Concourse Fly: baixar versions anteriors

## What's Changed

This release is in response to the compromised eMudhra CA certs. All container images for the bundled resource-types have been updated with the latest OS packages. All Go binaries we ship have been compiled with Go 1.27.3. As far as we can currently tell, all compromised CA certs have been removed from our published artifacts. If you find we have missed something please post in the [Discussion Forum](https://github.com/orgs/concourse/discussions/categories/general) or email `security@concourse-ci.org`.

This release contains no code changes to the `concourse` or `fly` binaries.

## 📦 Bundled Resource Types

<details>

• bosh-io-release：[v1.3.6](https://github.com/concourse/bosh-io-release-resource/releases/tag/v1.3.6)
• bosh-io-stemcell：[v1.7.1](https://github.com/concourse/bosh-io-stemcell-resource/releases/tag/v1.7.1)
• docker-image：[v1.13.3](https://github.com/concourse/docker-image-resource/releases/tag/v1.13.3)
• git：[v1.24.1](https://github.com/concourse/git-resource/releases/tag/v1.24.1)
• github-release：[v1.14.2](https://github.com/concourse/github-release-resource/releases/tag/v1.14.2)
• hg：[v1.5.6](https://github.com/concourse/hg-resource/releases/tag/v1.5.6)
• mock：[v0.14.7](https://github.com/concourse/mock-resource/releases/tag/v0.14.7)
• pool：[v1.8.3](https://github.com/concourse/pool-resource/releases/tag/v1.8.3)
• registry-image：[v1.19.0](https://github.com/concourse/registry-image-resource/releases/tag/v1.19.0)
• s3：[v2.5.6](https://github.com/concourse/s3-resource/releases/tag/v2.5.6)
• semver：[v2.0.4](https://github.com/concourse/semver-resource/releases/tag/v2.0.4)
• time：[v1.11.5](https://github.com/concourse/time-resource/releases/tag/v1.11.5)
</details>

## What's Changed

### 🐞 Bug Fixes
• worker：keep in-flight overlay dirs during orphan sweep by @ShravanthReddy in #9695
• Align GetResourceVersion behaviour with ListResourceVersion's by @taylorsilva in https://github.com/concourse/concourse/pull/9729
• Remove parent-dir references from paths provided to pipeline steps by @taylorsilva in https://github.com/concourse/concourse/pull/9735
• fix：Vault URL validation scheme broken with placeholder by @Kump3r in #9714
• fix：baggageclaim: fix overlay driver stacking mounts on worker restart by @Kump3r in #9723

### 🛠️ Misc. Changes
• Update Go to 1.27.1 by @alicul in https://github.com/concourse/concourse/pull/9730
• upgrade golang.org/x/crypto to v0.56.0 [security] by @alicul in #9702
• Revert workarounds for Go bugs by @alicul in #9703
• fix baggageclaim tests on windows by @taylorsilva in #9709
• Creds interface refactoring by @taylorsilva in https://github.com/concourse/concourse/pull/9731
• update module github.com/containerd/containerd/v2 to v2.3.5 [security] in #9710
• update module google.golang.org/grpc to v1.83.1 [security] in #9697

## 📦 Bundled Resource Types

<details>

• bosh-io-release：[v1.3.5](https://github.com/concourse/bosh-io-release-resource/releases/tag/v1.3.5)
• bosh-io-stemcell：[v1.6.0](https://github.com/concourse/bosh-io-stemcell-resource/releases/tag/v1.6.0)
• docker-image：[v1.13.2](https://github.com/concourse/docker-image-resource/releases/tag/v1.13.2)
• git：[v1.23.0](https://github.com/concourse/git-resource/releases/tag/v1.23.0)
• github-release：[v1.14.1](https://github.com/concourse/github-release-resource/releases/tag/v1.14.1)
• hg：[v1.5.5](https://github.com/concourse/hg-resource/releases/tag/v1.5.5)
• mock：[v0.14.6](https://github.com/concourse/mock-resource/releases/tag/v0.14.6)
• pool：[v1.8.2](https://github.com/concourse/pool-resource/releases/tag/v1.8.2)
• registry-image：[v1.18.0](https://github.com/concourse/registry-image-resource/releases/tag/v1.18.0)
• s3：[v2.5.5](https://github.com/concourse/s3-resource/releases/tag/v2.5.5)
• semver：[v2.0.3](https://github.com/concourse/semver-resource/releases/tag/v2.0.3)
• time：[v1.11.4](https://github.com/concourse/time-resource/releases/tag/v1.11.4)
</details>

**Full Changelog**：https://github.com/concourse/concourse/compare/v8.3.0...v8.3.1

What's Changed
🐞 Bug Fixes
• fix how resources with check_every：never are handled when scheduling builds by @taylorsilva in #9598
• fix streaming volumes with relative symlinks by @taylorsilva in #9601
• fix "invalid UTF-8" errors when get steps generate metadata by @kurtmc in #9602
📦 Bundled Resource Types
• bosh-io-release：v1.3.4
• bosh-io-stemcell：v1.5.4
• docker-image：v1.13.1
• git：v1.22.3
• github-release：v1.14.0
• hg：v1.5.4
• mock：v0.14.5
• pool：v1.8.1
• registry-image：v1.17.0
• s3：v2.5.4
• semver：v2.0.1
• time：v1.11.3
Full Changelog：v8.2.3...v8.2.4

What's Changed
🐞 Bug Fixes
• fix how resources with check_every：never are handled when scheduling builds by @taylorsilva in #9598
• fix streaming volumes with relative symlinks by @taylorsilva in #9601
• fix "invalid UTF-8" errors when get steps generate metadata by @kurtmc in #9602
📦 Bundled Resource Types
• bosh-io-release：v1.3.4
• bosh-io-stemcell：v1.5.4
• docker-image：v1.13.1
• git：v1.22.3
• github-release：v1.14.0
• hg：v1.5.4
• mock：v0.14.5
• pool：v1.8.1
• registry-image：v1.17.0
• s3：v2.5.4
• semver：v2.0.1
• time：v1.11.3
Full Changelog：v8.2.3...v8.2.4

What's Changed
🐞 Bug Fixes
- fix how resources with check_every: never are handled when scheduling builds by @taylorsilva in #9598
- fix streaming volumes with relative symlinks by @taylorsilva in #9601
- fix "invalid UTF-8" errors when get steps generate metadata by @kurtmc in #9602
📦 Bundled Resource Types
- bosh-io-release: v1.3.4
- bosh-io-stemcell: v1.5.4
- docker-image: v1.13.1
- git: v1.22.3
- github-release: v1.14.0
- hg: v1.5.4
- mock: v0.14.5
- pool: v1.8.1
- registry-image: v1.17.0
- s3: v2.5.4
- semver: v2.0.1
- time: v1.11.3
Full Changelog: v8.2.3...v8.2.4

What's Changed
🐞 Bug Fixes
- unescape the redirect uri before further parsing it by @taylorsilva in #9587
- Resolves open redirect CVE GHSA-8w27-c4vc-88q9
📦 Bundled Resource Types
- bosh-io-release: v1.3.4
- bosh-io-stemcell: v1.5.4
- docker-image: v1.13.1
- git: v1.22.3
- github-release: v1.14.0
- hg: v1.5.4
- mock: v0.14.5
- pool: v1.8.1
- registry-image: v1.17.0
- s3: v2.5.4
- semver: v2.0.1
- time: v1.11.3
Full Changelog: v8.2.2...v8.2.3

What's Changed
🐞 Bug Fixes
- Fix CF connector by @IvanChalukov in #9580
- Use session signing key to derive state signing key by @taylorsilva in #9579
🛠️ Misc. Changes
- Bump containerd to v2.3.1 to address a privilege escalation CVE in containerd by @taylorsilva in #9582
📦 Bundled Resource Types
- bosh-io-release: v1.3.4
- bosh-io-stemcell: v1.5.4
- docker-image: v1.13.1
- git: v1.22.3
- github-release: v1.14.0
- hg: v1.5.4
- mock: v0.14.5
- pool: v1.8.1
- registry-image: v1.17.0
- s3: v2.5.4
- semver: v2.0.1
- time: v1.11.3
Full Changelog: v8.2.1...v8.2.2

What's Changed
🐞 Bug Fixes
- fix: handle all IPv4 loopback resolvers by @immanuwell in #9569
- Fix pipeline rendering when resources have no icon by @jghiloni in #9571
- Ensure resources that have never been checked are looked up by manually triggered builds by @taylorsilva in #9574
📦 Bundled Resource Types
- bosh-io-release: v1.3.4
- bosh-io-stemcell: v1.5.4
- docker-image: v1.13.0
- git: v1.22.2
- github-release: v1.14.0
- hg: v1.5.3
- mock: v0.14.5
- pool: v1.8.1
- registry-image: v1.17.0
- s3: v2.5.4
- semver: v2.0.0
- time: v1.11.3
New Contributors
- @immanuwell made their first contribution in #9569
Full Changelog: v8.2.0...v8.2.1

What's Changed
🚨 Breaking Changes
- Don't allow pipelines or teams containing / to be set with the set_pipeline step by @taylorsilva in #9537
- Teams or pipelines with / wouldn't display in the web UI. If you have teams or pipelines that have a /, rename them before upgrading.
- Semver resource has a breaking change for users of the swift driver. We migrated the driver from using rackspace/gophercloud to gophercloud/gophercloud, which dropped the api_key field. We added all new AuthOptions from the new SDK.
✈️ Features
- Add --team flag to fly pipelines command by @izabelacg in #9488
- Add --team flag to fly execute command by @izabelacg in #9491
- Enable hot-reloading of ATC HTTPS listener by @jghiloni in #9472
- Opaque User Data Feature (Issue #8426) by @alicul in #9489
- Smarter resource checking - Only check triggering resources by @taylorsilva in #9492
- Add UserData field to pipeline API responses by @alicul in #9505
- Make the Broadcast Message feature UI operable by @ceco556 in #9484
- Worker healthcheck endpoint returns a detailed json response by @taylorsilva in #9529
- feat(ui): display non-zero tasks exit codes in pipeline UI by @arakakimarcelo in #9527
- feat(atc): natively inject BUILD_STATUS into resource metadata by @arakakimarcelo in #9523
- Add TTL/expiry for task caches and CONCOURSE_DEFAULT_TASK_CACHE_TTL by @taylorsilva in #9533
- Cache Vault KV version by mount path to reduce preflight calls (CONCOURSE_VAULT_ENABLE_KV_MOUNT_CACHE) by @IvanChalukov in #9530
- atc: add base64 and hex encryption key flags by @samuelBarreto in #9542
- Enable operators to pause/unpause web components by @taylorsilva in #9544
- web: add next steps to download fly page by @samuelBarreto in #9545
- Add Gitea as authentication provider by @taylorsilva in #9558
- Add SimpleIcons support in pipeline resources by @jghiloni in #9564
🐞 Bug Fixes
- return BreakoutError when symlink does not link to a path inside the destination by @taylorsilva in #9486
- Make the set_pipeline step respect the CONCOURSE_DISABLE_REDACT_SECRETS setting by @taylorsilva in #9497
- Finish wiring up the concourse_builds_check_finished_total metric by @taylorsilva in #9500
- Fix missing volumesStreamedViaFallback Prometheus metric by @alicul in #9503
- worker/runtime: wrap containers from NewContainer and Containers with request timeout by @Kump3r in #9509
- Allow pending builds in paused pipelines to be aborted and automatically abort pending builds in archived pipelines by @taylorsilva in #9521
- Don't error if the overlaysDir does not exist during orphan volume cleanup by @taylorsilva in #9528
- fix(atc): retain var_sources visibility inside across interpolation steps by @arakakimarcelo in #9525
- fix resource types query returning duplicate resource types by @taylorsilva in #9534
- fix fly's [yN] prompt by @taylorsilva in #9540
- fix: redact secrets from task config in build events by @pierluigilenoci in #9551
🛠️ Misc. Changes
- [chore] regenerate counterfeiter fakes by @alicul in #9483
- db: optimize IsFirstOccurrence query for jobs with many builds by @analytically in #9422
- nit: TSA cleanup by @taylorsilva in #9516
- nit: use idiomatic "for range" over channel by @taylorsilva in #9518
- nit: API cleanup by @taylorsilva in #9517
- Database cleanup and optimizations by @taylorsilva in #9522
- log container placement strategies being used by web node by @taylorsilva in #9538
- Bump tedsuo/ifrit by @taylorsilva in #9539
- Import concourse/flag package into main repo by @taylorsilva in #9541
- Bump go dependencies and fix Dex signing key setup by @taylorsilva in #9549
- Have lidar check non-triggering input resources that have no versions or errored by @taylorsilva in #9552
- Upgrade fly to charm v2 by @taylorsilva in #9553
- Update to containerd v2.3.0 by @taylorsilva in #9562
- Emit a more useful error if we get the "rootfs empty" error by @taylorsilva in #9563
📦 Bundled Resource Types
- bosh-io-release: v1.3.4
- bosh-io-stemcell: v1.5.4
- docker-image

What's Changed
🐞 Bug Fixes
- return BreakoutError when symlink does not link to a path inside the destination by @taylorsilva #9486
🛠️ Misc. Changes
- use statically built versions of containerd binaries by @taylorsilva concourse/ci#429
📦 Bundled Resource Types
- bosh-io-release: v1.3.3
- bosh-io-stemcell: v1.5.3
- docker-image: v1.12.4
- git: v1.22.0
- github-release: v1.13.2
- hg: v1.5.2
- mock: v0.14.4
- pool: v1.7.2
- registry-image: v1.16.0
- s3: v2.5.3
- semver: v1.11.2
- time: v1.11.2
Full Changelog: v8.1.0...v8.1.1

What's Changed
✈️ Features
- feat: allow glob patterning for get.passed by @kcbimonte in #9418
- Add metadata from get steps to the local build var by @PentaHelix in #9419
- Make container selection for fly intercept interactive and searchable by @taylorsilva in #9438
- Implement disable_reruns property for jobs by @ceco556 in #9463
- Add --containerd-allowed-device flag for cgroup device rules by @mariash in #9465
- Implement SearchBar for jobs in pipelines by @ceco556 in #9459
🐞 Bug Fixes
- fix(skymarshal): use HMAC-signed stateless OAuth state tokens by @analytically in #9387
- Fix down migration cleanup for resource_config_versions_version_md5 index by @IvanChalukov in #9426
- Fix down migration to fully restore rerun_of indexes by @IvanChalukov in #9428
- fix BUILD_URL when a pipeline has instance vars by @taylorsilva in #9431
- Ensure strings passed to containerd container properties only contain UTF8 runes by @taylorsilva in #9430
- Fix bugs related to baggageclaim logging not producing logs by @geofffranks in #9383
- Handle json null values in the resource_config_versions table during the sha256 migration by @taylorsilva in #9436
- fly: skip destroy confirmation when pipeline does not exist by @railgun-0402 in #9440
- fix: use JSON log format for containerd to match Concourse log format by @railgun-0402 in #9442
- Validate unknown fields in inline task configs by @railgun-0402 in #9445
- Improve error handling for async XHR during fly login by @IvanChalukov in #9450
- Fix some ways that overlay volumes leak and add more logging by @taylorsilva in #9451
- Volume sweeper removes orphaned volume artifacts by @taylorsilva in #9458
🛠️ Misc. Changes
- Refactor 9419 to have AsMap() as a func on []MetadataField by @taylorsilva in #9435
- Charm fly: port all fly user input interactions to charmbracelet/bubbletea by @taylorsilva in #9439
- Make error helpful when failing to stream rootfs metadata file by @taylorsilva in #9456
- Use @lydell/elm to support building concourse on arm by @akshaymankar in #9452
- Run go fix on the project by @taylorsilva in #9461
❗ Known Issues
- There's a regression in the latest lib/pq release that we indirectly use via Dex. If you're using a Client key and certificate to connect to Postgresql, make sure the file permissions are set to 0640 or 0600. Any other setting (higher or lower) will result in the error error: failed to perform migrations: creating migration table: pq: private key has world access; permissions should be u=rw,g=r (0640) if owned by root, or u=rw (0600), or less
- If you're using the Helm chart to deploy Concourse, the latest version 20.1.0 changes the file permissions of the Client key and cert to 0600. Previously it was 0400, which is how we discovered this issue.
- lib/pq issue: lib/pq#1257
📦 Bundled Resource Types
- bosh-io-release: v1.3.3
- bosh-io-stemcell: v1.5.3
- docker-image: v1.12.4
- git: v1.22.0
- github-release: v1.13.2
- hg: v1.5.2
- mock: v0.14.4
- pool: v1.7.2
- registry-image: v1.16.0
- s3: v2.5.3
- semver: v1.11.2
- time: v1.11.2
New Contributors
- @kcbimonte made their first contribution in #9418
- @geofffranks made their first contribution in #9383
- @PentaHelix made their first contribution in #9419
- @railgun-0402 made their first contribution in #9440
- @akshaymankar made their first contribution in #9452
Full Changelog: v8.0.2...v8.1.0

What's Changed
- We updated our build process to bring in newly compiled versions of the Linux container runtime dependencies (containerd, runc, CNI plugins, etc.). We grab most of these from Wolfi's APK repository. For runc, we needed a statically compiled version, so we compile that ourselves (pipeline here). The motivation for this was to clear out CVE's related to the version of Go that each of those binaries were compiled with. If you scan the Linux tarball in this release you should find no CVE's (at the time of publishing at least)
- Fix task caches by reverting #9330 but keep using sha256 instead of sha1 by @taylorsilva #9429
- As a side-note, you can define absolute paths for your task caches. See concourse/docs#583 for details
📦 Bundled Resource Types
- bosh-io-release: v1.3.3
- bosh-io-stemcell: v1.5.3
- docker-image: v1.12.2
- git: v1.22.0
- github-release: v1.13.1
- hg: v1.5.1
- mock: v0.14.3
- pool: v1.7.1
- registry-image: v1.15.3
- s3: v2.5.2
- semver: v1.11.1
- time: v1.11.1
Full Changelog: v8.0.1...v8.0.2

What's Changed
- Handle json null values in the resource_config_versions table during the sha256 migration by @taylorsilva #9436
- Fix down migration by @IvanChalukov #9426, #9428
- Add flag to disable secret redaction CONCOURSE_DISABLE_REDACT_SECRETS by @taylorsilva #9433
📦 Bundled Resource Types
- bosh-io-release: v1.3.2
- bosh-io-stemcell: v1.5.2
- docker-image: v1.12.0
- git: v1.21.0
- github-release: v1.13.0
- hg: v1.5.0
- mock: v0.14.2
- pool: v1.7.0
- registry-image: v1.15.2
- s3: v2.5.1
- semver: v1.11.0
- time: v1.11.0
Full Changelog: v8.0.0...v8.0.1

What's Changed
🚨 Breaking Changes
- fly: drop support for deprecated {{old_style}} var resolution by @vlfig in #9194
- Switch use of md5 hashing to sha256 by @IvanChalukov in #9165
- Prevent resources from emitting empty versions by @IvanChalukov in #9293
- set containerd as the default runtime for linux workers by @taylorsilva in #9372
- Make pipeline instances always enabled by @taylorsilva in #9373
- Make across step always enabled by @taylorsilva in #9375
- change put.inputs to default to detect inputs by @taylorsilva in #9374
- redact secrets is always enabled by @taylorsilva in #9378
✈️ Features
- fly: harmonize strictness for set and validate by @vlfig in #9197
- Add --team flag to clear-versions command by @mstandley-tempus in #9334
- Add --non-interactive flag to clear-versions command by @mstandley-tempus in #9335
- driver: use -R flag for recursive btrfs subvolume deletion by @analytically in #9288
- Add broadcast message to Concourse cluster by @ceco556 in #9273
- Add support for setting containerd log-level (default to info) by @analytically in #9290
- add back the retrying sql driver by @taylorsilva in #9361
- add --oidc-issuer-url flag to decouple OIDC issuer from external URL by @b1n9s in #9358
- Add Go runtime memory and GC metrics by @analytically in #9331
- Add BUILD_URL and BUILD_URL_SHORT in StepMetadata.Env() by @analytically in #9296
- Scale job badges to fit custom titles of any length by @analytically in #9317
- feat: display team name in set_pipeline step header by @analytically in #9318
- Bump concourse/flag to v2.4.0 - Adds CONCOURSE_POSTGRES_APPLICATION_NAME to web command by @taylorsilva in #9370
- Add S2 compression option for streaming container volumes by @analytically in #9340
- Show pipeline last updated tooltip on pipeline name hover by @analytically in #9381
- Add SameSite attribute to authentication and CSRF cookies by @Kump3r in #9389
- worker: add fallback to ATC streaming when P2P fails by @kurtmc in #9390
- Have task steps fallback to the container's ENTRYPOINT/CMD if run.path is not specified by @taylorsilva in #9410
- feat(web): show red/orange background on group tabs when jobs fail or error by @analytically in #9407
🐞 Bug Fixes
- Fix error logging level for missing resource in ListJobInputs by @analytically in #9285
- Fix active_tasks going negative when MaxTasks == 0 by @analytically in #9320
- Fix fly validate-pipeline for idtoken var_source #9310 by @dbaumgarten in #9319
- Fix time-based filtering returning incorrect builds by @analytically in #9298
- fix: use tolerance for scroll bottom detection to prevent auto-scrolling breaking by @analytically in #9303
- Fix Elm encoding bugs by @analytically in #9333
- fix: prevent panic in teams cache when notification listener fails by @analytically in #9311
- fix: only set scrolledToCurrentBuild flag when actually scrolling to current build by @analytically in #9322
- fix: correct LockTypeBuildTracking to factoryBuildTracking mapping by @analytically in #9308
- fix: vault userpass auth cannot be used by @nouseforaname in #9368
- fix(set_pipeline): evaluate InstanceVars ahead of other variables by @aeijdenberg in #9362
- Windows/baggageclaim: Retry initializing volumes on "Access is denied" errors by @taylorsilva in #9385
- Error on duplicate keys while not breaking pipelines that use yaml merge keys << by @taylorsilva in #9392
- fix issue where only one of max builds/days was set would result in the opposite value not being set all by @taylorsilva in #9393
- Windows: Ensure robocopy doesn't retry on errors for 347 days by @taylorsilva in #9395
- Replace rerun_of column with new bigint version by @taylorsilva in #9401
- fix: across step showing failed when nested retry succeeds by @analytically in #9406
🛠️ Misc. Changes
- nit: Typo, strategerizer to strategizer. by @analytically in #9141
- chore: correct spelling of 'CLI' throughout the codebase by @analytically in #9286
- Update TLS/SSH configs to prioritize Curve25519 by @analytical

What's Changed
🐞 Bug Fixes
- Make container attach idempotent and handle exited processes gracefully by @IvanChalukov in #9345
- Cherry-picked over by #9355
🛠️ Misc. Changes
- [7.14.x] Bump containerd to v2.1.5 & v1.7.29 by @taylorsilva in #9354
📦 Bundled Resource Types
- bosh-io-release: v1.3.1
- bosh-io-stemcell: v1.5.1
- docker-image: v1.11.3
- git: v1.20.0
- github-release: v1.12.1
- hg: v1.4.1
- mock: v0.14.1
- pool: v1.6.0
- registry-image: v1.13.2
- s3: v2.4.0
- semver: v1.10.2
- time: v1.10.0
Full Changelog: v7.14.2...v7.14.3

🛠️ Changes
- Fix SVG styling inheritance on Chrome >= v141 @slang25 #9313
📦 Bundled Resource Types
- bosh-io-release: v1.3.1
- bosh-io-stemcell: v1.5.1
- docker-image: v1.11.3
- git: v1.20.0
- github-release: v1.12.1
- hg: v1.4.1
- mock: v0.14.1
- pool: v1.6.0
- registry-image: v1.13.2
- s3: v2.4.0
- semver: v1.10.2
- time: v1.10.0

🛠️ Changes
- Fixed the guardian runtime for users of the concourse/concourse image @taylorsilva #9257
- Fixed the semver resource for users that use the git driver @taylorsilva concourse/semver-resource@13de59c
- docker-image resource updated with latest Docker binaries
📦 Bundled Resource Types
- bosh-io-release: v1.3.1
- bosh-io-stemcell: v1.5.1
- docker-image: v1.11.3
- git: v1.20.0
- github-release: v1.12.1
- hg: v1.4.1
- mock: v0.14.1
- pool: v1.6.0
- registry-image: v1.13.2
- s3: v2.4.0
- semver: v1.10.2
- time: v1.10.0
Full Changelog: v7.14.0...v7.14.1

What's Changed
🦾 Official ARM Build
This is the first release that includes an ARM version of concourse and fly (Linux and macOS). The ARM version of concourse only supports the containerd runtime (See garden/#378).
🐙 Wolfi-based Images
The concourse/concourse container image and all base resource-types now use Wolfi as their base image. This was done to support building the ARM version of Concourse.
✈️ Features
- Add Pipeline identity token as a var_source by @dbaumgarten in #9035
- See the docs for more details: https://concourse-ci.org/idtoken-credential-manager.html
- atc: allow identifiers to start with numbers by @analytically in #9119
- atc: enhance container memory unit parsing with IEC notation support by @analytically in #9130
- atc: Consider image volumes in volume-locality strategy by @analytically in #9188
- Restrict algorithms for host key exchange by @neumayer in #9214
- Bump pgx and concourse/flag to latest patch, this enables sslnegotiation option by @analytically in #9211
- Invalidate access token on Logout by @IvanChalukov in #9218
- containerd: add flag to add addintional-hosts by @Kump3r in #9238
- Add /download-fly page for downloading the fly cli by @taylorsilva in #9240
🐞 Bug Fixes
- Skip renewal for non-renewable Vault tokens by @IvanChalukov in #9208
- Improve idtoken credential provider compatibility (with AWS and Azure) by @dbaumgarten in #9224
- runtime/containerd: ensure logs are not dropped when web node re-attaches to running containers by @taylorsilva in #9234
- Re-enable manual token entry when a fly command fails due to auth by @taylorsilva in #9245
🛠️ Misc. Changes
- Update github.com/aws/aws-sdk-go to github.com/aws/aws-sdk-go-v2 by @hoegaarden in #9178
- refactor: More granular locking in WorkerCache by @analytically in #9118
- worker: containerd.go: Fixed typo in error message by @jpds in #9192
- fix(deps): update javasript by @renovate[bot] in #9172
- Fix error handling in processStream.Write method to follow io.Writer contract by @analytically in #9120
- Improve repository lock manager with sync.Map for better concurrency by @analytically in #9131
- Adding the db connection parameter to dev docker-compose by @Kump3r in #9196
- fix: add O_TRUNC flag when writing volume metadata file by @analytically in #9132
- Replace standard gzip with klauspost/compress/gzip by @analytically in #9138
- Migrate from kr/pty to creack/pty by @analytically in #9152
- Migrate from mitchellh/mapstructure to go-viper/mapstructure/v2 by @analytically in #9153
- fix k8s-topgun prometheus integration tests by @taylorsilva in #9206
- Remove use of deprecated package github.com/pkg/errors by @BooleanCat in #9216
- refactor: replace map+RWMutex with sync.Map in artifact repository for better concurrency by @analytically in #9148
- refactor: beingWatchedBuildEventChannelMap to use sync.Map by @analytically in #9161
- refactor: optimize Counter and Gauge with atomic.Int64 by @analytically in #9158
- refactor: simplify hasPermission method in accessor by @analytically in #9166
- Optimize SSE build event streaming by @analytically in #9169
- Increase containerd runner ready state timeout by @jzho987 in #9230
- Bump containerd libraries to v2 by @taylorsilva in #9231
- Remove hardcoded AlwaysSample from OpenTelemetry tracing configuration by @marcus-crane in #9229
- runtime: remove guardian as a runtime option for linux/arm64 by @taylorsilva in #9235
- fix(deps): update module github.com/containerd/containerd/v2 to v2.0.5 [security] by @renovate[bot] in #9233
- go and web dependency updates by @taylorsilva in #9243
- update web dependencies by @taylorsilva in #9247
- remove --time-format flag when using guardian runtime by @taylorsilva in #9252
New Contributors
- @hoegaarden made their first contribution in #9178
- @jpds made their first contribution in #9192
- @Kump3r made their first contribution in #9196
- @neumayer made their first contribution in #9214
- @dbaumgarten made their first contribution in #9035
- @jz

🛠️ Changes
- Upgraded CNI Plugins to v1.7.1 which should resolve #9027
- Upgraded Containerd to v2.1.1
- Bumped registry-image resource to v1.12.0
- Pushes multi-arch OCI images correctly now
- Bumped S3 resource to v2.2.0
- Fixed more auth related bugs
📦 Bundled resource types
- bosh-io-release: v1.2.3
- bosh-io-stemcell: v1.4.2
- docker-image: v1.10.1
- git: v1.18.3
- github-release: v1.11.0
- hg: v1.3.2
- mock: v0.13.0
- pool: v1.4.1
- registry-image: v1.12.0
- s3: v2.2.0
- semver: v1.9.0
- time: v1.8.0

📦 Bundled resource types
This release only updates the bundled resource-types, specifically the s3 and registry-image resources. Both resources had bugs related to their upgrade to v2 of the AWS Go SDK.
- bosh-io-release: v1.2.3
- bosh-io-stemcell: v1.4.2
- docker-image: v1.10.1
- git: v1.18.3
- github-release: v1.11.0
- hg: v1.3.2
- mock: v0.13.0
- pool: v1.4.1
- registry-image: v1.11.1
- s3: v2.0.2
- semver: v1.9.0
- time: v1.8.0

🚨 Breaking Changes
- Remove CONCOURSE_POSTGRES_BINARY_PARAMETERS flag (#9068) @taylorsilva ^{🔗}
- BREAKING: Removed the CONCOURSE_POSTGRES_BINARY_PARAMETERS flag. This was a lib/pq specific flag. We are now using Pgx as our Postgresql driver, therefore this flag is no longer relevant. If you are using PgBouncer we recommend being on the latest version (v1.24.0) which now supports prepared statements by default, though any version >1.21.0 may also work. This flag has been removed from both the Helm chart and Bosh release.
✈️ Features
- Building with Go 1.24.0 (#9074) @taylorsilva ^{🔗}
- go-concourse:connection client prints response body to the end user (#9011) @aliculPix4D ^{🔗}
- improve the error message given to the end user when setting the pipeline (#9012) @aliculPix4D ^{🔗}
- Log policy checker error messages (#9013) @aliculPix4D ^{🔗}
- Log detailed OPA error messages in web nodes logs and show a friendlier error message to the end user
- Introduce privileged-mode (#9017) @A1kmm ^{🔗}
- Added a new --containerd-privileged-mode/CONCOURSE_CONTAINERD_PRIVILEGED_MODE option to the worker, which accepts full (default, original behaviour), fuse-only (privileged: true tasks can use tools like buildah and podman, but can't escape if user namespaces are used to run the worker), ignore (privileged: true tasks have no extra access compared to privileged: false tasks)
- pgx Migration (Removing lib/pq) (#9066) @taylorsilva ^{🔗}
- Replace lib/pq with pgx as the Postgresql driver.
- PgBouncer users: The Pgx driver docs state that its out-of-the-box configuration does not support PgBouncer, but recent discussion indicates that may not be the case if you're using PgBouncer >1.21.0. The recent 1.24.0 release also says prepared statement support is on by default, so this may be a non-issue if you're on the most recent version of PgBouncer.
- atc: exec: ignore task input/output paths that reference parent directories (#9078) @taylorsilva ^{🔗}
- Task inputs and outputs can be placed using absolute or relative paths inside task containers now. This was changed back in v7.5.0 (#6597) but never properly announced. Paths that reference parent directories (../) will be treated as relative paths and no parent directory traversal will occur.
- worker runtime: concurrent process killing (#9084) @analytically ^{🔗}
- Worker runtime: make process killing concurrent for faster container cleanup
- worker runtime: make container deletion more robust (#9090) @taylorsilva ^{🔗}
- Make container deletion more robust by continuing to delete a container even if we get errors related to reading the containers /etc/host file
- Mount /sys/fs/cgroup as cgroup2 type if supported (#9094) @mariash ^{🔗}
- Enable cgroupv2 support for the Guardian runtime by mounting /sys/fs/cgroup as cgroup2 type if supported. Requires Garden v1.67.0 or greater
- fly: improve performance of fly watch (#9097) @analytically ^{🔗}
- Add --team flag to clear-resource-cache command (#9106) @IvanChalukov ^{🔗}
- Add --team flag to containers command (#9107) @IvanChalukov ^{🔗}
- Added --team flag to fly command containers. Use:
fly -t ci containers --team custom-team
- Support custom pipeline background image styling (#9117) @analytically ^{🔗}
- Add background_filter option for pipeline background images which takes in string of CSS filters. Defaults to the current filters opacity(30%) grayscale(100%)
- runtime: Seccomp update (#9173) @taylorsilva ^{🔗}
- Update seccomp profile to be in sync with Docker/Containerd's default profiles
- CF API v3 is now supported by our fork of Dex which will ensure CF Auth does not break when the CF v2 API is officially gone. Work done by @Kump3r @IvanChalukov in concourse/dex#148
- Add support for Strict-Transport-Security header (#9076) @taylorsilva ^{🔗}
- Add CONCOURSE_STRICT_TRANSPORT_SECURITY to the web command which allows an operator to set the Strict-Transport-Security header
- Add ESC key shortcut to hide keyboard help (#9111) @analytically

What's Changed
- fix: topgun k8s container limits test supports cgroups v1 and v2 by @Spimtav in #9028
- Split go-concourse client tests by @aliculPix4D in #9010
- go-concourse:connection client prints response body to the end user by @aliculPix4D in #9011
- Rebase master onto release 7.12.x by @drich10 in #9037
- fix(deps): update all dependencies by @drich10 in #9038
- Rebase master 7.12 by @drich10 in #9040
- fix(deps): update module golang.org/x/crypto to v0.31.0 [security] by @renovate in #9039
- Update renovate config by @drich10 in #9043
- Disable garden renovate update by @drich10 in #9044
- fix(deps): update all dependencies by @renovate in #8985
- CNI was downgraded to v1.5.1 to resolve an issue with the current versions (v1.6.x) of CNI. See #9027
New Contributors
- @Spimtav made their first contribution in #9028
- @drich10 made their first contribution in #9037
Full Changelog: v7.12.0...v7.12.1
📦 Bundled resource types
- bosh-io-release: v1.2.2
- bosh-io-stemcell: v1.4.1
- docker-image: v1.10.0
- git: v1.17.0
- github-release: v1.10.1
- hg: v1.3.1
- mock: v0.13.0
- pool: v1.4.0
- registry-image: v1.10.1
- s3: v1.3.0
- semver: v1.8.1
- time: v1.7.0
- tracker: v1.1.0

🚨 Security
- fix(deps): update module github.com/opencontainers/runc to v1.1.12 [security] (#8900) @renovate :link:
🤷 Miscellaneous
- Rotate dev vault certs (#8904) @xtremerui :link:
- Rebase master 7.11.2 (#8909) @xtremerui :link:
📦 Bundled resource types
- bosh-io-release: v1.2.2
- bosh-io-stemcell: v1.2.0
- docker-image: v1.8.1
- git: v1.15.0
- github-release: v1.9.0
- hg: v1.3.0
- mock: v0.13.0
- pool: v1.4.0
- registry-image: v1.9.0
- s3: v1.3.0
- semver: v1.7.0
- time: v1.7.0
- tracker: v1.1.0