Updates

• The source config size limit for orb imports has been removed for Server deployments. Pipelines that previously failed because their combined orb configuration exceeded the 6–8 MB threshold will now process successfully without any configuration changes.

Updates

• Refreshed GovCloud AMIs to use the latest base images for improved security and stability. These AMIs address the Copy Fail Vulnerability.

CVE Fixes

• CVE-2026-33814 in golang.org/x/net was addressed in distributor, output services.
• CVE-2026-39882 in OpenTelemetry OTLP HTTP exporters was addressed in docker-provisioner service.
• May 2026 CVEs in nginx unprivileged container were addressed by updating the default nginx image to 1.30.1.

Configuration Changes

• Added new Helm value for configuring builds-service JVM heap size. Operators can now tune memory allocation for the builds-service to match their infrastructure requirements.

NOTE: This is the last patch for server 4.8 as it has now reached end of life. Please upgrade to a supported version.

Updates

• Increased default RabbitMQ memory allocation to improve messaging reliability and prevent out-of-memory failures.
• Updated Nomad server to version 1.11.3 for performance and stability improvements.
• Enabled gRPC client-side load balancing.
• Switched gRPC client paths to use headless Services.
• Updated AWS AMIs with the latest security patches and updates.

Bug Fixes

• Fixed presigned URL expiry issue in test results index to prevent premature link expiration when downloading previous test results.
• Fixed nginx AWS ACM configuration.
• Fixed soft-fail policy violation banners not displaying in Server UI by adding policy decision enrichment to pipeline handlers.
• Fixed OIDC token minting panic.
• Fixed Nomad client startup script failures.
• Fixed a bug which made the admin-setting page inaccessible.

CVE Fixes

• CVE-2026-24051 in OpenTelemetry SDK was addressed.
• CVE-2026-1229 in Cloudflare CIRCL library was addressed.
• CVE-2025-64702 in quic-go library was addressed.
• CVE-2025-47911 in golang.org/x/net was addressed.
• CVE-2026-33186 in gRPC library was addressed
• CVE-2026-39882 in OpenTelemetry OTLP HTTP exporter was addressed.
• CVE-2026-39883 in OpenTelemetry SDK was addressed.
• CVE-2026-27141 in golang.org/x/net was addressed.
• CVE-2026-34986 in go-jose library was addressed.
• CVE-2025-67721 in aircompressor library was addressed.

Configuration Changes

• Added NOMAD_RPC_MAX_CONNS_PER_CLIENT configuration option to Helm values to control Nomad RPC connection limits and fix client rejection errors under load.
• Exposed Nomad server CPU and memory resource limits and requests in Helm values for better resource control.

Component Updates

• api-gateway
• api-service
• approval-job-provider-migrator
• audit-log-service
• authentication-svc
• authentication-svc-migrator
• branch-service
• branch-service-migrator
• builds-service
• builds-service-migrator
• ciam
• ciam-gateway
• circle-www-api
• contexts-service
• contexts-service-migrator
• cron-service
• cron-service-migrator
• distributor
• distributor-migrator
• docker-provisioner
• domain-service
• domain-service-migrator
• execution-gateway
• insights-service
• insights-service-migrator
• lock-job-provider
• machine-provisioner
• machine-provisioner-migrator
• no-op-job-provider
• oidc-service
• oidc-tasks-service
• oidc-tasks-service-migrator
• orb-service
• orb-service-analytics-migrator
• orb-service-migrator
• output
• permissions-service
• permissions-service-migrator
• picard
• policy-service
• public-api-service
• runner-admin
• runner-admin-migrator
• server-postgres
• server-rabbitmq
• server-redis
• step
• web-ui
• web-ui-server-admin
• webhook-service
• webhook-service-migrator
• workflows-conductor
• workflows-conductor-migrator

Known Issues

• The Ubuntu images provided by CircleCI in AWS GovCloud have not been updated.
• The Ubuntu images provided by CircleCI in GCP have not been updated.

Bug Fixes

• Fixed an issue where presigned URLs for test results would expire prematurely, causing access failures when viewing test data.
• Resolved a critical issue with the web-ui-server-admin component that was broken in the previous release.

CVE Fixes

• CVE-2026-1229 in github.com/cloudflare/circl was addressed.
• CVE-2026-2391 in qs dependency was addressed.
• CVE-2026-24051 in go.opentelemetry.io/otel/sdk was addressed.
• CVE-2026-33186 in google.golang.org/grpc was addressed.
• CVE-2026-33762 in github.com/go-git/go-git/v5 was addressed.
• CVE-2026-34165 in github.com/go-git/go-git/v5 was addressed.
• CVE-2026-34986 in go-jose/go-jose/v4 was addressed.
• CVE-2026-39882 in AWS SDK EventStream was addressed.
• CVE-2026-2391 in AWS SDK EventStream was addressed.
• CVE-2026-39882 in go.opentelemetry.io/otel was addressed.
• CVE in io.airlift/aircompressor was addressed.

Configuration Changes

• Added RabbitMQ configuration options requests, limits and memoryHighWatermark to provide operators with better control over RabbitMQ resource management.
• Added Nomad connection limits configuration to Helm values to prevent maximum RPC connection rejections and improve cluster stability.
• Added Nomad server CPU and memory resource requests and limits configuration options for better resource management and operational control.
• Enabled gRPC client-side load balancing for contexts-service to improve reliability and performance of service communication.

Component Updates

• api-gateway
• approval-job-provider-migrator
• audit-log-service
• branch-service
• branch-service-migrator
• builds-service
• builds-service-migrator
• circle-www-api
• contexts-service
• contexts-service-migrator
• cron-service
• cron-service-migrator
• distributor
• distributor-migrator
• docker-provisioner
• domain-service
• domain-service-migrator
• execution-gateway
• feature-flags
• insights-service
• insights-service-migrator
• machine-provisioner
• machine-provisioner-migrator
• oidc-tasks-service
• orb-service
• orb-service-analytics-migrator
• orb-service-migrator
• output
• picard
• policy-service
• public-api-service
• runner-admin
• runner-admin-migrator
• step
• web-ui
• web-ui-server-admin
• webhook-service
• webhook-service-migrator
• workflows-conductor
• workflows-conductor-migrator

Updates

• Added support for custom SAAS GHE usernames to improve integration flexibility.
• Renamed the session cookie to circleci-session.
• Fixed Kong routing configuration to support additional routing hosts for better traffic management.
• Enhanced queue sweeper job reliability by adding a 10-minute TTL to prevent resource exhaustion.
• Upgraded internal Clojure dependencies components for improved performance and stability.

Configuration Changes

• oidc_service.base_url: New optional Helm value that allows OIDC service to use a custom base URL instead of the global domain name. This enables OIDC functionality for air-gapped environments with non-publicly-resolvable domains. Leave empty to use existing behavior.
• nomad.rpc.mTLS.enabled: Added missing mTLS configuration flag to Helm values template. Set to true to enable mutual TLS for Nomad RPC communication between servers and clients. Defaults to existing behavior if not specified.

Bug Fixes

• Fixed deploy key links in SSH settings page to correctly display GitHub Enterprise Server domains instead of hardcoded github.com URLs.
• Resolved Docker executor certificate validation failures by correcting CA certificate loading order in build-agent.
• Fixed service port configurations in Helm charts that were causing user deletion commands to timeout after 60 seconds.
• Corrected ciam service selector configuration to prevent internal API communication failures.
• Resolved “field is immutable” Helm upgrade errors when upgrading from Server 4.8.x to 4.9.x by properly handling job template changes.

CVE Fixes

• CVE-2022-0856 in libcaca0 was addressed in web-ui service.
• CVE-2025-13151 in libtasn1-6 was addressed in web-ui service.
• CVE-2025-64702 in github.com/quic-go/quic-go was addressed in execution-gateway, docker-provisioner, oidc-tasks-service services.
• CVE-2025-47914 in golang.org/x/crypto was addressed in execution-gateway service.
• CVE-2025-58181 in golang.org/x/crypto was addressed in execution-gateway service.
• CVE-2025-69277 in libsodium23 was addressed in web-ui service.
• CVE-2026-24051 in go.opentelemetry.io/otel/sdk was addressed in build-agent, step, distributor, output services.
• CVE-2026-26278 in fast-xml-parser was addressed in web-ui service.
• CVE-2026-64718 in js-yaml was addressed in web-ui service.

Component Updates

• approval-job-provider-migrator
• audit-log-service
• authentication-svc
• authentication-svc-migrator
• branch-service
• branch-service-migrator
• builds-service
• builds-service-migrator
• ciam
• ciam-gateway
• circle-www-api
• cron-service
• cron-service-migrator
• distributor
• distributor-migrator
• docker-provisioner
• domain-service
• domain-service-migrator
• execution-gateway
• init-known-hosts
• insights-service
• insights-service-migrator
• lock-job-provider
• machine-provisioner
• machine-provisioner-migrator
• no-op-job-provider
• oidc-service
• oidc-tasks-service
• oidc-tasks-service-migrator
• output
• permissions-service
• permissions-service-migrator
• picard
• policy-service
• public-api-service
• runner-admin
• runner-admin-migrator
• server-postgres
• server-rabbitmq
• server-redis
• step
• web-ui
• web-ui-server-admin
• webhook-service
• webhook-service-migrator
• workflows-conductor
• workflows-conductor-migrator

Updates

• Added the missing nomad.rpc.mTLS.enabled configuration flag to Helm values to properly enable certificate generation within nomad-server pods.
• Renamed the session cookie to circleci-session.
• Fixed OIDC service configuration for air-gapped environments by adding oidc_service.base_url Helm value. This allows customers with non-publicly resolvable domains to override the issuer URL with a publicly accessible endpoint for external OIDC provider integration.
• Fixed database connection configuration in OIDC Tasks Service by using templated PostgreSQL host value instead of hardcoded hostname, allowing proper database connectivity in custom environments.

Bug Fixes

• Fixed Helm installation failures on Kubernetes clusters with strict Server-Side Apply validation by removing duplicate imagePullSecrets entries from Bitnami subcharts (MongoDB, PostgreSQL, RabbitMQ, Redis).
• Fixed OIDC Tasks Service migrator CrashLoopBackOff by correcting the container image reference, fixing invalid command paths, adding required Flyway security context, and updating database URL format for proper Flyway compatibility.
• Fixed user deletion failures via admin commands by correcting service port configurations in Helm charts. Updated client configurations to use proper Kubernetes service ports (80) instead of pod ports (8000).
• Fixed OIDC token minting panics caused by protocol buffer version mismatches between builds-service and oidc-tasks-service.
• Resolved database connection issues in OIDC Tasks Service by restoring the DATABASE_URL environment variable alongside the newer POSTGRESQL_OIDCTASKS_URI variable for backward compatibility.
• Fixed failed job navigation behavior where clicking on failed CircleCI status checks or workflow nodes incorrectly routed to the Steps tab instead of the Tests tab, restoring the expected navigation to test failure details.

CVE Fixes

• CVE-2025-11226 in ch.qos.logback:logback-core was addressed in contexts-service, domain-service, insights-service, circle, workflows-conductor and oidc-service services.
• CVE-2025-11065 in github.com/go-viper/mapstructure was addressed in build-agent service.
• CVE-2026-24051 in go.opentelemetry.io/otel/sdk was addressed in feature-flags, step, execution-gateway, build-agent, distributor and docker-provisioner services.

Updated Images

• api-service
• approval-job-provider-migrator
• authentication-svc
• builds-service
• builds-service-migrator
• ciam
• ciam-gateway
• circle-www-api
• contexts-service
• contexts-service-migrator
• distributor
• distributor-migrator
• docker-provisioner
• domain-service
• domain-service-migrator
• execution-gateway
• feature-flags
• init-known-hosts
• insights-service
• insights-service-migrator
• machine-provisioner
• machine-provisioner-migrator
• oidc-service
• oidc-tasks-service
• orb-service
• orb-service-analytics-migrator
• orb-service-migrator
• output
• permissions-service
• permissions-service-migrator
• picard
• policy-service
• runner-admin
• runner-admin-migrator
• step
• web-ui
• web-ui-server-admin
• workflows-conductor
• workflows-conductor-migrator

Fixes

• Set the env var RUNNER_ADMIN_FOR_SERVER_LAUNCH_AGENT_LOCKED:true on the radm-external deployment

Image Updates

• runner-admin

Fixes

• fixed a broken service selector which broke deleting users via nREPL
• Fixed broken deploy key link which pointed to github.com instead of GitHub Enterprise Server domain
• Pages will automatically update with new builds and re-run workflows

Updates

• Runner admin now uses o11y.OtelConfig
• Support custom usernames for SAAS GHE

Image Updates

• approval-job-provider-migrator
• branch-service
• branch-service-migrator
• builds-service
• builds-service-migrator
• circle-www-api
• cron-service
• cron-service-migrator
• distributor
• distributor-migrator
• execution-gateway
• init-known-hosts
• insights-service
• insights-service-migrator
• machine-provisioner
• machine-provisioner-migrator
• oidc-tasks-service
• orb-service
• orb-service-analytics-migrator
• orb-service-migrator
• runner-admin
• runner-admin-migrator
• step
• web-ui
• web-ui-server-admin
• workflows-conductor
• workflows-conductor-migrator

Fixes

• insights-service jobs now respect the global node-selectors, affinities and tolerations
• fix for templating issue which broke IMDSv1 support

Updates

• Mongo 4.4 is now the default image used in the base values.yaml. If you are using an older image of MongoDB internally in your cluster, then you will need to follow our upgrade guide to upgrade mongoDB to at least 4.4.

Image Updates

• api-gateway
• api-service
• authentication-svc
• authentication-svc-migrator
• branch-service
• branch-service-migrator
• cron-service
• cron-service-migrator
• docker-provisioner
• domain-service
• domain-service-migrator
• lock-job-provider
• picard
• runner-admin
• runner-admin-migrator
• web-ui
• web-ui-server-admin

Known Issues

• As of 4.9.0, personal Access Token (PAT) management has been migrated to the authentication-service. PATs are automatically migrated during the upgrade process. This changes requires that the mongoDB instance used by your CircleCI server is at least MongoDB 4.4. You will need to upgrade your mongoDB instance before upgrading to server 4.9.0. Please reference our MongoDB Upgrade instructions if your mongoDB instance is not externalized.

Fixes

• insights-service jobs now respect the global node-selectors, affinities and tolerations
• fix for templating issue which broke IMDSv1 support

Updates

• Added support for MTLS when using externalized nomad servers

Image Updates

• api-service
• authentication-svc
• branch-service
• branch-service-migrator
• ciam
• cron-service
• cron-service-migrator
• docker-provisioner
• output
• permissions-service
• permissions-service-migrator
• picard
• runner-admin
• runner-admin-migrator
• web-ui
• web-ui-server-admin
• webhook-service
• webhook-service-migrator

Note

This is the last update for Server 4.7 as it has reached end of life. Please upgrade to Server 4.8.x.

Fixes

• Fixed a UI bug which prevented users from accessing User Settings and Admin Settings.
• Fixed for URL of a pipeline run’s commit status referencing the CircleCI’s Cloud URL rather than the Server URL.
• Fixed an issue where the pinned machine agent version was not being applied correctly.
• Fixed template path of the custom-config file in telegraf.
• Fixed a malformed Cache-Control HTTP header in Kong configuration that was causing request failures.
• Fixed an error that displayed “Something Unexpected Happened” on the user notifications settings page.
• Fix for a regression in the max config size limit

Updates

• Removed web-ui-authentication as it was unused
• CVE patches
• nginx will now only listen on port 4647 if Nomad servers are deployed internally to the cluster
• Redis has been updated to version 6.2.20.

Image Updates

• cron-service
• cron-service-migrator
• branch-service
• branch-service-migrator
• workflows-conductor
• workflows-conductor-migrator
• orb-service
• orb-service-migrator
• orb-service-analytics-migrator
• runner-admin
• runner-admin-migrator
• policy-service
• authentication-service
• oidc-service
• init-known-hosts
• builds-service
• builds-service-migrator
• circleci-www-api
• permissions-service
• permissions-service-migrator
• approval-job-provider-migrator
• audit-log-service
• insights-service
• insights-service-migrator
• machine-provisioner
• machine-provisioner-migrator
• ciam
• server-postgres
• server-rabbitmq
• server-redis
• web-ui
• web-ui-server-admin

Updates

• Ships with a updated version of redis to address CVE-2025-49844
• Fix for fractional byte value warning when performing helm upgrades
• Added missing annotations to secrets so that the secrets may be preserved in the cluster namespace by default in the event of a helm uninstall
• General component dependency updates and CVE fixes
• Updated machine-agent

Image Updates

• web-ui
• permissions-service
• init-known-hosts
• machine-provisioner
• cron-service
• policy-service
• branch-service
• insights-service
• machine-agent

Updates

• Ships with a updated version of redis to address CVE-2025-49844
• Fix for fractional byte value warning when performing helm upgrades
• Added missing annotations to secrets so that the secrets may be preserved in the cluster namespace by default in the event of a helm uninstall
• General component dependency updates and CVE fixes

Image Updates

• web-ui
• web-ui-insights
• web-ui-org-settings
• web-ui-authentication
• web-ui-onboarding
• init-known-hosts
• cron-service
• authentication-service
• orbs-service
• policy-service
• branch-service
• insights-service

Fixes

• Fixed and issues where policies would fail, the neither the UI nor the CLI showed logs as to why the workflow was denied due to builds-service not being able to connect to policy-service on the correct port binding
• dependency update for branch-service

Image Updates

• branch-service

Updates

• Various dependency updates for components
• Update go modules in runner-admin
• Added support communication between docker-provisioner and an externalized nomad server over HTTPS
• Fixes for schema drift
• CVE fixes for circle-www-api, orb-service, workflows-conductor,api-service

Image Updates

• branch-service
• insights-service
• permissions-service
• api-service
• policy-service
• contexts-service
• domain-service
• circle-www-api
• build-agent
• domain-service
• authentication-svc
• orb-service
• workflows-conductor
• cron-service
• builds-service
• machine-provisioner
• policy-service
• init-known-hosts
• ciam-gateway

Updates

• CVE fixes for web-ui components
• Updated golang modules in init-known-hosts, ciam-gateway, authentication-service, permissions-service
• Updated some clojure components
• Fixed a bug that prevented additional tags from being consistently applied to machine resources between helm upgrades

Image Updates

• web-ui
• web-ui-insights
• web-ui-org-settings
• init-known-hosts
• cron-service
• ciam-gateway
• authentication-service
• permissions-service
• machine-provisioner

Bug Fixes

• Fixed issue where users were unable to access the login page
• Fixed a bug that prevented Remote Docker (setup_remote_docker) builds from using OIDC to pull images from ECR by updating the AWS SDK in docker-provisioner

Image Updates

• machine-provisioner
• branch-service
• docker-provisioner
• insights-service
• context-service
• domain-service
• server-postgres
• web-ui-authentication
• builds-service
• workflows-conductor
• orb-service

Bug Fixes

• Fixed a bug where users would receive a 400 error when attempting to log in caused by a break in web-ui-authentication. This bug was introduced in server 4.7.7

Image Updates

• web-ui-authentication

The Server 4.7.7 Release is broken

We have found a bug in the server 4.7.7 release which breaks logins. We are working on a fix actively. Please avoid upgrading to version 4.7.7

Downloading this helm chart release has been disabled.

Updates

Bug Fixes

• Fixed a bug where “empty pipelines” responses from the API would prevent the UI from loading.
• docker-provisioner-provisioner will roll when a manually provided certificate is changed

Chart Updates

The following charts have moved from Bitnami-hosted to CircleCI-hosted:

NOTE

Please note this release has been marked as broken and should not applied. Fixes will be applied in the 4.7.8 patch.

Updates

• RDS is now compatible with server 4.8.1. We have removed the permissions checks that previously blocked full support.
• When new workflows are stored, job numbers are generated for all jobs in that workflow together.
• Context-service will now use the same method as workflows-conductor to for table name consistency

Bug Fixes

• Fixed an issue that caused a lag between when jobs finished and when they were marked as complete
• Removed the GitHub App pipelines tooltips and pipeline management from the UI as Server does not support GitHub App pipelines at this time.
• SSH rerun now works in air-gap and in installations with a self-signed certificate on GitHub Enterprise.

Image Updates

• audit-log-service
• webhook-service
• cron-service
• branch-service
• feature-flags
• distributor
• execution-gateway
• output
• frontend (underlying container is now circle-www-api)
• builds-service
• orbs-service
• workflows-conductor
• insights-service
• machine-provisioner
• permissions-service
• domain-service
• policy-service
• authentication service
• ciam-service
• ciam-gateway
• contexts-service
• picard
• runner-admin
• step
• web-ui

Known Issues

• Vault may not refresh its client token after a month of uptime. Migrate to Tink to resolve this issue.
• Retry with SSH for jobs using the machine executor advertises a private IP address. For this reason, retry with SSH for jobs using the machine executor works as standard for public installations, but for private installs you would need to ensure that you can access the private IP advertised. For example, by using a VPN into your VPC.

To learn more about Server 4.8 installation, migration, or operations please review our documentation.

Updates

Bug Fixes

• CVE fixes
• Fixed a bug where the pipeline page for OSS repositories could be visible without being logged into CircleCI. Please reach out to your account team for more information.
• SSH rerun now works in air-gap and in installations with a self-signed certificate on GitHub Enterprise.

Image Updates

• frontend (underlying container is now circle-www-api)
• builds-service
• orbs-service
• workflows-conductor
• insights-service

Known Issues

• RabbitMQ needs features enabled prior to upgrading

Broken - This Server version has been removed

Updates

Bug Fixes

• Fixed a bug where the pipeline page for OSS repositories could be visible without being logged into CircleCI. Please reach out to your account team for more information.

Image Updates

• frontend (underlying container is now circle-www-api)

Bug Fixes

• Various CVE remediations
• Fixed a bug where the job page for OSS repositories could be visible without being logged into CircleCI. Please reach out to your account team for more information.

Image Updates

• branch-service
• branch-service-migrator
• execution-gateway
• runner-admin
• runner-admin-migrator
• web-ui-onboarding

Broken - This Server version has been removed

Updates

• Added support for additional certificates for OIDC
• Added support for assume_role_arn to the Machine Provisioner configmap
• Server version now included in support bundles

Bug Fixes

• Fixed a bug causing the /workflow-run api route to give 404 errors
• Various CVE remediations
• Fixed a bug where the job page for OSS repositories could be visible without being logged into CircleCI. Please reach out to your account team for more information.

Image Updates

• execution-gateway
• machine-provisioner
• machine-provisioner-migrator
• web-ui-server-admin
• picard

Updates

• oidc-tasks-service runs migrations before it’s main container is deployed
• Remote Docker and Machine jobs can now assume an IAM role by configuring machine_provisioner.providers.ec2.assumedRoleArn in your values.yaml

Bug Fixes

• /workflow-run/ route has been added to kong. Links for approval jobs will now be correctly routed on GHE
• The OIDC plugin now supports custom certificates
• A machine-provisioner custom config can now be provided in your helm upgrade command via --set-file. Machine-provisioner custom config can also be provided inline in the Helm values.yaml.
• Upgraded Next.js to resolve related CVEs

Updates

• Patched critical CVEs in web-ui-insights and webhook-service.

Bug fixes

• Fixed a vulnerability that allowed unauthenticated access to artifacts associated with public repositories.
• Resolved a bug that prevented a job from being rerun using SSH.

Updates

• Patched critical CVEs in web-ui-insights and webhook-service.

Bug fixes

• Fixed a vulnerability that allowed unauthenticated access to artifacts associated with public repositories.

Updates

• Updated the library dependencies for runner-admin
• CVE patches for web-ui-insights and webhook-service

Bug fixes

• Fixed a vulnerability where artifacts relating to public repositories could be accessed without authentication
• Fixed a bug where workflows in a terminal state with blocked jobs were incorrectly cancelled when a new workflow was triggered with redundant pipeline cancellation enabled.

Broken - This Server version has been removed

Updates

• Patched critical CVEs in webhook-service.

Bug fixes

• Fixed a vulnerability that allowed unauthenticated access to artifacts associated with public repositories. Server Release 4.5.8

Bug fixes

• Fixed a vulnerability that allowed unauthenticated access to artifacts associated with public repositories.

Bug fixes

• Resolved a bug where machine_provisioner.providers.gcp.network_tags were incorrectly assigned as labels on VM instances instead of as tags.

Broken - This Server version has been removed

Updates

• The provider manager’s connection pool size is now configurable under domain_service.providersMangerMaxPoolSize. The default is set to 10.

Bug Fixes

• Fixed a bug where OIDC tokens failed to be injected into a job, causing the environment variables $CIRCLE_OIDC_TOKEN and $CIRCLE_OIDC_TOKEN_V2 being missing.
• Resolved a bug where machine_provisioner.providers.gcp.network_tags were incorrectly assigned as labels on VM instances instead of as tags.
• Fixed a bug that prevented remote Docker from working in air-gapped environments. An external reaper container repository has been exposed for this and can be configured via docker_provisioner.reaperContainerRepository.
• Fixed an issue with IRSA roles on AWS GovCloud, which uses the S3 partition aws-us-gov instead of the default aws. This is now exposed in the values file under s3.partition.

New Known Issues

• Setting a custom reaper container repository (via docker_provisioner.reaperContainerRepository) is currently incompatible with Windows VMs and prevents Windows jobs from running.

Updates

• The provider manager’s connection pool size is now configurable under domain_service.providersMangerMaxPoolSize. The default is set to 10.

Bug fixes

• Resolved a bug where machine_provisioner.providers.gcp.network_tags were incorrectly assigned as labels on VM instances instead of as tags.
• Fixed a bug that prevented remote Docker from working in air-gapped environments. An external reaper container repository has been exposed for this and can be configured via docker_provisioner.reaperContainerRepository.
• Fixed an issue with IRSA roles on AWS GovCloud, which uses the S3 partition aws-us-gov instead of the default aws. This is now exposed in the values file under s3.partition.

New known issues

• Setting a custom reaper container repository (via docker_provisioner.reaperContainerRepository) is currently incompatible with Windows VMs and prevents Windows jobs from running.

Updates

• The provider manager’s connection pool size is now configurable under domain_service.providersMangerMaxPoolSize. The default is set to 10.

Bug fixes

• Network tags in GCP now function as expected.
• Fixed a bug that prevented remote Docker from working in air-gapped environments. An external reaper container repository has been exposed for this and can be configured via docker_provisioner.reaperContainerRepository.
• Improved handling of AWS errors by machine-provisioner

Bug Fixes

• Network tags in GCP now function as expected.

Updates

• The provider manager’s connection pool size is now configurable under domain_service.providersMangerMaxPoolSize. The default is set to 10.

Bug Fixes

• Fixed a bug that prevented remote Docker from working in air-gapped environments. An external reaper container repository has been exposed for this and can be configured via docker_provisioner.reaperContainerRepository.
• Fixed an issue with IRSA roles on AWS Gov Cloud, which uses the S3 partition aws-us-gov instead of the default aws. This is now exposed in the values file under s3.partition.

New Known Issues

• Setting a custom reaper container repository (via docker_provisioner.reaperContainerRepository) is currently incompatible with Windows VMs and prevents Windows jobs from running.

Updates:

• Ability to specify the AWS partition with .object_storage.s3.partition.
• Ability to specify the reaper image (pause:3.6) with .docker_provisioner.reaperContainerRepository.

Updates:

• Improved handling of AWS errors by machine-provisioner

CircleCI will be moving to twice-yearly major and minor version releases of Server. Releases will be targeted for Spring (April) and Fall (October). Patch releases for bugs and security updates will be made monthly as needed.

Updates:

• frontend pod will now redeploy when the circleci license has been changed
• the timeout for windows and linux machine instances can now be configured using machine_provisioner.terminatePendingWindowsAfter and machine_provisioner.terminatePendingLinuxAfter respectively in your values.yaml
• fixed table ownership issue which prevented insights data from loading

Broken - This Server version has been removed

Updates:

• frontend pod will now redeploy when the circleci license has been changed
• the timeout for windows and linux machine instances can now be configured using machine_provisioner.terminatePendingWindowsAfter and machine_provisioner.terminatePendingLinuxAfter respectively in your values.yaml
• nomad server pod replica count will now default to 5

Image Updates:

• builds-service
• ciam-gateway
• authentication-svc
• orb-service
• workflows-conductor
• machine-provisioner
• api-service
• domain-service
• permissions-service

Updates:

• Frontend pod will redeploy when license updates are made
• The timeout for windows and linux machine instances can now be configured using machine_provisioner.terminatePendingWindowsAfter and machine_provisioner.terminatePendingLinuxAfter respectively in your values.yaml

Changes

• Increased the default number of nomad servers from 3 to 5 to improve stability
• Increased memory request and JVM heap size for frontend to 3GB
• Added support for HSTS

Bug Fixes

• Fixed issue where remote docker jobs are unable to checkout when assaignPublicIP is false
• Fixed templating error in Machine Provisioner which resulted in agent_base_url not being set
• Fixed issue in templating where some services where not referencing the correct registry credential secrets for image pulls
• Fixed for failing job cancel button

Image Updates

• runner-admin
• contexts-service
• server-postgres

Changes

• Increased the default number of nomad servers from 3 to 5 to improve stability

Bug Fixes

• Fixed issue where remote docker jobs are unable to checkout when assaignPublicIP is false
• Fixed templating error in Machine Provisioner which resulted in agent_base_url not being set
• Fixed issue in templating where some services where not referencing the correct registry credential secrets for image pulls

Image Updates

• workflows-conductor
• machine-provisioner
• contexts-service
• ciam-gateway
• auth-service

Fixes

• Fixes an issue in 4.3.7 that prevented imagePullSecrets from compiling without secrets set.

What’s changed?

• Authenticated users are now redirected from /server-login to the app subdomain’s dashboard.
• Users who require admin approval before logging in will now see an error message on the login screen.
• Improved error handling when retrieving pipeline values from GCS
• Default resource class can now be set via Repl.
• Project-based context restrictions now populate the project list.
• ~Improved k8s runner start up times. Task agent will now be initialized via init image rather than waiting to copy over the agent after the task pod has started.~

Update: Aug 12, 2024. We discovered that the init container changes were not included in this release and have updated the change log.