From 55dea887bb5cb66c645fb0429bce4c6c95e806a6 Mon Sep 17 00:00:00 2001 From: Manuel Aguirre Date: Wed, 4 Nov 2026 16:41:53 -0600 Subject: [PATCH] chore(release): add release notes for 2.40.12 Co-Authored-By: Claude Sonnet 5.5 AI-Session-Id: dd3f1fde-4c18-44f5-9de3-aa22c2225298 AI-Tool: claude-code AI-Model: unknown --- .../armoryspinnaker_v2-40-12.md | 628 ++++++++++++++++++ 1 file changed, 628 insertions(+) create mode 100644 content/en/continuous-deployment/release-notes/rn-armory-spinnaker/armoryspinnaker_v2-40-12.md diff --git a/content/en/continuous-deployment/release-notes/rn-armory-spinnaker/armoryspinnaker_v2-40-12.md b/content/en/continuous-deployment/release-notes/rn-armory-spinnaker/armoryspinnaker_v2-40-12.md new file mode 100644 index 0000000000..dff027eecb --- /dev/null +++ b/content/en/continuous-deployment/release-notes/rn-armory-spinnaker/armoryspinnaker_v2-40-12.md @@ -0,0 +1,628 @@ +--- +title: v2.40.12 Armory Continuous Deployment Release (Spinnaker™ 2026.2.x) +toc_hide: true +version: 02.40.12 +date: 2026-11-04 +description: > + Release notes for Armory Continuous Deployment v2.40.12. +--- + + + +## 2026/11/04 release notes + +>Note: If you experience production issues after upgrading Armory Continuous Deployment, roll back to a previous working version and report issues to [http://go.armory.io/support](http://go.armory.io/support). + +## Required Armory Operator version +{{% alert color="warning" title="Important" %}} +[Armory Operator]({{< ref "armory-operator" >}}) has been deprecated and will is considered EOL. Please migrate to the [Kustomize]({{< ref "armory-operator-to-kustomize-migration" >}}) method of deployment. +{{% /alert %}} + +To install, upgrade, or configure Armory CD 2.40.12, use Armory Operator 1.8.6 or later. + +## Security + +Armory scans the codebase as we develop and release software. Contact your Armory account representative for information about CVE scans for this release. + +**emSign ECC Root CA - G3 removed from service images** + +Service images no longer trust the `emSign ECC Root CA - G3` certificate authority ([#8242](https://github.com/spinnaker/spinnaker/pull/8242)), following reports of a CA trust issue with eMudhra's emSign hierarchy. Previous images still trusted it, along with the `EM DV/OV/EV TLS CA - G3B/G3C` and `EM OV CS CA - G3B/G3C` intermediates it issued. The images now upgrade the CA packages at build time, and the build fails if the certificate is still present in the JVM trust store. If your services connect to endpoints whose certificates chain to this root, those connections fail after the upgrade. + +**emSign Root CA - G1 removed from the Java truststore of base images** + +The Armory base images no longer trust the compromised eMudhra `emSign Root CA - G1` certificate authority ([armory-spinnaker-base-images#17](https://github.com/armory-io/armory-spinnaker-base-images/pull/17)). The images deselect the certificate, rebuild the Java truststore, and fail the build if `emSign Root CA - G1`, G2, G3, or Comodo AAA are still trusted. If your services connect to endpoints whose certificates chain to this root, those connections fail after the upgrade. + +**Dependency updates for CVEs** + +- Bouncy Castle 1.86.2 (CVE-2026-8763) ([#8287](https://github.com/spinnaker/spinnaker/pull/8287)). Earlier 2.40.x releases shipped an affected Bouncy Castle version. +- Freemarker 2.3.35 (CVE-2026-84939) ([#8286](https://github.com/spinnaker/spinnaker/pull/8286)). +- Tomcat 10.1.59 (CVE-2026-65182) ([#8268](https://github.com/spinnaker/spinnaker/pull/8268)). +- Netty 4.1.137.Final (CVE-2026-75595) ([#8267](https://github.com/spinnaker/spinnaker/pull/8267)). + +## Breaking changes + +> Breaking changes are kept in this list for 3 minor versions from when the change is introduced. For example, a breaking change introduced in 2.21.0 appears in the list up to and including the 2.24.x releases. It would not appear on 2.25.x release notes. + +### Gate: Spring Security 5 Oauth2 Migration +Armory CD 2.38.0 removes deprecate Oauth2 annotations and uses Spring Security 5 DSL. In order to configure oauth2 in `gate-local.yml` have changed to: + +## Google Oauth configuration +```yaml +spring: + security: + oauth2: + client: + registration: + google: + client-id: + client-secret: + authorization-grant-type: authorization_code + redirect-uri: "https:///login/oauth2/code/google" + scope: profile,email,openid + client-name: google + provider: + google: + authorization-uri: https://accounts.google.com/o/oauth2/auth + token-uri: https://oauth2.googleapis.com/token + user-info-uri: https://www.googleapis.com/oauth2/v3/userinfo + user-name-attribute: sub +``` +## Github Oauth2 configuration +```yaml +spring: + security: + oauth2: + client: + registration: + userInfoMapping: + email: email + firstName: '' + lastName: name + username: login + github: + client-id: + client-secret: + authorization-grant-type: authorization_code + redirect-uri: "https:///login/oauth2/code/github" + scope: user,email + client-name: github + provider: + github: + authorization-uri: https://github.com/login/oauth/authorize + token-uri: https://github.com/login/oauth/access_token + user-info-uri: https://api.github.com/user + user-name-attribute: login +``` + +### Orca: Tasks configuration changes +The following configuration properties have been restructured in `orca-local.yml`: + +Previous Configuration: + +```yaml +tasks: + days-of-execution-history: + number-of-old-pipeline-executions-to-include: +``` + +New configuration format + +```yaml +tasks: + controller: + days-of-execution-history: + number-of-old-pipeline-executions-to-include: + optimize-execution-retrieval: + max-execution-retrieval-threads: + max-number-of-pipeline-executions-to-process: + execution-retrieval-timeout-seconds: +``` + +These changes improve query performance and execution retrieval efficiency, particularly for large-scale pipeline applications. + +### Policy Engine (OPA) is now built into Armory CD + +The Policy Engine is now built into the Armory CD distribution. The `Armory.PolicyEngine` plugin and the `armory.opa` configuration block are replaced by a native `armory.policy-engine` block. Remove the `Armory.PolicyEngine` plugin from `spinnaker.extensibility.plugins` in every service that had it configured and update the configuration block in `clouddriver-local.yml`, `front50-local.yml`, and any other service profile that references OPA: + +Previous: +```yaml +armory: + opa: + enabled: true + url: http://opa-server.opa:8181/v1 +``` + +New: +```yaml +armory: + policy-engine: + enabled: true + baseurl: http://opa-server.opa:8181/v1 +``` + +The OPA server deployment and policies are unchanged. + +### Kubernetes Agent (Kubesvc) is now built into Armory CD + +The Scale Agent plugin (`Armory.Kubesvc`) is now built into the Armory CD Clouddriver image. The plugin, its repository, and the top-level `kubesvc:` configuration block must be replaced by the native `armory.kubesvc:` block in `clouddriver-local.yml`: + +Previous: +```yaml +kubesvc: + cluster: kubernetes + +spinnaker: + extensibility: + plugins: + Armory.Kubesvc: + enabled: true + version: 0.16.2 + extensions: + armory.kubesvc: + enabled: true + repositories: + armory-agent: + url: https://raw.githubusercontent.com/armory-io/agent-k8s-spinplug-releases/master/repositories.json +``` + +New: +```yaml +armory: + kubesvc: + enabled: true + cluster: kubernetes +``` + +All sub-properties (grpc, cache, heartbeat, operations, credentials) stay the same — only the parent key changes. Remove `Armory.Kubesvc` from `spinnaker.extensibility.plugins` and `armory-agent` from `spinnaker.extensibility.repositories`. The Armory Agent **service** deployed in target clusters is unchanged. + +If Clouddriver fails to start after this change with a `Table 'kubesvc_cache' already exists` migration error, see [Clouddriver fails to start with a Kubesvc migration error](#clouddriver-fails-to-start-with-a-kubesvc-migration-error) under Known issues. + +### Spring Boot 3.5 upgrade + +Armory CD 2.40.3 upgrades to Spring Boot 3.5, the latest supported release. This is a major upgrade from Spring Boot 3.0 introduced in Armory CD 2.39.0. Plugins built against earlier Spring Boot versions will need to be updated to be compatible with this release. + +**Actuator metrics export property changes** (introduced in 2.39.0) + +If upgrading from a version prior to 2.39.0, note that the metrics export properties have moved: + +| Old Property Prefix | New Property Prefix | +|---------------------|---------------------| +| `management.metrics.export.` | `management..metrics.export` | + +**Gate session data cleanup** (introduced in 2.39.0) + +If upgrading from a version prior to 2.39.0, flush Gate's Redis session cache before upgrading: + +```bash +redis-cli keys "spring:session*" | xargs redis-cli del +``` + +**Ignored `server.*` properties** + +Earlier Spring Boot upgrades removed the following properties. Spring Boot ignores them without an error, so they have no effect if still set: + +| Ignored property | Ignored since | Replacement | +|------------------|---------------|-------------| +| `server.max-http-header-size` | Armory CD 2.39.0 (Spring Boot 3.0) | `server.max-http-request-header-size` | +| `server.tomcat.max-http-header-size` | Spring Boot 2.2 | `server.max-http-request-header-size` | +| `server.tomcat.protocolHeader`, `remoteIpHeader`, `internalProxies` | Spring Boot 2.5 | `server.forward-headers-strategy` and `server.tomcat.remoteip.*` | +| `server.tomcat.httpsServerPort` | Never supported | `server.tomcat.remoteip.port-header` (default `X-Forwarded-Port`) | +| `server.session.cookie.*` | Spring Boot 2.0 | `server.servlet.session.cookie.*` | + +If you raised the header limit with an old property, services are back on the 8KB default and reject larger headers, such as large SAML or OAuth tokens, with HTTP 400. Set the new property in the `spinnaker` profile to apply it to every service. + +For example, this Gate profile: + +```yaml +server: + servlet: + session: + timeout: 86400 + session: + cookie: + same-site: none + secure: true + tomcat: + max-http-header-size: 256KB + httpsServerPort: X-Forwarded-Port + internalProxies: .* + protocolHeader: X-Forwarded-Proto + remoteIpHeader: X-Forwarded-For +``` + +Becomes: + +```yaml +server: + forward-headers-strategy: native + max-http-request-header-size: 256KB + servlet: + session: + cookie: + same-site: none + secure: true + session: + timeout-in-seconds: 86400 +``` + +- On Kubernetes, Spring Boot already applies `native` when no strategy is set; setting it explicitly matters on other platforms. +- `native` trusts forwarded headers only from private and loopback addresses. For a load balancer on another address, set `server.tomcat.remoteip.internal-proxies`. +- If your proxy strips a path prefix and sends `X-Forwarded-Prefix`, use `framework` instead. It trusts these headers from any client, so the proxy must overwrite them. +- Gate's session lifetime is set by `server.session.timeout-in-seconds` (default `3600`), not `server.servlet.session.timeout`. + +### YAML parsing limits now configurable + +Starting with SnakeYAML 1.33, strict safety limits are enforced by default (`maxAliasesForCollections = 50`, `codePointLimit = 3145728`). These can cause large or alias-heavy YAML files such as Kubernetes manifests to fail. Two new properties allow operators to override these limits: + +```yaml +snakeyaml: + max-aliases-for-collections: 500 # default: 50 + code-point-limit: 10485760 # default: 3145728 +``` + +### AWS JDBC Driver Update + +The AWS JDBC driver has been updated from the deprecated aws-mysql-jdbc driver (version 1.0.0) to the [AWS Advanced JDBC Wrapper](https://github.com/aws/aws-advanced-jdbc-wrapper). + +This update adds support for IAM authentication with AWS Aurora Global Database endpoints. The previous driver did not support global database endpoint format (`*.global.rds.amazonaws.com`) when using IAM authentication, resulting in the error: + +``` +java.sql.SQLException: Unsupported AWS hostname '.global.rds.amazonaws.com'. +Amazon domain name in format *.AWS-Region.rds.amazonaws.com is expected +``` + +**Note:** Standard database connections (without IAM authentication) continue to work as before and do not require any configuration changes. + +**Affected services:** Front50, Orca, Clouddriver, Fiat + +#### Configuration for IAM Authentication with Aurora Global Database + +If you are using IAM authentication and want to connect to Aurora Global Database endpoints, update your JDBC connection string: + +**New JDBC URL format:** + +``` +jdbc:aws-wrapper:mysql://:/?wrapperPlugins=iam&globalClusterInstanceHostPatterns=?...rds.amazonaws.com,?...rds.amazonaws.com&iamRegion= +``` + +**Example:** If your Aurora Global Database has: +- Global endpoint: `mydb-global.global-xxxxx.global.rds.amazonaws.com` +- Primary (us-west-2): `mydb.cluster-abc123.us-west-2.rds.amazonaws.com` +- Secondary (us-east-1): `mydb.cluster-abc123.us-east-1.rds.amazonaws.com` + +Configure the JDBC URL as: +``` +jdbc:aws-wrapper:mysql://mydb-global.global-xxxxx.global.rds.amazonaws.com:3306/front50?wrapperPlugins=iam&globalClusterInstanceHostPatterns=?.cluster-abc123.us-west-2.rds.amazonaws.com,?.cluster-abc123.us-east-1.rds.amazonaws.com&iamRegion=us-west-2 +``` + +### Orca: Lambda invoke payload artifact resolution + +Lambda invoke stages now support SpEL expression evaluation and expected-artifact binding in payload artifacts. + +Previously, Lambda invocation used a custom `LambdaPipelineArtifact` class that did not participate in Orca's standard artifact resolution flow. The artifact was fetched inside Clouddriver's atomic `invokeLambdaFunction` operation, so Orca could not evaluate expressions or bind expected artifacts before invocation. + +With this release, a new Orca task `LambdaResolveInvokeArtifactTask` runs before `LambdaInvokeTask` when the feature flag is enabled: + +- Reads the `payloadArtifact` from stage context. +- Resolve expected-artifact IDs and evaluate any SpEL expressions. +- Fetches the artifact content. +- Stores the resolved content in stage context as `resolvedPayload`. + +`LambdaInvokeTask` then uses `resolvedPayload` and omits `payloadArtifact` when resolution happened, or falls back to the legacy behavior of passing `payloadArtifact` to Clouddriver when `resolvedPayload` is absent. + +Enable the feature by setting the following configuration in `orca-local.yml`: + +```yaml +stages: + lambda-invoke: + resolve-payload-artifact: true +``` + +### OSS Spinnaker images moved to GHCR + +OSS Spinnaker images are no longer published to Google Artifact Registry (GAR) and now pull from GitHub Container Registry (GHCR) at `ghcr.io/spinnaker/`. **Armory CD images continue to be published to Docker Hub** (`docker.io/armory`) and are unaffected. If you consume any OSS Spinnaker images directly alongside your Armory CD deployment, update those image references to point to GHCR before upgrading. + +### Halyard fully deprecated + +Halyard is no longer supported and will not receive patches or updates. Migrate to [spinnaker-kustomize](https://github.com/spinnaker/spinnaker-kustomize-patches) or a similar implementation. + +### MySQL 8+ now required + +Due to recent SQL library upgrades, MySQL 5.7 is no longer supported and will fail on startup. You must be running MySQL 8.0+ or an equivalent MariaDB version before upgrading to Armory CD 2.40.3. + +### Redis/Valkey 7+ now required + +Redis or Valkey 7.0+ is required for Armory CD 2.40.3. Older versions are not supported and may cause failures. Armory already deploys Redis 7+ by default — verify your Redis version before upgrading if you manage your own Redis instance. + +### AWS SDK v1 deprecated + +AWS SDK v2 support has been introduced across Spinnaker services. AWS SDK v1 is expected to be removed in an upcoming release. If you have custom implementations using SDK v1, begin migrating to the v2 integrations now. + +### EDDA support removed + +EDDA is no longer supported and will be removed once the AWS SDK v2 migration is complete. If you rely on EDDA, contact the Spinnaker Slack community before upgrading. + +### Armory Scale Agent (Kubesvc) deprecation notice + +The Armory Scale Agent (Kubesvc) is planned for deprecation in the next major release of Armory CD. + +### URL trailing-slash handling changed + +Due to Spring Boot changes, a new filter has been added that restores lenient handling of trailing slashes. If you have controllers (in plugins or custom code) that only register a trailing-slash route, those controllers may break. You can adjust or disable this filter per service: + +```yaml +url-handler: + trailing-slash: + enabled: true # set false to opt out + path-patterns: + - "/**" # narrow if desired +``` + +It is recommended to update any affected controllers to handle both paths with and without a trailing slash. + +## Known issues + +{{< include "known-issues/ki-kubesvc-changelog-migration.md" >}} + +## Highlighted updates + +### Gate: API token authentication + +Spinnaker now supports first-class, revocable API tokens for authenticating programmatic requests against Gate. Tokens are minted, listed, and revoked through a new self-service UI in Deck, persisted in Redis by Gate, and resolved on every inbound request by a dedicated Spring Security chain. + +The feature is **off by default**. To enable, add the following to your `gate-local.yml`: + +```yaml +api-tokens: + enabled: true +``` + +Key capabilities: +- **Per-credential revocation** — revoking one token does not affect other tokens for the same user or service account +- **Bounded lifetime** — user tokens always expire; admin-tunable max lifetimes (90 days for users, 365 days for service accounts by default) +- **IAP-compatible** — tokens use the `X-Spinnaker-Token: spk_…` header, which flows cleanly through GCP IAP +- **Operator observability** — a new `gate.requests` counter tagged with `authType`, `principalKind`, `method`, `statusCode`, and `status` + +### ECS: Major performance improvements + +ECS caching agents have been migrated to AWS SDK v2 and significantly optimized. Previously, several agents loaded all data for all accounts into memory before filtering. These agents now load only the data relevant to the requested account, significantly reducing memory footprint and database throughput for deployments with large numbers of ECS accounts. + +### Microsoft Teams: Jinja template support + +The Microsoft Teams notification integration now uses configurable Jinja templates to determine notification payloads, replacing the previously hardcoded message format. Two templates are provided out of the box and can be overridden: + +- `event-notification.jinja` +- `pipeline-notification.jinja` + +To override with custom templates, set the template path in your `echo-local.yml`: + +```yaml +microsoftteams: + enabled: true + templatePath: /opt/spinnaker/config/teams-templates +``` + +**Note:** `status` is now a required field on pipeline notification templates. Users on legacy Outlook webhook endpoints will receive deprecation warnings in logs — see the [migration guide](https://github.com/jasonmcintosh/spinnaker/blob/179e86695004fc8ec6c41ccc5b848a59a2154af1/echo/echo-notifications/src/main/resources/templates/microsoftteams/MIGRATION_GUIDE.md) for details. + +### Igor: Jenkins job cancellation + +When a Spinnaker pipeline is cancelled, any associated Jenkins job triggered by that pipeline is now also cancelled automatically. + +### Webhooks: Stage timeout support + +Webhook stages now respect the overridden `stageTimeoutMs` value set on the stage configuration. Previously this value was ignored, causing webhook stages to run until the global timeout elapsed. + +### AWS SDK v2: Credentials bridge for non-AWS environments + +The AWS SDK v2 credential path now bridges v1 credentials to v2, fixing credential discovery in non-AWS environments such as GKE pods using STS assume-role. Previously the v2 path used `DefaultCredentialsProvider` which could not discover credentials in these environments. All configured v1 `AWSCredentialsProvider` instances (including STS assume-role with token refresh) are now adapted for use by the v2 SDK. + +### SpeL support of dash(-) in variable names +SpEL by default tokenizes - as the arithmetic minus operator, not a valid identifier character. +Enabling the following configuration in orca-local.yml now adds support to treat the - as a valid identifier character +during SpeL variable evaluation. + +```yaml +expression: + dashed-identifiers: + enabled: true #Defaults to false +``` + +### Gate: API rate limiting + +Gate can limit how many API requests each user or service account makes. Limits are shared across Gate instances through the Redis configured in `redis.connection`. Rate limiting is off by default. When enabled, it starts in learning mode, which logs requests that go over the limit instead of rejecting them with HTTP 429. To enable, add the following to your `gate-local.yml`: + +```yaml +armory: + rate-limit: + enabled: true + learning: false # default true: log over-limit requests without rejecting them + capacity: 60 # requests per rate-seconds window, default 60 + rate-seconds: 10 # default 10 + capacity-by-role: + - {role: SPINNAKER_ADMIN, override: 600} + capacity-by-principal: + - {principal: jenkins-bot@example.com, override: 2000} + rules: + - {name: pipeline-start, methods: [POST], path-patterns: ["/pipelines/**"], capacity: 10, rate-seconds: 60} +``` + +Requests that match a rule's methods and paths count against that rule's limit instead of the default one. Don't also enable the OSS `rate-limit.enabled` property: Gate fails to start if both are enabled. + +### Gate: Private GitHub organization memberships + +The GitHub OAuth 2.0 `organization` requirement only sees public organization memberships, so users whose membership is private are rejected. Starting with 2.40.11, Gate can look up the user's membership directly, which includes private memberships ([#8192](https://github.com/spinnaker/spinnaker/pull/8192)). The membership must be active, and the OAuth 2.0 registration needs the `user` or `read:org` scope. This is off by default. To enable, add the following to your `gate-local.yml`: + +```yaml +spring: + security: + oauth2: + client: + registration: + github: + provider-requirements: + organization: my-org + include-private-memberships: true +``` + +### Fixed issues + +- Gate looks up a pipeline by id only within the requested application. Previously, an id that matched a pipeline name in the requested application returned a pipeline from a different application, so `GET /applications/{application}/pipelineConfigs/{pipelineName}` could return another application's pipeline, and triggering by name or id could start it ([#8352](https://github.com/spinnaker/spinnaker/pull/8352)). +- Front50 validates pipeline ids on save, update, and batch update. A supplied pipeline id can no longer be associated with a different application, and updates keep the pipeline in its existing application ([#8356](https://github.com/spinnaker/spinnaker/pull/8356)). +- Orca sends the Clouddriver requests that its Retrofit 2 migration left unsent. Clouddriver's cache is refreshed again after stages delete a load balancer, create, update, or delete a security group, destroy a job, or change a Lambda function. Canceling a Run Job stage, or letting it time out, now stops the job instead of leaving it running ([#8144](https://github.com/spinnaker/spinnaker/pull/8144)). +- Clouddriver's SQL task, account definition, and event repositories retry transient database errors, such as failovers, dropped connections, and deadlocks, using the `sql.retries` settings (by default, 5 attempts with a 100 ms backoff). Previously, the retry configuration had no effect and these errors failed on the first attempt ([#8111](https://github.com/spinnaker/spinnaker/pull/8111)). +- ECS accounts pick up changes to their backing AWS account, such as a new region, without restarting Clouddriver ([#8196](https://github.com/spinnaker/spinnaker/pull/8196)). +- Echo compares GitHub webhook signatures in constant time and no longer logs the computed digest ([#8162](https://github.com/spinnaker/spinnaker/pull/8162)). +- Fiat role syncs are faster for installations with many users and restricted resources ([#8136](https://github.com/spinnaker/spinnaker/pull/8136)). +- Fiat renews GitHub App installation tokens. Previously, GitHub team role syncs failed with `401 Bad credentials` about an hour after Fiat started and used stale roles until Fiat restarted ([#8224](https://github.com/spinnaker/spinnaker/pull/8224)). +- A failed GitHub membership refresh no longer removes every user's roles in Fiat. Fiat keeps the last known memberships and retries ([#8224](https://github.com/spinnaker/spinnaker/pull/8224)). +- Front50 no longer overwrites its pipeline cache with an older snapshot when cache refreshes run concurrently ([#8228](https://github.com/spinnaker/spinnaker/pull/8228)). +- Kustomize 3 bakes no longer fail with `yaml: invalid trailing UTF-8 octet` when resource comments contain non-ASCII characters. Rosco ships Kustomize 3.8.10 again instead of 3.10.0. + +### Spinnaker community contributions + +There have also been numerous enhancements, fixes, and features across all of Spinnaker's other services. See the +[Spinnaker 2026.2.4](https://www.spinnaker.io/changelogs/2026.2.4-changelog/) and [2026.2.5](https://www.spinnaker.io/changelogs/2026.2.5-changelog/) changelogs for details. + +## Detailed updates + +### Bill Of Materials (BOM) + +
Expand to see the BOM +
+artifactSources:
+  dockerRegistry: docker.io/armory
+dependencies:
+  redis:
+    commit: null
+    version: 2:2.8.4-2
+services:
+  clouddriver:
+    commit: b0e00185dafaa98bba9d49cfa051a4146a1e5c36
+    version: 2.40.12
+  deck:
+    commit: b0e00185dafaa98bba9d49cfa051a4146a1e5c36
+    version: 2.40.12
+  dinghy:
+    commit: b0e00185dafaa98bba9d49cfa051a4146a1e5c36
+    version: 2.40.12
+  echo:
+    commit: b0e00185dafaa98bba9d49cfa051a4146a1e5c36
+    version: 2.40.12
+  fiat:
+    commit: b0e00185dafaa98bba9d49cfa051a4146a1e5c36
+    version: 2.40.12
+  front50:
+    commit: b0e00185dafaa98bba9d49cfa051a4146a1e5c36
+    version: 2.40.12
+  gate:
+    commit: b0e00185dafaa98bba9d49cfa051a4146a1e5c36
+    version: 2.40.12
+  igor:
+    commit: b0e00185dafaa98bba9d49cfa051a4146a1e5c36
+    version: 2.40.12
+  kayenta:
+    commit: b0e00185dafaa98bba9d49cfa051a4146a1e5c36
+    version: 2.40.12
+  monitoring-daemon:
+    commit: null
+    version: 2.26.0
+  monitoring-third-party:
+    commit: null
+    version: 2.26.0
+  orca:
+    commit: b0e00185dafaa98bba9d49cfa051a4146a1e5c36
+    version: 2.40.12
+  rosco:
+    commit: b0e00185dafaa98bba9d49cfa051a4146a1e5c36
+    version: 2.40.12
+  terraformer:
+    commit: b0e00185dafaa98bba9d49cfa051a4146a1e5c36
+    version: 2.40.12
+timestamp: "2026-11-04 21:38:27"
+version: 2.40.12
+
+
+
+ +### Armory + + +#### Armory Clouddriver - 2.40.11...2.40.12 + + +#### Armory Terraformer - 2.40.11...2.40.12 + + +#### Armory Orca - 2.40.11...2.40.12 + + +#### Armory Rosco - 2.40.11...2.40.12 + + +#### Armory Igor - 2.40.11...2.40.12 + + +#### Armory Kayenta - 2.40.11...2.40.12 + + +#### Armory Front50 - 2.40.11...2.40.12 + + +#### Armory Gate - 2.40.11...2.40.12 + + +#### Armory Echo - 2.40.11...2.40.12 + + +#### Armory Fiat - 2.40.11...2.40.12 + + +#### Armory Deck - 2.40.11...2.40.12 + + +#### Armory Dinghy - 2.40.11...2.40.12 + + + +### Spinnaker + + +#### Spinnaker Clouddriver - 1.40.0 + + +#### Spinnaker Terraformer - 1.40.0 + + +#### Spinnaker Orca - 1.40.0 + + +#### Spinnaker Rosco - 1.40.0 + + +#### Spinnaker Igor - 1.40.0 + + +#### Spinnaker Kayenta - 1.40.0 + + +#### Spinnaker Front50 - 1.40.0 + + +#### Spinnaker Gate - 1.40.0 + + +#### Spinnaker Echo - 1.40.0 + + +#### Spinnaker Fiat - 1.40.0 + + +#### Spinnaker Deck - 1.40.0 + + +#### Spinnaker Dinghy - 1.40.0 + +