This release includes 7 security fixes for security teams reviewing exposed deployments.
Topics
+2 more
Affected surfaces
ReleasePort's take
Moderate signalVersion 2.39.5 upgrades the Alpine base image to 3.24.1 and containerd to 2.2.5, patching multiple OS‑level and runtime CVEs.
Why it matters: Addresses critical CVEs (CVE‑2026‑32316, CVE‑2026‑40164, plus five containerd CVEs) in Alpine and containerd; upgrade required for secure deployments.
Summary
AI summaryFixed a regression that caused Git stack deployments with relative env_file: paths to fail or deploy without environment variables.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Upgraded Alpine base image to 3.24.1 addressing OS-level CVEs (CVE-2026-32316, CVE-2026-40164). Upgraded Alpine base image to 3.24.1 addressing OS-level CVEs (CVE-2026-32316, CVE-2026-40164). Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Security | Critical |
Upgraded containerd to 2.2.5 fixing multiple CVEs (CVE-2026-53488, CVE-2026-53492, CVE-2026-53489, CVE-2026-47262, CVE-2026-50195). Upgraded containerd to 2.2.5 fixing multiple CVEs (CVE-2026-53488, CVE-2026-53492, CVE-2026-53489, CVE-2026-47262, CVE-2026-50195). Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Bugfix | Medium |
Fixed regression where relative `env_file:` in Git stack resolved against project root instead of compose file directory. Fixed regression where relative `env_file:` in Git stack resolved against project root instead of compose file directory. Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Bugfix | Medium |
Fixed standard users not seeing all their teams in access‑control selectors due to `FilterUserTeams` dropping teams. Fixed standard users not seeing all their teams in access‑control selectors due to `FilterUserTeams` dropping teams. Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Bugfix | Medium |
Fixed deleting images from Swarm image list to remove them from all nodes, not just one. Fixed deleting images from Swarm image list to remove them from all nodes, not just one. Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Bugfix | Medium |
Fixed Docker stack deployments stuck at "Deploying" after exceeding internal 15‑minute timeout. Fixed Docker stack deployments stuck at "Deploying" after exceeding internal 15‑minute timeout. Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Bugfix | Medium |
Fixed environment details view always showing default poll frequency for Edge environments instead of saved value. Fixed environment details view always showing default poll frequency for Edge environments instead of saved value. Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Bugfix | Medium |
Improved Edge tunnel reliability over high‑latency links by adding keep‑alive, unlimited retries, and raising ping timeout from 3s to 8s. Improved Edge tunnel reliability over high‑latency links by adding keep‑alive, unlimited retries, and raising ping timeout from 3s to 8s. Source: llm_adapter@2026-07-14 Confidence: low |
— |
Full changelog
Known issues
- On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot
Known issues with Podman support
- Podman environments aren't supported by auto-onboarding script
- It's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)
- Support for only CentOS 9, Podman 5 rootful
Changes
- Fixed a 2.39.4 regression where a relative
env_file:in a Git stack whose compose file lives in a repository sub-directory was resolved against the project root instead of the compose file's own directory, deploying stacks with an empty environment or failing outright - Improved Edge tunnel reliability over high-latency links (satellite/VSAT): the server no longer tears down a half-established tunnel on timeout, keep-alive and unlimited background retries were added on the agent, and the ping timeout was raised from 3s to 8s
- Fixed standard users not seeing all of their teams in access control selectors (e.g. when restricting access on a newly created Docker Config), caused by
FilterUserTeamsincorrectly dropping teams - Fixed deleting images from the Swarm image list only removing them from a single node instead of every node they exist on
- Fixed a potential block where a Docker stack deployment exceeding the internal 15-minute timeout left the stack stuck in "Deploying" status, preventing further redeployments
- Fixed the environment details view always showing the default poll frequency for Edge environments instead of the saved value
- Upgraded the Alpine base image from 3.23.4 to 3.24.1 to address OS-level package CVEs, including the jq advisories (CVE-2026-32316, CVE-2026-40164 and others)
- Upgraded
github.com/containerd/containerd/v2to 2.2.5 to address the following CVEs:- CVE-2026-53488,
- CVE-2026-53492,
- CVE-2026-53489,
- CVE-2026-47262,
- CVE-2026-50195
Deprecated and removed features
Deprecated features
- None
Removed features
- None
Security Fixes
- Upgraded Alpine base image from 3.23.4 to 3.24.1 addressing OS‑level CVEs: CVE-2026-32316, CVE-2026-40164
- dep: Upgraded containerd/v2 to 2.2.5 fixing CVE-2026-53488, CVE-2026-53492, CVE-2026-53489, CVE-2026-47262, CVE-2026-50195
- CVE-2026-40164
- CVE-2026-53492
- CVE-2026-53489
- CVE-2026-47262
- CVE-2026-50195
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Related CVEs
Earlier breaking changes
- v2.42.0 Removal of legacy CSRF fallback feature flag.
Beta — feedback welcome: [email protected]