Skip to content

v0.52.0

Choose a tag to compare

View all tags
@buildkite-systems buildkite-systems released this 21 Oct 01:24
· 20 commits to main since this release
v0.52.0
This tag was signed with the committer’s verified signature.
blaknite Grant Colegate
SSH Key Fingerprint: dfNtLUyXtJKRPqCLP82sF6cDEcshsBSVVioUo4pk76U
Verified
Learn about vigilant mode.
632f627
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v0.52.0 (2026-10-21)

Full Changelog

Security

  • Update the default Buildkite agent from v4.0.3 to v4.7.0, and build the controller and release binaries with Go 1.26.10 to reject compromised eMudhra certificate chains (CVE-2026-111943). #988 (@mcncl)

Upgrade the stack to receive the updated controller and default agent image. If you override the agent image, update that image separately. This release does not remediate OS, container, or custom trust stores, or external tools run by jobs.

Added

  • Add configuration for pipeline signing and verification using keys stored in AWS KMS or GCP KMS. #986 (@moskyb)

Internal

  • Deploy CI's selected, digest-pinned agent image instead of the floating buildkite/agent:beta image. #988 (@mcncl)

Images

Helm chart

Image: public.ecr.aws/buildkite/helm/agent-stack-k8s:0.52.0
Digest: sha256:a1993ea33710db53f3f3cec643bde1141968b467e1589139da74960aa3152f28

Image: ghcr.io/buildkite/helm/agent-stack-k8s:0.52.0
Digest: sha256:541e08437498613db8f2e07a103d3f051836f2c249c1aa31a1f64f3d132ff76d

Controller

Image: public.ecr.aws/buildkite/agent-stack-k8s/controller:0.52.0
Image: ghcr.io/buildkite/agent-stack-k8s/controller:0.52.0
Digest: sha256:e71fca0ad44eee80c3dc9eb5cbd143b0b7b89b4a12b37821102a8cc89be277c7

Agent

Image: ghcr.io/buildkite/agent:4.7.0
Digest: sha256:4b9127ae993b31e286d78864b4a8f9ad897a32fe218b5398decc7ba3b39cd219

Contributors

mcncl and moskyb
Assets 5
Loading