semaphore

v2.19.5-beta4 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 21d Infrastructure as Code

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

ansible awx ci-cd devops docker docker-ui

+7 more

go jenkins opentofu pulumi terraform terraform-ui terragrunt

Affected surfaces

auth rce_ssrf

Summary

AI summary

Updates Docker fixes, Internal changes, and Security fixes across a mixed release.

Full changelog

v2.19.5-beta4 Release Summary

This beta release includes runner status improvements, Docker image fixes, security hardening for Git repositories, dependency updates, and backend refactoring.

Improvements

Added runner status reporting in the API and web UI, so runners can now be shown as online or offline.
Added backend logic to calculate runner status based on the latest runner heartbeat.
Improved integration handling by moving integration storage access into the integration controller.

Security fixes

Added Git repository URL validation to prevent Git option injection.
Repository URLs that start with - are now rejected because Git could interpret them as command-line options instead of repository locations.

Docker fixes

Added Paramiko support to the Docker image for Ansible environments.
Fixed the Docker package/library name used for Paramiko installation.

Dependencies

Updated axios to v1.18.1.
Updated github.com/coreos/go-oidc/v3 to v3.19.0.
Improved Renovate configuration with a custom manager.

Internal changes

Added an implementation plan for IdP-initiated OIDC authentication.
Refactored backend code to use dependency injection in integrations.
Added tests for runner status calculation.

Security Fixes

Git repository URL validation rejects URLs starting with `-` to prevent Git option injection

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track semaphore

Get notified when new releases ship.

About semaphore

Modern UI and powerful API for Ansible, Terraform/OpenTofu/Terragrunt, PowerShell and other DevOps tools.

All releases →