2.8.2

2.8.2 - 2024-12-19

❤️ Thanks to all contributors! ❤️

@xoxys

🔒 Security

• Backport gitea and forgejo sdk updates [#4592]
• Do not log forge tokens (#4551) [#4590]
• Don't log DB passwords (#4583) [#4589]
• Backport golang security updates [#4587]

v3.0.0-rc.1

A curated changelog is currently being prepared. Please check the Migration notes PR for required changes when upgrading from 2.x to 3.x.

We welcome feedback for the new version to ship a robust final 3.0.

3.0.0-rc1 - 2024-12-14

❤️ Thanks to all contributors! ❤️

@6543, @Fishbowler, @M0Rf30, @anbraten, @cduchenoy, @fernandrone, @gnowland, @greenaar, @hg, @j04n-f, @jenrik, @johanneskastl, @jolheiser, @lafriks, @lukashass, @meln5674, @not-my-profile, @pat-s, @qwerty287, @smainz, @tori-27, @tsufeki, @xoxys, @xtexChooser, @zc-devs

💥 Breaking changes

• Drop native Let's Encrypt support [#4541]
• Set new default approval mode based on repo visibility [#4456]
• Do not set empty environment variables [#4193]
• Unify cli commands and flags [#4481]
• Move pipeline logs command [#4480]
• Fix woodpecker-go repo model to match server [#4479]
• Restructure cli commands [#4467]
• Add pagination options to all supported endpoints in sdk [#4463]
• Allow to set custom trusted clone plugins [#4352]
• Add PipelineListsOptions to woodpecker-go [#3652]
• Remove secrets in favor of from_secret [#4363]
• Kubernetes | Docker: Add support for rootless images [#4151]
• Split repo trusted setting [#4025]
• Move docker resource limit settings from server to agent [#3174]
• Set /woodpecker as default workdir for the woodpecker-cli container [#4130]
• Require upgrade from 2.x [#4112]
• Don't expose task data via api [#4108]
• Remove some ci environment variables [#3846]
• Remove all default privileged plugins [#4053]
• Add option to filter secrets by plugins with specific tags [#4069]
• Remove old pipeline options [#4016]
• Remove various deprecations [#4017]
• Drop repo name fallback for hooks [#4013]
• Improve local backend detection [#4006]
• Refactor JSON and SDK fields [#3968]
• Migrate to maintained cron lib and remove seconds [#3785]
• Switch to profile-based AppArmor configuration [#4008]
• Remove Kubernetes default image pull secret name regcred [#4005]
• Drop "WOODPECKER_WEBHOOK_HOST" env var and adjust docs [#3969]
• Drop version in schema [#3970]
• Update docker to v27 [#3972]
• Require gitlab 12.4 [#3966]
• Migrate to maintained httpsign library [#3839]
• Remove WOODPECKER_DEV_OAUTH_HOST and WOODPECKER_DEV_GITEA_OAUTH_URL [#3961]
• Remove deprecated pipeline keywords: pipeline:, platform:, branches: [#3916]
• server: remove old unused routes [#3845]
• CLI: remove step-id and add step-number as option to logs [#3927]

🔒 Security

• Add server config to disable user registered agents [#4206]
• chore: fix http-proxy-middleware CVE [#4257]
• Allow altering trusted clone plugins and filter them via tag [#4074]
• Update gitea sdk [#4012]
• Update Forgejo SDK [#3948]

✨ Features

• Add user as docker backend_option [#4526]
• Implement org/user agents [#3539]
• Replay pipeline using cli exec by downloading metadata [#4103]
• Update clone plugin to support sha256 [#4136]

🐛 Bug Fixes

• Fix BB ambiguous commit status key [#4544]
• fix: addon JSON pointers [#4508]
• Fix apparmorProfile being ignored when it's the only field [#4507]
• Sanitize strings in table output [#4466]
• Cleanup openapi generation [#4331]
• Support github refresh tokens [#3811]
• Fix not working overflow on repo list message [#4420]
• Fix avatar column type [#4340]
• fix error="io: read/write on closed pipe" on k8s backend [#4281]
• Move update notifier dot into settings button [#4334]
• gitea: add check if pull_request webhook is missing pull info [#4305]
• Refresh token before loading branches [#4284]
• Delete GitLab webhooks with partial URL match [#4259]
• Increase WOODPECKER_FORGE_TIMEOUT to fix config fetching for GitLab [#4262]
• Ensure cli exec has by default not the same prefix [#4132]
• Fix repo add loading spinner [#4135]
• Fix migration registries table [#4111]
• Wait for tracer to be done before finishing workflow [#4068]
• Fix schema with detached steps [#4066]
• Fix schema with commands and entrypoint [#4065]
• Read long log lines from file storage correctly [#4048]
• Set refspec for gitlab MR [#4021]
• Set CI_PREV_COMMIT_{SOURCE,TARGET}_BRANCH as mentioned in the documentation [#4001]
• [Bitbucket Datacenter] Return empty list instead of null [#4010]
• Fix BB PR pipeline ref [#3985]
• Change Bitbucket PR hook to point the source branch, commit & ref [#3965]
• Add updated, merged and declined events to bb webhook activation [#3963]
• Fix login via navbar [#3962]
• Truncate creation in list [#3952]
• Fix panic if forge is unreachable [#3944]

📚 Documentation

• Show client flags [#4542]
• chore(deps): update react monorepo to v19 (major) [#4523]
• chore(deps): update docs npm deps non-major [#4519]
• chore(deps): lock file maintenance [#4502]
• chore(deps): lock file maintenance [#4501]
• chore(deps): update dependency isomorphic-dompurify to v2.18.0 [#4493]
• fix(deps): update docs npm deps non-major [#4484]
• Add migration notes for restructured cli commands [[#4476](https://github.com/woodpecker-ci/woo...

2.8.1

2.8.1 - 2024-12-13

❤️ Thanks to all contributors! ❤️

@j04n-f, @jolheiser

🐛 Bug Fixes

• Add Bitbucket fixes to Release/2.8 [#4547]
• fix: addon JSON pointers (#4508) [#4512]

2.8.0

2.8.0 - 2024-11-28

❤️ Thanks to all contributors! ❤️

@6543, @anbraten, @pat-s, @hg

🔒 Security

• Extend approval options (#3348) [#4429]

✨ Features

• Docker Backend: fully support windows container (#4381) [#4464]

🐛 Bug Fixes

• Enforce exact matching for GitLab groups (#4473) [#4474]
• Normalize aarch64 -> arm64 for docker backend (#4451) [#4457]
• Add migration to autofix corrupted users.org_id entrys in db (#4307) [#4327]

📈 Enhancement

• Deprecate secrets in favor of from_secret [#4360]
• Deprecate and warn of list syntax of environment [#4358]
• Process workflow logs in batches (#4045) [#4356]

Misc

• Use release-helper for release/* branches [#4302]

2.7.3

Changelog

2.7.3 - 2024-11-05

Important

To secure your instance, set WOODPECKER_PLUGINS_PRIVILEGED to only allow specific versions of the woodpeckerci/plugin-docker-buildx plugin, use version 5.0.0 or above. This prevents older, potentially unstable versions from being privileged.

For example, to allow only version 5.0.0, use:

WOODPECKER_PLUGINS_PRIVILEGED=woodpeckerci/plugin-docker-buildx:5.0.0

To allow multiple versions, you can separate them with commas:

WOODPECKER_PLUGINS_PRIVILEGED=woodpeckerci/plugin-docker-buildx:5.0.0,woodpeckerci/plugin-docker-buildx:5.1.0

This setup ensures only specified, stable plugin versions are given privileged access.

Read more about it in #4213

❤️ Thanks to all contributors! ❤️

@anbraten

🐛 Bug Fixes

• Upgrade vue-i18n [#4298]

Misc

• Bump release plugin [#4311]
• Use release-helper for release/* branches [#4300]

2.7.2

Changelog

2.7.2 - 2024-11-03

Important

To secure your instance, set WOODPECKER_PLUGINS_PRIVILEGED to only allow specific versions of the woodpeckerci/plugin-docker-buildx plugin, use version 5.0.0 or above. This prevents older, potentially unstable versions from being privileged.

For example, to allow only version 5.0.0, use:

WOODPECKER_PLUGINS_PRIVILEGED=woodpeckerci/plugin-docker-buildx:5.0.0

To allow multiple versions, you can separate them with commas:

WOODPECKER_PLUGINS_PRIVILEGED=woodpeckerci/plugin-docker-buildx:5.0.0,woodpeckerci/plugin-docker-buildx:5.1.0

This setup ensures only specified, stable plugin versions are given privileged access.

Read more about it in #4213

❤️ Thanks to all contributors! ❤️

@6543, @anbraten, @j04n-f, @pat-s, @qwerty287

🔒 Security

• Chore(deps): update dependency vite to v5.4.6 [security] (#4163) [#4187]

🐛 Bug Fixes

• Don't parse forge config files multiple times if no error occured (#4272) [#4273]
• Fix repo/owner parsing for gitlab (#4255) [#4261]
• Run queue.process() in background [#4115]
• Only update agent.LastWork if not done recently (#4031) [#4100]

Misc

• Backport JS dependency updates [#4189]

2.7.1

2.7.1 - 2024-09-07

❤️ Thanks to all contributors! ❤️

@6543, @anbraten, @j04n-f, @qwerty287, @dvjn

🔒 Security

• Lint privileged plugin match and allow to be set empty [#4084]
• Allow admins to specify privileged plugins by name and tag [#4076]
• Warn if using secrets/env with plugin [#4039]

🐛 Bug Fixes

• Set refspec for gitlab MR [#4021]
• Change Bitbucket PR hook to point the source branch, commit & ref [#3965]
• Add updated, merged and declined events to bb webhook activation [#3963]
• Fix login via navbar [#3962]
• Fix panic if forge is unreachable [#3944]
• Fix org settings page [#4093]

Misc

• Bump github.com/docker/docker from v24.0.9 to v24.0.9+30 [#4077]

2.7.0

2.7.0 - 2024-07-18

❤️ Thanks to all contributors! ❤️

@6543, @anbraten, @dvjn, @hhamalai, @lafriks, @pat-s, @qwerty287, @smainz, @tongjicoder, @zc-devs

❤️ Special thanks the security researchers and those who fixed them ❤️

• Daniel Kilimnik @D_K_Dev (Neodyme AG) reporting the bugs and orchestrating the communication
• Felipe Custodio Romero @localo (Neodyme AG) finding the bugs
• @6543 fixing the bugs and orchestrating the communication

🔒 Security

• Add blocklist of environment variables who could alter execution of plugins [#3934]
• Make sure plugins only mount the workspace base in a predefinde location [#3933]
• Disallow to set arbitrary environments for plugins [#3909]
• Use proper oauth state [#3847]
• Enhance token checking [#3842]
• Bump github.com/hashicorp/go-retryablehttp v0.7.5 -> v0.7.7 [#3834]

✨ Features

• Gracefully shutdown server [#3896]
• Gracefully shutdown agent [#3895]
• Convert urls in logs to links [#3904]
• Allow login using multiple forges [#3822]
• Global and organization registries [#1672]
• Cli get repo from git remote [#3830]
• Add api for forges [#3733]

📈 Enhancement

• Cli fix pipeline logs [#3913]
• Migrate to github.com/urfave/cli/v3 [#2951]
• Allow to change the working directory also for plugins and services [#3914]
• Remove unplugin-icons [#3809]
• Release windows binaries as zip file [#3906]
• Convert to openapi 3.0 [#3897]
• Add user registries UI [#3888]
• Sort users by login [#3891]
• Exclude dummy backend in production [#3877]
• Fix deploy task env [#3878]
• Get default branch and show message in pipeline list [#3867]
• Add timestamp for last work done by agent [#3844]
• Adjust logger types [#3859]
• Cleanup state reporting [#3850]
• Unify DB tables/columns [#3806]
• Let webhook pass on pipeline parsing error [#3829]
• Exclude mocks from release build [#3831]
• K8s secrets reference from step [#3655]

🐛 Bug Fixes

• Handle empty repositories in gitea when listing PRs [#3925]
• Update alpine package dep for docker images [#3917]
• Don't report error if agent was terminated gracefully [#3894]
• Let agents continuously report their health [#3893]
• Ignore warnings for cli exec [#3868]
• Correct favicon states [#3832]
• Cleanup of the login flow and tests [#3810]
• Fix newlines in logs [#3808]
• Fix authentication error handling [#3807]

📚 Documentation

• Streamline docs for new users [#3803]
• Add mastodon verification [#3843]
• chore(deps): update docs npm deps non-major [#3837]
• fix(deps): update docs npm deps non-major [#3824]
• Add openSUSE package [#3800]
• chore(deps): update docs npm deps non-major [#3798]
• Add "Docker Tags" Plugin [#3796]
• chore(deps): update dependency marked to v13 [#3792]
• chore: fix some comments [#3788]

Misc

• chore(deps): update web npm deps non-major [#3930]
• chore(deps): update dependency vitest to v2 [#3905]
• fix(deps): update module github.com/google/go-github/v62 to v63 [#3910]
• chore(deps): update docker.io/woodpeckerci/plugin-docker-buildx docker tag to v4.1.0 [#3908]
• Update plugin-git and add renovate trigger [#3901]
• chore(deps): update docker.io/mstruebing/editorconfig-checker docker tag to v3.0.3 [#3903]
• fix(deps): update golang-packages [#3875]
• chore(deps): lock file maintenance [#3876]
• [pre-commit.ci] pre-commit autoupdate [#3862]
• Add dummy backend [#3820]
• chore(deps): update dependency replace-in-file to v8 [#3852]
• Update forgejo sdk [#3840]
• chore(deps): lock file maintenance [#3838]
• Allow to set dist dir using env var [#3814]
• chore(deps): lock file maintenance [#3805]
• chore(deps): update docker.io/lycheeverse/lychee docker tag to v0.15.1 [#3797]

2.6.1

2.6.1 - 2024-07-19

🔒 Security

• Add blocklist of environment variables who could alter execution of plugins [#3934]
• Make sure plugins only mount the workspace base in a predefinde location [#3933]
• Disalow to set arbitrary environments for plugins [#3909]
• Bump trivy plugin version and remove unused variable [#3833]

🐛 Bug Fixes

• Let webhook pass on pipeline parsion error [#3829]
• Fix newlines in logs [#3808]

2.6.0

2.6.0 - 2024-06-13

❤️ Thanks to all contributors! ❤️

@6543, @anbraten, @jcgl17, @pat-s, @qwerty287, @s00500, @wez, @zc-devs

🔒 Security

• Bump trivy plugin version and remove unused variable [#3759]

✨ Features

• Allow to store logs in files [#3568]
• Native forgejo support [#3684]

🐛 Bug Fixes

• Add release event to webhooks [#3784]
• Respect cli argument when checking docker backend availability [#3770]
• Fix repo creation [#3756]
• Fix config loading of cli [#3764]
• Fix missing WOODPECKER_BITBUCKET_DC_URL [#3761]
• Correct repo repair success message in cli [#3757]

📈 Enhancement

• Improve step logging [#3722]
• chore(deps): update dependency eslint to v9 [#3594]
• Show workflow names if there are multiple configs [#3767]
• Use http constants [#3766]
• Spellcheck "server/*" [#3753]
• Agent-wide node selector [#3608]

📚 Documentation

• Remove misleading crontab guru suggestion from docs [#3781]
• Add documentation for KUBERNETES_SERVICE_HOST in Agent [#3747]
• Remove web.archive.org workaround in docs [#3771]
• Serve plugin icons locally [#3768]
• Docs: update local backend page [#3765]
• Remove old docs versions [#3743]
• Merge release plugins [#3752]
• Split FAQ [#3746]

Misc

• Update nix flake [#3780]
• chore(deps): lock file maintenance [#3783]
• chore(deps): update pre-commit hook golangci/golangci-lint to v1.59.1 [#3782]
• fix(deps): update codeberg.org/mvdkleijn/forgejo-sdk/forgejo digest to 168c988 [#3776]
• chore(deps): lock file maintenance [#3750]
• chore(deps): update gitea/gitea docker tag to v1.22 [#3749]
• Fix setting name [#3744]