npx @buildinternet/releases get nomad-releasesFixed bugs where namespaces and node pools could stop replicating between federated regions or be deleted in a follower region by an invalid replication token. Also fixes task restarts skipping shutdown_delay, image_pull_timeout not being respected past 5min, and unchanged jobs creating new versions when submitted with a different ACL token.
Closes a security hole where the Alloc FS API could access a secret directory symlinked into a task, and fixes a scheduler bug where task groups with per_alloc volumes could skip feasibility checks for allocs after the first placement failure. Also includes a go-getter security dependency upgrade and a Vault change_mode trigger fix.
The DriverNetwork.Hash method is removed from the plugin/drivers package. Fixed a Docker bug where tasks could escape their assigned cpuset range, plus a fix preventing deleted allocations from remaining running.
Fixed two Docker security issues: enforcement of allowed_modes or allow_privileged requirement for host namespace modes (CVE-2026-14891), and a symlink bypass of the volumes.enabled=false plugin configuration (CVE-2026-14896). Also fixed a cross-namespace host volume deletion bug and several scheduler issues affecting sticky volumes and feasibility checking.
Fixed two Docker security issues: CVE-2026-14891 enforces allowed_modes or allow_privileged requirement for host namespace modes, and CVE-2026-14896 closes a symlink bypass for volumes.enabled=false. Also fixed a cross-namespace host volume deletion vulnerability and multiple scheduler and UI bugs including a ModifyIndex collision that omitted jobs from the jobs page.
Fixed a security bug where users with host-volume-delete permission in one namespace could delete claims from another namespace. Also fixed scheduler issues with sticky host volumes, a client panic after allocation garbage collection, and UI rendering of jobs with matching ModifyIndex values.
CLI debug bundles now redact token and certificate key flags and environment variables to prevent credential exposure. Fixed a bug where tasks could be killed mid-restart on template re-render, and restored support for multiple Vault namespaces in a single job.
Debug bundles now redact sensitive token and certificate key CLI flags and environment variables. Fixed a bug where tasks could be accidentally killed mid-restart on template re-render, and re-enabled use of multiple Vault namespaces in a single Enterprise job.
CLI flags and environment variables containing tokens and certificate keys are now redacted when writing debug bundles, addressing a security exposure. Added support for timeouts on batch jobs, and improved ACL token handling, Vault token renewal, and workload identity claims.
Fixed bugs where the client detail page, topology page, and evaluation detail panel would fail to render or render improperly in the UI.
Fixed UI rendering failures on the client detail page and topology page, and improper rendering of the evaluation detail panel.
Fixed an RPC permission denied error when using node_pool="all" in ACL rules. Also fixed UI rendering bugs affecting the client detail page, topology page, and evaluation detail panel.
Fixed two security vulnerabilities: prevented unintended code execution outside the plugin directory in dynamic host volumes (CVE-2026-7474) and protected the logging FIFO from symlink swap attacks (CVE-2026-6959). Allocation logs directory is now bind-mounted read-only for task drivers with filesystem isolation support, and plugin clients no longer leak file descriptors on agent restart.
Fixed two security vulnerabilities: logging FIFOs are now protected from symlink swap attacks (CVE-2026-6959), and dynamic host volumes prevent unintended code execution outside the plugin directory (CVE-2026-7474). The allocation logs directory is now bind-mounted read-only for task drivers with filesystem isolation, and a file descriptor leak in plugin clients on agent restart is fixed.
Fixed two security vulnerabilities: dynamic host volumes could allow unintended code execution outside the plugin directory (CVE-2026-7474), and logging FIFO was vulnerable to symlink swap attacks (CVE-2026-6959). Allocation logs directory is now bind-mounted read-only for task drivers with filesystem isolation support, and a plugin file descriptor leak on agent restart is fixed.
FEATURES:
SECURITY:
FEATURES:
SECURITY:
FEATURES:
FEATURES:
