3.0

Enterprise Server 3.1 release notes

3.2

Enterprise Server 3.1.9

Download

October, 12, 2021

📣 This is not the latest release of Enterprise Server. Please use the latest release for the latest security, performance, and bug fixes.

Security fixes
  • Packages have been updated to the latest security versions.

Bug fixes
  • Custom pre-receive hooks could have failed due to too restrictive virtual memory or CPU time limits.

  • Attempting to wipe all existing configuration settings with ghe-cleanup-settings failed to restart the Management Console service.

  • During replication teardown via ghe-repl-teardown Memcached failed to be restarted.

  • During periods of high load, users would receive HTTP 503 status codes when upstream services failed internal healthchecks.

  • With Actions configured, MSSQL replication would fail after restoring from a GitHub Enterprise Backup Utilities snapshot.

  • An erroneous jq error message may have been displayed when running ghe-config-apply.

  • Pre-receive hook environments were forbidden from calling the cat command via BusyBox on Alpine.

  • The external database password was logged in plaintext.

  • Failing over from a primary Cluster datacenter to a secondary Cluster datacenter succeeds, but then failing back over to the original primary Cluster datacenter failed to promote Elasticsearch indicies.

  • The "Import teams" button on the Teams page for an Organization returned an HTTP 404.

  • In some cases, GitHub Enterprise Administrators attempting to view the Dormant users page received 502 Bad Gateway or 504 Gateway Timeout response.

  • Performance was negatively impacted in certain high load situations as a result of the increased number of SynchronizePullRequestJob jobs.

Changes
  • More effectively delete Webhook logs that fall out of the Webhook log retention window.

Known issues
  • The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.

  • On a freshly set up GitHub Enterprise Server without any users, an attacker could create the first admin user.

  • Custom firewall rules are removed during the upgrade process.

  • Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.

  • Issues cannot be closed if they contain a permalink to a blob in the same repository, where the blob's file path is longer than 255 characters.

  • When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.

  • If GitHub Actions is enabled for GitHub Enterprise Server, teardown of a replica node with ghe-repl-teardown will succeed, but may return ERROR:Running migrations.

  • Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.

Enterprise Server 3.1.8

Download

September, 24, 2021

📣 This is not the latest patch release of this release series, and this is not the latest release of Enterprise Server. Please use the latest release for the latest security, performance, and bug fixes.

Security fixes
  • HIGH: A path traversal vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration options used by GitHub Pages were not sufficiently restricted and made it possible to read files on the GitHub Enterprise Server instance. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.1.8 and was fixed in 3.1.8, 3.0.16, and 2.22.22. This is the result of an incomplete fix for CVE-2021-22867. This vulnerability was reported via the GitHub Bug Bounty program and has been assigned CVE-2021-22868.

  • MEDIUM: An improper access control vulnerability in GitHub Enterprise Server allowed a workflow job to execute in a self-hosted runner group it should not have had access to. This affects customers using self-hosted runner groups for access control. A repository with access to one enterprise runner group could access all of the enterprise runner groups within the organization because of improper authentication checks during the request. This could cause code to be run unintentionally by the incorrect runner group. This vulnerability affected GitHub Enterprise Server versions from 3.0.0 to 3.0.15 and 3.1.0 to 3.1.7 and was fixed in 3.0.16 and 3.1.8 releases. It has been assigned CVE-2021-22869.

Bug fixes
  • Resque worker counts were displayed incorrectly during maintenance mode.

  • Allocated memcached memory could be zero in clustering mode.

  • Non-empty binary files displayed an incorrect file type and size on the pull request "Files" tab.

  • Fixes GitHub Pages builds so they take into account the NO_PROXY setting of the appliance. This is relevant to appliances configured with an HTTP proxy only. (update 2021-09-30)

Known issues
  • The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.

  • On a freshly set up GitHub Enterprise Server without any users, an attacker could create the first admin user.

  • Custom firewall rules are removed during the upgrade process.

  • Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.

  • Issues cannot be closed if they contain a permalink to a blob in the same repository, where the blob's file path is longer than 255 characters.

  • When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.

  • If GitHub Actions is enabled for GitHub Enterprise Server, teardown of a replica node with ghe-repl-teardown will succeed, but may return ERROR:Running migrations.

  • Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.

Enterprise Server 3.1.7

Download

September, 07, 2021

📣 This is not the latest patch release of this release series, and this is not the latest release of Enterprise Server. Please use the latest release for the latest security, performance, and bug fixes.

Security fixes
  • Packages have been updated to the latest security versions.

Bug fixes
  • Attempting to tear down a newly-added replica node by specifying its UUID with ghe-repl-teardown would fail without reporting an error if replication was not started.

  • GitHub Pages builds were being passed through an external proxy if there was one configured.

  • Custom pre-receive hooks that created sub-processes would lack a PATH variable in their environment, resulting in "No such file or directory" errors.

  • MySQL could failover during an upgrade if mysql-auto-failover was enabled.

Known issues
  • The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.

  • On a freshly set up GitHub Enterprise Server without any users, an attacker could create the first admin user.

  • Custom firewall rules are removed during the upgrade process.

  • Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.

  • Issues cannot be closed if they contain a permalink to a blob in the same repository, where the blob's file path is longer than 255 characters.

  • When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.

  • If GitHub Actions is enabled for GitHub Enterprise Server, teardown of a replica node with ghe-repl-teardown will succeed, but may return ERROR:Running migrations.

  • Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.

Enterprise Server 3.1.6

Download

August, 24, 2021

📣 This is not the latest patch release of this release series, and this is not the latest release of Enterprise Server. Please use the latest release for the latest security, performance, and bug fixes.

Security fixes
  • Packages have been updated to the latest security versions.

Bug fixes
  • Attaching very large images or animated GIFs to images or pull requests would fail.

  • Journald messages related to automatic updates (Adding h/m/s random time.) were logged to syslog.

  • Custom pre-receive hooks that created named pipes (FIFOs) would crash or hang, resulting in a timeout error.

  • Adding filters to the audit log advanced search page did not populate the query text box in real-time with the correct facet prefix and value.

  • Git hooks to the internal API that result in failing requests returned the exception undefined method body for "success":String (NoMethodError) instead of returning an explicit nil.

  • When an integration was removed, it was possible for an unrelated OAuth application or integration to also be removed.

  • When a mandatory message containing an emoji character was added, attempting to view or change the message would return a 500 Internal Server Error.

Changes
  • Adds triage and maintain to the list of permissions returned by the REST API.

Known issues
  • The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.

  • On a freshly set up GitHub Enterprise Server without any users, an attacker could create the first admin user.

  • Custom firewall rules are removed during the upgrade process.

  • Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.

  • Issues cannot be closed if they contain a permalink to a blob in the same repository, where the blob's file path is longer than 255 characters.

  • When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.

  • If GitHub Actions is enabled for GitHub Enterprise Server, teardown of a replica node with ghe-repl-teardown will succeed, but may return ERROR:Running migrations.

  • Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.

Enterprise Server 3.1.5

Download

August, 10, 2021

📣 This is not the latest patch release of this release series, and this is not the latest release of Enterprise Server. Please use the latest release for the latest security, performance, and bug fixes.

Bug fixes
  • Custom pre-receive hooks that used a bash subshell would return an error: No such file or directory.

  • When GitHub Actions is enabled without running regular scheduled backups the MSSQL Transaction Log could grow unbounded and can consume all available space on the appliance's Data Disk causing a possible outage.

  • Unnecessary database logging consumed a large amount of disk space on instances with heavy LFS usage.

  • Audit log entries for changes made to "Repository creation" organization settings were inaccurate.

  • Excessive logging of ActionController::UnknownFormat exceptions caused unnecessary disk usage.

  • LDAP group_dn values longer than 255 characters would result in errors being logged: Data truncated for column 'group_dn' at row 1.

Changes
  • Abuse rate limits are now called Secondary rate limits, since the behavior they limit is not always abusive.

Known issues
  • The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.

  • On a freshly set up GitHub Enterprise Server without any users, an attacker could create the first admin user.

  • Custom firewall rules are removed during the upgrade process.

  • Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.

  • Issues cannot be closed if they contain a permalink to a blob in the same repository, where the blob's file path is longer than 255 characters.

  • When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.

  • If GitHub Actions is enabled for GitHub Enterprise Server, teardown of a replica node with ghe-repl-teardown will succeed, but may return ERROR:Running migrations.

  • Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.

Enterprise Server 3.1.4

Download

July, 27, 2021

📣 This is not the latest patch release of this release series, and this is not the latest release of Enterprise Server. Please use the latest release for the latest security, performance, and bug fixes.

Security fixes
  • Packages have been updated to the latest security versions.

Bug fixes
  • The counts on packages pages were not being incremented when a package was downloaded.

  • ghe-config-apply would timeout, ask for a prompt or fail for a customer that had secret scanning enabled, and had either disabled or never enabled GitHub Actions on their instance.

  • Log files were not reopened after rotation in some cases leading to high disk space usage on instances with high uptime.

  • Upgrade could fail from older version of GitHub Enterprise Server due to a missing job in GitHub Actions.

  • Custom pre-receive hooks could lead to an error like error: object directory /data/user/repositories/0/nw/12/34/56/7890/network.git/objects does not exist; check .git/objects/info/alternates.

  • Unauthenticated HTTP proxy for the pages containers build was not supported for any users that use HTTP proxies.

  • A significant number of 503 errors were logged every time a user visited a repository's /settings page if the dependency graph was not enabled.

  • Internal repositories were only returned when a user had affiliations with the repository through a team or through collaborator status, or queried with the ?type=internal parameter.

  • Failed background jobs had unlimited retries which could cause large queue depths.

  • A significant number of 503 errors were being created if the scheduled job to sync vulnerabilities with GitHub.com attempted to run when dependency graph was not enabled and content analysis was enabled.

  • When GitHub Actions is enabled without running regular scheduled backups, the MSSQL transaction log could grow unbounded and can consume all available space on the appliance's data disk, causing a possible outage.

    If you have configured regularly scheduled MSSQL backups, no further actions is required. Otherwise, if you have GitHub Actions previously enabled, run the following commands after installing this patch.

    ghe-actions-console -s Mps -c 'Update-Service -Force'
    ghe-actions-console -s Token -c 'Update-Service -Force'
    ghe-actions-console -s Actions -c 'Update-Service -Force'
    
Changes
  • The logs for babeld now include a cmd field for HTTP ref advertisement requests instead of only including it during the negotiation requests.

Known issues
  • The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.

  • On a freshly set up GitHub Enterprise Server without any users, an attacker could create the first admin user.

  • Custom firewall rules are removed during the upgrade process.

  • Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.

  • Issues cannot be closed if they contain a permalink to a blob in the same repository, where the blob's file path is longer than 255 characters.

  • When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.

  • If GitHub Actions is enabled for GitHub Enterprise Server, teardown of a replica node with ghe-repl-teardown will succeed, but may return ERROR:Running migrations.

  • Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.

Enterprise Server 3.1.3

Download

July, 14, 2021

📣 This is not the latest patch release of this release series, and this is not the latest release of Enterprise Server. Please use the latest release for the latest security, performance, and bug fixes.

Security fixes
  • HIGH: A path traversal vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration options used by GitHub Pages were not sufficiently restricted and made it possible to read files on the GitHub Enterprise Server instance. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.1.3 and has been assigned CVE-2021-22867. This vulnerability was reported via the GitHub Bug Bounty program.

  • Packages have been updated to the latest security versions.

Bug fixes
  • SAML expiration date variable was not configurable.

  • Application services would fail their health checks during config apply before they could enter a healthy state.

  • ghe-cluster-config-node-init would fail during cluster setup if HTTP proxy is enabled.

  • Pre-receive hooks could encounter an error Failed to resolve full path of the current executable due to /proc not being mounted on the container.

  • Collectd would not resolve the forwarding destination hostname after the initial startup.

  • The job that purged stale deleted repositories could fail to make progress if some of those repositories were protected from deletion by legal holds.

  • Background jobs were being queued to the spam queue which were not being processed.

  • The preferred merge method would be reset when retrying after a failed PR merge.

  • Git pushes could result in a 500 Internal Server Error during the user reconciliation process on instances using LDAP authentication mode.

  • After upgrading from 3.0.x to 3.1.x, in some cases GitHub Actions would fail with an error: An unexpected error occurred when executing this workflow.

Changes
  • Improved the efficiency of config apply by skipping IP allow firewall rules that had not changed, which saved significant time on large clusters.

Known issues
  • The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.

  • On a freshly set up GitHub Enterprise Server without any users, an attacker could create the first admin user.

  • Custom firewall rules are removed during the upgrade process.

  • Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.

  • Issues cannot be closed if they contain a permalink to a blob in the same repository, where the blob's file path is longer than 255 characters.

  • When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.

  • If GitHub Actions is enabled for GitHub Enterprise Server, teardown of a replica node with ghe-repl-teardown will succeed, but may return ERROR:Running migrations.

  • Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.

Enterprise Server 3.1.2

Download

June, 24, 2021

📣 This is not the latest patch release of this release series, and this is not the latest release of Enterprise Server. Please use the latest release for the latest security, performance, and bug fixes.

Security fixes
  • Packages have been updated to the latest security versions.

Bug fixes
  • A large number of gauge-dependency-graph-api-dispatch_dispatch metrics could accumulate in the Management Console.

  • The sshd service would sometimes fail to start on instances running on Google Cloud Platform.

  • Old upgrade files would persist on the user disk, sometimes resulting in out of space conditions.

  • gh-migrator displayed an incorrect path to its log output.

  • An export archive would silently fail to import pull requests if they contained review requests from teams not present in the archive.

Changes
  • Update the GitHub Actions Runner version in GHES 3.1 to v2.278.0

Known issues
  • The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.

  • On a freshly set up GitHub Enterprise Server without any users, an attacker could create the first admin user.

  • Custom firewall rules are removed during the upgrade process.

  • Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.

  • Issues cannot be closed if they contain a permalink to a blob in the same repository, where the blob's file path is longer than 255 characters.

  • When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.

  • After upgrading from 3.0.x to 3.1.x, in some cases GitHub Actions can fail with an error: An unexpected error occurred when executing this workflow. To workaround this problem, connect to the administrative shell (ssh) and run:

    ghe-actions-console -s actions -c "Queue-ServiceJob -JobId 4DB1F4CF-19FD-40E0-A253-91288813DE8B"
    
  • If GitHub Actions is enabled for GitHub Enterprise Server, teardown of a replica node with ghe-repl-teardown will succeed, but may return ERROR:Running migrations.

  • Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.

Enterprise Server 3.1.1

Download

June, 10, 2021

📣 This is not the latest patch release of this release series, and this is not the latest release of Enterprise Server. Please use the latest release for the latest security, performance, and bug fixes.

Security fixes
  • Packages have been updated to the latest security versions.

Bug fixes
  • SVN 1.7 and older clients showed an error when using the svn co and svn export commands.

  • Accessing a repository through the administrative shell using ghe-repo <owner>/<reponame> would hang.

  • After upgrading, users experienced reduced availability during heavy usage, because services restarted too frequently. This would occur due to timeout mismatches between the nomad configuration and that of the internal services.

  • In some instances, running ghe-repl-status after setting up GitHub Actions would produce an error and ghe-actions-teardown would fail.

  • ghe-dbconsole would return errors under some circumstances.

  • Import failures of organizations or repositories from non-GitHub sources could produce an undefined method '[]' for nil:NilClass error.

  • GitHub profile names might have changed unintentionally when using SAML authentication, if the GitHub profile name did not match the value of the attribute mapped to the Full name field in the Management Console.

  • Upgrading an instance that had previously ran a 2.13 release, but not a 2.14 release, resulted in a database migration error relating to the AddRepositoryIdToCheckRuns data transition.

Changes
  • Users of the GraphQL API can query the public field closingIssuesReferences on the PullRequest object. This field retrieves issues that will be automatically closed when the related pull request is merged. This approach will also allow this data to be migrated in future, as part of a higher fidelity migration process.

Known issues
  • The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.

  • On a freshly set up GitHub Enterprise Server without any users, an attacker could create the first admin user.

  • Custom firewall rules are removed during the upgrade process.

  • Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.

  • Issues cannot be closed if they contain a permalink to a blob in the same repository, where the blob's file path is longer than 255 characters.

  • When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.

  • After upgrading from 3.0.x to 3.1.x, in some cases GitHub Actions can fail with an error: An unexpected error occurred when executing this workflow. To workaround this problem, connect to the administrative shell (ssh) and run:

    ghe-actions-console -s actions -c "Queue-ServiceJob -JobId 4DB1F4CF-19FD-40E0-A253-91288813DE8B"
    
  • When a replica node is offline in a high availability configuration, GitHub Enterprise Server may still route GitHub Pages requests to the offline node, reducing the availability of GitHub Pages for users.

  • If GitHub Actions is enabled for GitHub Enterprise Server, teardown of a replica node with ghe-repl-teardown will succeed, but may return ERROR:Running migrations.

  • Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.

Enterprise Server 3.1.0

Download

June, 03, 2021

📣 This is not the latest patch release of this release series, and this is not the latest release of Enterprise Server. Please use the latest release for the latest security, performance, and bug fixes.

For minimum infrastructure requirements, see "About minimum requirements for GitHub Enterprise Server 3.0 and later."

Features

    GitHub Advanced Security Secret Scanning

  • Secret Scanning is now generally available on GitHub Enterprise Server 3.1+. Scan public and private repositories for committed credentials, find secrets, and notify the secret provider or admin the moment they are committed into a repository.

    This release includes several improvements from the beta of Secret Scanning on GitHub Enterprise Server:

    Administrators using GitHub Advanced Security can enable and configure GitHub Advanced Security secret scanning. You can review the updated minimum requirements for your platform before you turn on GitHub Advanced Security secret scanning.

  • GitHub Advanced Security billing improvements

  • This release includes several improvements to GitHub Advanced Security billing in GitHub Enterprise Server:

    • GitHub Advanced Security customers can now view their active committer count and the remaining number of unused committer seats on their organization or enterprise account’s Billing page. If Advanced Security is purchased for an enterprise, administrators can also view the active committer seats which are being used by other organizations within their enterprise. For more information, see "About GitHub Advanced Security licensing" and "Viewing your GitHub Advanced Security usage."
    • GitHub Advanced Security customers can now view their active committer count for any Advanced Security enabled repositories on their organization or enterprise account's Billing page. These changes help billing administrators track their usage against how many committer licenses they purchased. For more information see "Managing security and analysis settings for your organization."
  • Dependabot improvements

  • This release includes improvements to Dependabot alerts in GitHub Enterprise Server:

  • GitHub Actions Workflow Visualization beta

  • GitHub Actions can now generate a visual graph of your workflow on every run. With workflow visualization, you can:

    • View and understand complex workflows
    • Track progress of workflows in real-time
    • Troubleshoot runs quickly by easily accessing logs and jobs metadata
    • Monitor progress of deployment jobs and easily access deployment targets

    For more information, see "Using the visualization graph."

  • OAuth 2.0 Device Authorization Grant

  • OAuth 2.0 Device Authorization Grant allows any CLI client or developer tool to authenticate using a secondary system with a browser.

    Administrators using OAuth Apps and GitHub Apps can enable and configure OAuth 2.0 Device Authorization Flow, in addition to the existing Web Application Flow. You can review the updated minimum requirements for your platform before you enable OAuth 2.0 Device Authorization Flow.

  • Pull request auto-merge

  • With auto-merge, pull requests can be set to merge automatically when all merge requirements have been satisfied. This saves users from needing to constantly check the state of their pull requests just to merge them. Auto-merge can be enabled by a user with permission to merge and on pull requests that have unsatisfied merge requirements. For more information, see "Automatically merging a pull request."

  • Custom notifications

  • You can customize the types of notifications you want to receive from individual repositories. For more information, see "Configuring notifications."

  • GitHub Mobile filtering

  • GitHub for mobile filtering allows you to search for and find issues, pull requests, and discussions from your device. New metadata for issues and pull request list items allow you to filter by assignees, checks status, review states, and comment counts.

    GitHub for mobile beta is available for GitHub Enterprise Server. Sign in with our Android and iOS apps to triage notifications and manage issues and pull requests on the go. Administrators can disable mobile support for their Enterprise using the management console or by running ghe-config app.mobile.enabled false. For more information, see "GitHub for mobile."

Changes

    Administration Changes

  • By precomputing checksums, the amount of time a repository is under the lock has reduced dramatically, allowing more write operations to succeed immediately and improving monorepo performance.

  • The latest release of the CodeQL CLI supports uploading analysis results to GitHub. This makes it easier to run code analysis for customers who wish to use CI/CD systems other than GitHub Actions. Previously, such users had to use the separate CodeQL runner, which will continue to be available. For more information, see "About CodeQL code scanning in your CI system."

  • GitHub Actions now supports skipping push and pull_request workflows by looking for some common keywords in your commit message.

  • Check annotations older than four months will be archived.

  • Security Changes

  • Following feedback, display of Code Scanning results on a pull request without submitting with a pull request ID will remain supported. For more information, see "Configuring code scanning" and "Configuring CodeQL code scanning in your CI system.

  • SARIF upload support increased to a maximum of 5000 results per upload.

  • Developer Changes

  • You can specify multiple callback URLs while configuring a GitHub App. This can be used in services with multiple domains or subdomains. GitHub will always deny authorization if the callback URL from the request is not in the authorization callback URL list.

  • The GitHub App file permission has been updated to allow an app developer to specify up to 10 files for read-only or read-write access that their app can request access to.

  • CodeQL now supports more libraries and frameworks for a variety of languages (C++, JavaScript, Python,Java, Go). The CodeQL engine can now detect more sources of untrusted user data, which improves the quality and depth of the code scanning alerts. For more information, see "About CodeQL."

  • When configuring a GitHub App, the authorization callback URL is a required field. Now, we allow the developer to specify multiple callback URLs. This can be used in services with multiple domains or subdomains. GitHub will always deny authorization if the callback URL from the request is not in the authorization callback URL list.

  • Delete an entire directory of files, including subdirectories, from your web browser. For more information, see "Deleting a file or directory."

  • Include multiple words after the # in an issue, discussion, or pull request comment to further narrow your search.

  • When you’re writing an issue, pull request, or discussion comment the list syntax for bullets, numbers, and tasks autocompletes after you press return or enter.

  • API Changes

  • The code scanning API allows users to upload data about static analysis security testing results, or export data about alerts. For more information, see the code scanning API reference.

  • The GitHub Apps API for managing installations has now graduated from an API preview to a generally available API. The preview header is no longer required to access these endpoints.

Security fixes
  • MEDIUM Under certain circumstances, users who were removed from a team or organization could retain write access to branches they had existing pull requests opened for.

  • Packages have been updated to the latest security versions.

Bug fixes

    Fixes for known issues from Release Candidate

  • All known issues from Release Candidate 1 have been fixed, except those listed in the Known Issues section below.

  • Fixes for other issues

  • On the "Configure Actions and Packages" page of the initial installation process, clicking on the "Test domain settings" button did not complete the test.

  • Running ghe-btop failed with an error and cannot find a babeld container.

  • MySQL could reload and cause downtime if you change auto failover settings.

  • After upgrading, a mismatch of internal and external timeout values created service unavailability.

  • Expected replication delays in MSSQL generated warnings.

  • Link to "Configuring clustering" on the Management Console was incorrect.

  • When creating or editing a pre-receive hook, a race condition in the user interface meant that after selecting a repository, files within the repository were sometimes not populated in files dropdown.

  • When an IP address is added to a whitelist using "Create Whitelist Entry" button, it could still be shown as locked out.

  • References to the "Dependency graph" and "Dependabot alerts" features were not shown as disabled on some repositories.

  • Setting an announcement in the enterprise account settings could result in a 500 Internal Server Error.

  • HTTP POST requests to the /hooks endpoint could fail with a 401 response due to an incorrectly configured hookID.

  • The build-server process failed to clean up processes, leaving them in the defunct state.

  • spokesd created excessive log entries, including the phrase "fixing placement skipped".

  • While upgrading Actions the upgrade could fail if the instance could not make self-requests via its configured hostname.

  • Upgrading from 2.22.x to 3.1.0.rc1 could result in a database migration error relating to the BackfillIntegrationApplicationCallbackUrlsTransition data transition.

Known issues
  • Access to a repository through the administrative shell using ghe-repo <owner>/<reponame> will hang. As a workaround, use ghe-repo <owner>/<reponame> -c "bash -i" until a fix is available in the next version.

  • The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.

  • On a freshly set up GitHub Enterprise Server without any users, an attacker could create the first admin user.

  • Custom firewall rules are not maintained during an upgrade.

  • Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.

  • Issues cannot be closed if they contain a permalink to a blob in the same repository where the file path is longer than 255 characters.

  • When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.

  • Upgrading an instance that has previously ran a 2.13 release, but not a 2.14 release, results in a database migration error relating to the AddRepositoryIdToCheckRuns data transition.

  • After upgrading from 3.0.x to 3.1.x, in some cases GitHub Actions can fail with an error: An unexpected error occurred when executing this workflow. To workaround this problem, connect to the administrative shell (ssh) and run:

    ghe-actions-console -s actions -c "Queue-ServiceJob -JobId 4DB1F4CF-19FD-40E0-A253-91288813DE8B"
    
  • When a replica node is offline in a high availability configuration, GitHub Enterprise Server may still route GitHub Pages requests to the offline node, reducing the availability of GitHub Pages for users.

  • Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.

Deprecations
Backups

Did this doc help you?

Privacy policy

Help us make these docs great!

All GitHub docs are open source. See something that's wrong or unclear? Submit a pull request.

Make a contribution

Or, learn how to contribute.