woodpecker

3.20.0 - 2026-10-28

⚠️ this release has an unintended breaking change [#7398], use 3.20.1

❤️ Thanks to all contributors! ❤️

@6543, @AhmadNajiKam, @AkashKumar7902, @CamiloEspinoza, @Javex, @M0Rf30, @MannXo, @Mihir-Rabari, @PatelFarhaan, @Sawarz, @Sriram-PR, @YouCD, @aniketatgithub, @arcaartem, @asyntai, @carstenschmidt77, @confusedsushi, @cuducos, @eknathdj, @fredrikblau, @lafriks, @njaaazi, @pcbeingused333, @qwerty287, @roian6, @sugar700, @supertj, @tritsystem, @wolffberg, @xoxys

Special thanks to @baradika for reporting a security vulnerability

🔒 Security

• Remove agent token from process os environments [#7412]
• Make sure CLI self-update can target cli install dir only [#7400]
• Document security boundaries [#7281]
• Keep revoked env admins revoked until the server restarts [#7403]
• Fix gitlab to set tag pipeline author from webhook metadata [#7397]
• Update module github.com/woodpecker-ci/envsubst to v1.2.0 [#7398]
• Rotate repo JWT on repo repair [#7361]
• Fix and harden config fetching [#7386]
• Enhance matrix feature [#7353]
• Recover from config parsing panic in server [#7348]
• Fix server panics while parsing config [#7336]
• Only link http(s) error URIs on the login page [#7318]
• Do not log bearer credentials at trace level [#7317]
• Fall back to read only if the forge permission sync fails [#7282]
• Quote all YAML line breaks in environment substitution [#7283]

✨ Features

• Add support for selecting workflow to run for manual pipelines [#7393]
• Add option to restrict organization and user to use its agents only [#7359]
• Make CLI lint prefer detected Woodpecker config [#6634]

📈 Enhancement

• Send restart flag to the HTTP config extension [#7384]
• Harden store scoping for org-level secret and registry retrieval [#7365]
• Add CI_REPO_ID environment variable [#7295]
• Replace pipeline author on deploy with session user [#7358]
• Switch to the woodpecker-ci envsubst fork [#7349]
• StepFinished of log store return error now [#7346]
• Speed up queue scheduling calculations [#7303]
• Allow selecting the forge when creating a user [#7314]
• Drop reviewer metadata when restarting a pipeline [#7287]
• Indicate permission fallback in webui [#7285]
• li

3.19.0 - 2026-10-07

❤️ Thanks to all contributors! ❤️

Special thanks to @vibushasatheeshkumar for reporting a security vulnerability!

@6543, @ChrisJr404, @KR-Ravindra, @LaGrunge, @cacarico, @chiliec, @confusedsushi, @grisu48, @healdropper, @hsdfat, @jagerman, @joseph0531, @lafriks, @mattwilkinsonn, @qwerty287, @roian6, @sb123sb123, @somaz94, @spatterIight, @tehlordvortex, @thiagola92, @tunglambk, @usiegj00, @xoxys

🔒 Security

• Prevent injection of matrix env vars into default clone step [#7157]

✨ Features

• Local backend gets support for custom shell paths [#7194]
• Server side enforced agent labels [#4131]

📈 Enhancement

• CLI exec sanitize secrets too [#6877]
• Harmonize unit test patterns [#7229]
• Generalize log output groups [#7226]
• Include HTTP status in Bitbucket errors without a message [#7227]
• Add default user namespace support with configurable non-root override [#6943]
• Adopt Golang v1.27 [#7153]
• Store workflow/step dependencies in database and update API [#6130]
• Fix/docs deps and flaky test [#7204]
• Add AgentListWithOpts with pagination options [#7155]
• Use more unique sign to detect commands [#7122]
• Run swaggo in golangci-lint [#7121]
• feat(agent): add CI_AGENT_ID and CI_AGENT_LABELS runtime env vars [#7070]

🐛 Bug Fixes

• Fix step logs lost when pipeline ends with skipped workflows [#7240]
• Release agents waiting on long polls during server shutdown [#7189]
• Add version endpoint to API as per spec [#7232]
• Accept host:port registry addresses [#7235]
• Fix queue scheduler debug log spam [#7224]
• Fix infinite hook pagination loop on Bitbucket Cloud [#7210]
• Wait for informer cache sync before checking pod deletion [#7158]
• Fix race condition on concurrent pipeline config persist [#7192]
• Reload user from store before refreshing OAuth token [#7176]
• Ignore GitLab rejecting a commit status transition [#7217]
• Fix workspace volume mismatch when using CLI exec with the Kubernetes backend [#7150]
• Fix CLI shell completion [#7203]
• Fix url including when combined with ansi escapes [#7196]
• Fix nix dev env by disable static linking and make pnpm work again [#7193]
• Fix data race in SSE stream handlers when the clie

3.18.1 - 2026-09-09

❤️ Thanks to all contributors! ❤️

@6543, @YouCD, @dylanpulver, @lafriks, @mattwilkinsonn, @qwerty287

🔒 Security

• Fix docs securityscan [#7094]

🐛 Bug Fixes

• Add timezone data to docker images [#7093]
• Log an expected log-stream close failure at debug instead of error [#7117]
• Log a filtered webhook at debug instead of error [#7116]
• Fix workflow-level when.status so a failure-only workflow does not run on success [#7091]
• Speedup migration "deduplicate-log-entries" [#7068]
• fix(forge/gitlab): use group Path instead of Name for membership lookup [#7086]
• Fix injecting additional variables for substituting [#7077]

🧪 Tests

• Add test to verify that additional envs from manual run are available to when conditions [#7090]

📚 Documentation

• Fix RPM URL [#7124]
• Update dependency isomorphic-dompurify to v4 [#7097]
• Update pnpm to v11.25.0 [#7095]
• Update docs npm deps non-major [#7083]

📦️ Dependency

• Update golang-packages [#7112]
• Update web npm deps non-major [#7107]
• Lock file maintenance [#7113]
• Update golang-packages [#7106]
• Update pnpm to v12 [#7108]
• Update dependency eslint to v10.10.0 [#7105]
• Update dependency vitest to v5 [#7098]
• Update module github.com/google/go-github/v90 to v91 [#7099]
• Lock file maintenance [#7100]
• Update web npm deps non-major [#7096]
• Update golang-packages [#7092]
• Update module gitlab.com/gitlab-org/api/client-go/v2 to v2.61.0 [#7088]
• Lock file maintenance [#7087]
• Update dependency simple-icons to v16.29.0 [#7082]
• Update module github.com/getkin/kin-openapi to v0.149.0 [#7084]
• Update web npm deps non-major [#7081]
• Update pre-commit hook golangci/golangci-lint to v2.13.2 [#7080]
• Update golang-packages [#7075]
• Update golang-packages [#7071]

Misc

• Makefile enhancement [#7067]

3.18.0 - 2026-08-24

⚠️ This release contains a migration that alters log storage. Depending on the number of stored log lines, it can take a while to complete. Back up before upgrading and allow for extra downtime.

❤️ Thanks to all contributors! ❤️

Special thanks to @arpitjain099, @abdullaabdullazade, @george928 and @RealFakeAccount for reporting security vulnerabilities!

@6543, @AhmadNajiKam, @DEATIN, @OCram85, @Palleas, @YouCD, @anbraten, @confusedsushi, @gerbsen, @hasufell, @jrouly, @kastl-ars, @lafriks, @qwerty287, @retif, @romain-rossi, @spam-n-eggs, @stevapple, @xoxys, @zmully

🔒 Security

• k8s: allow to disable runtime class name backend option [#7046]
• Don't inject additional env vars into plugins [#7040]
• Don't inject matrix env vars into plugins [#7036]
• Update golang.org/x/mod [#7012]
• Change group identifier to full_path for GitLab [#6950]

📈 Enhancement

• Allow to add custom message to manual pipelines [#6973]
• Add hidden decode-base64 agent command for Windows local backend [#7023]
• Enforce unique name for services and steps if dag is used [#7032]
• Add custom list opts with all [#6992]
• Add pipeline log download endpoint [#6876]
• Reject invalid started and done workflow states [#7029]
• Sort workflow files by name [#7021]
• Reject incompatible gRPC proto version agents [#7028]
• Enforce one log entry per line with a unique index [#7004]
• Order the user feed by creation time instead of id [#7005]
• Return step logs strictly in line order [#6999]
• Find the preceding pipeline by number instead of id [#7003]
• perf(schema): cache compiled YAML validation schema [#7002]
• Pick a repo's latest pipeline by number instead of id [#7001]
• feat: allow configuring allowed orgs per forge [#6874]
• Make the Kubernetes cluster domain configurable [#6957]
• Fix vite deprecation [#6974]
• feat(web): extract ListEditor form component [#6962]
• Rename WOODPECKER_GRPC_VERIFY to WOODPECKER_GRPC_SKIP_VERIFY [#6947]
• Update frontend schema.json for documented backend options [#6933]

🐛 Bug Fixes

• Prevent repository buttons from overlapping search bar [#7047]
• fix(server): prefix manual trigger Ref with refs/heads/ [#7051]
• fix runtime to ignore cancel as runtime error [#7031]
• Fix orphaned pipelines after