v1.11.2

What's Changed

• chore(backport release-1.11): fix(sso): redirect to previously expected page instead of home page by @akuitybot in #6817
• chore(backport release-1.11): fix(github): Fixes regression where bypass rules are respected for GitHub by @akuitybot in #6822
• chore(backport release-1.11): fix(ui): add missing promotion steps to wizard registry by @akuitybot in #6825
• chore(backport release-1.11): fix: dropped origins when aborting queued promotions by @akuitybot in #6827
• chore(backport release-1.11): fix(health): Fixes pointless status write for argocd health by @thomastaylor312 in #6832

Full Changelog: v1.11.1...v1.11.2

v1.10.10

What's Changed

• chore(backport release-1.10): fix(controller): validate new GitHub App tokens before first use by @akuitybot in #6635
• chore: lock 1.10 docs into 1.10.9 charts, latest 1.10.x scripts, etc. by @krancour in #6704
• chore(backport release-1.10): fix(health): Fixes pointless status write for argocd health by @thomastaylor312 in #6833

Full Changelog: v1.10.9...v1.10.10

v1.11.1

What's Changed

• chore(backport release-1.11): fix(ui): open ArgoCD links in a new tab natively by @akuitybot in #6701
• chore: manual backport of fix: reconcile UI auto-promotion hold state with the reconciler (#6694) by @krancour in #6712
• chore(backport release-1.11): fix: prevent response body leak and propagate context to HTTP requests by @akuitybot in #6717
• chore(backport release-1.11): fix: exhaustive rename detection was skipped due to too many files by @akuitybot in #6721
• chore(backport release-1.11): fix(ui): allow typing spaces in YAML editors over the pipeline graph by @akuitybot in #6745
• chore(backport release-1.11): fix(controller): keep dead network connections from hanging artifact discovery indefinitely by @akuitybot in #6748
• chore(backport release-1.11): fix(server): correct REST API error handling by @akuitybot in #6761
• chore(backport release-1.11): fix(ui): unblock the token renewal page's own requests by @akuitybot in #6775
• chore(backport release-1.11): fix(ui): undefined chart (without name) when cloning freight by @akuitybot in #6786

Full Changelog: v1.11.0...v1.11.1

v1.11.0

🚀 Kargo v1.11.0 has arrived! This release teaches auto-promotion to respect your intention to pin a Stage on older Freight, makes promotions dramatically more responsive, lightens the load on your Git servers, and continues our steady stream of general improvements.

🚨 Breaking Changes

• Auto-Promotion May Move Pinned Stages on Upgrade (#6334): Before v1.11.0, a Stage with auto-promotion enabled that had been manually pointed at older Freight stayed put only by an incidental behavior: auto-promotion declined to re-promote any Freight for which a Promotion already existed. Auto-promotion holds (see below) replace that incidental protection with an explicit, durable one — but holds are recorded only for Promotions created from v1.11.0 onward, so pre-existing, incidental pins are not protected. On the first reconciliation after upgrade, any Stage previously pinned this way will be auto-promoted to its origin's current auto-promotion candidate. To avoid this, disable auto-promotion for affected Stages before upgrading. To restore a pin after upgrading, simply promote the older Freight again — this time, a hold will be recorded.

• allowTags / ignoreTags Enforcement (#6487): As announced in the v1.9.0 release notes, artifact discovery now fails with an error for any Warehouse subscription still using the deprecated allowTags or ignoreTags fields. Migrate to allowTagsRegexes and ignoreTagsRegexes before upgrading. The deprecated fields will be removed entirely in v1.13.0.

• Corrected OpenAPI Spec and New Generated Go Client (#6647): This one PR fixed two independent problems. First, the REST API's OpenAPI spec (swagger.json) previously mistyped several Kubernetes types. Quantity and MicroTime fields are now plain strings — matching their actual JSON wire format — and IntOrString fields are now untyped. If you've generated a client of your own from the spec, regenerate it from the corrected version. Second, and independent of the spec, the go-swagger-generated Go client (pkg/client/generated) has been removed outright and replaced by an OpenAPI Generator-generated client at pkg/x/client/generated: the old generator emitted "phantom" empty objects for optional fields, visible as junk in kargo get ... -o yaml output and hazardous to anything round-tripping that output, and the new generator does not. As with everything under pkg/x/, Go programs importing the new package should expect no stability guarantees. We recommend upgrading the CLI to v1.11.0 alongside your server. The CLI uses a generated client, and older versions predate both fixes — and, having used the old generator, can emit the phantom-object junk. A v1.10.x CLI remains mostly compatible, but upgrading is the safer choice.

• Removed Chart Values (#6318): The rbac.useDefaultServiceAccount and rbac.disableAutomountServiceAccountToken Helm chart values introduced in v1.10.0 have been removed. These existed to support internal plans that have since changed and are unlikely to have been used by anyone else. If you had set either, remove them from your values before upgrading.

🗑️ Deprecations

• Legacy gRPC (ConnectRPC) API — Removal in v1.12.0: This is not a new deprecation, but a reminder of an existing and important one. The Connect-based gRPC API was deprecated back in v1.9.0 in favor of the REST API. With the UI now fully transitioned to the REST API (see UI Improvements below), the legacy API no longer has any first-party consumers and will be removed entirely in v1.12.0. If you maintain integrations built against it, migrate them to the REST API before upgrading to v1.12.0.

⏸️ Auto-Promotion Holds

Ever promoted an older piece of Freight to a Stage — only to watch auto-promotion immediately "correct" your correction? Not anymore. When a Promotion you initiate manually succeeds for Freight other than the current auto-promotion candidate, Kargo now records a hold that pauses auto-promotion of other Freight from that Freight's origin to that Stage, thereby keeping the Stage in the state you deliberately restored it to. Holds are scoped to a single origin, so Freight from other origins matching a Stage's other Freight requests continues to auto-promote as usual.

When you're ready to move forward again, just promote the origin's current auto-promotion candidate and auto-promotion resumes. Depending on auto-promotion policy, that's either the newest available Freight or the Freight in use immediately upstream of the Stage.

The UI makes this effortless: Stages with paused auto-promotion display an alert with a Resume button, and a resume action is also available from the Stage's action menu. Either opens a drawer that identifies the held origin and its current auto-promotion candidate, resuming with a single click. (#6628, #6670)

With the CLI, the current auto-promotion candidate can be resolved automatically by just specifying a Warehouse instead of specific Freight:

kargo promote --project=my-project --warehouse=my-warehouse --stage=test

⚡ Performance & Responsiveness

This release takes a big bite out of the two most common sources of waiting in Kargo: artifact discovery and polling for external conditions.

• Cheaper Git Discovery: At steady state, most Warehouse reconciliations discover nothing new — yet previously still performed a full clone and history walk per Git subscription. A single git ls-remote round-trip now detects when remote ref state is unchanged and skips the clone entirely, a huge win for large monorepos subscribed to by many Warehouses. (#6369)

• Blobless Clones Are Back: Blobless clones (--filter=blob:none) were disabled in a previous release because some Git servers don't support partial clones. They've been restored with a graceful fallback: if a server rejects the filter, Kargo automatically retries without it. (#6014)

• Instant Wake-Up for PR Merges: When a GitHub pull_request webhook reports a PR has closed, Kargo now immediately re-reconciles any running Promotion whose git-wait-for-pr step is waiting on that PR — reducing detection latency from minutes to near-instant, with polling retained as a fallback. (docs, #5852)

• Event-Driven Wake-Up for Selector-Based Argo CD Steps: argocd-update and argocd-wait steps that target Applications by label selector (rather than by name) previously progressed only on the periodic reconciliation interval. Application state changes now wake these Promotions through the same event-driven path as name-based steps. (#6401)

• Configurable (and Faster) Polling: The three steps that poll external conditions — http, git-wait-for-pr, and git-merge-pr — now accept an optional pollInterval in their configurations, and ship with much snappier defaults (30s, 30s, and 10s respectively) than the previous five-minute requeue interval. (#6493)

➡️ Promotion Improvements

• New file-write Step: Renders evaluated content directly into a file — useful for templating arbitrary content without a dedicated step for the format at hand. New YAML and pretty-JSON expression helpers round out the picture. (docs, #6293)

• http Step: A new errorExpression option extracts a meaningful error message from a failed response and surfaces it in the step result, and a new proxy option specifies an HTTP proxy for the request, overriding https_proxy and related environment variables. (docs, #6414, #6264)

• git-tag Step: A new force option permits an existing tag to be moved to the current HEAD — supporting workflows where a well-known tag tracks the commit from which a GitOps agent syncs. (docs, #6457)

• git-merge-pr Step: The mergeMethod option introduced in v1.10.0 is now supported for Bitbucket Cloud, and the step's GitHub provider is now resilient to races with concurrent merges to the same base branch, retrying rather than failing the Promotion. (docs, #6315, #6490)

• git-open-pr Step: The labels option is now supported for Gitea. (#6262)

• delete Step: The path option now accepts glob patterns, so a long series of delete steps that cluttered the promotion view can collapse into a single step. (docs, #6533)

• Freight Alias in Expressions: The human-friendly alias of the Freight being promoted is now accessible as ctx.targetFreight.alias...

v1.11.0-rc.6

v1.11.0-rc.6

v1.11.0-rc.5

What's Changed

• chore(backport release-1.11): fix(tar_extractor): log closeErr instead of io.CopyN error in file close handler by @akuitybot in #6640
• chore(backport release-1.11): docs: fix typo in untar promotion step docs (overriden -> overridden) by @akuitybot in #6641
• chore(backport release-1.11): fix(ui): prevent promotion drawer crash when promotion fails to load by @akuitybot in #6645
• chore(backport release-1.11): chore(deps): bump the go-patch group with 4 updates by @akuitybot in #6650
• chore(backport release-1.11): chore(deps): bump github.com/oapi-codegen/oapi-codegen/v2 from 2.6.0 to 2.7.1 by @akuitybot in #6652
• chore(backport release-1.11): fix(kubeclient): move defer after error check to prevent nil pointer panic by @akuitybot in #6639
• chore(backport release-1.11): fix: invalid httpsGet handler by @akuitybot in #6663
• chore(backport release-1.11): fix: Bump wait time for argocd discovery by @akuitybot in #6665
• chore(backport release-1.11): fix(ui): Remove committed debug code by @akuitybot in #6669
• chore(backport release-1.11): fix(argocd): Tune up the steps as well by @akuitybot in #6673
• chore(backport release-1.11): feat(ui): add resume button to auto-promotion paused alert by @akuitybot in #6672
• chore!: manual cherry-pick of #6647 (replace go-swagger client gen w/open api client gen) by @krancour in #6676
• chore: manual backport of fix: Dockerfile.dev (#6677) by @krancour in #6678
• chore(backport release-1.11): feat(events): annotate promotion events with rollback status by @akuitybot in #6680

Full Changelog: v1.11.0-rc.4...v1.11.0-rc.5

v1.11.0-rc.4

v1.11.0-rc.4

v1.11.0-rc.3

v1.11.0-rc.3

v1.10.9

What's Changed

Addresses GHSA-f72x-6fm6-94rq and GHSA-xx8h-gw9m-m95p

Plus:

• chore(backport release-1.10): fix: indentation in examples for git-open-pr.md by @akuitybot in #6283

Full Changelog: v1.10.8...v1.10.9

v1.9.10

What's Changed

Addresses GHSA-f72x-6fm6-94rq and GHSA-xx8h-gw9m-m95p

Full Changelog: v1.9.9...v1.9.10