What rundeck/rundeck shipped
Written by FoxPlug from public releases; not affiliated with Rundeck. An automatic summary of the public release, pull request and commit data of github.com/rundeck/rundeck. Rundeck did not write it and does not use or endorse FoxPlug. Every line links to the public change it describes.
Get a weekly update like this for your product, free
Week of September 21, 2026
What shipped
- Project archive imports now require configure authorization when the import includes project configuration, node sources, or SCM configuration. Pull request #10488
- Webhook auth tokens migrated from plaintext LEGACY storage to SHA-256 hashed SECURED storage mode. Pull request #10477
- SCM job status resolution optimized to walk git history once per HEAD instead of once per job. Pull request #10629
- SCM Git Import fixed to handle HTTP 500 errors and stale cluster state in two-node clusters. Pull request #10583
- LogFileStorageService now starts log storage consumers when the plugin is configured via System Configuration. Pull request #10638
- grails.serverURL from custom rundeck-config properties files is now visible early enough to link-generating beans. Pull request #10633
- SCM git-export with Create Branch enabled no longer wipes the working directory on re-initialization. Pull request #10563
- Apache Ant upgraded from 1.10.17 to 1.10.18 to address CVE-2026-78254. Pull request #10618
- MinIO test image in object-store-plugin tests replaced with RustFS to fix CircleCI build failures. Pull request #10641
- Custom Fields plugin-property widget fixed to preserve field values when syncing typed fields. Pull request #10620
Why it matters
This week shipped security fixes for webhook tokens and Apache Ant, critical bugfixes for SCM operations including git-export branch handling and cluster state races, and authorization improvements for project imports. Performance improvements to SCM history resolution and fixes for configuration visibility ensure more reliable operation at scale.
Changelog entry
- Project archive imports now require configure authorization when including project configuration, node sources, or SCM configuration (#10488) Pull request #10488
- Webhook auth tokens migrated from LEGACY plaintext to SECURED SHA-256 hashed storage (#10477) Pull request #10477
- SCM job status resolution optimized to walk git history once per HEAD instead of once per job (#10629) Pull request #10629
- Fixed SCM Git Import HTTP 500 errors and stale cluster state in multi-node clusters (#10583) Pull request #10583
- LogFileStorageService now starts consumers when plugin configured via System Configuration (#10638) Pull request #10638
- Fixed grails.serverURL visibility for link-generating beans when set via rundeck-config properties (#10633) Pull request #10633
- SCM git-export no longer wipes working directory on Create Branch re-initialization (#10563) Pull request #10563
- Upgraded Apache Ant from 1.10.17 to 1.10.18 to address CVE-2026-78254 (#10618) Pull request #10618
- Replaced unavailable MinIO test image with RustFS in object-store-plugin tests (#10641) Pull request #10641
- Fixed Custom Fields widget value-loss bug in DynamicFormPluginProp (#10620) Pull request #10620
New Rundeck releases this week: security fixes for webhook tokens and Apache Ant, SCM git-export working directory fix, authorization for project configuration imports, and SCM job status performance optimization.
Rundeck shipped significant improvements this week: webhook auth tokens now use SHA-256 hashing instead of plaintext storage, SCM git-export no longer destroys working directories on branch re-init, and project configuration imports require proper authorization. Performance optimization cuts SCM history walks by a factor of job count. Security patches address CVE-2026-78254 in Apache Ant.
Week of September 14, 2026
What shipped
- Security fix removes hardcoded default encryption password from RPM/DEB package installs. Pull request #10597
- Security fix stops caching plaintext LDAP passwords in heap memory. Pull request #10559
- Security fix upgrades reactor-core to address two Denial of Service vulnerabilities (CVE-2026-47857, CVE-2026-47863). Pull request #10606
- Security fix addresses path traversal vulnerability in Apache Ivy (CVE-2026-26032). Pull request #10595
- Bugfix restores job options and notifications when server-side validation fails during save. Pull request #10579
- Bugfix prevents 500 errors on Nodes page when a node source fails to load. Pull request #10592
- Bugfix restores rundeck-cli session authentication behind forwarded-headers proxies. Pull request #10596
- Bugfix strips trailing slash from job.serverUrl context variable to fix HTTP 400 errors. Pull request #10594
- Bugfix corrects osFamily detection for Ansible-discovered Windows nodes. Pull request #10607
- Bundled plugin versions updated to latest releases including ansible-plugin 5.1.3. Pull request #10616
Why it matters
This week addresses multiple security vulnerabilities in encryption, LDAP authentication, and dependencies that affect production deployments. Several regressions from recent releases are fixed, restoring functionality in proxy environments, job editing, and node discovery.
Changelog entry
- Security: Remove hardcoded default encryption password from RPM/DEB package installs (RUN-4532) Pull request #10597
- Security: Stop caching plaintext LDAP passwords in JettyCachingLdapLoginModule heap cache (RUN-4551) Pull request #10559
- Security: Upgrade reactor-core to 3.8.7 to fix CVE-2026-47857 and CVE-2026-47863 Pull request #10606
- Security: Upgrade Apache Ivy to fix CVE-2026-26032 path traversal vulnerability Pull request #10595
- Fix: Restore job options and notifications when server-side validation fails (RUN-4922) Pull request #10579
- Fix: Prevent 500 error on Nodes page when a node source fails to load (RUN-4952) Pull request #10592
- Fix: Restore rundeck-cli session authentication behind forwarded-headers proxies (RUN-4947) Pull request #10596
- Fix: Strip trailing slash from job.serverUrl context variable to prevent HTTP 400 errors (RUN-4919) Pull request #10594
- Fix: Correct osFamily detection for Ansible-discovered Windows nodes (RUN-4940) Pull request #10607
- Fix: Don't persist STATIC_TEXT plugin properties into saved job config (RUN-4866) Pull request #10539
- Fix: Keep AutogenInstanceId props out of STATIC_TEXT exclusion in pluginConfig (RUN-4866) Pull request #10619
- Fix: Correct newline trimming in storage config template (RUN-4971) Pull request #10590
- Fix: Log Output respects disabled Follow setting on large execution logs (RUN-4814) Pull request #10562
- Fix: rd system acls create no longer fails with JsonParseException (RUN-4790) Pull request #10537
- Fix: Error handler branch distinguished from main step in execution context (RUN-4837) Pull request #10582
- Fix: Explicitly request demographic/password attributes in LDAP findUser() (RUN-4860) Pull request #10532
- Fix: Add rundeck.metrics.legacy.enabled to Docker remco config template (RUN-4859) Pull request #10531
- Update: Bump bundled plugin versions to latest releases Pull request #10616
- Maintenance: Prettier config and prettier/prettier promoted to error in ui-trellis (RUN-4869) Pull request #10605
- Maintenance: Standardize TypeScript version across packages (RUN-4873) Pull request #10587
Week's highlights: security fixes for encryption defaults, LDAP password caching, and dependency CVEs. Bugfixes for job option persistence, node page errors, CLI auth behind proxies, and context variables.
This week's Rundeck updates focus on security and stability. We've addressed hardcoded encryption passwords in package installs, plaintext LDAP password caching, and dependency vulnerabilities. Several regressions are fixed: job options now persist when validation fails, the Nodes page handles failed sources gracefully, rundeck-cli works behind forwarded-headers proxies again, and context variables format correctly for API calls. Bundled plugins updated to latest releases.