Skip to content

Commit cdee2db

Browse files
release-controller[bot]Release-Controllerrachaelrenkvgrl
authored
Patch release notes for GitHub Enterprise Server (#40494)
Co-authored-by: Release-Controller <runner@fv-az225-545.nn523fotaqjeti0rucxshd1u2e.jx.internal.cloudapp.net> Co-authored-by: Rachael Rose Renk <[email protected]> Co-authored-by: Vanessa <[email protected]>
1 parent 69f60ee commit cdee2db

File tree

4 files changed

+202
-0
lines changed

4 files changed

+202
-0
lines changed

‎data/release-notes/enterprise-server/3-6/17.yml

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
date: '2023-08-10'
2+
sections:
3+
security_fixes:
4+
- |
5+
**LOW:** An attacker could circumvent branch protection by changing a PR base branch to an invalid ref name. This vulnerability was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
6+
- |
7+
Packages have been updated to the latest security versions.
8+
bugs:
9+
- |
10+
On an instance in a high availability configuration, on some platforms, replication could perform poorly over links with very high latency.
11+
- |
12+
On an instance with custom firewall rules defined, a configuration run with `ghe-config-apply` could take longer than expected.
13+
- |
14+
Events related to repository notifications did not appear in the audit log.
15+
- |
16+
A collaborator with the "Set the social preview" permission inherited from the "Read" role couldnt upload the social preview image of a repository.
17+
- |
18+
On an instance in a high availability configuration, existing nodes with out-of-sync repositories prevented new nodes from replicating those repositories.
19+
- |
20+
GitHub Enterprise Server was queuing zip jobs unnecessarily.
21+
changes:
22+
- |
23+
The secondary abuse rate limits of the GraphQL API are now configurable in the Management Console.
24+
- |
25+
The description of the `ghe-cluster-balance` command line utility clarifies that it can be used to balance jobs other than `github-unicorn`.
26+
- |
27+
Administrators can display all repositories in a network with `spokesctl` by using the `repositories` subcommand.
28+
known_issues:
29+
- |
30+
Custom firewall rules are removed during the upgrade process.
31+
- |
32+
Git LFS tracked files [uploaded through the web interface](https://github.com/blog/2105-upload-files-to-your-repositories) are incorrectly added directly to the repository.
33+
- |
34+
The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.
35+
- |
36+
In a repository's settings, enabling the option to allow users with read access to create discussions does not enable this functionality.
37+
- |
38+
Custom patterns for secret scanning have `.*` as an end delimiter, specifically in the "After secret" field. This delimiter causes inconsistencies in scans for secrets across repositories, and you may notice gaps in a repository's history where no scans completed. Incremental scans may also be impacted. To prevent issues with scans, modify the end of the pattern to remove the `.*` delimiter.
39+
- |
40+
{% data reusables.release-notes.repository-inconsistencies-errors %}
41+
- |
42+
On an instance in a high-availability configuration, passive replica nodes accept Git client requests and forward the requests to the primary node.
43+
- |
44+
If an instance is configured to forward logs to a target server with TLS enabled, certificate authority (CA) bundles that a site administrator uploads using `ghe-ssl-ca-certificate-install` are not respected, and connections to the server fail.
45+
- |
46+
When running `ghe-config-apply`, the process may stall with the message `Deployment is running pending automatic promotion`.

‎data/release-notes/enterprise-server/3-7/15.yml

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
date: '2023-08-10'
2+
sections:
3+
security_fixes:
4+
- |
5+
**LOW:** An attacker could circumvent branch protection by changing a PR base branch to an invalid ref name. This vulnerability was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
6+
- |
7+
In some cases, users could reopen a pull request that should not have been able to be reopened.
8+
- |
9+
Packages have been updated to the latest security versions.
10+
bugs:
11+
- |
12+
In rare circumstances, Git commits signed with SSH keys using the RSA algorithm would incorrectly indicate the signature was invalid.
13+
- |
14+
Issues with cross references to pull requests from deleted accounts would not load.
15+
- |
16+
The site admin page for organizations erroneously included a "Blocked Copilot Repositories" link.
17+
- |
18+
The checks in the merge box for a pull request did not always match the the checks for the most recent commit in the pull request.
19+
- |
20+
When a site administrator used GitHub Enterprise Importer on versions 3.7 and below to migrate repositories from GitHub Enterprise Server, the system backup size would increase after running many migrations due to storage files not being cleaned up.
21+
- |
22+
API results were incomplete, and ordering of results was incorrect if `asc` or `desc` appeared in lowercase within the API query.
23+
- |
24+
A collaborator with the "Set the social preview" permission inherited from the "Read" role couldnt upload the social preview image of a repository.
25+
- |
26+
In some cases, on an instance with GitHub Actions enabled, deployment of GitHub Pages site using a GitHub Actions workflow failed with a status of `deployment_lost`.
27+
- |
28+
On an instance in a high availability configuration, existing nodes with out-of-sync repositories prevented new nodes from replicating those repositories.
29+
- |
30+
GitHub Enterprise Server was queuing zip jobs unnecessarily.
31+
changes:
32+
- |
33+
The description of the `ghe-cluster-balance` command line utility clarifies that it can be used to balance jobs other than `github-unicorn`.
34+
- |
35+
Administrators can display all repositories in a network with `spokesctl` by using the `repositories` subcommand.
36+
- |
37+
Site administrators can see improved diagnostic information about repositories that have been deleted.
38+
known_issues:
39+
- |
40+
Custom firewall rules are removed during the upgrade process.
41+
- |
42+
The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.
43+
- |
44+
In a repository's settings, enabling the option to allow users with read access to create discussions does not enable this functionality.
45+
- |
46+
Custom patterns for secret scanning have `.*` as an end delimiter, specifically in the "After secret" field. This delimiter causes inconsistencies in scans for secrets across repositories, and you may notice gaps in a repository's history where no scans completed. Incremental scans may also be impacted. To prevent issues with scans, modify the end of the pattern to remove the `.*` delimiter.
47+
- |
48+
{% data reusables.release-notes.repository-inconsistencies-errors %}
49+
- |
50+
During the validation phase of a configuration run, a `No such object` error may occur for the Notebook and Viewscreen services. This error can be ignored as the services should still correctly start.
51+
- |
52+
On an instance in a high-availability configuration, passive replica nodes accept Git client requests and forward the requests to the primary node.
53+
- |
54+
If an instance is configured to forward logs to a target server with TLS enabled, certificate authority (CA) bundles that a site administrator uploads using `ghe-ssl-ca-certificate-install` are not respected, and connections to the server fail.
55+
- |
56+
When running `ghe-config-apply`, the process may stall with the message `Deployment is running pending automatic promotion`.

‎data/release-notes/enterprise-server/3-8/8.yml

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
date: '2023-08-10'
2+
sections:
3+
security_fixes:
4+
- |
5+
**LOW:** An attacker could circumvent branch protection by changing a PR base branch to an invalid ref name. This vulnerability was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
6+
- |
7+
Packages have been updated to the latest security versions.
8+
bugs:
9+
- |
10+
API results were incomplete, and ordering of results was incorrect if `asc` or `desc` appeared in lowercase within the API query.
11+
- |
12+
The checks in the merge box for a pull request did not always match the the checks for the most recent commit in the pull request.
13+
- |
14+
When a site administrator used GitHub Enterprise Importer on versions 3.7 and below to migrate repositories from GitHub Enterprise Server, the system backup size would increase after running many migrations due to storage files not being cleaned up.
15+
- |
16+
A collaborator with the "Set the social preview" permission inherited from the "Read" role couldnt upload the social preview image of a repository.
17+
- |
18+
When running the `ghe-migrator`, certain error messages contained an invalid link to import documentation.
19+
- |
20+
In some cases, on an instance with GitHub Actions enabled, deployment of GitHub Pages site using a GitHub Actions workflow failed with a status of `deployment_lost`.
21+
- |
22+
On an instance in a high availability configuration, existing nodes with out-of-sync repositories prevented new nodes from replicating those repositories.
23+
- |
24+
GitHub Enterprise Server was queuing zip jobs unnecessarily.
25+
changes:
26+
- |
27+
The description of the `ghe-cluster-balance` command line utility clarifies that it can be used to balance jobs other than `github-unicorn`.
28+
- |
29+
On GitHub Enterprise Server 3.8 and above, a blob storage provider must be configured in the Management Console in order to use the GitHub Enterprise Importer CLI, "startRepositoryMigration" GraphQL API, or "Start an organization migration" REST API. The "Migrations" section in the Management Console was mistakenly removed and has been added back.
30+
- |
31+
Administrators can display all repositories in a network with `spokesctl` by using the `repositories` subcommand.
32+
known_issues:
33+
- |
34+
Custom firewall rules are removed during the upgrade process.
35+
- |
36+
The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.
37+
- |
38+
During the validation phase of a configuration run, a `No such object` error may occur for the Notebook and Viewscreen services. This error can be ignored as the services should still correctly start.
39+
- |
40+
If the root site administrator is locked out of the Management Console after failed login attempts, the account does not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[Troubleshooting access to the Management Console](https://docs.github.com/en/[email protected]/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)." [Updated: 2023-02-23]
41+
- |
42+
On an instance in a high-availability configuration, passive replica nodes accept Git client requests and forward the requests to the primary node.
43+
- |
44+
If an instance is configured to forward logs to a target server with TLS enabled, certificate authority (CA) bundles that a site administrator uploads using `ghe-ssl-ca-certificate-install` are not respected, and connections to the server fail.
45+
- |
46+
When running `ghe-config-apply`, the process may stall with the message `Deployment is running pending automatic promotion`.
47+
- |
48+
On an instance with subdomain isolation disabled, Mermaid diagrams in the web UI display an "Unable to render rich display" error and fail to render.

‎data/release-notes/enterprise-server/3-9/3.yml

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
date: '2023-08-10'
2+
intro: |
3+
{% warning %}
4+
5+
**Warning**: This release contains known issues that can impact the performance of your instance. Before you upgrade, make sure you've read the "[Known issues](#3.9.1-known-issues)" section of these release notes.
6+
7+
{% endwarning %}
8+
sections:
9+
security_fixes:
10+
- |
11+
**LOW:** An attacker could circumvent branch protection by changing a PR base branch to an invalid ref name. This vulnerability was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
12+
bugs:
13+
- |
14+
API results were incomplete, and ordering of results was incorrect if `asc` or `desc` appeared in lowercase within the API query.
15+
- |
16+
The checks in the merge box for a pull request did not always match the the checks for the most recent commit in the pull request.
17+
- |
18+
When a site administrator used GitHub Enterprise Importer on versions 3.7 and below to migrate repositories from GitHub Enterprise Server, the system backup size would increase after running many migrations due to storage files not being cleaned up.
19+
- |
20+
A collaborator with the "Set the social preview" permission inherited from the "Read" role could not upload the social preview image of a repository.
21+
- |
22+
The security settings page for a repository would return an error when enterprise-level runners were assigned to the repository.
23+
- |
24+
GitHub Enterprise Server was queuing zip jobs unnecessarily.
25+
changes:
26+
- |
27+
On GitHub Enterprise Server 3.8 and above, a blob storage provider must be configured in the Management Console in order to use the GitHub Enterprise Importer CLI, "startRepositoryMigration" GraphQL API, or "Start an organization migration" REST API. The "Migrations" section in the Management Console was mistakenly removed and has been added back.
28+
- |
29+
Administrators can display all repositories in a network with `spokesctl` by using the `repositories` subcommand.
30+
known_issues:
31+
- |
32+
Custom firewall rules are removed during the upgrade process.
33+
- |
34+
The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.
35+
- |
36+
During the validation phase of a configuration run, a `No such object` error may occur for the Notebook and Viewscreen services. This error can be ignored as the services should still correctly start.
37+
- |
38+
If the root site administrator is locked out of the Management Console after failed login attempts, the account does not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[Troubleshooting access to the Management Console](https://docs.github.com/en/[email protected]/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)." [Updated: 2023-02-23]
39+
- |
40+
On an instance in a high-availability configuration, passive replica nodes accept Git client requests and forward the requests to the primary node.
41+
- |
42+
If an instance is configured to forward logs to a target server with TLS enabled, certificate authority (CA) bundles that a site administrator uploads using `ghe-ssl-ca-certificate-install` are not respected, and connections to the server fail.
43+
- |
44+
When running `ghe-config-apply`, the process may stall with the message `Deployment is running pending automatic promotion`.
45+
- |
46+
The `mbind: Operation not permitted` error in the `/var/log/mysql/mysql.err` file can be ignored. MySQL 8 does not gracefully handle when the `CAP_SYS_NICE` capability isn't required, and outputs an error instead of a warning.
47+
- |
48+
On an instance with subdomain isolation disabled, Mermaid diagrams in the web UI display an "Unable to render rich display" error and fail to render.
49+
- |
50+
When enabling CodeQL via default setup [at scale](/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning-at-scale), some checks related to GitHub Actions are omitted, potentially preventing the process from completing.
51+
- |
52+
{% data reusables.release-notes.upgrade-mysql8-cannot-start-up %}

0 commit comments

Comments
 (0)