What rundeck/rundeck shipped

This week: webhooks work with requiredRole set, executions metrics no longer 500 when all runs are running, PowerShell file refs stay unresolved, and an opt-in property loads node sources in parallel.

This week's changes to Rundeck: webhook POSTs are no longer rejected when rundeck.security.requiredRole is set, and the executions metrics endpoint no longer returns a 500 when every matched execution is running. Unresolved PowerShell file references are preserved, Node Source error messages keep their line breaks, and the Jobs page no longer shows a duplicated header with Next UI enabled. Large execution logs no longer jump to the bottom after Follow is turned off. Also included: an opt-in project property for loading node sources in parallel and new per-step plugin and node-bucket execution metrics.

This week: execution metrics fixed on SQL Server, STATIC_TEXT config no longer breaks the Job Definition view, Git SCM job exports stop writing the user field, and duplicate DynamicForm hidden fields are prevented.

This week's changes include a fix for execution metrics on SQL Server and for metric durations that depended on time zone. Job Definition pages no longer show raw HTML markup from STATIC_TEXT plugin config values, and Git SCM job exports no longer write a user line into exported job files. The legacy job editor no longer submits duplicate hidden fields, which could persist a list instead of a single value. UI work adds dark mode styles for the PrimeVue wrappers, a layout fix in the EA plugin chooser, a bulk edit menu extension point and a toast z-index fix.

This week: project import no longer exposes execution logs across projects; scheduled Quartz runs re-check the owner's run authorization; remco rebuilt with Go 1.27.3 for CVE-2026-111943; job Exclude Filters now apply independently of node filter exclusions; job reference steps n

This week in Rundeck: a security fix ensures project import rewrites an imported execution's outputfilepath to a project-scoped value, closing a cross-project execution log disclosure. Scheduled executions triggered through Quartz now re-verify that the job's stored owner still holds run authorization for the project before an execution is created. Official Docker images now build remco with Go 1.27.3 for CVE-2026-111943. A job's Exclude Filter is now applied independently of exclusions in its own node filter, and job reference steps no longer show as Killed on successful runs. The UI no longer bundles the older DOMPurify 3.2.6 copy affected by CVE-2025-15599. On the pipeline side, the rd cli version used in CircleCI was bumped and an unused job removed. v6.3.0 shipped this week after rc4.

This week: workflow step failures keep their failureData, Git SCM remotes can be restricted, HTML tables in job descriptions render properly, and tzdb was updated to 2026e on both the browser and server sides for the 2026 Canadian time zone changes. 6.3.0-rc3 is out.

Changes this week: failed workflow step plugins now keep their failureData so the exit code survives, Git SCM import and export gained optional controls on accepted remotes, and HTML table blocks in job descriptions render as formatted tables instead of escaped tag text. The legacy UI moment-timezone bundle and the ubuntu-base Docker image JDK tzdb were both updated to IANA 2026e for the 2026 Canadian time zone changes, covering browser and Quartz schedules. Executions gained a note field, the Docker remco template exposes the execution job dimension metrics setting, and 6.3.0-rc3 was published.

This week: warn when a scheduled job's saved user can't run it, earlyAccessJobConditional on by default, job.serverUrl trailing slash restored, step save validation ignores scoped properties, legacy Jasypt recovery, and auto-generated Step Names.

This week in Rundeck: a warning now appears when a scheduled job's saved user can no longer run it, and the earlyAccessJobConditional feature flag is enabled by default. We also restored the trailing slash on job.serverUrl, made step validation on save ignore Project and Framework scoped properties, and added recovery for legacy Jasypt content that is Base64-encoded or stale-flagged plaintext. Workflow steps now get an auto-generated default Step Name, and the job-state step plugin exposes its observed state so later conditional steps can branch on it.

This week: plugin security fixes, step execution metrics, @PluginOutput for conditionals, job autocomplete restored, and dark mode fixes. Plus hot reload for frontend dev.

Rundeck shipped significant improvements this week: four plugin upload security fixes, per-step execution duration metrics, the @PluginOutput annotation for conditional logic, restored job name autocomplete, and comprehensive dark mode UI fixes. Development experience improves with hot reload for ui-trellis changes during local bootRun.

New Rundeck releases this week: security fixes for webhook tokens and Apache Ant, SCM git-export working directory fix, authorization for project configuration imports, and SCM job status performance optimization.

Rundeck shipped significant improvements this week: webhook auth tokens now use SHA-256 hashing instead of plaintext storage, SCM git-export no longer destroys working directories on branch re-init, and project configuration imports require proper authorization. Performance optimization cuts SCM history walks by a factor of job count. Security patches address CVE-2026-78254 in Apache Ant.

Week's highlights: security fixes for encryption defaults, LDAP password caching, and dependency CVEs. Bugfixes for job option persistence, node page errors, CLI auth behind proxies, and context variables.

This week's Rundeck updates focus on security and stability. We've addressed hardcoded encryption passwords in package installs, plaintext LDAP password caching, and dependency vulnerabilities. Several regressions are fixed: job options now persist when validation fails, the Nodes page handles failed sources gracefully, rundeck-cli works behind forwarded-headers proxies again, and context variables format correctly for API calls. Bundled plugins updated to latest releases.