Enterprise Server 3.4 release notes

MEDIUM: A security issue in nginx resolver was identified, where an attacker who could forge UDP packets from the DNS server could cause 1-byte memory overwrite, resulting in worker process crashes or other potentially damaging impacts. The vulnerability has been assigned CVE-2021-23017.

Updated the actions/checkout@v2 and actions/checkout@v3 actions to address new vulnerabilities announced in the Git security enforcement blog post.

Packages have been updated to the latest security versions.

In some cluster topologies, the ghe-cluster-status command left behind empty directories in /tmp.

SNMP incorrectly logged a high number of Cannot statfs error messages to syslog.

When adding custom patterns and providing non-UTF8 test strings, match highlighting was incorrect.

LDAP users with an underscore character (_) in their user names can now login successfully.

For instances configured with SAML authentication and built-in fallback enabled, built-in users would get stuck in a “login” loop when attempting to sign in from the page generated after logging out.

After enabling SAML encrypted assertions with Azure as identity provider, the sign in page would fail with a 500 error.

Character key shortcut preferences weren't respected.

Attempts to view the git fsck output from the /stafftools/repositories/:owner/:repo/disk page would fail with a 500 Internal Server Error.

When using SAML encrypted assertions, some assertions were not correctly marking SSH keys as verified.

Videos uploaded to issue comments would not be rendered properly.

When using GitHub Enterprise Importer to import a repository, some issues would fail to import due to incorrectly configured project timeline events.

When using ghe-migrator, a migration would fail to import video file attachments in issues and pull requests.

In high availability configurations, clarify that the replication overview page in the Management Console only displays the current replication configuration, not the current replication status.

The Nomad allocation timeout for Dependency Graph has been increased to ensure post-upgrade migrations can complete.

When enabling GitHub Packages, clarify that using a Shared Access Signature (SAS) token as connection string is not currently supported.

Support bundles now include the row count of tables stored in MySQL.

When determining which repository networks to schedule maintenance on, we no longer count the size of unreachable objects.

The run_started_at response field is now included in the Workflow runs API and the workflow_run event webhook payload.

Packages have been updated to the latest security versions.

Resolved a regression that could lead to consistent failures to retrieve artifacts and download log archives for GitHub Actions. In some circumstances we stopped resolving URLs for internal communications that used localhost, and instead incorrectly used the instance hostname.

When a manifest file was deleted from a repository, the manifest would not be removed from the repository's "Dependency graph" page.

Upgrading the nodes in a high availability pair with an upgrade package could cause Elasticsearch to enter an inconsistent state in some cases.

Rotated log files with the extension .backup would accumulate in directories containing system logs.

In some cluster topologies, the command line utilities ghe-spokesctl and ghe-btop failed to run.

Elasticsearch indices could be duplicated during a package upgrade, due to an elasticsearch-upgrade service running multiple times in parallel.

Repository cache servers could serve data from non-cache locations even when the data was available in the local cache location.

When converting a user account to an organization, if the user account was an owner of the GitHub Enterprise Server enterprise account, the converted organization would incorrectly appear in the enterprise owner list.

The /stafftools/users/ip_addresses/:address page responded with a 500 Internal Server Error when attempting to display the page for an IPv6 address.

Creating an impersonation OAuth token using the Enterprise Administration REST API resulted in an error when an integration matching the OAuth Application ID already existed.

Added support for replica domain names that are more than 63 characters.

Configuration errors that halt a config apply run are now output to the terminal in addition to the configuration log.

If GitHub Advanced Security features are enabled on your instance, the performance of background jobs has improved when processing batches for repository contributions.

On a freshly set up GitHub Enterprise Server instance without any users, an attacker could create the first admin user.

Custom firewall rules are removed during the upgrade process.

Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.

Issues cannot be closed if they contain a permalink to a blob in the same repository, where the blob's file path is longer than 255 characters.

When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.

The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.

Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.

When using SAML encrypted assertions with GitHub Enterprise Server 3.4.0 and 3.4.1, a new XML attribute WantAssertionsEncrypted in the SPSSODescriptor contains an invalid attribute for SAML metadata. IdPs that consume this SAML metadata endpoint may encounter errors when validating the SAML metadata XML schema. A fix will be available in the next patch release. [Updated: 2022-04-11]

To work around this problem, you can take one of the two following actions.

• Reconfigure the IdP by uploading a static copy of the SAML metadata without the WantAssertionsEncrypted attribute.
• Copy the SAML metadata, remove WantAssertionsEncrypted attribute, host it on a web server, and reconfigure the IdP to point to that URL.

GitHub Enterprise Server 3.0 was discontinued on February 16, 2022. This means that no patch releases will be made, even for critical security issues, after this date. For better performance, improved security, and new features, upgrade to the newest version of GitHub Enterprise Server as soon as possible.

GitHub Enterprise Server 3.1 will be discontinued on June 3, 2022. This means that no patch releases will be made, even for critical security issues, after this date. For better performance, improved security, and new features, upgrade to the newest version of GitHub Enterprise Server as soon as possible.

Starting in GitHub Enterprise Server 3.3, GitHub Enterprise Server on XenServer was deprecated and is no longer supported. Please contact GitHub Support with questions or concerns.

Due to low usage, we have deprecated the Content References API preview in GitHub Enterprise Server 3.4. The API was previously accessible with the corsair-preview header. Users can continue to navigate to external URLs without this API. Any registered usages of the Content References API will no longer receive a webhook notification for URLs from your registered domain(s) and we no longer return valid response codes for attempted updates to existing content attachments.

The Codes of Conduct API preview, which was accessible with the scarlet-witch-preview header, is deprecated and no longer accessible in GitHub Enterprise Server 3.4. We instead recommend using the "Get community profile metrics" endpoint to retrieve information about a repository's code of conduct. For more information, see the "Deprecation Notice: Codes of Conduct API preview" in the GitHub changelog.

Starting with GitHub Enterprise Server 3.4, the deprecated version of the OAuth Application API endpoints have been removed. If you encounter 404 error messages on these endpoints, convert your code to the versions of the OAuth Application API that do not have access_tokens in the URL. We've also disabled the use of API authentication using query parameters. We instead recommend using API authentication in the request header.

The CodeQL runner is deprecated in GitHub Enterprise Server 3.4 and is no longer supported. The deprecation only affects users who use CodeQL code scanning in third party CI/CD systems; GitHub Actions users are not affected. We strongly recommend that customers migrate to the CodeQL CLI, which is a feature-complete replacement for the CodeQL runner. For more information, see the GitHub changelog.

Starting in GitHub Enterprise Server 3.1, support for GitHub's proprietary bit-cache extensions began to be phased out. These extensions are deprecated in GitHub Enterprise Server 3.3 onwards.

Any repositories that were already present and active on your GitHub Enterprise Server instance running version 3.1 or 3.2 will have been automatically updated.

Repositories which were not present and active before upgrading to GitHub Enterprise Server 3.3 may not perform optimally until a repository maintenance task is run and has successfully completed.

To start a repository maintenance task manually, browse to https://<hostname>/stafftools/repositories/<owner>/<repository>/network for each affected repository and click the Schedule button.

The theme picker for GitHub Pages has been removed from the Pages settings. For more information about configuration of themes for GitHub Pages, see "Adding a theme to your GitHub Pages site using Jekyll."

MEDIUM: A path traversal vulnerability was identified in GitHub Enterprise Server Management Console that allowed the bypass of CSRF protections. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.5 and was fixed in versions 3.1.19, 3.2.11, 3.3.6, 3.4.1. This vulnerability was reported via the GitHub Bug Bounty program and has been assigned CVE-2022-23732.

MEDIUM: An integer overflow vulnerability was identified in the 1.x branch and the 2.x branch of yajil which leads to subsequent heap memory corruption when dealing with large (~2GB) inputs. This vulnerability was reported internally and has been assigned CVE-2022-24795.

Support bundles could include sensitive files if GitHub Actions was enabled.

Packages have been updated to the latest security versions.

A workflow run may not complete if it uses composite-actions.

When enabling Dependabot, an error caused some security advisories to temporarily read as no-longer applicable.

Minio processes would have high CPU usage if an old configuration option was present after upgrading GitHub Enterprise Server.

The options to enable TLS 1.0 and TLS 1.1 in the Privacy settings of the Management Console were shown, although removal of those protocol versions occurred in an earlier release.

In a HA environment, configuring MSSQL replication could require additional manual steps after enabling GitHub Actions for the first time.

A subset of internal configuration files are more reliably updated after a hotpatch.

The ghe-run-migrations script would sometimes fail to generate temporary certificate names correctly.

Pre-receive hooks that used gpg --import timed out due to insufficient syscall privileges.

In some cluster topologies, webhook delivery information was not available.

The GitHub Actions deployment graph would display an error when rendering a pending job.

Elasticsearch health checks would not allow a yellow cluster status when running migrations.

When using the Migrations API, queued export jobs were not processed.

Repositories would display a non-functional Discussions tab in the web UI.

Organizations created as a result of a user transforming their user account into an organization were not added to the global enterprise account.

LDAP user sync jobs would fail when trying to sync GPG keys that had been synced previously.

Links to inaccessible pages were removed.

Some instances experienced high CPU usage due to large amounts unnecessary background jobs being queued.

Empty repositories didnt sync correctly to cache servers.

Adding a team as a reviewer to a pull request would sometimes show the incorrect number of members on that team.

The remove team membership API endpoint would respond with an error when attempting to remove member externally managed via a SCIM Group.

A large number of dormant users could cause a GitHub Connect configuration to fail.

The "Feature & beta enrollments" page in the Site admin web UI was incorrectly available.

The "Site admin mode" link in the site footer did not change state when clicked.

Memcached connection limits were increased to better accommodate large cluster topologies.

The Dependency Graph API previously ran with a statically defined port.

The default shard counts for cluster-related Elasticsearch shard settings have been updated.

The Migrations API now generates exports of repositories.

When filtering enterprise members by organization role on the "People" page, the text for the dropdown menu items has been improved.

The “Triage” and “Maintain” team roles are preserved during repository migrations.

Using ghe-migrator or exporting from GitHub.com, an export would not include Pull Request attachments.

Performance has been improved for web requests made by enterprise owners.

On a freshly set up GitHub Enterprise Server instance without any users, an attacker could create the first admin user.

Custom firewall rules are removed during the upgrade process.

Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.

Issues cannot be closed if they contain a permalink to a blob in the same repository, where the blob's file path is longer than 255 characters.

When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.

The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.

Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.

When using SAML encrypted assertions with GitHub Enterprise Server 3.4.0 and 3.4.1, a new XML attribute WantAssertionsEncrypted in the SPSSODescriptor contains an invalid attribute for SAML metadata. IdPs that consume this SAML metadata endpoint may encounter errors when validating the SAML metadata XML schema. A fix will be available in the next patch release. [Updated: 2022-04-11]

To work around this problem, you can take one of the two following actions.

• Reconfigure the IdP by uploading a static copy of the SAML metadata without the WantAssertionsEncrypted attribute.
• Copy the SAML metadata, remove WantAssertionsEncrypted attribute, host it on a web server, and reconfigure the IdP to point to that URL.

GitHub Enterprise Server 3.0 was discontinued on February 16, 2022. This means that no patch releases will be made, even for critical security issues, after this date. For better performance, improved security, and new features, upgrade to the newest version of GitHub Enterprise Server as soon as possible.

GitHub Enterprise Server 3.1 will be discontinued on June 3, 2022. This means that no patch releases will be made, even for critical security issues, after this date. For better performance, improved security, and new features, upgrade to the newest version of GitHub Enterprise Server as soon as possible.

Starting in GitHub Enterprise Server 3.3, GitHub Enterprise Server on XenServer was deprecated and is no longer supported. Please contact GitHub Support with questions or concerns.

Due to low usage, we have deprecated the Content References API preview in GitHub Enterprise Server 3.4. The API was previously accessible with the corsair-preview header. Users can continue to navigate to external URLs without this API. Any registered usages of the Content References API will no longer receive a webhook notification for URLs from your registered domain(s) and we no longer return valid response codes for attempted updates to existing content attachments.

The Codes of Conduct API preview, which was accessible with the scarlet-witch-preview header, is deprecated and no longer accessible in GitHub Enterprise Server 3.4. We instead recommend using the "Get community profile metrics" endpoint to retrieve information about a repository's code of conduct. For more information, see the "Deprecation Notice: Codes of Conduct API preview" in the GitHub changelog.

Starting with GitHub Enterprise Server 3.4, the deprecated version of the OAuth Application API endpoints have been removed. If you encounter 404 error messages on these endpoints, convert your code to the versions of the OAuth Application API that do not have access_tokens in the URL. We've also disabled the use of API authentication using query parameters. We instead recommend using API authentication in the request header.

The CodeQL runner is deprecated in GitHub Enterprise Server 3.4 and is no longer supported. The deprecation only affects users who use CodeQL code scanning in third party CI/CD systems; GitHub Actions users are not affected. We strongly recommend that customers migrate to the CodeQL CLI, which is a feature-complete replacement for the CodeQL runner. For more information, see the GitHub changelog.

Starting in GitHub Enterprise Server 3.1, support for GitHub's proprietary bit-cache extensions began to be phased out. These extensions are deprecated in GitHub Enterprise Server 3.3 onwards.

Any repositories that were already present and active on your GitHub Enterprise Server instance running version 3.1 or 3.2 will have been automatically updated.

Repositories which were not present and active before upgrading to GitHub Enterprise Server 3.3 may not perform optimally until a repository maintenance task is run and has successfully completed.

To start a repository maintenance task manually, browse to https://<hostname>/stafftools/repositories/<owner>/<repository>/network for each affected repository and click the Schedule button.

GitHub Advanced Security customers can now use the REST API to retrieve commit details of secrets detected in private repository scans. The new endpoint returns details of a secret's first detection within a file, including the secret's location and commit SHA. For more information, see "Secret scanning" in the REST API documentation.

Enterprise and organization owners can now export their GitHub Advanced Security license usage data to a CSV file. The Advanced Security billing data can also be retrieved via billing endpoints in the REST API. For more information, see the "GitHub changelog."

You can now reuse entire workflows as if they were an action. This feature is available in public beta. Instead of copying and pasting workflow definitions across repositories, you can now reference an existing workflow with a single line of configuration. For more information, see the "GitHub changelog."

Dependabot is now available in GitHub Enterprise Server 3.4 as a public beta, offering both version updates and security updates for several popular ecosystems. Dependabot on GitHub Enterprise Server requires GitHub Actions and a pool of self-hosted runners configured for Dependabot use. Dependabot on GitHub Enterprise Server also requires GitHub Connect and Dependabot to be enabled by an administrator. Beta feedback and suggestions can be shared in the Dependabot Feedback GitHub discussion. For more information and to try the beta, see "Setting up Dependabot security and version updates on your enterprise."

If you use SAML authentication for GitHub Enterprise Server, you can now configure encrypted assertions from your IdP to improve security. Encrypted assertions add an additional layer of encryption when your IdP transmits information to your GitHub Enterprise Server instance. For more information, see "Using SAML."

Users can now choose the number of spaces a tab is equal to, by setting their preferred tab size in the "Appearance" settings of their user account. All code with a tab indent will render using the preferred tab size.

The GitHub Connect data connection record now includes a count of the number of active and dormant users and the configured dormancy period.

You can now give users access to enterprise-specific links by adding custom footers to GitHub Enterprise Server. For more information, see "Configuring custom footers."

WireGuard, used to secure communication between GitHub Enterprise Server instances in a High Availability configuration, has been migrated to the Kernel implementation.

Organization owners can now unsubscribe from email notifications when new deploy keys are added to repositories belonging to their organizations. For more information, see "Configuring notifications."

Notification emails from newly created issues and pull requests now include (Issue #xx) or (PR #xx) in the email subject, so you can recognize and filter emails that reference these types of issues.

Organizations can now display a README.md file on their profile Overview. For more information, see the "GitHub changelog."

Members of organizations can now view a list of their enterprise owners under the organization's "People" tab. The enterprise owners list is also now accessible using the GraphQL API. For more information, see the "enterpriseOwners" field under the Organization object in the GraphQL API documentation.

A "Manage Access" section is now shown on the "Collaborators and teams" page in your repository settings. The new section makes it easier for repository administrators to see and manage who has access to their repository, and the level of access granted to each user. Administrators can now:

• Search all members, teams and collaborators who have access to the repository.
• View when members have mixed role assignments