Changelog

Fixes

• Fixed a UI bug which prevented users from accessing User Settings and Admin Settings.
• Fixed for URL of a pipeline run’s commit status referencing the CircleCI’s Cloud URL rather than the Server URL.
• Fixed an issue where the pinned machine agent version was not being applied correctly.
• Fixed template path of the custom-config file in telegraf.
• Fixed a malformed Cache-Control HTTP header in Kong configuration that was causing request failures.
• Fixed an error that displayed “Something Unexpected Happened” on the user notifications settings page.
• Fix for a regression in the max config size limit

Updates

• Removed web-ui-authentication as it was unused
• CVE patches
• nginx will now only listen on port 4647 if Nomad servers are deployed internally to the cluster
• Redis has been updated to version 6.2.20.

Image Updates

• cron-service
• cron-service-migrator
• branch-service
• branch-service-migrator
• workflows-conductor
• workflows-conductor-migrator
• orb-service
• orb-service-migrator
• orb-service-analytics-migrator
• runner-admin
• runner-admin-migrator
• policy-service
• authentication-service
• oidc-service
• init-known-hosts
• builds-service
• builds-service-migrator
• circleci-www-api
• permissions-service
• permissions-service-migrator
• approval-job-provider-migrator
• audit-log-service
• insights-service
• insights-service-migrator
• machine-provisioner
• machine-provisioner-migrator
• ciam
• server-postgres
• server-rabbitmq
• server-redis
• web-ui
• web-ui-server-admin

Updates

• Ships with a updated version of redis to address CVE-2025-49844
• Fix for fractional byte value warning when performing helm upgrades
• Added missing annotations to secrets so that the secrets may be preserved in the cluster namespace by default in the event of a helm uninstall
• General component dependency updates and CVE fixes
• Updated machine-agent

Image Updates

• web-ui
• permissions-service
• init-known-hosts
• machine-provisioner
• cron-service
• policy-service
• branch-service
• insights-service
• machine-agent

Updates

• Ships with a updated version of redis to address CVE-2025-49844
• Fix for fractional byte value warning when performing helm upgrades
• Added missing annotations to secrets so that the secrets may be preserved in the cluster namespace by default in the event of a helm uninstall
• General component dependency updates and CVE fixes

Image Updates

• web-ui
• web-ui-insights
• web-ui-org-settings
• web-ui-authentication
• web-ui-onboarding
• init-known-hosts
• cron-service
• authentication-service
• orbs-service
• policy-service
• branch-service
• insights-service

Fixes

• Fixed and issues where policies would fail, the neither the UI nor the CLI showed logs as to why the workflow was denied due to builds-service not being able to connect to policy-service on the correct port binding
• dependency update for branch-service

Image Updates

• branch-service

Updates

• Various dependency updates for components
• Update go modules in runner-admin
• Added support communication between docker-provisioner and an externalized nomad server over HTTPS
• Fixes for schema drift
• CVE fixes for circle-www-api, orb-service, workflows-conductor,api-service

Image Updates

• branch-service
• insights-service
• permissions-service
• api-service
• policy-service
• contexts-service
• domain-service
• circle-www-api
• build-agent
• domain-service
• authentication-svc
• orb-service
• workflows-conductor
• cron-service
• builds-service
• machine-provisioner
• policy-service
• init-known-hosts
• ciam-gateway

Updates

• CVE fixes for web-ui components
• Updated golang modules in init-known-hosts, ciam-gateway, authentication-service, permissions-service
• Updated some clojure components
• Fixed a bug that prevented additional tags from being consistently applied to machine resources between helm upgrades

Image Updates

• web-ui
• web-ui-insights
• web-ui-org-settings
• init-known-hosts
• cron-service
• ciam-gateway
• authentication-service
• permissions-service
• machine-provisioner

Bug Fixes

• Fixed issue where users were unable to access the login page
• Fixed a bug that prevented Remote Docker (setup_remote_docker) builds from using OIDC to pull images from ECR by updating the AWS SDK in docker-provisioner

Image Updates

• machine-provisioner
• branch-service
• docker-provisioner
• insights-service
• context-service
• domain-service
• server-postgres
• web-ui-authentication
• builds-service
• workflows-conductor
• orb-service

Bug Fixes

• Fixed a bug where users would receive a 400 error when attempting to log in caused by a break in web-ui-authentication. This bug was introduced in server 4.7.7

Image Updates

• web-ui-authentication

The Server 4.7.7 Release is broken

We have found a bug in the server 4.7.7 release which breaks logins. We are working on a fix actively. Please avoid upgrading to version 4.7.7

Downloading this helm chart release has been disabled.

Updates

Bug Fixes

• Fixed a bug where “empty pipelines” responses from the API would prevent the UI from loading.
• docker-provisioner-provisioner will roll when a manually provided certificate is changed

Chart Updates

The following charts have moved from Bitnami-hosted to CircleCI-hosted:

NOTE

Please note this release has been marked as broken and should not applied. Fixes will be applied in the 4.7.8 patch.

Updates

• RDS is now compatible with server 4.8.1. We have removed the permissions checks that previously blocked full support.
• When new workflows are stored, job numbers are generated for all jobs in that workflow together.
• Context-service will now use the same method as workflows-conductor to for table name consistency

Bug Fixes

• Fixed an issue that caused a lag between when jobs finished and when they were marked as complete
• Removed the GitHub App pipelines tooltips and pipeline management from the UI as Server does not support GitHub App pipelines at this time.
• SSH rerun now works in air-gap and in installations with a self-signed certificate on GitHub Enterprise.

Image Updates

• audit-log-service
• webhook-service
• cron-service
• branch-service
• feature-flags
• distributor
• execution-gateway
• output
• frontend (underlying container is now circle-www-api)
• builds-service
• orbs-service
• workflows-conductor
• insights-service
• machine-provisioner
• permissions-service
• domain-service
• policy-service
• authentication service
• ciam-service
• ciam-gateway
• contexts-service
• picard
• runner-admin
• step
• web-ui

Known Issues

• Vault may not refresh its client token after a month of uptime. Migrate to Tink to resolve this issue.
• Retry with SSH for jobs using the machine executor advertises a private IP address. For this reason, retry with SSH for jobs using the machine executor works as standard for public installations, but for private installs you would need to ensure that you can access the private IP advertised. For example, by using a VPN into your VPC.

To learn more about Server 4.8 installation, migration, or operations please review our documentation.

Updates

Bug Fixes

• CVE fixes
• Fixed a bug where the pipeline page for OSS repositories could be visible without being logged into CircleCI. Please reach out to your account team for more information.
• SSH rerun now works in air-gap and in installations with a self-signed certificate on GitHub Enterprise.

Image Updates

• frontend (underlying container is now circle-www-api)
• builds-service
• orbs-service
• workflows-conductor
• insights-service

Known Issues

• RabbitMQ needs features enabled prior to upgrading

Bug Fixes

• Various CVE remediations
• Fixed a bug where the job page for OSS repositories could be visible without being logged into CircleCI. Please reach out to your account team for more information.

Image Updates

• branch-service
• branch-service-migrator
• execution-gateway
• runner-admin
• runner-admin-migrator
• web-ui-onboarding

Updates

• Added support for additional certificates for OIDC
• Added support for assume_role_arn to the Machine Provisioner configmap
• Server version now included in support bundles

Bug Fixes

• Fixed a bug causing the /workflow-run api route to give 404 errors
• Various CVE remediations
• Fixed a bug where the job page for OSS repositories could be visible without being logged into CircleCI. Please reach out to your account team for more information.

Image Updates

• execution-gateway
• machine-provisioner
• machine-provisioner-migrator
• web-ui-server-admin
• picard

Updates

• oidc-tasks-service runs migrations before it’s main container is deployed
• Remote Docker and Machine jobs can now assume an IAM role by configuring machine_provisioner.providers.ec2.assumedRoleArn in your values.yaml

Bug Fixes

• /workflow-run/ route has been added to kong. Links for approval jobs will now be correctly routed on GHE
• The OIDC plugin now supports custom certificates
• A machine-provisioner custom config can now be provided in your helm upgrade command via --set-file. Machine-provisioner custom config can also be provided inline in the Helm values.yaml.
• Upgraded Next.js to resolve related CVEs

Updates

• Patched critical CVEs in web-ui-insights and webhook-service.

Bug fixes

• Fixed a vulnerability that allowed unauthenticated access to artifacts associated with public repositories.
• Resolved a bug that prevented a job from being rerun using SSH.

Updates

• Patched critical CVEs in web-ui-insights and webhook-service.

Bug fixes

• Fixed a vulnerability that allowed unauthenticated access to artifacts associated with public repositories.

Updates

• Updated the library dependencies for runner-admin
• CVE patches for web-ui-insights and webhook-service

Bug fixes

• Fixed a vulnerability where artifacts relating to public repositories could be accessed without authentication
• Fixed a bug where workflows in a terminal state with blocked jobs were incorrectly cancelled when a new workflow was triggered with redundant pipeline cancellation enabled.

Updates

• Patched critical CVEs in webhook-service.

Bug fixes

• Fixed a vulnerability that allowed unauthenticated access to artifacts associated with public repositories. Server Release 4.5.8

Bug fixes

• Fixed a vulnerability that allowed unauthenticated access to artifacts associated with public repositories.

Bug fixes

• Resolved a bug where machine_provisioner.providers.gcp.network_tags were incorrectly assigned as labels on VM instances instead of as tags.

Updates

• The provider manager’s connection pool size is now configurable under domain_service.providersMangerMaxPoolSize. The default is set to 10.

Bug Fixes

• Fixed a bug where OIDC tokens failed to be injected into a job, causing the environment variables $CIRCLE_OIDC_TOKEN and $CIRCLE_OIDC_TOKEN_V2 being missing.
• Resolved a bug where machine_provisioner.providers.gcp.network_tags were incorrectly assigned as labels on VM instances instead of as tags.
• Fixed a bug that prevented remote Docker from working in air-gapped environments. An external reaper container repository has been exposed for this and can be configured via docker_provisioner.reaperContainerRepository.
• Fixed an issue with IRSA roles on AWS GovCloud, which uses the S3 partition aws-us-gov instead of the default aws. This is now exposed in the values file under s3.partition.

New Known Issues

• Setting a custom reaper container repository (via docker_provisioner.reaperContainerRepository) is currently incompatible with Windows VMs and prevents Windows jobs from running.

Updates

• The provider manager’s connection pool size is now configurable under domain_service.providersMangerMaxPoolSize. The default is set to 10.

Bug fixes

• Resolved a bug where machine_provisioner.providers.gcp.network_tags were incorrectly assigned as labels on VM instances instead of as tags.
• Fixed a bug that prevented remote Docker from working in air-gapped environments. An external reaper container repository has been exposed for this and can be configured via docker_provisioner.reaperContainerRepository.
• Fixed an issue with IRSA roles on AWS GovCloud, which uses the S3 partition aws-us-gov instead of the default aws. This is now exposed in the values file under s3.partition.

New known issues

• Setting a custom reaper container repository (via docker_provisioner.reaperContainerRepository) is currently incompatible with Windows VMs and prevents Windows jobs from running.

Updates

• The provider manager’s connection pool size is now configurable under domain_service.providersMangerMaxPoolSize. The default is set to 10.

Bug fixes

• Network tags in GCP now function as expected.
• Fixed a bug that prevented remote Docker from working in air-gapped environments. An external reaper container repository has been exposed for this and can be configured via docker_provisioner.reaperContainerRepository.
• Improved handling of AWS errors by machine-provisioner

Bug Fixes

• Network tags in GCP now function as expected.

Updates

• The provider manager’s connection pool size is now configurable under domain_service.providersMangerMaxPoolSize. The default is set to 10.

Bug Fixes

• Fixed a bug that prevented remote Docker from working in air-gapped environments. An external reaper container repository has been exposed for this and can be configured via docker_provisioner.reaperContainerRepository.
• Fixed an issue with IRSA roles on AWS Gov Cloud, which uses the S3 partition aws-us-gov instead of the default aws. This is now exposed in the values file under s3.partition.

New Known Issues

• Setting a custom reaper container repository (via docker_provisioner.reaperContainerRepository) is currently incompatible with Windows VMs and prevents Windows jobs from running.

Updates:

• Ability to specify the AWS partition with .object_storage.s3.partition.
• Ability to specify the reaper image (pause:3.6) with .docker_provisioner.reaperContainerRepository.

Updates:

• Improved handling of AWS errors by machine-provisioner

CircleCI will be moving to twice-yearly major and minor version releases of Server. Releases will be targeted for Spring (April) and Fall (October). Patch releases for bugs and security updates will be made monthly as needed.

Updates:

• frontend pod will now redeploy when the circleci license has been changed
• the timeout for windows and linux machine instances can now be configured using machine_provisioner.terminatePendingWindowsAfter and machine_provisioner.terminatePendingLinuxAfter respectively in your values.yaml
• fixed table ownership issue which prevented insights data from loading

Updates:

• frontend pod will now redeploy when the circleci license has been changed
• the timeout for windows and linux machine instances can now be configured using machine_provisioner.terminatePendingWindowsAfter and machine_provisioner.terminatePendingLinuxAfter respectively in your values.yaml
• nomad server pod replica count will now default to 5

Image Updates:

• builds-service
• ciam-gateway
• authentication-svc
• orb-service
• workflows-conductor
• machine-provisioner
• api-service
• domain-service
• permissions-service

Updates:

• Frontend pod will redeploy when license updates are made
• The timeout for windows and linux machine instances can now be configured using machine_provisioner.terminatePendingWindowsAfter and machine_provisioner.terminatePendingLinuxAfter respectively in your values.yaml

Changes

• Increased the default number of nomad servers from 3 to 5 to improve stability
• Increased memory request and JVM heap size for frontend to 3GB
• Added support for HSTS

Bug Fixes

• Fixed issue where remote docker jobs are unable to checkout when assaignPublicIP is false
• Fixed templating error in Machine Provisioner which resulted in agent_base_url not being set
• Fixed issue in templating where some services where not referencing the correct registry credential secrets for image pulls
• Fixed for failing job cancel button

Image Updates

• runner-admin
• contexts-service
• server-postgres

Changes

• Increased the default number of nomad servers from 3 to 5 to improve stability

Bug Fixes

• Fixed issue where remote docker jobs are unable to checkout when assaignPublicIP is false
• Fixed templating error in Machine Provisioner which resulted in agent_base_url not being set
• Fixed issue in templating where some services where not referencing the correct registry credential secrets for image pulls

Image Updates

• workflows-conductor
• machine-provisioner
• contexts-service
• ciam-gateway
• auth-service

Fixes

• Fixes an issue in 4.3.7 that prevented imagePullSecrets from compiling without secrets set.

What’s changed?

• Authenticated users are now redirected from /server-login to the app subdomain’s dashboard.
• Users who require admin approval before logging in will now see an error message on the login screen.
• Improved error handling when retrieving pipeline values from GCS
• Default resource class can now be set via Repl.
• Project-based context restrictions now populate the project list.
• ~Improved k8s runner start up times. Task agent will now be initialized via init image rather than waiting to copy over the agent after the task pod has started.~

Update: Aug 12, 2024. We discovered that the init container changes were not included in this release and have updated the change log.

Enhancements

• Updated AMIs. These images are now based on ubuntu 22.04. Older images are no longer available at this time.

Bug Fixes

• Fix to address a change in the Github API validation for the content-type field which is breaking webhook setup for projects

Change Log

• Suspended users will receive a more descriptive error upon failure to log in.
• Bug fixes for SMPT email value.

Change Log

• Suspended users will receive a more descriptive error upon failure to log in.
• Bug fixes for SMPT email value.

Bug Fixes

• fix for hardcoded smtp email in some services
• CVE fixes for web-ui deployment
• fix for duplicate volume in domain-service deployment

Change Log

• updated task agent version
• bug fixes for oidc-service

CHANGES:

CHANGES:

Fixes

• Fix Windows machine executors on EC2
• Allow disabling statsd collection for build agent to decrease startup time
• Configure remote Docker engine with proxy settings if present

Fixes

Fix incorrect build-agent version

Fixes

• Fix Windows machine executors on EC2
• Allow disabling statsd collection for build agent to decrease startup time
• Fix bug in the postgres image which threw an error when Postgres triggered JIT compilation for a query

Fixes

• Security updates
• Removed the unused distributor_dispatcher.disable_concurrency value

Fixes

• Updated Go version to 1.21.5 in init-known-hosts to address CVEs
• Concurrency is disabled by default in distributor-dispatcher. Previously, disabling/enabling concurrency limits was a configurable option.
• Bump Go version to 1.20.12 in distributor to address CVEs

Changes

• The default 2500 job concurrency limit per organization is now configurable with the Helm value execution_gateway.plan_concurrency.
• The timeout for downloading machine provisioner agents is now configurable with the Helm values machine_provisioner.machine_agent_download_timeout_seconds and machine_provisioner.agent_download_timeout_seconds.

Fixes

• Bump Go version to 1.21.5 in Go-based services to address CVEs.