🔧 Renovate: Update (minor) semaphoreui/semaphore Docker tag to v2.18.2 #2487
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: Trez/rinoa-docker#2487
Reference in New Issue
Block a user
Delete Branch "renovate/docker-compose-semaphoreui-semaphore-v2-18-2"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
v2.16.51→v2.18.2⚡ Renovate Update Info
Update Type: minor
Automerge: 🛑 This update requires manual approval
Release Notes
semaphoreui/semaphore (semaphoreui/semaphore)
v2.18.2Compare Source
Bugfixes
SEMAPHORE_DB_PASS.v2.18.1Compare Source
This is a substantial beta release that pushes Semaphore meaningfully further into enterprise-grade secrets management, hardens the API token lifecycle, expands the runner scheduling model, and absorbs a flurry of security and dependency fixes — many of them caught and triaged by automated review bots (Cursor, ChatGPT Codex) before merge. It also bumps the bundled Ansible runtime by two major versions.
Below is a qualitative, themed walkthrough rather than a flat PR list.
Secret storage: two new external backends + a hard look at ownership
The headline feature of this release is first-class support for two more enterprise secret backends, joining the existing Devolutions Server (DVLS) integration:
azcore,azidentity,azsecrets). Auth follows the same DB / env-var / file pattern as AWS SM and DVLS, and the backend was refactored to consolidateSyncSecretsacross all storage types into a single function.Alongside the new backends, an unusually large cluster of secret-related security fixes landed — almost all of them automatically flagged by
cursor[bot]during review:ErrReadOnlyStoragesentinel + a silent delete error on environment secrets (the operation appeared to succeed while failing).unsetenvfor sensitive config fields after they're consumed, so they don't linger in process memory available to child processes.returnstatements after error responses in auth/env handlers (classic continue-after-error logic bug).The pattern here is notable: the new backends were merged together with a methodical sweep of the existing secret-handling code, suggesting the secrets subsystem received a deliberate audit pass.
API tokens grow up
Two complementary PRs turn API tokens from disposable opaque strings into something closer to a managed credential:
expires_at. Creation rejects non-future values; bearer-token authentication checks expiry on every request via a newIsExpiredAtmethod, so revocation-by-time is enforced before the request handler even runs. This also added rollback SQL for the migration.@setswei. Tokens get anamefield, which is the small UX touch that finally makes a token list legible when you have more than two of them.Together with [#3785](#3785) (a nil pointer dereference fix in TOTP session verification), the auth surface in this release is meaningfully more robust.
Runners: tags become a first-class scheduling primitive
[#3804](#3804) is the largest single feature in the release (24 commits) and is worth understanding architecturally rather than as a list of bullets:
runner__tagjoin table replaces the previous single-stringtagcolumn, so a runner can carry multiple tags.RunnerTagFilterModeenum (CompleteMatch,HasNoTags,IsDefault,IgnoreTags,HasAnyTag) governs how tasks pick runners.The PR is also a fascinating case study in automated code review actually working:
cursor[bot]repeatedly flagged an inverted condition inservices/tasks/RemoteJob.gowheretagFilterModewas set backward (tagged jobs would have routed to untagged runners and vice versa, breaking the isolation guarantee that's the whole point of the feature). Across roughly five review cycles the maintainer (@fiftin) iterated until the logic was right. Aboltdriver caveat —db:"-"tags causing tag persistence to silently break on Bolt deployments — was raised by the Codex reviewer; worth verifying for anyone still on Bolt.A related smaller change, [#3793](#3793), refactored the
syncflag handling, which was prerequisite plumbing.Admin observability
[#3782](#3782) adds a System Information dialog for admins — a new admin-only
GET /admin/infoendpoint backing a UI dialog that surfaces:tmp_path,home_dir_modeThis is genuinely useful for support triage — the kind of "what version of everything is this server running?" question that previously required SSH access. The endpoint is correctly gated by
adminMiddlewareserver-side, with the UI also guarding render withv-if="user && user.admin". Notably, several of these values were already exposed to all authenticated users via/api/info; the new endpoint is more restrictive than what existed before.Ansible jumps two major versions
[#3736](#3736) (first contribution from
@sevencastles) bumps the bundled Ansible from 11.1.0 → 13.5.0 (ansible-core 2.20.4). This is a non-trivial jump for anyone running Ansible workloads against the Semaphore image — playbooks that relied on collections or behavior from Ansible 11 should be re-tested. There are no notes about pinned-version overrides, so the upgrade is mandatory for users on the official image.Terraform: stop logic finally works
[#3694](#3694) — a long-standing bug from
@JulianKap: stopping a Terraform task while it sat inwaiting_confirmation(the human-approval gate between plan and apply) didn't actually stop it. Now it does. For anyone using Terraform integration, this closes one of the more annoying state machine quirks.Quality-of-life and infrastructure
A few smaller items worth flagging:
@lawrence3699) — CLI command strings are no longer translated. Translatingansible-playbookinto other languages was, predictably, breaking command execution.chownis now scoped to directories the process actually has access to, instead of attempting it everywhere and erroring noisily.@gaetan-steininger) — updated to recommend SQLite over Bolt, which is now deprecated. Worth noting alongside the Bolt-driver concern raised on #3804: Bolt's days are numbered, and new features may not get the same testing coverage on it.Dependency churn
This release pulled in a high volume of dependency bumps. The notable security-relevant ones:
go-git/go-git/v5→ v5.17.2 ([#3732](#3732), [#3751](#3751)) — security advisory fix.go-jose/go-jose/v4→ v4.1.4 ([#3745](#3745)) — patches CVE-2026-34986 (DoS via JWE decryption panic), which is in Semaphore's path because it's transitively used by the OIDC login flow.axios→ v1.15.0/v1.15.2 ([#3756](#3756), [#3800](#3800)) — security advisory.node-forge→ 1.4.0 ([#3728](#3728))go-ldap/ldap/v3→ v3.4.13 ([#3767](#3767))Azure/go-ntlmssp→ v0.1.1 ([#3794](#3794)) — also feeds into the Azure work.Plus routine bumps of
lodash,picomatch,flatted,follow-redirects,prettier,core-js,dotenv,openai, andactions/checkout.A small style/config cleanup (
[588b369d](https://github.com/semaphoreui/semaphore/commit/588b369d)) removes some extra config validation.New contributors
Four first-time contributors landed code this release:
@gaetan-steininger,@lawrence3699,@sevencastles, and@setswei. The community continues to broaden.Headline takeaways for upgraders
expires_atandnamefields; they're optional but the inflection point to start using them is now.v2.17.39Compare Source
Bugfixes
v2.17.38Compare Source
Changes
v2.17.37Compare Source
v2.17.36Compare Source
Changelog
07b5c05fix(subscr): show correct message6b5a4aeMerge pull request #3754 from semaphoreui/fix/ldap_filter_injectionv2.17.35Compare Source
v2.17.34Compare Source
v2.17.33Compare Source
Changelog
629fc09fix(repo): use *_internal directory to store requirements hash filev2.17.32Compare Source
Semaphore UI v2.17.32 – Release Summary
This release focuses on runner reliability, security improvements, and overall stability, along with several bug fixes and translation updates.
🚀 Improvements
Runners are now selected randomly, improving load balancing and avoiding uneven task distribution across runners.
🔐 Security & Safety
The
access_key_encryptionsetting is now validated during startup to prevent misconfiguration issues early.Restoring projects from backup now requires admin permissions, improving security around sensitive operations.
🐛 Bug Fixes
🌍 Localization
What's Changed
New Contributors
Full Changelog: https://github.com/semaphoreui/semaphore/compare/v2.17.31...v2.17.32
v2.17.31Compare Source
Changelog
v2.17.30Compare Source
Changelog
3f8c2b9fix(env): allow empty secret prefixWhat's Changed
Full Changelog: https://github.com/semaphoreui/semaphore/compare/v2.17.28...v2.17.30
v2.17.29Compare Source
v2.17.28Compare Source
Release v2.17.28
This release improves runner-to-task tracking and fixes task status handling in the runner update flow.
A new
runner_idfield was added to tasks in the database, which makes it possible to persist the association between a task and the runner executing it. This improves internal task tracking and lays the groundwork for more reliable runner state handling.This release also fixes a bug in the runner update logic where the current task state was checked using the wrong field. In
api/runners/runners.go, the status check was corrected fromjob.Status.IsFinished()totsk.Task.Status.IsFinished(), ensuring the system evaluates the actual stored task state before applying runner updates. This makes task state transitions more accurate during runner execution.What's changed
runner_idto the task record in the database for better runner-to-task association. (#3712)Full Changelog
https://github.com/semaphoreui/semaphore/compare/v2.17.27...v2.17.28
v2.17.27Compare Source
Bugfixes
Fixed bug with running Terragrunt
v2.17.26Compare Source
Changelog
3b278d1fix(secrets): null pointerFull Changelog: https://github.com/semaphoreui/semaphore/compare/v2.17.24...v2.17.26
v2.17.25Compare Source
v2.17.24Compare Source
Changelog
b9cb5befix(secrets): provide source storage type in var groupsWhat's Changed
New Contributors
Full Changelog: https://github.com/semaphoreui/semaphore/compare/v2.17.22...v2.17.24
v2.17.23Compare Source
v2.17.22Compare Source
This patch release includes a small fix related to integrations permissions.
Fixes
Full Changelog: https://github.com/semaphoreui/semaphore/compare/v2.17.21...v2.17.22
v2.17.21Compare Source
Changelog
3a04fdaMerge branch '2-17-stable' into developFull Changelog: https://github.com/semaphoreui/semaphore/compare/v2.17.17...v2.17.21
v2.17.20Compare Source
v2.17.19Compare Source
v2.17.18Compare Source
v2.17.17Compare Source
Changelog
9c82d18Merge pull request #3689 from semaphoreui/load_secretsWhat's Changed
Full Changelog: https://github.com/semaphoreui/semaphore/compare/v2.17.16...v2.17.17
v2.17.16Compare Source
Changelog
140584fci(docker): fix migration conditionWhat's Changed
Full Changelog: https://github.com/semaphoreui/semaphore/compare/v2.17.15...v2.17.16
v2.17.15Compare Source
Here’s a clean release summary you can use:
Semaphore UI v2.17.15
Overview
This release improves secret management flexibility and includes minor internal cleanup and dependency updates.
✨ Highlights
🔐 Read Secrets from Raw Files
You can now load secrets directly from a raw file. This makes it easier to integrate with:
This enhancement simplifies secure automation workflows and improves compatibility with production setups.
What's Changed
Full Changelog: https://github.com/semaphoreui/semaphore/compare/v2.17.14...v2.17.15
v2.17.14Compare Source
Changelog
v2.17.12Compare Source
🚀 Release Summary
This release introduces improved task control, an important database migration capability, and multiple dependency updates for stability and security.
✨ Highlights
BoltDB → SQL migration tool (major step forward)
This is a key improvement for scalability and aligns with the future removal of BoltDB support.
🔧 Maintenance & Security
🙌 Community
Changelog
3e5e0deci(github): return GH_TOKEN for dockerWhat's Changed
New Contributors
Full Changelog: https://github.com/semaphoreui/semaphore/compare/v2.17.8...v2.17.12
v2.17.10Compare Source
v2.17.9Compare Source
v2.17.8Compare Source
Release Summary
This is a small maintenance release focused on improving task control and integration behavior, along with routine dependency updates.
✨ New Features
Added the ability to stop all running tasks with force option, giving administrators faster control in emergency or cleanup scenarios.
🔧 Improvements & Fixes
Extracted values in integrations now correctly take precedence, ensuring more predictable configuration behavior.
Changelog
38d2d2afix(integrations): extracted values has priorityWhat's Changed
Full Changelog: https://github.com/semaphoreui/semaphore/compare/v2.17.7...v2.17.8
v2.17.7Compare Source
Release Summary
This release focuses on logging improvements, Docker usability, and dependency updates.
✨ Improvements
Syslog output now follows the RFC 5424 standard, improving compatibility with enterprise logging systems and SIEM platforms.
🐳 Docker
Docker deployments now correctly provide the configuration path when importing settings.
Changelog
7c3cc4ffix(docker): provide config path for importWhat's Changed
Full Changelog: https://github.com/semaphoreui/semaphore/compare/v2.17.5...v2.17.7
v2.17.6Compare Source
v2.17.5Compare Source
Release Summary
This release delivers a fix for scheduled task configuration stability.
🛠 Fixes
Fixed a bug where task properties were not saved or updated correctly when working with schedules. This improves reliability and consistency of scheduled task configuration.
Changelog
23d300cfix(schedule): saving/updating task props (#3304)Full Changelog: https://github.com/semaphoreui/semaphore/compare/v2.17.4...v2.17.5
v2.17.4Compare Source
Summary
This release focuses on performance improvements, permission fixes, and small usability enhancements, along with routine dependency updates and test coverage improvements.
🚀 Performance
🔐 Permissions & UI fixes
⚙️ Improvements
🧪 Testing & Maintenance
getHomeDir.core-jsdependency.Changelog
e49d030Merge pull request #3619 from semaphoreui/perf/optimize_db_queriesWhat's Changed
Full Changelog: https://github.com/semaphoreui/semaphore/compare/v2.17.2...v2.17.4
v2.17.3Compare Source
v2.17.2Compare Source
Release Summary
This release introduces high availability improvements, enhanced integrations, and important security and dependency updates.
✨ New Features
Active-active high availability
Added support for active-active HA deployments, allowing multiple Semaphore UI nodes to operate simultaneously for improved scalability and resilience.
Integration task details via headers
Integrations can now return created task details through response headers, enabling better automation workflows and easier external system integration.
🔒 Security & Maintenance
👋 Community
What's Changed
Full Changelog: https://github.com/semaphoreui/semaphore/compare/v2.17.0...v2.17.2
v2.17.0Compare Source
Semaphore 2.17 Release Details
--registerflag forrunnercommandLinks
Create best docker container
Join our responsive community
Configuration
📅 Schedule: (UTC)
* 0-4,22-23 * * 1-5)* * * * 0,6)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate.
d45a5e4dabtoe99744e7cde99744e7cdto5215cb33f95215cb33f9tob43239bb8eb43239bb8etob64cd47786b64cd47786toa864cac0d7a864cac0d7to7c50a0885e7c50a0885eto201d639265201d639265to62e31960bb62e31960bbtod17115e761d17115e761to9065a96c4e9065a96c4eto9c3dbd815c