Spinnaker –

Changelogs: Spinnaker Release 2026.2.2

Mon, 13 Jul 2026 04:07:46 +0000

Breaking Changes

Features

Configuration

Fixes

kayenta: Fix kayenta stage UI formatting (#7779) (#7780) ( fc9c8004 )

Other

cves: Upgrade various deps based on security scans (#7775) (#7776) ( 08fe0e57 )

Changelogs: Spinnaker Release 2026.2.1

Mon, 06 Jul 2026 20:07:42 +0000

Breaking Changes

Features

Configuration

Fixes

aws: bridge v1 credentials to v2 in AmazonCredentials.getV2CredentialsProvider() AmazonCredentials.getV2CredentialsProvider() returned DefaultCredentialsProvider which cannot discover AWS credentials in non-AWS environments (e.g. GKE pods). All Spinnaker accounts have a configured v1 AWSCredentialsProvider that already handles STS assume-role with token refresh, but the v2 path ignored it entirely. Bridge the v1 provider to v2 by adapting each resolved credential (supporting both session and basic credentials). This makes the v2 SDK path work everywhere the v1 path works, without requiring a separate v2 credential discovery chain. Also removes the now-unnecessary override from NetflixAssumeRoleAmazonCredentials since the base class handles it for all subclasses. (#7766) (#7767) ( 160c50ab )

Other

Changelogs: Spinnaker Release 2026.2.0

Wed, 01 Jul 2026 17:07:59 +0000

Deprecations and Removals

MySQL 8+ REQUIRED: With recent upgrades to the underlying SQL libraries, MySQL 5.7 is no longer supported and will fail. You must be on MySQL 8+ (or equivalent MariaDB) to use Spinnaker going forward.
Halyard: Halyard has been deprecated and will be removed from new publishing after this release. The current Halyard installation should continue to operate, but the code will be removed from the Spinnaker project core. Fixes can be backported as needed, but all users should migrate to an alternative installation method. Kustomize is the default documented and community-supported installation method.
AWS SDK v1: AWS SDK v2 support has been introduced. AWS SDK v1 is likely to be removed in an upcoming release, though custom code using v1 should continue to operate. If you have custom implementations, it’s recommended to immediately begin migrating to use the v2 integrations. A few cache agents have been moved to use AWS V2 SDKs as part of this release.
EDDA: EDDA will not be supported going forward and will be removed once AWS SDK v2 is fully migrated. We have not heard of anyone in the OSS community using it and will not be continuing to support it. Please join the Spinnaker Slack if you have any concerns.
Spectator: Spectator should be considered end-of-life for the project. All operations will be moving to standard Micrometer registries. While Spectator itself is a Micrometer registry, the project will be removing implementation-specific libraries.

URL handling

Due to spring boot changes, there is a new filter that restores a lenient handling of trailing slashes. This filter enables clients to work with endpoints that do not have trailing slashes when previously they would work with this. See Github PR #7755 for more information and details. This filter can have it’s configuration adjusted as needed with the following config:

url-handler:
  trailing-slash:
    enabled: true          # default; set false to opt out
    path-patterns:
      - "/**"              # default; narrow if desired

IF you have controllers with ONLY a trailing slash, this may BREAK those controllers. You can adjust the configuration on services using the above configuration block to be more explicit on which patterns are matched. This should be a stopgap as the long term plan will be to remove the need for this filter by changing various clients and endpoints. It’s recommended that you update your controllers in plugins or custom code to handle both paths.

Major Dependency Upgrades

Spring Boot 3.5

A major change in this release is a full upgrade to the latest Spring Boot 3.5, moving to a supported release of Spring Boot. This means plugins will need version updates and other changes to work with the newer Spinnaker.

PNPM Instead of NPM

Thanks to several PRs, Spinnaker has received numerous UI version updates and moved to PNPM for publishing.

Gradle 8

The project has been upgraded to Gradle 8. Be aware of these changes for local builds.

Stage Timeout Support in Webhooks

Spinnaker will now obey overridden timeouts on webhook stages.

API Token Support

GitHub PR #7683

Spinnaker now has an alternative to mTLS or other API authentication mechanisms. This feature adds first-class, revocable API tokens for authenticating programmatic requests against Gate. Tokens are minted, listed, and revoked through a new self-service UI in Deck, persisted in Redis by Gate, and resolved on every inbound request by a dedicated stateless Spring Security chain.

The feature is off by default (api-tokens.enabled=false). Turning it on registers all of the new beans, exposes the /auth/apiTokens endpoints, and surfaces the “API Tokens” entry in the user menu.

Why API Tokens?

Today, automation that talks to Spinnaker has to either ride a user’s SSO session or run as a service account behind some out-of-band auth (basic auth, mTLS, IAP-issued JWT, etc.). None of those are revocable per-credential, scoped to a single integration, or auditable from the UI.

API tokens provide:

Per-credential revocation: Every token is independent; revoking one doesn’t disturb other automation owned by the same user or service account.
Bounded lifetime: Both user and service-account tokens have admin-tunable max lifetimes (90/365 days by default); user tokens always expire.
IAP-compatible transport: X-Spinnaker-Token: spk_… flows cleanly through GCP IAP, which rejects non-JWT Authorization: Bearer values.
Operator observability: A new gate.requests Spectator counter is tagged with authType, principalKind, method, statusCode, and status so operators can answer “how much of our traffic is token-auth, and from which kind of principal?” without scraping logs.

Configuration options

https://github.com/spinnaker/spinnaker/commit/fd3c081c5ba93fe71e84cf1bd4bb54ba05c8db75 you can see the various options documented in the spinnaker-kustomize folder. Please adjust as needed for your use

Major ECS Performance Improvements

ECS accounts had a major performance issue where several caching agents would load all data into memory before filtering. This issue has been addressed and should drastically reduce the memory footprint for those using ECS. This should be a noticeable improvement for users with large numbers of ECS accounts.

Microsoft Teams Integration Changes

GitHub PR #7741

The Microsoft Teams integration has been updated to use a set of Jinja templates to determine the Teams notification payloads. This allows a much more varied range of calls and configurations that can be sent to Microsoft Teams endpoints, and allows further updates to be done by end users without changing the codebase.

This adds two templates that can be overridden by users:

Event notifications
Pipeline notifications

Users can override these with a configuration option:

microsoftteams:
  enabled: true
  templatePath: /opt/some/override/path

Note: The template files should be named event-notification.jinja and pipeline-notification.jinja. Additionally, status becomes a required field on pipeline notification templates (it should already always be set).

Migration from Outlook

For users using a deprecated/legacy endpoint, this change will send log warnings when detected. Please read the migration guide for more information.

ECS and Image Selection

ECS will now prompt you for an account when selecting an image to deploy. Additionally, some permissions issues around Docker handling have been fixed. This required some UI changes as a result. Account is now a required field on image find APIs.

Features

api-tokens: add API token authentication support ( aa01d1d8 )
aws: make AmazonClientProvider bilingual (v1 + v2 SDK) (#7705) ( ff7bffb5 )
echo: add trace hierarchy, stage names and customData promotion to OTLP CDEvents spans ( 8bd917bc )
ecs: migrate ECS caching agents to AWS SDK v2 (#7742) ( 61d833ee )
teams: Allow adaptive and custom templates for MS Teams messages using Jinja (#7741) ( e77f8489 )
upgrades: Spring boot on a supported version - 3.5.14 (#7682) ( 7d1e46bc )

Configuration

Fixes

build: Add find step before closing Nexus repos (#7744) ( 71a7d490 )
build: Close Nexus staging repo in a later GHA step (#7737) ( 802819e3 )
build: Defer publishing configuration until -bom subproject evaluation (#7727) ( 68159cd1 )
build: Support find Nexus staging repository task (#7738) ( 5752bb5f )
build: Temporary fix to ignore closing a staging repo (#7763) (#7764) ( 6964c765 )
build: Use default resolution for javaPlatform (#7732) ( d409ba18 )
docker: Fixes an issue with RBAC around docker images. (#7746) ( 667e3208 )
echo: Fix Microsoft Teams webhook URL doubling in Retrofit2 migration (#7718) (#7719) ( a3e1f5e2 )
echo: Fix Microsoft Teams webhook URL doubling in Retrofit2 migration (#7718) ( 294e8d71 )
echo: GitHub status conversion exception (#7701) (#7706) ( 6f0250a4 )
echo: GitHub status conversion exception (#7701) ( a1ae9e5b )
jenkins: cancel Jenkins job when Spinnaker pipeline is cancelled (#7752) ( 3162d5f0 )
mvc: UrlHandlerFilter to trailing slash handle route matching (#7755) ( 971162f7 )
orca: Pipeline bulk save breaks with managed service accounts (#7688) ( 80676c9f )
perf: ECS loaded ALL data for ALL accounts then filtered. (#7672) ( a59fcc0a )
spin: SPIN cli builds had a number of issues post changes to openapi spec. Fix these issues and make sure to use the monorepo packaging structure. (#7757) (#7762) ( f909fe40 )
tests: Add tests around retrofit incorrect call handling from previous PR (#7710) (#7722) ( 8d011e83 )
tests: Add tests around retrofit incorrect call handling from previous PR (#7710) ( 0a0b6e1a )

Other

api-token: hardening fixes (#7695) ( 0fb23be0 )
build: Upgrade to gradle 8 (#7680) ( d6d10e07 )
build: migrate deck & deck-kayenta from yarn to pnpm (#7694) ( 9bfad217 )
change: CI fixes, ordering and jakarta ( 6c6e8098 )
change: Fixes #7282: honor stageTimeoutMs in CreateWebhookTask (#7689) ( ed6708e6 )
change: Merge commit from fork (#7711) ( de5a7a05 )
change: Merge commit from fork ( df32d568 )
change: Merge pull request #7617 from tridentsx/feat/cdevents-otlp-mtls ( 6e47ef4c )
change: Merge pull request #7683 from stevenlandrydd/api-tokens ( 3e5e0d15 )
change: fix redis token version usage ( 57d293b5 )
change: review fixes ( 5a2b7b9c )
change: update customize ( fd3c081c )
cleanup: Remove bearychat as dead code as it closed in 2021 (#7681) ( f76c1d10 )
deps-dev: bump webpack-dev-server from 5.2.1 to 5.2.4 in /deck (#7687) ( c69d00e4 )
deps-dev: bump webpack-dev-server in /deck/packages/app (#7684) ( d31e47a9 )
deps: bump esbuild from 0.25.12 to 0.28.1 in /deck (#7725) ( 365a90f7 )
deps: bump fast-xml-builder in /.github/actions/spinnaker-release (#7676) ( 607d9700 )
deps: bump uuid in /.github/actions/spinnaker-release (#7666) ( d940059c )
echo: add Javadoc explaining subject.id stability for trace correlation ( 6d919c5d )
echo: stateless deterministic trace correlation for multi-pod ( 87fbeebf )
echo: use W3CTraceContextPropagator for trace correlation ( 476e2ce1 )
tests: Adds integration tests for MTLS & OAuth2 flows with keycloak (#7726) ( 4d64cc86 )
upgrade: Spring boot 3.5.14 -> 3.5.15 (#7715) ( e1f75bf2 )

Changelogs: Spinnaker Release 2025.4.4

Fri, 12 Jun 2026 18:06:56 +0000

Breaking Changes

Features

Configuration

Fixes

clouddriver/eureka: remove leading slashes from all the retrofit2 api interfaces (#7652) (#7661) ( 2ef5968c )
deck: Preserve execution selection when editing form fields (#7439) (#7698) ( 37108a77 )
echo: Fix Microsoft Teams webhook URL doubling in Retrofit2 migration (#7718) (#7721) ( 9e97bec6 )
echo: GitHub status conversion exception (#7701) (#7708) ( ffba1a55 )
tests: Add tests around retrofit incorrect call handling from previous PR (#7710) (#7724) ( bb91cca7 )
yaml: A few classes were not using safe constructors. Fix these (#7669) (backport to 2025.4.x) (#7691) ( e57c0db4 )

Other

change: Merge commit from fork (#7713) ( 2d75818b )

Changelogs: Spinnaker Release 2026.1.1

Fri, 12 Jun 2026 18:06:32 +0000

Breaking Changes

Features

Configuration

Fixes

echo: Fix Microsoft Teams webhook URL doubling in Retrofit2 migration (#7718) (#7719) ( a3e1f5e2 )
echo: GitHub status conversion exception (#7701) (#7706) ( 6f0250a4 )
tests: Add tests around retrofit incorrect call handling from previous PR (#7710) (#7722) ( 8d011e83 )

Other

change: Merge commit from fork (#7711) ( de5a7a05 )

Changelogs: Spinnaker Release 2026.0.3

Fri, 12 Jun 2026 18:06:29 +0000

Breaking Changes

Features

Configuration

Fixes

clouddriver/eureka: remove leading slashes from all the retrofit2 api interfaces (#7652) (#7660) ( 5900380b )
echo: Fix Microsoft Teams webhook URL doubling in Retrofit2 migration (#7718) (#7720) ( 5aec138d )
echo: GitHub status conversion exception (#7701) (#7707) ( 5c41f281 )
tests: Add tests around retrofit incorrect call handling from previous PR (#7710) (#7723) ( 7770adf6 )
yaml: A few classes were not using safe constructors. Fix these (#7669) (backport to 2026.0.x) (#7690) ( 4cbe1d5f )

Other

change: Merge commit from fork (#7712) ( bbc30c9b )

Changelogs: Spinnaker Release 2026.1.0

Sat, 09 May 2026 20:05:37 +0000

Security

There are a number of fixes in this release. As always upgrading post validation in a sandbox account is highly recommended. For example, the project moved from spring boot 3.1.2 to 3.1.12.

Breaking Changes

Halyard is fully deprecated at this point and no longer supported. Please migrate to spinnaker kustomize or a similar implementation going forward, as halyard will no longer be patched, updated, nor addressed for work
GHCR is now the default location for all images going forward. We will no longer be publishing to GAR, and in a few releases, all GAR access will be removed for docker images (debians are still published to GAR).

Certificate map support for GCP load balancers

Spinnaker supports caching and migration to certificate maps from ssl certificate configurations for load balancers.

Kubernetes secret engine support

A new feature allows you to store and reference secrets from kubernetes. You can now save a secret and use it in a spinnaker configuration using the encrypted syntax similar to that for s3 or other services.

encrypted:k8s!n:somesecretName!k:secretKey

If you want to enable this, add to your spinnaker-local.yml (the default config file in spinnaker-kustomize) the following config:

spinnaker:
  secrets:
    kubernetes:
      enabled: true

This will use the local pod credentials for accessing secrets. You can also use a secret in a different namespace if your spinnaker is authorized to do so with an ns flag. See https://github.com/spinnaker/spinnaker/pull/7603/changes for more information.

Lambda Naming and performance fixes

Lambda had some issues around loading all lambdas into memory when enabled then filtering. The new release with some configuration changes this to operate similarly to ECS and Kubernetes with tags added to the lambda that enable filtering by tags. Further, this moves caching out of the shared application to a dedicated lambda application table. This should drastically improve lambda experience across the board. The tags behavior is enabled by default and all new deploys will automatically add these tags on deployment. You can disable this behavior by changing the following in clouddriver:

aws:
  lambda:
    setMonikerTags: false

Next, to allow arbitrary naming of functions without a default prefix on deployments, you can disable by a flag the spinnaker behavior of adding this. Note there are two configurations, one in orca and one in clouddriver.

Clouddriver:

aws:
  lambda:
    prefixApplicationNameToFunction: false

Orca:

lambda:
  prefixApplicationNameToFunction: false

This will allow you to using an expression edit the stage json and set any name you wish other than the UI generated function name.

ECS Fixes

ECS is receiving a number of performance fixes. The first is onDemand APIs for loading accounts via cache calls. This should drastically reduce memory, database throughput and impacts to spinnaker when a large number of accounts are deployed and deployments referencing an ECS deploy are in progress. Additional performance fixes for ECS caching is incoming in upcoming releases

Fiat performance fixes

A couple of PRs that fix some major performance issues in fiat.

The locking mechanism was restored but fixed the issues reported in https://github.com/spinnaker/spinnaker/issues/7339
The sync process does a parallel write and read of data. https://github.com/spinnaker/spinnaker/pull/7648

For configuration the parallel write when using redis, add the following to adjust this.

fiat:
  redis:
    repository:
      sync-threads: 16   # default: Runtime.getRuntime().availableProcessors()

For the lock behavior there are two places to configure the recommended settings:

Fiat:

# Fiat – enable cross-pod sync coordination
fiat:
  write-mode:
    enabled: true
    synchronization-config:
      enabled: true
      prefix: "spinnaker:fiat"
    sync-delay-ms: 600000
    sync-failure-delay-ms: 600000
    sync-delay-timeout-ms: 30000
    retry-interval-ms: 10000

Front50

# Front50 – avoid full sync (and locks) when saving service accounts
fiat:
  disableRoleSyncWhenSavingServiceAccounts: true

These in combination should help reduce the number of sync times and improve overall fiat performance. In some testing, we’ve seen this configuration reduce sync time from hours to minutes.

AWS pubsub support for cross-account / IaC-managed SQS queues

A new skipQueueBootstrap flag on each pubsub.amazon.subscriptions entry lets the SQS subscriber skip createQueue, setQueueAttributes, and SNS.Subscribe at startup, so it works with queues provisioned externally (e.g. Terraform) or owned by another AWS account.

pubsub:
  amazon:
    subscriptions:
      - name: my-subscription
        queueARN: arn:aws:sqs:eu-central-1:000000000000:my-queue
        topicARN: arn:aws:sns:eu-central-1:000000000000:my-topic
        skipQueueBootstrap: true

Default is false; existing same-account subscribers are unaffected

Features

ci/gcb: Add region in gcb account def for regional endpoints (#7504) ( 7b4a9f35 )
echo: add OTLP/gRPC transport for CDEvents notifications (#7554) ( 2bae6532 )
echo: add mTLS support for OTLP/gRPC CDEvents transport (#7561) ( 3a65ecdc )
igor: allow overriding artifact extensions in Artifactory monitors (#7535) ( ed1f4afd )
kork/artifact/artifactstore/s3: add context to artifact store exceptions (#7650) ( 85fb3911 )
lambda: Make application names work with Lambda (#7655) ( 2a3d2a91 )
provider/google, deck/google: Add certificateMap support for GCE HTTP(S) load balancers (#7475) ( 54aaef22 )
secrets: K8s secret engine support (#7603) ( 86a21d18 )
spin/iap: add token caching for IAP authentication (#7595) ( 3e7d4f38 )
webhooks: hide sensitive headers in custom webhook stages (#7421) ( e0c3c24f )

Configuration

Fixes

bom: Fix bom publishing to now reference GHCR (#7553) ( 0f872993 )
build/test: disable JVM class data sharing to remove warning on jvm startup (#7624) ( d4a42dc8 )
build: Fix bad merge from dependabot (#7508) ( 8aa48f90 )
build: Fix indentation when in a if block (#7621) ( 91c7367c )
build: Fix labels on containers (#7620) ( c1923555 )
builds: Fix bad character on gha publish breaking echo commands (#7619) ( 9adacf94 )
builds: Fix spinnaker.io publishing (#7549) (#7551) ( 45754bc9 )
builds: Fix spinnaker.io publishing (#7549) ( 095cdce7 )
builds: Fix spinnaker.io publishing when using a GitHub App for token (#7498) (#7499) ( 0b696139 )
builds: Fix spinnaker.io publishing when using a GitHub App for token (#7498) ( c4dbce60 )
builds: Fix testcontainer due to docker client upgrade issue (#7471) (#7476) ( f9be1e8a )
builds: Fix testcontainer due to docker client upgrade issue (#7471) ( b9814476 )
clouddriver/eureka: remove leading slashes from all the retrofit2 api interfaces (#7652) ( 183b6bd7 )
clouddriver: update kubectl download URL (#7470) (#7472) ( b39db13d )
clouddriver: update kubectl download URL (#7470) ( 330dd8f0 )
deck/pipeline: pass raw pipeline config to MetadataPageContent for V2 templated pipelines (#7537) ( e8324196 )
deck: Fix build all for deck/deck-kayenta (#7467) (#7468) ( cb5fe264 )
deck: Fix build all for deck/deck-kayenta (#7467) ( 88682cdb )
ecs: Fix ecs on demand perf loading issue (#7667) ( 2d39bc81 )
fiat/api: remove deprecation warnings (#7613) ( 9337025a )
fiat: Minor potential issue if groups return list ever was null (#7611) ( 5dc90a65 )
gate/api-tck/test: remove noisy startup errors from GateFixtureTest output (#7572) ( a320d63c )
gate/basic: replace deprecated Spring Security DSL with lambda-style configuration (#7589) ( be01ea3f )
gate/core: remove deprecation warnings in AnonymousConfig and ServiceAccountFilterConfigProps (#7587) ( 7416d029 )
gate/oauth2: remove deprecated tokenEndpoint() method call in OAuth2SsoConfig (#7588) ( 4e4430b2 )
gate/oauth2: restore /login endpoint behavior (#7567) ( 64251195 )
gate/plugins: make PluginsInstalledController conditional and DeckPluginService optional (#7563) ( 2269b5e3 )
gate/web/test: remove stale comments in AdminControllerTest (#7584) (#7585) ( 87a79d27 )
gate/web/test: remove stale comments in AdminControllerTest (#7584) ( 585b7106 )
gate/web/test: replace deprecated Spring Security DSL in AuthConfigTest (#7571) ( 209025fd )
gate/web: include additional exception message in AdminController.killZombie (#7575) (#7579) ( a0d688e0 )
gate/web: include additional exception message in AdminController.killZombie (#7575) ( 1f10a347 )
gate/web: remove BakeController.handleBakeOptionsException (#7511) ( 73950daa )
gate/web: return 200 instead of 500 for void orca endpoints (#7574) (#7578) ( 4b41bdf5 )
gate/web: return 200 instead of 500 for void orca endpoints (#7574) ( 7a62f750 )
gate: rename x509 SecurityFilterChain bean to prevent SAML override when both are enabled (#7539) ( e4a5016a )
gate: rename x509 SecurityFilterChain bean to prevent SAML override when both are enabled (backport #7539) (#7580) ( 60f45db4 )
gitrepo: Fix git repo with some odd character combinations (#7564) (#7568) ( 5468ff62 )
gitrepo: Fix git repo with some odd character combinations (#7564) ( 7997a14a )
gitrepo: Validate gitrepo hostname (#7541) ( 58641982 )
halyard-core: correct ‘occured’ -> ‘occurred’ in Problem javadoc (#7641) ( e08e21a7 )
iap: Fix iap auth post spring 3.0 upgrade (#7503) ( 195b36d9 )
iap: Fix iap auth post spring 3.0 upgrade (backport #7503) (#7547) ( 764558f1 )
igor/web: remove some deprecation warnings (#7615) ( 113494e3 )
kayenta: Send Authorization header proactively for Prometheus-compatible APIs (#7464) ( 39d3d272 )
kork/core: remove yaml-related deprecation warnings (#7635) ( 0f70a0b1 )
kork/moniker: fix unchecked warnings in FriggaReflectiveNamer (#7634) ( 74d99462 )
kork/plugins: remove warnings (#7637) ( e070e6af )
kork/retrofit: remove unchecked, deprecation warnings (#7626) ( cc4e08fc )
kork/secrets-k8s/test: allow KubernetesSecretsEngineTest to pass outside a k8s cluster (#7623) ( 2646a87c )
kork/sql-test: remove deprecation warnings (#7628) ( 1524b77d )
kork/sql: remove warnings (#7629) ( 78a095f6 )
kork/web: remove deprecation warnings (#7614) ( 943a78ae )
kustomize: Mariadb broken. Fix gate health check (#7606) ( 9220695c )
lambda: Lambda APIs when only account or region were still loading all data THEN filtering (#7644) ( ca659468 )
oauth2: spin cli oauth2 auth ctx (#7532) ( 256c3ec5 )
pubsub/aws: rename enableQueueCreationFallback -> skipQueueBootstrap and skip all bootstrap ops for cross-account queues (#7668) ( bd3df2e8 )
pubsub/aws: support cross-account SQS queue lookup and make queue creation fallback configurable (#7609) (#7633) ( e4a49e41 )
release: Fix release publishing notes to spinnaker.io (#7486) (#7491) ( aa0ea524 )
release: Fix release publishing notes to spinnaker.io (#7486) ( c90c4c55 )
saml: Fix wiring issue on saml. Add FULL end to end integration test using keycloak & htmlunitdriver (#7525) ( 943997b2 )
saml: Fix wiring issue on saml. Add FULL end to end integration test using keycloak & htmlunitdriver (backport #7525) (#7528) ( 1e230e28 )
security: restore AnonymousConfig after Spring Boot 3 / Security 6 upgrade (#7538) (#7594) ( 3d031ab6 )
security: restore AnonymousConfig after Spring Boot 3 / Security 6 upgrade (#7538) ( 4d0a82a0 )
spin-cli: update gateclient to always set Bearer token for oauth2 (#7612) ( f653d7dd )
spin/pipeline-template: prevent panic on non-string tag field (#7639) ( cf984859 )
spinnaker-gradle-project/publishing: replace deprecated JacksonFactory with GsonFactory (#7627) ( 39eb96f6 )
spotless: Update to 1.17 of spotless (#7479) (#7482) ( 6e1a6497 )
spotless: Update to 1.17 of spotless (#7479) ( f0dfe854 )
spring: remove LocalVariableTableParameterNameDiscoverer warnings from kork, fiat, and clouddriver (#7502) ( db214efa )
tests: Add tests for eureka so we dont hit issues in future (#7656) ( 6411e151 )
validation: Fixes some validation around user inputs (#7542) ( c4a5b4fd )

Other

build/protobuf: upgrade com.google.protobuf plugin 0.8.12 -> 0.9.6 (#7618) ( ac49be5d )
build: remove gradle warnings (#7625) ( 7e5fdfb3 )
change: Adopt latching for fiat role sync (#7647) ( 40706834 )
change: Improve parallelization of redis fiat get and put (#7648) ( c41d8622 )
change: Merge commit from fork ( 95829010 )
change: Merge commit from fork ( a14c26ef )
change: Merge commit from fork ( f69d7b53 )
clouddriver/aws: cleanup dependencies (#7590) ( db998010 )
clouddriver: bump json-flattener from 0.14.2 to 0.16.6 (#7598) ( 3b254970 )
clouddriver: centralize version of json-flattener (#7591) ( 6c096ec0 )
deck/build: update rollup to v4 (#7523) ( cf4a260a )
deck: upgrade webpack to 5.104.1, webpack-dev-server to 5.2.1 & eslint to 9.39.2 (#7516) ( 9980f156 )
dependencies: upgrade to Spring Boot 3.1.12 and align dependent libraries (#7338) ( 81f227f6 )
deps-dev: bump rollup from 2.79.2 to 2.80.0 in /deck-kayenta (#7514) ( 817dcc74 )
deps: bump actions/create-github-app-token from 2 to 3 (#7597) ( 42a085c7 )
deps: bump actions/github-script from 7 to 8 (#7520) ( 0ca720b6 )
deps: bump axios from 1.13.6 to 1.15.0 in /deck (#7631) ( 4c8a40d2 )
deps: bump bn.js from 4.12.2 to 4.12.3 in /deck (#7506) ( 9dc2b880 )
deps: bump docker/login-action from 3 to 4 (#7596) ( 4a75cb0d )
deps: bump express from 4.18.2 to 4.22.0 in /deck-kayenta (#7349) ( 90212867 )
deps: bump fast-xml-parser and @google-cloud/storage (#7483) ( aeb2a4cc )
deps: bump fast-xml-parser in /.github/actions/spinnaker-release (#7519) ( 5570ccd0 )
deps: bump fast-xml-parser in /.github/actions/spinnaker-release (#7540) ( 62e23c93 )
deps: bump fast-xml-parser in /.github/actions/spinnaker-release (#7546) ( 3fc2a7c6 )
deps: bump fast-xml-parser in /.github/actions/spinnaker-release (#7654) ( 3e75e3b3 )
deps: bump flatted from 3.3.4 to 3.4.2 in /deck (#7552) ( 52e65fba )
deps: bump follow-redirects from 1.15.11 to 1.16.0 in /deck (#7642) ( 1cd788ec )
deps: bump follow-redirects in /deck-kayenta (#7638) ( 71bbb66b )
deps: bump follow-redirects in /deck/test/functional (#7640) ( 2cbdca69 )
deps: bump handlebars from 4.7.8 to 4.7.9 in /deck (#7573) ( c4b81240 )
deps: bump js-yaml in /deck/packages/kubernetes (#7341) ( efeec340 )
deps: bump lodash from 4.17.21 to 4.17.23 in /deck (#7515) ( f667c9b4 )
deps: bump lodash from 4.17.23 to 4.18.1 in /deck (#7600) ( 24662152 )
deps: bump lodash in /.github/actions/spinnaker-release (#7513) ( d3ef1142 )
deps: bump lodash in /deck/packages/cloudrun (#7507) ( f5fde96e )
deps: bump lodash in /deck/packages/kubernetes (#7509) ( 401be8c5 )
deps: bump lodash-es from 4.17.21 to 4.18.1 in /deck-kayenta (#7599) ( 488c7116 )
deps: bump minimatch from 3.1.2 to 3.1.5 in /deck-kayenta (#7517) ( 7a624c52 )
deps: bump node-forge from 1.3.3 to 1.4.0 in /deck (#7582) ( d809a6e1 )
deps: bump path-to-regexp from 0.1.12 to 0.1.13 in /deck (#7583) ( 92609e78 )
deps: bump postcss from 8.5.3 to 8.5.12 in /deck/test/functional (#7659) ( 8ff0f9ef )
deps: bump postcss from 8.5.8 to 8.5.10 in /deck (#7664) ( caffebf8 )
deps: bump rollup from 3.29.5 to 3.30.0 in /deck/test/functional (#7512) ( 6497a1c3 )
deps: bump svgo from 2.8.0 to 2.8.2 in /deck (#7524) ( 25cb982b )
deps: bump uuid and @actions/core (#7653) ( c34013f6 )
deps: bump yaml in /.github/actions/spinnaker-release (#7566) ( 16281185 )
deps: bump yaml in /.github/actions/update-monorepo (#7565) ( 51ffb3f6 )
deps: update jinjava to 2.7.6 (#7536) ( 61787ec7 )
docs: add AGENTS.md, CLAUDE.md and copilot-instructions.md (#7559) ( a427629a )
gate/header: skip login of service account users when using header authentication (#7557) ( da35224f )
gate/web/test: mock ApplicationService to prevent noisy log output (#7562) ( f29d55e9 )
gate: parameterize raw types in OrcaService (#7586) ( b040c76f )
kork/sql-test: use postgres:16.13 to stay up to date (#7610) ( 4b1291af )
kork/sql/test: remove warnings + clean up test output (#7636) ( 07cc8180 )
kork/test: close the jedis pool before shutting down redis (#7558) ( 16db7d76 )
kustomize: Add auth to kustomize install and some defaults and an ingress (#7601) ( 678e231e )
lambda: Update UI lambda runtime defaults to match current releases (#7665) ( 1f25ba39 )
mergify: upgrade configuration to current format (#7645) ( 5f9a4afa )
oauth2: demonstrate that Bearer token is used to authenticate (#7545) ( 5282b204 )
publishing: Move to GHCR for image references (#7452) ( 79d8d240 )
wercker: Remove wercker as a dead product from spinnaker (#7622) ( 1c8205e9 )

Changelogs: Spinnaker Release 2025.3.3

Tue, 07 Apr 2026 19:04:23 +0000

Breaking Changes

Features

Configuration

Fixes

gate/web: return 200 instead of 500 for void orca endpoints (#7574) (#7576) ( d420f762 )
gitrepo: Fix git repo with some odd character combinations (#7564) (#7570) ( d5593b3f )

Other

Changelogs: Spinnaker Release 2026.0.2

Tue, 07 Apr 2026 19:04:16 +0000

Breaking Changes

Features

Configuration

Fixes

gate/web/test: remove stale comments in AdminControllerTest (#7584) (#7585) ( 87a79d27 )
gate/web: include additional exception message in AdminController.killZombie (#7575) (#7579) ( a0d688e0 )
gate/web: return 200 instead of 500 for void orca endpoints (#7574) (#7578) ( 4b41bdf5 )
gate: rename x509 SecurityFilterChain bean to prevent SAML override when both are enabled (backport #7539) (#7580) ( 60f45db4 )
gitrepo: Fix git repo with some odd character combinations (#7564) (#7568) ( 5468ff62 )
security: restore AnonymousConfig after Spring Boot 3 / Security 6 upgrade (#7538) (#7594) ( 3d031ab6 )

Other

Changelogs: Spinnaker Release 2025.4.3

Tue, 07 Apr 2026 19:04:12 +0000

Breaking Changes

Features

Configuration

Fixes

gate/web: return 200 instead of 500 for void orca endpoints (#7574) (#7577) ( 2cd80fb2 )
gate: rename x509 SecurityFilterChain bean to prevent SAML override when both are enabled (#7539) (#7581) ( c12a7d69 )
gitrepo: Fix git repo with some odd character combinations (#7564) (#7569) ( 369da6f0 )
saml: Fix wiring issue on saml. Add FULL end to end integration test using keycloak & htmlunitdriver (backport #7525) (#7607) ( 24959fc5 )
saml: Restore allowedAccounts (#7453) (#7608) ( 804c3fc4 )
security: restore AnonymousConfig after Spring Boot 3 / Security 6 upgrade (#7538) (#7593) ( 7adb4f7b )

Other

Changelogs: Spinnaker Release 2026.0.1

Fri, 20 Mar 2026 19:03:48 +0000

Breaking Changes

Features

Configuration

There’s an additional configuration that can be set on the gitrepo for controlling which hosts are accessible by a gitrepo. You can restrict now the gitrepo calls to ONLY internal servers vs. allowing multiple git servers. This can be done by adding an allowedhosts flag on the gitrepo accounts. NOTE: THis does NOT work in halyard so you’ll need to set these accounts via profiles if you’re still using halyard/operator.

Fixes

gitrepo Fix git repo validation
Auth Fix IAP Authentication fix(iap): Fix iap auth post spring 3.0 upgrade (backport #7503) (#7547)
Saml Fix an issue with restoring the allowed accounts to SAML user logins fix(saml): Fix wiring issue on saml. Add FULL end to end integration test using keycloak & htmlunitdriver (backport #7525) (#7528)

Other

Changelogs: Spinnaker Release 2025.4.2

Fri, 20 Mar 2026 18:03:48 +0000

Breaking Changes

Features

Configuration

Fixes

builds: Fix spinnaker.io publishing (#7549) (#7550) ( d86027a6 )
builds: Fix spinnaker.io publishing when using a GitHub App for token (#7498) (#7500) ( 5739c008 )
builds: Fix testcontainer due to docker client upgrade issue (backport #7471) (#7477) ( c48e50e4 )
clouddriver: update kubectl download URL (#7470) (#7473) ( 11dd402a )
gitrepo: Fix git repo validation (#7543) ( 96beee34 )
iap: Fix iap auth post spring 3.0 upgrade (#7503) (#7548) ( f0207f0a )
kayentadeck: Fix publishing to NOT tag by latest. This prevents us from hitting an issue where backports fail to publish due to being older versions (#7456) (#7457) ( fd5c76f6 )
publishing: Tags cant be semver so prefix with release (#7460) (#7461) ( 7e333744 )
release: Fix release publishing notes to spinnaker.io (#7486) (#7496) ( 164bfb34 )

Other

build: Add id permissions to release for deck NPM publishing (#7448) (#7449) ( 06cdcfef )
change: Call Deck/Deck Kayenta workflows via API to work around NPM Trusted Publishing validation (#7455) (#7492) ( 23cb0f17 )
release: move from personal app to GHA to do updates on release notes or other purposes (#7465) (#7494) ( 524862f8 )

Changelogs: Spinnaker Release 2025.3.2

Thu, 19 Mar 2026 20:03:29 +0000

Breaking Changes

Features

Configuration

Fixes

builds: Fix spinnaker.io publishing when using a GitHub App for token (#7498) (#7501) ( 9b32c670 )
builds: Fix testcontainer due to docker client upgrade issue (backport #7471) (#7478) ( 4c2c4435 )
clouddriver: update kubectl download URL (#7470) (#7474) ( 261c19c2 )
gitrepo: Fix git repo validation (#7544) ( 8dfcb8e9 )
release: Fix release publishing notes to spinnaker.io (#7486) (#7497) ( 9bfd1b89 )

Other

change: Call Deck/Deck Kayenta workflows via API to work around NPM Trusted Publishing validation (#7455) (#7493) ( a241ce1a )
release: move from personal app to GHA to do updates on release notes or other purposes (#7465) (#7495) ( 67c4b2f0 )

Changelogs: Spinnaker Release 2026.0.0

Thu, 19 Feb 2026 05:02:12 +0000

Breaking Changes

Images

The spinnaker project will be moving docker images from Google’s artifact registry to GHCR going forward. This should save the project significantly on network and storage costs, while also allowing unlimited downloads. As such we’ve started publishing all images to the github packages pages . 2026.0.0 should be the last release consuming images from google artifact registry. Going forward, halyard and other images will start pulling from GHCR instead (incoming PRs shortly on this change). Please update any allowlists, rules, and mirrors to start using GHCR as a package repository. For more information, please join

slack and we’ll answer any questions!

Security fixes

We have HIGH level vulnerabilities in spinnaker tied to user input validation handling on URL calls. Specifically, see the advisories page for more information: https://github.com/spinnaker/spinnaker/security/advisories/ Please upgrade to a supported release as soon as possible.

Features

GHA support for fiat group integration

Thanks to https://github.com/spinnaker/spinnaker/pull/7337 you can now use GitHub Apps to authentication and sync group information for fiat. This is expected to unblock later usage of this same logic in ohter areas at a future date but this ONLY works for FIAT for group information at this point in time. For more information on configuration, please see the documentation .

Clouddriver

https://github.com/spinnaker/spinnaker/pull/7356 adds a way to configure artifact support in clouddriver at build time to reduce image size and dependencies. Previously, support for all artifact types was included in clouddriver, with config flags to enable individual types (e.g. artifacts.bitbucket.enabled, artifacts.gcs.enabled, artifacts.github.enabled, etc.). This PR introduces a new gradle property: artifactTypes that defaults to include all artifact types at build time. There’s no change for the clouddriver artifacts that the Spinnaker project publishes, but the flexibility is there for those who build clouddriver on their own.

artifactTypes=bitbucket,custom,docker,embedded,front50,gcs,github,gitlab,gitrepo,helm,http,ivy,jenkins,kubernetes,maven,oracle,s3

Change the value of artifactTypes to include a subset. Note that the kubernetes cloud provider uses kubernetes artifacts. So, if the kubernetes cloud provider is enabled, kubernetes artifacts are included even if kubernetes isn’t present in artifactTypes. Similarly for the cloudfoundry cloud provider and maven artifacts.

clouddriver-artifacts: configurable artifact support (#7356) ( 1a024e44 )

Ability to cancel a zombie via an API call

You can now kill a zombie execution without needing to port forward orca. There’s a new admin controller that supports this for “Admins”.

admin: Admin controller for killing pipelines & is admin API check (#7313) ( f616e69e )

Externalized storage

There’s a new feature to externalize more of the pipeline context to an external storage system. Please see the PR for information, documentation and more information . Note this requires S3.

kork-artifacts: Adds entity storage feature (#7072) ( 7aa599e0 )

Status codes on preconfigured webhooks

A new small feature which allows adding a wait before monitor and retry status code fields on preconfigured webhooks.

webhooks: allow waitBeforeMonitor and retryStatusCodes fields in preconfigured webhooks (#7387) ( 8243f239 )

Fixes

fiat-github: Add integration tests and fix token refresh for GitHub App auth (#7353) ( f9794beb )
OAuth2: Remove quotes as it is causing URI issues while redirecting. (#7380) (#7383) ( 826e6adf )
OAuth2: Remove quotes as it is causing URI issues while redirecting. (#7380) ( 232089d8 )
build: actually publish compiled deck-kayenta code (#7389) (#7417) ( 43c99069 )
build: actually publish compiled deck-kayenta code (#7389) ( 3f325c90 )
build: produce production build of Deck (#7384) ( 62db9e22 )
builds: Fix spinnaker.io publishing when using a GitHub App for token (#7498) (#7499) ( 0b696139 )
builds: Fix testcontainer due to docker client upgrade issue (#7471) (#7476) ( f9be1e8a )
cats-sql: make SqlUnknownAgentCleanupAgent sharding-aware (#7431) ( cdad1f67 )
clouddriver-artifacts: fix multiple okhttpclients issue (#7363) ( d70a1803 )
clouddriver: update kubectl download URL (#7470) (#7472) ( b39db13d )
deck: Attempt two of fixing deck publishing (#7406) ( 4a1dafc4 )
deck: Attempt two of fixing deck publishing (backport #7406) (#7410) ( 27f0bf35 )
deck: Fix build all for deck/deck-kayenta (#7467) (#7468) ( cb5fe264 )
deck: Preserve execution selection when editing form fields (#7439) ( 17dde4b0 )
deck: fix artifact not bound error on deck (#7371) ( 6b3ab9d9 )
echo: actually increment trigger.errors.accessdenied counter (#7388) ( 6c91f2fb )
fiat: make prefix permissions case-insensitive (#7361) ( cccc1fcd )
gcp: Fiat batch queries on rate limit would randomly fail (#7385) ( 2c60d34f )
gcp: Fix missing pagination token on accelerator lookups (#7420) (#7434) ( fc30c3dc )
gcp: Fix missing pagination token on accelerator lookups (#7420) ( 343c3905 )
kayentadeck: Fix publishing to NOT tag by latest. This prevents us from hitting an issue where backports fail to publish due to being older versions (#7456) ( 5b3d513e )
ldap: publish firstName and lastName for users authenticated via LDAP (#7438) ( 6a6c4066 )
npm: Fix npm publishing (#7398) (#7408) ( efa2f298 )
npm: Fix npm publishing (#7398) ( 212cedb7 )
oauth2: re-implement ExternalAuthTokenFilter to fix spin-cli login (#7392) ( 64ae6f74 )
orca-core: fix evaluateVariables stage when evaluation has already failed prior (#7372) ( d897320a )
orca/web: properly deserialize webhook status code (#7367) (#7368) ( 6bb03290 )
orca/web: properly deserialize webhook status code (#7367) ( f85f74de )
orca: Include pipeline config context in template variable validation errors (#7354) ( fe8f20d7 )
publishing: Fix deck kayenta had duplicate package block (#7444) (#7445) ( aa57ea00 )
publishing: Fix deck kayenta had duplicate package block (#7444) ( 7c7ba0a5 )
publishing: Fix image publishing for deck due to NPM trusted publishing change (#7422) (#7423) ( f3b93fbc )
publishing: Fix image publishing for deck due to NPM trusted publishing change (#7422) ( f8505b75 )
publishing: Tags cant be semver so prefix with release (#7460) ( b134dd11 )
queue: pass true for restoreOriginalContext in StageExecution.withAuth (#7357) ( 01d4e9ce )
release: Fix release publishing notes to spinnaker.io (#7486) (#7491) ( aa0ea524 )
release: Fix string handling on release notes for summary step (#7466) ( 946f0a3f )
rosco/helmfile: fix command line arguments list when multiple values files are provided (#7351) ( 5eb1aa0a )
saml: Restore allowedAccounts (#7453) ( d430487c )
spin-cli: update spin-cli to handle new oauth2 endpoint (#7391) ( 4790896f )
spotless: Update to 1.17 of spotless (#7479) (#7482) ( 6e1a6497 )
validation: Fixes some url validation handling on underscores (#7428) ( 7c473790 )
validation: Fixes some url validation handling on underscores (backport #7428) (#7440) ( 31d40976 )

Other

build: Add id permissions to release for deck NPM publishing (#7448) ( ad49e819 )
build: migrate to trusted npm publishing (#7379) (#7414) ( 6ea43243 )
build: migrate to trusted npm publishing (#7379) ( c0a18c31 )
build: remove unused properties (#7375) ( cebafa66 )
build: update Deck to Node 24 (#7443) ( ad5cf396 )
change: Add GitHub App Authentication Support for Team Membership (#7337) ( 9dd90943 )
change: Call Deck/Deck Kayenta workflows via API to work around NPM Trusted Publishing validation (#7455) ( a4550cd1 )
change: refactor: Upgrade HttpClient from Apache HttpClient 4.x to 5.x across modules (#7345) ( 091e9248 )
clouddriver: log unhandled exceptions with a stack trace during HTTP URL Restrictions check (#7360) ( 3ac0e6c9 )
deps: bump actions/cache from 4 to 5 (#7378) ( bbbfd9fa )
deps: bump diff from 4.0.2 to 4.0.4 in /deck (#7396) ( be17384c )
deps: bump jws from 3.2.2 to 3.2.3 in /deck (#7364) ( ca63e293 )
deps: bump jws in /.github/actions/spinnaker-release (#7355) ( b46c1bdd )
deps: bump lodash from 4.17.21 to 4.17.23 in /deck-kayenta (#7407) ( 769b6e22 )
deps: bump lodash from 4.17.21 to 4.17.23 in /deck/packages/azure (#7426) ( bfc1e330 )
deps: bump lodash from 4.17.21 to 4.17.23 in /deck/packages/core (#7427) ( 2f8196f1 )
deps: bump lodash from 4.17.21 to 4.17.23 in /deck/packages/dcos (#7403) ( 317c7bcc )
deps: bump lodash from 4.17.21 to 4.17.23 in /deck/packages/mocks (#7429) ( 040f8341 )
deps: bump lodash from 4.17.21 to 4.17.23 in /deck/packages/titus (#7430) ( 0295d1ce )
deps: bump lodash in /deck/packages/appengine (#7401) ( 45708712 )
deps: bump lodash in /deck/test/functional (#7402) ( 1ba6dd3b )
gradle: allocate 10g of heap space (#7376) ( 2b181b19 )
orca/web: reproduce anonymous pipeline trigger user (#7369) (#7374) ( 57f98fe3 )
orca/web: reproduce anonymous pipeline trigger user (#7369) ( 52d0968b )
release: move from personal app to GHA to do updates on release notes or other purposes (#7465) ( 153155be )
upgrades: Upgrade the CLI utilities used by rosco for baking (#7299) ( eb3edf6c )

Changelogs: Spinnaker Release 2025.2.4

Sat, 14 Feb 2026 20:02:49 +0000

Breaking Changes

Features

Configuration

Fixes

OAuth2: Remove quotes as it is causing URI issues while redirecting. (#7380) (#7381) ( 3558e844 )
build: actually publish compiled deck-kayenta code (#7389) (#7419) ( 9b1b4b0f )
deck: Attempt two of fixing deck publishing (backport #7406) (#7413) ( edb2ed1c )
gcp: Fix missing pagination token on accelerator lookups (#7420) (#7436) ( 1ab52111 )
kayentadeck: Fix publishing to NOT tag by latest. This prevents us from hitting an issue where backports fail to publish due to being older versions (#7456) (#7459) ( b1559cfa )
npm: Fix npm publishing (#7398) (#7412) ( a649739b )
orca-applications: Retrofit calls on Front50 projects tasks (#7272) (#7393) ( 9741b74e )
publishing: Fix deck kayenta had duplicate package block (#7444) (#7447) ( c53f05bd )
publishing: Fix image publishing for deck due to NPM trusted publishing change (#7422) (#7425) ( 9bd2194b )
publishing: NPM Tag update ( b2634575 )
validation: Fixes some url validation handling on underscores (backport #7428) (#7442) ( 1db6abf1 )

Other

build: Add id permissions to release for deck NPM publishing (#7448) (#7451) ( fbcbd0e4 )
build: migrate to trusted npm publishing (backport #7379) (#7416) ( 0549fd93 )

Changelogs: Spinnaker Release 2025.3.1

Sat, 14 Feb 2026 18:02:36 +0000

Breaking Changes

Features

Configuration

Fixes

OAuth2: Remove quotes as it is causing URI issues while redirecting. (#7380) (#7382) ( d03b0ad5 )
build: actually publish compiled deck-kayenta code (#7389) (#7418) ( 8ea3baac )
deck: Attempt two of fixing deck publishing (backport #7406) (#7411) ( 1411a9cd )
gcp: Fix missing pagination token on accelerator lookups (#7420) (#7435) ( a34f9f93 )
kayentadeck: Fix publishing to NOT tag by latest. This prevents us from hitting an issue where backports fail to publish due to being older versions (#7456) (#7458) ( 2ed5a0eb )
npm: Fix npm publishing (#7398) (#7409) ( 61bcf573 )
publishing: Fix deck kayenta had duplicate package block (#7444) (#7446) ( fa857f76 )
publishing: Fix image publishing for deck due to NPM trusted publishing change (#7422) (#7424) ( f651b23a )
publishing: Tags cant be semver so prefix with release (#7460) (#7462) ( c973386a )
validation: Fixes some url validation handling on underscores (backport #7428) (#7441) ( 9b3fe2b0 )

Other

build: Add id permissions to release for deck NPM publishing (#7448) (#7450) ( afc84eaf )
build: migrate to trusted npm publishing (#7379) (#7415) ( 82aef6bb )
roles: make fiat full role sync synchronized across fiat instan…" (#7348) (#7394) ( 61df749e )

Changelogs: Spinnaker Release 2025.4.1

Tue, 03 Feb 2026 00:02:53 +0000

Breaking Changes

Features

Configuration

Fixes

OAuth2: Remove quotes as it is causing URI issues while redirecting. (#7380) (#7383) ( 826e6adf )
gcp: Fix missing pagination token on accelerator lookups (#7420) (#7434) ( fc30c3dc )
orca/web: properly deserialize webhook status code (#7367) (#7368) ( 6bb03290 )
validation: Fixes some url validation handling on underscores (backport #7428) (#7440) ( 31d40976 )

Other

deck: actually publish compiled deck-kayenta code (#7389) (#7417) ( 43c99069 )
build: Attempt two of fixing deck publishing (backport #7406) (#7410) ( 27f0bf35 )
build: Fix deck kayenta had duplicate package block (#7444) (#7445) ( aa57ea00 )
build: Fix image publishing for deck due to NPM trusted publishing change (#7422) (#7423) ( f3b93fbc )
build: Fix npm publishing (#7398) (#7408) ( efa2f298 )
build: migrate to trusted npm publishing (#7379) (#7414) ( 6ea43243 )
orca/web: reproduce anonymous pipeline trigger user (#7369) (#7374) ( 57f98fe3 )

Changelogs: Spinnaker Release 2025.4.0

Mon, 01 Dec 2025 23:12:33 +0000

Breaking Changes

Spring Boot 3.0.13 Upgrade

As part of the upgrade to Spring Boot 3.0.13, actuator metrics export configuration properties have changed structure.

Actuator Metrics Export Property Changes

The metrics export properties have moved from the old schema to the new format:

Old Property Prefix	New Property Prefix
`management.metrics.export.<product>`	`management.<product>.metrics.export`

Example

Prometheus configuration keys have changed from:

management.metrics.export.prometheus.*

to

management.prometheus.metrics.export.*

Session data cleanup

Spring Boot 3.0 considers session data cached by Spring Boot 2.7 invalid. Therefore, users with cached sessions will be unable to log in until the invalid information is removed from the cache. Open browser windows to Spinnaker are unresponsive after the deployment until they’re reloaded. Executing:

$ redis-cli keys "spring:session*" | xargs redis-cli del

on Gate’s redis instance removes the cached session information.

YAML Parsing Limits Configuration

Context: Starting with SnakeYAML 1.33, strict safety limits are enforced by default:

maxAliasesForCollections = 50
codePointLimit = 3145728

These limits can cause large or alias-heavy YAML files (such as Kubernetes manifests) to fail during parsing, potentially breaking Spinnaker deployments.

Improvement: To address this, Spinnaker now exposes two configurable properties that allow operators to override these limits when needed:

snakeyaml.max-aliases-for-collections: <int>   # default: 50
snakeyaml.code-point-limit: <int>              # default: 3145728

Impact:

Prevents deployment failures due to strict YAML parsing limits.
Provides flexibility for environments using complex or deeply aliased YAML manifests.
Defaults remain aligned with SnakeYAML 1.33’s secure settings.

Example: To increase limits for large manifests:

snakeyaml:
  max-aliases-for-collections: 500
  code-point-limit: 10485760

reference links: https://www.javadoc.io/doc/org.yaml/snakeyaml/1.33/org/yaml/snakeyaml/LoaderOptions.html https://github.com/spinnaker/spinnaker/blob/main/kork/kork-core/src/main/java/com/netflix/spinnaker/kork/yaml/YamlHelper.java

Features

Configuration

Fixes

spin: Fix spin cli docker publishing to GHCR (#7335) (#7336) ( ed0023eb )
spin: Fix spin cli docker publishing to GHCR (#7335) ( 03e94e4e )
web: provide json error responses in more cases (#7340) ( 05503adb )

Other

dependency: upgrade spring boot from 2.7.x to 3.0.x and spring cloud from 2021.0.x to 2022.0.x (#7057) ( eb576df1 )
deps: bump actions/checkout from 5 to 6 (#7347) ( f78af607 )
deps: bump golangci/golangci-lint-action from 8 to 9 (#7346) ( 0995d75a )
deps: bump js-yaml from 3.14.0 to 3.14.2 in /deck-kayenta (#7342) ( e4c7b5b5 )
roles: make fiat full role sync synchronized across fiat instan…" (#7348) ( 6465902a )

Changelogs: Spinnaker Release 2025.3.0

Sat, 08 Nov 2025 00:11:07 +0000

Breaking Changes

S3ArtifactValidator’s validate method signature has changed when clouddriver-artifacts was upgraded to AWS SDK v2. Any custom implementations of this interface need to be updated accordingly. AWS SDK v2 upgrade PR: https://github.com/spinnaker/spinnaker/pull/7301

Features

Security settings on http based artifacts.

Any http or similar artifacts can now set some limits on accessible accounts. It’s recommended to configure an allow list to restrict calls to allowed known domains. There’s a whitelist of domains that can be set. Example of the configuration:

artifacts:
  http:
    enabled: true
    accounts:
      - name: http_account
        urlRestrictions:
          allowedDomains:
          - mydomain.com
          - raw.github.com
          - api.github.com
          rejectLocalhost: true #default value
          rejectLinkLocal: true #default value
          rejectVerbatimIps: true #default value
          rejectedIps: [] #default value

IF an allowedDomains pattern is set, it will take precedence even if other settings are allowed.

Account APIs.

Similar to prior verisons where you can manage k8s accounts via an API , you can now manage ECS, Azure and GCP accounts via APIs.

Long lived Lambda operations

Due to network constraints, most long lived connections will end after 5 minutes. AWS will let you use a TCP keep alive which in combination with operating system configurations allow requests to live longer with keep alive mechanisms. This new feature can be set via:

aws:
  lambda:
    tcpKeepAlive: true

For operating system configuration and information, see AWS Documentation

GRPC/HTTP2 support for GCP Load balancers

You can now setup and configure GRPC/HTTP2 configuration settings on GCP load balancers.

azure: Implement Azure dynamic account loading matching AWS/Goo… (#7269) ( 9788e7f8 )
clouddriver-artifacts/aws: upgrade clouddriver-artifacts module to aws sdk v2 (#7301) ( 97bb0434 )
clouddriver-lambda: Add configuration for tcpKeepAlive on the AWS Lambda client (#7308) ( 9f1313dc )
clouddriver/ecs: Implement the account API for ecs accounts (#7247) ( eea4599f )
docker: Start publishing to GHCR as well as GAR for future removal of GAR for docker (#7312) ( a8d0914a )
echo/aws: upgrade echo from aws sdk v1 to v2 (#7243) ( d7d65404 )
front50/aws: upgrade front50 to aws sdk v2 (#7250) ( 6f76e1f0 )
gate/executions: add a pipelineNameFilter query parameter when getting pipeline executions (#7315) ( 908bc11d )
gate/web: add GET /executions/failedStages endpoint (#7300) ( d219882d )
google: Add @JsonTypeName annotation and account definition source for dynamic loading (#7270) ( 0a1b7a32 )
healthcheck: Add GRPC and HTTP/2 support for GCP load balancers (#7253) ( b1893f0e )
igor/aws: upgrade igor to aws sdk v2 (#7283) ( 5ba06cd7 )
orca/echo: instrument code that sends events to echo before/after pipeline executions (#7297) ( a091d844 )

Configuration

Fixes

OAuth2, NPE: Map.copyOf is strict about nulls so use Collections.unmodifiableMap instead (#7246) (#7252) ( 63dcf960 )
OAuth2, NPE: Map.copyOf is strict about nulls so use Collections.unmodifiableMap instead (#7246) ( 10aa59bc )
clouddriver/cloudformation: fix an API failure caused by encoded colon char post retrofit2 upgrade (#7262) (#7275) ( be71bba3 )
clouddriver/cloudformation: fix an API failure caused by encoded colon char post retrofit2 upgrade (#7262) ( a74c9959 )
config: Defaults are not being set when only a few fields are set (#7285) (#7286) ( dd59e7f2 )
config: Defaults are not being set when only a few fields are set (#7285) ( ce3e4c5a )
echo: Fix rest event config to work with splunk style URLs or those without a trailing slash on the URL (#7330) (#7331) ( c6907c53 )
echo: Fix rest event config to work with splunk style URLs or those without a trailing slash on the URL (#7330) ( 74262cac )
front50/s3: always configure region in s3 client, when specified (#7268) ( c7966612 )
gate-web: Controller fix for RoleController & EcsCloudMetricController after retrofit updates (#7303) (#7306) ( 19d27f1c )
gate-web: Controller fix for RoleController & EcsCloudMetricController after retrofit updates (#7303) ( 9de5a1dc )
gate-web: EcsServerGroupEventsController & EcsSecretController retrofit calls to clouddriver (#7291) ( c306a00d )
gha: Another gha typo (#7323) ( a41df9f1 )
gha: Fix cleaner step (#7322) ( 99e72174 )
gha: Not a workflow so secret refs slightly different (#7325) ( ce27f216 )
images: Fix a few more places querying for images that had null parameters causing failures due to retrofit changes (#7321) (#7328) ( 3750eca6 )
images: Fix a few more places querying for images that had null parameters causing failures due to retrofit changes (#7321) ( 3a81d834 )
oauth2: move tokenResponseClient bean to static inner config to avoid circular dependency (#7254) (#7255) ( 02284135 )
oauth2: move tokenResponseClient bean to static inner config to avoid circular dependency (#7254) ( 54d246cb )
oracle: A few oracle operations call themselves google which can mess with class loading on class scans. Fix them to be Oracle (#7249) ( d5160c51 )
orca-applications: Retrofit calls on Front50 projects tasks (#7272) ( 1c35ff8d )
orca-clouddriver: Fix findImages oortService call query map (#7278) (#7317) ( cf4a7428 )
orca-clouddriver: Fix findImages oortService call query map (#7278) ( 0e76bc0b )
orca-queue: ignore unacked messages that fail retry to not block processing of other messages (#7290) ( 653ba1ed )
orca/clouddriver/retrofit: fix wildcard in the retrofit method parameter (#7264) (#7267) ( b91f789a )
orca/clouddriver/retrofit: fix wildcard in the retrofit method parameter (#7264) ( d0f0620a )
orca/clouddriver: fix log line in AbstractCheckIfApplicationExistsTask (#7298) ( de3de11d )
orca/queue: run kotlin tests in orca/orca-queue (#7333) ( 9721c0cb )
orca/redis: actually run the tests (#7292) (#7295) ( f9cf87cd )
orca/redis: actually run the tests (#7292) ( 8456bba6 )
orca/sql: Retrieve the newest pipeline executions (#7320) ( 2b12d309 )
orca/web/test: make the description of the test match reality (#7326) ( 7a3b1053 )
orca: set the status correctly when cancelling a pipeline execution (#7296) ( b281edf3 )
spin: Fix spin cli docker publishing to GHCR (#7335) (#7336) ( ed0023eb )
sql: only reference the compressed executions table (#7327) ( bf5738c1 )

Other

change: Merge commit from fork (#7279) ( dbabd821 )
change: Merge commit from fork ( 7aa9fabc )
change: Various kork updates (secrets, utilities, prereqs for credentials updates) (#7245) ( 77e5da97 )
deps: bump actions/checkout from 4 to 5 (#7259) ( c6ae6afb )
deps: bump actions/setup-go from 5 to 6 (#7257) ( df0e1300 )
deps: bump actions/setup-java from 4 to 5 (#7258) ( 9a3d91fa )
deps: bump github/codeql-action from 3 to 4 (#7311) ( 15c525e9 )
deps: bump google-github-actions/auth from 2 to 3 (#7260) ( 12779ea6 )
deps: bump google-github-actions/upload-cloud-storage from 2 to 3 (#7261) ( d2883614 )
execution: Add a retrieve method with requireLatestVersion (#7310) ( 003b1c2e )
executions: add pipelineLimit query parameter to gate’s GET /applications/{application}/pipelines and GET /applications/{application}/pipelineConfigs endpoints (#7319) ( 44dc2da4 )
front50: fetch pipeline by id in StartPipelineTask (#7273) ( 5334e0a2 )
gate/web: increase performance of the GET /{application}/pipelineConfigs/{pipelineName:.+} endpoint (#7314) ( a5210afe )
orca: add a test to verify clouddriver GET api to get CloudFormationStack (#7248) (#7276) ( 74192b53 )
orca: add a test to verify clouddriver GET api to get CloudFormationStack (#7248) ( 2ceb0bb1 )
orca: query for individual pipelines from front50 (#7302) ( 8ba587d2 )
roles: make fiat full role sync synchronized across fiat instances (#7115) ( a1195444 )
sql: Simplify sql query in retrievePipelineExecutionDetailsForApplication (#7309) ( 6dfb0fef )

Changelogs: Spinnaker Release 2025.1.6

Fri, 07 Nov 2025 17:11:38 +0000

Breaking Changes

Features

Configuration

Fixes

config: Defaults are not being set when only a few fields are set (#7285) (#7287) ( 52f54124 )
echo: Fix rest event config to work with splunk style URLs or those without a trailing slash on the URL (#7330) (#7332) ( ac327cb6 )
gate-web: Controller fix for RoleController & EcsCloudMetricController after retrofit updates (#7303) (#7305) ( 653442e8 )
images: Fix a few more places querying for images that had null parameters causing failures due to retrofit changes (#7321) (#7329) ( 69792c33 )
orca-clouddriver: Fix findImages oortService call query map (#7278) (#7318) ( e45b2043 )
orca/redis: actually run the tests (#7292) (#7294) ( 1aa81a49 )

Other

change: Merge commit from fork (#7280) ( 54259cac )

Changelogs: Spinnaker Release 2025.2.3

Fri, 07 Nov 2025 17:11:32 +0000

Breaking Changes

Features

Configuration

Fixes

clouddriver/cloudformation: fix an API failure caused by encoded colon char post retrofit2 upgrade (#7262) (#7275) ( be71bba3 )
config: Defaults are not being set when only a few fields are set (#7285) (#7286) ( dd59e7f2 )
echo: Fix rest event config to work with splunk style URLs or those without a trailing slash on the URL (#7330) (#7331) ( c6907c53 )
gate-web: Controller fix for RoleController & EcsCloudMetricController after retrofit updates (#7303) (#7306) ( 19d27f1c )
images: Fix a few more places querying for images that had null parameters causing failures due to retrofit changes (#7321) (#7328) ( 3750eca6 )
orca-clouddriver: Fix findImages oortService call query map (#7278) (#7317) ( cf4a7428 )
orca/clouddriver/retrofit: fix wildcard in the retrofit method parameter (#7264) (#7267) ( b91f789a )
orca/redis: actually run the tests (#7292) (#7295) ( f9cf87cd )

Other

change: Merge commit from fork (#7279) ( dbabd821 )
orca: add a test to verify clouddriver GET api to get CloudFormationStack (#7248) (#7276) ( 74192b53 )

Changelogs: Spinnaker Release 2025.1.5

Mon, 13 Oct 2025 11:10:50 +0000

Breaking Changes

Features

Configuration

Fixes

clouddriver/cloudformation: fix an API failure caused by encoded colon char post retrofit2 upgrade (#7262) (#7274) ( 8f783f28 )
orca/clouddriver/retrofit: fix wildcard in the retrofit method parameter (#7264) (#7266) ( 4223404b )

Other

orca: add a test to verify clouddriver GET api to get CloudFormationStack (#7248) (#7277) ( 8172b817 )

Changelogs: Spinnaker Release 2025.2.2

Wed, 24 Sep 2025 20:09:33 +0000

Breaking Changes

Features

Configuration

Fixes

oauth2: move tokenResponseClient bean to static inner config to avoid circular dependency (#7254) (#7255) ( 02284135 )

Other

Changelogs: Spinnaker Release 2025.2.1

Mon, 22 Sep 2025 19:09:25 +0000

Breaking Changes

Features

Configuration

Fixes

OAuth2, NPE: Map.copyOf is strict about nulls so use Collections.unmodifiableMap instead (#7246) (#7252) ( 63dcf960 )

Other

Changelogs: Spinnaker Release 2025.2.0

Thu, 11 Sep 2025 19:09:01 +0000

Changelog

Breaking Changes

Clouddriver

https://github.com/spinnaker/spinnaker/pull/7240 changes constructors in AmazonCredentials / AssumeRoleAmazonCredentials / NetflixAmazonCredentials / NetflixAssumeRoleAmazonCredentials. Plugins or custom code may need corresponding changes (e.g. pass null for AwsConfigurationProperties) to continue to build.

Gate

Spring Security 5 Oauth2 Migration

https://github.com/spinnaker/spinnaker/pull/7052 removes deprecated OAuth2 annotations, and uses Spring Security 5’s DSL. Various steps are required for this upgrade. The properties for configuring OAuth2 in Gate have changed:

OAuth2 Configuration Property Mapping

security.authn.oauth2.enabled
  -> spring.security.oauth2.client (auto-configured by Spring Security)

security.authn.oauth2.provider
  -> spring.security.oauth2.client.registration.<providerId> (if provider is not specified in the old configuration, it should be set to 'other' in the new configuration)

security.authn.oauth2.client.clientId
  -> spring.security.oauth2.client.registration.<providerId>.client-id

security.authn.oauth2.client.clientSecret
  -> spring.security.oauth2.client.registration.<providerId>.client-secret

security.authn.oauth2.client.scope
  -> spring.security.oauth2.client.registration.<providerId>.scope

security.authn.oauth2.client.clientAuthenticationScheme
  -> spring.security.oauth2.client.registration.<providerId>.clientAuthenticationScheme

security.authn.oauth2.client.preEstablishedRedirectUri
  -> spring.security.oauth2.client.registration.<providerId>.redirect-uri (url should be in this format https://<your-domain>/login/oauth2/code/<providerid>)

security.authn.oauth2.client.userAuthorizationUri
  -> spring.security.oauth2.client.provider.<providerId>.authorization-uri

security.authn.oauth2.client.accessTokenUri
  -> spring.security.oauth2.client.provider.<providerId>.token-uri

security.authn.oauth2.resource.userInfoUri
  -> spring.security.oauth2.client.provider.<providerId>.user-info-uri

security.authn.oauth2.userInfoMapping
  -> spring.security.oauth2.client.registration.userInfoMapping

security.authn.oauth2.userInfoRequirements
  -> spring.security.oauth2.client.registration.userInfoRequirements

Below are some example configurations built based on above mapping.

old (google):

security:
  authn:
    oauth2:
      enabled: true
      client:
        clientId: <client-id>
        clientSecret: <client-secret>
        accessTokenUri: https://www.googleapis.com/oauth2/v4/token
        userAuthorizationUri: https://accounts.google.com/o/oauth2/v2/auth
        scope: profile email
      userInfoRequirements:
        hd: <domain>
      resource:
        userInfoUri: https://www.googleapis.com/oauth2/v3/userinfo
      userInfoMapping:
        email: email
        firstName: given_name
        lastName: family_name
      provider: GOOGLE

new (google):

spring:
  security:
    oauth2:
      client:
        registration:
          userInfoMapping:
            email: email
            firstName: given_name
            lastName: family_name
          userInfoRequirements:
            hd: <domain>
          google:
            client-secret: <client-secret>
            scope: profile,email
            client-id: <client-id>
        provider:
          google:
            user-info-uri: https://www.googleapis.com/oauth2/v3/userinfo
            authorization-uri: https://accounts.google.com/o/oauth2/v2/auth
            token-uri: https://www.googleapis.com/oauth2/v4/token

old (github):

security:
  authn:
    oauth2:
      enabled: true
      client:
        clientId: client-id
        clientSecret: client-secret
        accessTokenUri: https://github.com/login/oauth/access_token
        userAuthorizationUri: https://github.com/login/oauth/authorize
        scope: user,email
      resource:
        userInfoUri: https://api.github.com/user
      userInfoMapping:
        email: email
        firstName: ''
        lastName: name
        username: login
      provider: GITHUB

new (github):

spring:
  security:
    oauth2:
      client:
        registration:
          userInfoMapping:
            email: email
            firstName: ''
            lastName: name
            username: login
          github:
            client-secret: client-secret
            scope: user,email
            client-id: client-id
        provider:
          github:
            user-info-uri: https://api.github.com/user
            authorization-uri: https://github.com/login/oauth/authorize
            token-uri: https://github.com/login/oauth/access_token

Notes:

The useCurrentUri property from spring-security-oauth is not supported in Spring Security and has been removed as part of the migration.

halyard has been updated to generate the new configuration, with the same command as before, e.g.:

hal config security authn oauth2 edit --provider google --client-id some_id --client-secret some_secret --user-info-requirements hd=company.io

Additionally, your OAuth2 resource needs to be updated to support the new redirect URI format. The previous format (https://<your-domain>/login) has changed to https://<your-domain>/login/oauth2/code/<provider>, where provider is one of github, google, or other. We recommend supporting both URL formats in your provider temporarily, to avoid issues in case of a need to rollback.

You will need to clear sessions in Redis after upgrading to avoid deserialization exceptions in Gate.

$ redis-cli keys "spring:session*" | xargs redis-cli del

Finally, spin-cli has been updated to support the new version. Post upgrade, users of spin-cli will need to download the latest version, and update their OAuth config by adding provider to their OAuth config block.

Features

Clouddriver

https://github.com/spinnaker/spinnaker/pull/7239 and https://github.com/spinnaker/spinnaker/pull/7240 add functionality to log the endpoints that the AWS sdk uses, controlled by two new config flags that default to false:

aws:
  client:
    logEndpoints: true

and

artifacts:
  s3:
    logEndpoints: true

aws.client.logEndpoints is for clients that AmazonClientBuilder creates, as well as NetflixSTSAssumeRoleSessionCredentialsProvider. artifacts.s3.logEndpoints is for clients that S3ArtifactCredentials creates.

Note: https://github.com/spinnaker/spinnaker/pull/7240 changes constructors in AmazonCredentials / AssumeRoleAmazonCredentials / NetflixAmazonCredentials / NetflixAssumeRoleAmazonCredentials. Plugins or custom code may need corresponding changes (e.g. pass null for AwsConfigurationProperties) to continue to build.

OAuth2: Current OAuth2 annotations are deprecated so using Java DSL way of configuring OAuth2 (#7052) ( c6a79fd0 )
clouddriver/aws: Implement the account API for aws accounts (#7238) ( d41da1e2 )
clouddriver/aws: log aws sdk endpoints (#7239) ( d19e1944 )
clouddriver/aws: log the endpoint that aws sdk sts clients use (#7240) ( c390e6fb )

Configuration

Fixes

clouddriver/aws: align CredentialsParser types in AmazonCredentialsInitializer (#7207) (#7208) ( 3c45b4c9 )
clouddriver/aws: align CredentialsParser types in AmazonCredentialsInitializer (#7207) ( 57b5928f )
deck: Fix RunJob external logs when component is not mounted and interpolation is needed (#7163) ( 9d86a95a )
echo/rest: make it possible to send events to URLs with no trailing slash (#7212) (#7215) ( 824acc94 )
echo/rest: make it possible to send events to URLs with no trailing slash (#7212) ( 0e8c45b4 )
gate/web: add Retrofit2SyncCall.execute to SubnetController.allByCloudProvider (#7219) (#7221) ( 9b5dcd7b )
gate/web: add Retrofit2SyncCall.execute to SubnetController.allByCloudProvider (#7219) ( 66b9ab01 )
gcp: Fix a number of potential NPEs around deploy handling for google builds. Tied to groovy to java migration (#7227) (#7233) ( 4ea0d508 )
gcp: Fix a number of potential NPEs around deploy handling for google builds. Tied to groovy to java migration (#7227) ( ffeaa35a )
gcp: More NPE handling on some input (#7236) (#7237) ( 347cfb20 )
gcp: More NPE handling on some input (#7236) ( 7177e163 )
google: Add retry and status polling logic (#7191) (#7217) ( b1243f81 )
google: Add retry and status polling logic (#7191) ( 5385827f )
halyard/retrofit2: fix DaemonService’s convertor factory (#7230) (#7232) ( 66ade3f8 )
halyard/retrofit2: fix DaemonService’s convertor factory (#7230) ( 1a83ac38 )
halyard/retrofit2: fix daemon service getTask API definition (#7206) (#7209) ( a75b383c )
halyard/retrofit2: fix daemon service getTask API definition (#7206) ( 4d991929 )
orca/clouddriver: correct parameter order for requestOperations to avoid invalid cloudProvider errors (#7201) (#7204) ( 7f6e3e2f )
orca/clouddriver: correct parameter order for requestOperations to avoid invalid cloudProvider errors (#7201) ( f45b7fd8 )
orca/retrofit2: fix orca bakeservice api (#7224) (#7225) ( e0a64b30 )
orca/retrofit2: fix orca bakeservice api (#7224) ( 6c47bbfa )
sql: Update account type column during upserts (#7242) ( ba06d158 )

Other

build: dynamic version indexing in tag name based on type (#7202) (#7203) ( e9d8ebc4 )
build: dynamic version indexing in tag name based on type (#7202) ( 18758e3a )
dependency: update bc version from 1.77 to 1.81 (#7211) ( c051f965 )
deps: bump sha.js from 2.4.11 to 2.4.12 in /deck (#7213) ( 0c97ecd1 )
deps: bump tmp from 0.2.3 to 0.2.5 in /deck/test/functional (#7231) ( de171bc4 )
deps: bump tmp in /.github/actions/spinnaker-release (#7229) ( da68ba66 )
graphql: Remove unused and legacy graphql libraries and sample endpoints (#7244) ( fe879f8b )
kubernetes: convert load balancer details component to react (#7222) ( c42106e7 )
kubernetes: convert manifest actions modal components to react (#7223) ( e0801020 )
kubernetes: de-angularize services, and components (#7228) ( e5a54ada )

Changelogs: Spinnaker Release 2025.1.4

Wed, 03 Sep 2025 19:09:12 +0000

Breaking Changes

Features

Configuration

Fixes

gcp: More NPE handling on some input (#7236) (#7237) ( 347cfb20 )

Other

Changelogs: Spinnaker Release 2025.1.3

Tue, 02 Sep 2025 17:09:52 +0000

Breaking Changes

Features

Configuration

Fixes

gate/web: add Retrofit2SyncCall.execute to SubnetController.allByCloudProvider (#7219) (#7221) ( 9b5dcd7b )
gcp: Fix a number of potential NPEs around deploy handling for google builds. Tied to groovy to java migration (#7227) (#7233) ( 4ea0d508 )
halyard/retrofit2: fix DaemonService’s convertor factory (#7230) (#7232) ( 66ade3f8 )
orca/retrofit2: fix orca bakeservice api (#7224) (#7225) ( e0a64b30 )

Other

Changelogs: Spinnaker Release 2025.0.8

Fri, 22 Aug 2025 17:08:38 +0000

Breaking Changes

Features

Configuration

Fixes

gate/web: add Retrofit2SyncCall.execute to SubnetController.allByCloudProvider (#7219) (#7220) ( 27179ec2 )

Other

Changelogs: Spinnaker Release 2025.1.2

Thu, 21 Aug 2025 20:08:00 +0000

Breaking Changes

Features

Configuration

Fixes

clouddriver/aws: align CredentialsParser types in AmazonCredentialsInitializer (#7207) (#7208) ( 3c45b4c9 )
echo/rest: make it possible to send events to URLs with no trailing slash (#7212) (#7215) ( 824acc94 )
google: Add retry and status polling logic (#7191) (#7217) ( b1243f81 )
halyard/retrofit2: fix daemon service getTask API definition (#7206) (#7209) ( a75b383c )

Other

Changelogs: Spinnaker Release 2025.0.7

Thu, 21 Aug 2025 18:08:04 +0000

Breaking Changes

Features

Configuration

Fixes

echo/rest: make it possible to send events to URLs with no trailing slash (#7212) (#7214) ( dd7714d9 )
echo/retrofit2: fix the handling of responses from APIs of GoogleChat and Slack (#7175) (#7181) ( 1ff8e285 )
keel: add executor pool for asynchronous requests (#7190) (#7194) ( 057df0d4 )
orca/retrofit: replace RetrofitError with SpinnakerServerException in orca.yml to add automatic retries to API calls that might fail transiently. (#7180) (#7182) ( 41d8bd3a )

Other

Changelogs: Spinnaker Release 2025.1.1

Tue, 19 Aug 2025 21:08:45 +0000

Breaking Changes

Features

Configuration

Fixes

orca/clouddriver: correct parameter order for requestOperations to avoid invalid cloudProvider errors (#7201) (#7204) ( 7f6e3e2f )

Other

Changelogs: Spinnaker Release 2025.1.0

Tue, 19 Aug 2025 18:08:49 +0000

Changelog

Breaking Changes

https://github.com/spinnaker/spinnaker/pull/7173 removed retrofit1 from Spinnaker. Specifically, spinnaker-dependencies no longer refers to com.squareup.retrofit:retrofit:1.9.0 (and some other related jars as well). Plugins or custom code that depend on this need to add their own dependencies or upgrade to retrofit2.

Helm OCI Registry Chart Support

Docker registry provider now supports adding OCI-based registries hosting Helm repositories. This feature allows users to download and bake Helm charts hosted in OCI-compliant registries (such as Docker Hub).

Related PRs:

To enable the Helm OCI support in a Docker Registry account set a list of OCI repositories in the helmOciRepositories of the Docker Registry account configuration. The helmOciRepositories is a list of repository names in the format <registry>/<repository>. For example:

dockerRegistry:
  enabled: true
  primaryAccount: dockerhub   # Must be one of the configured docker accounts
  accounts:
    - name: dockerhub
      requiredGroupMembership: []
      providerVersion: V1
      permissions: {}
      address: https://index.docker.io  # (Required). The registry address you want to pull and deploy images from; e.g. https://index.docker.io
      username: <username>   # Your docker registry email (often this only needs to be well-formed, rather than be a real address)
      password: <password>
      cacheIntervalSeconds: 30          # (Default: 30). How many seconds elapse between polling your docker registry.
      clientTimeoutMillis: 60000        # (Default: 60000). Timeout time in milliseconds for this repository.
      cacheThreads: 1                   # (Default: 1). How many threads to cache all provided repos on. Really only useful if you have a ton of repos.
      paginateSize: 100                 # (Default: 100). Paginate size for the docker repository _catalog endpoint.
      sortTagsByDate: false             # (Default: false). Sort tags by creation date.
      trackDigests: false               # (Default: false). Track digest changes. This is not recommended as it consumes a high QPM, and most registries are flaky.
      insecureRegistry: false           # (Default: false). Treat the docker registry as insecure (don’t validate the ssl cert).
      repositories:
        - "registry/repository"         # (Default: []). An optional list of repositories to cache Docker images from. If not provided, Spinnaker will attempt to read accessible repositories from the registries _catalog endpoint
      helmOciRepositories:
        - "registry/HelmOciRepository" # (Default: []). An optional list of Helm OCI-Based repositories to cache helm charts from.

For every account with non-empty helmOciRepositories list, Clouddriver will cache the Helm charts from the specified OCI repositories.

The cached Helm OCI charts are defined as a new Artifact type named helm/image and can be used to bake Helm OCI-based charts in Spinnaker pipelines.

Defining retention policy for downloaded helm/image charts in Clouddriver

Optionally, users can define a retention policy for Helm OCI charts downloaded in a Clouddriver instance. This functionality is disabled by default and it is useful for users that want to keep a local copy of a Helm OCI based chart without the need to download it every time it is used in a pipeline. The retention policy is defined in the clouddriver-local.yml configuration file:

artifacts:
   helm-oci:
    clone-retention-minutes: 60
    clone-retention-max-bytes: 104857600 # 100MB

clone-retention-minutes: Default: 0. How much time to keep the downloaded helm/image chart. Values are:
- 0: no retention.
- -1: retain forever.
- any whole number of minutes, such as 60.
clone-retention-max-bytes: Default: 104857600 (100 MB). Maximum amount of disk space to use for downloaded helm/image charts. When the maximum amount of space is reached, Clouddriver deletes the clones after returning the artifact to the pipeline, just as if retention were disabled.

Defining Triggers for helm/image artifacts in Spinnaker pipelines

To trigger a Spinnaker pipeline on a new version of a Helm OCI-based chart, users will need to enable the Igor poller for the helm/image artifact type. This can be done by adding the following configuration to the igor-local.yml file:

helm-oci-docker-registry:
  enabled: true

Additionally, a new trigger type (named helm/oci) has been implemented to allow pipelines to be triggered by new versions of helm/image artifacts.

  "triggers": [
    {
      "account": "<accountName>",
      "enabled": true,
      "organization": "<org>",
      "registry": "index.docker.io",
      "repository": "org/repositoryName",
      "type": "helm/oci"
    }
  ],

Gate

https://github.com/spinnaker/spinnaker/pull/7109 added a gate-header module to gate that provides what’s known as header authentication. It’s meant for scenarios where something external to gate it providing “real” authentication via mTLS or similar, as it’s very permissive. When header.enabled is true (false by default), gate requires an X-SPINNAKER-USER header on incoming http requests, and uses the value of that header as the username/email. Gate logs in to fiat and queries fiat for allowed accounts. Again, any incoming request can specify an arbitrary value for X-SPINNAKER-USER and gate-header uses it.

https://github.com/spinnaker/spinnaker/pull/7120 added ProvidedIdRequestFilter and these new configuration properties and their defaults:

provided-id-request-filter:
  enabled: false
  headers:
    - X-SPINNAKER-REQUEST-ID
    - X-SPINNAKER-EXECUTION-ID
  additionalHeaders: [] # empty list

ProvidedIdRequestFilter puts headers from incoming requests into the MDC which improves logging in gate. As well, those values are used in outgoing http requests that gate makes (e.g. to fiat during authentication), as opposed to auto-generated ones when they’re not present. This makes it easier to trace requests through Spinnaker.

Retrofit2 Upgrade

Retrofit1 clients from the following spinnaker services have been upgraded to retrofit2. With this release, retrofit2 upgrade of all spinnaker services is completed.

Orca: https://github.com/spinnaker/spinnaker/pull/7085
Kayenta: https://github.com/spinnaker/spinnaker/pull/7093
Halyard: https://github.com/spinnaker/spinnaker/pull/7098

A new CallAdapter named LegacySignatureCallAdapter has been introduced in Kork to provide support for legacy Retrofit method signatures. This adapter enables the use of Retrofit interfaces that do not return Call<..>, similar to how Retrofit 1 worked. Both Kayenta and Halyard leveraged this feature during their Retrofit 2 upgrades, allowing them to maintain their existing method signatures without wrapping them in Call<..> or using Retrofit2SyncCall.execute()

https://github.com/spinnaker/spinnaker/pull/7088

Orca

https://github.com/spinnaker/spinnaker/pull/7164 adds root id to the pipeline execution context. Code outside of Spinnaker that processes executions may need adjusting to handle the additional field.

https://github.com/spinnaker/spinnaker/pull/7168 adds some new mechanisms to webhook stages:

If webhook.requireAccount is true (it defaults to false), and the account property is not present (i.e. a non-empty string), the stage stage fails.
if webhook.validateAcount is true (it defaults to false), and an account property is present, call clouddriver’s GET /credentials/{account}/authorized endpoint to validate that the current user has permission to use the account.
A new WebhookAccountProcessorInterface. If a WebhookAccountProcessor bean is present, it has the opportunity to customize the headers in the outgoing http requests that webhook stages make.

https://github.com/spinnaker/spinnaker/pull/7171 introduces regex support to the webhook allow list. Before this, an allow list entry like:

  allowedRequests:
    - httpMethods:
      - GET
      urlPrefix: https://myurl:<port>/some/path

implied a “starts with” matching strategy. Matching strategy still defaults to STARTS_WITH, but PATTERN_MATCHES is also a valid value. For example:

  allowedRequests:
    - httpMethods:
      - GET
      matchStrategy: STARTS_WITH
      urlPrefix: https://myurl:port/some/path
    - httpMethods:
      - GET
      - POST
      matchStrategy: PATTERN_MATCHES
      urlPattern: https://myhost[0-9]+.mycompany/some/path.*

Note: specify urlPrefix with STARTS_WITH, and urlPattern with PATTERN_MATCHES

https://github.com/spinnaker/spinnaker/pull/7172 adds a new safeToRetry property (default false) to webhook allow list entries. Before this, CreateWebhookTask (the “initial” part of a webhook stage) would retry SocketTimeoutException only for GET requests. Now, it also retries other request methods (e.g. PUT, POST, etc.) if safeToRetry is true in the relevant allow list entry.

https://github.com/spinnaker/spinnaker/pull/7178 adds two new boolean properties that default ot false.

webhook:
  eventLoggingEnabled: false
  eventLoggingVerbose: false

With webhook.eventLoggingEnabled true, and eventLoggingVerbose false, WebhookLoggingEventListener logs messages like:

2025-07-31 06:45:52.824  INFO 17273 --- [    Test worker] c.n.s.o.w.u.WebhookLoggingEventListener  : [] [0 ms] callStart: Request{method=GET, url=http://localhost:61843/test, headers=[Accept:text/plain, application/json, application/cbor, application/*+json, */*, Content-Length:0]}
2025-07-31 06:45:52.825  INFO 17273 --- [    Test worker] c.n.s.o.w.u.WebhookLoggingEventListener  : [] [1 ms] requestHeadersEnd
2025-07-31 06:45:52.871  INFO 17273 --- [    Test worker] c.n.s.o.w.u.WebhookLoggingEventListener  : [] [47 ms] responseBodyEnd: byteCount=33
2025-07-31 06:45:52.871  INFO 17273 --- [    Test worker] c.n.s.o.w.u.WebhookLoggingEventListener  : [] [47 ms] callEnd

With eventLoggingVerbose also true, WebhookLoggingEventListener logs messages like:

2025-07-31 06:45:52.890  INFO 17273 --- [    Test worker] c.n.s.o.w.u.WebhookLoggingEventListener  : [] [0 ms] callStart: Request{method=GET, url=http://localhost:61843/test, headers=[Accept:text/plain, application/json, application/cbor, application/*+json, */*, Content-Length:0]}
2025-07-31 06:45:52.890  INFO 17273 --- [    Test worker] c.n.s.o.w.u.WebhookLoggingEventListener  : [] [0 ms] proxySelectStart: http://localhost:61843/
2025-07-31 06:45:52.890  INFO 17273 --- [    Test worker] c.n.s.o.w.u.WebhookLoggingEventListener  : [] [0 ms] proxySelectEnd: [DIRECT]
2025-07-31 06:45:52.890  INFO 17273 --- [    Test worker] c.n.s.o.w.u.WebhookLoggingEventListener  : [] [0 ms] dnsStart: localhost
2025-07-31 06:45:52.890  INFO 17273 --- [    Test worker] c.n.s.o.w.u.WebhookLoggingEventListener  : [] [0 ms] dnsEnd: [localhost/127.0.0.1, localhost/0:0:0:0:0:0:0:1]
2025-07-31 06:45:52.890  INFO 17273 --- [    Test worker] c.n.s.o.w.u.WebhookLoggingEventListener  : [] [0 ms] connectStart: localhost/127.0.0.1:61843 DIRECT
2025-07-31 06:45:52.890  INFO 17273 --- [    Test worker] c.n.s.o.w.u.WebhookLoggingEventListener  : [] [0 ms] connectEnd: http/1.1
2025-07-31 06:45:52.890  INFO 17273 --- [    Test worker] c.n.s.o.w.u.WebhookLoggingEventListener  : [] [0 ms] connectionAcquired: Connection{localhost:61843, proxy=DIRECT hostAddress=localhost/127.0.0.1:61843 cipherSuite=none protocol=http/1.1}
2025-07-31 06:45:52.890  INFO 17273 --- [    Test worker] c.n.s.o.w.u.WebhookLoggingEventListener  : [] [0 ms] requestHeadersStart
2025-07-31 06:45:52.890  INFO 17273 --- [    Test worker] c.n.s.o.w.u.WebhookLoggingEventListener  : [] [0 ms] requestHeadersEnd
2025-07-31 06:45:52.891  INFO 17273 --- [    Test worker] c.n.s.o.w.u.WebhookLoggingEventListener  : [] [1 ms] responseHeadersStart
2025-07-31 06:45:52.891  INFO 17273 --- [    Test worker] c.n.s.o.w.u.WebhookLoggingEventListener  : [] [1 ms] responseHeadersEnd: Response{protocol=http/1.1, code=200, message=OK, url=http://localhost:61843/test}
2025-07-31 06:45:52.892  INFO 17273 --- [    Test worker] c.n.s.o.w.u.WebhookLoggingEventListener  : [] [1 ms] responseBodyStart
2025-07-31 06:45:52.892  INFO 17273 --- [    Test worker] c.n.s.o.w.u.WebhookLoggingEventListener  : [] [2 ms] responseBodyEnd: byteCount=33
2025-07-31 06:45:52.892  INFO 17273 --- [    Test worker] c.n.s.o.w.u.WebhookLoggingEventListener  : [] [2 ms] connectionReleased
2025-07-31 06:45:52.892  INFO 17273 --- [    Test worker] c.n.s.o.w.u.WebhookLoggingEventListener  : [] [2 ms] callEnd

https://github.com/spinnaker/spinnaker/pull/7179 teaches Spinnaker to (when enabled), plumb http request headers that arrive at gate all the way through to headers in outgoing http requests that webhook stages make using the following new orca configuration properties and their defaults. Note, ProvidedIdRequestFilter has the same configuration properties in orca as it does in gate.

provided-id-request-filter:
  enabled: false
  headers:
    - X-SPINNAKER-REQUEST-ID
    - X-SPINNAKER-EXECUTION-ID
  additionalHeaders: [] # empty list

webhook:
  includeAdditionalHeaders: false

To get additional headers in outgoing http requests in webhook stages, enable ProvidedIdRequestFilter configure provided-id-request-filter.additionalHeaders the same in both gate and orca. Set webhook.includeAdditionalHeaders to true in orca, and then provide the configured additional headers in the http requests to gate that initate a pipeline execution. Those headers make it through gate, to orca, into the pipeline execution context in a new additionalHeaders property, and then into webhook stages, and their outgoing http requests.

Clouddriver

https://github.com/spinnaker/spinnaker/pull/7185 adds a way to prevent caching agents from starting until clouddriver is healthy, when using ClusteredAgentScheduler.

This can resolve issues at startup where clouddriver is so busy processing accounts that startup/readiness/liveness probes fail. The following configuration properties and their defaults control this behavior:

clustered:
  agent:
    scheduler:
      wait-on-health-check-enabled: false
      wait-time-after-successful-health-check-seconds: 75

Note: ClusteredAgentScheduler uses redis as its backing store. The store for data that caching agents collect is independent of this.

https://github.com/spinnaker/spinnaker/pull/7187 adds support for multiple managing accounts. There’s a talk about this ( slides ). There’s a new configuration flag to enable this (defaults to false):

aws:
  loadAccounts:
    useManagingAccountProfile: true

If enabled, the new managingAccountProfile property of AWS accounts specifies the profile to use.

AWS doesn’t support assuming a role across partitions. So, before this PR, Spinnaker needed to run in the same partition as the accounts it targets. With this PR, it’s now possible for one Spinnaker instance to target multiple partitions.

Features

aws: add to a new counter metric named aws.discardedImages (#7192) ( 601c277b )
change: feat: Add kubernetes functional tests ( 2a94d045 )
clouddriver/aws: support multiple managing accounts (#7187) ( c81cfb41 )
clouddriver/cats: delay caching agents until after startup (#7185) ( 094886ac )
core: add rootId to PipelineExecution (#7164) ( 36ebf880 )
fiat/google-groups: expand indirect google groups for emails (#1213) ( 25404916 )
header: don’t create nor use sessions with header auth (#7121) ( 6d1ee269 )
header: new module for authenticating based on the X-SPINNAKER-USER header (#7109) ( 3b10e2fc )
helm/image: Adding clouddriver-docker implementation for helm/image caching agents and lookup controller ( 6947824d )
helm/image: Adding clouddriver-docker implementation for helm/image caching agents and lookup controller ( ca10bac6 )
helm/image: Adding clouddriver-docker implementation for helm/image caching agents and lookup controller ( f499a9bd )
helm/image: Adding clouddriver-docker tests for helm/image caching agents and lookup controller ( e1d51861 )
helm/image: Adding controller test for multiple level repository name ( b7dc9c31 )
helm/image: Adding kork-docker extracting functionality from clouddriver-docker (#7069) ( 1fdc9bc0 )
helm/image: Adding note for future refactoring on duplicate account properties ( a1233335 )
helm/image: Adding rosco and deck support for helm/image artifacts ( 10baee37 )
helm/image: Adding support for automatic triggers on the new artifact type helm/image ( f0d8662e )
helm/image: Adding support for automatic triggers on the new artifact type helm/image - deck lint fix ( 0c443431 )
helm/image: Adding support for automatic triggers on the new artifact type helm/image - migrate groovy ( 9449fbda )
helm/image: Adding support for helm/image chart artifacts ( f9d312ac )
helm/image: Automatic triggers for Helm/image artifacts - classes rename and optimisations ( 83589bfb )
helm/image: Implementing AbstractArtifactCachedFileSystem and tests ( d3d4c7ed )
kayenta: adding outlierStrategy field in metric config modal ( 0cf3148a )
kayenta: enable using template for Datadog metric store (#7056) ( 47f85652 )
kayenta: expose mustHaveData checkbox in canary metric config modal (#7063) ( 243d98d5 )
orca/webhook: add account property to webhook stages and introduce WebhookAccountProcessor interface (#7168) ( 32649bce )
orca/webhook: add regex pattern matching to the webhook allow list (#7171) ( 23627333 )
orca: plumb additional headers from incoming requests into webhook stages (#7179) ( de7a124a )
plugins: Log output of the version requirements when a mismatch occurs and plugin loading information (#7196) ( 8b5c743e )
retrofit2: Add CallAdapter for legacy Retrofit signatures (#7088) (#7155) ( eced8bbe )
retrofit2: Add CallAdapter for legacy Retrofit signatures (#7088) ( 1516f8d0 )
webhook: add new webhook allow list property safeToRetry (#7172) ( 43e42394 )
webhook: add webhook.eventLoggingEnabled and webhook.eventLoggingVerbose properties (#7178) ( 6127d7b5 )

Configuration

Fixes

GHA: update cache GHA used in ci to latest (v4) (#629) ( 63c49b54 )
build: Enable publishing for Gradle plugins (#7122) (#7128) ( 5e58dc70 )
build: Enable publishing for Gradle plugins (#7122) ( ec096c9b )
build: Fix BoM generation against release tags (#7081) (#7083) ( 0a75021d )
build: Fix BoM generation against release tags (#7081) ( a26582ee )
build: Fix previous-version changelog arg, filter changelog commits (#7045) (#7046) ( 03a3c471 )
build: Fix previous-version changelog arg, filter changelog commits (#7045) ( 6aa5729d )
build: Limit versions.yml to three releases, and collapse patch versions (#7086) (#7087) ( 168f447a )
build: Limit versions.yml to three releases, and collapse patch versions (#7086) ( b2f481e4 )
build: Plumb NPM token, skip spotless hooks when rewriting package.json (#7043) (#7044) ( 5b14f932 )
build: Plumb NPM token, skip spotless hooks when rewriting package.json (#7043) ( f0d8dae2 )
build: Publish debs on release (#7091) (#7092) ( 75c5e544 )
build: Publish debs on release (#7091) ( 0d1ba306 )
build: Update top-level versions.yml metadata if release is newest (#7080) (#7082) ( fe9ebe5e )
build: Update top-level versions.yml metadata if release is newest (#7080) ( 6c3cd4eb )
changelog: Use proper seconds date format (#7047) (#7048) ( 29bca907 )
changelog: Use proper seconds date format (#7047) ( 4dbd2ce2 )
clouddriver/aws: fix corner cases in AmazonNamedImageLookupController (#7188) ( bd4875f6 )
clouddriver: replace cast to Moniker in JobUtils.cancelWait ( 1f93847f )
config: fix the issue of halyard failing to add docker registry account (#7066) (#7068) ( 0d5a0591 )
config: fix the issue of halyard failing to add docker registry account (#7066) ( 7a2bf022 )
core/pipeline: prevent duplicate executions in UI when combining filters (#7097) ( 22db793b )
core: Always use clusters parameter for ECS server group URLs (#10171) ( 3f2418ea )
docker: fix missing slash issue of docker registry client’s base url (#7110) ( f5c9edb3 )
docker: fix missing slash issue of docker registry client’s base url (backport #7110) (#7111) ( 9151b959 )
docker: fix the issue of fetching docker images (#7073) (#7074) ( 4f9ba539 )
docker: fix the issue of fetching docker images (#7073) ( 93ea3ff5 )
echo/retrofit2: fix the handling of responses from APIs of GoogleChat and Slack (#7175) ( 450ea3f6 )
front50/korkversion: remove older duplicate entry of korkVersion (#7124) ( b179f4ec )
googlechat: fix googlechat encoding issue (#7165) (#7166) ( e0ca3882 )
googlechat: fix googlechat encoding issue (#7165) ( 313fa6d4 )
igor-web: fix Jenkins job’s build response handling issue (#7105) (#7107) ( f65eb2c4 )
igor-web: fix Jenkins job’s build response handling issue (#7105) ( 993b01c9 )
keel: add executor pool for asynchronous requests (#7190) ( 93b87572 )
logs: Fix log message formatting - likely gorovy to java miss (#7199) ( 23082706 )
notifications: Prevent duplicate notifications for Manual Judgment stages (#1506) ( 989e20b5 )
ops: fix Groovy missing property on retry of failed operation (#7112) ( 250f5955 )
orca/retrofit2: error @Param must not come after @Query (#7198) ( a3c4ed5f )
orca/retrofit2: fix path and query params order issue (#7183) ( 3574bbeb )
orca/retrofit2: fix wildcard in parameter type in echo’s retrofit2 client’s api interface method (#7189) ( e4b1ebc6 )
orca/retrofit: replace RetrofitError with SpinnakerServerException in orca.yml to add automatic retries to API calls that might fail transiently. (#7180) ( ebb54afb )
pipelineTemplateList: Only pass scopes if explicitly provided (#7116) ( 7973e0c2 )
publishing: Write all versions to Maven metadata (#7126) (#7127) ( c1b4d73d )
publishing: Write all versions to Maven metadata (#7126) ( f12a946a )
rest: fix the retrofit2 error messages coming in the test logs of RestEventListenerTest (#7055) (#7058) ( 081cd201 )
rest: fix the retrofit2 error messages coming in the test logs of RestEventListenerTest (#7055) ( ff4c04b5 )
retrofit1: remove the retrofit1 code (#7173) ( 48a43bd0 )
retrofit2: fix a broken scenario related to LegacySignatureCallAdapter (#7131) ( bf302616 )
retrofit2: fix a broken scenario related to LegacySignatureCallAdapter (backport #7131) (#7135) ( 4fb42281 )
retrofit2: fix query param encoding logic to accommodate repeating query params (#7133) (#7134) ( 7252a084 )
retrofit2: fix query param encoding logic to accommodate repeating query params (#7133) ( c1139c9d )
retrofit2: fix the issue of retrofit2 being unable to convert the Event object to RequestBody. (#7060) (#7067) ( 972e36bc )
retrofit2: fix the issue of retrofit2 being unable to convert the Event object to RequestBody. (#7060) ( 6cbd3662 )
retrofit2: remove leading slashes from all the retrofit2 api interfaces (#7159) ( b2f2742b )
retrofit2: remove leading slashes from all the retrofit2 api interfaces (backport #7159) (#7160) ( 450f01e1 )
retrofit: fix retrofit1 client definition in kork (#7130) ( ae505cdc )
saml: Cherry pick saml assertion signing fix from gate repo (#7197) ( 50418dbd )
test: move test file to the right location (#7102) (#7103) ( a991d2d2 )
test: move test file to the right location (#7102) ( 38adb45a )
tests: update failing test due to recent changes in ServerGroups (ReplicaSet) ( 5489344e )
web: add ProvidedIdRequestFilter (#7120) ( 7301a98f )
web: fix HelmConverterFactory for deserialization error (#7077) (#7079) ( 4cf4d420 )
web: fix HelmConverterFactory for deserialization error (#7077) ( 0b6dc0d2 )

Other

build: Migrate from OSSRH to Central Portal (#7114) (#7123) ( 745c1e81 )
build: Migrate from OSSRH to Central Portal (#7114) ( 9b22488a )
build: dynamic version indexing in tag name based on type (#7202) (#7203) ( e9d8ebc4 )
change: Merge pull request #7071 from spinnaker/auto-merge-main ( de917997 )
change: Merge pull request #7078 from zrashwani/feat/kayenta-outlier-strategy-field ( 8a7f05de )
change: Merge pull request #7089 from christosarvanitis/feat/helmOciArtifacts ( 9ffb48b9 )
change: Merge pull request #7113 from christosarvanitis/feat/HelmArtifactsTriggers ( db3c0044 )
change: Merge pull request #7119 from dbyron-sf/jobutils-cancelwait ( 0860bfa4 )
change: Merge pull request #7132 from spinnaker/dependabot/github_actions/gatsbyjs/stale-1.1.0 ( a5e2896c )
change: Merge pull request #7140 from dbyron-sf/run-when-k8s-integration-tests-when-workflow-is-modified ( cca49629 )
change: Merge pull request #7156 from dbyron-sf/run-clouddriver-integration-tests-when-dependent-libs-change ( ef408f08 )
change: Merge pull request #7161 from cristhian-castaneda/refactor/reactify-infrastructure-servergroup-details ( 69f494f5 )
change: Merge pull request #7176 from cristhian-castaneda/test/add_kubernetes_functional_tests ( daf3c051 )
change: Remove unused CI GHA from monorepo merge ( 658a47c0 )
clouddriver/aws: specify a region when querying for aws images (#7193) ( 5caf9a3d )
clouddriver/kubernetes: test against a 1.30.13 k8s cluster (#7139) (#7141) ( abe2528f )
clouddriver/kubernetes: test against a 1.30.13 k8s cluster (#7139) ( a88b213b )
clouddriver/kubernetes: upgrade kind to 0.29.0 (#7138) (#7142) ( 8c463a59 )
clouddriver/kubernetes: upgrade kind to 0.29.0 (#7138) ( 3d468c62 )
clouddriver: demonstrate that JobUtils.cancelWait fails ( a8046076 )
clouddriver: give the jvm 8g when compiling (#7195) ( 32494157 )
core: upgrade to Node.js 20.x (#7177) ( 6521da25 )
core: upgrade to TypeScript 5.x (#7061) ( dd732fbd )
dependency: bump tomcat from 9.0.83 to 9.0.107 (#7154) ( a5c65ed5 )
deps: bump form-data in /.github/actions/spinnaker-release (#7169) ( bff84855 )
deps: bump gatsbyjs/stale from 0.1.0 to 1.1.0 (#7023) ( 679ca776 )
deps: bump gatsbyjs/stale from 0.1.0 to 1.1.0 (#7023)" (#7100) ( 504a916b )
deps: bump gatsbyjs/stale from 0.1.0 to 1.1.0 ( bfe45801 )
deps: bump golangci/golangci-lint-action from 7 to 8 (#7094) ( 3bcf1dea )
deps: bump pbkdf2 from 3.1.2 to 3.1.3 in /deck (#7117) ( df936003 )
deps: bump undici in /.github/actions/spinnaker-release (#7084) ( cd040ee3 )
deps: bump undici in /.github/actions/update-monorepo (#7075) ( ba273657 )
front50/retrofit2: upgrade the lone EchoService interface to retrofit2 in front50 (#7151) (#7153) ( fb781906 )
front50/retrofit2: upgrade the lone EchoService interface to retrofit2 in front50 (#7151) ( 2b513742 )
gha: run clouddriver integration tests when kork or fiat change ( eedb67e3 )
gha: run clouddriver integration tests when kork or fiat change (backport #7156) (#7158) ( 14c9e06e )
gha: run clouddriver integration tests when the github workflow changes ( 5b9daa55 )
gha: run clouddriver k8s integration tests when the workflow is modified (#7157) ( b5de0d40 )
gha: run clouddriver k8s integration tests when the workflow is modified ( d0a9f0c7 )
kubernetes: convert server group details component to react ( 9af7b05e )
kubernetes: convert server group manager details component to react (#7184) ( 80e8490c )
mergify: upgrade configuration to current format (#7040) ( db0f37c9 )
orca: restore changes from https://github.com/spinnaker/orca/pull/4566 (#7167) ( c3b5f6b5 )
projects: convert projects component to react (#7200) ( ffe16cd3 )
retrofit2/test: remove unused code (#7129) ( f35e1484 )
retrofit2: Upgrade retrofit clients to retrofit2 in Kayenta (#7093) ( 932cfbc5 )
retrofit2: update retrofit1 clients to retrofit2 (#7098) ( dca52e68 )
retrofit2: upgrade all retrofit clients to retrofit2 in Orca (#7085) ( 525ff2be )
test/functional: upgrade cypress (#7062) ( bca54be2 )
test: adjust test code to execute on arm (#7049) ( bb256d4c )

Changelogs: Spinnaker Release 1.36.3

Fri, 15 Aug 2025 18:14:37 +0000

Clouddriver 5.90.5

The primary change here is a configuration (defaulted to true) that instead of immediately moving on after a deploy operation instead polls for task completion of the operation. There is a case where Google will not complete the operation or even fail the operation and instead of detecting this, spinnaker would go to the next task and fail. See issue 7170 for more information.

This WILL add some extra time on deployments and the legacy behavior can be disabled via a configuration property documented in the enableAsyncOperationWait PR.

Fixes

builds: Fixes upload URLs for releases ( 0568f3c4 )
google: Add retry and status polling logic ( 21102ec6 )

Other

google: Add retry and status polling logic for autoscalers and backend services ( 21102ec6 )
google: Added enableAsyncOperationWait=true flag for legacy behaviour ( 21102ec6 )
google: Log enableAsyncOperationWait flag warning just once ( 21102ec6 )

Changelogs: Spinnaker Release 2025.0.6

Thu, 24 Jul 2025 22:07:53 +0000

Breaking Changes

Features

retrofit2: Add CallAdapter for legacy Retrofit signatures (#7088) (#7155) ( eced8bbe )

Configuration

Fixes

googlechat: fix googlechat encoding issue (#7165) (#7166) ( e0ca3882 )
retrofit2: fix a broken scenario related to LegacySignatureCallAdapter (backport #7131) (#7135) ( 4fb42281 )
retrofit2: remove leading slashes from all the retrofit2 api interfaces (backport #7159) (#7160) ( 450f01e1 )
retrofit: fix retrofit1 client definition in kork (#7130) ( ae505cdc )

Other

front50/retrofit2: upgrade the lone EchoService interface to retrofit2 in front50 (#7151) (#7153) ( fb781906 )
gha: run clouddriver integration tests when kork or fiat change (backport #7156) (#7158) ( 14c9e06e )
gha: run clouddriver k8s integration tests when the workflow is modified (#7157) ( b5de0d40 )

Changelogs: Spinnaker Release 2025.0.5

Tue, 15 Jul 2025 19:07:50 +0000

Breaking Changes

Features

Configuration

Fixes

build: Enable publishing for Gradle plugins (#7122) (#7128) ( 5e58dc70 )
publishing: Write all versions to Maven metadata (#7126) (#7127) ( c1b4d73d )
retrofit2: fix query param encoding logic to accommodate repeating query params (#7133) (#7134) ( 7252a084 )

Other

build: Migrate from OSSRH to Central Portal (#7114) (#7123) ( 745c1e81 )
clouddriver/kubernetes: test against a 1.30.13 k8s cluster (#7139) (#7141) ( abe2528f )
clouddriver/kubernetes: upgrade kind to 0.29.0 (#7138) (#7142) ( 8c463a59 )

Changelogs: Spinnaker Release 2025.0.4

Mon, 16 Jun 2025 21:06:26 +0000

Breaking Changes

Features

Configuration

Fixes

docker: fix missing slash issue of docker registry client’s base url (backport #7110) (#7111) ( 9151b959 )
igor-web: fix Jenkins job’s build response handling issue (#7105) (#7107) ( f65eb2c4 )
test: move test file to the right location (#7102) (#7103) ( a991d2d2 )

Other

Changelogs: Spinnaker Release 2025.0.3

Sat, 24 May 2025 14:05:08 +0000

Breaking Changes

Features

Configuration

Fixes

build: Fix BoM generation against release tags (#7081) (#7083) ( 0a75021d )
build: Limit versions.yml to three releases, and collapse patch versions (#7086) (#7087) ( 168f447a )
build: Publish debs on release (#7091) (#7092) ( 75c5e544 )
build: Update top-level versions.yml metadata if release is newest (#7080) (#7082) ( fe9ebe5e )

Other

Changelogs: Spinnaker Release 1.36.2

Thu, 22 May 2025 18:13:27 +0000

Clouddriver 5.90.2

Fixes

aws: Launch template version of ASG default to when not defined (#6373) ( 3984ca5a )
clouddriver-google: Fix logic when Instance Types are available only in selected Zones/Regions - manual backport ( 482dda72 )
clouddriver-google: Fix logic when Instance Types are available only in selected Zones/Regions - manual backport ( 482dda72 )
clouddriver-google: Fix logic when Instance Types are available only in selected Zones/Regions ( 482dda72 )
ecs: evaluate targetgroup healthcheck in instance healthcheck (#6307) ( c8c9d4c8 )
ecs: include healthcheck status from targetgroups in instance healthcheck ( c8c9d4c8 )
ecs: check null for loadBalancer attribute ( c8c9d4c8 )
ecs: evaluate TargetHealth check if container deployed does have target groups associated ( c8c9d4c8 )

Other

dependencies: Autobump fiatVersion ( 1730ad7c )
dependencies: Autobump korkVersion ( 0c7cff1d )
ecs: add tests for default behavior and targetgroup healthchecks ( c8c9d4c8 )
ecs: improve testing and use targetHealth to determine status only if containerHealthcheck is UNKNOWN ( c8c9d4c8 )

Deck 3.19.2

Fixes

core: Always use clusters parameter for ECS server group URLs (#10171) ( 127fa906 )
core: Always use clusters parameter for ECS server group URLs ( 127fa906 )
core: Extend server group URL fix to handle both ECS and AWS providers ( 127fa906 )
gcp: fixing existing test + adding one test and updating credentials.json (#10166) ( 1b8f60af )

Echo 2.43.3

Fixes

notifications: Prevent duplicate notifications for Manual Judgment stages (#1506) ( 0dbf85c0 )

Other

dependencies: Autobump fiatVersion ( babe7819 )
dependencies: Autobump korkVersion ( 4fefb47d )

Fiat 1.51.2

Other

dependencies: Autobump korkVersion ( 6c46d685 )

Front50 2.37.2

Other

dependencies: Autobump fiatVersion ( 3325d3cd )
dependencies: Autobump korkVersion ( 6b38756d )

Gate 6.64.2

Fixes

saml: With the upgrade to spring saml off of the DSL signing saml requests were broken. This restores that capability (#1898) ( e551157a )
swagger: ensure byteArrayHttpMessageConverter is the first converter to render swagger UI (#1865) ( 251d2505 )
swagger: ensure byteArrayHttpMessageConverter is the first converter to render swagger UI ( 251d2505 )

Other

dependencies: Autobump fiatVersion ( 938d70eb )
dependencies: Autobump korkVersion ( ff320db1 )
swagger: add test for swagger openapi migration ( 251d2505 )
swagger: refactor fix and rename swagger test ( 251d2505 )

Igor 4.18.2

Other

dependencies: Autobump fiatVersion ( c23e997b )
dependencies: Autobump korkVersion ( 992af5a9 )

Kayenta 2.42.2

Other

dependencies: Autobump orcaVersion ( 6b6a9dde )

Orca 8.57.2

Other

dependencies: Autobump fiatVersion ( 5f3b9f44 )
dependencies: Autobump korkVersion ( 321513c2 )

Rosco 1.22.2

Fixes

install: Fixed packer version check for packer installation (#1121) ( 469879dc )

Other

dependencies: Autobump korkVersion ( dbaeacd4 )

Changelogs: Spinnaker Release 2025.0.2

Sat, 17 May 2025 07:05:53 +0000

Breaking Changes

Features

Configuration

Fixes

web: fix HelmConverterFactory for deserialization error (#7077) (#7079) ( 4cf4d420 )

Other

Changelogs: Spinnaker Release 2025.0.1

Mon, 12 May 2025 20:05:16 +0000

Breaking Changes

Features

Configuration

Fixes

build: Fix previous-version changelog arg, filter changelog commits (#7045) (#7046) ( 03a3c471 )
changelog: Use proper seconds date format (#7047) (#7048) ( 29bca907 )
config: fix the issue of halyard failing to add docker registry account (#7066) (#7068) ( 0d5a0591 )
docker: fix the issue of fetching docker images (#7073) (#7074) ( 4f9ba539 )
rest: fix the retrofit2 error messages coming in the test logs of RestEventListenerTest (#7055) (#7058) ( 081cd201 )
retrofit2: fix the issue of retrofit2 being unable to convert the Event object to RequestBody. (#7060) (#7067) ( 972e36bc )

Other

Changelogs: Spinnaker Release 1.37.11

Mon, 12 May 2025 19:46:56 +0000

Clouddriver 5.91.7

Fixes

docker: fix the issue of fetching docker images ( e8f7a1aa )
docker: fix the issue of fetching docker images due to java.lang.ArrayIndexOutOfBoundsException: Index 1 out of bounds for length 1 ( e8f7a1aa )

Other

docker: add a test to demonstrate the issue of fetching docker images due to java.lang.ArrayIndexOutOfBoundsException: Index 1 out of bounds for length 1 ( e8f7a1aa )

Igor 4.19.3

Fixes

jenkins: fix the issue of Retrofit2EncodeCorrectionInterceptor getting added to Jenkins retrofit1 client ( 840fdb61 )
jenkins: fix the issue of Retrofit2EncodeCorrectionInterceptor getting added to retrofit1 client of JenkinsClient. ( 840fdb61 )
jenkins: address review comments ( 840fdb61 )

Other

jenkins: add a test to demonstrate the issue of Retrofit2EncodeCorrectionInterceptor getting added to retrofit1 client of JenkinsClient ( 840fdb61 )
jenkins: Convert JenkinsClientSpec groovy test to java ( 840fdb61 )

Changelogs: Spinnaker Release 2025.0.0

Sat, 19 Apr 2025 02:04:00 +0000

Changelog

Version 2025.0.0 is the first version of Spinnaker released from the monorepo . It’s equivalent to version 1.38.0 which was released using the individual repos.

Changelogs: Spinnaker Release 1.38.0

Fri, 18 Apr 2025 20:26:42 +0000

Changelog

echo

Version 1.31.0 of Spinnaker introduced a feature to filter pipelines from front50 , that was disabled by default. Version 1.35.0 enabled it by default , but we’ve had enough trouble with it, that https://github.com/spinnaker/echo/pull/1503 disables it by default again.

retrofit2 upgrade

All retrofit clients are upgraded to retrofit2 and any references to retrofit1 dependencies are removed in the following services.

Igor - https://github.com/spinnaker/igor/pull/1313

Clouddriver 5.95.0

Fixes

clouddriver-google: Fix logic when Instance Types are available only in selected Zones/Regions ( 6a65adfd )
core/test: add a Retrofit2EncodeCorrectionInterceptor bean ( 70b14c1a )
docker: resolve the issue of Unrecognized field "child" ( 7c4514af )
docker: resolve the issue of Failed to parse ResponseBody : Unrecognized field "child" when google cloud artifact registry responds with additional fields upon invoking tags list api ( 7c4514af )
docker: resolve the issue of double encoding while making the next call to ECR’s tags list ( 06c98c00 )
docker: resolve the issue of double encoding contained in the ECR’s next link header causing the Retrofit2 client to fail due to error code 405 and Message: Method Not Allowed. ( 06c98c00 )
docker: fix retrofit2 docker client which is replacing ? with %3F causing api failure ( 02101899 )
docker: fix the issue of retrofit2 replacing ? with %3F causing api failure with 400 ( 02101899 )
docker: address review comments on the fix to the issue of retrofit2 replacing ? with %3F causing api failure with 400 ( 02101899 )
docker/test: add a Retrofit2EncodeCorrectionInterceptor bean ( 70b14c1a )

Other

cats-sql: actually execute groovy tests ( 23155e5b )
dependencies: Autobump fiatVersion ( 5e0ce2ab )
dependencies: Autobump korkVersion ( 4d80be21 )
dependencies: Autobump fiatVersion ( 06fbc3d5 )
dependencies: Autobump korkVersion ( 3a2356f0 )
dependencies: Autobump fiatVersion ( 5a1709a4 )
dependencies: Autobump korkVersion ( 70b14c1a )
dependencies: Autobump korkVersion ( 70b14c1a )
docker: add a test to demonstrate the issue of Failed to parse ResponseBody : Unrecognized field "child" ( 7c4514af )
docker: add test to demonstrate the issue of double encoding of query parameter when the next link from a docker registry like ECR responds with an encoded url. ( 06c98c00 )
docker: add two test classes, one to demonstrate how real docker registry apis can be accessed using retrofit2 client and another to demonstrate the issue of retrofit2 replacing ? with %3F causing api failure with 400 ( 02101899 )

Deck 3.21.0

Fixes

gcp: fixing existing test + adding one test and updating credentials.json ( 2740ed53 )
pipelineStage: Rendering with a warning with the pipelineParameters are defined as a SpeL expression ( 294e0ed1 )

Echo 2.47.2

Fixes

notifications: fix MicrosoftTeamsConfig which has unused retrofit1 parameters ( 41b18321 )
notifications: add Retrofit2SyncCall.execute to BearychatService in BearychatNotificationService ( 8a2b94af )
notifications: add Retrofit2SyncCall.execute to BearychatService in BearychatNotificationService ( 8a2b94af )
pipelinetriggers: turn off pipeline filtering by default (#1503) ( 38c2df6d )
rest: add Retrofit2SyncCall.execute to RestService in RestEventService ( d3c1833b )
rest: add Retrofit2SyncCall.execute to RestService in RestEventService ( d3c1833b )
retrofit: address remnants of retrofit1 like TypedInput, TypedByteArray etc ( 5132fa85 )
retrofit: address remnants of retrofit1 like TypedInput, TypedByteArray etc ( 5132fa85 )
retrofit2: fix google cloud build notification agent for missing Retrofit2SyncCall.execute call (#1500) ( 7de326a1 )
retrofit2: fix the issue of missing Retrofit2SyncCall.execute call in GoogleCloudBuildNotificationAgent ( 7de326a1 )
retrofit2: fix A @path parameter must not come after a @Query error ( f170364c )
retrofit2: fix A @Path parameter must not come after a @Query error ( f170364c )
retrofit2: fix baseUrl must end in / error ( 19e2f34d )
retrofit2: fix the following error by adding trailing / in the baseUrl and removing leading / in the end point: ( 19e2f34d )
retrofit2: fix RestService by replacing POST mapping from / to . and add a test class to demonstrate the behaviour. ( 19e2f34d )
retrofit2/test: deal with the introduction of Retrofit2EncodeCorrectionInterceptor ( 3b759058 )

Other

core/test: only spin up a wiremock server once in IgorServiceTest ( 5132fa85 )
dependencies: Autobump fiatVersion ( 4c0e2959 )
dependencies: Autobump korkVersion ( c4fac745 )
dependencies: Autobump fiatVersion ( b2fe9a12 )
dependencies: Autobump korkVersion ( 3fb1fd6a )
dependencies: Autobump fiatVersion ( db1889af )
dependencies: Autobump korkVersion ( 3b759058 )
dependencies: Autobump korkVersion ( 3b759058 )
notifications: add a test to demonstrate the missing Retrofit2SyncCall.execute calls in BearychatNotificationService ( 8a2b94af )
rest: add a test to demonstrate that RestEventService.sendEvent is failing to make the RestService.recordEvent api call ( d3c1833b )
retrofit: add a test to demonstrate the issue of passing a TypedInput while using retrofit2 client ( 5132fa85 )
retrofit2: add a test to demonstrate the issue of missing Retrofit2SyncCall.execute call in GoogleCloudBuildNotificationAgent ( 7de326a1 )
retrofit2: add a test to demonstrate the following error: ( f170364c )
retrofit2: add a test to demonstrate the error: java.lang.IllegalArgumentException: baseUrl must end in /. ( 19e2f34d )

Fiat 1.57.0

Fixes

github: fix the error where if the baseUrl of the Github client has multiple slashes and the end point start with a slash, the resultant api url leaves that part the base url coming after first slash. ( a7f7f9de )
retrofit2: fix multiple slash issue in baseUrl of retrofit2 client ( a7f7f9de )

Other

api: refactor retrofit2 client configuration for FiatService to fix any issues that may occur if the base url has multiple slashes ( a7f7f9de )
dependencies: Autobump korkVersion ( 1c7fb38c )
dependencies: Autobump korkVersion ( e6fa9be1 )
dependencies: Autobump korkVersion ( 0b9e5f6f )
github: add a test to demonstrate an error scenario where if the baseUrl of the Github client has multiple slashes and the end point start with a slash ( a7f7f9de )
web: refactor retrofit2 client configuration for IgorApi, ClouddriverApi and Front50Api to fix any issues that may occur if the base url has multiple slashes ( a7f7f9de )

Front50 2.41.0

Other

dependencies: Autobump fiatVersion ( ceda49e0 )
dependencies: Autobump korkVersion ( 849a0ce3 )
dependencies: Autobump fiatVersion ( c4c047b5 )
dependencies: Autobump korkVersion ( e8909c70 )
dependencies: Autobump fiatVersion ( 6dc06b63 )
dependencies: Autobump korkVersion ( 84137d73 )

Gate 6.69.0

Fixes

retrofit2: fix retrofit2 issues ( bdf8922b )
retrofit2: fix non-generics QueryMap which causes the following error: ( bdf8922b )
retrofit2: fix A @Path parameter must not come after a @Query error ( bdf8922b )
retrofit2/test: deal with the introduction of Retrofit2EncodeCorrectionInterceptor ( c18a17c1 )
web: fix the mismatch in return types of EchoService.postEvent api stub and the actual api from echo ( ed770271 )
web: fix the mismatch in return types of EchoService.postEvent api stub and the actual api from echo. ( ed770271 )
web: fix the mismatches in the return types of APIs in gate and orca ( 15465c96 )
web: fix the mismatches in the return types of apis in gate and orca for delete, resume, cancel and pause operations of a pipeline. ( 15465c96 )
web: add Retrofit2SyncCall.execute to ClouddriverService in CredentialsController ( 5b500d3c )
web: add Retrofit2SyncCall.execute to ClouddriverService in CredentialsController ( 5b500d3c )
web: add Retrofit2SyncCall.execute to BakeService ( d3dc67d6 )
web: add Retrofit2SyncCall.execute to BakeService ( d3dc67d6 )
web: make type of additionalFilters in ImageController.findImages ( 875a8b15 )
web: make type of additionalFilters in ImageController.findImages ( 875a8b15 )

Other

Add test cases for OAuth feature validation ( a33b053e )
OAuth2: groovy to java conversion for OAuth module ( 381f554c )
OAuth2: groovy to java conversion for OAuth module ( 381f554c )
dependencies: Autobump fiatVersion ( 1af7f70a )
dependencies: Autobump korkVersion ( 8f5cffb6 )
dependencies: Autobump fiatVersion ( d04b861c )
dependencies: Autobump korkVersion ( efd741a5 )
dependencies: Autobump fiatVersion ( dd8ea4b3 )
dependencies: Autobump korkVersion ( c18a17c1 )
dependencies: Autobump korkVersion ( c18a17c1 )
retrofit2: add test to demonstrate the following error when QueryMap is used without generics: ( bdf8922b )
web: add a test to demonstrate the mismatch in return types of EchoService.postEvent api stub and the actual api from echo. ( ed770271 )
web: add a test to demonstrate the mismatch in api response types of gate and orca when delete pipeline execution api is invoked ( 15465c96 )
web: add a test to demonstrate the retrofit error that occurs when /credentials/type/{accountType} is invoked ( 5b500d3c )
web: use constructor injection in BakeService ( d3dc67d6 )
web: demonstrate behavior of BakeService ( d3dc67d6 )
web: demonstrate behavior of ImageController.findImages ( 875a8b15 )
web/test: mock DefaultProviderLookupService in PipelineServiceTest ( 15465c96 )
web/test: remove request id header from PipelineServiceTest ( 15465c96 )
web/test: add X-SPINNAKER-USER and X-SPINNAKER-ACCOUNTS headers ( 15465c96 )

Igor 4.22.0

Fixes

monitor-travis/test: keep up with new Retrofit2EncodeCorrectionInterceptor argument ( 5921e5fc )
web/test: keep up with new Retrofit2EncodeCorrectionInterceptor argument ( 5921e5fc )

Other

dependencies: Autobump fiatVersion ( 627ec479 )
dependencies: Autobump korkVersion ( f4f2da07 )
dependencies: Autobump fiatVersion ( 44c1bd8b )
dependencies: Autobump korkVersion ( 0c90099a )
dependencies: Autobump fiatVersion ( 22985a3d )
dependencies: Autobump korkVersion ( 5921e5fc )
dependencies: Autobump korkVersion ( 5921e5fc )
retrofit2: upgrade code to use retrofit2 ( 769f1751 )
retrofit2: upgrade igor-core package to retrofit2 ( 769f1751 )
retrofit2: upgrade igor-monitor-artifactory to retrofit2 ( 769f1751 )
retrofit2: upgrade igor-monitor-plugins to retrofit2 ( 769f1751 )
retrofit2: upgrade igor-monitor-travis to retrofit2 ( 769f1751 )
retrofit2: upgrade igor-web jenkins code to retrofit2 ( 769f1751 )
retrofit2: upgrade igor-web bitbucket code to retrofit2 ( 769f1751 )
retrofit2: upgrade igor-web github code to retrofit2 ( 769f1751 )
retrofit2: upgrade igor-web gitlab code to retrofit2 ( 769f1751 )
retrofit2: upgrade igor-web stash code to retrofit2 ( 769f1751 )
retrofit2: upgrade igor-web wercker code to retrofit2 ( 769f1751 )
retrofit2: upgrade igor-web concourse code to retrofit2 ( 769f1751 )
retrofit2: upgrade igor-web helm code to retrofit2 ( 769f1751 )
retrofit2: upgrade remaining misc files in igor-web to retrofit2 ( 769f1751 )
retrofit2: add missing Retrofit2SyncCall.execute() calls ( 769f1751 )
retrofit2: remove leading slashes in endpoints + add utility class to prevent ‘baseUrl must end in /’ error ( 769f1751 )
retrofit2: add tests for retry behavior in GitlabCiService ( 769f1751 )
retrofit2: fix connection refused in RetrofitUtilsTest ( 769f1751 )
retrofit2: fix formatting ( 769f1751 )
retrofit2: remove JenkinsOkHttpClientProvider and DefaultJenkinsOkHttpClientProvider ( 769f1751 )

Kayenta 2.46.0

Other

dependencies: Autobump orcaVersion ( a69573be )
dependencies: Autobump orcaVersion ( 4c545b5f )

Orca 8.64.0

Fixes

clouddriver/test: keep up with new Retrofit2EncodeCorrectionInterceptor argument ( d04c5186 )
retrofit1: exclude Retrofit2EncodeCorrectionInterceptor from the retrofit1 clients ( 2fdb327a )
retrofit1: exclude Retrofit2EncodeCorrectionInterceptor from the retrofit1 clients ( 2fdb327a )

Other

dependencies: Autobump fiatVersion ( b61e752b )
dependencies: Autobump korkVersion ( 139af4a0 )
dependencies: Autobump fiatVersion ( c7f18c88 )
dependencies: Autobump korkVersion ( c8496b5d )
dependencies: Autobump fiatVersion ( 7071d6e9 )
dependencies: Autobump korkVersion ( d04c5186 )
dependencies: Autobump korkVersion ( d04c5186 )
retrofit1: revert adding Retrofit2EncodeCorrectionInterceptor to retrofit1 clients in tests as kork is updated with new constructor ( 2fdb327a )

Rosco 1.26.0

Other

dependencies: Autobump korkVersion ( 0ae53eb0 )
dependencies: Autobump korkVersion ( cac7dd3d )
dependencies: Autobump korkVersion ( 84b7fe58 )

Changelogs: Spinnaker Release 1.37.10

Mon, 14 Apr 2025 22:19:13 +0000

Echo 2.44.7

Fixes

retrofit2: fix google cloud build notification agent for missing Retrofit2SyncCall.execute call (#1500) ( 21721cb9 )
retrofit2: fix the issue of missing Retrofit2SyncCall.execute call in GoogleCloudBuildNotificationAgent ( 21721cb9 )

Other

retrofit2: add a test to demonstrate the issue of missing Retrofit2SyncCall.execute call in GoogleCloudBuildNotificationAgent ( 21721cb9 )

Changelogs: Spinnaker Release 1.37.9

Wed, 09 Apr 2025 04:31:08 +0000

Clouddriver 5.91.6

Fixes

core/test: add a Retrofit2EncodeCorrectionInterceptor bean ( f56f4f9e )
docker/test: add a Retrofit2EncodeCorrectionInterceptor bean ( f56f4f9e )

Other

dependencies: Autobump fiatVersion ( f0abfea1 )
dependencies: Autobump korkVersion ( 1e70bbdd )
dependencies: Autobump korkVersion ( f56f4f9e )
dependencies: Autobump korkVersion ( f56f4f9e )

Echo 2.44.6

Fixes

retrofit: address remnants of retrofit1 like TypedInput, TypedByteArray etc (#1493) ( 4212e89c )
retrofit: address remnants of retrofit1 like TypedInput, TypedByteArray etc ( 4212e89c )
retrofit2/test: deal with the introduction of Retrofit2EncodeCorrectionInterceptor ( 226670cc )

Other

core/test: only spin up a wiremock server once in IgorServiceTest ( 4212e89c )
dependencies: Autobump fiatVersion ( 0eac7c7c )
dependencies: Autobump korkVersion ( 9a7ef451 )
dependencies: Autobump korkVersion ( 226670cc )
dependencies: Autobump korkVersion ( 226670cc )
retrofit: add a test to demonstrate the issue of passing a TypedInput while using retrofit2 client ( 4212e89c )

Fiat 1.54.2

Other

dependencies: Autobump korkVersion ( 489b9b27 )
dependencies: Autobump korkVersion ( 1f5fd73a )

Front50 2.38.2

Other

dependencies: Autobump fiatVersion ( 96c758f4 )
dependencies: Autobump korkVersion ( 4e935e19 )
dependencies: Autobump korkVersion ( 027cb28f )

Gate 6.66.6

Fixes

retrofit2/test: deal with the introduction of Retrofit2EncodeCorrectionInterceptor ( e4c1a499 )

Other

dependencies: Autobump fiatVersion ( 57ed6109 )
dependencies: Autobump korkVersion ( a7dbb54d )
dependencies: Autobump korkVersion ( e4c1a499 )
dependencies: Autobump korkVersion ( e4c1a499 )

Igor 4.19.2

Other

dependencies: Autobump fiatVersion ( db63b98b )
dependencies: Autobump korkVersion ( 70375f29 )
retrofit1: make sure Retrofit2EncodeCorrectionInterceptor is not included in the retrofit1 clients ( a34671ba )

Kayenta 2.44.2

Other

dependencies: Autobump orcaVersion ( 343b06ec )

Orca 8.61.2

Fixes

retrofit1: exclude Retrofit2EncodeCorrectionInterceptor from the retrofit1 clients (#4857) ( ced52554 )
retrofit1: exclude Retrofit2EncodeCorrectionInterceptor from the retrofit1 clients ( ced52554 )

Other

dependencies: Autobump fiatVersion ( 38b4af39 )
dependencies: Autobump korkVersion ( b7223b9f )
retrofit1: revert adding Retrofit2EncodeCorrectionInterceptor to retrofit1 clients in tests as kork is updated with new constructor ( ced52554 )

Rosco 1.23.1

Other

dependencies: Autobump korkVersion ( 1b72b865 )
dependencies: Autobump korkVersion ( 64e90cc2 )

Changelogs: Spinnaker Release 1.37.8

Sun, 23 Mar 2025 02:46:00 +0000

Clouddriver 5.91.5

Other

dependencies: Autobump fiatVersion ( a34c2759 )

Echo 2.44.5

Other

dependencies: Autobump fiatVersion ( 0685f7a8 )

Fiat 1.54.1

Fixes

github: fix the error where if the baseUrl of the Github client has multiple slashes and the end point start with a slash, the resultant api url leaves that part the base url coming after first slash. ( 6a2024ec )
retrofit2: fix multiple slash issue in baseUrl of retrofit2 client (#1206) ( 6a2024ec )

Other

api: refactor retrofit2 client configuration for FiatService to fix any issues that may occur if the base url has multiple slashes ( 6a2024ec )
github: add a test to demonstrate an error scenario where if the baseUrl of the Github client has multiple slashes and the end point start with a slash ( 6a2024ec )
web: refactor retrofit2 client configuration for IgorApi, ClouddriverApi and Front50Api to fix any issues that may occur if the base url has multiple slashes ( 6a2024ec )

Front50 2.38.1

Other

dependencies: Autobump fiatVersion ( a038589e )

Gate 6.66.5

Other

dependencies: Autobump fiatVersion ( 2cc76390 )

Igor 4.19.1

Other

dependencies: Autobump fiatVersion ( 9a2ad8b5 )

Kayenta 2.44.1

Other

dependencies: Autobump orcaVersion ( 74292755 )

Orca 8.61.1

Other

dependencies: Autobump fiatVersion ( 1f8d42e9 )

Changelogs: Spinnaker Release 1.37.7

Tue, 18 Mar 2025 18:17:36 +0000

Clouddriver 5.91.4

Fixes

docker: resolve the issue of Unrecognized field "child" (#6359) ( b79b25c6 )
docker: resolve the issue of Failed to parse ResponseBody : Unrecognized field "child" when google cloud artifact registry responds with additional fields upon invoking tags list api ( b79b25c6 )

Other

docker: add a test to demonstrate the issue of Failed to parse ResponseBody : Unrecognized field "child" ( b79b25c6 )

Changelogs: Spinnaker Release 1.37.6

Wed, 12 Mar 2025 22:15:45 +0000

Clouddriver 5.91.3

Fixes

docker: resolve the issue of double encoding while making the next call to ECR’s tags list (#6357) ( dd4791f9 )
docker: resolve the issue of double encoding contained in the ECR’s next link header causing the Retrofit2 client to fail due to error code 405 and Message: Method Not Allowed. ( dd4791f9 )

Other

docker: add test to demonstrate the issue of double encoding of query parameter when the next link from a docker registry like ECR responds with an encoded url. ( dd4791f9 )

Deck 3.20.1

Fixes

gcp: fixing existing test + adding one test and updating credentials.json (#10166) ( b3f52630 )

Changelogs: Spinnaker Release 1.37.5

Fri, 07 Mar 2025 20:45:13 +0000

Clouddriver 5.91.2

Fixes

docker: fix retrofit2 docker client which is replacing ? with %3F causing api failure (#6354) ( fd29d63d )
docker: fix the issue of retrofit2 replacing ? with %3F causing api failure with 400 ( fd29d63d )
docker: address review comments on the fix to the issue of retrofit2 replacing ? with %3F causing api failure with 400 ( fd29d63d )

Other

docker: add two test classes, one to demonstrate how real docker registry apis can be accessed using retrofit2 client and another to demonstrate the issue of retrofit2 replacing ? with %3F causing api failure with 400 ( fd29d63d )

Changelogs: Spinnaker Release 1.37.4

Wed, 05 Mar 2025 21:18:21 +0000

Echo 2.44.4

Fixes

notifications: fix MicrosoftTeamsConfig which has unused retrofit1 parameters (#1485) ( aa889534 )