v4.7.0

Important security update

Upgrade to v4.7.0 promptly. This release addresses compromised eMudhra certificate chains (CVE-2026-111943) by building the agent with Go 1.26.10, which rejects the affected chains, including alternate cross-signed paths.

Installing the updated agent is required to receive this protection. It doesn't update OS, container or custom trust stores, or protect external tools run by jobs; remediate those separately.

What's Changed

🔒 Security

• Reject compromised eMudhra certificate chains (CVE-2026-111943) by building with Go 1.26.10 by @duckalini in #4550
• Prevent artifact downloads escaping their destination through directory symlinks by @isaacsu in #4541
• Add opt-in --git-commit-verification=fail-closed to reject checkouts when commit verification can't succeed by @dahtey-bk in #4530
• Protect GIT_ALLOW_PROTOCOL when --protect-dangerous-git-environment-variables is enabled and list the protected variables in help by @moskyb in #4527

🐛 Fixed

• Redact secrets containing apostrophes in buildkite-agent secret get --format env output in build logs by @isaacsu in #4531
• Honour the agent's BUILDKITE_CAPTURE_AGENT_ERRORS setting when it's protected from job overrides by @123sarahj123 in #4524

🔧 Changed

• Show the cache command in buildkite-agent --help by @ss1909 in #4482

🏠 Internal

• Replace deprecated HTTP/2 transport configuration by @isaacsu in #4542
• Add a pipeline to close stale issues and PRs by @moskyb in #4544
• Run stale issue and PR cleanup on elastic runners by @moskyb in #4546
• Dependency updates by @dependabot[bot] in #4536, #4535, #4419, #4537, #4447, #4545, #4504, #4505, #4540 and #4416

New Contributors

• @dahtey-bk made their first contribution in #4530

Full Changelog: v4.6.0...v4.7.0