Arivu 1.8.1
A maintenance release: current runtimes underneath, security fixes, and refusal of certificates from this week's compromised eMudhra keys.
Arivu 1.8.1 is out. Nothing looks or works differently. This release keeps the parts underneath Arivu current and picks up security fixes, including one for this week’s certificate authority compromise.
What’s in it
- Certificates from the compromised eMudhra keys are refused. This week, eight intermediate certificate keys operated by the certificate authority eMudhra were found to be compromised, and browsers and operating systems stopped trusting them. The connections Arivu makes itself, such as direct extraction and link previews, now reject those certificates too, so a site that relies on one fails instead of being treated as trusted.
- Current runtimes. Arivu now builds on the current Go release. The complete-capture runtime that the installer manages ships the current long-term-support release of Node.js, with updated page rendering and page saving components. Together these carry the security fixes those projects have published since 1.8.0.
- A newer base for the container image. If you build Arivu’s container image yourself, it now starts from the current Debian release, which still receives regular security updates.
Before you upgrade
Nothing in your data changes, so there is no new backup format and no one-time conversion. A fresh backup before any upgrade is still a good habit.
Complete capture runs its own headless browser, which checks certificates against your server’s certificate store. Install your distribution’s latest ca-certificates update so captures refuse the same certificates the rest of Arivu does. Supported systems are unchanged: Ubuntu 22.04+ and Debian 12+ on AMD64 and ARM64. The installer downloads and verifies the new capture runtime during the upgrade.
Follow Self-Hosting Arivu for upgrade steps.