2.0.4 (July 07, 2026) SECURITY: docker: Enforce allowed_modes or allow_privileged requirement to set host namespace modes in task. This is CVE-2026-14891. [GH-28190] docker: Fixed a bug where docker tasks could use a symlink to bypass the plugin configuration for volumes.enabled=false. This is CVE-2026-14896. [GH-28177] dynamic host volumes: Fixed a bug where users with host-volume-delete in one n…
SECURITY: docker: Enforce allowed_modes or allow_privileged requirement to set host namespace modes in task. This is CVE-2026-14891. [GH-28190] docker: Fixed a bug where docker tasks could use a symlink to bypass the plugin configuration for volumes.enabled=false. This is CVE-2026-14896. [GH-28177] dynamic host volumes: Fixed a bug where users with host-volume-delete in one namespace could delete…
SECURITY: docker: Enforce allowed_modes or allow_privileged requirement to set host namespace modes in task. This is CVE-2026-14891. [GH-28190] docker: Fixed a bug where docker tasks could use a symlink to bypass the plugin configuration for volumes.enabled=false. This is CVE-2026-14896. [GH-28177] dynamic host volumes: Fixed a bug where users with host-volume-delete in one namespace could delete…
SECURITY: cli: Redact token and certificate key CLI flags and environment variables when writing debug bundle [GH-28063] IMPROVEMENTS: build: Updated Go to 1.26.4 [GH-28080] vault: adds token renewal retries [GH-27947] BUG FIXES: audit (Enterprise): Fixed a bug where alloc exec and job actions requests from the webbrowser would be marked as anonymous in audit logs [GH-28025] client: Fixed a bug wh…
SECURITY: cli: Redact token and certificate key CLI flags and environment variables when writing debug bundle [GH-28063] IMPROVEMENTS: build: Updated Go to 1.26.4 [GH-28080] vault: adds token renewal retries [GH-27947] BUG FIXES: audit (Enterprise): Fixed a bug where alloc exec and job actions requests from the webbrowser would be marked as anonymous in audit logs [GH-28025] client: Fixed a bug wh…
FEATURES: core: timeouts for batch jobs [GH-27803] SECURITY: cli: Redact token and certificate key CLI flags and environment variables when writing debug bundle [GH-28063] IMPROVEMENTS: acl: Support uploading client ACL tokens [GH-27741] alloc: don't restore when allocDir is inaccessible [GH-27933] api: added agent reload endpoint [GH-27106] build: Updated Go to 1.26.4 [GH-28080] client: Adds defa…
1.10.12 Enterprise (May 22, 2026) BUG FIXES: ui: Fixed a bug where the client detail page would fail to render [GH-27958] ui: Fixed a bug where the topology page would fail to render [GH-27958] ui: Fixed a bug where the evaluation detail panel would render improperly [GH-27987]
1.11.6 Enterprise (May 22, 2026) BUG FIXES: ui: Fixed a bug where the client detail page would fail to render [GH-27958] ui: Fixed a bug where the topology page would fail to render [GH-27958] ui: Fixed a bug where the evaluation detail panel would render improperly [GH-27987]
2.0.2 (May 22, 2026) BUG FIXES: acl: fix rpc permission denied error when using node_pool="all" [GH-27973] ui: Fixed a bug where the client detail page would fail to render [GH-27958] ui: Fixed a bug where the topology page would fail to render [GH-27958] ui: Fixed a bug where the evaluation detail panel would render improperly [GH-27987]
BREAKING CHANGES: logging: The allocation logs directory is bind-mounted read-only for task drivers that support with filesystem isolation [GH-27918] SECURITY: dynamic host volumes: Prevent unintended code execution outside the plugin directory (CVE-2026-7474) [GH-27919] logging: Protect logging FIFO from symlink swap attacks (CVE-2026-6959) [GH-27918] sentinel: require sentinel-override ACL capab…
BREAKING CHANGES: logging: The allocation logs directory is bind-mounted read-only for task drivers that support with filesystem isolation [GH-27918] SECURITY: dynamic host volumes: Prevent unintended code execution outside the plugin directory (CVE-2026-7474) [GH-27919] logging: Protect logging FIFO from symlink swap attacks (CVE-2026-6959) [GH-27918] sentinel: require sentinel-override ACL capab…
BREAKING CHANGES: logging: The allocation logs directory is bind-mounted read-only for task drivers that support with filesystem isolation [GH-27918] SECURITY: dynamic host volumes: Prevent unintended code execution outside the plugin directory (CVE-2026-7474) [GH-27919] logging: Protect logging FIFO from symlink swap attacks (CVE-2026-6959) [GH-27918] sentinel: require sentinel-override ACL capab…
FEATURES: config: add nonproduction config option for server, license, and reporting config [GH-27646] core (Enterprise): Enable parsing and reporting with IBM PAO licenses SECURITY: build: upgrade Go to 1.26.2 [GH-27831] ui: Increased the client-side generated OIDC nonce entropy to 256-bit. [GH-27749] IMPROVEMENTS: build (Enterprise): Added support for ppc64le CPU architecture on Linux build: Upg…