Skip to content

docs(release-notes): separate new changes from ones carried-over #2400

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
christosarvanitis merged 2 commits into from
Nov 9, 2026
Merged

docs(release-notes): separate new changes from ones carried-over #2400

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b2567f3
docs(release-notes): separate new 2.40.12 changes from carried-over 2…
mrusan Nov 9, 2026
0b6fce6
docs(release-notes): separate new 2.41.3 changes from carried-over 2.…
mrusan Nov 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 19 additions & 6 deletions ...inuous-deployment/release-notes/rn-armory-spinnaker/armoryspinnaker_v2-40-12.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,25 @@

>Note: If you experience production issues after upgrading Armory Continuous Deployment, roll back to a previous working version and report issues to [http://go.armory.io/support](http://go.armory.io/support).

## What's new in 2.40.12

{{% alert color="success" title="Changes since 2.40.11" %}}
These are the only changes in this release. Everything after this section is unchanged from earlier 2.40.x releases.

**Security**

- **emSign Root CA - G1 removed from the Java truststore of base images.** The Armory base images no longer trust the compromised eMudhra `emSign Root CA - G1` certificate authority ([armory-spinnaker-base-images#17](https://github.com/armory-io/armory-spinnaker-base-images/pull/17)). The images deselect the certificate, rebuild the Java truststore, and fail the build if `emSign Root CA - G1`, G2, G3, or Comodo AAA are still trusted. If your services connect to endpoints whose certificates chain to this root, those connections fail after the upgrade.

**Fixed issues**

- Gate looks up a pipeline by id only within the requested application. Previously, an id that matched a pipeline name in the requested application returned a pipeline from a different application, so `GET /applications/{application}/pipelineConfigs/{pipelineName}` could return another application's pipeline, and triggering by name or id could start it ([#8352](https://github.com/spinnaker/spinnaker/pull/8352)).

Check warning on line 30 in content/en/continuous-deployment/release-notes/rn-armory-spinnaker/armoryspinnaker_v2-40-12.md

View workflow job for this annotation

GitHub Actions / vale

[vale] content/en/continuous-deployment/release-notes/rn-armory-spinnaker/armoryspinnaker_v2-40-12.md#L30 

[Google.WordList] Use 'app' instead of 'application'.
Raw output 
{"message": "[Google.WordList] Use 'app' instead of 'application'.", "location": {"path": "content/en/continuous-deployment/release-notes/rn-armory-spinnaker/armoryspinnaker_v2-40-12.md", "range": {"start": {"line": 30, "column": 137}}}, "severity": "WARNING"}
- Front50 validates pipeline ids on save, update, and batch update. A supplied pipeline id can no longer be associated with a different application, and updates keep the pipeline in its existing application ([#8356](https://github.com/spinnaker/spinnaker/pull/8356)).

Check warning on line 31 in content/en/continuous-deployment/release-notes/rn-armory-spinnaker/armoryspinnaker_v2-40-12.md

View workflow job for this annotation

GitHub Actions / vale

[vale] content/en/continuous-deployment/release-notes/rn-armory-spinnaker/armoryspinnaker_v2-40-12.md#L31 

[Google.WordList] Use 'app' instead of 'application'.
Raw output 
{"message": "[Google.WordList] Use 'app' instead of 'application'.", "location": {"path": "content/en/continuous-deployment/release-notes/rn-armory-spinnaker/armoryspinnaker_v2-40-12.md", "range": {"start": {"line": 31, "column": 196}}}, "severity": "WARNING"}
{{% /alert %}}

{{% alert color="info" title="Unchanged from previous 2.40.x releases" %}}
The sections below are carried over from 2.40.0 through 2.40.11 for reference. They contain no new changes in 2.40.12.
{{% /alert %}}

## Required Armory Operator version
{{% alert color="warning" title="Important" %}}
[Armory Operator]({{< ref "armory-operator" >}}) has been deprecated and will is considered EOL. Please migrate to the [Kustomize]({{< ref "armory-operator-to-kustomize-migration" >}}) method of deployment.
Expand All @@ -31,10 +50,6 @@

Service images no longer trust the `emSign ECC Root CA - G3` certificate authority ([#8242](https://github.com/spinnaker/spinnaker/pull/8242)), following reports of a CA trust issue with eMudhra's emSign hierarchy. Previous images still trusted it, along with the `EM DV/OV/EV TLS CA - G3B/G3C` and `EM OV CS CA - G3B/G3C` intermediates it issued. The images now upgrade the CA packages at build time, and the build fails if the certificate is still present in the JVM trust store. If your services connect to endpoints whose certificates chain to this root, those connections fail after the upgrade.

**emSign Root CA - G1 removed from the Java truststore of base images**

The Armory base images no longer trust the compromised eMudhra `emSign Root CA - G1` certificate authority ([armory-spinnaker-base-images#17](https://github.com/armory-io/armory-spinnaker-base-images/pull/17)). The images deselect the certificate, rebuild the Java truststore, and fail the build if `emSign Root CA - G1`, G2, G3, or Comodo AAA are still trusted. If your services connect to endpoints whose certificates chain to this root, those connections fail after the upgrade.

**Dependency updates for CVEs**

- Bouncy Castle 1.86.2 (CVE-2026-8763) ([#8287](https://github.com/spinnaker/spinnaker/pull/8287)). Earlier 2.40.x releases shipped an affected Bouncy Castle version.
Expand Down Expand Up @@ -469,8 +484,6 @@

### Fixed issues

- Gate looks up a pipeline by id only within the requested application. Previously, an id that matched a pipeline name in the requested application returned a pipeline from a different application, so `GET /applications/{application}/pipelineConfigs/{pipelineName}` could return another application's pipeline, and triggering by name or id could start it ([#8352](https://github.com/spinnaker/spinnaker/pull/8352)).
- Front50 validates pipeline ids on save, update, and batch update. A supplied pipeline id can no longer be associated with a different application, and updates keep the pipeline in its existing application ([#8356](https://github.com/spinnaker/spinnaker/pull/8356)).
- Orca sends the Clouddriver requests that its Retrofit 2 migration left unsent. Clouddriver's cache is refreshed again after stages delete a load balancer, create, update, or delete a security group, destroy a job, or change a Lambda function. Canceling a Run Job stage, or letting it time out, now stops the job instead of leaving it running ([#8144](https://github.com/spinnaker/spinnaker/pull/8144)).
- Clouddriver's SQL task, account definition, and event repositories retry transient database errors, such as failovers, dropped connections, and deadlocks, using the `sql.retries` settings (by default, 5 attempts with a 100 ms backoff). Previously, the retry configuration had no effect and these errors failed on the first attempt ([#8111](https://github.com/spinnaker/spinnaker/pull/8111)).
- ECS accounts pick up changes to their backing AWS account, such as a new region, without restarting Clouddriver ([#8196](https://github.com/spinnaker/spinnaker/pull/8196)).
Expand Down
83 changes: 48 additions & 35 deletions ...tinuous-deployment/release-notes/rn-armory-spinnaker/armoryspinnaker_v2-41-3.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,54 @@ FOR EXAMPLE, "Armory Continuous Deployment Release LTS" or "Armory Continuous De

>Note: If you experience production issues after upgrading Armory Continuous Deployment, roll back to a previous working version and report issues to [http://go.armory.io/support](http://go.armory.io/support).

## What's new in 2.41.3

{{% alert color="success" title="Changes since 2.41.2" %}}
These are the only changes in this release. Everything after this section is unchanged from earlier 2.41.x releases.

**Security: dependency updates for CVEs**

- Bouncy Castle 1.86.2 (CVE-2026-8763). Earlier 2.41.x releases still shipped Bouncy Castle 1.84.
- Tomcat 10.1.59 (CVE-2026-65182) ([#8268](https://github.com/spinnaker/spinnaker/pull/8268)).
- Netty 4.1.137.Final (CVE-2026-75595) ([#8267](https://github.com/spinnaker/spinnaker/pull/8267)).

**Gate: API rate limiting**

Gate can limit how many API requests each user or service account makes. Limits are shared across Gate instances through the Redis configured in `redis.connection`. Rate limiting is off by default. When enabled, it starts in learning mode, which logs requests that go over the limit instead of rejecting them with HTTP 429. To enable, add the following to your `gate-local.yml`:

```yaml
armory:
rate-limit:
enabled: true
learning: false # default true: log over-limit requests without rejecting them
capacity: 60 # requests per rate-seconds window, default 60
rate-seconds: 10 # default 10
capacity-by-role:
- {role: SPINNAKER_ADMIN, override: 600}
capacity-by-principal:
- {principal: jenkins-bot@example.com, override: 2000}
rules:
- {name: pipeline-start, methods: [POST], path-patterns: ["/pipelines/**"], capacity: 10, rate-seconds: 60}
```

Requests that match a rule's methods and paths count against that rule's limit instead of the default one. Don't also enable the OSS `rate-limit.enabled` property: Gate fails to start if both are enabled.

**Java 25 runtime**

The Clouddriver, Echo, Fiat, Front50, Gate, Igor, Kayenta, Orca, and Rosco images now run on a Java 25 JRE. The services are still built with JDK 17. If you pass custom JVM options or run plugins that rely on JDK internals, validate them on this release.

**Fixed issues**

- Fiat renews GitHub App installation tokens. Previously, GitHub team role syncs failed with `401 Bad credentials` about an hour after Fiat started and used stale roles until Fiat restarted ([#8224](https://github.com/spinnaker/spinnaker/pull/8224)). Fiat also tolerates clock skew with GitHub and picks up a rotated GitHub App private key without a restart ([#8229](https://github.com/spinnaker/spinnaker/pull/8229)).
- A failed GitHub membership refresh no longer removes every user's roles in Fiat. Fiat keeps the last known memberships and retries ([#8224](https://github.com/spinnaker/spinnaker/pull/8224)).
- Front50 no longer overwrites its pipeline cache with an older snapshot when cache refreshes run concurrently ([#8228](https://github.com/spinnaker/spinnaker/pull/8228)).
- The pipeline editor no longer freezes when you add or select stages, open stages with an account field, or open the account dropdown in installations with thousands of accounts ([#8274](https://github.com/spinnaker/spinnaker/pull/8274)).
{{% /alert %}}

{{% alert color="info" title="Unchanged from previous 2.41.x releases" %}}
The rest of these notes are carried over from 2.41.0 through 2.41.2 for reference. They contain no new changes in 2.41.3.
{{% /alert %}}

{{% alert color="warning" title="Major upgrade" %}}
Armory CD 2.41.0 moves all AWS integrations to AWS SDK v2, removes Angular from the UI, moves Gate SAML configuration to Spring Security properties, and switches the Google provider to the Compute v1 API. Rebuild and validate custom backend and Deck plugins against 2.41.0; plugins that use removed APIs must be migrated before they can load. Validate this release in a non-production environment and read the [Breaking changes](#breaking-changes) before upgrading.
{{% /alert %}}
Expand All @@ -35,12 +83,6 @@ Armory scans the codebase as we develop and release software. Contact your Armor

Service images no longer trust the `emSign ECC Root CA - G3` certificate authority ([#8242](https://github.com/spinnaker/spinnaker/pull/8242)), following reports of a CA trust issue with eMudhra's emSign hierarchy. Previous images still trusted it, along with the `EM DV/OV/EV TLS CA - G3B/G3C` and `EM OV CS CA - G3B/G3C` intermediates it issued. The images now upgrade the CA packages at build time, and the build fails if the certificate is still present in the JVM trust store. If your services connect to endpoints whose certificates chain to this root, those connections fail after the upgrade.

**Dependency updates for CVEs**

- Bouncy Castle 1.86.2 (CVE-2026-8763). Earlier 2.41.x releases still shipped Bouncy Castle 1.84.
- Tomcat 10.1.59 (CVE-2026-65182) ([#8268](https://github.com/spinnaker/spinnaker/pull/8268)).
- Netty 4.1.137.Final (CVE-2026-75595) ([#8267](https://github.com/spinnaker/spinnaker/pull/8267)).

## Breaking changes
<!-- Copy/paste from the previous version if there are recent ones. We can drop breaking changes after 3 minor versions. Add new ones from OSS and Armory. -->

Expand Down Expand Up @@ -868,31 +910,6 @@ Clouddriver's SQL task repository now orders task history by a per-task sequence

On startup, Clouddriver migrates the `tasks` schema: it adds nullable columns, adds the `tasks_current_state_owner_idx` and `tasks_current_state_completed_at_idx` indexes, and replaces the `request_id` index with a unique index. Existing duplicate request IDs are kept and renamed with a `:duplicate:<id>` suffix. On PostgreSQL the indexes aren't created concurrently, so on large installations consider creating them with `CREATE INDEX CONCURRENTLY` before upgrading.

### Gate: API rate limiting

Gate can limit how many API requests each user or service account makes. Limits are shared across Gate instances through the Redis configured in `redis.connection`. Rate limiting is off by default. When enabled, it starts in learning mode, which logs requests that go over the limit instead of rejecting them with HTTP 429. To enable, add the following to your `gate-local.yml`:

```yaml
armory:
rate-limit:
enabled: true
learning: false # default true: log over-limit requests without rejecting them
capacity: 60 # requests per rate-seconds window, default 60
rate-seconds: 10 # default 10
capacity-by-role:
- {role: SPINNAKER_ADMIN, override: 600}
capacity-by-principal:
- {principal: jenkins-bot@example.com, override: 2000}
rules:
- {name: pipeline-start, methods: [POST], path-patterns: ["/pipelines/**"], capacity: 10, rate-seconds: 60}
```

Requests that match a rule's methods and paths count against that rule's limit instead of the default one. Don't also enable the OSS `rate-limit.enabled` property: Gate fails to start if both are enabled.

### Java 25 runtime

The Clouddriver, Echo, Fiat, Front50, Gate, Igor, Kayenta, Orca, and Rosco images now run on a Java 25 JRE. The services are still built with JDK 17. If you pass custom JVM options or run plugins that rely on JDK internals, validate them on this release.

### Fixed issues

- Paging executions by pipeline config ID honors `page` ([#7850](https://github.com/spinnaker/spinnaker/pull/7850)).
Expand All @@ -906,10 +923,6 @@ The Clouddriver, Echo, Fiat, Front50, Gate, Igor, Kayenta, Orca, and Rosco image
- Echo compares GitHub webhook signatures in constant time and no longer logs the computed digest ([#8162](https://github.com/spinnaker/spinnaker/pull/8162)).
- Fiat role syncs are faster for installations with many users and restricted resources ([#8136](https://github.com/spinnaker/spinnaker/pull/8136)).
- OSS image packages and shared Java dependencies are updated to address CVEs ([#8181](https://github.com/spinnaker/spinnaker/pull/8181)).
- Fiat renews GitHub App installation tokens. Previously, GitHub team role syncs failed with `401 Bad credentials` about an hour after Fiat started and used stale roles until Fiat restarted ([#8224](https://github.com/spinnaker/spinnaker/pull/8224)). Fiat also tolerates clock skew with GitHub and picks up a rotated GitHub App private key without a restart ([#8229](https://github.com/spinnaker/spinnaker/pull/8229)).
- A failed GitHub membership refresh no longer removes every user's roles in Fiat. Fiat keeps the last known memberships and retries ([#8224](https://github.com/spinnaker/spinnaker/pull/8224)).
- Front50 no longer overwrites its pipeline cache with an older snapshot when cache refreshes run concurrently ([#8228](https://github.com/spinnaker/spinnaker/pull/8228)).
- The pipeline editor no longer freezes when you add or select stages, open stages with an account field, or open the account dropdown in installations with thousands of accounts ([#8274](https://github.com/spinnaker/spinnaker/pull/8274)).

### Spinnaker community contributions

Expand Down
Loading