Signal
16 articles covering "ci-cd"
GitHub's Xcode 27 runner image for Actions is now generally available on arm64 runners only; a separate runner-images notice plans to make OpenSSL 4 the default from November 2.
GitHub's October 14 changelog says Actions workflow dependency lockfiles are in public preview; the pre-1.0 gh actions-lock extension writes .github/workflows/actions.lock.
GitLab's October 12 critical patch release fixes CVE-2026-97229, rated CVSS 10.0, which GitLab says could let an unauthenticated user run code via a crafted CI/CD regular expression.
GitHub's Actions Runner Controller 0.15.0 for Kubernetes runner scale sets updates resources in place, uses patch requests, and adds configurable concurrency, listener rate limits and shutdown grace period.
GitHub says all newly minted App installation tokens are now stateless JWTs of about 520 characters; the opt-out header ends November 30, 2026.
GitHub will retire the macOS 14 runner image on November 2, 2026 and fail jobs using it in eight October brownout windows; Azure DevOps hosted agents follow the same schedule.
Socket found that actions-cool/issues-helper and actions-cool/maintain-one-comment, disabled since May 2026, became reachable again on September 16 with their malicious tags intact, silently re-running the payload.
The Rust Security Response Team disclosed and patched a Miri flaw that stored all environment variables in target/, letting cached CI output expose secrets to pull requests.
CNCF graduated Cloud Native Buildpacks on August 11, formalizing a build model that shifts base-image patching from Dockerfiles to a centralized builder.
A GitHub Actions failure on August 6 knocked out workflows, Pages, and Copilot for over eight hours, extending a run of dozens of monthly incidents this year.
Jenkins fixed CVE-2026-53435, an 8.8-rated deserialization flaw letting an attacker-controlled config.xml impersonate users and reach the Script Console for code execution on the controller.
GitHub is embedding permanent owner and repository IDs into Actions OIDC subject claims, with the new format becoming the default for repos created after July 15, 2026.