This release is a minor maintenance and bug-fix release.$$$$$$Enhancements$$$#11355 - Provide Alpine arm64/aarch64 agent container image variants$$$#13554 - Add support for PKCS8 encrypted private keys to be used by agents$$$#13620 - Improve error messages during certain config repo plugin parsing failures$$$#13598 - Bundle latest Java 21.0.7 release with non-Linux installers & containers$$$#13553; #13624 - Reduce download size/security attack surface of agent and server packages$$$Bug fixes$$$#13622 - Fix pipeline run/VSM comparisons on MySQL 8$$$#13564 - Config repo display shows duplicate environment entries with multiple input files$$$#13555 - Correct logging of rare templating issues during server start-up$$$Security fixes$$$There are no security fixes included in this release (for issues known to affect GoCD).$$$$$$However; we regularly upgrade dependencies to mitigate known vulnerabilities from third party software (regardless of whether they are known to affect GoCD); so upgrading to the latest release is always recommended from a security perspective.$$$$$$APIs$$$Improvements; deprecations and breaking changes in the API and plugin API have been moved to their respective changelogs - API changelog for 25.2.0 and Plugin API changelog for 25.2.0.$$$$$$Contributors$$$Aravind SV; Chad Wilson; Vinod Dampuru; riven-blade$$$$$$Special thanks goes to Vinod Dampuru for his assistance simplifying and improving GoCD’s build & release infrastructure during this release window. ??$$$$$$Note$$$A more comprehensive list of changes for this release can be found here.$$$$$$Found a security issue that needs fixing? Please report it to https://hackerone.com/gocd$$$$$$Please report any issues that you observe on GitHub issues.

This release is a minor maintenance and bug-fix release.$$$Enhancements$$$Bundle latest Java 21.0.6 release with non-Linux installers & containers$$$Increase UI responsiveness by decreasing default refresh interval to 5 seconds$$$Bug fixes$$$Fix re-display of stage overview modals on VSM pages$$$Stage Overview Modal not Loading on VSM Page When Pipeline Name Contains a .$$$Avoid multiple stage overviews being displayed on VSM when server is slow to return model$$$Dont change hover cursor for unclickable icons$$$Security fixes$$$There are no security fixes included in this release (for issues known to affect GoCD).$$$APIs$$$Improvements; deprecations and breaking changes in the API and plugin API have been moved to their respective changelogs- https://plugin-api.gocd.org/25.1.0/#changes-in-gocd-25-1-0

This release is a security; maintenance and bug-fix release.$$$Security Fixes$$$This release has important security fixes relating to admin functionality. We recommend all users upgrade to this version to safeguard your GoCD server. There are no major compatibility changes in this release; nor since the change to require Java 17 included in 24.1.0; so upgrading should be straightforward for most users.$$$$$$If you cannot upgrade immediately; we recommend you mitigate the most critical of these issues by blocking access to URLs prefixed with /go/rails. Doing so has no impact on GoCD functionality.$$$$$$These security vulnerabilities were responsibly disclosed via high quality research performed by Joe Zhou (byc_404) and the team extend our thanks for their efforts. We want to give users some time to mitigate or upgrade; before providing more details about the vulnerabilities. These will be disclosed via GitHub Security Advisories and formal CVEs.$$$$$$Bug fixes$$$#13321 - Fix erratic startup of Docker-in-Docker container images with cgroups v2 host operating systems$$$Other changes$$$#13322 - Remove/decommission Chocolatey installers/support on Windows$$$APIs$$$Improvements; deprecations and breaking changes in the API and plugin API have been moved to their respective changelogs - API changelog for 24.5.0 and Plugin API changelog for 24.5.0.

This release is a minor maintenance and bug-fix release.$$$$$$Enhancements$$$#13148 - Bundle latest Java 21.0.5 release with non-Linux installers & containers$$$#13226 - Fail linux installer package post-install scripts if configured Java runtime cannot be found$$$Bug fixes$$$#13214 - GoCD 24.3.0 database migration can hang/be extremely slow in low entropy server environments$$$#13232 - Secret references within config repo materials dont work if material not used by any pipeline$$$#12764 - Secret resolution failure breaks work allocation in server$$$#13008 - Alpine-based images can conflicts with some tools due to inclusion of glibc zlib$$$#12872 - function ${escape:} not a valid type errors from UrlRewriting are still appearing$$$Security fixes$$$There are no security fixes included in this release (for issues known to affect GoCD).$$$$$$However; we regularly upgrade dependencies to mitigate known vulnerabilities from third party software (regardless of whether they are known to affect GoCD); so upgrading to the latest release is always recommended from a security perspective.$$$$$$APIs$$$Improvements; deprecations and breaking changes in the API and plugin API have been moved to their respective changelogs - API changelog for 24.4.0 and Plugin API changelog for 24.4.0.$$$$$$Contributors$$$Aravind SV; Chad Wilson; Jason Smyth; Jochen Lutz; Mitchell R$$$$$$Note$$$A more comprehensive list of changes for this release can be found here.$$$$$$Found a security issue that needs fixing? Please report it to https://hackerone.com/gocd$$$$$$Please report any issues that you observe on GitHub issues.

This release is a minor maintenance and bug-fix release.$$$$$$Enhancements$$$#12953 - Bundle latest Java 21.0.4 release with non-Linux installers & containers$$$Bug fixes$$$#12943 - Show password button not working properly while creating new config repo$$$Security fixes$$$There are no security fixes included in this release (for issues known to affect GoCD).$$$$$$However; we regularly upgrade dependencies to mitigate known vulnerabilities from third party software (regardless of whether they are known to affect GoCD); so upgrading to the latest release is always recommended from a security perspective.$$$$$$APIs$$$Improvements; deprecations and breaking changes in the API and plugin API have been moved to their respective changelogs - API changelog for 24.3.0 and Plugin API changelog for 24.3.0.$$$$$$Contributors$$$Aravind SV; Chad Wilson; ysf465639310$$$$$$Note$$$A more comprehensive list of changes for this release can be found here.$$$$$$Found a security issue that needs fixing? Please report it to https://hackerone.com/gocd$$$$$$Please report any issues that you observe on GitHub issues.

This release is a maintenance and bug-fix release.$$$$$$Java 21 support$$$GoCD is now built with; tested against and distributed with Java 21 LTS. Java 17 remains the minimum supported version for bring-your-own-JRE setups. There were no specific changes needed to support Java 21; so the prior release 24.1.0 can be considered the first version that supports Java 21.$$$$$$Windows installers no longer signed$$$Windows installers were previously code-signed with a proper Thoughtworks-issued OV code-signing certificate from DigiCert that avoided Windows SmartScreen prompts. Due to both certificate cost and changes in requirements for OV code-signing certificates (to have hardware-managed keys); in the short term this is no longer sustainable for GoCD. Therefore installers are not be signed from 24.2.0 onwards.$$$$$$GoCD can still be installed on Windows subsequent to this change; however users will need to review and accept warnings from Windows during installation. Note that runtime binaries are still signed as before; such as the Java runtime and service wrapper binaries; so this change only affects installation - not runtime.$$$$$$If you have a suggestion of approach to reinstate Windows code signing for a open-source project with limited funding; or know other projects which have done so; please reach out!$$$$$$Enhancements$$$#12762 - Build; test and package GoCD with Java 21 LTS by default$$$#12792 - Make JRE dependencies from RPM and Debian packages optional/recommended$$$#12761; #12828 - Add AlmaLinux 9 based GoCD agent image to replace CentOS Stream$$$Starting this release; AlmaLinux based docker images for GoCD Agent are available.$$$Bug fixes$$$#12765 - Tasks on gocd-agent-docker-dind:v24.1.0 image cannot interact with Docket socket by default$$$Security fixes$$$While we dont regularly release new GoCD versions to address container image dependencies; this release patches git binaries within container images due to CVE-2024-32002 and several other issues of particular concern to a build/deploy automation tool such as GoCD. You can read more about the issues on the GitHub Blog. Note that at time of release; Debian images have not had the most critical patch backported to Debian 11 or 12; so the gocd-agent-debian variants for 24.2.0 are still vulnerable. Ubuntu variants are all patched as are Alpine and Wolfi variants.$$$$$$We regularly upgrade dependencies to mitigate known vulnerabilities from third party software (regardless of whether they are known to affect GoCD); so upgrading to the latest release is always recommended from a security perspective.$$$$$$APIs$$$Improvements; deprecations and breaking changes in the API and plugin API have been moved to their respective changelogs - API changelog for 24.2.0 and Plugin API changelog for 24.2.0.

This release is a maintenance and bug-fix release; although there are several potentially breaking changes to be aware of:$$$$$$Links are no longer force-opened in new tabs$$$Java 17 is now the minimum supported version$$$Server container image is now based on Wolfi OS$$$Links are no longer force-opened in new tabs$$$A long-standing frustration with GoCDs UI is that it used to open new tabs for links; partly to avoid losing your place on the main dashboard when investigating an individual stage/job. However; browsers are now much better at remembering the back state; and the previous behaviour was confusing & frustrating.$$$$$$From now on control will be returned to users - for a new tab to be opened (foreground or background) in most cases users will need to use the browser/OS specific key combination or middle-click equivalent to do so.$$$$$$If you are interested in making this a configurable option to add back the old behaviour; discussion or pull requests are welcome.$$$$$$Java 17 is now the minimum supported version$$$Java 17 was released in September 2021; and has had complete support within GoCD since version 22.1.0; over 2 years ago. Since then it has been packaged with both GoCD container images & installers by default.$$$$$$This has proven to be be very stable; so to reduce maintenance overhead we are now making Java 17 the minimum supported version. Note that as of early 2024 GoCD has not been officially validated against Java 21 LTS (or intermediary versions 18-20).$$$$$$Security fixes$$$This release fixes CVE-2024-28866; a theoretical vulnerability which has not shown to be practically exploitable. Thank you to Aviv Keller (RedYetiDev) for discovering and responsibly disclosing this issue.$$$$$$We regularly upgrade dependencies to mitigate known vulnerabilities from third party software (regardless of whether they are known to affect GoCD); so upgrading to the latest release is always recommended from a security perspective.$$$

This release is a maintenance and bug-fix release.$$$$$$Enhancements$$$#12353 - Starting this release; Alpine 3.19 based container images for GoCD Agent are available.$$$#12353 - Build the default GoCD Server image on Alpine 3.19$$$#12212 - Make template selector dropdowns alphabetically sorted$$$Bug fixes$$$#12220 - Console view toolbar not shown after scrolling on v23.4.0$$$#12305 - Unable to pick stage from Add Material menu in Chrome on MacOS Sonoma$$$#12389 - Fix disappearing second+ stages on VSM view after clicking a stage$$$#12392 - Correct display of cancelled by for stage runs other than that being viewed$$$Security fixes$$$There are no security fixes included in this release (for issues known to affect GoCD).$$$$$$However; we regularly upgrade dependencies to mitigate known vulnerabilities from third party software (regardless of whether they are known to affect GoCD); so upgrading to the latest release is always recommended from a security perspective.$$$$$$APIs$$$Improvements; deprecations and breaking changes in the API and plugin API have been moved to their respective changelogs - API changelog for 23.5.0 and Plugin API changelog for 23.5.0.$$$$$$

This release is mainly a maintenance and bug-fix release.$$$$$$Jetty web server upgrade$$$GoCD relies internally upon the Eclipse Jetty web server; which was upgraded from v9 to v10 in this release.$$$$$$If you customise the configuration of the web server via config/jetty.xml or by overriding the Java system property jetty.xml.file.name; note that any custom configuration will be overridden to ensure compatibility with the new version. After upgrading; shut down your GoCD server and merge back your custom changes from a backup of your config directory / Jetty configuration. You can review the changes to jetty.xml here.$$$$$$Enhancements$$$#12120 - Bundle latest Java 17.0.9 release with non-Linux installers & containers$$$#12147 - Speed agent bootstrapping by reducing agent dependencies$$$#12051 - Remove subversion & mercurial from default container images$$$Bug fixes$$$#11868; #11893 - Server config can have boolean attributes unintentionally toggled by server at GoCD startup$$$#11819 - Agent links from stage details jobs tab no longer work since 23.2.0$$$#11866 - GoCD 23.2/23.3 breaks agent mTLS connectivity when private key is encrypted/passphrase protected$$$#11969 - GoCD Agent on Java 20+ cant talk to server on Java 17$$$#12107 - Improve error logging during agent token acquisition failures$$$Security fixes$$$We regularly fix security issues reported by security researchers & upgrade dependencies to mitigate known vulnerabilities. Upgrading to the latest release is always recommended.$$$$$$There are no security fixes specifically known to affect GoCD included in this release. If you use GoCD container images; note that this release rebuilds GoCD images to include fixes to curl CVE-2023-38545 across all supported platforms.$$$$$$APIs$$$Improvements; deprecations and breaking changes in the API and plugin API have been moved to their respective changelogs - API changelog for 23.4.0 and Plugin API changelog for 23.4.0.

This release is a maintenance release to address a couple of unintended regressions in the 23.2.0 release.$$$Bug fixes$$$$$$ #11790 - Stage History pagination links are broken on 23.2.0$$$ #11783 - Build detail timestamp icon is missing on 23.2.0$$$ #11797 - Some plugin config/report views have missing icons on 23.2.0$$$$$$APIs$$$$$$Improvements; deprecations and breaking changes in the API and plugin API have been moved to their respective changelogs - API changelog for 23.3.0 and Plugin API changelog for 23.3.0.$$$Contributors$$$$$$Aravind SV; Chad Wilson$$$Note$$$$$$A more comprehensive list of changes for this release can be found here.$$$$$$Found a security issue that needs fixing? Please report it to https://hackerone.com/gocd$$$$$$Please report any issues that you observe on GitHub issues.$$$

Due to both its uncommon use and improvement of agent bootstrap speeds the Yum/RPM/DNF Repository Poller Plugin is no longer bundled with GoCD from 23.1.0 onwards.$$$$$$All plugins impose a marginal startup cost for the server and certain plugins also to all agents. Since it is also currently difficult to override bundled plugins in some GoCD setups; the team have decided to stop bundling this particular plugin.$$$$$$If you rely upon this plugin; follow these upgrade steps:$$$$$$download the latest version of the plugin from GitHub$$$install the plugin as an external plugin (see plugin user guide)$$$upgrade your server to 23.1.0$$$You neednt worry about:$$$$$$Starting your old server version with the external plugin added. GoCD will ignore it; and prefer the bundled plugin until you upgrade.$$$Loss of configuration while starting your server on 23.1.0 before adding the plugin back. Your config will be retained; however your server will not function correctly; and certain pipelines will not be editable until you restore the plugin and restart your server; which you should do as soon as possible.$$$As always; we recommend that you take a backup before upgrading.

Changes$$$#10759 - Improve agent start-up time during agent-to-server version synchronization$$$#10924 - Bundle latest Java 17.0.5 patch release with non-Linux installers & containers$$$Starting this release; MacOS Apple Silicon (arm64/aarch64) installers and test-drive experience are available.$$$Starting this release; CentOS Stream 9 based docker images for GoCD Server are available.$$$Bug fixes$$$#8999 - Agents page layout has overlapping backgrounds on Chromium-based browsers$$$#10736 - GoCD 22.2.0 broke display of timestamps in plugin Elastic Agent Status Reports$$$#10837 - Job History sidebar dropdown does not display timestamps for previous job runs$$$#10891 - Build labels are truncated in pipeline activity page$$$#10937 - Support API logs a lot of noisy errors on Java 16+$$$#10943 - Fetch Artifact task doesnt provide correct suggestions when switching stages on pipeline config$$$#10982 - Fix Postgres backups via pg_dump on Windows$$$Security Fixes$$$We regularly fix security issues reported by security researchers & upgrade dependencies to mitigate known vulnerabilities. Upgrading to the latest release is always recommended.$$$$$$This release upgrades a number of important internal components; some of which were EOL. We do not have evidence that the previously vulnerable dependencies pose any specific risk in GoCDs usage; however we endeavour to minimise dependency drift.

Changes$$$#10613 - Bundle latest Java 17$$$#10518 - Build the default GoCD Server image on Alpine 3.16$$$Starting this release; Alpine 3.16 based docker images for GoCD Agent are available.$$$Starting this release; Centos Stream 9 based docker images for GoCD Agent are available.$$$Starting this release; Ubuntu 22.04 (Jammy Jellyfish) based docker images for GoCD Agent are available.$$$Security$$$We regularly fix security issues reported by security researchers & upgrade dependencies to mitigate known vulnerabilities. Upgrading to the latest release is always recommended.$$$$$$In this release; permissions were restricted further on Windows installer GoCD server & agent folders. Thank you to s7331 for responsibly disclosing this issue.$$$$$$Bug fixes$$$#4173 - On Windows; custom commands with spaces in path fail$$$#8986 - Git Material authentication fails for second user on the same repository$$$#9153 - Git Material credentials cannot be changed$$$#9509 - Unable to render VSM page when dependent pipelines are deleted or renamed$$$#9964 - Cant add user into a role (and other admin functions) behind CloudFlare minification proxy$$$#10036 - HTTP 500 when using external authorization plugins and GoCD site urls are blank$$$#10440 - Windows installer does not exit as intended on downgrade attempts$$$#10441 - Fix compatibility with JDK 11.0.15+ and 17.0.3+ during server configuration upgrades$$$#10555 - Misleading error message logged when agents have connectivity issues with GoCD Server$$$#10566 - Job Instance API does not return job state transitions as documented$$$#10610 - Custom tabs do not resize correctly to use window height as intended$$$#10648 - Plugin Admin page can display stale information after plugins are upgraded$$$#10668 - Fetch External (plugin) Artifact task gives generic Unprocessable Entity error for failing plugin validations$$$#10675 - Stage Details statistics graph page navigation broken on Chrome/Chromium$$$APIs$$$Improvements; deprecations and breaking changes in the API and plugin API have been moved to their respective changelogs - API changelog for 22.2.0 and Plugin API changelog for 22.2.0.