v2.18.0-beta13 #3810
fiftin
announced in
Announcements
v2.18.0-beta13
#3810
Replies: 1 comment
-
|
What's the current status of 2.18.x? I see 2.18.0 beta and rc releases. But then yesterday there's a 2.18.1 that has a similar changelog to this post, saying that it's beta and latest tag on Docker Hub points to it already. |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
-
Semaphore UI v2.18.0-beta13 — Release Summary
This is a substantial beta release that pushes Semaphore meaningfully further into enterprise-grade secrets management, hardens the API token lifecycle, expands the runner scheduling model, and absorbs a flurry of security and dependency fixes — many of them caught and triaged by automated review bots (Cursor, ChatGPT Codex) before merge. It also bumps the bundled Ansible runtime by two major versions.
Below is a qualitative, themed walkthrough rather than a flat PR list.
🔐 Secret storage: two new external backends + a hard look at ownership
The headline feature of this release is first-class support for two more enterprise secret backends, joining the existing Devolutions Server (DVLS) integration:
azcore,azidentity,azsecrets). Auth follows the same DB / env-var / file pattern as AWS SM and DVLS, and the backend was refactored to consolidateSyncSecretsacross all storage types into a single function.Alongside the new backends, an unusually large cluster of secret-related security fixes landed — almost all of them automatically flagged by
cursor[bot]during review:ErrReadOnlyStoragesentinel + a silent delete error on environment secrets (the operation appeared to succeed while failing).unsetenvfor sensitive config fields after they're consumed, so they don't linger in process memory available to child processes.returnstatements after error responses in auth/env handlers (classic continue-after-error logic bug).The pattern here is notable: the new backends were merged together with a methodical sweep of the existing secret-handling code, suggesting the secrets subsystem received a deliberate audit pass.
🪪 API tokens grow up
Two complementary PRs turn API tokens from disposable opaque strings into something closer to a managed credential:
expires_at. Creation rejects non-future values; bearer-token authentication checks expiry on every request via a newIsExpiredAtmethod, so revocation-by-time is enforced before the request handler even runs. This also added rollback SQL for the migration.@setswei. Tokens get anamefield, which is the small UX touch that finally makes a token list legible when you have more than two of them.Together with [#3785](#3785) (a nil pointer dereference fix in TOTP session verification), the auth surface in this release is meaningfully more robust.
🏃 Runners: tags become a first-class scheduling primitive
[#3804](#3804) is the largest single feature in the release (24 commits) and is worth understanding architecturally rather than as a list of bullets:
runner__tagjoin table replaces the previous single-stringtagcolumn, so a runner can carry multiple tags.RunnerTagFilterModeenum (CompleteMatch,HasNoTags,IsDefault,IgnoreTags,HasAnyTag) governs how tasks pick runners.The PR is also a fascinating case study in automated code review actually working:
cursor[bot]repeatedly flagged an inverted condition inservices/tasks/RemoteJob.gowheretagFilterModewas set backward (tagged jobs would have routed to untagged runners and vice versa, breaking the isolation guarantee that's the whole point of the feature). Across roughly five review cycles the maintainer (@fiftin) iterated until the logic was right. Aboltdriver caveat —db:"-"tags causing tag persistence to silently break on Bolt deployments — was raised by the Codex reviewer; worth verifying for anyone still on Bolt.A related smaller change, [#3793](#3793), refactored the
syncflag handling, which was prerequisite plumbing.🛡️ Admin observability
[#3782](#3782) adds a System Information dialog for admins — a new admin-only
GET /admin/infoendpoint backing a UI dialog that surfaces:tmp_path,home_dir_modeThis is genuinely useful for support triage — the kind of "what version of everything is this server running?" question that previously required SSH access. The endpoint is correctly gated by
adminMiddlewareserver-side, with the UI also guarding render withv-if="user && user.admin". Notably, several of these values were already exposed to all authenticated users via/api/info; the new endpoint is more restrictive than what existed before.🧱 Ansible jumps two major versions
[#3736](#3736) (first contribution from
@sevencastles) bumps the bundled Ansible from 11.1.0 → 13.5.0 (ansible-core 2.20.4). This is a non-trivial jump for anyone running Ansible workloads against the Semaphore image — playbooks that relied on collections or behavior from Ansible 11 should be re-tested. There are no notes about pinned-version overrides, so the upgrade is mandatory for users on the official image.🧭 Terraform: stop logic finally works
[#3694](#3694) — a long-standing bug from
@JulianKap: stopping a Terraform task while it sat inwaiting_confirmation(the human-approval gate between plan and apply) didn't actually stop it. Now it does. For anyone using Terraform integration, this closes one of the more annoying state machine quirks.🔧 Quality-of-life and infrastructure
A few smaller items worth flagging:
@lawrence3699) — CLI command strings are no longer translated. Translatingansible-playbookinto other languages was, predictably, breaking command execution.chownis now scoped to directories the process actually has access to, instead of attempting it everywhere and erroring noisily.@gaetan-steininger) — updated to recommend SQLite over Bolt, which is now deprecated. Worth noting alongside the Bolt-driver concern raised on feat/tagged global runner #3804: Bolt's days are numbered, and new features may not get the same testing coverage on it.📦 Dependency churn
This release pulled in a high volume of dependency bumps. The notable security-relevant ones:
go-git/go-git/v5→ v5.17.2 ([#3732](fix(deps): update module github.com/go-git/go-git/v5 to v5.17.1 [security] #3732), [#3751](fix(deps): update module github.com/go-git/go-git/v5 to v5.17.2 #3751)) — security advisory fix.go-jose/go-jose/v4→ v4.1.4 ([#3745](chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 #3745)) — patches CVE-2026-34986 (DoS via JWE decryption panic), which is in Semaphore's path because it's transitively used by the OIDC login flow.axios→ v1.15.0/v1.15.2 ([#3756](chore(deps): update dependency axios to v1.15.0 [security] #3756), [#3800](chore(deps): update dependency axios to v1.15.2 #3800)) — security advisory.node-forge→ 1.4.0 ([#3728](chore(deps-dev): bump node-forge from 1.3.3 to 1.4.0 in /web #3728))go-ldap/ldap/v3→ v3.4.13 ([#3767](fix(deps): update module github.com/go-ldap/ldap/v3 to v3.4.13 #3767))Azure/go-ntlmssp→ v0.1.1 ([#3794](chore(deps): bump github.com/Azure/go-ntlmssp from 0.0.0-20221128193559-754e69321358 to 0.1.1 #3794)) — also feeds into the Azure work.Plus routine bumps of
lodash,picomatch,flatted,follow-redirects,prettier,core-js,dotenv,openai, andactions/checkout.A small style/config cleanup (
[588b369d](https://github.com/semaphoreui/semaphore/commit/588b369d)) removes some extra config validation.👋 New contributors
Four first-time contributors landed code this release:
@gaetan-steininger,@lawrence3699,@sevencastles, and@setswei. The community continues to broaden.🎯 Headline takeaways for upgraders
expires_atandnamefields; they're optional but the inflection point to start using them is now.This is a beta — the
0-beta13suffix and the volume of late-breaking review-bot fixes both signal that. But the architectural direction (external secrets, scoped tokens, tagged runners, admin observability) is coherent and points clearly toward enterprise-readiness.Full Changelog: v2.17.38...v2.18.0-beta13
Changelog
What's Changed
New Contributors
Full Changelog: v2.17.38...v2.18.0-beta13
This discussion was created from the release v2.18.0-beta13.
Beta Was this translation helpful? Give feedback.
All reactions