November 12, 2024
Note
Release candidate (RC) builds are intended solely for use in a test environment. Do not install an RC in a production environment.
Do not upgrade to an RC from a supported, earlier version.
If your GitHub Enterprise Server instance is running an RC, you cannot upgrade to the general availability (GA) release. You also cannot upgrade with a hotpatch.
For upgrade instructions, see "Overview of the upgrade process."
3.15.0-rc.1: Features
Instance administration
New installations of GitHub Enterprise Server version 3.15 and upgrades to 3.15 now require a root disk size of at least 400GB. Otherwise, the system will not boot. For more information on how to increase the root disk size in the appliance, see "Increasing storage capacity."
Minimum recommended requirements for vCPUs, memory, root storage, and data storage have been updated. See "Installing GitHub Enterprise Server on VMware."
Audit logs
Organization owners and security managers can monitor changes to the use of security configurations at the organization and repository levels. See "About enabling security features at scale,"
security_configuration
, andrepository_security_configuration
.
Code scanning
Users can run CodeQL analysis of C# code without building the project,
build-mode: none
. When you enable code scanning using default setup on a repository, both Java and C# use this mode. Analysis of both languages using this method is generally available. See "About build mode None for CodeQL."CodeQL analysis of Swift and Kotlin code is generally available.
This release comes installed with version 2.18.4 of the CodeQL CLI, used in the CodeQL action for code scanning. Significant updates since the default version installed on GitHub Enterprise Server 3.14 include:
- Support for Go 1.23 and TypeScript 5.5
- C# can now use
build-mode: none
, which allows scanning C# code without requiring working builds - Kotlin & Swift support for mobile applications is generally available
- Java
build-mode: none
analyses only report a warning on the tool status page when significant analysis problems are detected - Two new JavaScript queries,
js/functionality-from-untrusted-domain
, have been added to detect usage of scripts from untrusted domains, includingpolyfill.io
content delivery network andjs/insecure-helmet-configuration
to detect instances where important Helmet security features are disabled - The precision of
cpp/iterator-to-expired-container
&cpp/unsafe-strncat
have been increased to high
Secret scanning
Secret scanning for discussions, issues, and pull request titles, bodies, and comments is now generally available. See "About secret scanning."
Users can bypass push protection using the existing
Create a blob
andCreate or update file contents
REST API endpoints. This action can also be performed programmatically using the newCreate a push protection bypass
API endpoint. See the GitHub Blog post.Organization owners can enable the detection of non-provider patterns for their organization using a security configuration. This feature is in public beta and is subject to change. See "Enabling detection of non-provider patterns for an organization."
Dependabot
Organization owners, security managers and users with admin access can manage Dependabot auto-triage rules, as well as create custom auto-triage rules. Auto-triage rules are a powerful tool that automatically dismiss Dependabot alerts matching certain criteria. This feature is generally available. See "About Dependabot auto-triage rules."
GitHub Connect
For enterprises with a deployment of GitHub Enterprise Cloud on GHE.com, automatic license sync is supported from GitHub Enterprise Server to GHE.com.
GitHub Advanced Security
Organization owners and security managers can use a "CodeQL pull request alerts" view in security overview to proactively identify and mitigate security risks at the organization and enterprise level. For example, they can see the most common alerts found in pull requests and see the corresponding remediation rates. See "Viewing metrics for pull request alerts."
Code security
Organization owners and security managers can simplify the rollout of GitHub security products at scale with security configurations. They can define collections of security settings, save them as a custom configuration, and apply them across groups of repositories. Security configurations can be enforced using policies to stop repositories making any changes to the enablement of security features. See "About enabling security features at scale."
Organization owners and security managers can create, apply, enforce, and monitor security configurations programmatically using REST API calls and audit logs. See "Configurations" and
security_configuration
.
GitHub Actions
For self-hosted GitHub Actions runners on this GitHub Enterprise Server release, the minimum required version of the GitHub Actions Runner application is 2.319.1. See the release notes for this version in the
actions/runner
repository. If your instance uses ephemeral self-hosted runners and you've disabled automatic updates, you must upgrade your runners to this version of the Runner application before upgrading your instance to this GitHub Enterprise Server release.
GitHub Packages
Package managers benefit from improved performance as the npm registry no longer includes README content in package version metadata, reducing the size of package packuments (metadata manifest). This change enhances registry and npm CLI efficiency.
Repositories
Users can use new property types when creating a custom property:
Multi select
andTrue/False
.Users can gain deeper insights into contributors and code frequency with enhanced focus navigation, and a new table format for viewing and downloading data.
Users can require that merges must be performed with a merge queue at the repository level. For more information about merge queues, see "Merging a pull request with a merge queue."
Admins can enforce status checks and workflow runs on existing refs while allowing the creation of new refs.
Organization members can use the new repository view and advanced filters to find repositories by visibility, language, custom properties, size, license, and more.
Projects
Users can interact with project status updates programmatically using the
ProjectV2StatusUpdate
GraphQL object and theprojects_v2_status_update
webhook event. See GitHub Issues & Projects on the GitHub Blog.For better accessibility, swimlanes and card titles have heading elements attached to them.
Project custom field changes are included directly in the project_v2_item webhook event when a project item's fields are edited, allowing users to understand how project fields change over time and how long they have a particular value.
Accessibility
Users can navigate and dismiss hovercards using keyboard shortcuts, enhancing accessibility. Additionally, a new setting allows users to disable all hovercards.
Math equations are rendered with standardized MathML, replacing custom HTML MathJax to enhance accessibility and security. While most users will see minimal changes, slight differences in font and alignment may occur.
The light and dark high contrast themes have been updated to improve readability.
Integrations and extensions
The
client_id
field is included in all API responses that describe a GitHub App. This is part of a shift to use the client ID as the primary identifier for an app. See Client IDs are now included in App API responses on the GitHub Blog.When users go through the device code flow for an OAuth app, such as the GitHub CLI, they are prompted to use an account picker if they have multiple accounts.
3.15.0-rc.1: Changes
The API endpoint for listing custom deployment rule integrations for an environment (
GET /repos/{owner}/{repo}/environments/{environment_name}/deployment_protection_rules/apps
) requires "Administration" repository permissions (read) for fine-grained tokens. Previously, the token required "Actions" repository permissions (read).Pushes that update over 5,000 branches no longer trigger webhooks or GitHub Actions workflows.
Organization owners and security managers will see a new organization-level code security settings UI. In the organization settings sidebar, the Code security and analysis option has been replaced by an expanding Code security option. This contains new Configurations and Global settings options. See "About enabling security features at scale."
3.15.0-rc.1: Known issues
Note: This list is not complete. Any new known issues that are identified for the 3.15 release will be added between now and the GA.
An organization-level code scanning configuration page is displayed on instances that do not use GitHub Advanced Security or code scanning.
When initializing a new GHES cluster, nodes with the
consul-server
role should be added to the cluster before adding additional nodes. Adding all nodes simultaneously creates a race condition between nomad server registration and nomad client registration.Attempting to stop replications after stopping GitHub Actions on a GHES instance would fail, reporting that MSSQL was not responding. This can be avoided by starting MSSQL prior to stopping replication by running
/usr/local/share/enterprise/ghe-nomad-jobs queue /etc/nomad-jobs/mssql/mssql.hcl
.Admins setting up cluster high availability (HA) may encounter a
spokes
error when runningghe-cluster-repl-status
if a new organization and repositories are created before using theghe-cluster-repl-bootstrap
command. To avoid this issue, complete the cluster HA setup withghe-cluster-repl-bootstrap
before creating new organizations and repositories.During the validation phase of a configuration run, a
No such object
error may occur for the Notebook and Viewscreen services. This error can be ignored as the services should still correctly start.If the root site administrator is locked out of the Management Console after failed login attempts, the account does not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. See "Troubleshooting access to the Management Console."
On an instance with the HTTP
X-Forwarded-For
header configured for use behind a load balancer, all client IP addresses in the instance's audit log erroneously appear as 127.0.0.1.In some situations, large
.adoc
files stored in a repository do not render properly in the web UI. The raw contents are still available to view as plaintext.Repositories originally imported using
ghe-migrator
will not correctly track GitHub Advanced Security contributions.Admin stats REST API endpoints may timeout on appliances with many users or repositories. Retrying the request until data is returned is advised.
When following the steps for Replacing the primary MySQL node, step 14 (running
ghe-cluster-config-apply
) might fail with errors. If this occurs, re-runningghe-cluster-config-apply
is expected to succeed.Running a
config apply
as part of the steps for Replacing a node in an emergency may fail with errors if the node being replaced is still reachable. If this occurs, shutdown the node and repeat the steps.If a hotpatch upgrade requires the
haproxy-frontend
service to be restarted, the restart will hang if there are existing long-lived connections, such as browser web sockets or Git operations. No new connections will be accepted for up to 5 minutes. Any existing unfinished connections at this time will be disconnected.When restoring data originally backed up from a 3.13 appliance onto a 3.13 appliance, the Elasticsearch indices need to be reindexed before some of the data will show up. This happens via a nightly scheduled job. It can also be forced by running
/usr/local/share/enterprise/ghe-es-search-repair
.An organization-level code scanning configuration page is displayed on instances that do not use GitHub Advanced Security or code scanning.
In the header bar displayed to site administrators, some icons are not available.
When enabling automatic update checks for the first time in the Management Console, the status is not dynamically reflected until the "Updates" page is reloaded.
When restoring from a backup snapshot, a large number of
mapper_parsing_exception
errors may be displayed.Services may respond with a
503
status due to an out of datehaproxy
configuration. This can usually be resolved with aghe-config-apply
run.Customers doing feature version upgrade to 3.14.3 may experience issues with database migrations due to data issues during database conversions.
When operating in a high availability configuration, running
ghe-repl-promote
on a replica node may fail if the original primary cannot be reached by the replica node. This is because theghe-repl-promote
script attempts to decommission all Elasticsearch nodes other than the promoted node, however these requests are made to the original primary node which is no longer reachable. The error message will be similar to:Maintenance mode has been enabled for active replica <REPLICA_HOSTNAME> {"message": "No server is currently available to service your request. Sorry about that. Please try resubmitting your request and contact your local GitHub Enterprise site administrator if the problem persists."} jq: error (at :3): Cannot index string with string "node"
[Updated: 2024-11-13]
3.15.0-rc.1: Closing down
In GitHub Enterprise Server 3.16, the
/explore
functionality, including theActivity
andTrending
pages, will be removed.
3.15.0-rc.1: Retired
We are closing down the API endpoints and parameters that complemented the old organization-level code security settings UI experience. These have been replaced by a new API for security configurations. See "Configurations."
- Retired: The GET response for security product status in an organization: Get an organization is deprecated. This attribute will return inaccurate information.
- Retired: The PATCH functionality for security products to set a default status for new repos in an organization: Update an organization is deprecated. The PATCH operation may return an error or will not perform the PATCH or will be ignored.
- Retired: The POST endpoint to enable or disable a security feature for all repositories in an organization: Enable or disable a security feature for an organization is deprecated. The POST will be ignored.
The Management Console API has been removed. The Manage GHES API reached feature parity with the Management Console API in GitHub Enterprise Server version 3.12. For information about the Manage GHES API, see "REST API endpoints for managing GitHub Enterprise Server."