📦 Bundled Resource Types
- bosh-io-release: [v1.3.7](https://github.com/concourse/bosh-io-release-resource/releases/tag/v1.3.7)
- bosh-io-stemcell: [v1.7.2](https://github.com/concourse/bosh-io-stemcell-resource/releases/tag/v1.7.2)
- docker-image: [v1.13.4](https://github.com/concourse/docker-image-resource/releases/tag/v1.13.4)
- git: [v1.24.1](https://github.com/concourse/git-resource/releases/tag/v1.24.1)
- github-release: [v1.14.3](https://github.com/concourse/github-release-resource/releases/tag/v1.14.3)
- hg: [v1.5.7](https://github.com/concourse/hg-resource/releases/tag/v1.5.7)
- mock: [v0.14.8](https://github.com/concourse/mock-resource/releases/tag/v0.14.8)
- pool: [v1.8.4](https://github.com/concourse/pool-resource/releases/tag/v1.8.4)
- registry-image: [v1.19.1](https://github.com/concourse/registry-image-resource/releases/tag/v1.19.1)
- s3: [v2.5.7](https://github.com/concourse/s3-resource/releases/tag/v2.5.7)
- semver: [v2.0.5](https://github.com/concourse/semver-resource/releases/tag/v2.0.5)
- time: [v1.11.6](https://github.com/concourse/time-resource/releases/tag/v1.11.6)
⚠️ Behavior Changes
- OIDC providers with RSA keys larger than 4096 bits. The fix for CVE-2026-116587 makes go-jose reject RSA keys larger than 4096 bits. Concourse reads the whole key set from your provider's
jwks_uri. If any key in that set is larger than 4096 bits, every login through the OIDC connector (--oidc-*/CONCOURSE_OIDC_*) fails withoidc: failed to decode keys: ... modulus too large. Large hosted providers use 2048-bit keys. Check self-hosted providers, such as Keycloak with imported keys, before you upgrade. Concourse's own keys are not affected, including the session signing key and the ID-token signing keys. - A negative
--concurrent-request-limitnow stops the web node from starting. For example,ListAllJobs:-1now makes the web node exit at startup withpanic: semaphore: size < 0. Before, a negative limit made every request to that endpoint return 503. To disable the endpoint, use0, which returns 501. To limit it, use a positive number. This comes from golang.org/x/sync v0.24.0, which the x/net fix requires.
🛡️ Security Fixes
concoursebinary: CVE-2026-116587 (go-jose), CVE-2026-78669, CVE-2026-78661 and CVE-2026-97045 (golang.org/x/net), and CVE-2026-84445 (gRPC).gdn: CVE-2026-111943 (built with go1.27.3).- Bundled resource types: CVE-2026-111497 (brotli) in every resource type except git, which already had the fix. Also CVE-2026-111943 and CVE-2026-114613 (pip) in hg, and CVE-2026-116587 (containerd) in docker-image.
🔓 Known Vulnerabilities
The bundled containerd and runc binaries are built from their latest upstream releases (containerd v2.4.2, runc v1.5.2). Those releases still carry vulnerable Go dependencies. We will pick up fixed versions in a later patch release once upstream ships them.
| Binary | CVE | Dependency |
|---|---|---|
containerd |
CVE-2026-116587, CVE-2026-78669 | go-jose/v4 v4.1.5, golang.org/x/net v0.58.0 |
containerd-shim-runc-v2, ctr |
CVE-2026-78669 | golang.org/x/net v0.58.0 |
runc |
CVE-2026-46600, CVE-2026-78669 | golang.org/x/net v0.55.0 |
What's Changed
🐞 Bug Fixes
- 8.3.x: Bump go-jose/v4, x/net and grpc to fix CVE-2026-116587, CVE-2026-78669, CVE-2026-84445 by @drich10 in https://github.com/concourse/concourse/pull/9779
Full Changelog: https://github.com/concourse/concourse/compare/v8.3.2...v8.3.3
