Release notes - GitHub Enterprise Server 3.6 Docs

Enterprise Server 3.6.11

Download GitHub Enterprise Server 3.6.11

March 23, 2023

📣 This is not the latest release of Enterprise Server. Please use the latest release for the latest security, performance, and bug fixes.

3.6.11: Bug fixes

In the Management Console's monitor dashboard, the Cached Requests and Served Requests graphs, which are retrieved by the git fetch catching command, did not display metrics for the instance.
After a site administrator exempted the @github-actions[bot] user from rate limiting by using the ghe-config app.github.rate-limiting-exempt-users "github-actions[bot]" command, running ghe-config-check caused a Validation is-valid-characterset failed warning to appear.
GitHub Actions (actions) and Microsoft SQL (mssql) did not appear in the list of processes within the instances monitor dashboard.
After an administrator used the /setup/api/start REST API endpoint to upload a license, the configuration run failed with a Connection refused error during the migrations phase.
In some cases, on an instance with a GitHub Advanced Security license and secret scanning enabled, users may have seen a discrepancy between the number of alerts displayed on a repositorys "Security" tab and in the sidebar for the "Security" tab.
On an instance in a cluster configuration, when a site administrator set maintenance mode using ghe-maintenance -s, a Permission denied error appeared when the utility tried to access /data/user/common/cluster.conf.
On an instance in a high availability configuration, if an administrator tore down replication from a replica node using ghe-repl-teardown immediately after running ghe-repl-setup, but before ghe-repl-start, an error indicated that the script cannot launch /usr/local/bin/ghe-single-config-apply - run is locked. ghe-repl-teardown now displays an informational alert and continues the teardown.
During configuration of high availability, if a site administrator interrupted the ghe-repl-start utility, the utility erroneously reported that replication was configured, and the instance would not perform expected clean-up operations.
Responses from the /repositories REST API endpoint erroneously included deleted repositories.
When a site administrator used ghe-migrator to migrate data to GitHub Enterprise Server, in some cases, nested team relationships would not persist after teams were imported.
If a repository contained a CODEOWNERS file with check annotations, pull requests "Files changed" tab returned a 500 error and displayed "Oops, something went wrong" in the "Unchanged files with check annotations" section.
After upgrading an instance with a GitHub Advanced Security license to GitHub Enterprise Server 3.6 or 3.7, creating a repository or viewing the security settings page for an organization or repository could result in a 500 error due to a GitHub Advanced Security backfill job not completing before the upgrade started.
On an instance with GitHub Actions enabled, if a user manually triggered a workflow using the REST API but did not specify values for optional booleans, the API failed to validate the request and returned a 422 error.
The CSV reports for all users and all active users, available from the site admin dashboard, did not consider recent access using SSH or personal access tokens.
On an instance with GitHub Connect enabled, if "Users can search GitHub.com" was enabled, users would not see issues in private and internal repositories in search results for GitHub.com.
GitHub Enterprise Server published distribution metrics that cannot be processed by collectd. The metrics included pre_receive.lfsintegrity.dist.referenced_oids, pre_receive.lfsintegrity.dist.unknown_oids, and git.hooks.runtime.
On an instance with a GitHub Advanced Security license, if code scanning had been used while running GitHub Enterprise Server 3.4 or earlier, a subsequent upgrade from 3.5 to 3.6 or 3.7 could fail when attempting to add a unique index to a database table.

3.6.11: Changes

After an enterprise owner enables Dependabot updates, the instance creates the initial set of updates faster.
On an instance in a cluster configuration, when a site administrator sets maintenance mode on a single cluster node using ghe-maintenance -s, the utility warns the administrator to use ghe-cluster-maintenance -s to set maintenance mode on all of the clusters nodes. For more information, see "Enabling and scheduling maintenance mode."
When a site administrator configures an outbound web proxy server for GitHub Enterprise Server, the instance now validates top-level domains (TLDs) excluded from the proxy configuration. By default, you can exclude public TLDs that the IANA specifies. Site administrators can specify a list of unregistered TLDs to exclude using ghe-config. The . prefix is required for any public TLDs. For example, .example.com is valid, but example.com is invalid. For more information, see "Configuring an outbound web proxy server."
To avoid intermittent issues with the success of Git operations on an instance with multiple nodes, GitHub Enterprise Server checks the status of the MySQL container before attempting a SQL query. The timeout duration has also been reduced.
The default path for output from ghe-saml-mapping-csv -d is /data/user/tmp instead of /tmp. For more information, see "Command-line utilities."

3.6.11: Known issues

On a freshly set up GitHub Enterprise Server instance without any users, an attacker could create the first admin user.
Custom firewall rules are removed during the upgrade process.
Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.
The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.
Instances experiencing a high sustained number of concurrent Git requests may experience performance issues. If you suspect that this issue is affecting your instance, contact GitHub Support. For more information, see "Creating a support ticket." [Updated: 2022-12-07]
In a repository's settings, enabling the option to allow users with read access to create discussions does not enable this functionality.
Custom patterns for secret scanning have .* as an end delimiter, specifically in the "After secret" field. This delimiter causes inconsistencies in scans for secrets across repositories, and you may notice gaps in a repository's history where no scans completed. Incremental scans may also be impacted. To prevent issues with scans, modify the end of the pattern to remove the .* delimiter.
Following an upgrade to GitHub Enterprise Server 3.6 or later, existing inconsistencies in a repository such as broken refs or missing objects, may now be reported as errors like invalid sha1 pointer 0000000000000000000000000000000000000000, Zero-length loose reference file, or Zero-length loose object file. Previously, these indicators of repository corruption may have been silently ignored. GitHub Enterprise Server now uses an updated Git version with more diligent error reporting enabled. For more information, see this upstream commit in the Git project.

If you suspect a problem like this exists in one of your repositories, contact GitHub Enterprise Support for assistance.

Enterprise Server 3.6.10

Download GitHub Enterprise Server 3.6.10

March 02, 2023

📣 This is not the latest patch release of this release series, and this is not the latest release of Enterprise Server. Please use the latest release for the latest security, performance, and bug fixes.

3.6.10: Security fixes

"HIGH: A path traversal vulnerability was identified in GitHub Enterprise Server that allowed remote code execution when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability was reported via the GitHub Bug Bounty Program and has been assigned CVE-2023-23760.

3.6.10: Bug fixes

When viewing a list of open sessions for the devices logged into a user account, the GitHub Enterprise Server web UI could display an incorrect location.
In the rare case when primary shards for Elasticsearch were located on a replica node, the ghe-repl-stop command would fail with ERROR: Running migrations.
The settings page for discussions in an organization returned a 500 error after a repository owned by the organization was deleted.

3.6.10: Known issues

On a freshly set up GitHub Enterprise Server instance without any users, an attacker could create the first admin user.
Custom firewall rules are removed during the upgrade process.
Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.
When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.
The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.
Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.
Actions services need to be restarted after restoring an instance from a backup taken on a different host.
In a repository's settings, enabling the option to allow users with read access to create discussions does not enable this functionality.
Custom patterns for secret scanning have .* as an end delimiter, specifically in the "After secret" field. This delimiter causes inconsistencies in scans for secrets across repositories, and you may notice gaps in a repository's history where no scans completed. Incremental scans may also be impacted. To prevent issues with scans, modify the end of the pattern to remove the .* delimiter.
Following an upgrade to GitHub Enterprise Server 3.6 or later, existing inconsistencies in a repository such as broken refs or missing objects, may now be reported as errors like invalid sha1 pointer 0000000000000000000000000000000000000000, Zero-length loose reference file, or Zero-length loose object file. Previously, these indicators of repository corruption may have been silently ignored. GitHub Enterprise Server now uses an updated Git version with more diligent error reporting enabled. For more information, see this upstream commit in the Git project.

If you suspect a problem like this exists in one of your repositories, contact GitHub Enterprise Support for assistance.
Instances experiencing a high sustained number of concurrent Git requests may experience performance issues. If you suspect that this issue is affecting your instance, contact GitHub Support. For more information, see "Creating a support ticket." [Updated: 2022-12-07]
In some cases, while converting an issue to a discussion, the conversion process may hang. In this situation, an enterprise owner can try the following troubleshooting steps to resolve the issue.
1. At the end of the stuck discussion's URL, note the discussion's number.
2. In the web UI, browse to the repository where the conversion is stuck.
3. In the top-right corner of the web UI, click .
4. Under "Collaboration", click NUMBER discussions.
5. In the list, click the number from step 1.
6. Under "Conversion", click Enqueue conversion job.
7. Wait a few minutes, then check the issue's status.
If the conversion still hasn't completed, contact GitHub Enterprise Support for assistance.
On instances in a high availability configuration, git push operations may fail in the following situations. [Updated: 2023-03-17]
- During creation of the repository on a replica node
- After failure to create the repository on a replica node, before automatic repair of the repository

Enterprise Server 3.6.9

Download GitHub Enterprise Server 3.6.9

February 16, 2023

3.6.9: Security fixes

HIGH: Updated Git to include fixes from 2.39.2, which address CVE-2023-22490 and CVE-2023-23946.
Packages have been updated to the latest security versions.

3.6.9: Bug fixes

When using a VPC endpoint URL as an AWS S3 URL for GitHub Packages, publication and installation of packages failed.
On an instance with a GitHub Advanced Security license, if code scanning had been used while running GitHub Enterprise Server 3.4 or earlier, a subsequent upgrade from 3.5 to 3.6 or 3.7 could fail when attempting to add a unique index to a database table.

3.6.9: Known issues

On a freshly set up GitHub Enterprise Server instance without any users, an attacker could create the first admin user.
Custom firewall rules are removed during the upgrade process.
Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.
When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.
The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.
Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.
Actions services need to be restarted after restoring an instance from a backup taken on a different host.
In a repository's settings, enabling the option to allow users with read access to create discussions does not enable this functionality.
Custom patterns for secret scanning have .* as an end delimiter, specifically in the "After secret" field. This delimiter causes inconsistencies in scans for secrets across repositories, and you may notice gaps in a repository's history where no scans completed. Incremental scans may also be impacted. To prevent issues with scans, modify the end of the pattern to remove the .* delimiter.
Following an upgrade to GitHub Enterprise Server 3.6 or later, existing inconsistencies in a repository such as broken refs or missing objects, may now be reported as errors like invalid sha1 pointer 0000000000000000000000000000000000000000, Zero-length loose reference file, or Zero-length loose object file. Previously, these indicators of repository corruption may have been silently ignored. GitHub Enterprise Server now uses an updated Git version with more diligent error reporting enabled. For more information, see this upstream commit in the Git project.

If you suspect a problem like this exists in one of your repositories, contact GitHub Enterprise Support for assistance.
Instances experiencing a high sustained number of concurrent Git requests may experience performance issues. If you suspect that this issue is affecting your instance, contact GitHub Support. For more information, see "Creating a support ticket." [Updated: 2022-12-07]
In some cases, while converting an issue to a discussion, the conversion process may hang. In this situation, an enterprise owner can try the following troubleshooting steps to resolve the issue.
1. At the end of the stuck discussion's URL, note the discussion's number.
2. In the web UI, browse to the repository where the conversion is stuck.
3. In the top-right corner of the web UI, click .
4. Under "Collaboration", click NUMBER discussions.
5. In the list, click the number from step 1.
6. Under "Conversion", click Enqueue conversion job.
7. Wait a few minutes, then check the issue's status.
If the conversion still hasn't completed, contact GitHub Enterprise Support for assistance.
On instances in a high availability configuration, git push operations may fail in the following situations. [Updated: 2023-03-17]
- During creation of the repository on a replica node
- After failure to create the repository on a replica node, before automatic repair of the repository

Enterprise Server 3.6.8

Download GitHub Enterprise Server 3.6.8

February 02, 2023

3.6.8: Security fixes

MEDIUM: A code injection vulnerability was identified in GitHub Enterprise Server that allowed setting arbitrary environment variables from a single environment variable value in GitHub Actions when using a Windows based runner due to improper sanitization of null bytes. To exploit this vulnerability, an attacker would need existing permission to control the value of environment variables for use with GitHub Actions. This vulnerability was reported via the GitHub Bug Bounty Program and has been assigned CVE-2023-22381.
Packages have been updated to the latest security versions.

3.6.8: Bug fixes

After a site administrator adjusted the cutoff date for allowing SSH connections with RSA keys using ghe-config app.gitauth.rsa-sha1, the instance would still disallow connections with RSA keys if the connection attempt was signed by the SHA-1 hash function.
During the validation phase of a configuration run, a No such object error may have occurred for the Notebook and Viewscreen services.
When enabling automatic TLS certificate management with Let's Encrypt, the process could fail with the error The certificate is not signed by a trusted certificate authority (CA) or the certificate chain in missing intermediate CA signing certificates.
In some cases, users were unable to convert existing issues to discussions. If an issue is stuck while being converted to a discussion, enterprise owners can review the "Known issues" section below for more information.

3.6.8: Changes

When a timeout occurs during diff generation, such as when a commit displays an error that the diff is taking too long to generate, the push webhook event will deliver empty diff information. Previously, the push webhook event would fail to be delivered.

3.6.8: Known issues

On a freshly set up GitHub Enterprise Server instance without any users, an attacker could create the first admin user.
Custom firewall rules are removed during the upgrade process.
Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.
When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.
The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.
Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.
Actions services need to be restarted after restoring an instance from a backup taken on a different host.
In a repository's settings, enabling the option to allow users with read access to create discussions does not enable this functionality.
Custom patterns for secret scanning have .* as an end delimiter, specifically in the "After secret" field. This delimiter causes inconsistencies in scans for secrets across repositories, and you may notice gaps in a repository's history where no scans completed. Incremental scans may also be impacted. To prevent issues with scans, modify the end of the pattern to remove the .* delimiter.
Following an upgrade to GitHub Enterprise Server 3.6 or later, existing inconsistencies in a repository such as broken refs or missing objects, may now be reported as errors like invalid sha1 pointer 0000000000000000000000000000000000000000, Zero-length loose reference file, or Zero-length loose object file. Previously, these indicators of repository corruption may have been silently ignored. GitHub Enterprise Server now uses an updated Git version with more diligent error reporting enabled. For more information, see this upstream commit in the Git project.

If you suspect a problem like this exists in one of your repositories, contact GitHub Enterprise Support for assistance.
Instances experiencing a high sustained number of concurrent Git requests may experience performance issues. If you suspect that this issue is affecting your instance, contact GitHub Support. For more information, see "Creating a support ticket." [Updated: 2022-12-07]
In some cases, while converting an issue to a discussion, the conversion process may hang. In this situation, an enterprise owner can try the following troubleshooting steps to resolve the issue.
1. At the end of the stuck discussion's URL, note the discussion's number.
2. In the web UI, browse to the repository where the conversion is stuck.
3. In the top-right corner of the web UI, click .
4. Under "Collaboration", click NUMBER discussions.
5. In the list, click the number from step 1.
6. Under "Conversion", click Enqueue conversion job.
7. Wait a few minutes, then check the issue's status.
If the conversion still hasn't completed, contact GitHub Enterprise Support for assistance.
On instances in a high availability configuration, git push operations may fail in the following situations. [Updated: 2023-03-17]
- During creation of the repository on a replica node
- After failure to create the repository on a replica node, before automatic repair of the repository

Enterprise Server 3.6.7

Download GitHub Enterprise Server 3.6.7

January 17, 2023

3.6.7: Security fixes

HIGH: Updated Git to include fixes from 2.39.1, which address CVE-2022-41903 and CVE-2022-23521.

3.6.7: Known issues

On a freshly set up GitHub Enterprise Server instance without any users, an attacker could create the first admin user.
Custom firewall rules are removed during the upgrade process.
Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.
When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.
The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.
Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.
Actions services need to be restarted after restoring an instance from a backup taken on a different host.
In a repository's settings, enabling the option to allow users with read access to create discussions does not enable this functionality.
In some cases, users cannot convert existing issues to discussions.
Custom patterns for secret scanning have .* as an end delimiter, specifically in the "After secret" field. This delimiter causes inconsistencies in scans for secrets across repositories, and you may notice gaps in a repository's history where no scans completed. Incremental scans may also be impacted. To prevent issues with scans, modify the end of the pattern to remove the .* delimiter.
Following an upgrade to GitHub Enterprise Server 3.6 or later, existing inconsistencies in a repository such as broken refs or missing objects, may now be reported as errors like invalid sha1 pointer 0000000000000000000000000000000000000000, Zero-length loose reference file, or Zero-length loose object file. Previously, these indicators of repository corruption may have been silently ignored. GitHub Enterprise Server now uses an updated Git version with more diligent error reporting enabled. For more information, see this upstream commit in the Git project.

If you suspect a problem like this exists in one of your repositories, contact GitHub Enterprise Support for assistance.
Instances experiencing a high sustained number of concurrent Git requests may experience performance issues. If you suspect that this issue is affecting your instance, contact GitHub Support. For more information, see "Creating a support ticket." [Updated: 2022-12-07]
On instances in a high availability configuration, git push operations may fail in the following situations. [Updated: 2023-03-17]
- During creation of the repository on a replica node
- After failure to create the repository on a replica node, before automatic repair of the repository

Enterprise Server 3.6.6

Download GitHub Enterprise Server 3.6.6

January 12, 2023

3.6.6: Security fixes

Sanitize additional secrets in support bundles and the configuration log.
Dependencies for the CodeQL action have been updated to the latest security versions.
Packages have been updated to the latest security versions.

3.6.6: Bug fixes

The metrics Active workers and Queued requests for github (renamed from metadata), gitauth, and unicorn container services werent correctly read from collectd and displayed in the Management Console.
Dependabot Alert emails would be sent to disabled repositories.
Data migrations could fail when the underlying database table contained only a single record.
When viewing a pull requests diff for a large file with many lines between changes, it was not possible to expand the view to display all of the changes.
The git-janitorcommand was unable to fix outdated multi-pack-index.lock files, resulting in the repository failing maintenance.
The GITHUB_REF_PROTECTED environment variable and github.ref_protected contexts were incorrectly set as false when branch protections did exist.
Dropped launch.* metrics that can't be parsed by statsd, as the resulting statsd errors caused collectd logs to grow rapidly in size.
When updating custom patterns, the pattern state was immediately set to published.

3.6.6: Changes

Improved the reliability of the real time updates service (Alive) to make it more resilient against network issues with Redis.
The ghe-support-bundle and ghe-cluster-support-bundle commands were updated to include the -p/--period flag to generate a time constrained support bundle. The duration can be specified in days and hours, for example: -p '2 hours', -p '1 day', -p '2 days 5 hours'.
When upgrading an instance with a new root partition, running the ghe-upgrade command with the -t/--target option ensures the preflight check for the minimum disk storage size is executed against the target partition.
The performance of configuration runs started with ghe-config-apply has been improved.
When exporting account data, backing up a repository, or performing a migration, the link to a repository archive now expires after 1 hour. Previously the archive link expired after 5 minutes.

3.6.6: Known issues

On a freshly set up GitHub Enterprise Server instance without any users, an attacker could create the first admin user.
Custom firewall rules are removed during the upgrade process.
Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.
When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.
The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.
Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.
Actions services need to be restarted after restoring an instance from a backup taken on a different host.
In a repository's settings, enabling the option to allow users with read access to create discussions does not enable this functionality.
In some cases, users cannot convert existing issues to discussions.
Custom patterns for secret scanning have .* as an end delimiter, specifically in the "After secret" field. This delimiter causes inconsistencies in scans for secrets across repositories, and you may notice gaps in a repository's history where no scans completed. Incremental scans may also be impacted. To prevent issues with scans, modify the end of the pattern to remove the .* delimiter.
Following an upgrade to GitHub Enterprise Server 3.6 or later, existing inconsistencies in a repository such as broken refs or missing objects, may now be reported as errors like invalid sha1 pointer 0000000000000000000000000000000000000000, Zero-length loose reference file, or Zero-length loose object file. Previously, these indicators of repository corruption may have been silently ignored. GitHub Enterprise Server now uses an updated Git version with more diligent error reporting enabled. For more information, see this upstream commit in the Git project.

If you suspect a problem like this exists in one of your repositories, contact GitHub Enterprise Support for assistance.
Instances experiencing a high sustained number of concurrent Git requests may experience performance issues. If you suspect that this issue is affecting your instance, contact GitHub Support. For more information, see "Creating a support ticket." [Updated: 2022-12-07]
On instances in a high availability configuration, git push operations may fail in the following situations. [Updated: 2023-03-17]
- During creation of the repository on a replica node
- After failure to create the repository on a replica node, before automatic repair of the repository

Enterprise Server 3.6.5

Download GitHub Enterprise Server 3.6.5

December 13, 2022

3.6.5: Security fixes

HIGH: A path traversal vulnerability was identified in GitHub Enterprise Server that allowed remote code execution when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the instance. This vulnerability was reported via the GitHub Bug Bounty Program and has been assigned CVE-2022-46256.
HIGH: An incorrect authorization vulnerability allowed a scoped user-to-server token to escalate to full admin access for a repository. An attacker would require an account with admin access to install a malicious GitHub App. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.7.0. This vulnerability was reported via the GitHub Bug Bounty program and has been assigned CVE-2022-23741.
MEDIUM: An information disclosure vulnerability was identified in GitHub Enterprise Server that allowed private repositories to be added to a GitHub Actions runner group via the API by a user who did not have access to those repositories, resulting in the repository names being shown in the UI. To exploit this vulnerability, an attacker would need access to the GHES instance, permissions to modify GitHub Actions runner groups, and successfully guess the obfuscated ID of private repositories. This vulnerability was reported via the GitHub Bug Bounty Program and has been assigned CVE-2022-46257.

3.6.5: Bug fixes

A race condition blocked upgrades to GitHub Enterprise Server 3.6 or later until a site administrator retried the upgrade.
Site administrators were not able to manage security products settings for repositories they had unlocked.
When a site administrator ran the ghe-repl-status command on a cache replica via the administrative shell (SSH), the command incorrectly reported overall Git and Alambic cluster replication status information as if it pertained only to cache replication.
When a site administrator ran the ghe-repl-sync-ca-certificates command from an instances primary node via the administrative shell (SSH), the command only replicated CA certificates from the instances primary node to a single replica node. The command did not replicate the certificates to all available replica nodes.
When using repository caching with an instance in a high availability configuration, if a Git client used SSH instead of HTTPS for a repositorys remote URL, Git LFS would fetch objects from the instances primary node instead of the appropriate cache replica node.
Installation of GitHub Enterprise Server on the VMware ESXi hypervisor failed due to the generation of an OVA file with an invalid capacity value.
When users performed an operation using the API, GitHub Enterprise Server enforced repository size quotas even when disabled globally.
If a user uploaded more than one file while creating a new Gist, the user could not delete any files uploaded after the first.
In some cases, searches via the API returned a 500 error.
In some cases, when browsing repositories in the web interface, an erroneous banner indicated that a repository didnt contain a specific undefined path on the current branch.
The member webhook event did not include the from and to field values for the permission field as part of the changes field.
Adding a collaborator to a user-owned fork of a private, organization-owned repository with triage, maintain, or custom access resulted in a 500 error.
In some cases, the page for setting up code scanning would erroneously report that GitHub Actions was not configured for the instance.
After a user's account was deleted from the instance, image attachments that the user uploaded in comments were no longer visible in the web interface.
A debug-level message appeared in a system log, which could consume space rapidly on the instance's root storage volume.

3.6.5: Changes

To avoid failing domain verification due to the 63-character limit enforced by DNS providers for DNS records, the GitHub-generated TXT record to verify domain ownership is now limited to 63 characters.
After an enterprise owner enables Dependabot alerts, GitHub Enterprise Server enqueues the synchronization of advisory data to ensure hourly updates from GitHub.com.
A user's list of recently accessed repositories no longer includes deleted repositories.
For participants in the private beta of SCIM for GitHub Enterprise Server, custom mappings for SAML user attributes are now supported. Custom mappings allow the use of a value other than NameID as the unique identifying claim during SAML authentication. For more information, see "Configuring user provisioning with SCIM for your enterprise." [Updated: 2023-02-27]

3.6.5: Known issues

On a freshly set up GitHub Enterprise Server instance without any users, an attacker could create the first admin user.
Custom firewall rules are removed during the upgrade process.
Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.
When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.
The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.
Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.
Actions services need to be restarted after restoring an instance from a backup taken on a different host.
In a repository's settings, enabling the option to allow users with read access to create discussions does not enable this functionality.
In some cases, users cannot convert existing issues to discussions.
Custom patterns for secret scanning have .* as an end delimiter, specifically in the "After secret" field. This delimiter causes inconsistencies in scans for secrets across repositories, and you may notice gaps in a repository's history where no scans completed. Incremental scans may also be impacted. To prevent issues with scans, modify the end of the pattern to remove the .* delimiter.
Following an upgrade to GitHub Enterprise Server 3.6 or later, existing inconsistencies in a repository such as broken refs or missing objects, may now be reported as errors like invalid sha1 pointer 0000000000000000000000000000000000000000, Zero-length loose reference file, or Zero-length loose object file. Previously, these indicators of repository corruption may have been silently ignored. GitHub Enterprise Server now uses an updated Git version with more diligent error reporting enabled. For more information, see this upstream commit in the Git project.

If you suspect a problem like this exists in one of your repositories, contact GitHub Enterprise Support for assistance.
Instances experiencing a high sustained number of concurrent Git requests may experience performance issues. If you suspect that this issue is affecting your instance, contact GitHub Support. For more information, see "Creating a support ticket." [Updated: 2022-12-07]
For participants in the private beta of SCIM for GitHub Enterprise Server, authentication for requests to resources other than the REST API using a personal access token or SSH key may not succeed. A fix will be available in a forthcoming release of GitHub Enterprise Server. [Updated: 2023-02-27]
On instances in a high availability configuration, git push operations may fail in the following situations. [Updated: 2023-03-17]
- During creation of the repository on a replica node
- After failure to create the repository on a replica node, before automatic repair of the repository

Enterprise Server 3.6.4

Download GitHub Enterprise Server 3.6.4

November 22, 2022

3.6.4: Security fixes

MEDIUM: Updated CommonMarker to address a scenario where parallel requests to the Markdown REST API could result in unbounded resource exhaustion. This vulnerability has been assigned CVE-2022-39209.
MEDIUM: Scoped user-to-server tokens from GitHub Apps could bypass authorization checks in GraphQL API requests when accessing non-repository resources. This vulnerability was reported via the GitHub Bug Bounty Program and has been assigned CVE-2022-23739.
MEDIUM: Pull request preview links did not properly sanitize URLs, allowing a malicious user to embed dangerous links in the instances web UI. This vulnerability was reported via the GitHub Bug Bounty program.
MEDIUM: An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository-scoped token with read/write access to modify GitHub Actions workflow files without a workflow scope. The "Repository contents" should enforce workflow scope. This vulnerability was reported via the GitHub Bug Bounty program and has been assigned CVE-2022-46258.

3.6.4: Bug fixes

If a GitHub Actions dependency uses a pinned SHA version, Dependabot will no longer mark the dependency as vulnerable.
Setting the maintenance mode with an IP Exception List would not persist across upgrades.
GitHub Pages builds could time out on instances in AWS that are configured for high availability.
Status details for the replication of Git LFS objects to repository cache replica nodes were not visible in the ghe-repl-status output on those nodes.
After configuration of Dependabot and alert digest emails, the instance would send digest emails to suspended users.
The audit log timestamp for Dependabot alert events returned the creation date of the alert instead of the timestamp when a user took action on the alert.
When using the CodeQL action, the runs annotations would include a spurious HttpError: Upload not found error.
When accessing an instances JavaScript resources from behind a proxy, the browser displayed Cross-Origin Resource Sharing (CORS) errors.
If a user named a status check with leading or trailing spaces, the instance created a duplicate check if another check existed with the same name and no leading or trailing spaces.
If a user configured a pre-receive hook for multiple repositories, the instances Hooks page would not always display the correct status for the hook.
In some cases, an instance could replace an active repository with a deleted repository.
Git LFS objects in a repository with a cache replication policy would not be copied to cache replicas if the total number of objects in the repository exceeded 5,000.
After running migrations for the GitHub Enterprise Importer on an instance configured for high availability, replication of migration storage assets would not catch up.
Zombie processes no longer accumulate in the gitrpcd container.

3.6.4: Changes

If a site administrator has not yet configured GitHub Actions for the instance, the UI for setting up code scanning will prompt the user to configure GitHub Actions.

3.6.4: Known issues

On a freshly set up GitHub Enterprise Server instance without any users, an attacker could create the first admin user.
Custom firewall rules are removed during the upgrade process.
Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.
When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.
The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.
Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.
Actions services need to be restarted after restoring an instance from a backup taken on a different host.
In a repository's settings, enabling the option to allow users with read access to create discussions does not enable this functionality.
In some cases, users cannot convert existing issues to discussions.
Custom patterns for secret scanning have .* as an end delimiter, specifically in the "After secret" field. This delimiter causes inconsistencies in scans for secrets across repositories, and you may notice gaps in a repository's history where no scans completed. Incremental scans may also be impacted. To prevent issues with scans, modify the end of the pattern to remove the .* delimiter.
Following an upgrade to GitHub Enterprise Server 3.6 or later, existing inconsistencies in a repository such as broken refs or missing objects, may now be reported as errors like invalid sha1 pointer 0000000000000000000000000000000000000000, Zero-length loose reference file, or Zero-length loose object file. Previously, these indicators of repository corruption may have been silently ignored. GitHub Enterprise Server now uses an updated Git version with more diligent error reporting enabled. For more information, see this upstream commit in the Git project.

If you suspect a problem like this exists in one of your repositories, contact GitHub Enterprise Support for assistance.
Instances experiencing a high sustained number of concurrent Git requests may experience performance issues. If you suspect that this issue is affecting your instance, contact GitHub Support. For more information, see "Creating a support ticket." [Updated: 2022-12-07]
For participants in the private beta of SCIM for GitHub Enterprise Server, custom mappings for SAML user attributes are not supported in this release. Custom mappings are supported in GitHub Enterprise Server 3.6.5 or 3.7.5 and later. [Updated: 2023-02-27]
On instances in a high availability configuration, git push operations may fail in the following situations. [Updated: 2023-03-17]
- During creation of the repository on a replica node
- After failure to create the repository on a replica node, before automatic repair of the repository

Enterprise Server 3.6.3

Download GitHub Enterprise Server 3.6.3

October 25, 2022

3.6.3: Security fixes

HIGH: Updated dependencies for the Management Console to the latest patch versions, which addresses security vulnerabilities including CVE-2022-30123 and CVE-2022-29181.
HIGH: Added checks to address an improper cache key vulnerability that allowed an unauthorized actor to access private repository files through a public repository. This vulnerability has been assigned CVE-2022-23738.
MEDIUM: Updated CommonMarker to address a scenario where parallel requests to the Markdown REST API could result in unbounded resource exhaustion. This vulnerability has been assigned CVE-2022-39209.
MEDIUM: Updated Redis to 5.0.14 to address CVE-2021-32672 and CVE-2021-32762.
MEDIUM: Updated GitHub Actions runners to fix a bug that allowed environment variables in GitHub Actions jobs to escape the context of the variable and modify the invocation of docker commands directly. For more information, see the Actions Runner security advisory.
MEDIUM: An improper privilege management vulnerability was identified in GitHub Enterprise Server that allowed users with improper privileges to create or delete pages via the API. To exploit this vulnerability, an attacker would need to be added to an organization's repo with write permissions. This vulnerability was reported via the GitHub Bug Bounty program and has been assigned CVE-2022-23737.
LOW: Due to a CSRF vulnerability, a GET request to the instance's site/toggle_site_admin_and_employee_status endpoint could toggle a user's site administrator status unknowingly.
Packages have been updated to the latest security versions.

3.6.3: Bug fixes

After a site administrator made a change that triggered a configuration run, such as disabling GitHub Actions, validation of services would sometimes fail with the message WARNING: Validation encountered a problem.
After a site administrator installed a hotpatch containing changes to web interface assets such as JavaScript files or images, the instance did not serve the new assets.
When a user accessed a renamed repository using Git, the hostname in the Git output incorrectly indicated GitHub.com instead of the instance's hostname.
On instances using LDAP authentication and LDAP sync, sync would fail and print undefined method ord for nil:NilClass in ldap-sync.log.
When a user visited links to view history or suggest an improvement to the GitHub Advisory Database, the URLs were incorrect, resulting in a 404 error.
Deleted assets and assets scheduled to be purged within a repository, such as LFS files, took too long to to be cleaned up.
On instances configured for high availability, ghe-repl-status incorrectly reported that replication was behind for repositories that users had previously deleted.
If a user installed a GitHub App for the user account and then converted the account into an organization, the app was not granted organization permissions.
Missing secret scanning alerts on instance with a GitHub Advanced Security license that was not upgraded directly to GitHub Enterprise Server 3.4 are now visible in the web interface and through the REST API.
In some cases, on an instance with a GitHub Advanced Security license, some tokens detected by secret scanning were reported as "unknown tokens."

3.6.3: Changes

To ensure that site administrators can successfully complete an upgrade, the instance will now execute a preflight check to ensure that the virtual machine meets minimum hardware requirements. The check also verifies Elasticsearch's health. You can review the current requirements for CPU, memory, and storage for GitHub Enterprise Server in the "Minimum requirements" section within each article in "Setting up a GitHub Enterprise Server instance."

3.6.3: Known issues

On a freshly set up GitHub Enterprise Server instance without any users, an attacker could create the first admin user.
Custom firewall rules are removed during the upgrade process.
Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.
When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.
The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.
Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.
Actions services need to be restarted after restoring an instance from a backup taken on a different host.
In a repository's settings, enabling the option to allow users with read access to create discussions does not enable this functionality.
In some cases, users cannot convert existing issues to discussions.
Custom patterns for secret scanning have .* as an end delimiter, specifically in the "After secret" field. This delimiter causes inconsistencies in scans for secrets across repositories, and you may notice gaps in a repository's history where no scans completed. Incremental scans may also be impacted. To prevent issues with scans, modify the end of the pattern to remove the .* delimiter.
GitHub Pages builds may time out on instances in AWS that are configured for high availability. [Updated: 2022-11-28]
Instances experiencing a high sustained number of concurrent Git requests may experience performance issues. If you suspect that this issue is affecting your instance, contact GitHub Support. For more information, see "Creating a support ticket." [Updated: 2022-12-07]
For participants in the private beta of SCIM for GitHub Enterprise Server, custom mappings for SAML user attributes are not supported in this release. Custom mappings are supported in GitHub Enterprise Server 3.6.5 or 3.7.5 and later. [Updated: 2023-02-27]
On instances in a high availability configuration, git push operations may fail in the following situations. [Updated: 2023-03-17]
- During creation of the repository on a replica node
- After failure to create the repository on a replica node, before automatic repair of the repository

Enterprise Server 3.6.2

Download GitHub Enterprise Server 3.6.2

September 21, 2022

3.6.2: Features

Repository archives for migrations now include an is_archived field.

3.6.2: Security fixes

HIGH: A GitHub App could use a scoped user-to-server token to bypass user authorization logic and escalate privileges.
LOW: Granting a user the ability to bypass branch protections no longer allows the user to bypass the requirement for signature verification.
Packages have been updated to the latest security versions.

3.6.2: Bug fixes

In some cases, collectd could log excessive metrics-related errors in /var/log/collectd.log.
When configuring the external domain name of a repository cache replica node using ghe-repl-node --cache-domain, the command would return an error that prevented Git LFS caching from being enabled.
Installation of a TLS certificate failed when the certificate's subject string included UTF-8 characters.
Configuration runs could fail when retry-limit or retry-sleep-duration were manually set by an administrator using ghe-config.
The option to enable TLS encryption for incoming SMTP connections to an instance was missing from the Management Console.
In some cases, the Management Console's monitor dashboard would not load correctly.
Removed a non-functional link for exporting Management Console monitor graphs as a PNG image.
The ghe-find-insecure-git-operations command did not return all insecure Git operations after each invocation.
When sending a support bundle to GitHub Enterprise Support using ghe-support-upload, the -t option would not successfully associate the uploaded bundle with the specified ticket.
A link back to the security settings for the instance's enterprise account could render an incorrect view.
In rare cases, an upgrade from GitHub Enterprise Server 3.3 to 3.4 would incorrectly modify how data is stored, resulting in failures during future upgrades. When upgrading directly to this release from 3.3, the failure will not occur.
When using a VPC endpoint URL as an AWS S3 URL for GitHub Packages, publication and installation of packages failed.
Git clones or fetches over SSH could experience data corruption for transfers over 1GB in size.
After a user deleted or restore

Enterprise Server 3.6 release notes