3.18.0

3.18.0 - 2026-08-24

❤️ Thanks to all contributors! ❤️

Special thanks to @arpitjain099, @abdullaabdullazade, @George928 and @RealFakeAccount for reporting security vulnerabilities!

@6543, @AhmadNajiKam, @DEATIN, @OCram85, @Palleas, @YouCD, @anbraten, @confusedsushi, @gerbsen, @hasufell, @jrouly, @kastl-ars, @lafriks, @qwerty287, @retif, @romain-rossi, @spam-n-eggs, @stevapple, @xoxys, @zmully

🔒 Security

• k8s: allow to disable runtime class name backend option [#7046]
• Don't inject additional env vars into plugins [#7040]
• Don't inject matrix env vars into plugins [#7036]
• Update golang.org/x/mod [#7012]
• Change group identifier to full_path for GitLab [#6950]

📈 Enhancement

• Allow to add custom message to manual pipelines [#6973]
• Add hidden decode-base64 agent command for Windows local backend [#7023]
• Enforce unique name for services and steps if dag is used [#7032]
• Add custom list opts with all [#6992]
• Add pipeline log download endpoint [#6876]
• Reject invalid started and done workflow states [#7029]
• Sort workflow files by name [#7021]
• Reject incompatible gRPC proto version agents [#7028]
• Enforce one log entry per line with a unique index [#7004]
• Order the user feed by creation time instead of id [#7005]
• Return step logs strictly in line order [#6999]
• Find the preceding pipeline by number instead of id [#7003]
• perf(schema): cache compiled YAML validation schema [#7002]
• Pick a repo's latest pipeline by number instead of id [#7001]
• feat: allow configuring allowed orgs per forge [#6874]
• Make the Kubernetes cluster domain configurable [#6957]
• Fix vite deprecation [#6974]
• feat(web): extract ListEditor form component [#6962]
• Rename WOODPECKER_GRPC_VERIFY to WOODPECKER_GRPC_SKIP_VERIFY [#6947]
• Update frontend schema.json for documented backend options [#6933]

🐛 Bug Fixes

• Prevent repository buttons from overlapping search bar [#7047]
• fix(server): prefix manual trigger Ref with refs/heads/ [#7051]
• fix runtime to ignore cancel as runtime error [#7031]
• Fix orphaned pipelines after repo delete [#6971]
• Migrate modernize encryption service [#6830]
• Fix running multiple cmdlets on windows [#6968]
• server: drop stale queued tasks for terminal workflows [#7015]
• fix(gitlab): avoid N+1 member lookups in Repos() [#6991]
• agent: retry connect on DeadlineExceeded, not just Unavailable [#6975]

📚 Documentation

• Update pnpm to v11.23.0 [#7061]
• Update dependency marked to v18.0.10 [#7052]
• k8s backend: fix step example using incorrect "detached" property [#7016]
• Update docs npm deps non-major [#7010]
• highlight the nodeSelector doesn't work by default [#7007]
• Update pnpm to v11.21.0 [#6982]
• Update docs npm deps non-major [#6979]
• Update documentation link for NestGuard plugin [#6954]
• Make intro example actually usable [#6953]
• Update docs npm deps non-major [#6925]
• Fix old link to Gitea docs [#6932]

📦️ Dependency

• Update web npm deps non-major [#7060]
• Lock file maintenance [#7062]
• Update web npm deps non-major [#7054]
• Update woodpeckerci/plugin-git Docker tag to v2.10.0 [#7059]
• Update docker.io/golang Docker tag to v1.27 [#7055]
• Update pre-commit hook golangci/golangci-lint to v2.13.1 [#7058]
• Update docker.io/techknowlogick/xgo Docker tag to go-1.27.x [#7056]
• Update module gitlab.com/gitlab-org/api/client-go/v2 to v2.58.2 [#7053]
• Update golang-packages to v0.36.4 [#7050]
• Update golang-packages [#7045]
• Update module github.com/getkin/kin-openapi to v0.147.0 [#7039]
• Update module github.com/urfave/cli/v3 to v3.11.0 [#7017]
• Lock file maintenance [#7018]
• Update web npm deps non-major [#7009]
• Update module gitlab.com/gitlab-org/api/client-go/v2 to v2.58.0 [#7014]
• Update postgres Docker tag to v18.6 [#7011]
• Update dependency golang to v1.26.6 [#7008]
• Update module golang.org/x/net to v0.58.0 [#6996]
• Update module golang.org/x/crypto to v0.55.0 [#6994]
• Update module google.golang.org/protobuf to v1.36.12 [#6989]
• Update pnpm to v11.21.0 [#6983]
• Update dependency eslint to v10.8.1 [#6977]
• Update module github.com/google/go-github/v89 to v90 [#6980]
• Update google.golang.org/protobuf digest to 644d026 [#6976]
• Update woodpeckerci/plugin-git Docker tag to v2.9.3 [#6978]
• Update web npm deps non-major [#6939]
• Update module github.com/docker/cli to v29.7.2+incompatible [#6966]
• Update web npm deps non-major [#6928]

Misc

• Remove gitpod [#7013]
• Drop star-history [#6997]
• Do not run openapi generation twice on fail [#6987]

3.17.0

3.17.0 - 2026-07-31

❤️ Thanks to all contributors! ❤️

@6543, @AnayGarodia, @DerRockWolf, @Kernald, @Komzpa, @OCram85, @TowyTowy, @cyphercodes, @glitch-ux, @healdropper, @ivanvc, @jleider, @kanywst, @nicolasbatistoni, @qwerty287, @rfinnie, @roian6, @xoxys, @youdie006, @zmully

🔒 Security

• Update module github.com/getkin/kin-openapi to v0.144.0 [SECURITY] [#6896]
• Make grpc secret autogenerated [#6845]
• Gate Kubernetes nodeSelector backend step config behind agent config [#6809]

✨ Features

• WebUI: show runtime workflow errors [#6577]

📈 Enhancement

• Add Docker backend AppArmor profile option [#6909]
• refactor: rework k8s utils to handle resource names and labels [#6855]
• Make matrix axis permutation order deterministic [#6847]
• feat(server): add unix socket permission option [#6839]
• Add step type label to step-level Prometheus metrics [#6824]
• Stamp trusted commit-branch and event pod labels [#6802]
• Rename CI_COMMIT_PRERELEASE to CI_PIPELINE_RELEASE_PRE [#6794]
• Rework pipeline data structure: Release & Tag [#6774]

🐛 Bug Fixes

• fix(server): guard DAG cycle check against filtered-out optional dependencies [#6915]
• all yaml unmarshalling should use maxDepth [#6911]
• Don't count step error as workflow runtime error [#6904]
• Do not allow 0 minute timeout [#6903]
• Fix pipeline queue default template data [#6906]
• Use toLabelValue instead of toDNSName in Kubernetes step label [#6890]
• ReFetch secrets on pipeline restart [#6857]
• fix(forgejo): treat 404 on empty repos as empty pull request list [#6872]
• fix(github): resolve tag pagination loop in release hook [#6870]
• Fix CreatePipeline retry [#6859]
• WebUI: unregister scaffold Tab on unmount and stable Tab order [#6842]
• WebUI: Fixes three bugs around component unmount and reset in compositions [#6843]
• fix(server): heal users left on forge_id=0 with closed registration [#6823]
• Correct forge_id and org handling on user/repo [#6820]

🧪 Tests

• Add fuzz target to make [#6828]
• Add mock for server scheduler [#6848]

📚 Documentation

• Remove dependency overrides [#6912]
• Document CLI configuration [#6899]
• Update pnpm to v11.17.0 [#6892]
• Update docs npm deps non-major [#6835]
• docs: document the scope of built-in environment variables [#6879]
• Add NestGuard plugin to plugins.json [#6873]
• Minor adjustments for API usage example [#6605]
• docs: add note about pull_request events with path filter and correct comment about on_empty [#6819]
• Update docs npm deps non-major [#6788]

📦️ Dependency

• Update dependency mvdan/gofumpt to v0.11.0 [#6926]
• Lock file maintenance [#6931]
• Update docker.io/mysql Docker tag to v26 [#6930]
• Update dependency jsdom to v30 [#6929]
• Update pre-commit hook hadolint/hadolint to v2.15.1 [#6927]
• Update golang-packages [#6920]
• Update module github.com/mattn/go-sqlite3 to v1.14.49 [#6919]
• Update module gitlab.com/gitlab-org/api/client-go/v2 to v2.53.0 [#6917]
• Update golang-packages [#6910]
• Update web npm deps non-major [#6894]
• Lock file maintenance [#6901]
• Update module github.com/docker/go-connections to v0.8.0 [#6900]
• Update dependency fast-uri to v4 [#6897]
• Update golang-packages [#6889]
• Update dependency brace-expansion to v5 [#6895]
• Update pre-commit hook rbubley/mirrors-prettier to v3.9.6 [#6893]
• Update golang-packages [#6883]
• Update web npm deps non-major [#6866]
• Update golang-packages [#6867]
• Update pnpm to v11.15.0 [#6865]
• Update pre-commit hook igorshubovych/markdownlint-cli to v0.49.1 [#6861]
• Update dependency pinia to v4 [#6864]
• Update gitea/gitea Docker tag to v1.27 [#6863]
• Update web npm deps non-major [#6862]
• Update docker.io/woodpeckerci/plugin-ready-release-go Docker tag to v4.1.2 [#6860]
• Update golang-packages [#6858]
• Update web npm deps non-major [#6815]
• Update golang-packages [#6821]
• Update docker.io/woodpeckerci/plugin-docker-buildx Docker tag to v6.1.1 [#6834]
• Update docker.io/woodpeckerci/plugin-codecov Docker tag to v2.3.2 [#6833]
• Update dependency golang to v1.26.5 [#6832]
• Update golang-packages [#6785]
• Lock file maintenance [#6816]
• Update pnpm to v11.10.0 [#6814]
• Update module github.com/cenkalti/backoff/v6 to v7 [#6812]
• Update web npm deps non-major [#6787]
• Lock file maintenance [#6799]

3.16.0

3.16.0 - 2026-06-27

❤️ Thanks to all contributors! ❤️

@6543, @AkashKumar7902, @M31ancholy, @MeurillonGuillaume, @WeslleyNasRocha, @gedankenstuecke, @head1328, @mahlzahn, @mmeier86, @nati737, @nijave, @qwerty287, @simonckemper, @simonmeyerrr

🔒 Security

• Gate Kubernetes serviceAccountName backend step config behind agent config [#6792]
• Harden agent rpc to check agentID on workflow [#6759]
• Security updates for js dependencies [#6737]
• bump go.mongodb.org/mongo-driver v1.17.6 => v1.17.7 [#6741]
• Update joi [#6728]

✨ Features

• Add workflow concurrency limit option [#6671]
• Support Unix Sockets [#6721]

📈 Enhancement

• Kubernetes: allow custom image when precreating workingDir as nonroot [#6771]
• Server can move pipeline parsing into background on long creation times [#6781]
• Add CI_COMMIT_PULL_REQUEST_DRAFT environment variable [#6778]
• Make LogEntry Buffer configurable for agent [#6773]
• Agent treat gRPC Internal error as fatal [#6780]
• Refactor to inject store and context into server scheduler [#6755]
• Refactor server scheduler collect in new interface [#6753]
• Add Prometheus metrics for pipeline step duration and failures [#6738]
• Add k8s userns support [#6710]
• Make cli exec auto detect single workflow test in multi workflow setup [#6715]
• Surface .env load errors [#6707]
• Group commands followup user preference [#6694]
• Trim white spaces for cron create/update [#6690]
• Improve slow user authorization if many orgs/repos [#5665]
• pipeline: use more explizite error for step dependencies filtered out by its conditions [#6680]
• Add commit timestamp env vars [#6670]
• Show forge in users list [#6666]

🐛 Bug Fixes

• Allow images for secrets to contain SHA256 for image pinning [#6784]
• server should drop stale queue tasks already missing in database [#6765]
• server queue api should ignore missing agent [#6763]
• docs: deps migrate gray-matter to maintained fork [#6744]
• local backend: on windows use process tree-walk as workaround to kill [#6718]
• Fix issue with deeply nested k8s backend_options [#6730]
• cli exec: have uniq prefix for each workflow [#6716]
• github dont fail on force push [#6697]
• fix(kubernetes): retry WaitStep when container terminated state not yet finalized [#6672]

🧪 Tests

• More test coverage of server/api/... [#6712]
• Add e2e test that assert workflow depends_on enforces ordering [#6711]
• Add more tests in areas not well covered [#6696]
• Cleanup e2e test setup [#6480]

📚 Documentation

• Update docs npm deps non-major [#6786]
• Check docs JS files for spelling [#6758]
• Remove openbao extension [#6757]
• Update docs npm deps non-major [#6747]
• adds git-pages plugin [#6736]
• Update docs npm deps non-major to v1.18.0 [#6731]
• Update docs npm deps non-major to v3.17.0 [#6726]
• Update docs npm deps non-major [#6722]
• Update docs npm deps non-major [#6705]
• Add Podman plugin [#6701]
• Update docs npm deps non-major [#6679]
• Update dependency concurrently to v10 [#6676]
• Update docs npm deps non-major [#6675]
• docs: add cli exec examples [#6629]

📦️ Dependency

• Update pre-commit hook rbubley/mirrors-prettier to v3.8.5 [#6791]
• Update golang-packages [#6782]
• Update web npm deps non-major [#6761]
• Update golang-packages [#6767]
• Lock file maintenance [#6768]
• Update module github.com/cenkalti/backoff/v5 to v6 [#6752]
• Update dependency http-proxy-middleware to v4 [#6750]
• Update pre-commit non-major to v0.49.0 [#6749]
• Update docker.io/mysql Docker tag to v9.7.1 [#6746]
• Lock file maintenance [#6733]
• Update docker.io/alpine Docker tag to v3.24 [#6725]
• Update pre-commit non-major to v3.8.4 [#6723]
• Lock file maintenance [#6709]
• Update golang-lang to v1.26.4 [#6704]
• bump github.com/quic-go/quic-go to v0.59.1 [#6700]
• Update docker.io/woodpeckerci/plugin-trivy Docker tag to v1.6.0 [#6699]
• Lock file maintenance [#6686]
• Update woodpeckerci/plugin-git Docker tag to v2.9.2 [#6674]
• Update module gitlab.com/gitlab-org/api/client-go/v2 to v2.36.0 [#6668]
• Migrate gopkg.in/yaml.v3 usages to go.yaml.in/yaml/v4 [#6651]

Misc

• Rename editorconfig file [#6734]

3.15.0

3.15.0 - 2026-05-28

❤️ Thanks to all contributors! ❤️

@6543, @AkashKumar7902, @EdwardSalter, @M31ancholy, @anbraten, @hhamalai, @johanvdw, @jolheiser, @julienvincent, @lephuongbg, @mateuszkamola, @qwerty287, @rfinnie, @simonmeyerrr, @wucm667

Special thanks to @geo-chen for finding and reporting vulnerabilities!

🔒 Security

• Use Gitlab username [#6653]
• Update uuid [#6647]
• server: for grpc store extracted agentID in context [#6569]

✨ Features

• Support optional flag in depends_on for workflows and steps [#6461]

📈 Enhancement

• Use refactored pipeline builder in cli exec [#6453]
• Add config to change default pipeline config paths and extensions [#6580]
• Allow disabling service workspace volumes in k8s [#6644]
• View warning if admin is configured at env level [#6600]
• Add timezone support for crons [#6597]
• Add CI_PIPELINE_RERUNS environment variable [#6588]
• Add placeholders to inputs [#6599]
• Refactor server/.../step_builder into pipeline/.../builder [#3967]
• Group logs by command in step logs UI and make them collapsible [#6398]
• Expose step type to step env [#4290]
• pipeline runtime: move setting step environment variables into own func and add CI_PIPELINE_STATUS back [#6516]
• Refactor agent rpc retry [#6515]

🐛 Bug Fixes

• Fix org lookup panic [#6652]
• Deduplicate schema linter composition errors [#6633]
• local backend: on linux / mac start commands in own process group and kill the group on cancel [#6609]
• k8s: add guards to stop pipeline services upon completion [#6623]
• Fix missing log close button [#6584]
• fix(agent): persist agent ID after auth to prevent crashloop duplicates [#6543]
• fix(gitlab): preserve private flag when webhook payload omits project visibility [#6544]

🧪 Tests

• Fix race in local backend tests [#6574]

📚 Documentation

• Add note about extension permission [#6646]
• Add GitHub OAuth App setup hint to docker-compose page [#6643]
• Update pnpm to v11.3.0 [#6639]
• Update docs npm deps non-major [#6625]
• Docs: Mention that you can use failure: fail [#6611]
• Change homepage of woodpecker-shellcheck [#6594]
• Update docs npm deps non-major [#6586]
• Update pnpm to v11 [#6561]
• Update docs npm deps non-major [#6555]
• Add 3rd party secret extensions list [#6546]
• Update dependency axios to v1.16.0 [#6538]
• Update dependency yaml to v2.8.4 [#6536]
• Update dependency isomorphic-dompurify to v3.12.0 [#6532]
• Update docs npm deps non-major [#6530]

📦️ Dependency

• Update module gitlab.com/gitlab-org/api/client-go/v2 to v2.34.0 [#6662]
• Update dependency uuid to v14 [#6658]
• Lock file maintenance [#6659]
• Update golang-packages [#6637]
• Update web npm deps non-major [#6638]
• Lock file maintenance [#6640]
• Update module github.com/google/go-github/v86 to v88 [#6626]
• Update web npm deps non-major [#6624]
• Update golang-packages [#6622]
• Update golang-packages [#6620]
• Update module gitlab.com/gitlab-org/api/client-go/v2 to v2.29.0 [#6618]
• Update golang-packages [#6614]
• Lock file maintenance [#6606]
• Update web npm deps non-major [#6604]
• Update web npm deps non-major [#6603]
• Update web npm deps non-major [#6602]
• Update web npm deps non-major [#6601]
• Update dependency simple-icons to v16.20.0 [#6596]
• Update dependency eslint to v10.4.0 [#6593]
• Update dependency @antfu/eslint-config to v9 [#6592]
• Update web npm deps non-major [#6591]
• Update woodpeckerci/plugin-git Docker tag to v2.9.1 [#6589]
• Update postgres Docker tag to v18.4 [#6590]
• Update module gitlab.com/gitlab-org/api/client-go/v2 to v2.26.1 [#6587]
• Update golang-packages [#6582]
• Update module gitlab.com/gitlab-org/api/client-go/v2 to v2.26.0 [#6578]
• Update golang-packages [#6571]
• Update web npm deps non-major [#6446]
• Update module gitlab.com/gitlab-org/api/client-go/v2 to v2.25.0 [#6566]
• Update module github.com/google/go-github/v85 to v86 [#6560]
• Lock file maintenance [#6563]
• Update golang-packages [#6562]
• Update dependency mvdan/gofumpt to v0.10.0 [#6558]
• Update dependency golangci/golangci-lint to v2.12.2 [#6556]
• Update pre-commit hook golangci/golangci-lint to v2.12.2 [#6557]
• Update dependency golang to v1.26.3 [#6554]
• Update golang-packages [#6548]
• Update module gitlab.com/gitlab-org/api/client-go/v2 to v2.24.1 [#6545]
• Update golang-packages [#6542]
• Lock file maintenance [#6540]
• Update module github.com/docker/cli to v29.4.2+incompatible [#6539]
• Update golangci/golangci-lint Docker tag to v2.12.1 [#6537]
• Update pre-commit hook golangci/golangci-lint to v2.12.1 [#6535]
• Update docker.io/woodpeckerci/plugin-docker-buildx Docker tag to v6.1.0 [#6534]
• Update dependency golangci/golangci-lint to v2.12.0 [#6533]
• Update woodpeckerci/plugin-release Docker tag to v0.3.1 [#6531]
• Update docker.io/lycheeverse/lychee Docker tag to v0.24.2 [#6529]

Misc

• build: release freebsd/openbsd as binary not container [[#6610](https://github.com/woodpecker-...

3.14.1

3.14.1 - 2026-05-12

❤️ Special thanks the security researchers and those who fixed them ❤️

• Thanks to Shivam Kumar (@shivamkumarcyber) and
  Ranganatha Rao Sridhar (Praetorian) independently finding and reporting the bug
• And @6543 fixing the bugs and orchestrating the communication

CVE-2026-50141 EUVD-2026-37897

🔒 Security

• Server: make sure agent_id can not be spoofed by agent [#6567]

3.14.0

3.14.0 - 2026-05-01

❤️ Thanks to all contributors! ❤️

@6543, @Aex12, @AhmadNajiKam, @CrimsonFez, @LUKIEYF, @LoricAndre, @M31ancholy, @MartinSchmidt, @Pnkcaht, @Sim-hu, @TumbleOwlee, @api2062, @bclermont, @brainbaking, @cliffmccarthy, @confusedsushi, @dccdis, @hhamalai, @hnb2, @lephuongbg, @mehrdadbn9, @mofr93, @myers, @myselfghost, @njaaazi, @packrat386, @paulovitorbal, @qwerty287, @rfinnie, @rhafer, @samoli, @savv, @stardothosting, @utafrali, @wucm667

🔒 Security

• docs: bump follow-redirects [#6441]
• chore(deps): update dependency axios to v1.15.0 [security] [#6417]
• fix(deps): update go.opentelemetry.io/otel to v1.43.0 [#6416]
• WebUI: remove "lodash" dep [#6369]
• Sanitize agent introduced pipeline/workflow/step state changes and log streaming [#6308]
• Send 404 if logs are not allowed to access [#6349]
• Prevent registering as arbitrary agents with system token [#6283]
• Update fast-xml-parser [#6258]
• Update dompurify and svgo [#6198]
• Update edwards25519 [#6143]

✨ Features

• Support one-shot agent execution mode [#6150]
• Add external secret extension implementation [#6252]
• Allow disabling isolated home directory for local agents [#6251]
• Add Container Registry credential extension [#5993]
• Support exclusive config extensions [#5978]

📈 Enhancement

• Kubernetes: precreate workingDir as nonroot when required [#6322]
• Kubernetes: Support allowPrivilegeEscalation and capabilities backend_options [#6307]
• Refactor: remove Auth() from Forge interface [#6505]
• Move wait for log uploads logic out of logger and tracer into pipeline runtime [#6471]
• Make agent reconnect retry timeout configurable [#6470]
• Handle re-created forge repos gracefully [#6370]
• Cleanup server store step interface [#6476]
• Docker/K8s: add config for stop timeout [#6445]
• Docker backend should retry to delete volume on "in use" error [#6381]
• Move skip pipeline by commit message into pipeline/frontend package [#6437]
• Init server/scheduler package and use it as proxy for queue & pubsub [#6418]
• Unify server API parameters to snake_case [#6404]
• Add netrc option for config/registry extension [#6333]
• Docker backend: replace docker SDK with moby SDK [#6357]
• Deprecate commit avatar envs [#6356]
• Refactor server/pubsub into interface [#6318]
• Separate cron field [#6346]
• Refactor pipeline runtime code [#6166]
• Show Woodpecker version on pipeline details [#6316]
• Unify import aliases [#6328]
• Improve linter warning when step has no when block [#6314]
• Improve error message when no workflows for manual were found [#6313]
• Server return conflict status when stale repo causes duplicate insert [#6276]
• Show global/org registries in org/repo registries tab [#6291]
• Report skipped step state as soon as it's determined [#6295]
• Only add compatibility environment variables for drone-ci to plugins [#6271]
• Refactor: pass backend explicitly when creating pipeline engine runtime [#6268]
• Compare admins case-insensitively [#6261]
• Allow to cancel on failure [#6158]
• Refactor so storage detects if Insert fails because of unique constraint [#6259]
• Add server config for maximum log lines shown in web UI [#6250]
• Add "Load more" pagination to pipeline list [#6200]
• Use upstream slices.Concat and remove utils.MergeSlices [#6185]
• Add enhanced function for error message handling in http request for configuration fetching [#5712]
• Remove fixed badge width in UI [#6157]
• Improve Debian packages [#6085]
• Refactor pipeline engine [#6073]
• Show cancellation reason in pipeline details [#6072]
• Document required forge methods [#6049]
• Dynamic log following [#6036]
• Per-Workflow and Per-Workflow-Step badge generation [#5977]
• Render MD in pipeline titles [#5999]
• Simplify and Fix server task queue [#6017]
• Update Architecture: move pipeline/rpc => rpc & server/{grpc => rpc} [#6012]
• Implement retry logic in HTTP Send method [#5857]
• CLI: Allow single output template [#5882]
• Improve service syntax related docs and tests nits [#5991]
• Remove deactivated secrets type from container definition [#5983]

🐛 Bug Fixes

• fix(web): escape HTML in commit messages to prevent XSS [#6523]
• fix(cli,server): fix trusted flags copy-paste bug and server nil pointer panic [#6501]
• Add refname to bitbucket commit status [#6482]
• Fix send on closed channel panic in SSE stream handlers [#6456]
• Add WOODPECKER_FORCE_IGNORE_SERVICE_FAILURE config to preserve non-breaking behavior by default [#6448]
• Fix race in pipeline runtime [#6451]
• Fix race in server LogEntry logger [#6449]
• Kubernetes: detached steps are no services [#6435]
• Support dots in image names [#6431]
• Fix erroneous linter error for plugin privileges [#6424]
• Add connection timeout and graceful shutdown to agent RPC client [#6414]
• Fix Windows container exit code handling and error checks [#6411]
• Bitbucket: Remove usage of deprecated /user/permissions/repositories [#6401]
• Bitbucket: Fix parsing /user/workspaces response [#6396]
• Fix CLI exec with workflow matrix feature, where variables are not substituted. [#6162]
• Fix enable repo with same name and owner on second forge [#6375]
• Fix workflow being skipped and marked as failed when agent starts before server [#6361]
• Only redirect after login [#6348]
• Set w...

3.14.0-rc.2

3.14.0-rc.2 - 2026-04-27

❤️ Thanks to all contributors! ❤️

@6543, @LoricAndre, @bclermont, @hhamalai, @lephuongbg, @njaaazi, @rhafer

🔒 Security

• docs: bump follow-redirects [#6441]

📈 Enhancement

• Refactor: remove Auth() from Forge interface [#6505]
• Move wait for log uploads logic out of logger and tracer into pipeline runtime [#6471]
• Make agent reconnect retry timeout configurable [#6470]
• Handle re-created forge repos gracefully [#6370]
• Cleanup server store step interface [#6476]
• Docker/K8s: add config for stop timeout [#6445]
• Docker backend should retry to delete volume on "in use" error [#6381]

🐛 Bug Fixes

• fix(cli,server): fix trusted flags copy-paste bug and server nil pointer panic [#6501]
• Add refname to bitbucket commit status [#6482]
• Fix send on closed channel panic in SSE stream handlers [#6456]
• Add WOODPECKER_FORCE_IGNORE_SERVICE_FAILURE config to preserve non-breaking behavior by default [#6448]
• Fix race in pipeline runtime [#6451]
• Fix race in server LogEntry logger [#6449]
• Kubernetes: detached steps are no services [#6435]

🧪 Tests

• e2e test wait for grpc server teardown and stop agents [#6479]
• Add more test cases for rpc label filter [#6483]
• Fix flaky TestJWTManager [#6478]
• Add e2e pipeline restart test [#6469]
• Init minimal e2e tests [#6391]
• Enhance datastore DB test setup [#6450]

📚 Documentation

• Lock file maintenance [#6508]
• Update docs npm deps non-major [#6496]
• Add Laravel Forge plugin [#6491]
• Add 'entrypoint' property to service in schema [#6487]
• Lock file maintenance [#6472]
• Update dependency axios to v1.15.1 [#6468]
• Update dependency marked to v18.0.2 [#6465]
• Update docs npm deps non-major [#6463]

📦️ Dependency

• Update module github.com/google/go-github/v84 to v85 [#6500]
• Update module github.com/getkin/kin-openapi to v0.136.0 [#6503]
• Update woodpeckerci/plugin-git Docker tag to v2.9.0 [#6499]
• Update docker.io/mysql Docker tag to v9.7.0 [#6498]
• Update docker.io/lycheeverse/lychee Docker tag to v0.24.1 [#6497]
• Update golang-packages to v0.36.0 [#6485]
• Update golang-packages [#6477]
• Update pre-commit hook rbubley/mirrors-prettier to v3.8.3 [#6462]
• Update module k8s.io/client-go to v0.35.4 [#6460]
• Update golang-packages [#6459]
• Update docker.io/woodpeckerci/plugin-trivy Docker tag to v1.4.5 [#6447]

Misc

• Add s3 cache plugin to docs [#6467]

3.14.0-rc.1

3.14.0-rc.1 - 2026-04-15

❤️ Thanks to all contributors! ❤️

@6543, @AhmadNajiKam, @M31ancholy, @lephuongbg, @packrat386, @qwerty287, @utafrali

🔒 Security

• chore(deps): update dependency axios to v1.15.0 [security] [#6417]
• fix(deps): update go.opentelemetry.io/otel to v1.43.0 [#6416]
• WebUI: remove "lodash" dep [#6369]
• Sanitize agent introduced pipeline/workflow/step state changes and log streaming [#6308]

📈 Enhancement

• Move skip pipeline by commit message into pipeline/frontend package [#6437]
• Init server/scheduler package and use it as proxy for queue&pubsub [#6418]
• refactor(server): unify api parameters to snake case [#6404]

🐛 Bug Fixes

• Support dots in image names [#6431]
• Fix erroneous linter error for plugin privileges [#6424]
• fix: add connection timeout and graceful shutdown to agent RPC client [#6414]
• Fix Windows container exit code handling and error checks [#6411]
• Bitbucket: Remove usage of deprecated /user/permissions/repositories [#6401]
• Bitbucket: Fix parsing /user/workspaces response [#6396]
• Fix CLI exec with workflow matrix feature, where variables are not substituted. [#6162]
• Fix enable repo with same name and owner on second forge [#6375]

🧪 Tests

• Dummy backend support cancel [#6390]

📚 Documentation

• Update dependency marked to v18 [#6425]
• Update docs npm deps non-major [#6422]
• chore(deps): update dependency marked to v17.0.6 [#6386]
• chore(deps): update dependency fuse.js to v7.3.0 [#6382]
• chore(deps): update docs npm deps non-major [#6376]

📦️ Dependency

• Update docker.io/woodpeckerci/plugin-ready-release-go Docker tag to v4.1.1 [#6440]
• Update module gitlab.com/gitlab-org/api/client-go/v2 to v2.18.0 [#6439]
• Update docker.io/woodpeckerci/plugin-codecov Docker tag to v2.3.1 [#6438]
• Lock file maintenance [#6430]
• Update dependency dotenv to v17.4.2 [#6428]
• Update dependency simple-icons to v16.16.0 [#6427]
• Update web npm deps non-major [#6423]
• Update pre-commit hook rbubley/mirrors-prettier to v3.8.2 [#6421]
• Update dependency golang to v1.26.2 [#6420]
• fix(deps): update module github.com/docker/cli to v29.4.0+incompatible [#6403]
• fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.41 [#6397]
• chore(deps): lock file maintenance [#6392]
• chore(deps): update dependency dotenv to v17.4.1 [#6389]
• chore(deps): update dependency marked to v17.0.6 [#6387]
• chore(deps): update dependency simple-icons to v16.15.0 [#6385]
• fix(deps): update golang-packages [#6384]
• chore(deps): update dependency fuse.js to v7.3.0 [#6383]
• chore(deps): update dependency @antfu/eslint-config to v8 [#6378]
• chore(deps): update web npm deps non-major [#6377]
• fix(deps): update module github.com/lib/pq to v1.12.2 [#6371]

Misc

• Update module gitlab.com/gitlab-org/api/client-go/v2 to v2.17.0 [#6426]

3.14.0-rc.0

3.14.0-rc.0 - 2026-04-01

❤️ Thanks to all contributors! ❤️

@6543, @CrimsonFez, @LUKIEYF, @MartinSchmidt, @Pnkcaht, @Sim-hu, @TumbleOwlee, @api2062, @brainbaking, @cliffmccarthy, @confusedsushi, @dccdis, @hhamalai, @hnb2, @mehrdadbn9, @mofr93, @myers, @myselfghost, @paulovitorbal, @qwerty287, @samoli, @savv, @stardothosting

🔒 Security

• Send 404 if logs are not allowed to access [#6349]
• Prevent registering as arbitrary agents with system token [#6283]
• Update fast-xml-parser [#6258]
• Update dompurify and svgo [#6198]
• Update edwards25519 [#6143]
• chore(deps): update dependency lodash to v4.17.23 [security] [#5997]

✨ Features

• Support one-shot agent execution mode [#6150]
• Add external secret extension implementation [#6252]
• make it possible to disable the isolated home for local agents [#6251]
• Add Container Registry credential extension [#5993]
• Support exclusive config extensions [#5978]

📈 Enhancement

• Add netrc option for config/registry extension [#6333]
• Migrate to moby [#6357]
• Deprecate commit avatar envs [#6356]
• Refactor server/pubsub into interface [#6318]
• Separate cron field [#6346]
• Refactor pipeline runtime code [#6166]
• Show Woodpecker version on pipeline details [#6316]
• Unify import aliases [#6328]
• Improve linter warning when step has no when block [#6314]
• Improve error message when no workflows for manual were found [#6313]
• Server return conflict status when stale repo causes duplicate insert [#6276]
• Show global/org registries in org/repo registries tab [#6291]
• Forward skipped step state once it's known [#6295]
• Only add compatibility environment variables for drone-ci to plugins [#6271]
• Creating new engine runtime now requires backend as argument [#6268]
• Compare admins case-insensitively [#6261]
• Allow to cancel on failure [#6158]
• Refactor so storage detects if Insert fails because of unique constraint [#6259]
• Add configure the max number of lines loaded in log webview [#6250]
• Add "Load more" pagination to pipeline list [#6200]
• refactor: pipeline runtime add description and prevent race [#6167]
• refactor: use upstream slices.Concat and remove utils.MergeSlices [#6185]
• Add enhanced function for error message handling in http request for configuration fetching [#5712]
• Remove fixed badge width in UI [#6157]
• Refactor pipeline engine [#6073]
• Added cancel info so one can see why it was cancelled [#6072]
• Document required forge methods [#6049]
• Dynamic log following [#6036]
• Per-Workflow and Per-Workflow-Step badge generation [#5977]
• Render MD in pipeline titles [#5999]
• Simplify and Fix server task queue [#6017]
• fix(agent): workflow runner use shutdown context [#6021]
• Update Architecture: move pipeline/rpc => rpc & server/{grpc => rpc} [#6012]
• Implement retry logic in HTTP Send method [#5857]
• CLI: Allow single output template [#5882]
• Improve service syntax related docs and tests nits [#5991]
• Remove deactivated secrets type from container defintion [#5983]

🐛 Bug Fixes

• Fix workflow beeing skipped and marked as failed when agent starts before server [#6361]
• Only redirect after login [#6348]
• Set workflow services stuck in running state to finished [#6337]
• Fix bitbucket api deprecations [#6324]
• Fix workflow serialize to omit skip_clone if false [#6319]
• Fix build deb rpm packages [#6309]
• Enable crons if created via CLI [#6228]
• Fix message on gitlab tag event [#6196]
• fix(bbdc): resolve annotated tag object SHA to commit SHA before posting build status [#6203]
• Prevent leaking goroutines on cancelled steps [#6186]
• Independently evaluate status filter and support on workflows [#6183]
• Fix status merging with skipped pipelines [#6176]
• Update pipeline config schema [#6156]
• Fix OAuth token refresh race condition with singleflight [#6153]
• Fully merge statuses [#6119]
• Only set tag env on tags [#6142]
• Fix bitbucket email [#6102]
• Detached or service steps report back too [#6039]
• Don't propagate workflow error from agent back to agent [#6056]
• Fix pipeline cancellation status handling and step state synchronization [#6011]
• Add retry logic for CreatePipeline with backoff [#6067]
• Fix OAuth token refresh in webhook handling for Bitbucket and GitHub [#6059]
• Refresh token before forge calls [#6035]
• Local backend: cleanup generated script for cmd.exe shell [#6029]
• Local backend: setup clone step respects context [#6030]
• Fix: Agent now gracefully handles running containers when killed [#6018]
• Local backend: handle canceled steps case [#6008]

🧪 Tests

• Extend workflow integration tests [#6272]
• Add registry service tests [#6330]
• Add workflow integration test [#6270]
• Increase timeout for migration tests [#6206]
• Ignore fixtures for coverage [#6197]
• Use tabs for indentation in embedded JSON [#6103]
• Add some tests [#6076]
• Ignore mocks for coverage [#6074]

📚 Documentation

• chore(deps): update dependency typescript to v6 [#6336]
• chore(deps): update docs npm deps non-major [#6335]
• Add CI check for docs on feat...

3.13.0

3.13.0 - 2026-01-14

❤️ Thanks to all contributors! ❤️

@6543, @Javex, @KhalidAlansary, @MartinSchmidt, @abhiyerra, @anbraten, @bentasker, @gjuoun, @gsaslis, @henkka, @jolheiser, @mogsie, @qwerty287, @sloonz, @sugar700, @tuxmainy, @xoxys

🔒 Security

• Update quic-go/qpack & quic-go/quic-go [#5885]
• fix: updateRepoPermissions to cleanup old permissions [#5790]

✨ Features

• Add cli contexts [#5929]

📈 Enhancement

• Allow to add a note to secrets [#5898]
• Log addon errors [#5923]
• Custom vars for crons [#5897]
• Allow to disable a cron [#5896]
• Add background to status icons [#5880]
• Fix dead page and cleanup router [#5519]
• feat(kubernetes): add support for pod affinity and anti-affinity configurations [#5854]
• Public key endpoint [#5860]
• Allow untrusted repo to still drop network for steps [#5820]
• Add support for headless Kubernetes services [#5764]
• server/forge: rename var to be more descriptive and test value [#5806]
• add events query parameter to badge url [#5728]
• Extract default step-builder options into server [#5785]
• feat: include CI_COMMIT_TAG env in deployment events [#5773]

🐛 Bug Fixes

• Use repo-user for api call of cron [#5967]
• Close opened file on LogFind [#5961]
• Delete/Deactivate repo ignores missing repo at forge [#5953]
• Correctly update repo permissions [#5928]
• Revert repos pagination for GH and BB [#5924]
• fix: send correct argument to rpc call for name/url [#5922]
• fix: secrets-file flag [#5909]
• Do not run crons for disabled repos [#5884]
• Show warning if there is no workflow to run [#5883]
• fix(datastore): fix pagination bug in workflowsDelete skipping records [#5881]
• Remove rounded corners in fullscreen log view [#5879]
• Fix some ListItems and Queue view background in dark mode [#5878]
• Make disabled checkboxes match overall style [#5869]
• Fix CLI trusted updating [#5861]
• Send configuration as part of the request for external configuration [#5831]
• fix(bitbucketdatacenter): fix CI_COMMIT_PULL_REQUEST [#5769]
• On set/get of repo make sure forge_id is set and on fetch respected [#5717]
• Improve repair endpoints [#5767]

📚 Documentation

• chore(deps): lock file maintenance [#5963]
• chore(deps): update dependency @types/node to v24.10.7 [#5954]
• chore(deps): update dependency @types/react to v19.2.8 [#5941]
• chore(deps): update dependency @types/node to v24.10.6 [#5935]
• chore(deps): update dependency @types/node to v24.10.5 [#5933]
• fix(docs): update woodpecker-cli secret command [#5927]
• Update Docs and nix-flake to reflect current dev environment [#5926]
• Update Helm chart installation command [#5872]
• docs: add BunnyCDN Cache Purge Plugin [#5906]
• chore(deps): update dependency isomorphic-dompurify to v2.35.0 [#5904]
• chore(deps): update dependency @types/node to v24.10.4 [#5862]
• chore(deps): update docs npm deps non-major [#5855]
• chore(deps): update docs npm deps non-major [#5829]
• Update link for Codeberg Pages Deploy plugin [#5811]
• chore(deps): update dependency yaml to v2.8.2 [#5803]
• chore(deps): update dependency prettier to v3.7.3 [#5799]
• chore(deps): update docs npm deps non-major [#5791]
• chore(deps): update dependency isomorphic-dompurify to v2.33.0 [#5778]
• chore(deps): update docs npm deps non-major [#5774]

📦️ Dependency

• fix(deps): update module gitlab.com/gitlab-org/api/client-go to v1.14.0 [#5969]
• fix(deps): update golang-packages [#5966]
• fix(deps): update module gitlab.com/gitlab-org/api/client-go to v1.12.0 [#5962]
• chore(deps): update dependency simple-icons to v16.5.0 [#5957]
• fix(deps): update golang-packages [#5956]
• chore(deps): update dependency @types/node to v24.10.7 [#5955]
• fix(deps): update module github.com/google/go-github/v80 to v81 [#5946]
• chore(deps): update woodpeckerci/plugin-git docker tag to v2.8.0 [#5945]
• chore(deps): update golangci/golangci-lint docker tag to v2.8.0 [#5944]
• chore(deps): update docker.io/woodpeckerci/plugin-codecov docker tag to v2.2.0 [#5943]
• chore(deps): update web npm deps non-major [#5942]
• chore(deps): update docker.io/woodpeckerci/plugin-surge-preview docker tag to v1.4.2 [#5938]
• chore(deps): update docker.io/woodpeckerci/plugin-ready-release-go docker tag to v3.4.1 [#5937]
• chore(deps): update docker.io/woodpeckerci/plugin-docker-buildx docker tag to v6.0.4 [#5936]
• chore(deps): update docker.io/woodpeckerci/plugin-editorconfig-checker docker tag to v0.3.3 [#5934]
• fix(deps): update module gitlab.com/gitlab-org/api/client-go to v1.11.0 [#5919]
• chore(deps): lock file maintenance [#5916]
• chore(deps): update dependency simple-icons to v16.4.0 [#5915]
• fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.33 [#5910]
• chore(deps): lock file maintenance [#5913]
• chore(deps): lock file maintenance [#5907]
• chore(deps): update dependency simple-icons to v16.3.0 [#5905]
• chore(deps): update web npm deps non-major [#5903]
• fix(deps): update module google.golang.org/grpc to v1.78.0 [#5901]
• chore(deps): lock file maintenance [#5895]
• fix(deps): update module github.com/tink-crypto/tink-go/v2 to v2.6.0 [#5894]
• chore(deps): update dependency @antfu/eslint-config to v6.7.2 [#5893]
• chore(deps): update dependency vue-i18n to v11.2.7 [#5892]
• ch...