Skip to main content

03-21 Platform Release Notes

· 11 min read

Before digging into the changes...​

  • Reminder: Please contact support@cloud.gov to schedule your RDS upgrades if you have not already done so.

  • The default amount of memory for staging applications has been increased from 1GB to 2GB to attempt to mitigate staging OOM issues. Once we verify the recently deployed stemcells with the fix, we will be dropping it back down to 1 GB during upgrades next week.

  • As mentioned above there is a fix for the Out of Memory issue, which is live in production. The release 1.404 contains this fix:

    The linux kernel has been changed from the HWE line of kernels back to the LTS line of kernels. Changing from the current 6.5 to 5.15. This is an attempt to mitigate issue 318 where we see cgroups with memory limits hitting OOM errors when they previously did not under the 6.2 kernel versions

Customer Facing Changes​

The audience for this section is developers who maintain applications on cloud.gov and may need to respond to stack or buildpack changes.

CF-Deployment - v38.1.0 to v39.7.0​

Changes below are broken down by component, note that v39.7.0 was a stemcell update from v1.404 to v1.406 of the Jammy Stemcell, the rest listed below are for v39.6.0:

dotnet-core-buildpack 2.4.23 to 2.4.25​

  • Add dotnet-sdk 8.0.203, remove dotnet-sdk 8.0.202 (#947)
  • Add dotnet-aspnetcore 6.0.28, remove dotnet-aspnetcore 6.0.27
  • Add dotnet-runtime 6.0.28, remove dotnet-runtime 6.0.27 (#940)
  • Add dotnet-sdk 6.0.420, remove dotnet-sdk 6.0.419 (#939)
  • Add dotnet-aspnetcore 7.0.17, remove dotnet-aspnetcore 7.0.16 (#942)
  • Add dotnet-runtime 7.0.17, remove dotnet-runtime 7.0.16 (#945)
  • Add dotnet-sdk 7.0.407, remove dotnet-sdk 7.0.406 (#941)
  • Add dotnet-aspnetcore 8.0.3, remove dotnet-aspnetcore 8.0.2 (#937)
  • Add dotnet-runtime 8.0.3, remove dotnet-runtime 8.0.2 (#943)
  • Add dotnet-sdk 8.0.202, remove dotnet-sdk 8.0.201 (#938)
  • Add libunwind 1.8.1, remove libunwind 1.8.0 (#925)
  • Add node 20.11.1, remove node 20.11.0
  • Add dotnet-sdk 8.0.201, remove dotnet-sdk 8.0.200
  • Add support for BP_OPENSSL_ACTIVATE_LEGACY_PROVIDER (#921)
  • Enables the new environment variable will load and active the legacy openssl provider
  • Remove use_legacy_openssl buildpack.yml setting in favour of the environment variable

Packaged binaries:

  • bower 1.8.14
  • dotnet-aspnetcore 6.0.27
  • dotnet-aspnetcore 7.0.16
  • dotnet-aspnetcore 8.0.2
  • dotnet-runtime 6.0.27
  • dotnet-runtime 7.0.16
  • dotnet-runtime 8.0.2
  • dotnet-sdk 6.0.419
  • dotnet-sdk 7.0.406
  • dotnet-sdk 8.0.201
  • libgdiplus 6.1
  • libunwind 1.8.1
  • node 20.11.1

Default binary versions:

  • dotnet-runtime 6.0.x
  • dotnet-aspnetcore 6.0.x
  • dotnet-sdk 6.0.x
  • bower 1.8.x

go-buildpack 1.10.16 to 1.10.17​

  • Add go 1.22.1, remove go 1.22.0
  • Add go 1.21.8, remove go 1.21.7
  • Deprecate Go 1.20.x (EOL) (#424)

Packaged binaries:

  • dep 0.5.4
  • glide 0.13.3
  • go 1.21.8
  • go 1.22.1
  • godep 80

Default binary versions:

  • go 1.21.x

java-buildpack 4.66.0 to 4.67.0​

For a more detailed look at the changes in 4.67.0, please take a look at the commit log. The packaged version of the buildpack, suitable for use with create-buildpack and update-buildpack, can be found attached to this release.

DependencyVersionCVEsRelease Notes
AppDynamics Agent24.2.0_35552
Azure Application Insights Agent3.5.0Release Notes
CA Introscope APM Framework24.2.1_7
Client Certificate Mapper2.0.1Included inline aboveIncluded inline above
Container Security Provider1.20.0_RELEASEIncluded inline aboveIncluded inline above
Contrast Security Agent6.2.1Release Notes
Datadog APM Javaagent1.31.0Release Notes
Elastic APM Agent1.48.0Release Notes
Gemalto Luna Security Provider7.4.0Release Notes
Geode Tomcat Session Store1.14.9
Google Stackdriver Profiler0.1.0Release Notes
Groovy2.5.23Release Notes
JaCoCo Agent0.8.11Release Notes
Java CFEnv3.1.5Release Notes
Java Memory Assistant Agent0.5.0
Java Memory Assistant Clean Up0.1.0
JProfiler Profiler13.0.7ChangeLog
JRebel Agent2024.1.1ChangeLog
jvmkill Agent1.17.0_RELEASEIncluded inline aboveIncluded inline above
MariaDB JDBC Driver2.7.9Release Notes
Memory Calculator3.13.0_RELEASEIncluded inline aboveIncluded inline above
Metric Writer3.5.0_RELEASEIncluded inline aboveIncluded inline above
New Relic Agent8.9.1Release Notes
Open Telemetry Agent2.1.0Release Notes
OpenJDK JRE 1111.0.22_12Risk MatrixRelease Notes
OpenJDK JRE 1717.0.10_13Risk MatrixRelease Notes
OpenJDK JRE 2121.0.2_14Risk MatrixRelease Notes
OpenJDK JRE 81.8.0_402Risk MatrixRelease Notes
PostgreSQL JDBC Driver42.7.2Release Notes
Redis Session Store1.3.6_RELEASEIncluded inline aboveIncluded inline above
Riverbed Appinternals Agent11.8.5_BL527
SeaLights Agent4.0.2459
SkyWalking8.16.0ChangeLog
Splunk OpenTelemetry Java Agent1.30.3Release Notes
Spring Auto-reconfiguration2.12.0_RELEASEIncluded inline aboveIncluded inline above
Spring Boot CLI2.7.18
Spring Boot Container Customizer2.6.0_RELEASEIncluded inline aboveIncluded inline above
Takipi Agent4.73.3Release Notes
Tomcat9.0.86SecurityChangeLog
Tomcat Access Logging Support3.4.0_RELEASEIncluded inline aboveIncluded inline above
Tomcat Lifecycle Support3.4.0_RELEASEIncluded inline aboveIncluded inline above
Tomcat Logging Support3.4.0_RELEASEIncluded inline aboveIncluded inline above
YourKit Profiler2023.9.109Release Notes

nginx-buildpack 1.2.11 to 1.2.12​

  • Add nginx 1.25.4, remove nginx 1.25.3 (#267)

Packaged binaries:

  • nginx 1.24.0
  • nginx 1.25.4
  • openresty 1.21.4.2
  • openresty 1.25.3.1

Default binary versions:

  • nginx 1.25.x

php-buildpack 4.6.15 to 4.6.16​

  • Add php 8.2.16, remove php 8.2.14

Packaged binaries:

  • appdynamics 23.11.0-839
  • composer 2.7.1
  • httpd 2.4.58
  • newrelic 10.11.0.3
  • nginx 1.24.0
  • nginx 1.25.4
  • php 8.1.26
  • php 8.1.27
  • php 8.2.15
  • php 8.2.16
  • php 8.3.1
  • php 8.3.3
  • python 2.7.18
  • ruby 3.0.5

Default binary versions:

  • php 8.1.27
  • httpd 2.4.58
  • newrelic 10.11.0.3
  • nginx 1.25.4
  • composer 2.7.1

python-buildpack 1.8.20 to 1.8.21​

  • Add setuptools 69.1.1, remove setuptools 69.1.0
  • Add miniconda3-py39 24.1.2, remove miniconda3-py39 23.11.0

Packaged binaries:

  • libffi 3.2.1
  • libmemcache 1.0.18
  • miniconda3-py39 24.1.2
  • pip 24.0
  • pipenv 2023.12.1
  • python 3.8.18
  • python 3.9.18
  • python 3.10.13
  • python 3.11.8
  • python 3.12.2
  • setuptools 69.1.1

Default binary versions:

  • python 3.10.x

r-buildpack 1.2.8 to 1.2.9​

  • Rebuild executables

Packaged binaries:

  • r 3.6.3
  • r 4.2.3
  • r 4.3.2

ruby-buildpack 1.10.9 to 1.10.10​

  • Add jruby 9.4.6.0, remove jruby 9.4.5.0 (#906)
  • Add node 20.11.1, remove node 20.11.0 (#905)

Packaged binaries:

  • bundler 2.5.6
  • jruby 9.4.6.0
  • node 20.11.0
  • openjdk1.8-latest 1.8.0
  • ruby 3.1.3
  • ruby 3.1.4
  • ruby 3.2.2
  • ruby 3.2.3
  • ruby 3.3.0
  • rubygems 3.5.6
  • yarn 1.22.21

Default binary versions:

  • ruby 3.2.x

staticfile-buildpack 1.6.10 to 1.6.11​

  • Add nginx 1.25.4, remove nginx 1.25.3 (#408)

Packaged binaries:

  • nginx 1.24.0
  • nginx 1.25.4

Default binary versions:

  • nginx 1.25.x

CFLinuxfs4 - v1.82.0 up from v1.79.0​

Notably, this release addresses:

  • USN-6694-1 Expat vulnerabilities:

    • CVE-2024-28757: libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).
    • CVE-2023-52425: libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.

  • USN-6677-1 libde265 vulnerabilities:

    • CVE-2023-49468: Libde265 v1.0.14 was discovered to contain a global buffer overflow vulnerability in the read_coding_unit function at slice.cc.
    • CVE-2023-49465: Libde265 v1.0.14 was discovered to contain a heap-buffer-overflow vulnerability in the derive_spatial_luma_vector_prediction function at motion.cc.
    • CVE-2023-27102: Libde265 v1.0.11 was discovered to contain a segmentation violation via the function decoder_context::process_slice_segment_header at decctx.cc.
    • CVE-2023-49467: Libde265 v1.0.14 was discovered to contain a heap-buffer-overflow vulnerability in the derive_combined_bipredictive_merging_candidates function at motion.cc.
    • CVE-2023-27103: Libde265 v1.0.11 was discovered to contain a heap buffer overflow via the function derive_collocated_motion_vectors at motion.cc.
    • CVE-2023-47471: Buffer Overflow vulnerability in strukturag libde265 v1.10.12 allows a local attacker to cause a denial of service via the slice_segment_header function in the slice.cc component.
    • CVE-2023-43887: Libde265 v1.0.12 was discovered to contain multiple buffer overflows via the num_tile_columns and num_tile_row parameters in the function pic_parameter_set::dump.

Platform Changes​

This section is for the platform operators at cloud.gov to highlight changes to Cloud Foundry components, this is likely not of interest for developers using the platform.

bpm 1.2.16 to 1.2.17​

  • Updates golang package golang-1-linux to 1.22.1

CAPI v1.173.0 to v1.175.0​

Cloud Controller​

Cloud Controller Database Migrations

log-cache 3.0.10 to 3.0.11​

  • Bump dependencies
  • Bump packaged Golang to go 1.21.8

loggregator-agent 7.7.5 to 8.0.2​

routing 0.292.0 to 0.293.0​

statsd-injector 1.11.38 to 1.11.39​

syslog 11.8.17 to 12.2.3​

  • Bump dependencies
  • Bump packaged Golang to go1.21.8

uaa 77.1.0 to 77.2.0​

Misc​

Dependency Bumps​

  • Bump rspec-support from 3.13.0 to 3.13.1 by @dependabot in #809
  • Bump drb from 2.2.0 to 2.2.1 by @dependabot in #812
  • Bump github.com/cloudfoundry/bosh-utils from 0.0.446 to 0.0.447 in /src/acceptance_tests by @dependabot in #814
  • Bump github.com/cloudfoundry/bosh-utils from 0.0.447 to 0.0.448 in /src/acceptance_tests by @dependabot in #817
  • Bump i18n from 1.14.1 to 1.14.3 by @dependabot in #816
  • Bump github.com/cloudfoundry/bosh-utils from 0.0.448 to 0.0.449 in /src/acceptance_tests by @dependabot in #819
  • Bump i18n from 1.14.3 to 1.14.4 by @dependabot in #820

Known Issues​

  • During the upgrade to this version from UAA v76 or below with canary deployment (where briefly both new and old UAA servers could be running), UAA delete user endpoint might respond with an error even though the user deletion is successful. Mitigation: Delete users after the canary deployment finishes. But if you do run into this issue, you can ignore the error and check whether the user has been successfully deleted after the canary deployment finishes.

Full UAA Changelog: v77.1.0...v77.2.0

Final Note​

Tune in next sprint for new release notes!

GSA.gov

An official website of the U.S. General Services Administration

Looking for U.S. government information and services?
Visit USA.gov