📦 Bundled Resource Types bosh-io-release: v1.3.7 bosh-io-stemcell: v1.7.2 docker-image: v1.13.4 git: v1.24.1 github-release: v1.14.3 hg: v1.5.7 mock: v0.14.8 pool: v1.8.4 registry-image: v1.19.1 s3: v2.5.7 semver: v2.0.5 time: v1.11.6 ⚠️ Behavior Changes OIDC providers with RSA keys larger than 4096 bits. The fix for CVE-2026-116587 makes go-jose reject RSA keys larger than 4096 bits. Concourse re…
What's Changed This release is in response to the compromised eMudhra CA certs. All container images for the bundled resource-types have been updated with the latest OS packages. All Go binaries we ship have been compiled with Go 1.27.3. As far as we can currently tell, all compromised CA certs have been removed from our published artifacts. If you find we have missed something please post in the…
What's Changed 🐞 Bug Fixes worker: keep in-flight overlay dirs during orphan sweep by @ShravanthReddy in #9695 Align GetResourceVersion behaviour with ListResourceVersion's by @taylorsilva in #9729 Remove parent-dir references from paths provided to pipeline steps by @taylorsilva in #9735 - Resolves GHSA fix: Vault URL validation scheme broken with placeholder by @Kump3r in #9714 fix: baggageclaim…
What's Changed 🚨 Breaking Changes Chown bind-mount volumes when running as non-root user by @taylorsilva in #9593 ✈️ Features atc: behaviour: add origin_pipeline to OPA payload by @Petahhh in #9583 Remove inline scripts and styles to enable strict CSP by @Kump3r in #9596 feat: add validation for team names to prevent '/' characters in rename-team command by @IvanChalukov in #9600 Add job and step-…
What's Changed [Security] Fix path traversal bug during secrets lookup. Resolves GHSA workaround root.MkdirAll bug for Windows workers #9637 scheduler: fix scheduling for jobs with serial: true and check_every: never resource(s) #9670 📦 Bundled Resource Types bosh-io-release: v1.3.4 bosh-io-stemcell: v1.5.4 docker-image: v1.13.1 git: v1.22.3 github-release: v1.14.0 hg: v1.5.4 mock: v0.14.5 pool: v…
What's Changed 🐞 Bug Fixes fix how resources with check_every: never are handled when scheduling builds by @taylorsilva in #9598 fix streaming volumes with relative symlinks by @taylorsilva in #9601 fix "invalid UTF-8" errors when get steps generate metadata by @kurtmc in #9602 📦 Bundled Resource Types bosh-io-release: v1.3.4 bosh-io-stemcell: v1.5.4 docker-image: v1.13.1 git: v1.22.3 github-relea…
What's Changed 🐞 Bug Fixes unescape the redirect uri before further parsing it by @taylorsilva in #9587 Resolves open redirect CVE GHSA-8w27-c4vc-88q9 📦 Bundled Resource Types bosh-io-release: v1.3.4 bosh-io-stemcell: v1.5.4 docker-image: v1.13.1 git: v1.22.3 github-release: v1.14.0 hg: v1.5.4 mock: v0.14.5 pool: v1.8.1 registry-image: v1.17.0 s3: v2.5.4 semver: v2.0.1 time: v1.11.3 Full Changelog…
What's Changed 🐞 Bug Fixes Fix CF connector by @IvanChalukov in #9580 Use session signing key to derive state signing key by @taylorsilva in #9579 🛠️ Misc. Changes Bump containerd to v2.3.1 to address a privilege escalation CVE in containerd by @taylorsilva in #9582 📦 Bundled Resource Types bosh-io-release: v1.3.4 bosh-io-stemcell: v1.5.4 docker-image: v1.13.1 git: v1.22.3 github-release: v1.14.0…
What's Changed 🐞 Bug Fixes fix: handle all IPv4 loopback resolvers by @immanuwell in #9569 Fix pipeline rendering when resources have no icon by @jghiloni in #9571 Ensure resources that have never been checked are looked up by manually triggered builds by @taylorsilva in #9574 📦 Bundled Resource Types bosh-io-release: v1.3.4 bosh-io-stemcell: v1.5.4 docker-image: v1.13.0 git: v1.22.2 github-releas…
What's Changed 🚨 Breaking Changes Don't allow pipelines or teams containing / to be set with the set_pipeline step by @taylorsilva in #9537 Teams or pipelines with / wouldn't display in the web UI. If you have teams or pipelines that have a /, rename them before upgrading. Semver resource has a breaking change for users of the swift driver. We migrated the driver from using rackspace/gophercloud t…
Thank you to all the people that contributed to this release! You can read this blog post for an overview of the changes: https://concourse-ci.org/blog/2026-01-15-v8---new-year-new-concourse-release/ What's Changed 🚨 Breaking Changes fly: drop support for deprecated {{old_style}} var resolution by @vlfig in #9194 Switch use of md5 hashing to sha256 by @IvanChalukov in #9165 NOTE: This DB migration…
What's Changed 🐞 Bug Fixes return BreakoutError when symlink does not link to a path inside the destination by @taylorsilva #9486 🛠️ Misc. Changes use statically built versions of containerd binaries by @taylorsilva concourse/ci#429 📦 Bundled Resource Types bosh-io-release: v1.3.3 bosh-io-stemcell: v1.5.3 docker-image: v1.12.4 git: v1.22.0 github-release: v1.13.2 hg: v1.5.2 mock: v0.14.4 pool: v1.…
What's Changed ✈️ Features feat: allow glob patterning for get.passed by @kcbimonte in #9418 Add metadata from get steps to the local build var by @PentaHelix in #9419 Make container selection for fly intercept interactive and searchable by @taylorsilva in #9438 Implement disable_reruns property for jobs by @ceco556 in #9463 Add --containerd-allowed-device flag for cgroup device rules by @mariash…
What's Changed We updated our build process to bring in newly compiled versions of the Linux container runtime dependencies (containerd, runc, CNI plugins, etc.). We grab most of these from Wolfi's APK repository. For runc, we needed a statically compiled version, so we compile that ourselves (pipeline here). The motivation for this was to clear out CVE's related to the version of Go that each of…
What's Changed Handle json null values in the resource_config_versions table during the sha256 migration by @taylorsilva #9436 Fix down migration by @IvanChalukov #9426, #9428 Add flag to disable secret redaction CONCOURSE_DISABLE_REDACT_SECRETS by @taylorsilva #9433 📦 Bundled Resource Types bosh-io-release: v1.3.2 bosh-io-stemcell: v1.5.2 docker-image: v1.12.0 git: v1.21.0 github-release: v1.13.0…