v3.5.1

Spotlight

• Security fix: the control-plane image no longer trusts emSign ECC Root CA - G3, the root behind the eMudhra intermediate CAs whose private keys leaked. It is now built on distroless Debian 13, whose CA bundle drops that root. Every RunsOn binary (control plane, runner agent, health probe, OpenTelemetry collector) is built with Go 1.26.10, which also refuses the eight compromised intermediates on its own. Fixes runs-on#572.

CloudFormation

• No CloudFormation-specific changes.

Terraform

• No Terraform-specific changes. Update version (and the pinned image digest, if you pin one) to pick up the new image.

Other fixes

• No other changes from v3.5.0.

Release resources

• Upgrade guide: https://runs-on.com/docs/maintenance/upgrades/
• CloudFormation template: https://runs-on.s3.eu-west-1.amazonaws.com/cloudformation/template-v3.5.1.yaml