Updates
-
The source config size limit for orb imports has been removed for Server deployments. Pipelines that previously failed because their combined orb configuration exceeded the 6–8 MB threshold will now process successfully without any configuration changes.
-
Insights-service database migration validation errors that occurred during upgrades have been fixed, allowing upgrades to complete cleanly without manual intervention.
-
Fixed a security context user mismatch for the insights-service that could prevent the service from starting correctly in environments with strict pod security policies.
New Features
-
Pod annotations on Nomad server deployments are now configurable via the Helm chart. Operators can set custom annotations (for example, to enable Prometheus scraping) without needing manual patches that would otherwise be lost on upgrade.
-
A configurable prefix directory for Kong is now available, resolving socket permission errors that occurred in restricted or hardened environments.
Configuration Changes
-
Authentication service rate limits are now configurable. Operators can tune API throttling behaviour by setting the relevant environment variables in their deployment. This is optional; existing deployments will continue to use the previous hardcoded defaults.
-
Resource requests and limits for all application services are now fully configurable through
values.yaml. This allows operators to set Guaranteed QoS, prevent OOM cascades, and right-size workloads for their infrastructure. Previously these values were hardcoded. This is optional but recommended for production deployments.
CVE Fixes
-
CVE-2026-39833 in golang.org/x/crypto was addressed in distributor, docker-provisioner, execution-gateway, step service(s).
-
CVE-2026-33814 in golang.org/x/net was addressed in execution-gateway, api-gateway service(s).
-
CVE-2026-42506 in golang.org/x/net was addressed in step, execution-gateway service(s).
-
CVE-2026-29181 and CVE-2026-39883 in go.opentelemetry.io/otel were addressed in policy-service service(s).
-
CVE-2026-34282 and CVE-2026-22016 in JDK were addressed in contexts-service, permissions-service service(s).
-
CVE-2026-42010 and CVE-2026-33845 in libgnutls30 were addressed in server-rabbitmq service(s).
-
CVE-2026-40898 in github.com/quic-go/quic-go was addressed in output, execution-gateway, distributor, no-op-job-provider, step, permissions-service, lock-job-provider, authentication-svc service(s).
-
CVE-2026-39824 in golang.org/x/sys was addressed in output service(s).
-
CVE-2026-46600 in golang.org/x/net was addressed in docker-provisioner, machine-provisioner, output, step, oidc-tasks-service service(s).
-
CVE-2026-33812 in golang.org/x/image was addressed in public-api-service service(s).
-
CVE-2026-6321 and CVE-2026-6322 in fast-uri were addressed in web-ui, web-ui-server-admin service(s).
-
CVE-2026-5160 in goldmark were addressed in distributor, step service(s).
-
CVE-2026-47691 in netty-resolver-dns was addressed in domain-service service(s).
-
CVE in Netty (including netty-handler) was addressed in contexts-service, permissions-service, orb-service, workflows-conductor, cron-service, api-service, branch-service, domain-service, insights-service service(s).
-
CVE in google.golang.org/grpc (xDS RBAC authorization bypass and HTTP/2 vulnerabilities) was addressed in public-api-service, permissions-service, distributor, authentication-svc, ciam-gateway, runner-admin service(s).
-
CVE in golang.org/x/text (infinite loop on invalid UTF-8 input) was addressed in no-op-job-provider, distributor, ciam-gateway, authentication-svc service(s).
-
CVE-2025-69725 in go-chi was addressed in authentication-svc service(s).