Concourse Files

What's Changed

🚨 Breaking Changes

• Chown bind-mount volumes when running as non-root user by @taylorsilva in https://github.com/concourse/concourse/pull/9593

✈️ Features

• atc: behaviour: add origin_pipeline to OPA payload by @Petahhh in https://github.com/concourse/concourse/pull/9583
• Remove inline scripts and styles to enable strict CSP by @Kump3r in https://github.com/concourse/concourse/pull/9596
• feat: add validation for team names to prevent '/' characters in rename-team command by @IvanChalukov in https://github.com/concourse/concourse/pull/9600
• Add job and step-level tags for do and in_parallel steps by @taylorsilva in https://github.com/concourse/concourse/pull/9606
• Add configurable stall timeout to auto-prune long-stalled workers by @blarghmatey in https://github.com/concourse/concourse/pull/9604
• Privileged mode fuse-only supports buildkit-based container building by @Kump3r in https://github.com/concourse/concourse/pull/9612
• add --force flag to fly's abort-build command by @taylorsilva in https://github.com/concourse/concourse/pull/9611
• Add hide_ui query param to hide web UI elements by @taylorsilva in https://github.com/concourse/concourse/pull/9625
• add shared path support to credhub CONCOURSE_CREDHUB_SHARED_PATH by @VikranthBala in https://github.com/concourse/concourse/pull/9615
• feat: Add health endpoint basic structures and routes by @Kump3r in https://github.com/concourse/concourse/pull/9588
• add: Health endpoint go-client methods and fly command by @Kump3r in https://github.com/concourse/concourse/pull/9640
• Allow workers to configure their own max active tasks CONCOURSE_MAX_ACTIVE_TASKS by @taylorsilva in https://github.com/concourse/concourse/pull/9627
• Have pipeline collector destroy archived pipelines after some duration (opt-in) by @taylorsilva in https://github.com/concourse/concourse/pull/9630
• fix: Hermetic doesn't configure hosts on the containers by @Kump3r in https://github.com/concourse/concourse/pull/9634
• add shared path support to kubernetes, CONCOURSE_KUBERNETES_SHARED_PATH by @VikranthBala in https://github.com/concourse/concourse/pull/9643
• Add CONCOURSE_CUSTOM_HTTP_HEADERS allowing operators to set multiple headers on all HTTP responses by @AtanasNikov in https://github.com/concourse/concourse/pull/9618
• web: instance groups: add list view by @bcersows in https://github.com/concourse/concourse/pull/9626

🐞 Bug Fixes

• Use session signing key to derive state signing key by @taylorsilva in https://github.com/concourse/concourse/pull/9579
• bump dex to fix CF connector by @taylorsilva in https://github.com/concourse/concourse/pull/9580
• unescape the redirect uri before further parsing it by @taylorsilva in https://github.com/concourse/concourse/pull/9587
• set flex-shrink to zero on icons in resource page to avoid shrinkage by @taylorsilva in https://github.com/concourse/concourse/pull/9591
• fix how resources with check_every: never are handled when scheduling builds by @taylorsilva in https://github.com/concourse/concourse/pull/9598
• Use os.Root when extracting files by @taylorsilva in https://github.com/concourse/concourse/pull/9601
• fix: split container property labels on rune boundaries by @kurtmc in https://github.com/concourse/concourse/pull/9602
• Make aborting jobs faster when the worker disappears by @taylorsilva in https://github.com/concourse/concourse/pull/9607
• fix: Resource cache cleanup errors with Postgresql 18 by @Kump3r in https://github.com/concourse/concourse/pull/9621
• Fix: Jobs stuck in pending state until resource manually checked or check interval elapsed by @taylorsilva in https://github.com/concourse/concourse/pull/9622
• Prevent wall banner from overlapping page content when scrolling by @ceco556 in https://github.com/concourse/concourse/pull/9624
• normalize symlink path since root.Symlink doesn't on Windows by @taylorsilva in https://github.com/concourse/concourse/pull/9610
• Workaround for root.MkdirAll bug by @taylorsilva in https://github.com/concourse/concourse/pull/9637
• sec: fix worker OOM via unbounded /etc/passwd and /etc/group parsing by @IvanChalukov in https://github.com/concourse/concourse/pull/9642
• skymarshal: behaviour: handle RFC 8693 token-exchange responses by @ibaileyStingray in https://github.com/concourse/concourse/pull/9638
• atc: Check pinned resources whose pinned version doesn't exist in the version history by @taylorsilva in https://github.com/concourse/concourse/pull/9652
• Fail put step when saving output fails by @aliculPix4D in https://github.com/concourse/concourse/pull/9658
• worker: add --numeric-owner to tar commands when streaming volumes by @taylorsilva in https://github.com/concourse/concourse/pull/9663
• scheduler: fix scheduling for jobs with serial: true and check_every: never resource(s) by @taylorsilva in https://github.com/concourse/concourse/pull/9670
• fly: copy stdin buffer before sending hijack input by @lodener in https://github.com/concourse/concourse/pull/9668
• Verify worker's team when landing/retiring workers by @taylorsilva in https://github.com/concourse/concourse/pull/9676
• Security tightening of API endpoints by @taylorsilva in https://github.com/concourse/concourse/pull/9680
• fix regression in HD view when there are multiple columns of pipelines by @taylorsilva in https://github.com/concourse/concourse/pull/9683

🛠️ Misc. Changes

• Remove legacy X-XSS-Protection response header by @IvanChalukov in https://github.com/concourse/concourse/pull/9576
• Security: upgrade golang.org/x/crypto to v0.52.0 by @IvanChalukov in https://github.com/concourse/concourse/pull/9589
• Enhance fly health output and auth handling by @IvanChalukov in https://github.com/concourse/concourse/pull/9644
• atc: Have EOF errors from checks treated as no versions found by @taylorsilva in https://github.com/concourse/concourse/pull/9639
• baggageclaim api tests: fix missing asserts on errors by @aliculPix4D in https://github.com/concourse/concourse/pull/9650
• fix tarfs absolute symlink test for Windows by @aliculPix4D in https://github.com/concourse/concourse/pull/9654
• go-archive:tarfs: test relative and absolute symlink extraction by @aliculPix4D in https://github.com/concourse/concourse/pull/9655
• Fix go-archive PATH stubbing for cross-platform tests by @aliculPix4D in https://github.com/concourse/concourse/pull/9656
• go-archives: symlink extraction attack tests by @aliculPix4D in https://github.com/concourse/concourse/pull/9657
• improve type casting and checking in vault client by @taylorsilva in https://github.com/concourse/concourse/pull/9677

📦 Bundled Resource Types

New Contributors

• @Petahhh made their first contribution in https://github.com/concourse/concourse/pull/9583
• @blarghmatey made their first contribution in https://github.com/concourse/concourse/pull/9604
• @VikranthBala made their first contribution in https://github.com/concourse/concourse/pull/9615
• @ibaileyStingray made their first contribution in https://github.com/concourse/concourse/pull/9638
• @AtanasNikov made their first contribution in https://github.com/concourse/concourse/pull/9618
• @bcersows made their first contribution in https://github.com/concourse/concourse/pull/9626
• @lodener made their first contribution in https://github.com/concourse/concourse/pull/9668

Full Changelog: https://github.com/concourse/concourse/compare/v8.2.4...v8.3.0