2.33.0

🌟 Highlights & Key Features

• Multi-Replica Executor & Resilient Dispatch: Terrakube Executor now supports horizontal scaling across multiple replicas with distributed admission control, FIFO job scheduling, and automatic stuck-job recovery.
• Live SSE & GraphQL Subscriptions: Replaced traditional HTTP log polling with Server-Sent Events (SSE) and GraphQL subscriptions, delivering real-time, low-latency run log streaming in the UI.
• Apply-Time Structured Output: Expanded structured output to include apply-time resources, module imports, real-time diff rendering, and strict sensitivity protection against credential leakage.
• Cloud Storage Binary Caching: Automatic cloud storage caching for Terraform and OpenTofu binary distribution to drastically accelerate workspace startup times.
• Expanded VCS & Webhooks Ecosystem: Added support for Azure DevOps v1/v2 webhooks, GitLab shared repository-level webhooks, and automatic repository discovery for workspace onboarding.
• AWS Dynamic Credentials ABAC: Implemented AWS session tag emission in OIDC JWT dynamic credentials to enable Attribute-Based Access Control (ABAC).
• Supply Chain Security: Integrated OpenSSF Scorecard security analysis, Syft SBOM generation into container builds, and digest-pinned base images.

---

What's Changed

🚀 Features

• feat: shallow git clone (--depth 1) for VCS workspace checkout by @mvanhorn in #3269
• Emit AWS session tags in the dynamic-credentials JWT for ABAC by @BaptisteCentreon in #3284
• feat: Optional AWS Session Tags FF by @BaptisteCentreon in #3289
• feat(api): add Azure DevOps webhooks v1 support by @alfespa17 in #3315
• feat(vcs): add repository auto-discovery for workspace creation by @jakegroves in #3332
• feat: improve PR/MR plan & apply comments and fix silent GitLab/Bitbucket failures by @jakegroves in #3335
• feat(ui): workspace access by @jakegroves in #3337
• feat(ui): modernize organization and workspace list views by @jakegroves in #3339
• feat: run onReject commands when an approval step is rejected by @adeeelsameer in #3341
• feat(structured-output): apply-time structured output, imports, and progress tracking by @jakegroves in #3349
• feat(executor): support running multiple executor replicas, fix VCS-status crash & plan-only completion, add Queued filter by @jakegroves in #3353
• feat(api): Add soft-delete to Jobs by @ivarmedi in #3355
• feat(ui): replace run status/log polling with SSE and GraphQL subscriptions by @jakegroves in #3357
• feat(vcs): include plan/apply summary in commit status descriptions by @jakegroves in #3358
• feat(api): add GitLab webhooks support for shared repository-level workflows by @alfespa17 in #3360
• feat: implement v2 webhook support and shared repository webhook management for Azure DevOps by @alfespa17 in #3364
• feat(api): improve LazyIssuerJwtDecoder with thread-safe AtomicReference and add tests by @alfespa17 in #3373
• feat(registry): Federated credentials support by @alfespa17 in #3374
• feat: implement stale cache fallback for terraform index retrieval when the upstream endpoint fails by @alfespa17 in #3383
• feat(executor): add persistent executor admission control, FIFO dispatch, and stuck-job recovery by @jakegroves in #3387
• feat: implement cloud storage caching for Terraform and OpenTofu binaries by @alfespa17 in #3389
• feat: add workspace folder validation and sync from Terrakube client by @alfespa17 in #3391
• feat(registry): publish canonical SemVer module versions and validate version formats by @jakegroves in #3393
• feat: add support for ephemeral storage requests and limits in ephemeral executor jobs by @alfespa17 in #3400
• feat(notification): add Slack/Teams/webhook notifications for job status changes by @jakegroves in #3401
• feat(ui): add target/replace resources to New Run's Additional planning options by @jakegroves in #3407
• feat(ui): add in-app API docs page by @jakegroves in #3411
• feat: integrate Syft SBOM generation into UI Dockerfile by @alfespa17 in #3414
• feat: add OpenSSF Scorecard security analysis workflow and documentation badge by @alfespa17 in #3415
• feat(ui): add pending status filter to workspace list by @jakegroves in #3440

🐛 Fixes

• fix(ui): render actions that use optional chaining or nullish coalescing by @vikraj01 in #3276
• fix(ui): use absolute base URL so deep-link reloads work (#3286) by @mikluko in #3287
• fix(executor): surface init failures on remote-content runs by @mikluko in #3291
• fix(ui): make header logo navigate home by @mikluko in #3293
• fix(executor): adjust environment variable paths to use workspace root directory by @alfespa17 in #3295
• fix(api): update JWT audience setting to resolve potential token parsing issues by @alfespa17 in #3300
• Fix: Ignore GitLab MR discussion resolutions to prevent spurious job execution by @ctpeter in #3306
• Fix to prevent Quartz thread exhaustion from blocking VCS module refresh by @ZoesDev in #3307
• fix: widen vcs access_token/refresh_token columns for oversized OAuth tokens by @mvanhorn in #3308
• fix(ui): serve env-config.js with Cache-Control: no-store by @yasharma28 in #3316
• Widen github_app_token.token for new GitHub installation token format by @dnl555 in #3320
• fix(ui): keep organization dropdown reachable and in sync with one org by @jakegroves in #3327
• fix: surface VCS permission errors for webhooks and PR comments by @jakegroves in #3328
• fix(ui): show save feedback and auto-refresh after CRUD actions by @jakegroves in #3331
• fix: validate GitHub App token expiry and clean up orphaned VCS refs by @jakegroves in #3336
• fix: guard WebhookResult against null event and fix installation token return type by @jakegroves in #3338
• fix(vcs): tolerate clock drift in GitHub App JWTs by @jakegroves in #3342
• fix: update ANSI escape sequence regex to correctly identify terminal color codes by @alfespa17 in #3343
• fix(webhook): serialize shared-webhook sync via a Quartz job, fix hook registration, orphan cleanup, and UI delete by @jakegroves in #3344
• fix: resolve SonarCloud blocker/high/medium/low issues on main by @jakegroves in #3351
• fix(ui): trim whitespace from key, value, and description fields when saving variables by @at0miqx in #3354
• fix(executor): ensure reliable job dispatch across multi-replica executor pools by @jakegroves in #3356
• fix: Gitlab Update visibility condition for gitlab shared webhook by @alfespa17 in #3361
• fix(streaming): stop dropping unparseable apply -json lines and SSE interruptions by @jakegroves in #3362
• fix(structured-output): correct event handling and diff rendering; harden webhooks and job execution by @jakegroves in #3370
• fix(registry): refine Git handling and improve error validations by @alfespa17 in #3371
• fix(redis): enable Jedis connection pooling by @Guflly in #3372
• fix(executor): restrict the shallow clone to the requested ref by @siler in #3375
• fix(ui): avoid double v-prefix on module/provider/workspace versions by @jakegroves in #3377
• fix(api): evaluate federated membership outside the groups loop by @jvdrag in #3379
• fix(executor): enable native S3 state locking on the generated backend by @jvdrag in #3380
• fix(fanout): request cache federated details, scope ui requests by @siler in #3381
• fix: remove sparse field filtering from registry, workspace, and job API requests by @alfespa17 in #3385
• fix(executor): pass clone folder to resolveBranchRef to consolidate temporary ssh credentials within the workspace directory by @alfespa17 in #3386
• fix(webhook): sync shared repo webhook on WebhookEvent mutations by @jakegroves in #3388
• fix: Add connect/read timeouts to the proxy RestTemplate by @bunlongheng in #3390
• fix(auth): recover from stale sessions after API/Dex restarts by @jakegroves in #3394
• fix(variable): prevent job crashes from workspace variables with no category by @jakegroves in #3398
• test: update JobDispatchOrderRepositoryIntegrationTest by @alfespa17 in #3399
• fix: re-queue last applied configuration for CLI/API workspace Run now by @KetchupBomb in #3402
• fix(api): change logic for workspace version constraint by @jakegroves in #3404
• fix(structured-output): apply/plan console and PR comment fixes by @jakegroves in #3405
• fix(structured-output): prevent sensitive attribute leakage and propagate dynamic sensitivities during state resolution by @alfespa17 in #3406
• fix(ui): open organization/workspace rows as real links for ctrl/middle/right-click by @jakegroves in #3410
• fix: correct pinned SHA for actions/upload-artifact@v4.6.1 in scorecard workflow by @alfespa17 in #3416
• fix: add top-level read-all permissions to resolve Scorecard Token-Permissions warning by @alfespa17 in #3420
• fix: pin all container image references by digest for Scorecard Pinned-Dependencies by @alfespa17 in #3421
• chore: add Docker ecosystem entries to Dependabot for automatic image digest updates by @alfespa17 in #3422
• fix: replace read-all with explicit minimum permissions (Sonar S8234) by @alfespa17 in #3424
• chore: remove alpaquita build job from pull request workflow [skip ci] by @alfespa17 in #3425
• fix: remove invalid inline comments from Dockerfiles [skip ci] by @alfespa17 in #3426
• fix(api): don't log an unconfigured webhook event as an error by @gangadhar-res in #3429
• fix(#3412): Mirrored providers with trust_signature fail due to truncation by @7487 in #3431
• fix(api): escape quotes in target and replace resource addresses by @alfespa17 in #3433
• fix(api): stop DownloadReleasesService accumulating User-Agent headers by @klinux in #3434
• fix: prevent header accumulation in WebClient instances by cloning the builder before configuration by @alfespa17 in #3435
• fix: make webhook delivery and scheduler processing scale to large shared webhooks by @jakegroves in #3439
• fix(ui): keep workspace table pagination stable during background refresh by @jakegroves in #3443
• fix(ui): unify workspace/job status badge rendering by @jakegroves in #3452
• fix(ui): don't show "no changes needed" while a plan is still running by @jakegroves in #3453
• fix: misc ui fixes by @BaptisteCentreon in #3454
• fix: persist job.overrideSource for CLI/API driven Run now jobs by @KetchupBomb in #3455
• fix(ui): preserve organization context on workspace create/import and update table unit tests by @alfespa17 in #3458
• fix: initialize notification config collections before session closes by @jakegroves in #3466
• fix(ui): import useParams in Create workspace component by @alfespa17 in #3467

📦 Dependency Updates

View Dependency Changes

• deps: bump the mvn-packages group with 3 updates by @dependabot[bot] in #3277
• deps: bump the ui-packages group across 1 directory with 12 updates by @dependabot[bot] in #3278
• deps: bump @types/node from 25.9.3 to 26.0.1 in /ui by @dependabot[bot] in #3279
• deps: bump js-yaml from 3.14.2 to 3.15.0 in /ui by @dependabot[bot] in #3281
• deps: bump the mvn-packages group with 6 updates by @dependabot[bot] in #3298
• deps: bump the ui-packages group in /ui with 6 updates by @dependabot[bot] in #3299
• deps: bump the mvn-packages group with 4 updates by @dependabot[bot] in #3309
• deps: bump the ui-packages group in /ui with 8 updates by @dependabot[bot] in #3311
• deps: bump brace-expansion from 1.1.14 to 1.1.16 in /ui by @dependabot[bot] in #3321
• deps: bump tar from 7.5.16 to 7.5.20 in /ui by @dependabot[bot] in #3322
• deps: bump the mvn-packages group with 4 updates by @dependabot[bot] in #3323
• deps: bump the ui-packages group in /ui with 6 updates by @dependabot[bot] in #3324
• deps: bump @testing-library/jest-dom from 6.9.1 to 7.0.0 in /ui by @dependabot[bot] in #3325
• deps: bump the mvn-packages group with 3 updates by @dependabot[bot] in #3345
• deps: bump the ui-packages group in /ui with 10 updates by @dependabot[bot] in #3346
• deps: bump web-vitals from 5.3.0 to 6.0.1 in /ui by @dependabot[bot] in #3347
• deps: bump tar from 7.5.20 to 7.5.22 in /ui by @dependabot[bot] in #3348
• deps: bump the mvn-packages group with 4 updates by @dependabot[bot] in #3365
• deps: bump the ui-packages group in /ui with 8 updates by @dependabot[bot] in #3366
• deps: bump brace-expansion from 1.1.16 to 1.1.18 in /ui by @dependabot[bot] in #3368
• deps: bump undici from 6.27.0 to 6.28.0 in /ui by @dependabot[bot] in #3369
• deps: bump js-yaml from 3.15.0 to 3.15.1 in /ui by @dependabot[bot] in #3384
• deps: bump the mvn-packages group with 3 updates by @dependabot[bot] in #3396
• deps: bump the ui-packages group in /ui with 12 updates by @dependabot[bot] in #3397
• deps: bump the mvn-packages group with 3 updates by @dependabot[bot] in #3417
• deps: bump redis.clients:jedis from 7.5.3 to 8.0.0 by @dependabot[bot] in #3418
• deps: bump the ui-packages group in /ui with 11 updates by @dependabot[bot] in #3419
• deps: add renovate configuration for paketo buildpacks by @alfespa17 in #3427
• deps: Update Paketo buildpacks updates by @renovate[bot] in #3428
• deps: bump the mvn-packages group with 2 updates by @dependabot[bot] in #3446
• deps: bump the ui-packages group in /ui with 8 updates by @dependabot[bot] in #3449
• deps: ignore major version updates for node in docker dependabot by @alfespa17 in #3459
• deps: bump nginxinc/nginx-unprivileged from 1ab63ed to 197f252 in /ui in the ui-docker-images group across 1 directory by @dependabot[bot] in #3460
• deps: bump org.apache.groovy:groovy-all from 5.1.0 to 5.1.1 in the mvn-packages group by @dependabot[bot] in #3461
• deps: bump the ui-packages group in /ui with 2 updates by @dependabot[bot] in #3462
• deps: Update Paketo buildpacks updates by @renovate[bot] in #3463
• deps: Update Spring Boot version to 3.5.16 by @alfespa17 in #3464

New Contributors

• @vikraj01 made their first contribution in #3276
• @BaptisteCentreon made their first contribution in #3284
• @mikluko made their first contribution in #3287
• @ctpeter made their first contribution in #3306
• @yasharma28 made their first contribution in #3316
• @dnl555 made their first contribution in #3320
• @jakegroves made their first contribution in #3327
• @at0miqx made their first contribution in #3354
• @Guflly made their first contribution in #3372
• @jvdrag made their first contribution in #3379
• @siler made their first contribution in #3381
• @bunlongheng made their first contribution in #3390
• @KetchupBomb made their first contribution in #3402
• @adeeelsameer made their first contribution in #3341
• @renovate[bot] made their first contribution in #3428
• @gangadhar-res made their first contribution in #3429
• @7487 made their first contribution in #3431

Full Changelog: 2.32.0...2.33.0