Server Release 4.10.1

Updates

• The NGINX default image has been updated to version 1.30.1, which addresses security vulnerabilities present in version 1.30.0 that were not resolved until after its release. No action is required unless you have pinned the NGINX image tag in your deployment.

• Pipeline creation failures caused by OAuth webhook setup now return specific error messages instead of generic failures, making it easier for operators and users to understand why a trigger could not be created.

• The new pipelines page toggle has been disabled for Server instances, as the new pipeline view is not available in Server deployments. This prevents users from encountering an unsupported UI state.

• Serial jobs that depend on multiple non-serial job groups now correctly resolve their dependencies at compilation time, preventing jobs from failing or behaving incorrectly due to misresolved dependency ordering.

• Nginx-to-Kong upstream connection keepalive pooling is now enabled, preventing ephemeral TCP port exhaustion and intermittent 502 errors that could occur under sustained load.

• The source config size limit has been removed for Server deployments, allowing pipelines that use large orb imports to be processed without hitting the previous 8 MB constraint.

• Editing context variables for account contexts is now handled correctly on Server, restoring a legacy code path that had been inadvertently broken.

New Features

• Kong now supports referencing an existing Kubernetes secret for Redis authentication credentials, in addition to plain-text passwords. This allows operators to manage Redis credentials more securely using standard Kubernetes secret management practices.

• Pod annotations can now be configured for the nomad-server deployment via Helm values, allowing operators to add custom annotations (for example, for Prometheus scraping) that persist across upgrades.

• Per-service nodeSelector overrides are now available in Helm values, allowing operators to constrain pod placement to specific nodes on a per-service basis rather than relying solely on a global nodeSelector.

• Per-service tolerations overrides are now available in Helm values, allowing operators to customize which node taints each service can tolerate independently of the global toleration settings.

• Per-service nodeAffinity overrides are now available in Helm values, allowing operators to customize pod affinity rules per service (such as preferring specific node pools) while a global default remains in effect.

• Per-service pod anti-affinity configuration is now available in Helm values for nomad-server, domain-service, and workflows-conductor-grpc, allowing operators to enforce or prefer pod distribution across nodes to reduce the risk of cascading failures.

• Windows AMI support has been added to the stable environment configuration, enabling self-hosted runner deployments that target Windows instances.

Bug Fixes

• Fixed a Helm templating error that prevented node tolerations from being rendered correctly in generated Kubernetes manifests.

CVE Fixes

• CVE-2026-33814 in golang.org/x/net was addressed in machine-provisioner service(s).

• CVE-2026-39833 in golang.org/x/crypto was addressed in distributor, output, execution-gateway, step, notifications service(s).

• CVE-2026-42506 in golang.org/x/net was addressed in notifications, execution-gateway, output service(s).

• CVE-2026-34040 in docker module dependencies was addressed in docker-provisioner service(s).

• CVE-2026-40898 in quic-go was addressed in output, execution-gateway, distributor, step, machine-provisioner, oidc-tasks-service service(s).

• CVE-2026-5160 in goldmark was addressed in runner-admin, output, distributor, step service(s).

• CVE-2026-32282 in Go toolchain was addressed in permissions-service, server service(s).

• CVE-2026-39822 in Go toolchain was addressed in permissions-service, server service(s).

• CVE-2026-42505 in Go toolchain was addressed in permissions-service service(s).

• CVE-2026-41889 in pgx was addressed in authentication-svc, policy-service service(s).

• CVE-2026-46600 in golang.org/x/net was addressed in output, runner-admin, step, execution-gateway, oidc-tasks-service service(s).

• CVE-2026-56852 in golang.org/x/text was addressed in machine-provisioner, ciam-gateway, authentication-svc, output, permissions-service, contexts-service, server service(s).

• GHSA-mpwr-8vm7-h73f in go-pkcs12 was addressed in contexts-service service(s).

• GHSA-hrxh-6v49-42gf in gRPC was addressed in distributor, public-api-service, output, policy-service, notifications, authentication-svc, runner-admin, docker-provisioner, execution-gateway, step, ciam-gateway, oidc-tasks-service, server service(s).

• CVE-2026-41178 in go.opentelemetry.io/otel was addressed in output, step, docker-provisioner, oidc-tasks-service, contexts-service, runner-admin, server service(s).

• CVE-2026-46625 in js-cookie and GHSA-39q2-94rc-95cp in dompurify were addressed in web-ui, web-ui-server-admin service(s).

• GHSA-259r-337f-4rfw in github.com/klauspost/compress was addressed in output service(s).

• CVE-2026-6790 in Eclipse Jetty was addressed in api-service service(s).

• CVE-2026-6473, CVE-2026-6475, CVE-2026-6476, CVE-2026-6477, CVE-2026-6479, CVE-2026-6637, CVE-2026-6638 in PostgreSQL were addressed in server-postgres service(s).

• GHSA-w9fj-cfpg-grvv and GHSA-pwqr-wmgm-9rr8 in Netty were addressed in insights-service, orb-service, workflows-conductor, cron-service, branch-service, api-service service(s).

Configuration Changes

• The builds-service JVM heap size is now configurable as a Helm value (builds-service.jvmHeapSize or equivalent chart key), giving operators direct control over memory allocation for this service. This is an optional setting; the previous default behaviour is preserved if not set.

• Authentication service rate limits (request thresholds and burst limits) are now configurable via Helm values, allowing operators to tune rate limiting to suit their environment instead of relying on hard-coded defaults. This is an optional setting.

• Resource requests and limits for all services are now configurable via values.yaml, replacing previously hardcoded values. Operators can now set appropriate resource requests to achieve the desired Kubernetes QoS class and tune limits per service, including Vault sidecar containers. This is an optional setting; existing defaults are preserved if not overridden.

Removed Components

• audit-log-service