v8.3.3

📦 Bundled Resource Types

• bosh-io-release: v1.3.7
• bosh-io-stemcell: v1.7.2
• docker-image: v1.13.4
• git: v1.24.1
• github-release: v1.14.3
• hg: v1.5.7
• mock: v0.14.8
• pool: v1.8.4
• registry-image: v1.19.1
• s3: v2.5.7
• semver: v2.0.5
• time: v1.11.6

⚠️ Behavior Changes

• OIDC providers with RSA keys larger than 4096 bits. The fix for CVE-2026-116587 makes go-jose reject RSA keys larger than 4096 bits. Concourse reads the whole key set from your provider's jwks_uri. If any key in that set is larger than 4096 bits, every login through the OIDC connector (--oidc-* / CONCOURSE_OIDC_*) fails with oidc: failed to decode keys: ... modulus too large. Large hosted providers use 2048-bit keys. Check self-hosted providers, such as Keycloak with imported keys, before you upgrade. Concourse's own keys are not affected, including the session signing key and the ID-token signing keys.
• A negative --concurrent-request-limit now stops the web node from starting. For example, ListAllJobs:-1 now makes the web node exit at startup with panic: semaphore: size < 0. Before, a negative limit made every request to that endpoint return 503. To disable the endpoint, use 0, which returns 501. To limit it, use a positive number. This comes from golang.org/x/sync v0.24.0, which the x/net fix requires.

🛡️ Security Fixes

• concourse binary: CVE-2026-116587 (go-jose), CVE-2026-78669, CVE-2026-78661 and CVE-2026-97045 (golang.org/x/net), and CVE-2026-84445 (gRPC).
• gdn: CVE-2026-111943 (built with go1.27.3).
• Bundled resource types: CVE-2026-111497 (brotli) in every resource type except git, which already had the fix. Also CVE-2026-111943 and CVE-2026-114613 (pip) in hg, and CVE-2026-116587 (containerd) in docker-image.

🔓 Known Vulnerabilities

The bundled containerd and runc binaries are built from their latest upstream releases (containerd v2.4.2, runc v1.5.2). Those releases still carry vulnerable Go dependencies. We will pick up fixed versions in a later patch release once upstream ships them.

Binary	CVE	Dependency
containerd	CVE-2026-116587, CVE-2026-78669	go-jose/v4 v4.1.5, golang.org/x/net v0.58.0
containerd-shim-runc-v2, ctr	CVE-2026-78669	golang.org/x/net v0.58.0
runc	CVE-2026-46600, CVE-2026-78669	golang.org/x/net v0.55.0

What's Changed

🐞 Bug Fixes

• 8.3.x: Bump go-jose/v4, x/net and grpc to fix CVE-2026-116587, CVE-2026-78669, CVE-2026-84445 by @drich10 in #9779

Full Changelog: v8.3.2...v8.3.3