What rundeck/rundeck shipped
Written by FoxPlug from the repository's own releases; not affiliated with Rundeck. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/rundeck/rundeck; Rundeck did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of October 5, 2026
What shipped
- Warn when a scheduled job's saved user can no longer run the job. Pull request #10670
- Enable the earlyAccessJobConditional feature flag by default. Pull request #10682
- Tolerate empty path segments and restore the trailing slash on job.serverUrl. Pull request #10681
- Skip the UI-built ACL warning Selenium test in Pro when the early-access step picker is shown. Pull request #10690
- Ignore Project and Framework scoped properties when validating workflow steps on save. Pull request #10684
- Recover legacy Jasypt content that is Base64-encoded or stale-flagged plaintext. Pull request #10632
- Auto-generate a default Step Name for workflow steps. Pull request #10600
- Expose the observed job state from the job-state step plugin so later steps can branch on it. Pull request #10664
- Return 404 for direct requests to /error. Pull request #10689
- Install apt dependencies once per pipeline and reuse them in CI. Pull request #10668
Why it matters
This week brings a warning when a scheduled job's saved user can no longer run it and enables the earlyAccessJobConditional flag by default. Several fixes improve reliability: job.serverUrl keeps its trailing slash, step validation ignores Project and Framework scoped properties on save, and legacy Jasypt content that could crash-loop on upgrade is now recovered. Workflow steps also get a generated Step Name, and the job-state step plugin exposes its observed state for conditional branching.
Changelog entry
- Warn when a scheduled job's saved user can no longer run it. Pull request #10670
- Enable earlyAccessJobConditional feature flag by default. Pull request #10682
- Tolerate empty path segments and restore job.serverUrl trailing slash. Pull request #10681
- Skip the UI-built ACL warning Selenium test in Pro. Pull request #10690
- Ignore Project/Framework scoped properties when validating steps on save. Pull request #10684
- Recover legacy Jasypt content that is Base64-encoded or stale-flagged plaintext. Pull request #10632
- Auto-generate a default Step Name for workflow steps. Pull request #10600
- Expose the observed job state from the job-state step plugin. Pull request #10664
- Return 404 for direct /error requests. Pull request #10689
- Install apt dependencies once per pipeline and reuse them. Pull request #10668
- Expose plugin outputs and add Prior Steps UI building blocks. Pull request #10679
- Add Ad-hoc Steps page UI building blocks. Pull request #10678
This week: warn when a scheduled job's saved user can't run it, earlyAccessJobConditional on by default, job.serverUrl trailing slash restored, step save validation ignores scoped properties, legacy Jasypt recovery, and auto-generated Step Names.
This week in Rundeck: a warning now appears when a scheduled job's saved user can no longer run it, and the earlyAccessJobConditional feature flag is enabled by default. We also restored the trailing slash on job.serverUrl, made step validation on save ignore Project and Framework scoped properties, and added recovery for legacy Jasypt content that is Base64-encoded or stale-flagged plaintext. Workflow steps now get an auto-generated default Step Name, and the job-state step plugin exposes its observed state so later conditional steps can branch on it.
Week of September 28, 2026
What shipped
- Fixed four security issues in plugin upload and install flows. Pull request #10602
- Job executions now compute and expose per-step duration and node-dispatch count. Pull request #10510
- Added @PluginOutput annotation to expose plugin properties for conditional logic. Pull request #10612
- Restored job name autocomplete in the job reference step. Pull request #10625
- Converted user profile list page from GSP/Knockout to Vue. Pull request #10623
- Frontend changes in ui-trellis now hot reload during local development. Pull request #10671
- Dark mode form validation states now render with correct backgrounds. Pull request #10617
- Dark mode badges and secondary buttons display correct styling. Pull request #10624
- Plugin config forms with Integer, Long, and FreeSelect properties now load correctly. Pull request #10645
- Added feature flag for ad hoc step functionality. Pull request #10669
Why it matters
This week addresses security vulnerabilities in plugin handling, improves job editing workflow with restored autocomplete and hot-reloading development experience, and expands plugin capabilities with output annotations for conditional logic. Dark mode rendering issues are resolved across multiple UI components.
Changelog entry
- Security: Fixed four security issues in plugin upload and install flows Pull request #10602
- Feature: Job executions now expose per-step elapsed time and node-dispatch count Pull request #10510
- Feature: Added @PluginOutput annotation to expose plugin properties for conditional logic Pull request #10612
- Bugfix: Restored job name autocomplete in job reference step Pull request #10625
- Enhancement: Converted user profile list page to Vue Pull request #10623
- Bugfix: Frontend changes in ui-trellis now hot reload during local development Pull request #10671
- Bugfix: Dark mode form validation states render with correct backgrounds Pull request #10617
- Bugfix: Dark mode badges and secondary buttons now display correctly Pull request #10624
- Bugfix: Dark mode declares color-scheme and fixes popover arrow styling Pull request #10639
- Bugfix: Plugin config forms with Integer, Long, and FreeSelect properties load correctly Pull request #10645
- Bugfix: Fixed flaky JobEditSpec node filter test Pull request #10666
- Feature: Added adHocStep feature toggle Pull request #10669
This week: plugin security fixes, step execution metrics, @PluginOutput for conditionals, job autocomplete restored, and dark mode fixes. Plus hot reload for frontend dev.
Rundeck shipped significant improvements this week: four plugin upload security fixes, per-step execution duration metrics, the @PluginOutput annotation for conditional logic, restored job name autocomplete, and comprehensive dark mode UI fixes. Development experience improves with hot reload for ui-trellis changes during local bootRun.
Week of September 21, 2026
What shipped
- Project archive imports now require configure authorization when the import includes project configuration, node sources, or SCM configuration. Pull request #10488
- Webhook auth tokens migrated from plaintext LEGACY storage to SHA-256 hashed SECURED storage mode. Pull request #10477
- SCM job status resolution optimized to walk git history once per HEAD instead of once per job. Pull request #10629
- SCM Git Import fixed to handle HTTP 500 errors and stale cluster state in two-node clusters. Pull request #10583
- LogFileStorageService now starts log storage consumers when the plugin is configured via System Configuration. Pull request #10638
- Grails.serverURL from custom rundeck-config properties files is now visible early enough to link-generating beans. Pull request #10633
- SCM git-export with Create Branch enabled no longer wipes the working directory on re-initialization. Pull request #10563
- Apache Ant upgraded from 1.10.17 to 1.10.18 to address CVE-2026-78254. Pull request #10618
- MinIO test image in object-store-plugin tests replaced with RustFS to fix CircleCI build failures. Pull request #10641
- Custom Fields plugin-property widget fixed to preserve field values when syncing typed fields. Pull request #10620
Why it matters
This week shipped security fixes for webhook tokens and Apache Ant, critical bugfixes for SCM operations including git-export branch handling and cluster state races, and authorization improvements for project imports. Performance improvements to SCM history resolution and fixes for configuration visibility ensure more reliable operation at scale.
Changelog entry
- Project archive imports now require configure authorization when including project configuration, node sources, or SCM configuration Pull request #10488
- Webhook auth tokens migrated from LEGACY plaintext to SECURED SHA-256 hashed storage Pull request #10477
- SCM job status resolution optimized to walk git history once per HEAD instead of once per job Pull request #10629
- Fixed SCM Git Import HTTP 500 errors and stale cluster state in multi-node clusters Pull request #10583
- LogFileStorageService now starts consumers when plugin configured via System Configuration Pull request #10638
- Fixed grails.serverURL visibility for link-generating beans when set via rundeck-config properties Pull request #10633
- SCM git-export no longer wipes working directory on Create Branch re-initialization Pull request #10563
- Upgraded Apache Ant from 1.10.17 to 1.10.18 to address CVE-2026-78254 Pull request #10618
- Replaced unavailable MinIO test image with RustFS in object-store-plugin tests Pull request #10641
- Fixed Custom Fields widget value-loss bug in DynamicFormPluginProp Pull request #10620
New Rundeck releases this week: security fixes for webhook tokens and Apache Ant, SCM git-export working directory fix, authorization for project configuration imports, and SCM job status performance optimization.
Rundeck shipped significant improvements this week: webhook auth tokens now use SHA-256 hashing instead of plaintext storage, SCM git-export no longer destroys working directories on branch re-init, and project configuration imports require proper authorization. Performance optimization cuts SCM history walks by a factor of job count. Security patches address CVE-2026-78254 in Apache Ant.
Week of September 14, 2026
What shipped
- Security fix removes hardcoded default encryption password from RPM/DEB package installs. Pull request #10597
- Security fix stops caching plaintext LDAP passwords in heap memory. Pull request #10559
- Security fix upgrades reactor-core to address two Denial of Service vulnerabilities (CVE-2026-47857, CVE-2026-47863). Pull request #10606
- Security fix addresses path traversal vulnerability in Apache Ivy (CVE-2026-26032). Pull request #10595
- Bugfix restores job options and notifications when server-side validation fails during save. Pull request #10579
- Bugfix prevents 500 errors on Nodes page when a node source fails to load. Pull request #10592
- Bugfix restores rundeck-cli session authentication behind forwarded-headers proxies. Pull request #10596
- Bugfix strips trailing slash from job.serverUrl context variable to fix HTTP 400 errors. Pull request #10594
- Bugfix corrects osFamily detection for Ansible-discovered Windows nodes. Pull request #10607
- Bundled plugin versions updated to latest releases including ansible-plugin 5.1.3. Pull request #10616
Why it matters
This week addresses multiple security vulnerabilities in encryption, LDAP authentication, and dependencies that affect production deployments. Several regressions from recent releases are fixed, restoring functionality in proxy environments, job editing, and node discovery.
Changelog entry
- Security: Remove hardcoded default encryption password from RPM/DEB package installs (RUN-4532) Pull request #10597
- Security: Stop caching plaintext LDAP passwords in JettyCachingLdapLoginModule heap cache (RUN-4551) Pull request #10559
- Security: Upgrade reactor-core to 3.8.7 to fix CVE-2026-47857 and CVE-2026-47863 Pull request #10606
- Security: Upgrade Apache Ivy to fix CVE-2026-26032 path traversal vulnerability Pull request #10595
- Fix: Restore job options and notifications when server-side validation fails (RUN-4922) Pull request #10579
- Fix: Prevent 500 error on Nodes page when a node source fails to load (RUN-4952) Pull request #10592
- Fix: Restore rundeck-cli session authentication behind forwarded-headers proxies (RUN-4947) Pull request #10596
- Fix: Strip trailing slash from job.serverUrl context variable to prevent HTTP 400 errors (RUN-4919) Pull request #10594
- Fix: Correct osFamily detection for Ansible-discovered Windows nodes (RUN-4940) Pull request #10607
- Fix: Don't persist STATIC_TEXT plugin properties into saved job config (RUN-4866) Pull request #10539
- Fix: Keep AutogenInstanceId props out of STATIC_TEXT exclusion in pluginConfig (RUN-4866) Pull request #10619
- Fix: Correct newline trimming in storage config template (RUN-4971) Pull request #10590
- Fix: Log Output respects disabled Follow setting on large execution logs (RUN-4814) Pull request #10562
- Fix: rd system acls create no longer fails with JsonParseException (RUN-4790) Pull request #10537
- Fix: Error handler branch distinguished from main step in execution context (RUN-4837) Pull request #10582
- Fix: Explicitly request demographic/password attributes in LDAP findUser() (RUN-4860) Pull request #10532
- Fix: Add rundeck.metrics.legacy.enabled to Docker remco config template (RUN-4859) Pull request #10531
- Update: Bump bundled plugin versions to latest releases Pull request #10616
- Maintenance: Prettier config and prettier/prettier promoted to error in ui-trellis (RUN-4869) Pull request #10605
- Maintenance: Standardize TypeScript version across packages (RUN-4873) Pull request #10587
Week's highlights: security fixes for encryption defaults, LDAP password caching, and dependency CVEs. Bugfixes for job option persistence, node page errors, CLI auth behind proxies, and context variables.
This week's Rundeck updates focus on security and stability. We've addressed hardcoded encryption passwords in package installs, plaintext LDAP password caching, and dependency vulnerabilities. Several regressions are fixed: job options now persist when validation fails, the Nodes page handles failed sources gracefully, rundeck-cli works behind forwarded-headers proxies again, and context variables format correctly for API calls. Bundled plugins updated to latest releases.