Server Release 4.9.6

Updates

• nginx upstream connections to Kong now use keepalive pooling to reuse TCP connections. This prevents ephemeral port exhaustion under high load, eliminating the 502 errors that could occur in busy deployments.

• A connection-pool defect in the Redis client used by the oidc-tasks-service has been resolved. OIDC token retrieval on Machine jobs no longer stalls due to exhausted or stuck pool connections.

New Features

• Each Kubernetes deployment now supports per-service nodeSelector overrides. Operators can schedule individual service pods onto specific node pools without changing global nodeSelector settings.

• Each Kubernetes deployment now supports per-service tolerations overrides. Operators can allow individual service pods to be scheduled onto tainted nodes without modifying global toleration configuration.

• Each Kubernetes deployment now supports per-service nodeAffinity overrides. Operators can control pod placement preferences for individual services independently of any global affinity rules.

CVE Fixes

• CVE-2026-56852 in golang.org/x/text was addressed in step, oidc-tasks-service service(s).

• CVE-2026-46600 in golang.org/x/net was addressed in machine-provisioner, output service(s).

• CVE-2026-41178 in go.opentelemetry.io/otel was addressed in server, no-op-job-provider, step, oidc-tasks-service, authentication-svc service(s).

• CVE-2026-46625 in js-cookie and CVE-2026-24001 in diff were addressed in web-ui, web-ui-server-admin service(s).

• CVE-2026-5841 in github.com/klauspost/compress was addressed in step, lock-job-provider service(s).

• CVE-2026-53606 in sanitize-html was addressed in web-ui, web-ui-server-admin service(s).