3.20.1 - 2026-10-29

❤️ Thanks to all contributors! ❤️

@6543, @lafriks

🐛 Bug Fixes

• Restore drone envsubst [#7433]
• Fix step lop group UX [#7431]

📦️ Dependency

• Update golang-packages [#7426]

3.20.0 - 2026-10-28

⚠️ this release has an unintended breaking change [#7398], use 3.20.1

❤️ Thanks to all contributors! ❤️

@6543, @AhmadNajiKam, @AkashKumar7902, @CamiloEspinoza, @Javex, @M0Rf30, @MannXo, @Mihir-Rabari, @PatelFarhaan, @Sawarz, @Sriram-PR, @YouCD, @aniketatgithub, @arcaartem, @asyntai, @carstenschmidt77, @confusedsushi, @cuducos, @eknathdj, @fredrikblau, @lafriks, @njaaazi, @pcbeingused333, @qwerty287, @roian6, @sugar700, @supertj, @tritsystem, @wolffberg, @xoxys

Special thanks to @baradika for reporting a security vulnerability

🔒 Security

• Remove agent token from process os environments [#7412]
• Make sure CLI self-update can target cli install dir only [#7400]
• Document security boundaries [#7281]
• Keep revoked env admins revoked until the server restarts [#7403]
• Fix gitlab to set tag pipeline author from webhook metadata [#7397]
• Update module github.com/woodpecker-ci/envsubst to v1.2.0 [#7398]
• Rotate repo JWT on repo repair [#7361]
• Fix and harden config fetching [#7386]
• Enhance matrix feature [#7353]
• Recover from config parsing panic in server [#7348]
• Fix server panics while parsing config [#7336]
• Only link http(s) error URIs on the login page [#7318]
• Do not log bearer credentials at trace level [#7317]
• Fall back to read only if the forge permission sync fails [#7282]
• Quote all YAML line breaks in environment substitution [#7283]

✨ Features

• Add support for selecting workflow to run for manual pipelines [#7393]
• Add option to restrict organization and user to use its agents only [#7359]
• Make CLI lint prefer detected Woodpecker config [#6634]

📈 Enhancement

• Send restart flag to the HTTP config extension [#7384]
• Harden store scoping for org-level secret and registry retrieval [#7365]
• Add CI_REPO_ID environment variable [#7295]
• Replace pipeline author on deploy with session user [#7358]
• Switch to the woodpecker-ci envsubst fork [#7349]
• StepFinished of log store return error now [#7346]
• Speed up queue scheduling calculations [#7303]
• Allow selecting the forge when creating a user [#7314]
• Drop reviewer metadata when restarting a pipeline [#7287]
• Indicate permission fallback in webui [#7285]
• lint against tag align in golang [#7292]
• Rework dark theme [#7263]
• Persist queue paused state across server restarts [#7256]

🐛 Bug Fixes

• Fix server panic when saving workflows fails [#7401]
• Fix depends_on workflows running after failed dependency on queue reload [#7395]
• Resolve commit SHA for annotated tags for gitlab, gitea and forgejo [#7394]
• Fix nushell quoting for command in local backend [#7294]
• Make workflow collapsible behavor consistent [#7367]
• For kubernetes do not report unknown deleted pods as successful [#7357]
• Make agent respect keepalive time and timeout flags [#7351]
• Forward OOM error correctly [#7313]
• Enable crons created without enabled field [#7339]
• Fix file based logstore related bugs [#7323]
• Use merge request IID in GitLab pull request list [#7259]
• Retry pipeline creation on SQLite database lock [#7264]
• Do not retry extensions that respond with 204 No Content [#7320]
• Return an error when Kubernetes backend options cannot be parsed [#7312]
• Persist token expiry when existing users sign in [#7304]
• Fix quoting windows container [#7293]
• Fix PowerShell-specific quoting for commands in local backend [#7290]
• Ignore GitLab tag deletion webhooks [#7289]
• Fix Docker backend with TLS and a custom host [#7269]
• Force oauth2 token exchange in forge Refresh for Gitea, GitLab, Forgejo and GitHub [#7167]
• Fix 'Repair Repository' failing for Bitbucket Datacenter repos with spaces in their name [#7261]
• For Gitlab resolve group-inherited project permissions for repos [#7172]

🧪 Tests

• Enable test context checks in usetesting [#7414]
• Enforce make syntax for empty maps [#7406]
• Require scheduler_mocks import name [#7341]
• Increase test coverage of server/forge and server/servies [#7319]
• Count cross-package coverage in all Go test targets [#7316]

📚 Documentation

• Update dependency @types/node to v26 [#7422]
• Update docs npm deps non-major [#7420]
• Add Supabase Backup plugin [#7410]
• Document how to install the CLI [#7360]
• Add OpenArtifact plugin [#7378]
• Add concurrency option to Workflow Syntax docs [#7369]
• Add Reviewdog PHPCS, PHPMD and PHPStan plugins [#7347]
• Document missing server and backend environment variables [#7335]
• Remove Codeberg Pages Deploy plugin [#7325]
• Update and extend development docs [#7248]
• Add Asyntai AI Chatbot Docs Sync to plugins [#7298]
• Extend / Update awesome list [#7243]

📦️ Dependency

• Update Node.js to v26 [#7421]
• Update woodpeckerci/plugin-git to v2.11.0 [#7375]

Misc

• Check for a migration note on breaking pull requests [#7249]

3.19.0 - 2026-10-07

❤️ Thanks to all contributors! ❤️

Special thanks to @vibushasatheeshkumar for reporting a security vulnerability!

@6543, @ChrisJr404, @KR-Ravindra, @LaGrunge, @cacarico, @chiliec, @confusedsushi, @grisu48, @healdropper, @hsdfat, @jagerman, @joseph0531, @lafriks, @mattwilkinsonn, @qwerty287, @roian6, @sb123sb123, @somaz94, @spatterIight, @tehlordvortex, @thiagola92, @tunglambk, @usiegj00, @xoxys

🔒 Security

• Prevent injection of matrix env vars into default clone step [#7157]

✨ Features

• Local backend gets support for custom shell paths [#7194]
• Server side enforced agent labels [#4131]

📈 Enhancement

• CLI exec sanitize secrets too [#6877]
• Harmonize unit test patterns [#7229]
• Generalize log output groups [#7226]
• Include HTTP status in Bitbucket errors without a message [#7227]
• Add default user namespace support with configurable non-root override [#6943]
• Adopt Golang v1.27 [#7153]
• Store workflow/step dependencies in database and update API [#6130]
• Fix/docs deps and flaky test [#7204]
• Add AgentListWithOpts with pagination options [#7155]
• Use more unique sign to detect commands [#7122]
• Run swaggo in golangci-lint [#7121]
• feat(agent): add CI_AGENT_ID and CI_AGENT_LABELS runtime env vars [#7070]

🐛 Bug Fixes

• Fix step logs lost when pipeline ends with skipped workflows [#7240]
• Release agents waiting on long polls during server shutdown [#7189]
• Add version endpoint to API as per spec [#7232]
• Accept host:port registry addresses [#7235]
• Fix queue scheduler debug log spam [#7224]
• Fix infinite hook pagination loop on Bitbucket Cloud [#7210]
• Wait for informer cache sync before checking pod deletion [#7158]
• Fix race condition on concurrent pipeline config persist [#7192]
• Reload user from store before refreshing OAuth token [#7176]
• Ignore GitLab rejecting a commit status transition [#7217]
• Fix workspace volume mismatch when using CLI exec with the Kubernetes backend [#7150]
• Fix CLI shell completion [#7203]
• Fix url including when combined with ansi escapes [#7196]
• Fix nix dev env by disable static linking and make pnpm work again [#7193]
• Fix data race in SSE stream handlers when the client disconnects early [#7139]
• Disable cmd.exe AutoRun commands for local pipelines on Windows [#7162]
• Restart a pipeline that errored before its config was persisted [#7120]
• Ignore directories while fetching files [#7145]
• Skip short multi-line secret lines [#7144]
• Fix agent panic in local backend cleanup when a workflow is canceled before a step started [#7132]
• Report an in-setup pipeline status as pending on all forges [#7118]
• Update CLI command in CLI & API example [#7129]
• Fix crash rendering a pipeline with a stepless workflow [#7119]

📚 Documentation

• Harmonize secrets docs [#7236]
• Clarify secret precedence order [#7233]
• Fix docs link in systemd example unit [#7222]
• Update pnpm to v12.9.1 [#7219]
• Use CI to update latest version on mastodon profile [#7179]
• Update dependency @types/node to v25.9.9 [#7211]
• Update docs npm deps non-major [#7208]
• Update docs npm deps non-major [#7186]
• Add MASH to awesome list [#7191]
• docs: document manual Linux binary installation [#7160]

📦️ Dependency

• Update module gitlab.com/gitlab-org/api/client-go/v3 to v3.16.0 [#7234]
• Update dependency @vueuse/core to v15 [#7212]
• Update dependency dotenv to v18 [#7213]
• Update module github.com/google/go-github/v91 to v92 [#7200]
• Update module gitlab.com/gitlab-org/api/client-go/v2 to v3 [#7201]
• Update docker.io/woodpeckerci/plugin-codecov Docker tag to v2.3.3 [#7199]
• Update golangci/golangci-lint Docker tag to v2.13.1 [#7057]
• Update dependency mvdan/gofumpt to v0.12.0 [#7185]
• Update woodpeckerci/plugin-release Docker tag to v0.3.2 [#7184]
• Update docker.io/woodpeckerci/plugin-surge-preview Docker tag to v1.4.3 [#7182]
• Update docker.io/woodpeckerci/plugin-trivy Docker tag to v1.6.1 [#7183]
• Update docker.io/woodpeckerci/plugin-docker-buildx Docker tag to v6.1.2 [#7180]
• Update docker.io/woodpeckerci/plugin-editorconfig-checker Docker tag to v0.3.4 [#7181]
• Update dependency simple-icons to v16.31.0 [#7138]
• Update woodpeckerci/plugin-git Docker tag to v2.10.1 [#7135]

Misc

• Remove remainig gitpod artifacts [#7216]

3.18.1 - 2026-09-09

❤️ Thanks to all contributors! ❤️

@6543, @YouCD, @dylanpulver, @lafriks, @mattwilkinsonn, @qwerty287

🔒 Security

• Fix docs securityscan [#7094]

🐛 Bug Fixes

• Add timezone data to docker images [#7093]
• Log an expected log-stream close failure at debug instead of error [#7117]
• Log a filtered webhook at debug instead of error [#7116]
• Fix workflow-level when.status so a failure-only workflow does not run on success [#7091]
• Speedup migration "deduplicate-log-entries" [#7068]
• fix(forge/gitlab): use group Path instead of Name for membership lookup [#7086]
• Fix injecting additional variables for substituting [#7077]

🧪 Tests

• Add test to verify that additional envs from manual run are available to when conditions [#7090]

📚 Documentation

• Fix RPM URL [#7124]
• Update dependency isomorphic-dompurify to v4 [#7097]
• Update pnpm to v11.25.0 [#7095]
• Update docs npm deps non-major [#7083]

📦️ Dependency

• Update golang-packages [#7112]
• Update web npm deps non-major [#7107]
• Lock file maintenance [#7113]
• Update golang-packages [#7106]
• Update pnpm to v12 [#7108]
• Update dependency eslint to v10.10.0 [#7105]
• Update dependency vitest to v5 [#7098]
• Update module github.com/google/go-github/v90 to v91 [#7099]
• Lock file maintenance [#7100]
• Update web npm deps non-major [#7096]
• Update golang-packages [#7092]
• Update module gitlab.com/gitlab-org/api/client-go/v2 to v2.61.0 [#7088]
• Lock file maintenance [#7087]
• Update dependency simple-icons to v16.29.0 [#7082]
• Update module github.com/getkin/kin-openapi to v0.149.0 [#7084]
• Update web npm deps non-major [#7081]
• Update pre-commit hook golangci/golangci-lint to v2.13.2 [#7080]
• Update golang-packages [#7075]
• Update golang-packages [#7071]

Misc

• Makefile enhancement [#7067]

3.18.0 - 2026-08-24

⚠️ This release contains a migration that alters log storage. Depending on the number of stored log lines, it can take a while to complete. Back up before upgrading and allow for extra downtime.

❤️ Thanks to all contributors! ❤️

Special thanks to @arpitjain099, @abdullaabdullazade, @George928 and @RealFakeAccount for reporting security vulnerabilities!

@6543, @AhmadNajiKam, @DEATIN, @OCram85, @Palleas, @YouCD, @anbraten, @confusedsushi, @gerbsen, @hasufell, @jrouly, @kastl-ars, @lafriks, @qwerty287, @retif, @romain-rossi, @spam-n-eggs, @stevapple, @xoxys, @zmully

🔒 Security

• k8s: allow to disable runtime class name backend option [#7046]
• Don't inject additional env vars into plugins [#7040]
• Don't inject matrix env vars into plugins [#7036]
• Update golang.org/x/mod [#7012]
• Change group identifier to full_path for GitLab [#6950]

📈 Enhancement

• Allow to add custom message to manual pipelines [#6973]
• Add hidden decode-base64 agent command for Windows local backend [#7023]
• Enforce unique name for services and steps if dag is used [#7032]
• Add custom list opts with all [#6992]
• Add pipeline log download endpoint [#6876]
• Reject invalid started and done workflow states [#7029]
• Sort workflow files by name [#7021]
• Reject incompatible gRPC proto version agents [#7028]
• Enforce one log entry per line with a unique index [#7004]
• Order the user feed by creation time instead of id [#7005]
• Return step logs strictly in line order [#6999]
• Find the preceding pipeline by number instead of id [#7003]
• perf(schema): cache compiled YAML validation schema [#7002]
• Pick a repo's latest pipeline by number instead of id [#7001]
• feat: allow configuring allowed orgs per forge [#6874]
• Make the Kubernetes cluster domain configurable [#6957]
• Fix vite deprecation [#6974]
• feat(web): extract ListEditor form component [#6962]
• Rename WOODPECKER_GRPC_VERIFY to WOODPECKER_GRPC_SKIP_VERIFY [#6947]
• Update frontend schema.json for documented backend options [#6933]

🐛 Bug Fixes

• Prevent repository buttons from overlapping search bar [#7047]
• fix(server): prefix manual trigger Ref with refs/heads/ [#7051]
• fix runtime to ignore cancel as runtime error [#7031]
• Fix orphaned pipelines after repo delete [#6971]
• Migrate modernize encryption service [#6830]
• Fix running multiple cmdlets on windows [#6968]
• server: drop stale queued tasks for terminal workflows [#7015]
• fix(gitlab): avoid N+1 member lookups in Repos() [#6991]
• agent: retry connect on DeadlineExceeded, not just Unavailable [#6975]

📚 Documentation

• Update pnpm to v11.23.0 [#7061]
• Update dependency marked to v18.0.10 [#7052]
• k8s backend: fix step example using incorrect "detached" property [#7016]
• Update docs npm deps non-major [#7010]
• highlight the nodeSelector doesn't work by default [#7007]
• Update pnpm to v11.21.0 [#6982]
• Update docs npm deps non-major [#6979]
• Update documentation link for NestGuard plugin [#6954]
• Make intro example actually usable [#6953]
• Update docs npm deps non-major [#6925]
• Fix old link to Gitea docs [#6932]

📦️ Dependency

• Update web npm deps non-major [#7060]
• Lock file maintenance [#7062]
• Update web npm deps non-major [#7054]
• Update woodpeckerci/plugin-git Docker tag to v2.10.0 [#7059]
• Update docker.io/golang Docker tag to v1.27 [#7055]
• Update pre-commit hook golangci/golangci-lint to v2.13.1 [#7058]
• Update docker.io/techknowlogick/xgo Docker tag to go-1.27.x [#7056]
• Update module gitlab.com/gitlab-org/api/client-go/v2 to v2.58.2 [#7053]
• Update golang-packages to v0.36.4 [#7050]
• Update golang-packages [#7045]
• Update module github.com/getkin/kin-openapi to v0.147.0 [#7039]
• Update module github.com/urfave/cli/v3 to v3.11.0 [#7017]
• Lock file maintenance [#7018]
• Update web npm deps non-major [#7009]
• Update module gitlab.com/gitlab-org/api/client-go/v2 to v2.58.0 [#7014]
• Update postgres Docker tag to v18.6 [#7011]
• Update dependency golang to v1.26.6 [#7008]
• Update module golang.org/x/net to v0.58.0 [#6996]
• Update module golang.org/x/crypto to v0.55.0 [#6994]
• Update module google.golang.org/protobuf to v1.36.12 [#6989]
• Update pnpm to v11.21.0 [#6983]
• Update dependency eslint to v10.8.1 [#6977]
• Update module github.com/google/go-github/v89 to v90 [#6980]
• Update google.golang.org/protobuf digest to 644d026 [#6976]
• Update woodpeckerci/plugin-git Docker tag to v2.9.3 [#6978]
• Update web npm deps non-major [#6939]
• Update module github.com/docker/cli to v29.7.2+incompatible [#6966]
• Update web npm deps non-major [#6928]

Misc

• Remove gitpod [#7013]
• Drop star-history [#6997]
• Do not run openapi generation twice on fail [#6987]

3.17.0 - 2026-07-31

❤️ Thanks to all contributors! ❤️

@6543, @AnayGarodia, @DerRockWolf, @Kernald, @Komzpa, @OCram85, @TowyTowy, @cyphercodes, @glitch-ux, @healdropper, @ivanvc, @jleider, @kanywst, @nicolasbatistoni, @qwerty287, @rfinnie, @roian6, @xoxys, @youdie006, @zmully

🔒 Security

• Update module github.com/getkin/kin-openapi to v0.144.0 [SECURITY] [#6896]
• Make grpc secret autogenerated [#6845]
• Gate Kubernetes nodeSelector backend step config behind agent config [#6809]

✨ Features

• WebUI: show runtime workflow errors [#6577]

📈 Enhancement

• Add Docker backend AppArmor profile option [#6909]
• refactor: rework k8s utils to handle resource names and labels [#6855]
• Make matrix axis permutation order deterministic [#6847]
• feat(server): add unix socket permission option [#6839]
• Add step type label to step-level Prometheus metrics [#6824]
• Stamp trusted commit-branch and event pod labels [#6802]
• Rename CI_COMMIT_PRERELEASE to CI_PIPELINE_RELEASE_PRE [#6794]
• Rework pipeline data structure: Release & Tag [#6774]

🐛 Bug Fixes

• fix(server): guard DAG cycle check against filtered-out optional dependencies [#6915]
• all yaml unmarshalling should use maxDepth [#6911]
• Don't count step error as workflow runtime error [#6904]
• Do not allow 0 minute timeout [#6903]
• Fix pipeline queue default template data [#6906]
• Use toLabelValue instead of toDNSName in Kubernetes step label [#6890]
• ReFetch secrets on pipeline restart [#6857]
• fix(forgejo): treat 404 on empty repos as empty pull request list [#6872]
• fix(github): resolve tag pagination loop in release hook [#6870]
• Fix CreatePipeline retry [#6859]
• WebUI: unregister scaffold Tab on unmount and stable Tab order [#6842]
• WebUI: Fixes three bugs around component unmount and reset in compositions [#6843]
• fix(server): heal users left on forge_id=0 with closed registration [#6823]
• Correct forge_id and org handling on user/repo [#6820]

🧪 Tests

• Add fuzz target to make [#6828]
• Add mock for server scheduler [#6848]

📚 Documentation

• Remove dependency overrides [#6912]
• Document CLI configuration [#6899]
• Update pnpm to v11.17.0 [#6892]
• Update docs npm deps non-major [#6835]
• docs: document the scope of built-in environment variables [#6879]
• Add NestGuard plugin to plugins.json [#6873]
• Minor adjustments for API usage example [#6605]
• docs: add note about pull_request events with path filter and correct comment about on_empty [#6819]
• Update docs npm deps non-major [#6788]

📦️ Dependency

• Update dependency mvdan/gofumpt to v0.11.0 [#6926]
• Lock file maintenance [#6931]
• Update docker.io/mysql Docker tag to v26 [#6930]
• Update dependency jsdom to v30 [#6929]
• Update pre-commit hook hadolint/hadolint to v2.15.1 [#6927]
• Update golang-packages [#6920]
• Update module github.com/mattn/go-sqlite3 to v1.14.49 [#6919]
• Update module gitlab.com/gitlab-org/api/client-go/v2 to v2.53.0 [#6917]
• Update golang-packages [#6910]
• Update web npm deps non-major [#6894]
• Lock file maintenance [#6901]
• Update module github.com/docker/go-connections to v0.8.0 [#6900]
• Update dependency fast-uri to v4 [#6897]
• Update golang-packages [#6889]
• Update dependency brace-expansion to v5 [#6895]
• Update pre-commit hook rbubley/mirrors-prettier to v3.9.6 [#6893]
• Update golang-packages [#6883]
• Update web npm deps non-major [#6866]
• Update golang-packages [#6867]
• Update pnpm to v11.15.0 [#6865]
• Update pre-commit hook igorshubovych/markdownlint-cli to v0.49.1 [#6861]
• Update dependency pinia to v4 [#6864]
• Update gitea/gitea Docker tag to v1.27 [#6863]
• Update web npm deps non-major [#6862]
• Update docker.io/woodpeckerci/plugin-ready-release-go Docker tag to v4.1.2 [#6860]
• Update golang-packages [#6858]
• Update web npm deps non-major [#6815]
• Update golang-packages [#6821]
• Update docker.io/woodpeckerci/plugin-docker-buildx Docker tag to v6.1.1 [#6834]
• Update docker.io/woodpeckerci/plugin-codecov Docker tag to v2.3.2 [#6833]
• Update dependency golang to v1.26.5 [#6832]
• Update golang-packages [#6785]
• Lock file maintenance [#6816]
• Update pnpm to v11.10.0 [#6814]
• Update module github.com/cenkalti/backoff/v6 to v7 [#6812]
• Update web npm deps non-major [#6787]
• Lock file maintenance [#6799]

3.16.0 - 2026-06-27

❤️ Thanks to all contributors! ❤️

@6543, @AkashKumar7902, @M31ancholy, @MeurillonGuillaume, @WeslleyNasRocha, @gedankenstuecke, @head1328, @mahlzahn, @mmeier86, @nati737, @nijave, @qwerty287, @simonckemper, @simonmeyerrr

🔒 Security

• Gate Kubernetes serviceAccountName backend step config behind agent config [#6792]
• Harden agent rpc to check agentID on workflow [#6759]
• Security updates for js dependencies [#6737]
• bump go.mongodb.org/mongo-driver v1.17.6 => v1.17.7 [#6741]
• Update joi [#6728]

✨ Features

• Add workflow concurrency limit option [#6671]
• Support Unix Sockets [#6721]

📈 Enhancement

• Kubernetes: allow custom image when precreating workingDir as nonroot [#6771]
• Server can move pipeline parsing into background on long creation times [#6781]
• Add CI_COMMIT_PULL_REQUEST_DRAFT environment variable [#6778]
• Make LogEntry Buffer configurable for agent [#6773]
• Agent treat gRPC Internal error as fatal [#6780]
• Refactor to inject store and context into server scheduler [#6755]
• Refactor server scheduler collect in new interface [#6753]
• Add Prometheus metrics for pipeline step duration and failures [#6738]
• Add k8s userns support [#6710]
• Make cli exec auto detect single workflow test in multi workflow setup [#6715]
• Surface .env load errors [#6707]
• Group commands followup user preference [#6694]
• Trim white spaces for cron create/update [#6690]
• Improve slow user authorization if many orgs/repos [#5665]
• pipeline: use more explizite error for step dependencies filtered out by its conditions [#6680]
• Add commit timestamp env vars [#6670]
• Show forge in users list [#6666]

🐛 Bug Fixes

• Allow images for secrets to contain SHA256 for image pinning [#6784]
• server should drop stale queue tasks already missing in database [#6765]
• server queue api should ignore missing agent [#6763]
• docs: deps migrate gray-matter to maintained fork [#6744]
• local backend: on windows use process tree-walk as workaround to kill [#6718]
• Fix issue with deeply nested k8s backend_options [#6730]
• cli exec: have uniq prefix for each workflow [#6716]
• github dont fail on force push [#6697]
• fix(kubernetes): retry WaitStep when container terminated state not yet finalized [#6672]

🧪 Tests

• More test coverage of server/api/... [#6712]
• Add e2e test that assert workflow depends_on enforces ordering [#6711]
• Add more tests in areas not well covered [#6696]
• Cleanup e2e test setup [#6480]

📚 Documentation

• Update docs npm deps non-major [#6786]
• Check docs JS files for spelling [#6758]
• Remove openbao extension [#6757]
• Update docs npm deps non-major [#6747]
• adds git-pages plugin [#6736]
• Update docs npm deps non-major to v1.18.0 [#6731]
• Update docs npm deps non-major to v3.17.0 [#6726]
• Update docs npm deps non-major [#6722]
• Update docs npm deps non-major [#6705]
• Add Podman plugin [#6701]
• Update docs npm deps non-major [#6679]
• Update dependency concurrently to v10 [#6676]
• Update docs npm deps non-major [#6675]
• docs: add cli exec examples [#6629]

📦️ Dependency

• Update pre-commit hook rbubley/mirrors-prettier to v3.8.5 [#6791]
• Update golang-packages [#6782]
• Update web npm deps non-major [#6761]
• Update golang-packages [#6767]
• Lock file maintenance [#6768]
• Update module github.com/cenkalti/backoff/v5 to v6 [#6752]
• Update dependency http-proxy-middleware to v4 [#6750]
• Update pre-commit non-major to v0.49.0 [#6749]
• Update docker.io/mysql Docker tag to v9.7.1 [#6746]
• Lock file maintenance [#6733]
• Update docker.io/alpine Docker tag to v3.24 [#6725]
• Update pre-commit non-major to v3.8.4 [#6723]
• Lock file maintenance [#6709]
• Update golang-lang to v1.26.4 [#6704]
• bump github.com/quic-go/quic-go to v0.59.1 [#6700]
• Update docker.io/woodpeckerci/plugin-trivy Docker tag to v1.6.0 [#6699]
• Lock file maintenance [#6686]
• Update woodpeckerci/plugin-git Docker tag to v2.9.2 [#6674]
• Update module gitlab.com/gitlab-org/api/client-go/v2 to v2.36.0 [#6668]
• Migrate gopkg.in/yaml.v3 usages to go.yaml.in/yaml/v4 [#6651]

Misc

• Rename editorconfig file [#6734]

3.15.0 - 2026-05-28

❤️ Thanks to all contributors! ❤️

@6543, @AkashKumar7902, @EdwardSalter, @M31ancholy, @anbraten, @hhamalai, @johanvdw, @jolheiser, @julienvincent, @lephuongbg, @mateuszkamola, @qwerty287, @rfinnie, @simonmeyerrr, @wucm667

Special thanks to @geo-chen for finding and reporting vulnerabilities!

🔒 Security

• Use Gitlab username [#6653]
• Update uuid [#6647]
• server: for grpc store extracted agentID in context [#6569]

✨ Features

• Support optional flag in depends_on for workflows and steps [#6461]

📈 Enhancement

• Use refactored pipeline builder in cli exec [#6453]
• Add config to change default pipeline config paths and extensions [#6580]
• Allow disabling service workspace volumes in k8s [#6644]
• View warning if admin is configured at env level [#6600]
• Add timezone support for crons [#6597]
• Add CI_PIPELINE_RERUNS environment variable [#6588]
• Add placeholders to inputs [#6599]
• Refactor server/.../step_builder into pipeline/.../builder [#3967]
• Group logs by command in step logs UI and make them collapsible [#6398]
• Expose step type to step env [#4290]
• pipeline runtime: move setting step environment variables into own func and add CI_PIPELINE_STATUS back [#6516]
• Refactor agent rpc retry [#6515]

🐛 Bug Fixes

• Fix org lookup panic [#6652]
• Deduplicate schema linter composition errors [#6633]
• local backend: on linux / mac start commands in own process group and kill the group on cancel [#6609]
• k8s: add guards to stop pipeline services upon completion [#6623]
• Fix missing log close button [#6584]
• fix(agent): persist agent ID after auth to prevent crashloop duplicates [#6543]
• fix(gitlab): preserve private flag when webhook payload omits project visibility [#6544]

🧪 Tests

• Fix race in local backend tests [#6574]

📚 Documentation

• Add note about extension permission [#6646]
• Add GitHub OAuth App setup hint to docker-compose page [#6643]
• Update pnpm to v11.3.0 [#6639]
• Update docs npm deps non-major [#6625]
• Docs: Mention that you can use failure: fail [#6611]
• Change homepage of woodpecker-shellcheck [#6594]
• Update docs npm deps non-major [#6586]
• Update pnpm to v11 [#6561]
• Update docs npm deps non-major [#6555]
• Add 3rd party secret extensions list [#6546]
• Update dependency axios to v1.16.0 [#6538]
• Update dependency yaml to v2.8.4 [#6536]
• Update dependency isomorphic-dompurify to v3.12.0 [#6532]
• Update docs npm deps non-major [#6530]

📦️ Dependency

• Update module gitlab.com/gitlab-org/api/client-go/v2 to v2.34.0 [#6662]
• Update dependency uuid to v14 [#6658]
• Lock file maintenance [#6659]
• Update golang-packages [#6637]
• Update web npm deps non-major [#6638]
• Lock file maintenance [#6640]
• Update module github.com/google/go-github/v86 to v88 [#6626]
• Update web npm deps non-major [#6624]
• Update golang-packages [#6622]
• Update golang-packages [#6620]
• Update module gitlab.com/gitlab-org/api/client-go/v2 to v2.29.0 [#6618]
• Update golang-packages [#6614]
• Lock file maintenance [#6606]
• Update web npm deps non-major [#6604]
• Update web npm deps non-major [#6603]
• Update web npm deps non-major [#6602]
• Update web npm deps non-major [#6601]
• Update dependency simple-icons to v16.20.0 [#6596]
• Update dependency eslint to v10.4.0 [#6593]
• Update dependency @antfu/eslint-config to v9 [#6592]
• Update web npm deps non-major [#6591]
• Update woodpeckerci/plugin-git Docker tag to v2.9.1 [#6589]
• Update postgres Docker tag to v18.4 [#6590]
• Update module gitlab.com/gitlab-org/api/client-go/v2 to v2.26.1 [#6587]
• Update golang-packages [#6582]
• Update module gitlab.com/gitlab-org/api/client-go/v2 to v2.26.0 [#6578]
• Update golang-packages [#6571]
• Update web npm deps non-major [#6446]
• Update module gitlab.com/gitlab-org/api/client-go/v2 to v2.25.0 [#6566]
• Update module github.com/google/go-github/v85 to v86 [#6560]
• Lock file maintenance [#6563]
• Update golang-packages [#6562]
• Update dependency mvdan/gofumpt to v0.10.0 [#6558]
• Update dependency golangci/golangci-lint to v2.12.2 [#6556]
• Update pre-commit hook golangci/golangci-lint to v2.12.2 [#6557]
• Update dependency golang to v1.26.3 [#6554]
• Update golang-packages [#6548]
• Update module gitlab.com/gitlab-org/api/client-go/v2 to v2.24.1 [#6545]
• Update golang-packages [#6542]
• Lock file maintenance [#6540]
• Update module github.com/docker/cli to v29.4.2+incompatible [#6539]
• Update golangci/golangci-lint Docker tag to v2.12.1 [#6537]
• Update pre-commit hook golangci/golangci-lint to v2.12.1 [#6535]
• Update docker.io/woodpeckerci/plugin-docker-buildx Docker tag to v6.1.0 [#6534]
• Update dependency golangci/golangci-lint to v2.12.0 [#6533]
• Update woodpeckerci/plugin-release Docker tag to v0.3.1 [#6531]
• Update docker.io/lycheeverse/lychee Docker tag to v0.24.2 [#6529]

Misc

• build: release freebsd/openbsd as binary not container [[#6610](https://github.com/woodpecker-...

3.14.1 - 2026-05-12

❤️ Special thanks the security researchers and those who fixed them ❤️

• Thanks to Shivam Kumar (@shivamkumarcyber) and
  Ranganatha Rao Sridhar (Praetorian) independently finding and reporting the bug
• And @6543 fixing the bugs and orchestrating the communication

CVE-2026-50141 EUVD-2026-37897

🔒 Security

• Server: make sure agent_id can not be spoofed by agent [#6567]

3.14.0 - 2026-05-01

❤️ Thanks to all contributors! ❤️

@6543, @Aex12, @AhmadNajiKam, @CrimsonFez, @LUKIEYF, @LoricAndre, @M31ancholy, @MartinSchmidt, @Pnkcaht, @Sim-hu, @TumbleOwlee, @api2062, @bclermont, @brainbaking, @cliffmccarthy, @confusedsushi, @dccdis, @hhamalai, @hnb2, @lephuongbg, @mehrdadbn9, @mofr93, @myers, @myselfghost, @njaaazi, @packrat386, @paulovitorbal, @qwerty287, @rfinnie, @rhafer, @samoli, @savv, @stardothosting, @utafrali, @wucm667

🔒 Security

• docs: bump follow-redirects [#6441]
• chore(deps): update dependency axios to v1.15.0 [security] [#6417]
• fix(deps): update go.opentelemetry.io/otel to v1.43.0 [#6416]
• WebUI: remove "lodash" dep [#6369]
• Sanitize agent introduced pipeline/workflow/step state changes and log streaming [#6308]
• Send 404 if logs are not allowed to access [#6349]
• Prevent registering as arbitrary agents with system token [#6283]
• Update fast-xml-parser [#6258]
• Update dompurify and svgo [#6198]
• Update edwards25519 [#6143]

✨ Features

• Support one-shot agent execution mode [#6150]
• Add external secret extension implementation [#6252]
• Allow disabling isolated home directory for local agents [#6251]
• Add Container Registry credential extension [#5993]
• Support exclusive config extensions [#5978]

📈 Enhancement

• Kubernetes: precreate workingDir as nonroot when required [#6322]
• Kubernetes: Support allowPrivilegeEscalation and capabilities backend_options [#6307]
• Refactor: remove Auth() from Forge interface [#6505]
• Move wait for log uploads logic out of logger and tracer into pipeline runtime [#6471]
• Make agent reconnect retry timeout configurable [#6470]
• Handle re-created forge repos gracefully [#6370]
• Cleanup server store step interface [#6476]
• Docker/K8s: add config for stop timeout [#6445]
• Docker backend should retry to delete volume on "in use" error [#6381]
• Move skip pipeline by commit message into pipeline/frontend package [#6437]
• Init server/scheduler package and use it as proxy for queue & pubsub [#6418]
• Unify server API parameters to snake_case [#6404]
• Add netrc option for config/registry extension [#6333]
• Docker backend: replace docker SDK with moby SDK [#6357]
• Deprecate commit avatar envs [#6356]
• Refactor server/pubsub into interface [#6318]
• Separate cron field [#6346]
• Refactor pipeline runtime code [#6166]
• Show Woodpecker version on pipeline details [#6316]
• Unify import aliases [#6328]
• Improve linter warning when step has no when block [#6314]
• Improve error message when no workflows for manual were found [#6313]
• Server return conflict status when stale repo causes duplicate insert [#6276]
• Show global/org registries in org/repo registries tab [#6291]
• Report skipped step state as soon as it's determined [#6295]
• Only add compatibility environment variables for drone-ci to plugins [#6271]
• Refactor: pass backend explicitly when creating pipeline engine runtime [#6268]
• Compare admins case-insensitively [#6261]
• Allow to cancel on failure [#6158]
• Refactor so storage detects if Insert fails because of unique constraint [#6259]
• Add server config for maximum log lines shown in web UI [#6250]
• Add "Load more" pagination to pipeline list [#6200]
• Use upstream slices.Concat and remove utils.MergeSlices [#6185]
• Add enhanced function for error message handling in http request for configuration fetching [#5712]
• Remove fixed badge width in UI [#6157]
• Improve Debian packages [#6085]
• Refactor pipeline engine [#6073]
• Show cancellation reason in pipeline details [#6072]
• Document required forge methods [#6049]
• Dynamic log following [#6036]
• Per-Workflow and Per-Workflow-Step badge generation [#5977]
• Render MD in pipeline titles [#5999]
• Simplify and Fix server task queue [#6017]
• Update Architecture: move pipeline/rpc => rpc & server/{grpc => rpc} [#6012]
• Implement retry logic in HTTP Send method [#5857]
• CLI: Allow single output template [#5882]
• Improve service syntax related docs and tests nits [#5991]
• Remove deactivated secrets type from container definition [#5983]

🐛 Bug Fixes

• fix(web): escape HTML in commit messages to prevent XSS [#6523]
• fix(cli,server): fix trusted flags copy-paste bug and server nil pointer panic [#6501]
• Add refname to bitbucket commit status [#6482]
• Fix send on closed channel panic in SSE stream handlers [#6456]
• Add WOODPECKER_FORCE_IGNORE_SERVICE_FAILURE config to preserve non-breaking behavior by default [#6448]
• Fix race in pipeline runtime [#6451]
• Fix race in server LogEntry logger [#6449]
• Kubernetes: detached steps are no services [#6435]
• Support dots in image names [#6431]
• Fix erroneous linter error for plugin privileges [#6424]
• Add connection timeout and graceful shutdown to agent RPC client [#6414]
• Fix Windows container exit code handling and error checks [#6411]
• Bitbucket: Remove usage of deprecated /user/permissions/repositories [#6401]
• Bitbucket: Fix parsing /user/workspaces response [#6396]
• Fix CLI exec with workflow matrix feature, where variables are not substituted. [#6162]
• Fix enable repo with same name and owner on second forge [#6375]
• Fix workflow being skipped and marked as failed when agent starts before server [#6361]
• Only redirect after login [#6348]
• Set w...