Spinnaker Release 2026.2.4
Breaking Changes
Features
- orca: Add opt-in feature to rewrite dashed SpeL variables (backport #7983) (#7990) ( 49163652 )
Configuration
Fixes
- artifacts: prevent SSRF via HTTP redirect in Helm and Jenkins artifact accounts (#7756) (#7908) ( 0e77a6df )
- change: fix: resolve CVE findings in commons-compress, logback, httpcore5, tomcat-embed, and Netty/Log4j BOM precedence (#7877) (#7878) ( 17cb6895 )
- echo: populate telemetry spinnakerVersion from resolved service version (#7966) (#7977) ( 13d6d574 )
- entity-store: Fix a UI bug with entity store references and a few stages which didn’t work with it (#7913) (#7914) ( 15ceaf45 )
- front50: filter pipelines by application, not pipeline name, in PostFilter (#7945) (#7948) ( e6f2ff50 )
- front50: repair dormant pipeline staleCheck optimistic-concurrency check (#8022) (#8086) ( 75a03f80 )
- k8s: K8s caching is kind of broken with SQL (backport #8059) (#8081) ( f56ea739 )
- kubernetes: retain empty cache entries for kinds with zero live resources (#8054) (#8056) ( 7ac54f2a )
- lambda: Lambda invoke timeout capped by shared HTTP client socket timeout (#7959) ( 9d0d1740 )
- rosco: close remaining helmfile RCE gaps and disable insecure helmfile features by default (#8034) (#8036) ( 0aaa3e1f )
- rosco: reject helmfile hooks/postRenderers by default (backport #8015) (#8016) ( 30f2e016 )
- saml: Fixes a weird edge case where metadata doesnt specify sig… (#7995) ( 66f7302a )
- sql: qualify GROUP BY columns so getAllByApplication works on PostgreSQL (#7902) (#7904) ( 1e26d464 )
- trigger: Fixes docker UI trigger on expected artifacts to use docker UI not the helm UI (#7824) (#7906) ( 3726e93f )