Update semaphoreui/semaphore Docker tag to v2.19.8 #279

Open
renovate-bot wants to merge 1 commit from renovate/semaphoreui-semaphore-2.x into main
Collaborator

This PR contains the following updates:

Package Update Change
semaphoreui/semaphore minor v2.18.2v2.19.8

Release Notes

semaphoreui/semaphore (semaphoreui/semaphore)

v2.19.8

Compare Source

v2.19.7

Compare Source

image

Semaphore UI v2.19

Highlights

  • Workflows — build multi-template pipelines with a graphical editor
  • Docker and Kubernetes executors — run tasks in containers/pods instead of on the server (Pro/Enterprise)
  • JWT / OIDC ID tokens for tasks — keyless auth to Vault, AWS, GCP, Azure
  • Encryption key rotation with a labelled keyring
  • Real server-side pagination for task history — projects with millions of tasks no longer choke
  • BoltDB removed — SQLite/MySQL/Postgres only
  • A large batch of security hardening across the API

Workflows

A workflow is a graph of task templates that run as one unit.

  • Graphical editor at /workflows/new and /workflows/:id/edit (Drawflow-based), with palette
    drag-and-drop, edge condition selectors, live cycle/self-edge guards, a validation problems panel,
    and auto-layout for position-less workflows. Node positions are persisted.
  • Node kinds: task (runs a template), approval (gates the run, with timeout and message), and
    note (free-form annotation, never executed).
  • Per-node task parameters (task_params_id on workflow nodes).
  • API: /project/{id}/workflows (CRUD), /{workflow_id}/run, /runs,
    /runs/{run_id}/{stop,artifacts,approvals}, POST /runs/{run_id}/approvals/{node_id}.

Executors: Docker and Kubernetes (Pro/Enterprise)

Runners can now execute tasks in a container or a pod instead of directly on the runner host.

  • Kubernetes (runner.executor.k8s): kubeconfig, namespace (default semaphore), image,
    helper_image, service_account, pull_secrets, poll_interval_seconds, cleanup_grace_seconds.
  • Docker (runner.executor.docker): host, tls_verify, cert_path, image, helper_image,
    network, pull_policy, cpu_limit, memory_limit, privileged (off by default), poll/cleanup
    timings.
  • Each option also has a SEMAPHORE_RUNNER_K8S_* / SEMAPHORE_RUNNER_DOCKER_* environment variable.
  • New semaphoreui/job and semaphoreui/helper images are built and published by CI; the job image
    ships Terraform/OpenTofu/Terragrunt and paramiko.
  • Per-template executor image — a template can override the container image used for its tasks
    (project__template.executor_image).

Task JWT / OIDC ID tokens

Semaphore can now act as an OIDC provider for running tasks, so jobs authenticate to external systems
without long-lived credentials.

  • Short-lived ECDSA-signed JWTs issued per task, published via GET /.well-known/jwks.json.
  • Per-template JWT options (multiple audiences, per-token TTL) configured in the template form; claims
    carry IDs only.
  • Config block jwt: enabled, issuer, default_ttl (1h), max_ttl (24h), with SEMAPHORE_JWT_*
    env vars.
  • Template JWT params persisted in project__template.jwt_params.

Secrets & encryption

  • Encryption key rotation. New encryption config block with a labelled keyring: inline keys
    (value or file), or a keys_folder where each file is a key named by its filename, plus
    active.secret_key / active.option_key pointers. Ciphertext now carries a key ID, so keys can be
    rotated without a big-bang re-encrypt. keys_file + keys_poll_interval (default 15s) allow hot
    reload. The legacy flat access_key_encryption still works and is used when encryption is unset.
  • option_encryption — separate key for encrypting DB-stored options.
  • Survey secret variables now work on remote runners and in HA. Previously a survey secret value
    lived only in the memory of the node that accepted the task, so it arrived empty on remote runners
    and was lost across restarts. Secrets are now persisted as task-bound access keys
    (access_key.task_id, access_key.expire_at, cascade-deleted with the task); TTL is derived from
    MaxTaskDurationSec (+1h queue allowance, 24h when unlimited).
  • OpenBao secret storage type (routed through the Vault provider), with its own icon in the UI.
  • TLS-skip-verify checkbox for Vault/OpenBao storages.
  • Synchronized and read-only secret fields are no longer wiped on update.

Runners

  • Online/offline status shown on the Runners page, derived from heartbeat liveness (webhook-driven
    runners are always dispatch candidates).
  • Hung-task recovery. Runners report their process start time (X-Runner-Started-At, stored in
    runner.started_at), which lets the server detect a runner that restarted and silently lost its
    in-memory job pool. starting tasks are reassigned to a healthy runner; running tasks get a
    recovery window and are then failed with a clear message. Tunables in the new runners config
    block: offline_timeout_sec (120), task_fail_timeout_sec (420), reconcile_interval_sec (30).
  • Tasks reassigned away from a runner are terminated on the old runner.
  • Per-runner RSA encryption keys removed — secrets are protected by TLS on the wire instead. This
    removes ~380 lines of key-exchange code from the runner protocol.
  • Runner registration tokens are stored hashed, with an expiry; invalid registration tokens are
    rejected with 400, and token prefixes are validated.
  • Fixed a TCP connection leak in the runner client.
  • Runner options moved into a dedicated runners config struct (old flat options still read).
  • The active flag was dropped from runner registration; only registered runners are used.

Performance & scale

  • Keyset pagination for task history. The history page used to fetch the 200 newest tasks and page
    through them client-side. The backend now returns one page at a time via a before cursor +
    count (legacy limit still accepted), with no COUNT(*) and no OFFSET — so page depth no
    longer degrades on projects with millions of tasks. Applies to project history, template task lists
    (/templates/{id}/tasks, /tasks/last, /stats) and the dashboard.
  • Task lists reload at most once every 5 seconds; several redundant UI requests removed.
  • Git operations are serialized per repository directory (KeyLock). Templates with
    AllowParallelTasks=true shared one working copy, and concurrent git pull + git checkout could
    corrupt it. updateRepository() + checkoutRepository() is now one critical section, covering both
    local and runner execution. Inventory repo operations are serialized the same way.
  • BoltDB removed. SQLite replaces it everywhere, including session storage; the
    permanent-connection flag is gone.
  • Stale HA pool state is released on duplicate finalize.

Templates, tasks & UI

  • Dynamic playbook picker — the template form lists actual playbook files from the repository
    (GET /repositories/{repository_id}/playbooks) instead of requiring a hand-typed path. Playbooks
    reset when the branch changes, and branch-load failures no longer block the playbook list.
  • Survey variable target — a survey var can now be delivered as a process environment variable
    (target: "env") instead of the app-specific CLI way (--extra-vars / -var / CLI arg). The env
    var name is the variable name verbatim, so TF_VAR_foo works. Stored in the existing survey_vars
    JSON — no migration.
  • New survey variable types: int, text (multiline), and restyled enum.
  • Typed variables in variable groups (including int).
  • Skip Ansible Galaxy install — per-template and per-task option to skip role/collection
    requirement installation.
  • Dropdown cards for JWT and schedule sections in the template form; new DropdownCard /
    HighlightedCard components.
  • Czech translation added.
  • Copy-to-clipboard icon is visible in light mode; running-task spinners fixed; template form bottom
    padding fixed.
  • Schedules are validated with the server-side cron parser (client and server no longer disagree).
  • Integration variable extraction preserves JSON objects and arrays instead of stringifying them.

Observability

  • Prometheus metrics. New metrics config block (enabled, username, password, plus
    SEMAPHORE_METRICS_*) exposing /api/metrics with Go/process collectors,
    semaphore_tasks_running (gauge) and semaphore_tasks_total{status} (counter). The endpoint is off
    by default and can be protected with basic auth.
  • Namespaced debug logging. A Node.js debug-style filter via --debug-filter /
    SEMAPHORE_DEBUG_FILTER lets you turn on verbose tracing for one subsystem (runners, LDAP,
    schedules, git) without the noise from everything else. Applies to syslog hooks too.
    SEMAPHORE_LOG_LEVEL / --log-level behave exactly as before.
  • Many new contextual debug statements across runners, tasks and auth.
  • SSH host key checking is configurable: ssh.known_hosts_file, ssh.config_path,
    ssh.strict_host_key_checking (no / yes / accept-new). With no known-hosts file configured,
    Semaphore uses a persistent trust-on-first-use file under TmpPath — first connection pinned, later
    host-key changes rejected.

Security

  • Changing a password or managing 2FA/TOTP now requires the current password (CWE-620 —
    unverified password change).
  • Origin/Referer validation on state-changing requests (CSRF hardening).
  • Session cookies marked Secure over HTTPS.
  • Custom role creation now checks the caller's permissions.
  • Task branch override is only allowed when the template sets AllowOverrideBranchInTask.
  • Git URL validation; --end-of-options passed to git so a crafted ref cannot be read as a flag;
    commit hashes format-checked; branches validated before repository browsing; playbook paths
    validated.
  • Access key payloads validated; template app validated.
  • Project/integration ID ownership verified on integration API requests; template_id verified on
    vault update.
  • Runner tokens are no longer written into project backups.
  • API returns after a write error instead of continuing with a partially written response.
  • Runner per-runner encryption keys removed in favour of transport TLS.
  • Fixed a nil-pointer panic when closing an uninitialized DB.
  • CodeQL: potential integer overflow in allocation size computation.
  • Security SLA published in SECURITY.md; release artifacts signed with the
    security@semaphoreui.com GPG key.

Upgrade notes

Breaking / behavioural changes
  1. BoltDB is gone. If you are still running a BoltDB installation, migrate to SQLite (or
    MySQL/Postgres) before upgrading. bolt is no longer a valid dialect.
  2. Runner encryption keys removed. Runners and server must both be on 2.19; the key-exchange step
    no longer exists. Make sure runner↔server traffic is TLS-protected.
  3. Task list APIs are paginated. GET /project/{id}/tasks and the template task endpoints return
    one page and take a before cursor plus count. limit is still accepted for backward
    compatibility, but clients relying on getting the newest 200 tasks in one response must page.
  4. Runner active flag removed from registration.
  5. Project backups no longer contain runner tokens — re-register runners rather than expecting a
    restore to carry credentials.
New configuration

encryption, jwt, metrics, runners, ssh, runner.executor.{docker,k8s},
ldap_tls_skip_verify, option_encryption, external_auth_email_matching.

All are optional; existing configs keep working. use_remote_runner and the flat runner options are
deprecated in favour of runners. The JSON schema (config.schema.yaml) and the config-option
reference docs have been regenerated.

Documentation

Docs are now a git submodule and are embedded in the binary, so they ship offline. New/updated pages:
Docker & Kubernetes executors, encryption and key rotation, JWT auth during task execution, OpenBao
secret storage, IdP-initiated OIDC, PingFederate TLS, license activation, dev setup, logging, runner
registration, and regenerated CLI reference.

Dependencies & build

Go 1.26.5; Debian 13 and Alpine 3.24 base images; go-git 5.19.2, go-oidc 3.20.0,
golang.org/x/crypto 0.54.0, go-ldap 3.4.14, modernc.org/sqlite 1.54.0; frontend axios 1.19,
cron-parser 5.7, nanoid 6, shell-quote 1.10. MariaDB 12.1 migration compatibility fixed.
THIRD-PARTY-LICENSES.md regenerated.

Known gaps

Two plans in AGENTS/plans/2_19 did not ship in this line and are still open:
password-hash-argon2id (bcrypt → Argon2id) and runner-token-hash (hashing the runner bearer token
itself — only registration tokens are hashed today). The runner-version-platform-uptime plan
shipped partially: uptime and online/offline status landed, but runner version/OS/arch columns did
not.

v2.19.6

Compare Source

v2.18.29

Compare Source

Changelog

  • 91719b9 fix(secrets): do not remove synchronized fields and readonly secrets

v2.18.28

Compare Source

Bugfixes

  • Validate schedule cron format using backend endpoint instead of JS library

v2.18.27

Compare Source

Changelog

  • 240e595 fix(templates): validate app

v2.18.26

Compare Source

Changelog

  • ee781a0 feat(auth): verify current password to fix CWE-620

v2.18.25

Compare Source

Changelog

  • 7c3789c fix(runners): close connections

v2.18.24

Compare Source

v2.18.23

Compare Source

Changelog

  • 74d8dd5 feat(ui): placeholder for enterprise storages

v2.18.22

Compare Source

Changelog

  • debf7a0 feat(ui): return extra vars for secrets

v2.18.21

Compare Source

Changelog

  • 2d6e2e3 feat: secure flag for session when https enabled

v2.18.20

Compare Source

Bugfixes

  • Validate playbook path

v2.18.19

Compare Source

v2.18.19 Release Summary

This patch release includes several important security and validation fixes.

Security fixes
  • Added validation for Git repository URLs to prevent Git option injection.
  • Added --end-of-options to Git commands to make repository URL and branch handling safer.
  • Fixed branch override handling: task-level Git branch override is now applied only when the template explicitly allows it.
  • Prevented custom roles from shadowing built-in role slugs such as owner or manager.
  • Fixed permission resolution so built-in roles always use their built-in permissions instead of database-defined custom roles.
  • Added validation to prevent access keys from being updated with a different ID or moved to another project.
Reliability and tests
  • Added tests for Git URL validation and Git command injection protection.
  • Added tests for access key update validation.
  • Added tests for custom role validation and reserved role slugs.
  • Refactored Git branch resolution into a dedicated helper to make task behavior more consistent.

v2.18.18

Compare Source

v2.18.17

Compare Source

v2.18.16

Compare Source

Bugfixes

  • Fix variable groups sync functionality

v2.18.15

Compare Source

v2.18.14

Compare Source

v2.18.12

Compare Source

Features

  • Checkbox Skip Galaxy install

v2.18.10

Compare Source

v2.18.9

Compare Source

Changelog

  • 0a37ea2 feat(cli): allow create token

v2.18.8

Compare Source

Changelog

v2.18.5

Compare Source

v2.18.4

Compare Source

Changelog

  • 7ca373d fix(docker): check reg token file

What's Changed

New Contributors

Full Changelog: https://github.com/semaphoreui/semaphore/compare/v2.18.2...v2.18.4

v2.18.3

Compare Source


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [semaphoreui/semaphore](https://github.com/semaphoreui/semaphore) | minor | `v2.18.2` → `v2.19.8` | --- ### Release Notes <details> <summary>semaphoreui/semaphore (semaphoreui/semaphore)</summary> ### [`v2.19.8`](https://github.com/semaphoreui/semaphore/compare/v2.19.7...v2.19.8) [Compare Source](https://github.com/semaphoreui/semaphore/compare/v2.19.7...v2.19.8) ### [`v2.19.7`](https://github.com/semaphoreui/semaphore/releases/tag/v2.19.7) [Compare Source](https://github.com/semaphoreui/semaphore/compare/v2.19.6...v2.19.7) <img width="1537" height="730" alt="image" src="https://github.com/user-attachments/assets/bb0ef600-70cf-4943-8247-debb59e438a7" /> ### Semaphore UI v2.19 #### Highlights - **Workflows** — build multi-template pipelines with a graphical editor - **Docker and Kubernetes executors** — run tasks in containers/pods instead of on the server (Pro/Enterprise) - **JWT / OIDC ID tokens for tasks** — keyless auth to Vault, AWS, GCP, Azure - **Encryption key rotation** with a labelled keyring - **Real server-side pagination** for task history — projects with millions of tasks no longer choke - **BoltDB removed** — SQLite/MySQL/Postgres only - A large batch of **security hardening** across the API #### Workflows A workflow is a graph of task templates that run as one unit. - Graphical editor at `/workflows/new` and `/workflows/:id/edit` (Drawflow-based), with palette drag-and-drop, edge condition selectors, live cycle/self-edge guards, a validation problems panel, and auto-layout for position-less workflows. Node positions are persisted. - Node kinds: **task** (runs a template), **approval** (gates the run, with timeout and message), and **note** (free-form annotation, never executed). - Per-node task parameters (`task_params_id` on workflow nodes). - API: `/project/{id}/workflows` (CRUD), `/{workflow_id}/run`, `/runs`, `/runs/{run_id}/{stop,artifacts,approvals}`, `POST /runs/{run_id}/approvals/{node_id}`. #### Executors: Docker and Kubernetes (Pro/Enterprise) Runners can now execute tasks in a container or a pod instead of directly on the runner host. - **Kubernetes** (`runner.executor.k8s`): `kubeconfig`, `namespace` (default `semaphore`), `image`, `helper_image`, `service_account`, `pull_secrets`, `poll_interval_seconds`, `cleanup_grace_seconds`. - **Docker** (`runner.executor.docker`): `host`, `tls_verify`, `cert_path`, `image`, `helper_image`, `network`, `pull_policy`, `cpu_limit`, `memory_limit`, `privileged` (off by default), poll/cleanup timings. - Each option also has a `SEMAPHORE_RUNNER_K8S_*` / `SEMAPHORE_RUNNER_DOCKER_*` environment variable. - New `semaphoreui/job` and `semaphoreui/helper` images are built and published by CI; the job image ships Terraform/OpenTofu/Terragrunt and `paramiko`. - **Per-template executor image** — a template can override the container image used for its tasks (`project__template.executor_image`). #### Task JWT / OIDC ID tokens Semaphore can now act as an OIDC provider for running tasks, so jobs authenticate to external systems without long-lived credentials. - Short-lived ECDSA-signed JWTs issued per task, published via `GET /.well-known/jwks.json`. - Per-template JWT options (multiple audiences, per-token TTL) configured in the template form; claims carry IDs only. - Config block `jwt`: `enabled`, `issuer`, `default_ttl` (1h), `max_ttl` (24h), with `SEMAPHORE_JWT_*` env vars. - Template JWT params persisted in `project__template.jwt_params`. #### Secrets & encryption - **Encryption key rotation.** New `encryption` config block with a labelled keyring: inline `keys` (value or file), or a `keys_folder` where each file is a key named by its filename, plus `active.secret_key` / `active.option_key` pointers. Ciphertext now carries a key ID, so keys can be rotated without a big-bang re-encrypt. `keys_file` + `keys_poll_interval` (default `15s`) allow hot reload. The legacy flat `access_key_encryption` still works and is used when `encryption` is unset. - **`option_encryption`** — separate key for encrypting DB-stored options. - **Survey secret variables now work on remote runners and in HA.** Previously a survey `secret` value lived only in the memory of the node that accepted the task, so it arrived empty on remote runners and was lost across restarts. Secrets are now persisted as task-bound access keys (`access_key.task_id`, `access_key.expire_at`, cascade-deleted with the task); TTL is derived from `MaxTaskDurationSec` (+1h queue allowance, 24h when unlimited). - **OpenBao** secret storage type (routed through the Vault provider), with its own icon in the UI. - TLS-skip-verify checkbox for Vault/OpenBao storages. - Synchronized and read-only secret fields are no longer wiped on update. #### Runners - **Online/offline status** shown on the Runners page, derived from heartbeat liveness (webhook-driven runners are always dispatch candidates). - **Hung-task recovery.** Runners report their process start time (`X-Runner-Started-At`, stored in `runner.started_at`), which lets the server detect a runner that restarted and silently lost its in-memory job pool. `starting` tasks are reassigned to a healthy runner; `running` tasks get a recovery window and are then failed with a clear message. Tunables in the new `runners` config block: `offline_timeout_sec` (120), `task_fail_timeout_sec` (420), `reconcile_interval_sec` (30). - Tasks reassigned away from a runner are terminated on the old runner. - **Per-runner RSA encryption keys removed** — secrets are protected by TLS on the wire instead. This removes \~380 lines of key-exchange code from the runner protocol. - Runner registration tokens are stored hashed, with an expiry; invalid registration tokens are rejected with `400`, and token prefixes are validated. - Fixed a TCP connection leak in the runner client. - Runner options moved into a dedicated `runners` config struct (old flat options still read). - The `active` flag was dropped from runner registration; only registered runners are used. #### Performance & scale - **Keyset pagination for task history.** The history page used to fetch the 200 newest tasks and page through them client-side. The backend now returns one page at a time via a `before` cursor + `count` (legacy `limit` still accepted), with no `COUNT(*)` and no `OFFSET` — so page depth no longer degrades on projects with millions of tasks. Applies to project history, template task lists (`/templates/{id}/tasks`, `/tasks/last`, `/stats`) and the dashboard. - Task lists reload at most once every 5 seconds; several redundant UI requests removed. - **Git operations are serialized per repository directory** (`KeyLock`). Templates with `AllowParallelTasks=true` shared one working copy, and concurrent `git pull` + `git checkout` could corrupt it. `updateRepository()` + `checkoutRepository()` is now one critical section, covering both local and runner execution. Inventory repo operations are serialized the same way. - **BoltDB removed.** SQLite replaces it everywhere, including session storage; the permanent-connection flag is gone. - Stale HA pool state is released on duplicate finalize. #### Templates, tasks & UI - **Dynamic playbook picker** — the template form lists actual playbook files from the repository (`GET /repositories/{repository_id}/playbooks`) instead of requiring a hand-typed path. Playbooks reset when the branch changes, and branch-load failures no longer block the playbook list. - **Survey variable target** — a survey var can now be delivered as a process environment variable (`target: "env"`) instead of the app-specific CLI way (`--extra-vars` / `-var` / CLI arg). The env var name is the variable name verbatim, so `TF_VAR_foo` works. Stored in the existing `survey_vars` JSON — no migration. - **New survey variable types**: `int`, `text` (multiline), and restyled `enum`. - **Typed variables in variable groups** (including `int`). - **Skip Ansible Galaxy install** — per-template and per-task option to skip role/collection requirement installation. - Dropdown cards for JWT and schedule sections in the template form; new `DropdownCard` / `HighlightedCard` components. - **Czech translation** added. - Copy-to-clipboard icon is visible in light mode; running-task spinners fixed; template form bottom padding fixed. - Schedules are validated with the server-side cron parser (client and server no longer disagree). - Integration variable extraction preserves JSON objects and arrays instead of stringifying them. #### Observability - **Prometheus metrics.** New `metrics` config block (`enabled`, `username`, `password`, plus `SEMAPHORE_METRICS_*`) exposing `/api/metrics` with Go/process collectors, `semaphore_tasks_running` (gauge) and `semaphore_tasks_total{status}` (counter). The endpoint is off by default and can be protected with basic auth. - **Namespaced debug logging.** A Node.js `debug`-style filter via `--debug-filter` / `SEMAPHORE_DEBUG_FILTER` lets you turn on verbose tracing for one subsystem (runners, LDAP, schedules, git) without the noise from everything else. Applies to syslog hooks too. `SEMAPHORE_LOG_LEVEL` / `--log-level` behave exactly as before. - Many new contextual debug statements across runners, tasks and auth. - **SSH host key checking is configurable**: `ssh.known_hosts_file`, `ssh.config_path`, `ssh.strict_host_key_checking` (`no` / `yes` / `accept-new`). With no known-hosts file configured, Semaphore uses a persistent trust-on-first-use file under `TmpPath` — first connection pinned, later host-key changes rejected. #### Security - **Changing a password or managing 2FA/TOTP now requires the current password** (CWE-620 — unverified password change). - **Origin/Referer validation** on state-changing requests (CSRF hardening). - Session cookies marked `Secure` over HTTPS. - Custom role creation now checks the caller's permissions. - Task branch override is only allowed when the template sets `AllowOverrideBranchInTask`. - Git URL validation; `--end-of-options` passed to git so a crafted ref cannot be read as a flag; commit hashes format-checked; branches validated before repository browsing; playbook paths validated. - Access key payloads validated; template `app` validated. - Project/integration ID ownership verified on integration API requests; `template_id` verified on vault update. - Runner tokens are no longer written into project backups. - API returns after a write error instead of continuing with a partially written response. - Runner per-runner encryption keys removed in favour of transport TLS. - Fixed a nil-pointer panic when closing an uninitialized DB. - CodeQL: potential integer overflow in allocation size computation. - Security SLA published in `SECURITY.md`; release artifacts signed with the `security@semaphoreui.com` GPG key. *** #### Upgrade notes ##### Breaking / behavioural changes 1. **BoltDB is gone.** If you are still running a BoltDB installation, migrate to SQLite (or MySQL/Postgres) before upgrading. `bolt` is no longer a valid `dialect`. 2. **Runner encryption keys removed.** Runners and server must both be on 2.19; the key-exchange step no longer exists. Make sure runner↔server traffic is TLS-protected. 3. **Task list APIs are paginated.** `GET /project/{id}/tasks` and the template task endpoints return one page and take a `before` cursor plus `count`. `limit` is still accepted for backward compatibility, but clients relying on getting the newest 200 tasks in one response must page. 4. **Runner `active` flag removed** from registration. 5. Project backups no longer contain runner tokens — re-register runners rather than expecting a restore to carry credentials. ##### New configuration `encryption`, `jwt`, `metrics`, `runners`, `ssh`, `runner.executor.{docker,k8s}`, `ldap_tls_skip_verify`, `option_encryption`, `external_auth_email_matching`. All are optional; existing configs keep working. `use_remote_runner` and the flat runner options are deprecated in favour of `runners`. The JSON schema (`config.schema.yaml`) and the config-option reference docs have been regenerated. #### Documentation Docs are now a git submodule and are embedded in the binary, so they ship offline. New/updated pages: Docker & Kubernetes executors, encryption and key rotation, JWT auth during task execution, OpenBao secret storage, IdP-initiated OIDC, PingFederate TLS, license activation, dev setup, logging, runner registration, and regenerated CLI reference. #### Dependencies & build Go 1.26.5; Debian 13 and Alpine 3.24 base images; `go-git` 5.19.2, `go-oidc` 3.20.0, `golang.org/x/crypto` 0.54.0, `go-ldap` 3.4.14, `modernc.org/sqlite` 1.54.0; frontend `axios` 1.19, `cron-parser` 5.7, `nanoid` 6, `shell-quote` 1.10. MariaDB 12.1 migration compatibility fixed. `THIRD-PARTY-LICENSES.md` regenerated. #### Known gaps Two plans in `AGENTS/plans/2_19` did **not** ship in this line and are still open: `password-hash-argon2id` (bcrypt → Argon2id) and `runner-token-hash` (hashing the runner bearer token itself — only *registration* tokens are hashed today). The `runner-version-platform-uptime` plan shipped partially: uptime and online/offline status landed, but runner version/OS/arch columns did not. ### [`v2.19.6`](https://github.com/semaphoreui/semaphore/compare/v2.18.29...v2.19.6) [Compare Source](https://github.com/semaphoreui/semaphore/compare/v2.18.29...v2.19.6) ### [`v2.18.29`](https://github.com/semaphoreui/semaphore/releases/tag/v2.18.29) [Compare Source](https://github.com/semaphoreui/semaphore/compare/v2.18.28...v2.18.29) #### Changelog - [`91719b9`](https://github.com/semaphoreui/semaphore/commit/91719b944ccf17e23cbf5e1955a1caea32a58c5c) fix(secrets): do not remove synchronized fields and readonly secrets ### [`v2.18.28`](https://github.com/semaphoreui/semaphore/releases/tag/v2.18.28) [Compare Source](https://github.com/semaphoreui/semaphore/compare/v2.18.27...v2.18.28) #### Bugfixes - Validate schedule cron format using backend endpoint instead of JS library ### [`v2.18.27`](https://github.com/semaphoreui/semaphore/releases/tag/v2.18.27) [Compare Source](https://github.com/semaphoreui/semaphore/compare/v2.18.26...v2.18.27) #### Changelog - [`240e595`](https://github.com/semaphoreui/semaphore/commit/240e5952239f7168e26cd81680de58d865d1919a) fix(templates): validate app ### [`v2.18.26`](https://github.com/semaphoreui/semaphore/releases/tag/v2.18.26) [Compare Source](https://github.com/semaphoreui/semaphore/compare/v2.18.25...v2.18.26) #### Changelog - [`ee781a0`](https://github.com/semaphoreui/semaphore/commit/ee781a032ccb58c61de6b9a70993f9b6dc77dcf8) feat(auth): verify current password to fix CWE-620 ### [`v2.18.25`](https://github.com/semaphoreui/semaphore/releases/tag/v2.18.25) [Compare Source](https://github.com/semaphoreui/semaphore/compare/v2.18.24...v2.18.25) #### Changelog - [`7c3789c`](https://github.com/semaphoreui/semaphore/commit/7c3789c890d7e92fb8ca2a63ad74babf460a13fa) fix(runners): close connections ### [`v2.18.24`](https://github.com/semaphoreui/semaphore/compare/v2.18.23...v2.18.24) [Compare Source](https://github.com/semaphoreui/semaphore/compare/v2.18.23...v2.18.24) ### [`v2.18.23`](https://github.com/semaphoreui/semaphore/releases/tag/v2.18.23) [Compare Source](https://github.com/semaphoreui/semaphore/compare/v2.18.22...v2.18.23) #### Changelog - [`74d8dd5`](https://github.com/semaphoreui/semaphore/commit/74d8dd572c056ce943080a344d87e29dd036df33) feat(ui): placeholder for enterprise storages ### [`v2.18.22`](https://github.com/semaphoreui/semaphore/releases/tag/v2.18.22) [Compare Source](https://github.com/semaphoreui/semaphore/compare/v2.18.21...v2.18.22) #### Changelog - [`debf7a0`](https://github.com/semaphoreui/semaphore/commit/debf7a0618b46a529a08c11408d2a378d97af13b) feat(ui): return extra vars for secrets ### [`v2.18.21`](https://github.com/semaphoreui/semaphore/releases/tag/v2.18.21) [Compare Source](https://github.com/semaphoreui/semaphore/compare/v2.18.20...v2.18.21) #### Changelog - [`2d6e2e3`](https://github.com/semaphoreui/semaphore/commit/2d6e2e3eb10e8bf688e2ab59609b909a012fad4c) feat: secure flag for session when https enabled ### [`v2.18.20`](https://github.com/semaphoreui/semaphore/releases/tag/v2.18.20) [Compare Source](https://github.com/semaphoreui/semaphore/compare/v2.18.19...v2.18.20) #### Bugfixes - Validate playbook path ### [`v2.18.19`](https://github.com/semaphoreui/semaphore/releases/tag/v2.18.19) [Compare Source](https://github.com/semaphoreui/semaphore/compare/v2.18.18...v2.18.19) #### v2.18.19 Release Summary This patch release includes several important security and validation fixes. ##### Security fixes - Added validation for Git repository URLs to prevent Git option injection. - Added `--end-of-options` to Git commands to make repository URL and branch handling safer. - Fixed branch override handling: task-level Git branch override is now applied only when the template explicitly allows it. - Prevented custom roles from shadowing built-in role slugs such as owner or manager. - Fixed permission resolution so built-in roles always use their built-in permissions instead of database-defined custom roles. - Added validation to prevent access keys from being updated with a different ID or moved to another project. ##### Reliability and tests - Added tests for Git URL validation and Git command injection protection. - Added tests for access key update validation. - Added tests for custom role validation and reserved role slugs. - Refactored Git branch resolution into a dedicated helper to make task behavior more consistent. ### [`v2.18.18`](https://github.com/semaphoreui/semaphore/compare/v2.18.17...v2.18.18) [Compare Source](https://github.com/semaphoreui/semaphore/compare/v2.18.17...v2.18.18) ### [`v2.18.17`](https://github.com/semaphoreui/semaphore/compare/v2.18.16...v2.18.17) [Compare Source](https://github.com/semaphoreui/semaphore/compare/v2.18.16...v2.18.17) ### [`v2.18.16`](https://github.com/semaphoreui/semaphore/releases/tag/v2.18.16) [Compare Source](https://github.com/semaphoreui/semaphore/compare/v2.18.15...v2.18.16) #### Bugfixes - Fix variable groups sync functionality ### [`v2.18.15`](https://github.com/semaphoreui/semaphore/compare/v2.18.14...v2.18.15) [Compare Source](https://github.com/semaphoreui/semaphore/compare/v2.18.14...v2.18.15) ### [`v2.18.14`](https://github.com/semaphoreui/semaphore/compare/v2.18.12...v2.18.14) [Compare Source](https://github.com/semaphoreui/semaphore/compare/v2.18.12...v2.18.14) ### [`v2.18.12`](https://github.com/semaphoreui/semaphore/releases/tag/v2.18.12) [Compare Source](https://github.com/semaphoreui/semaphore/compare/v2.18.10...v2.18.12) #### Features - Checkbox Skip Galaxy install ### [`v2.18.10`](https://github.com/semaphoreui/semaphore/compare/v2.18.9...v2.18.10) [Compare Source](https://github.com/semaphoreui/semaphore/compare/v2.18.9...v2.18.10) ### [`v2.18.9`](https://github.com/semaphoreui/semaphore/releases/tag/v2.18.9) [Compare Source](https://github.com/semaphoreui/semaphore/compare/v2.18.8...v2.18.9) #### Changelog - [`0a37ea2`](https://github.com/semaphoreui/semaphore/commit/0a37ea29f286c68b60bc80639363fa687eeac620) feat(cli): allow create token ### [`v2.18.8`](https://github.com/semaphoreui/semaphore/releases/tag/v2.18.8) [Compare Source](https://github.com/semaphoreui/semaphore/compare/v2.18.5...v2.18.8) #### Changelog - [`459ccee`](https://github.com/semaphoreui/semaphore/commit/459ccee8ee67b779fd87ba4309698f5296356703) ci: fix branch ### [`v2.18.5`](https://github.com/semaphoreui/semaphore/compare/v2.18.4...v2.18.5) [Compare Source](https://github.com/semaphoreui/semaphore/compare/v2.18.4...v2.18.5) ### [`v2.18.4`](https://github.com/semaphoreui/semaphore/releases/tag/v2.18.4) [Compare Source](https://github.com/semaphoreui/semaphore/compare/v2.18.3...v2.18.4) #### Changelog - [`7ca373d`](https://github.com/semaphoreui/semaphore/commit/7ca373de70acb3845b4b286e99b2214464848f8e) fix(docker): check reg token file #### What's Changed - truncate commit message by runes, not bytes by [@&#8203;4n70w4](https://github.com/4n70w4) in [#&#8203;3836](https://github.com/semaphoreui/semaphore/pull/3836) - fix(db): honor legacy environment\_id when saving templates by [@&#8203;cursor](https://github.com/cursor)\[bot] in [#&#8203;3841](https://github.com/semaphoreui/semaphore/pull/3841) - api-docs: align spec with actual REST API behavior by [@&#8203;Omicron7](https://github.com/Omicron7) in [#&#8203;3852](https://github.com/semaphoreui/semaphore/pull/3852) #### New Contributors - [@&#8203;4n70w4](https://github.com/4n70w4) made their first contribution in [#&#8203;3836](https://github.com/semaphoreui/semaphore/pull/3836) **Full Changelog**: <https://github.com/semaphoreui/semaphore/compare/v2.18.2...v2.18.4> ### [`v2.18.3`](https://github.com/semaphoreui/semaphore/compare/v2.18.2...v2.18.3) [Compare Source](https://github.com/semaphoreui/semaphore/compare/v2.18.2...v2.18.3) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNzAuOSIsInVwZGF0ZWRJblZlciI6IjQzLjI3MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
renovate-bot changed title from Update semaphoreui/semaphore Docker tag to v2.18.3 to Update semaphoreui/semaphore Docker tag to v2.18.4 2026-05-18 21:48:24 +02:00
renovate-bot force-pushed renovate/semaphoreui-semaphore-2.x from 3e6a7c894b to 5db64a7230 2026-05-18 21:48:26 +02:00 Compare
renovate-bot changed title from Update semaphoreui/semaphore Docker tag to v2.18.4 to Update semaphoreui/semaphore Docker tag to v2.18.5 2026-05-23 18:46:36 +02:00
renovate-bot force-pushed renovate/semaphoreui-semaphore-2.x from 5db64a7230 to d105c585cd 2026-05-23 18:46:37 +02:00 Compare
renovate-bot changed title from Update semaphoreui/semaphore Docker tag to v2.18.5 to Update semaphoreui/semaphore Docker tag to v2.18.8 2026-06-02 19:48:45 +02:00
renovate-bot force-pushed renovate/semaphoreui-semaphore-2.x from d105c585cd to d408617740 2026-06-02 19:48:46 +02:00 Compare
renovate-bot changed title from Update semaphoreui/semaphore Docker tag to v2.18.8 to Update semaphoreui/semaphore Docker tag to v2.18.9 2026-06-03 14:03:58 +02:00
renovate-bot force-pushed renovate/semaphoreui-semaphore-2.x from d408617740 to 6dffa6f58d 2026-06-03 14:03:59 +02:00 Compare
renovate-bot changed title from Update semaphoreui/semaphore Docker tag to v2.18.9 to Update semaphoreui/semaphore Docker tag to v2.18.10 2026-06-03 23:46:21 +02:00
renovate-bot force-pushed renovate/semaphoreui-semaphore-2.x from 6dffa6f58d to cc68e25fd3 2026-06-03 23:46:22 +02:00 Compare
renovate-bot changed title from Update semaphoreui/semaphore Docker tag to v2.18.10 to Update semaphoreui/semaphore Docker tag to v2.18.12 2026-06-08 20:28:10 +02:00
renovate-bot force-pushed renovate/semaphoreui-semaphore-2.x from cc68e25fd3 to 7c11291e89 2026-06-08 20:28:11 +02:00 Compare
renovate-bot force-pushed renovate/semaphoreui-semaphore-2.x from 7c11291e89 to b064b76cd0 2026-06-14 18:09:44 +02:00 Compare
renovate-bot force-pushed renovate/semaphoreui-semaphore-2.x from b064b76cd0 to 7c74c8e544 2026-06-16 23:39:17 +02:00 Compare
renovate-bot changed title from Update semaphoreui/semaphore Docker tag to v2.18.12 to Update semaphoreui/semaphore Docker tag to v2.18.14 2026-07-01 18:14:31 +02:00
renovate-bot force-pushed renovate/semaphoreui-semaphore-2.x from 7c74c8e544 to c65e4913c5 2026-07-01 18:14:33 +02:00 Compare
renovate-bot changed title from Update semaphoreui/semaphore Docker tag to v2.18.14 to Update semaphoreui/semaphore Docker tag to v2.18.16 2026-07-04 18:21:38 +02:00
renovate-bot force-pushed renovate/semaphoreui-semaphore-2.x from c65e4913c5 to 43f2e4adce 2026-07-04 18:21:39 +02:00 Compare
renovate-bot changed title from Update semaphoreui/semaphore Docker tag to v2.18.16 to Update semaphoreui/semaphore Docker tag to v2.18.17 2026-07-05 13:51:34 +02:00
renovate-bot force-pushed renovate/semaphoreui-semaphore-2.x from 43f2e4adce to d514263ade 2026-07-05 13:51:36 +02:00 Compare
renovate-bot changed title from Update semaphoreui/semaphore Docker tag to v2.18.17 to Update semaphoreui/semaphore Docker tag to v2.18.18 2026-07-05 14:55:15 +02:00
renovate-bot force-pushed renovate/semaphoreui-semaphore-2.x from d514263ade to cd9e035bd6 2026-07-05 14:55:16 +02:00 Compare
renovate-bot changed title from Update semaphoreui/semaphore Docker tag to v2.18.18 to Update semaphoreui/semaphore Docker tag to v2.18.19 2026-07-05 20:44:08 +02:00
renovate-bot force-pushed renovate/semaphoreui-semaphore-2.x from cd9e035bd6 to 90e07ea8a7 2026-07-05 20:44:10 +02:00 Compare
renovate-bot changed title from Update semaphoreui/semaphore Docker tag to v2.18.19 to Update semaphoreui/semaphore Docker tag to v2.18.20 2026-07-05 21:45:34 +02:00
renovate-bot force-pushed renovate/semaphoreui-semaphore-2.x from 90e07ea8a7 to 502f18ebc2 2026-07-05 21:45:34 +02:00 Compare
renovate-bot changed title from Update semaphoreui/semaphore Docker tag to v2.18.20 to Update semaphoreui/semaphore Docker tag to v2.18.21 2026-07-07 22:04:26 +02:00
renovate-bot force-pushed renovate/semaphoreui-semaphore-2.x from 502f18ebc2 to 53a7478d2d 2026-07-07 22:04:26 +02:00 Compare
renovate-bot changed title from Update semaphoreui/semaphore Docker tag to v2.18.21 to Update semaphoreui/semaphore Docker tag to v2.18.22 2026-07-08 18:19:22 +02:00
renovate-bot force-pushed renovate/semaphoreui-semaphore-2.x from 53a7478d2d to 960f12c729 2026-07-08 18:19:22 +02:00 Compare
renovate-bot changed title from Update semaphoreui/semaphore Docker tag to v2.18.22 to Update semaphoreui/semaphore Docker tag to v2.18.23 2026-07-08 23:01:22 +02:00
renovate-bot force-pushed renovate/semaphoreui-semaphore-2.x from 960f12c729 to 591e04c466 2026-07-08 23:01:23 +02:00 Compare
renovate-bot changed title from Update semaphoreui/semaphore Docker tag to v2.18.23 to Update semaphoreui/semaphore Docker tag to v2.18.24 2026-07-09 12:37:15 +02:00
renovate-bot force-pushed renovate/semaphoreui-semaphore-2.x from 591e04c466 to 6abae30f36 2026-07-09 12:37:17 +02:00 Compare
renovate-bot changed title from Update semaphoreui/semaphore Docker tag to v2.18.24 to Update semaphoreui/semaphore Docker tag to v2.18.25 2026-07-09 17:20:29 +02:00
renovate-bot force-pushed renovate/semaphoreui-semaphore-2.x from 6abae30f36 to db6e279363 2026-07-09 17:20:29 +02:00 Compare
renovate-bot changed title from Update semaphoreui/semaphore Docker tag to v2.18.25 to Update semaphoreui/semaphore Docker tag to v2.18.26 2026-07-12 14:15:04 +02:00
renovate-bot force-pushed renovate/semaphoreui-semaphore-2.x from db6e279363 to 1c01e0bdb6 2026-07-12 14:15:04 +02:00 Compare
renovate-bot changed title from Update semaphoreui/semaphore Docker tag to v2.18.26 to Update semaphoreui/semaphore Docker tag to v2.18.27 2026-07-13 09:05:45 +02:00
renovate-bot force-pushed renovate/semaphoreui-semaphore-2.x from 1c01e0bdb6 to e33cc17f47 2026-07-13 09:05:47 +02:00 Compare
renovate-bot changed title from Update semaphoreui/semaphore Docker tag to v2.18.27 to Update semaphoreui/semaphore Docker tag to v2.18.28 2026-07-22 14:59:55 +02:00
renovate-bot force-pushed renovate/semaphoreui-semaphore-2.x from e33cc17f47 to 64cd0bf5a6 2026-07-22 14:59:55 +02:00 Compare
renovate-bot force-pushed renovate/semaphoreui-semaphore-2.x from 64cd0bf5a6 to ddf74464d1 2026-07-28 09:25:36 +02:00 Compare
renovate-bot changed title from Update semaphoreui/semaphore Docker tag to v2.18.28 to Update semaphoreui/semaphore Docker tag to v2.18.29 2026-07-28 09:25:50 +02:00
renovate-bot force-pushed renovate/semaphoreui-semaphore-2.x from ddf74464d1 to f39edd306b 2026-08-05 09:36:38 +02:00 Compare
renovate-bot changed title from Update semaphoreui/semaphore Docker tag to v2.18.29 to Update semaphoreui/semaphore Docker tag to v2.19.6 2026-08-05 09:36:58 +02:00
renovate-bot force-pushed renovate/semaphoreui-semaphore-2.x from f39edd306b to 5bdc307835 2026-08-05 15:35:44 +02:00 Compare
renovate-bot changed title from Update semaphoreui/semaphore Docker tag to v2.19.6 to Update semaphoreui/semaphore Docker tag to v2.19.7 2026-08-05 15:36:02 +02:00
renovate-bot force-pushed renovate/semaphoreui-semaphore-2.x from 5bdc307835 to 9eb89d1f77 2026-08-16 21:33:55 +02:00 Compare
renovate-bot changed title from Update semaphoreui/semaphore Docker tag to v2.19.7 to Update semaphoreui/semaphore Docker tag to v2.19.8 2026-08-16 21:34:10 +02:00
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin renovate/semaphoreui-semaphore-2.x:renovate/semaphoreui-semaphore-2.x
git switch renovate/semaphoreui-semaphore-2.x

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff renovate/semaphoreui-semaphore-2.x
git switch renovate/semaphoreui-semaphore-2.x
git rebase main
git switch main
git merge --ff-only renovate/semaphoreui-semaphore-2.x
git switch renovate/semaphoreui-semaphore-2.x
git rebase main
git switch main
git merge --no-ff renovate/semaphoreui-semaphore-2.x
git switch main
git merge --squash renovate/semaphoreui-semaphore-2.x
git switch main
git merge --ff-only renovate/semaphoreui-semaphore-2.x
git switch main
git merge renovate/semaphoreui-semaphore-2.x
git push origin main
Sign in to join this conversation.
No reviewers
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
enpls/docker-services!279
No description provided.