# ChefDK 1.6.11 Released

**URL:** <https://discourse.chef.io/t/chefdk-1-6-11-released/12036>\
**Category:** Chef Release Announcements\
**Created:** [November 29, 2017, 7:01pm UTC](https://discourse.chef.io/t/chefdk-1-6-11-released/12036 "2017-11-29T19:01:18Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![btm](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/btm/32/1089_2.png) [@btm](https://discourse.chef.io/u/btm)\
**Post date:** [November 29, 2017, 7:01pm UTC](https://discourse.chef.io/t/chefdk-1-6-11-released/12036/1 "2017-11-29T19:01:18Z")

</div>

We've released an update to ChefDK 1 today. This contains only dependency updates, some including security fixes.

Ruby upgraded to 2.3.5 to fix a number of CVEs:

- CVE-2017-0898: Buffer underrun vulnerability in Kernel.sprintf
- CVE-2017-10784: Escape sequence injection vulnerability in the Basic authentication of WEBrick
- CVE-2017-14033: Buffer underrun vulnerability in OpenSSL ASN1 docod
- CVE-2017-14064: Heap exposure in generating JSON

Chef Client upgraded to 12.21.26  
Push Jobs Client upgraded to 2.4.5  
And a few other bundled gem updates.

> **[Download | Chef](https://www.chef.io/downloads/tools/chefdk?v=1.6.11)**

If you're still running ChefDK 1, you should upgrade to this version. Also keep in mind that it will be EOL April 2018 with the release of ChefDK 3, so plan upgrading and testing soon.

> [@Coming soon: Chef Client 14 and Chef Development Kit 3](https://discourse.chef.io/t/coming-soon-chef-client-14-and-chef-development-kit-3/11853):
>
> At Chef, we understand that Infrastructure Automation enables your business to succeed, but it isn’t the reason your business exists. Ultimately, all software is a careful balancing act of introducing new features, fixing bugs, and saying no to ideas that we might love to do but are too disruptive–and it’s up to us to ensure that our work doesn’t create too much work for you. To ease that burden and help you plan for updates, we’ve introduced a regular release cadence, with backwards compatible …

Bryan