v6.69.0

v6.69.0 (2026-07-20)

Full Changelog

Added

• CIS hardened build #1836 (@omehegan)

• Add oldstable as a BuildkiteAgentRelease option #1837 (@DrJosh9000)

Changed

• Update buildkite-agent to v3.133.0 #1838 (@renovate[bot])
• Update buildkite-agent to v3.132.0 #1831 (@renovate[bot])

Fixed

• Fix CIS umask compatibility: chown cfn-env and env files #1832 (@omehegan)

Internal

• Add changelog entry for v6.68.1 #1829 (@scadu)

Agent Changelog (v3.133.0)

What's Changed

🔒 Security

• [A-1469] Re-exec agent start to hide the registration token from proc inspection by @moskyb in buildkite/agent#4046
• Redact Go-escaped needles by @DrJosh9000 in buildkite/agent#4091

✨ Added

• Set Partial Clone flags on sparse-checkout by @lizrabuya in buildkite/agent#4044

🐛 Fixed

• [A-1515] Improve job log URL and deduplicate url computation by @isaacsu in buildkite/agent#4083

🏠 Internal

• fix: check for --ensure_minimum when refreshExpiry by @ss1909 in buildkite/agent#4085
• fix: remove archiveInfo.ArchivePath after upload by @ss1909 in buildkite/agent#4086
• fix: Map expired artifact to ErrBlobNotFound by @ss1909 in buildkite/agent#4087
• Suggestions for #4044 by @isaacsu in buildkite/agent#4067
• Bump gh cli in release script to 2.96.0 by @DrJosh9000 in buildkite/agent#4077
• Improve log URL to point to specific job by @mitchhentgesspotify in buildkite/agent#4076
• build(deps): dependency bumps by @dependabot[bot] in #4078, #4079, #4080, #4081, #4082
• Constant-time token comparison by @DrJosh9000 in buildkite/agent#4084
• Add TestSecretsIntegration_ConfigVarSecretNotLoggedByEnvChange by @DrJosh9000 in buildkite/agent#4092
• Reduce Windows flakes in TestSetMetaDataBatch? by @DrJosh9000 in buildkite/agent#4093

New Contributors

• @mitchhentgesspotify made their first contribution in buildkite/agent#4076

Full Changelog: buildkite/agent@v3.132.0...v3.133.0

Agent Changelog (v3.132.0)

What's Changed

✨ Added

• Add BUILDKITE_GCS_PATH_SUFFIX to append a suffix to GCS artifact URLs by @tomowatt in buildkite/agent#4039

🏠 Internal

• A-1474: Remove --organization, --pipeline, --branch flags from cache subcommand by @zhming0 in buildkite/agent#4051
• build(deps): bump the cloud-providers group across 1 directory with 11 updates by @dependabot[bot] in buildkite/agent#4059
• build(deps): bump the container-images group across 1 directory with 2 updates by @dependabot[bot] in buildkite/agent#4058
• build(deps): bump the container-images group across 4 directories with 1 update by @dependabot[bot] in buildkite/agent#4057
• build(deps): bump github.com/lestrrat-go/jwx/v2 from 2.1.6 to 2.1.7 by @dependabot[bot] in buildkite/agent#4055
• build(deps): bump github.com/go-chi/chi/v5 from 5.3.0 to 5.3.1 by @dependabot[bot] in buildkite/agent#4054
• build(deps): bump github.com/klauspost/compress from 1.18.6 to 1.19.0 by @dependabot[bot] in buildkite/agent#4053
• build(deps): bump the container-images group across 3 directories with 1 update by @dependabot[bot] in buildkite/agent#4062
• build(deps): bump github.com/DataDog/datadog-go/v5 from 5.8.3 to 5.9.0 by @dependabot[bot] in buildkite/agent#4033
• build(deps): bump the container-images group across 4 directories with 1 update by @dependabot[bot] in buildkite/agent#4063
• A-1437: TTL refresh on hosted cache object by @zhming0 in buildkite/agent#4073
• feat: implement cache busting mechanism (part 2/2) by @ss1909 in buildkite/agent#4061

Full Changelog: buildkite/agent@v3.131.0...v3.132.0

Upgrading

Perform a CloudFormation stack update with the following URL:
https://s3.amazonaws.com/buildkite-aws-stack/v6.69.0/aws-stack.yml

If you want to launch a new stack, you can use this link (make sure not to use your production AWS account, create a new one for CI):