chore(deps): update semaphoreui/semaphore docker tag to v2.19.16

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
semaphoreui/semaphore	final	minor	v2.16.45 → v2.19.16

---

Release Notes

semaphoreui/semaphore (semaphoreui/semaphore)

v2.19.16

Compare Source

Configurable runner check interval

Runners can now be told how often to ask the server for new jobs. Until now the interval was hard-coded to 1 second, which on installations with many runners produced a noticeable amount of request traffic.

New option in the runner section of the runner config:

{
  "runner": {
    "check_interval_seconds": 5
  }
}

Or via environment variable:

SEMAPHORE_RUNNER_CHECK_INTERVAL_SECONDS=5

Default: 1 second, so existing installations behave exactly as before. Values of 0, negative values, or values too large to represent as a duration fall back to the default.

What changes and what does not. Only the check for new jobs honours the configured interval. The runner's progress report, which also serves as its heartbeat, keeps running once per second. Raising the check interval therefore does not affect when the server marks a runner offline. Jobs will start up to check_interval_seconds later than before, so pick a value that matches how quickly you need new tasks to be picked up.

Affected components: runner (semaphore runner start), config schema. No database migration, no changes to the server or the web interface.

v2.19.15

Compare Source

v2.19.14

Compare Source

v2.19.12

Compare Source

Bogfixes

• Fixed bug with runner configuration on registration step.

v2.19.11

Compare Source

Changelog

• 0c3f373 test(db): add tests for db migration

v2.19.10

Compare Source

v2.19.9

Compare Source

v2.19.8

Compare Source

Bugfixes

• Fixed SQLite migration

v2.19.7

Compare Source

Semaphore UI v2.19

Highlights

• Workflows — build multi-template pipelines with a graphical editor
• Docker and Kubernetes executors — run tasks in containers/pods instead of on the server (Pro/Enterprise)
• JWT / OIDC ID tokens for tasks — keyless auth to Vault, AWS, GCP, Azure
• Encryption key rotation with a labelled keyring
• Real server-side pagination for task history — projects with millions of tasks no longer choke
• BoltDB removed — SQLite/MySQL/Postgres only
• A large batch of security hardening across the API

Workflows

A workflow is a graph of task templates that run as one unit.

• Graphical editor at /workflows/new and /workflows/:id/edit (Drawflow-based), with palette
  drag-and-drop, edge condition selectors, live cycle/self-edge guards, a validation problems panel,
  and auto-layout for position-less workflows. Node positions are persisted.
• Node kinds: task (runs a template), approval (gates the run, with timeout and message), and
  note (free-form annotation, never executed).
• Per-node task parameters (task_params_id on workflow nodes).
• API: /project/{id}/workflows (CRUD), /{workflow_id}/run, /runs,
  /runs/{run_id}/{stop,artifacts,approvals}, POST /runs/{run_id}/approvals/{node_id}.

Executors: Docker and Kubernetes (Pro/Enterprise)

Runners can now execute tasks in a container or a pod instead of directly on the runner host.

• Kubernetes (runner.executor.k8s): kubeconfig, namespace (default semaphore), image,
  helper_image, service_account, pull_secrets, poll_interval_seconds, cleanup_grace_seconds.
• Docker (runner.executor.docker): host, tls_verify, cert_path, image, helper_image,
  network, pull_policy, cpu_limit, memory_limit, privileged (off by default), poll/cleanup
  timings.
• Each option also has a SEMAPHORE_RUNNER_K8S_* / SEMAPHORE_RUNNER_DOCKER_* environment variable.
• New semaphoreui/job and semaphoreui/helper images are built and published by CI; the job image
  ships Terraform/OpenTofu/Terragrunt and paramiko.
• Per-template executor image — a template can override the container image used for its tasks
  (project__template.executor_image).

Task JWT / OIDC ID tokens

Semaphore can now act as an OIDC provider for running tasks, so jobs authenticate to external systems
without long-lived credentials.

• Short-lived ECDSA-signed JWTs issued per task, published via GET /.well-known/jwks.json.
• Per-template JWT options (multiple audiences, per-token TTL) configured in the template form; claims
  carry IDs only.
• Config block jwt: enabled, issuer, default_ttl (1h), max_ttl (24h), with SEMAPHORE_JWT_*
  env vars.
• Template JWT params persisted in project__template.jwt_params.

Secrets & encryption

• Encryption key rotation. New encryption config block with a labelled keyring: inline keys
  (value or file), or a keys_folder where each file is a key named by its filename, plus
  active.secret_key / active.option_key pointers. Ciphertext now carries a key ID, so keys can be
  rotated without a big-bang re-encrypt. keys_file + keys_poll_interval (default 15s) allow hot
  reload. The legacy flat access_key_encryption still works and is used when encryption is unset.
• option_encryption — separate key for encrypting DB-stored options.
• Survey secret variables now work on remote runners and in HA. Previously a survey secret value
  lived only in the memory of the node that accepted the task, so it arrived empty on remote runners
  and was lost across restarts. Secrets are now persisted as task-bound access keys
  (access_key.task_id, access_key.expire_at, cascade-deleted with the task); TTL is derived from
  MaxTaskDurationSec (+1h queue allowance, 24h when unlimited).
• OpenBao secret storage type (routed through the Vault provider), with its own icon in the UI.
• TLS-skip-verify checkbox for Vault/OpenBao storages.
• Synchronized and read-only secret fields are no longer wiped on update.

Runners

• Online/offline status shown on the Runners page, derived from heartbeat liveness (webhook-driven
  runners are always dispatch candidates).
• Hung-task recovery. Runners report their process start time (X-Runner-Started-At, stored in
  runner.started_at), which lets the server detect a runner that restarted and silently lost its
  in-memory job pool. starting tasks are reassigned to a healthy runner; running tasks get a
  recovery window and are then failed with a clear message. Tunables in the new runners config
  block: offline_timeout_sec (120), task_fail_timeout_sec (420), reconcile_interval_sec (30).
• Tasks reassigned away from a runner are terminated on the old runner.
• Per-runner RSA encryption keys removed — secrets are protected by TLS on the wire instead. This
  removes ~380 lines of key-exchange code from the runner protocol.
• Runner registration tokens are stored hashed, with an expiry; invalid registration tokens are
  rejected with 400, and token prefixes are validated.
• Fixed a TCP connection leak in the runner client.
• Runner options moved into a dedicated runners config struct (old flat options still read).
• The active flag was dropped from runner registration; only registered runners are used.

Performance & scale

• Keyset pagination for task history. The history page used to fetch the 200 newest tasks and page
  through them client-side. The backend now returns one page at a time via a before cursor +
  count (legacy limit still accepted), with no COUNT(*) and no OFFSET — so page depth no
  longer degrades on projects with millions of tasks. Applies to project history, template task lists
  (/templates/{id}/tasks, /tasks/last, /stats) and the dashboard.
• Task lists reload at most once every 5 seconds; several redundant UI requests removed.
• Git operations are serialized per repository directory (KeyLock). Templates with
  AllowParallelTasks=true shared one working copy, and concurrent git pull + git checkout could
  corrupt it. updateRepository() + checkoutRepository() is now one critical section, covering both
  local and runner execution. Inventory repo operations are serialized the same way.
• BoltDB removed. SQLite replaces it everywhere, including session storage; the
  permanent-connection flag is gone.
• Stale HA pool state is released on duplicate finalize.

Templates, tasks & UI

• Dynamic playbook picker — the template form lists actual playbook files from the repository
  (GET /repositories/{repository_id}/playbooks) instead of requiring a hand-typed path. Playbooks
  reset when the branch changes, and branch-load failures no longer block the playbook list.
• Survey variable target — a survey var can now be delivered as a process environment variable
  (target: "env") instead of the app-specific CLI way (--extra-vars / -var / CLI arg). The env
  var name is the variable name verbatim, so TF_VAR_foo works. Stored in the existing survey_vars
  JSON — no migration.
• New survey variable types: int, text (multiline), and restyled enum.
• Typed variables in variable groups (including int).
• Skip Ansible Galaxy install — per-template and per-task option to skip role/collection
  requirement installation.
• Dropdown cards for JWT and schedule sections in the template form; new DropdownCard /
  HighlightedCard components.
• Czech translation added.
• Copy-to-clipboard icon is visible in light mode; running-task spinners fixed; template form bottom
  padding fixed.
• Schedules are validated with the server-side cron parser (client and server no longer disagree).
• Integration variable extraction preserves JSON objects and arrays instead of stringifying them.

Observability

• Prometheus metrics. New metrics config block (enabled, username, password, plus
  SEMAPHORE_METRICS_*) exposing /api/metrics with Go/process collectors,
  semaphore_tasks_running (gauge) and semaphore_tasks_total{status} (counter). The endpoint is off
  by default and can be protected with basic auth.
• Namespaced debug logging. A Node.js debug-style filter via --debug-filter /
  SEMAPHORE_DEBUG_FILTER lets you turn on verbose tracing for one subsystem (runners, LDAP,
  schedules, git) without the noise from everything else. Applies to syslog hooks too.
  SEMAPHORE_LOG_LEVEL / --log-level behave exactly as before.
• Many new contextual debug statements across runners, tasks and auth.
• SSH host key checking is configurable: ssh.known_hosts_file, ssh.config_path,
  ssh.strict_host_key_checking (no / yes / accept-new). With no known-hosts file configured,
  Semaphore uses a persistent trust-on-first-use file under TmpPath — first connection pinned, later
  host-key changes rejected.

Security

• Changing a password or managing 2FA/TOTP now requires the current password (CWE-620 —
  unverified password change).
• Origin/Referer validation on state-changing requests (CSRF hardening).
• Session cookies marked Secure over HTTPS.
• Custom role creation now checks the caller's permissions.
• Task branch override is only allowed when the template sets AllowOverrideBranchInTask.
• Git URL validation; --end-of-options passed to git so a crafted ref cannot be read as a flag;
  commit hashes format-checked; branches validated before repository browsing; playbook paths
  validated.
• Access key payloads validated; template app validated.
• Project/integration ID ownership verified on integration API requests; template_id verified on
  vault update.
• Runner tokens are no longer written into project backups.
• API returns after a write error instead of continuing with a partially written response.
• Runner per-runner encryption keys removed in favour of transport TLS.
• Fixed a nil-pointer panic when closing an uninitialized DB.
• CodeQL: potential integer overflow in allocation size computation.
• Security SLA published in SECURITY.md; release artifacts signed with the
  security@semaphoreui.com GPG key.

---

Upgrade notes

Breaking / behavioural changes

1. BoltDB is gone. If you are still running a BoltDB installation, migrate to SQLite (or
   MySQL/Postgres) before upgrading. bolt is no longer a valid dialect.
2. Runner encryption keys removed. Runners and server must both be on 2.19; the key-exchange step
   no longer exists. Make sure runner↔server traffic is TLS-protected.
3. Task list APIs are paginated. GET /project/{id}/tasks and the template task endpoints return
   one page and take a before cursor plus count. limit is still accepted for backward
   compatibility, but clients relying on getting the newest 200 tasks in one response must page.
4. Runner active flag removed from registration.
5. Project backups no longer contain runner tokens — re-register runners rather than expecting a
   restore to carry credentials.

New configuration

encryption, jwt, metrics, runners, ssh, runner.executor.{docker,k8s},
ldap_tls_skip_verify, option_encryption, external_auth_email_matching.

All are optional; existing configs keep working. use_remote_runner and the flat runner options are
deprecated in favour of runners. The JSON schema (config.schema.yaml) and the config-option
reference docs have been regenerated.

Documentation

Docs are now a git submodule and are embedded in the binary, so they ship offline. New/updated pages:
Docker & Kubernetes executors, encryption and key rotation, JWT auth during task execution, OpenBao
secret storage, IdP-initiated OIDC, PingFederate TLS, license activation, dev setup, logging, runner
registration, and regenerated CLI reference.

Dependencies & build

Go 1.26.5; Debian 13 and Alpine 3.24 base images; go-git 5.19.2, go-oidc 3.20.0,
golang.org/x/crypto 0.54.0, go-ldap 3.4.14, modernc.org/sqlite 1.54.0; frontend axios 1.19,
cron-parser 5.7, nanoid 6, shell-quote 1.10. MariaDB 12.1 migration compatibility fixed.
THIRD-PARTY-LICENSES.md regenerated.

Known gaps

Two plans in AGENTS/plans/2_19 did not ship in this line and are still open:
password-hash-argon2id (bcrypt → Argon2id) and runner-token-hash (hashing the runner bearer token
itself — only registration tokens are hashed today). The runner-version-platform-uptime plan
shipped partially: uptime and online/offline status landed, but runner version/OS/arch columns did
not.

v2.19.6

Compare Source

v2.18.31

Compare Source

Configurable runner check interval

Runners can now be told how often to ask the server for new jobs. Until now the interval was hard-coded to 1 second, which on installations with many runners produced a noticeable amount of request traffic.

New option in the runner section of the runner config:

{
  "runner": {
    "check_interval_seconds": 5
  }
}

Or via environment variable:

SEMAPHORE_RUNNER_CHECK_INTERVAL_SECONDS=5

Default: 1 second, so existing installations behave exactly as before. Values of 0, negative values, or values too large to represent as a duration fall back to the default.

What changes and what does not. Only the check for new jobs honours the configured interval. The runner's progress report, which also serves as its heartbeat, keeps running once per second. Raising the check interval therefore does not affect when the server marks a runner offline. Jobs will start up to check_interval_seconds later than before, so pick a value that matches how quickly you need new tasks to be picked up.

Affected components: runner (semaphore runner start), config schema. No database migration, no changes to the server or the web interface.

v2.18.30

Compare Source

Bogfixes

• Fixed bug with runner configuration on registration step.

v2.18.29

Compare Source

Changelog

• 91719b9 fix(secrets): do not remove synchronized fields and readonly secrets

v2.18.28

Compare Source

Bugfixes

• Validate schedule cron format using backend endpoint instead of JS library

v2.18.27

Compare Source

Changelog

• 240e595 fix(templates): validate app

v2.18.26

Compare Source

Changelog

• ee781a0 feat(auth): verify current password to fix CWE-620

v2.18.25

Compare Source

Changelog

• 7c3789c fix(runners): close connections

v2.18.24

Compare Source

v2.18.23

Compare Source

Changelog

• 74d8dd5 feat(ui): placeholder for enterprise storages

v2.18.22

Compare Source

Changelog

• debf7a0 feat(ui): return extra vars for secrets

v2.18.21

Compare Source

Changelog

• 2d6e2e3 feat: secure flag for session when https enabled

v2.18.20

Compare Source

Bugfixes

• Validate playbook path

v2.18.19

Compare Source

v2.18.19 Release Summary

This patch release includes several important security and validation fixes.

Security fixes

• Added validation for Git repository URLs to prevent Git option injection.
• Added --end-of-options to Git commands to make repository URL and branch handling safer.
• Fixed branch override handling: task-level Git branch override is now applied only when the template explicitly allows it.
• Prevented custom roles from shadowing built-in role slugs such as owner or manager.
• Fixed permission resolution so built-in roles always use their built-in permissions instead of database-defined custom roles.
• Added validation to prevent access keys from being updated with a different ID or moved to another project.

Reliability and tests

• Added tests for Git URL validation and Git command injection protection.
• Added tests for access key update validation.
• Added tests for custom role validation and reserved role slugs.
• Refactored Git branch resolution into a dedicated helper to make task behavior more consistent.

v2.18.18

Compare Source

v2.18.17

Compare Source

v2.18.16

Compare Source

Bugfixes

• Fix variable groups sync functionality

v2.18.15

Compare Source

v2.18.14

Compare Source

v2.18.12

Compare Source

Features

• Checkbox Skip Galaxy install

v2.18.10

Compare Source

v2.18.9

Compare Source

Changelog

• 0a37ea2 feat(cli): allow create token

v2.18.8

Compare Source

Changelog

• 459ccee ci: fix branch

v2.18.5

Compare Source

v2.18.4

Compare Source

Changelog

• 7ca373d fix(docker): check reg token file

What's Changed

• truncate commit message by runes, not bytes by @​4n70w4 in #​3836
• fix(db): honor legacy environment_id when saving templates by @​cursor[bot] in #​3841
• api-docs: align spec with actual REST API behavior by @​Omicron7 in #​3852

New Contributors

• @​4n70w4 made their first contribution in #​3836

Full Changelog: semaphoreui/semaphore@v2.18.2...v2.18.4

v2.18.3

Compare Source

v2.18.2

Compare Source

Bugfixes

• Fix bug with reading environment variable SEMAPHORE_DB_PASS.

v2.18.1

Compare Source

This is a substantial beta release that pushes Semaphore meaningfully further into enterprise-grade secrets management, hardens the API token lifecycle, expands the runner scheduling model, and absorbs a flurry of security and dependency fixes — many of them caught and triaged by automated review bots (Cursor, ChatGPT Codex) before merge. It also bumps the bundled Ansible runtime by two major versions.

Below is a qualitative, themed walkthrough rather than a flat PR list.

---

Secret storage: two new external backends + a hard look at ownership

The headline feature of this release is first-class support for two more enterprise secret backends, joining the existing Devolutions Server (DVLS) integration:

• AWS Secrets Manager ([#​3750](#​3750)) — adds a full Secret Storage type for AWS SM with a dedicated form, icon, and a Sync button to pull secrets on demand. The PR also introduced a generalized rekey flow and "source details" surfacing for individual secrets.
• Azure Key Vault ([#​3752](#​3752)) — symmetric implementation for Azure, using the official Microsoft SDKs (azcore, azidentity, azsecrets). Auth follows the same DB / env-var / file pattern as AWS SM and DVLS, and the backend was refactored to consolidate SyncSecrets across all storage types into a single function.

Alongside the new backends, an unusually large cluster of secret-related security fixes landed — almost all of them automatically flagged by cursor[bot] during review:

• [#​3753](#​3753) / [#​3762](#​3762) — broken ownership checks on environment secret delete/update (nil deref + auth bypass). These are real authorization bugs where an unauthenticated edge case could fall through.
• [#​3768](#​3768) — broken ErrReadOnlyStorage sentinel + a silent delete error on environment secrets (the operation appeared to succeed while failing).
• [#​3778](#​3778) — vault rekey now correctly skips keys that live in external storage (AWS/Azure/DVLS), since rekeying them locally would be incoherent.
• [#​3784](#​3784) — unsetenv for sensitive config fields after they're consumed, so they don't linger in process memory available to child processes.
• [#​3792](#​3792) — missing return statements after error responses in auth/env handlers (classic continue-after-error logic bug).

The pattern here is notable: the new backends were merged together with a methodical sweep of the existing secret-handling code, suggesting the secrets subsystem received a deliberate audit pass.

---

API tokens grow up

Two complementary PRs turn API tokens from disposable opaque strings into something closer to a managed credential:

• Expiration support ([#​3795](#​3795)) — tokens can now carry an optional expires_at. Creation rejects non-future values; bearer-token authentication checks expiry on every request via a new IsExpiredAt method, so revocation-by-time is enforced before the request handler even runs. This also added rollback SQL for the migration.
• Named tokens ([#​3788](#​3788)) — first contribution from @setswei. Tokens get a name field, which is the small UX touch that finally makes a token list legible when you have more than two of them.

Together with [#​3785](#​3785) (a nil pointer dereference fix in TOTP session verification), the auth surface in this release is meaningfully more robust.

---

Runners: tags become a first-class scheduling primitive

[#​3804](#​3804) is the largest single feature in the release (24 commits) and is worth understanding architecturally rather than as a list of bullets:

• A new runner__tag join table replaces the previous single-string tag column, so a runner can carry multiple tags.
• Global runners can now be tagged, not just project runners. This bridges the "platform team owns a fleet, project teams target subsets" model that previously required workarounds.
• The runner list UI gains Default and Global labels, label wrapping, autocompletion in the tag input, and a partial-tag filter ("get runners with any tag matching X").
• A new RunnerTagFilterMode enum (CompleteMatch, HasNoTags, IsDefault, IgnoreTags, HasAnyTag) governs how tasks pick runners.
• Non-admin users have actions disabled on globally-tagged runners — the UI honors the ownership boundary.

The PR is also a fascinating case study in automated code review actually working: cursor[bot] repeatedly flagged an inverted condition in services/tasks/RemoteJob.go where tagFilterMode was set backward (tagged jobs would have routed to untagged runners and vice versa, breaking the isolation guarantee that's the whole point of the feature). Across roughly five review cycles the maintainer (@fiftin) iterated until the logic was right. A bolt driver caveat — db:"-" tags causing tag persistence to silently break on Bolt deployments — was raised by the Codex reviewer; worth verifying for anyone still on Bolt.

A related smaller change, [#​3793](#​3793), refactored the sync flag handling, which was prerequisite plumbing.

---

Admin observability

[#​3782](#​3782) adds a System Information dialog for admins — a new admin-only GET /admin/info endpoint backing a UI dialog that surfaces:

• tmp_path, home_dir_mode
• Go version / arch / OS, Ansible version, git client
• DB dialect, HA configuration
• Auth method flags (LDAP, OIDC, etc.)
• Task limits, runner settings, notification flags

This is genuinely useful for support triage — the kind of "what version of everything is this server running?" question that previously required SSH access. The endpoint is correctly gated by adminMiddleware server-side, with the UI also guarding render with v-if="user && user.admin". Notably, several of these values were already exposed to all authenticated users via /api/info; the new endpoint is more restrictive than what existed before.

---

Ansible jumps two major versions

[#​3736](#​3736) (first contribution from @sevencastles) bumps the bundled Ansible from 11.1.0 → 13.5.0 (ansible-core 2.20.4). This is a non-trivial jump for anyone running Ansible workloads against the Semaphore image — playbooks that relied on collections or behavior from Ansible 11 should be re-tested. There are no notes about pinned-version overrides, so the upgrade is mandatory for users on the official image.

---

Terraform: stop logic finally works

[#​3694](#​3694) — a long-standing bug from @JulianKap: stopping a Terraform task while it sat in waiting_confirmation (the human-approval gate between plan and apply) didn't actually stop it. Now it does. For anyone using Terraform integration, this closes one of the more annoying state machine quirks.

---

Quality-of-life and infrastructure

A few smaller items worth flagging:

• i18n correctness ([#​3764](#​3764), first contribution from @lawrence3699) — CLI command strings are no longer translated. Translating ansible-playbook into other languages was, predictably, breaking command execution.
• Process file ownership ([#​3777](#​3777)) — chown is now scoped to directories the process actually has access to, instead of attempting it everywhere and erroring noisily.
• README ([#​3742](#​3742), first contribution from @gaetan-steininger) — updated to recommend SQLite over Bolt, which is now deprecated. Worth noting alongside the Bolt-driver concern raised on #​3804: Bolt's days are numbered, and new features may not get the same testing coverage on it.

---

Dependency churn

This release pulled in a high volume of dependency bumps. The notable security-relevant ones:

• go-git/go-git/v5 → v5.17.2 ([#​3732](#​3732), [#​3751](#​3751)) — security advisory fix.
• go-jose/go-jose/v4 → v4.1.4 ([#​3745](#​3745)) — patches CVE-2026-34986 (DoS via JWE decryption panic), which is in Semaphore's path because it's transitively used by the OIDC login flow.
• axios → v1.15.0/v1.15.2 ([#​3756](#​3756), [#​3800](#​3800)) — security advisory.
• node-forge → 1.4.0 ([#​3728](#​3728))
• go-ldap/ldap/v3 → v3.4.13 ([#​3767](#​3767))
• Azure/go-ntlmssp → v0.1.1 ([#​3794](#​3794)) — also feeds into the Azure work.

Plus routine bumps of lodash, picomatch, flatted, follow-redirects, prettier, core-js, dotenv, openai, and actions/checkout.

A small style/config cleanup ([588b369d](https://redirect.github.com/semaphoreui/semaphore/commit/588b369d)) removes some extra config validation.

---

New contributors

Four first-time contributors landed code this release: @gaetan-steininger, @lawrence3699, @sevencastles, and @setswei. The community continues to broaden.

---

Headline takeaways for upgraders

1. If you use external secret managers, this is a meaningful release — AWS SM and Azure KV are now first-class.
2. If you provision API tokens programmatically, plan for the new expires_at and name fields; they're optional but the inflection point to start using them is now.
3. If you run Ansible playbooks via Semaphore, validate against ansible-core 2.20.4 before upgrading production.
4. If you're still on the Bolt driver, evaluate migrating to SQLite — the README now recommends it and at least one PR in this release ([#​3804](#​3804)) had a noted Bolt-specific concern.
5. If you operate a multi-team installation, the new tagged-global-runner model is worth designing around — it removes one of the longest-standing rough edges in shared-fleet runner setups.

v2.17.39

Compare Source

Bugfixes

• BoltDB migrator: skipping broken vaults during migration

v2.17.38

Compare Source

Changes

• Added namespace support for HashiCorp Vault (Pro/Enterprise)
• Fixed critical bug with BoltDB migration.

v2.17.37

Compare Source

v2.17.36

Compare Source

Changelog

• 07b5c05 fix(subscr): show correct message
• 6b5a4ae Merge pull request #​3754 from semaphoreui/fix/ldap_filter_injection

v2.17.35

Compare Source

v2.17.34

Compare Source

v2.17.33

Compare Source

Changelog

• 629fc09 fix(repo): use *_internal directory to store requirements hash file

v2.17.32

Compare Source

Semaphore UI v2.17.32 – Release Summary

This release focuses on runner reliability, security improvements, and overall stability, along with several bug fixes and translation updates.

🚀 Improvements

• Smarter runner distribution
  Runners are now selected randomly, improving load balancing and avoiding uneven task distribution across runners.

🔐 Security & Safety

• Config validation at startup
  The access_key_encryption setting is now validated during startup to prevent misconfiguration issues early.
• Stronger permission checks
  Restoring projects from backup now requires admin permissions, improving security around sensitive operations.

🐛 Bug Fixes

• Fixed nil pointer crash in runner updates when tasks are not part of a pool
• Fixed incorrect handling of Git branch names containing slashes
• Improved runner shutdown logic to ensure progress is uploaded before termination
• Fixed inconsistencies in task status updates
• Minor fix for a missed import

🌍 Localization

• Improved Traditional Chinese (zh_TW) translations and consistency

---

What's Changed

• fix(i18n): improve Traditional Chinese (zh_TW) translations by @​tan9 in #​3701
• fix(config): validate access_key_encryption at startup by @​abh in #​3710
• fix(i18n): improve zh_TW translation consistency by @​tan9 in #​3705
• Fix branch names with slashes truncated in GetRemoteBranches by @​Copilot in #​3717
• Add admin permission check for project restore from backup by @​JulianKap in #​3695
• chore(deps): update dependency axios to v1.13.6 by @​renovate[bot] in #​3692
• fix: nil pointer dereference in UpdateRunner when task not in pool by @​cursor[bot] in #​3727
• feat: randomize runner selection by @​agrrh in #​3722
• fix(runners): gate one-off shutdown on acknowledged progress upload by @​fiftin in #​3738
• fix/status updating by @​fiftin in #​3737

New Contributors

• @​tan9 made their first contribution in #​3701
• @​abh made their first contribution in #​3710
• @​cursor[bot] made their first contribution in #​3727
• @​agrrh made their first contribution in #​3722

Full Changelog: semaphoreui/semaphore@v2.17.31...v2.17.32

v2.17.31

Compare Source

Changelog

• Fix Devolutions icon

v2.17.30

Compare Source

Changelog

• 3f8c2b9 fix(env): allow empty secret prefix

What's Changed

• fix: windows abs path support by @​fiftin in #​3720

Full Changelog: semaphoreui/semaphore@v2.17.28...v2.17.30

v2.17.29

Compare Source

v2.17.28

Compare Source

Release v2.17.28

This release improves runner-to-task tracking and fixes task status handling in the runner update flow.

A new runner_id field was added to tasks in the database, which makes it possible to persist the association between a task and the runner executing it. This improves internal task tracking and lays the groundwork for more reliable runner state handling.

This release also fixes a bug in the runner update logic where the current task state was checked using the wrong field. In api/runners/runners.go, the status check was corrected from job.Status.IsFinished() to tsk.Task.Status.IsFinished(), ensuring the system evaluates the actual stored task state before applying runner updates. This makes task state transitions more accurate during runner execution.

What's changed

• Added runner_id to the task record in the database for better runner-to-task association. (#​3712)
• Fixed runner task status validation to use the actual task status field instead of the job status field.

Full Changelog

semaphoreui/semaphore@v2.17.27...v2.17.28

v2.17.27

Compare Source

Bugfixes

• Fixed bug with running Terragrunt

  

v2.17.26

Compare Source

Changelog

• 3b278d1 fix(secrets): null pointer

Full Changelog: semaphoreui/semaphore@v2.17.24...v2.17.26

v2.17.25

Compare Source

v2.17.24

Compare Source

Changelog

• b9cb5be fix(secrets): provide source storage type in var groups

What's Changed

• fix: fixed a race condition for terraform task statuses by @​JulianKap in #​3686

New Contributors

• @​JulianKap made their first contribution in #​3686

Full Changelog: semaphoreui/semaphore@v2.17.22...v2.17.24

v2.17.23

Compare Source

v2.17.22

Compare Source

This patch release includes a small fix related to integrations permissions.

Fixes

• Fixed permissions handling for integrations.

Full Changelog: semaphoreui/semaphore@v2.17.21...v2.17.22

v2.17.21

Compare Source

Changelog

• 3a04fda Merge branch '2-17-stable' into develop

Full Changelog: semaphoreui/semaphore@v2.17.17...v2.17.21

v2.17.20

Compare Source

v2.17.19

Compare Source

v2.17.18

Compare Source

v2.17.17

Compare Source

Changelog

• 9c82d18 Merge pull request #​3689 from semaphoreui/load_secrets

What's Changed

• chore(deps-dev): bump svgo from 2.8.0 to 2.8.2 in /web by @​dependabot[bot] in #​3682
• Load secrets by @​fiftin in #​3689

Full Changelog: semaphoreui/semaphore@v2.17.16...v2.17.17

v2.17.16

Compare Source

Changelog

• 140584f ci(docker): fix migration condition

What's Changed

• feat(migrator): respect flag --merge-existing-users which allows use exiting users by @​fiftin in #​3673

Full Changelog: semaphoreui/semaphore@v2.17.15...v2.17.16

v2.17.15

Compare Source

Here’s a clean release summary you can use:

---

Semaphore UI v2.17.15

Overview

This release improves secret management flexibility and includes minor internal cleanup and dependency updates.

✨ Highlights

🔐 Read Secrets from Raw Files

You can now load secrets directly from a raw file. This makes it easier to integrate with:

• Docker/Kubernetes secret mounts
• Vault Agent file sinks
• External secret management systems

This enhancement simplifies secure automation workflows and improves compatibility with production setups.

What's Changed

• feat(secrets): allow read secret from raw file by @​fiftin in #​3654
• chore(deps): update dependency openai to v6.25.0 by @​renovate[bot] in #​3533

Full Changelog: semaphoreui/semaphore@v2.17.14...v2.17.15

v2.17.14

Compare Source

Changelog

• Fixed null pointer in Backups

v2.17.12

Compare Source

🚀 Release Summary

This release introduces improved task control, an important database migration capability, and multiple dependency updates for stability and security.

✨ Highlights

BoltDB → SQL migration tool (major step forward)

• A new backend migration utility allows moving from BoltDB to SQL databases.
  This is a key improvement for scalability and aligns with the future removal of BoltDB support.

🔧 Maintenance & Security

• Updated multiple Go modules (crypto, OAuth2, PostgreSQL driver).
• Updated frontend tooling (Prettier).
• Edwards25519 dependency updated (core and Pro).
• General dependency fixes and stability improvements.

🙌 Community

• Welcome @​darcystan for their first contribution!

Changelog

• 3e5e0de ci(github): return GH_TOKEN for docker

What's Changed

• Added host limit values in Task parameters instead of just Yes by @​darcystan in #​3637
• chore(deps): bump filippo.io/ed

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.