju/juju/pull/22061
test: fix cmr shell test failures by @wallyworld in https://github.com/juju/juju/pull/22177
chore(deps): bump golang.org/x/net from 0.52.0 to 0.53.0 by @dependabot[bot] in https://github.com/juju/juju/pull/22204
chore: merge private branch with CVE fixes by @wallyworld in https://github.com/juju/juju/pull/22205
chore: merge private branch with CVE fixes by @wallyworld in https://github.com/juju/juju/pull/22206
docs: fix typo in 2.9 release notes by @wallyworld in https://github.com/juju/juju/pull/22209
2.9 release notes typo by @wallyworld in https://github.com/juju/juju/pull/22210
feat: handle proxy in retrieveCACert function by @kian99 in https://github.com/juju/juju/pull/22165
chore(deps): security vulnerabilities by @iyiguncevik in https://github.com/juju/juju/pull/22211
fix: add recent introduced azure fallback cloud regions by @CodingCookieRookie in https://github.com/juju/juju/pull/22216
fix: migrate machine hostname by @adisazhar123 in https://github.com/juju/juju/pull/22207
fix: k8s deployment issue with rootfs and tmpfs by @CodingCookieRookie in https://github.com/juju/juju/pull/22163
chore: merge 2.9 into 3.6 + security vulnerabilities by @iyiguncevik in https://github.com/juju/juju/pull/22232
feat: display and update application storage cmd interface by @CodingCookieRookie in https://github.com/juju/juju/pull/21241
docs: update sphinx-llm to v0.4.0 with absolute URLs by @tmihoc in https://github.com/juju/juju/pull/22256
feat: add support of '--file' for update-cloud by @Tony-WLB in https://github.com/juju/juju/pull/22191
chore(deps): bump golang.org/x/mod from 0.34.0 to 0.35.0 by @dependabot[bot] in https://github.com/juju/juju/pull/22215
fix: gracefully handle missing storage backing status by @adisazhar123 in https://github.com/juju/juju/pull/22159
fix: exclude empty checksum from backup metadata json by @wallyworld in https://github.com/juju/juju/pull/22261
fix: ensure create backup works after upgrade by @wallyworld in https://github.com/juju/juju/pull/22271
fix(logsink,logsender): send proper WebSocket close codes and treat them as io.EOF by @xtrusia in https://github.com/juju/juju/pull/22065
feat: inject default image repo during build by @jack-w-shaw in https://github.com/juju/juju/pull/22255
fix: add a short model id to error messages by @jameinel in https://github.com/juju/juju/pull/22269
fix: use stderr not tty in backup shell test by @wallyworld in https://github.com/juju/juju/pull/22286
fix: grouping ports issue by @Deadinside101 in https://github.com/juju/juju/pull/22278
test: backport test fixes for model metrics shell tests by @wallyworld in https://github.com/juju/juju/pull/22292
feat(dqlite): update dqlite 1.18.6 by @SimonRichardson in https://github.com/juju/juju/pull/22289
feat(dqlite): update dqlite 1.18.6 by @SimonRichardson in https://github.com/juju/juju/pull/22297
3.6 update release notes structure by @tmihoc in https://github.com/juju/juju/pull/22302
Update 2.9 release notes support statement by @tmihoc in https://github.com/juju/juju/pull/22301
docs: update landing pages by @tmihoc in https://github.com/juju/juju/pull/22173
feat: mongo-client script by @nicolasbock in https://github.com/juju/juju/pull/22312
fix: snap linker for JujudOCINamespace by @jack-w-shaw in https://github.com/juju/juju/pull/22320
docs: set up multi-version sitemaps by @tmihoc in https://github.com/juju/juju/pull/22299
fix: ensure controller app is exposed on upgrade by @wallyworld in https://github.com/juju/juju/pull/22313
2.9 into 3.6 by @jack-w-shaw in https://github.com/juju/juju/pull/22325
docs: small fixes to hooks reference documentation by @astrojuanlu in https://github.com/juju/juju/pull/22318
fix: disallow updating storage provider type by @adisazhar123 in https://github.com/juju/juju/pull/22287
fix: add robust not found error handling in firewallers by @wallyworld in https://github.com/juju/juju/pull/22339
Add script to change the juju-db snap channel by @nicolasbock in https://github.com/juju/juju/pull/21868
fix: application-storage tabular output to use humanize size by @adisazhar123 in https://github.com/juju/juju/pull/22371
test: make k8s secrets shell tests more robust by @wallyworld in https://github.com/juju/juju/pull/22378
feat: k8s storage size update by @wallyworld in https://github.com/juju/juju/pull/22388
feat: reuse secret access tokens if scope matches by @wallyworld in https://github.com/juju/juju/pull/22399
chore: increment juju to 3.6.23 by @jujubot in https://github.com/juju/juju/pull/22415
fix(access): filter credential model access by owner only by @gfouillet in https://github.com/juju/juju/pull/22236
chore: move to go-1.26.3 for vuln issues by @SimonRichardson in https://github.com/juju/juju/pull/22417
feat: add step to transition guide for storage pools by @jack-w-shaw in https://github.com/juju/juju/pull/22404
feat: add agent md files by @wallyworld in https://github.com/juju/juju/pull/22431
refactor: rename the storage update apis to be compatible with 4.0 by @wallyworld in https://github.com/juju/juju/pull/22434
refactor: provisioning domain by @SimonRichardson in https://github.com/juju/juju/pull/22395
fix: flaky cmr test by @SimonRichardson in https://github.com/juju/juju/pull/22427
fix(network): validate subnets atomically when adding spaces by @nvinuesa in https://github.com/juju/juju/pull/22411
chore: increment juju to 3.6.24 by @jujubot in https://github.com/juju/juju/pull/22438
docs: replace juju status --watch with unix watch command by @tmihoc in https://github.com/juju/juju/pull/22447
chore: merge 3.6 by @wallyworld in https://github.com/juju/juju/pull/22450
docs: remove Windows installation instructions by @tmihoc in https://github.com/juju/juju/pull/22444
fix: resolve security vuln in golang.org/x/crypto/ssh by @jack-w-shaw in https://github.com/juju/juju/pull/22480
fix: resolve vulns found in golang.org/x/net/html by @jack-w-shaw in https://github.com/juju/juju/pull/22490
fix: uninstall lxd-container-provisioner manifold on container machines by @nvinuesa in https://github.com/juju/juju/pull/22468
feat(transition guide): add step for storage pool default change by @jack-w-shaw in https://github.com/juju/juju/pull/22478
chore: increment juju to 4.0.11 by @jujubot in https://github.com/juju/juju/pull/22425
fix: pass new secret ID to K8s backend on user secret create by @gfouillet in https://github.com/juju/juju/pull/22493
chore: add generated 4.0.10 controller and model release DDLs by @nvinuesa in https://github.com/juju/juju/pull/22501
fix: correct the order of relation key during import by @nvinuesa in https://github.com/juju/juju/pull/22499

New Contributors

@Tony-WLB made their first contribution in https://github.com/juju/juju/pull/22191
@Deadinside101 made their first contribution in https://github.com/juju/juju/pull/22278
@astrojuanlu made their first contribution in https://github.com/juju/juju/pull/22318

Full Changelog: https://github.com/juju/juju/compare/v4.0.10...v4.0.11

Breaking Changes

Removed Windows installation instructions

Security Fixes

fix: resolve security vuln in golang.org/x/crypto/ssh
fix: resolve vulns found in golang.org/x/net/html
chore(deps): security vulnerabilities
chore: merge private branch with CVE fixes (appears twice)
chore: move to go-1.26.3 for vuln issues

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track juju

Get notified when new releases ship.

About juju

Orchestration engine that enables the deployment, integration and lifecycle management of applications at any scale, on any infrastructure (Kubernetes or otherwise).

All releases →