What litmuschaos/litmus shipped
Written by FoxPlug from the repository's own releases; not affiliated with Litmuschaos. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/litmuschaos/litmus; Litmuschaos did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of October 26, 2026
What shipped
- Chaos infrastructure no longer stays stuck INACTIVE when a subscriber disconnects abruptly, fixing the stale entry in the in-memory connection map. Pull request #5621
- Authentication now returns 400 instead of exiting the process when the createdByMe or ascending query params on the list projects endpoint cannot be parsed. Pull request #5649
- The ChaosCenter dashboard now supports dark mode with a persisted theme setting and a toggle in the header available from every page. Pull request #5608
- The Chaos Center web UI build now uses a multi-stage Dockerfile with pnpm and BuildKit cache mounts instead of running Yarn in CI. Pull request #5660
- A new Editor role has been added. Pull request #5340
- The ReadMore component now has unit tests covering its toggle between truncated and full text. Pull request #5651
- The installation manifest for the 3.33.0 version has been added. Pull request #5687
- The email address for oumkale has been updated. Pull request #5681
Why it matters
This week brings a reliability fix for chaos infrastructure that could remain INACTIVE after an abrupt disconnect, and an authentication fix that stops a malformed query parameter from terminating the process. It also adds dark mode and a faster, reproducible web UI build, plus a new Editor role and test coverage for the ReadMore component. The 3.33.0 installation manifest is now available for users installing that version.
Changelog entry
- Fix chaos infrastructure staying INACTIVE after abrupt subscriber disconnect. Pull request #5621
- Return 400 on invalid createdByMe or ascending query params instead of terminating the process. Pull request #5649
- Add dark mode support to the ChaosCenter dashboard with persisted theme state and a header toggle. Pull request #5608
- Build the Chaos Center web UI using a multi-stage Dockerfile with pnpm and BuildKit cache mounts. Pull request #5660
- Add the Editor role. Pull request #5340
- Add unit tests for the ReadMore component. Pull request #5651
- Add the installation manifest for version 3.33.0. Pull request #5687
- Update the email address for oumkale. Pull request #5681
This week in Litmus: chaos infra no longer stuck INACTIVE after abrupt subscriber disconnect, authentication returns 400 on bad query params instead of exiting, dark mode lands in ChaosCenter, a pnpm multi-stage Dockerfile for the web UI, a new Editor role, and unit tests for Rea
This week in Litmus: we fixed chaos infrastructure getting stuck INACTIVE after an abrupt subscriber disconnect, and authentication now returns 400 when the createdByMe or ascending query params on the list projects endpoint are invalid instead of exiting the process. ChaosCenter gained dark mode with a persisted theme toggle, the web UI build moved to a multi-stage Dockerfile using pnpm with BuildKit cache mounts, and a new Editor role was added. ReadMore component unit tests were added, the installation manifest for 3.33.0 is available, and oumkale's email address was updated.
Week of October 12, 2026
What shipped
- Version 3.33.0 shipped with a fix for adminModeNamespace in the chaos engine probe check, build pipeline fixes, and new unit tests for ChaosHub output mapping and the Loader component. Release
- GitOps synchronization no longer panics when new manifests create inline probes; syncing now uses a background context and resolves audit usernames from authenticated contexts or the system actor. Pull request #5615
- Deleting a single experiment run no longer removes the experiment manifest from the GitOps repository while the experiment stays in ChaosCenter. Pull request #5644
- GetProjectById now checks the FindUsersByUID error before using the result, preventing a panic that could take down the authentication server. Pull request #5643
- Listing experiments by name now sorts in the requested direction; ascending requests were previously sorted descending and the other way round. Pull request #5642
- CUSTOM_TLS_CERT moved from the subscriber-config ConfigMap to the subscriber-secret Secret in the cluster and namespace agent manifests. Pull request #5637
- GetProjectStats now stops after the admin check fails, so a non-admin request no longer receives two JSON bodies in one response. Pull request #5636
- Date-range formatting now compares calendar days including the year, so ranges spanning different years display correctly. Pull request #5646
- The Duration component now normalizes timestamp precision, handling second-precision timestamps from the API as well as millisecond ones. Pull request #5634
- Saving an experiment on GitOps-configured projects now dispatches cron schedule updates to the subscriber instead of passing a nil state argument. Pull request #5628
Why it matters
This week's changes focus on reliability: several fixes stop panics and bad responses in the auth server, project stats and GitOps sync, and protect experiment manifests during run deletion. Users also get more predictable experiment sorting, correct date ranges across years, and a TLS certificate stored in a Secret rather than a ConfigMap.
Changelog entry
- Release 3.33.0 with fixes for adminModeNamespace in the chaos engine probe check, build pipeline, and new unit tests. Release
- Prevent panic when syncing inline probes during scheduled GitOps synchronization. Pull request #5615
- Keep the experiment manifest in git when deleting a single experiment run. Pull request #5644
- Check FindUsersByUID errors before use in GetProjectById to avoid an auth server panic. Pull request #5643
- Sort experiments by name in the requested direction. Pull request #5642
- Move CUSTOM_TLS_CERT from subscriber config to subscriber secret in agent manifests. Pull request #5637
- Stop GetProjectStats after a failed admin check to avoid a doubled response body. Pull request #5636
- Include the year when comparing date ranges. Pull request #5646
- Normalize timestamp precision in the Duration component. Pull request #5634
- Dispatch cron schedule updates to the subscriber when saving an experiment. Pull request #5628
Litmus 3.33.0 is out. This week: GitOps sync no longer panics on inline probes, run deletion keeps your experiment manifest in git, experiment sorting respects the requested order, and date ranges now include the year.
Litmus 3.33.0 is released. This week's fixes target reliability: GitOps synchronization no longer panics when new manifests create inline probes, and deleting a single experiment run keeps the experiment manifest in the git repository. GetProjectById now checks user lookup errors before using results, and GetProjectStats stops after a failed admin check so non-admin requests get a single response. Experiment listing sorts by name in the requested direction, the Duration component handles second-precision timestamps, and date ranges include the year. CUSTOM_TLS_CERT moved to the subscriber secret, and cron schedule updates are dispatched to the subscriber on experiment save. Release 3.33.0 also includes build pipeline fixes and new unit tests.
Week of September 28, 2026
What shipped
- Infrastructure access keys now use cryptographically secure random generation instead of math/rand. Pull request #5633
- Fixed authorization scope for invitation and project leave operations to properly validate caller identity. Pull request #5600
- Go version bumped to 1.26.0 and crypto dependencies updated to address security vulnerabilities. Pull request #5627
- Five transitive npm dependencies in the web frontend patched to resolve critical security advisories. Pull request #5631
- Protobuf dependency conflicts in fuzzing tests resolved by updating replace pins and removing legacy entries. Pull request #5632
- Unit tests added for the Loader component covering loading, no-data, and default render states. Pull request #5567
- Unit tests added for ChaosHub fault output mapping validation. Pull request #5549
- Broken documentation links fixed in adopter and translation README files. Pull request #5619
Why it matters
This week addresses multiple security concerns including cryptographic key generation, authorization validation, and dependency vulnerabilities across the Go backend and web frontend. Test coverage improvements ensure component reliability moving forward.
Changelog entry
- Infrastructure access keys now generated using crypto/rand for secure random generation Pull request #5633
- Fixed authorization validation scope for AcceptInvitation, DeclineInvitation, and LeaveProject operations Pull request #5600
- Go version bumped to 1.26.0 and x/crypto updated to v0.56.0 Pull request #5627
- Five transitive npm dependencies patched for critical security advisories Pull request #5631
- Protobuf dependency replace pins updated from v0.21.2 to v0.33.1 for fuzzing test compatibility Pull request #5632
- Added unit test coverage for Loader component including loading, no-data, and default render states Pull request #5567
- Added unit tests for ChaosFaults component validating fault rendering and link parameters Pull request #5549
- Fixed broken documentation links in adopter and translation README files Pull request #5619
This week we strengthened security with proper cryptographic key generation, fixed authorization scope issues, updated dependencies, and improved test coverage across the platform.
Litmuschaos shipped critical security updates this week: infrastructure access keys now use cryptographically secure random generation, authorization scope issues are resolved, Go and npm dependencies patched for known vulnerabilities, and new unit tests added for Loader and ChaosHub components. These changes reinforce the platform's security posture and code reliability.
Week of September 14, 2026
What shipped
- Released version 3.32.0 with updates to installation manifests, OIDC provider naming, and StatusBadgeV2 component tests. Release
- Added GraphQL query complexity limiting via FixedComplexityLimit to prevent resource exhaustion from deeply nested or abusive queries. Pull request #5595
- Fixed OIDC callback to reject unverified email claims, preventing authentication with unverified email addresses. Pull request #5601
- Fixed silent data-loss where updating a ChaosEngine manifest via the UI would overwrite pre-existing node tolerations for runners and experiments. Pull request #5590
- Refactored PredefinedExperimentController to use getPredefinedExperiment API query instead of client-side filtering, reducing network payload. Pull request #5587
- Added YAML view to ChaosProbeConfiguration component allowing users to inspect complete probe configuration as read-only YAML. Pull request #5553
- Added fuzz tests for subscriber GraphQL data marshaling to validate JSON-marshalable payloads and safe GraphQL payload quoting. Pull request #5534
Why it matters
Version 3.32.0 addresses critical security and stability issues including email verification in authentication and data-loss prevention in experiment configuration. Query complexity limiting protects the GraphQL server from resource exhaustion attacks, while performance improvements reduce network overhead when loading predefined experiments.
Changelog entry
- Chore(3.31.0): Add the installation manifest for 3.31.0 version Release
- Generalize OIDC/Dex naming to be provider-agnostic Release
- Test: Add unit tests for StatusBadgeV2 component Release
- Test: Add fuzz tests for subscriber GraphQL data marshaling Pull request #5534
- Feat: Add YAML view to ChaosProbeConfiguration Pull request #5553
- Refactor(web): Use getPredefinedExperiment API in PredefinedExperiment controller Pull request #5587
- Fix(web): Prevent ChaosEngine tolerations data-loss during experiment UI updates Pull request #5590
- Feat: Add GraphQL query complexity limiting via FixedComplexityLimit Pull request #5595
- Fix(auth): Reject unverified email claims in the OIDC callback Pull request #5601
Litmus 3.32.0 is out. New GraphQL query complexity limiting prevents resource exhaustion. Fixed OIDC email verification and ChaosEngine toleration data-loss during UI updates. Improved performance for predefined experiments.
Litmus 3.32.0 released with important security and stability improvements. GraphQL query complexity limiting protects against resource exhaustion from nested queries. Fixed OIDC callback to properly validate email verification claims. Resolved data-loss regression in ChaosEngine tolerations during UI updates. Improved performance by optimizing predefined experiment loading with targeted GraphQL queries instead of full list pagination.