# Portainer changelog > A container management platform for Docker and Kubernetes. - Vendor: Portainer - Category: Developer Tools - Official site: https://www.portainer.io - Tracked by: What's New (https://whatsnew.fyi/product/portainer) - Harvested from: GitHub (portainer/portainer) - Entries below: 10 (newest first) What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. ## Releases ### 2.44.0 — Release 2.44.0 STS - Date: 2026-07-30 - Version: 2.44.0 - Original notes: https://github.com/portainer/portainer/releases/tag/2.44.0 - Permalink: https://whatsnew.fyi/product/portainer/releases/2.44.0 - **added** — Add a basic workflow details screen - **added** — Add GPU visibility in the Environment Details view - **changed** — Make the Portainer setup token easier to spot in the installation logs - **changed** — Track the Source, Workflow, and Artifact status persistently - **changed** — Upgrade bbolt to v1.5.0 for performance and robustness improvements - **changed** — Move the build pipeline to BuildKit v0.31.2 (previously v0.27.0); image build provenance attestations moved to the SLSA v1.0 format (previously v0.2) - **security** — Fix unauthorized access via leftover service accounts - **security** — Fix path traversal in the swarm compose deployer, where configs/secrets file paths escaped the project root - **security** — Upgrade oras.land/oras-go/v2 to 2.6.1 to remediate CVEs - **security** — Upgrade containerd to 1.7.33 / v2 2.2.5 to remediate CVEs - **security** — Upgrade google.golang.org/grpc to 1.82.1 to remediate GHSA-hrxh-6v49-42gf - **security** — Upgrade axios to 1.18.0 to remediate CVEs - **security** — Upgrade shell-quote to 1.8.4 to remediate CVEs - **fixed** — Fix the "This node is not a swarm manager" error message when running inside a swarm - **fixed** — Fix image builds failing to authenticate against private registries in FROM lines by allowing the X-Registry-Config header through the proxy - **fixed** — Fix a team with valid access not appearing in Config access control while another team with identical access was visible - **fixed** — Fix AD/LDAP settings defects where special characters were stripped, the username format selection was invisible, the root domain was unpopulated, and the delete button was broken - **fixed** — Fix an issue where [object Object] appeared as an element name on the Alerting page - **fixed** — Fix a problem that caused sources to fail to load - **fixed** — Bring back shared Git credentials for GitOps Sources ##### Known issues - On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot ###### Known issues with Podman support - Podman environments aren't supported by auto-onboarding script - It's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa) - Support for only CentOS 9, Podman 5 rootful ##### Changes ###### New and improved features - Added a basic workflow details screen - Added GPU visibility in the Environment Details view - Made the Portainer setup token easier to spot in the installation logs - Tracked the Source, Workflow, and Artifact status persistently - Upgraded bbolt to v1.5.0 for performance and robustness improvements - Moved the build pipeline to BuildKit v0.31.2 (previously v0.27.0); image build provenance attestations moved to the SLSA v1.0 format (previously v0.2) — any tooling that parses attestations needed to be verified against the new format ###### Security improvements - Fixed unauthorized access via leftover service accounts - Fixed path traversal in the swarm compose deployer, where configs/secrets file paths escaped the project root - CVE remediation: - Upgraded oras.land/oras-go/v2 to 2.6.1 to remediate CVEs - Upgraded containerd to 1.7.33 / v2 2.2.5 to remediate CVEs - Upgraded google.golang.org/grpc to 1.82.1 to remediate GHSA-hrxh-6v49-42gf - Upgraded axios to 1.18.0 to remediate CVEs - Upgraded shell-quote to 1.8.4 to remediate CVEs ###### Bug fixes - Fixed the "This node is not a swarm manager" error message when running inside a swarm - Fixed image builds failing to authenticate against private registries in FROM lines by allowing the X-Registry-Config header through the proxy - Fixed a team with valid access not appearing in Config access control while another team with identical access was visible - Fixed AD/LDAP settings defects where special characters were stripped, the username format selection was invisible, the root domain was unpopulated, and the delete button was broken - Fixed an issue where [object Object] appeared as an element name on the Alerting page - Fixed a problem that caused sources to fail to load - Brought back shared Git credentials for GitOps Sources - Fixed an issue where a space-delimited list of scopes wasn't correctly requesting access to resources on the user's behalf, so the Google consent screen didn't show the expected permissions - Fixed the poll frequency selection dropdown staying on the default value - Fixed RBAC policy's datatable namespace input - Fixed the forced polling usage in Git sources - Fixed Helm chart uninstall showing cosmetic errors only - Fixed the tooltip rendering for environment variables in Portainer Application Templates - Fixed the Ingress service port number being displayed as 0 instead of the configured value - Fixed Kubernetes manifest deployments reporting success but silently failing when "Use namespace from manifest" was disabled - Fixed an output mismatch in the Kubectl shell between BE and CE - Fixed an issue where logout caused an infinite page reload - Fixed a missing source in the list until refresh - Fixed non-admin redeploy failing when numeric environment variables were quoted in a stack (invalid containerPort) - Fixed Portainer STS 2.42.0 showing "1 Agent needs upgrading" when none did - Fixed Docker stack deployments that exceeded the 15-minute timeout remaining stuck in the "Deploying" state and blocking further redeployments - Fixed RBAC policies not creating RoleBindings for grants with no namespace list (e.g. Operator, Helpdesk) - Fixed re-assigning an edge group to an edge stack bringing back old state - Fixed a regression where relative env_file: in Git sub-directory stacks resolved from the project root instead of the compose file's directory - Removed the hint box from the Applications page - Fixed Swarm stack and service deployments _[Truncated at 4000 characters — full notes: https://github.com/portainer/portainer/releases/tag/2.44.0]_ ### 2.39.5 — Release 2.39.5 LTS - Date: 2026-07-13 - Version: 2.39.5 - Original notes: https://github.com/portainer/portainer/releases/tag/2.39.5 - Permalink: https://whatsnew.fyi/product/portainer/releases/2.39.5 - **fixed** — Fixed a 2.39.4 regression where a relative env_file: in a Git stack whose compose file lives in a repository sub-directory was resolved against the project root instead of the compose file's own directory - **changed** — Improved Edge tunnel reliability over high-latency links by not tearing down a half-established tunnel on timeout, adding keep-alive and unlimited background retries on the agent, and raising the ping timeout from 3s to 8s - **fixed** — Fixed standard users not seeing all of their teams in access control selectors due to FilterUserTeams incorrectly dropping teams - **fixed** — Fixed deleting images from the Swarm image list only removing them from a single node instead of every node they exist on - **fixed** — Fixed a potential block where a Docker stack deployment exceeding the internal 15-minute timeout left the stack stuck in Deploying status - **fixed** — Fixed the environment details view always showing the default poll frequency for Edge environments instead of the saved value - **security** — Upgraded the Alpine base image from 3.23.4 to 3.24.1 to address OS-level package CVEs including jq advisories CVE-2026-32316 and CVE-2026-40164 - **security** — Upgraded github.com/containerd/containerd/v2 to 2.2.5 to address CVE-2026-53488, CVE-2026-53492, CVE-2026-53489, CVE-2026-47262, and CVE-2026-50195 ##### Known issues - On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot ###### Known issues with Podman support - Podman environments aren't supported by auto-onboarding script - It's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa) - Support for only CentOS 9, Podman 5 rootful ##### Changes - Fixed a 2.39.4 regression where a relative `env_file:` in a Git stack whose compose file lives in a repository sub-directory was resolved against the project root instead of the compose file's own directory, deploying stacks with an empty environment or failing outright - Improved Edge tunnel reliability over high-latency links (satellite/VSAT): the server no longer tears down a half-established tunnel on timeout, keep-alive and unlimited background retries were added on the agent, and the ping timeout was raised from 3s to 8s - Fixed standard users not seeing all of their teams in access control selectors (e.g. when restricting access on a newly created Docker Config), caused by `FilterUserTeams` incorrectly dropping teams - Fixed deleting images from the Swarm image list only removing them from a single node instead of every node they exist on - Fixed a potential block where a Docker stack deployment exceeding the internal 15-minute timeout left the stack stuck in "Deploying" status, preventing further redeployments - Fixed the environment details view always showing the default poll frequency for Edge environments instead of the saved value - Upgraded the Alpine base image from 3.23.4 to 3.24.1 to address OS-level package CVEs, including the jq advisories (CVE-2026-32316, CVE-2026-40164 and others) - Upgraded `github.com/containerd/containerd/v2` to 2.2.5 to address the following CVEs: - CVE-2026-53488, - CVE-2026-53492, - CVE-2026-53489, - CVE-2026-47262, - CVE-2026-50195 ##### Deprecated and removed features **Deprecated features** - None **Removed features** - None ### 2.39.4 — Release 2.39.4 LTS - Date: 2026-06-25 - Version: 2.39.4 - Original notes: https://github.com/portainer/portainer/releases/tag/2.39.4 - Permalink: https://whatsnew.fyi/product/portainer/releases/2.39.4 - **added** — Add an API endpoint to refresh Team/Group membership for a user - **fixed** — Fix an issue where users with no environment access are able to enumerate Kubernetes resources - **fixed** — Fix ecr token pre-validation error with warning log - **fixed** — Fix the way a standard user could not redeploy team stack or delete registry image - **fixed** — Fix the restore endpoint allowing admin takeover for uninitialised Portainer instances - **fixed** — Fix link on timed out page - **changed** — Replace docker binary with libstack - **fixed** — Fix the volume label dropdown becoming blank - **security** — Bump go-git to 5.19.1 to address CVE-2026-45570, CVE-2026-45571, and GHSA-w5pp-99ch-qj29 - **security** — Bump go stdlib to 1.25.11 to remediate multiple stdlib CVEs including CVE-2026-42504, CVE-2026-27145, CVE-2026-42499, CVE-2026-39836, CVE-2026-39820, CVE-2026-33814, CVE-2026-33811, CVE-2026-39826, CVE-2026-39823, CVE-2026-39825, and CVE-2026-42507 ##### Known issues - On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot - kubectl port-forward fails with Portainer kubeconfig in some configurations ###### Known issues with Podman support - Podman environments aren't supported by auto-onboarding script - It's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa) - Support for only CentOS 9, Podman 5 rootful ##### Changes - Added an API endpoint to refresh Team/Group membership for a user - Fixed an issue where users with no environment access are able to enumerate Kubernetes resources - Fixed ecr token pre-validation error with warning log - Fixed the way a standard user could not redeploy team stack or delete registry image - Fixed the restore endpoint allowing admin takeover for uninitialised Portainer instances - Fixed link on timed out page - Replaced docker binary with libstack - Fixed the volume label dropdown becoming blank - Bump go-git to 5.19.1 to address the following CVEs: - CVE-2026-45570 - CVE-2026-45571 - GHSA-w5pp-99ch-qj29 - Bumped go stdlib to 1.25.11 to remediate the following stdlib CVEs: - CVE-2026-42504 - CVE-2026-27145 - CVE-2026-42499 - CVE-2026-39836 - CVE-2026-39820 - CVE-2026-33814 - CVE-2026-33811 - CVE-2026-39826 - CVE-2026-39823 - CVE-2026-39825 - CVE-2026-42504 - CVE-2026-27145 - CVE-2026-42507 ##### Deprecated and removed features ###### Deprecated features None ###### Removed features None ### 2.43.0 — Release 2.43.0 STS - Date: 2026-06-24 - Version: 2.43.0 - Original notes: https://github.com/portainer/portainer/releases/tag/2.43.0 - Permalink: https://whatsnew.fyi/product/portainer/releases/2.43.0 - **added** — GitOps Sources: new Source Creation wizard, Source Detail screen and Source editing, with reuse of existing sources when adding Docker repository stacks and Kubernetes Helm-from-git installs - **added** — Display cached container images per node on Kubernetes - **added** — In-product installation flow for KubeSolo-based single-node edge deployments - **added** — Added a one-time setup token, printed to the server logs at startup, that is required to create the first administrator account or restore a backup on a new, uninitialised instance - **added** — Implemented an SSRF protection mechanism with a configurable allow-list in settings (off / audit / enforce modes) - **changed** — Kubernetes application list and pod logs now default to expanded - **changed** — Environment Group Detail View updated with a new sortable-list-based group list UI - **security** — Added an endpoint authorization check to /api/kubernetes/{id}/* routes, preventing users with no access from enumerating Kubernetes resources - **security** — Fixed custom-template user-access checks that bypassed the Resource Control definition, allowing edit/inspect/delete authorization to ignore admins-only / public / team grants - **security** — Filter GET namespace results by the user's allowed-namespace list, returning Forbidden for namespaces the user cannot access - **security** — Bumped golang.org/x/net to v0.55.0 for CVE-2026-39821, CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-42502, CVE-2026-42506 - **security** — Bumped golang.org/x/crypto to v0.52.0 for CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-42508, CVE-2026-46595 - **security** — Bumped go.opentelemetry.io/otel to v1.43.0 for CVE-2026-39882, CVE-2026-39883 - **security** — Bumped github.com/go-git/go-git/v5 to v5.19.1 for CVE-2026-45571, GHSA-w5pp-99ch-qj29, CVE-2026-45570 - **security** — Bumped Go stdlib to 1.26.4 for CVE-2026-42504, CVE-2026-27145, CVE-2026-42507 - **security** — Bumped Go to 1.26.3 for CVE-2026-42499, CVE-2026-39836, CVE-2026-39820, CVE-2026-33814, CVE-2026-33811, CVE-2026-39826, CVE-2026-39823, CVE-2026-39825 - **fixed** — Fixed edge stacks that could not be deployed (Helm file-path cleared incorrectly) - **fixed** — Fixed a ZodError (edgeStackId invalid input) when deploying an edge stack from a private repo to a group - **fixed** — Fixed "Invalid option: expected one of 1|2" error for environments in the waiting room - **fixed** — Fixed edge agent poll-handler timeouts and deadlocks; stale tunnels are now cleaned up immediately - **removed** — Provision KaaS Cluster feature ##### Known issues - On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot ###### Known issues with Podman support - Podman environments aren't supported by auto-onboarding script - It's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa) - Support for only CentOS 9, Podman 5 rootful ##### Changes ###### New and improved features - GitOps Sources: new Source Creation wizard, Source Detail screen and Source editing, with reuse of existing sources when adding Docker repository stacks and Kubernetes Helm-from-git installs - Display cached container images per node on Kubernetes - In-product installation flow for KubeSolo-based single-node edge deployments - Kubernetes application list and pod logs now default to expanded - Environment Group Detail View updated with a new sortable-list-based group list UI ###### Security improvements - Added a one-time setup token, printed to the server logs at startup, that is required to create the first administrator account or restore a backup on a new, uninitialised instance. - Implemented an SSRF protection mechanism with a configurable allow-list in settings (off / audit / enforce modes) - Added an endpoint authorization check to /api/kubernetes/{id}/* routes, preventing users with no access from enumerating Kubernetes resources - Fixed custom-template user-access checks that bypassed the Resource Control definition, allowing edit/inspect/delete authorization to ignore admins-only / public / team grants - Filter GET namespace results by the user's allowed-namespace list, returning Forbidden for namespaces the user cannot access - Bumped golang.org/x/net to v0.55.0 for the following CVEs: - CVE-2026-39821, CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-42502, CVE-2026-42506 - Bumped golang.org/x/crypto to v0.52.0 for the following CVEs: - CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-42508, CVE-2026-46595 - Bumped go.opentelemetry.io/otel to v1.43.0 for the following CVEs: - CVE-2026-39882, CVE-2026-39883 - Bumped github.com/go-git/go-git/v5 to v5.19.1 for the following CVEs: - CVE-2026-45571, GHSA-w5pp-99ch-qj29, CVE-2026-45570 - Bumped Go stdlib to 1.26.4 for the following CVEs: - CVE-2026-42504, CVE-2026-27145, CVE-2026-42507 - Bumped Go to 1.26.3 for the following CVEs: - CVE-2026-42499, CVE-2026-39836, CVE-2026-39820, CVE-2026-33814, CVE-2026-33811, CVE-2026-39826, CVE-2026-39823, CVE-2026-39825 - Bumped containerd to 1.7.32 and containerd/v2 to 2.2.4 for the following CVEs: - CVE-2026-46680 - Upgraded the kubectl-shell Helm SDK to helm/v4 4.1.4 for the following CVEs: - CVE-2026-35204, CVE-2026-35205 ###### Bug fixes - Fixed edge stacks that could not be deployed (Helm file-path cleared incorrectly) - Fixed a ZodError (edgeStackId invalid input) when deploying an edge stack from a private repo to a group - Fixed "Invalid option: expected one of 1|2" error for environments in the waiting room - Fixed edge agent poll-handler timeouts and deadlocks; stale tunnels are now cleaned up immediately - Fixed webhook POST returning 404 "Unable to find a webhook with this token" (webhook ID creation in the frontend) - Fixed Git auto-update polling failures for regular stacks caused by a cancelled deployment context - Standard users with access permission can again browse and delete private registry images (2.39.2 regression) - Fixed a 500 error on stack deploy/update when an invalid ECR registry is present; ECR token pre-validation errors now log a warning instead - Networks assigned to a Docker Swarm service at creation time are now correctly applied to the created service - Restored YAML syntax highlighting in the web editor - Improved performance of the image up-to-date status indicator; the UI no longer becomes slow/unresponsive on envir _[Truncated at 4000 characters — full notes: https://github.com/portainer/portainer/releases/tag/2.43.0]_ ### 2.39.3 — Release 2.39.3 LTS - Date: 2026-06-03 - Version: 2.39.3 - Original notes: https://github.com/portainer/portainer/releases/tag/2.39.3 - Permalink: https://whatsnew.fyi/product/portainer/releases/2.39.3 - **fixed** — Fixed a panic in Chisel - **security** — Bumped in-toto-golang to 0.11.0 to address GHSA-pmwq-pjrm-6p5r - **security** — Fixed a team access escalation via AuthorizedResourceControlUpdate logic flaw - **security** — Fixed a full-read server-side request forgery (SSRF) vulnerability in the GitLab Registry Proxy endpoint that could be exploited via the X-Gitlab-Domain header - **security** — Bumped github.com/go-git/go-git/v5 to 5.18.0 to address CVE-2026-34165, GHSA-3xc5-wrhm-f963, and CVE-2026-33762 - **security** — Bumped golang.org/x/net to >= 0.53.0 to address CVE-2026-27141 and CVE-2026-33814 - **fixed** — Fixed the "Re-pull image and redeploy" toggle - **changed** — Improved edge environment snapshot reliability by proactively triggering snapshots - **security** — Bumped golang.org/x/crypto to 0.52.0 to address CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-42508, and CVE-2026-46595 - **fixed** — Fixed a Git Auto Update polling failure for Stacks caused by improper shutdowns ##### Known issues - On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot ###### Known issues with Podman support - Support for only CentOS 9, Podman 5 rootful - Auto onboarding a Podman environment defaults to "Standard" and not "Podman" - It's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa) ##### Changes - Fixed a panic in Chisel - Bumped in-toto-golang to 0.11.0 to address GHSA-pmwq-pjrm-6p5r - Fixed a team access escalation via AuthorizedResourceControlUpdate logic flaw - Fixed a full-read server-side request forgery (SSRF) vulnerability in the GitLab Registry Proxy endpoint that could be exploited via the X-Gitlab-Domain header - Bumped github.com/go-git/go-git/v5 to 5.18.0 to address the following CVEs: - CVE-2026-34165 - GHSA-3xc5-wrhm-f963 - CVE-2026-33762 - Bumped golang.org/x/net to >= 0.53.0 to address the following CVEs: - CVE-2026-27141 - CVE-2026-33814 - Fixed the "Re-pull image and redeploy" toggle - Improved edge environment snapshot reliability by proactively triggering snapshots - Bumped golang.org/x/crypto to 0.52.0 to address the following CVEs: - CVE-2026-39830 - CVE-2026-39831 - CVE-2026-39832 - CVE-2026-39833 - CVE-2026-39834 - CVE-2026-42508 - CVE-2026-46595 - Fixed a Git Auto Update polling failure for Stacks caused by improper shutdowns ##### Deprecated and removed features None ### 2.42.0 — Release 2.42.0 STS - Date: 2026-05-20 - Version: 2.42.0 - Original notes: https://github.com/portainer/portainer/releases/tag/2.42.0 - Permalink: https://whatsnew.fyi/product/portainer/releases/2.42.0 - **removed** — Remove legacy CSRF fallback (legacy-csrf feature flag) - **security** — Fix CVE-2025-47909 related to CSRF protection implementation - **added** — Add theme selector to the user menu for switching between light, dark, and high-contrast themes - **added** — Add GitOps sources list view and source detail view for managing Git sources - **added** — Add connectivity test before adding edge environments - **added** — Add Docker host disk usage display to the host details view - **changed** — Replace Kubernetes Volume view with 3 new tables for PV, PVC, SC - **added** — Add link ability between Kubernetes secrets and service account image pull secrets for private registry access - **added** — Add pod restart and pod delete support on the Kubernetes application details page - **changed** — Improve Application Container list by separating pod info from containers list - **changed** — Port Swarm stack deployments to use libstack, eliminating the embedded Docker binary from CE/BE images - **added** — Add support for volumes-only mount paths in the agent for non-default Docker volume mount paths - **added** — Add missing snapshot collection for Edge Agents with long running Chisel connections - **security** — Fix Docker exec endpoint to enforce container resource controls - **security** — Fix Docker proxy to enforce resource controls on /containers/{id}/attach/ws WebSocket endpoint - **security** — Fix URL path rewriting to clear the RawPath field, preventing path traversal via percent-encoded paths - **security** — Enforce server-side EdgeID on first connection - **security** — Set Secure attribute automatically on authentication cookies when Portainer is accessed over HTTPS - **security** — Upgrade golang.org/x/net to v0.54.0 to address CVE-2026-27141 and CVE-2026-33814 - **security** — Upgrade github.com/go-git/go-git/v5 to v5.19.0 to address CVE-2026-34165, GHSA-3xc5-wrhm-f963, and CVE-2026-33762 ##### Known issues - On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot. ###### Known issues with Podman support - Support for only CentOS 9, Podman 5 rootful. ##### Changes ###### Breaking changes Changes to the CSRF protection implementation may cause failures when upgrading: - Removal of legacy CSRF fallback (scheduled). The legacy-csrf feature flag, introduced in 2.41 as a temporary migration aid, has been removed as scheduled. Users still relying on this flag must resolve any CSRF configuration issues before upgrading (see the 2.41 breaking changes for details). This change also resolves CVE-2025-47909. ###### New and improved features - Added theme selector to the user menu, allowing switching between light, dark, and high-contrast themes without navigating to settings. - Added GitOps sources list view and source detail view for managing Git sources used in deployments. - Added a connectivity test before adding edge environments. - Added Docker host disk usage display to the host details view. - Replaced Kubernetes Volume view with 3 new tables for PV, PVC, SC (PersistentVolumes, PersistentVolumeClaims, StorageClasses). - Added link ability between Kubernetes secrets and service account image pull secrets for private registry access. - Added pod restart and pod delete support on the Kubernetes application details page. - Improved Application Container list, separated pod info from containers list. - Ported Swarm stack deployments to use libstack, eliminating the embedded Docker binary from CE/BE images. - Added support for volumes-only mount paths in the agent, enabling environments where Docker volumes are accessible via non-default mount paths. - Added missing snapshot collection for Edge Agents with long running Chisel connections. ###### Security improvements - Fixed Docker exec endpoint to enforce container resource controls, preventing unauthorized exec access to containers. - Fixed Docker proxy to enforce resource controls on /containers/{id}/attach/ws WebSocket endpoint. - Fixed URL path rewriting to clear the RawPath field, preventing path traversal via percent-encoded paths. - Changed a default setting to enforce server-side EdgeID on first connection. - Authentication cookies now have the Secure attribute set automatically when Portainer is accessed over HTTPS. - Upgraded golang.org/x/net to v0.54.0 to address CVE-2026-27141 and CVE-2026-33814. - Upgraded github.com/go-git/go-git/v5 to v5.19.0 to address CVE-2026-34165, GHSA-3xc5-wrhm-f963, and CVE-2026-33762. - Upgraded github.com/in-toto/in-toto-golang to v0.11.0 to address GHSA-pmwq-pjrm-6p5r. - Upgraded github.com/Azure/go-ntlmssp to v0.1.1 to address CVE-2026-32952. - Upgraded github.com/prometheus/prometheus to v0.311.3 to address CVE-2026-40179, GHSA-fw8g-cg8f-9j28, and CVE-2026-42151. ###### Bug fixes - Fixed TLS configuration being accepted for Edge Agent environments via API (TLS is now correctly rejected for Edge Agent environment creation and updates). - Fixed stack deployments hanging due to deadlock during ECR token refresh under concurrent stack deployments. - Fixed Chisel panic caused by a negative WaitGroup counter. - Fixed stack images being pulled in parallel causing rate-limiting failures; images are now pulled sequentially and COMPOSE_PARALLEL_LIMIT is respected. - Fixed GitOps polling stopping permanently after a deployment error; auto-update now resumes correctly on subsequent polling cycles. - Fixed GitOps auto-update skipping re-deployment when the commit hash was persisted before the deployment attempt; the hash is now only written after the deploy status is saved. - Fixed an issue where editing a private git stack required re-entering credentials due to incorrect form validation and missing stack ID in gitops API calls. - Fixed “Stack ID required” error appearing when viewing logs for containers not part of a stack. - _[Truncated at 4000 characters — full notes: https://github.com/portainer/portainer/releases/tag/2.42.0]_ ### 2.41.1 — Release 2.41.1 STS - Date: 2026-05-11 - Version: 2.41.1 - Original notes: https://github.com/portainer/portainer/releases/tag/2.41.1 - Permalink: https://whatsnew.fyi/product/portainer/releases/2.41.1 - **added** — Add Age as a sort option on the Home environments list with Oldest and Newest toggles - **changed** — Make Age the default sort order on the Home environments list - **fixed** — Fix the Talos Cluster Details page rendering blank by reverting the Omni cluster phase fields to int32 to match the frontend OmniClusterPhase and OmniClusterUpgradePhase enum contract ##### Known issues - On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot ###### Known issues with Podman support - Podman environments aren't supported by auto-onboarding script - It's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa) - Support for only CentOS 9, Podman 5 rootful ##### Changes - Added Age as a sort option on the Home environments list and made it the default sort order, with "Oldest" (ascending by environment ID) and "Newest" (descending) toggles - Fixed the Talos Cluster Details page rendering blank by reverting the Omni cluster phase fields to int32 so they match the frontend OmniClusterPhase / OmniClusterUpgradePhase enum contract ##### Deprecated and removed features ###### Deprecated features None. ###### Removed features None ### 2.39.2 — Release 2.39.2 LTS - Date: 2026-05-07 - Version: 2.39.2 - Original notes: https://github.com/portainer/portainer/releases/tag/2.39.2 - Permalink: https://whatsnew.fyi/product/portainer/releases/2.39.2 - **fixed** — Fixed an issue where the kubectl-shell-image flag only takes effect on the first Portainer run - **fixed** — Fixed an issue where deleting a kube edge stack results in a downed environment - **fixed** — Fixed an issue where Edge stack deployment retries stopped working - **fixed** — Fixed an issue with saving Git credentials - **security** — Fixed a Docker API proxy authorisation bypass that allowed regular users to circumvent deny-plugin restrictions - **changed** — Changed a default setting to enforce server-side EdgeID on first connection - **security** — Fixed a bind mount restriction bypass via HostConfig.Mounts during container creation - **security** — Fixed a bind mount restriction bypass during Swarm service creation - **security** — Fixed a container capabilities and sysctl restriction bypass during Swarm service creation - **fixed** — Fixed an issue where the CronJob executions are not filtered by namespace - same-name CronJobs across namespaces show identical execution lists - **fixed** — Fixed an issue where the request failed with status code 504 - **removed** — Removed the option to pass a JWT token as a query string parameter - **changed** — Upgraded typescript to v6 - **fixed** — Fixed the TLS certificate uploading - **fixed** — Fixed a stacks issue where stack.env can be null - **changed** — Ensured Portainer pulls images sequentially and respects COMPOSE_PARALLEL_LIMIT - **removed** — Removed the possibility to clone Git repositories that contain symlinks - **fixed** — Fixed a DB write deadlock on ECR token refresh during stack redeployment - **changed** — Enforced admin permissions when updating endpoint relations - **changed** — Enforced admin permission in /system ##### Known issues - On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot ###### Known issues with Podman - Podman environments aren't supported by auto-onboarding script - It's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa) - Support for only CentOS 9, Podman 5 rootful ##### Changes - Fixed an issue where the kubectl-shell-image flag only takes effect on the first Portainer run - Fixed an issue where deleting a kube edge stack results in a downed environment - Fixed an issue where Edge stack deployment retries stopped working - Fixed an issue with saving Git credentials - Fixed a Docker API proxy authorisation bypass that allowed regular users to circumvent deny-plugin restrictions - Changed a default setting to enforce server-side EdgeID on first connection - Fixed a bind mount restriction bypass via HostConfig.Mounts during container creation - Fixed a bind mount restriction bypass during Swarm service creation - Fixed a container capabilities and sysctl restriction bypass during Swarm service creation - Fixed an issue where the CronJob executions are not filtered by namespace - same-name CronJobs across namespaces show identical execution lists - Fixed an issue where the request failed with status code 504 - Removed the option to pass a JWT token as a query string parameter - Upgraded typescript to v6 - Fixed the TLS certificate uploading - Fixed a stacks issue where stack.env can be null - Ensured Portainer pulls images sequentially and respects COMPOSE_PARALLEL_LIMIT - Removed the possibility to clone Git repositories that contain symlinks - Fixed a DB write deadlock on ECR token refresh during stack redeployment - Enforced admin permissions when updating endpoint relations - Enforced admin permission in /system - Fixed handling no healthcheck logs output - Resolved the following CVEs: - CVE-2026-35469 - CVE-2026-32280 - CVE-2026-32281 - CVE-2026-32283 - CVE-2026-32282 - CVE-2026-32289 - CVE-2026-32288 - CVE-2026-25679 - CVE-2026-27142 - CVE-2026-27139 - CVE-2026-32285 - CVE-2026-39883 - CVE-2026-39882 - GHSA-xmrv-pmrh-hhx2 - CVE-2026-32952 - CVE-2026-34165 - CVE-2026-33762 - GHSA-3xc5-wrhm-f963 - CVE-2026-35206 - GHSA-xmrv-pmrh-hhx2 - CVE-2026-39882 - GHSA-3xc5-wrhm-f963 - CVE-2026-31789 - CVE-2026-28387 - CVE-2026-28388 - CVE-2026-28390 - CVE-2026-31790 - CVE-2026-28389 - CVE-2026-2673 - CVE-2026-40200 - CVE-2026-6042 - CVE-2026-22184 - CVE-2026-27171 ##### Deprecated and removed features ###### Deprecated features None. ###### Removed features None ### 2.33.8 — Release 2.33.8 LTS - Date: 2026-05-06 - Version: 2.33.8 - Original notes: https://github.com/portainer/portainer/releases/tag/2.33.8 - Permalink: https://whatsnew.fyi/product/portainer/releases/2.33.8 - **security** — Fixed a Docker API proxy authorisation bypass that allowed regular users to circumvent deny-plugin restrictions - **changed** — Changed a default setting to enforce server-side EdgeID on first connection - **security** — Fixed a path traversal vulnerability in custom template handling - **security** — Fixed unauthorized access to custom template file contents via a direct API endpoint - **removed** — Removed the option to pass a JWT token as a query string parameter - **removed** — Removed the possibility to clone Git repositories that contain symlinks - **security** — Fixed a bind mount restriction bypass via HostConfig.Mounts during container creation - **security** — Fixed a bind mount restriction bypass during Swarm service creation - **security** — Fixed a container capabilities and sysctl restriction bypass during Swarm service creation - **fixed** — Fixed an error handling condition in the database - **added** — Added missing return statements to prevent continued execution after failed authorisation checks - **fixed** — Fixed an issue where Edge stack deployment retries stopped working - **security** — Resolved CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32288, CVE-2026-32289, CVE-2025-58058, CVE-2026-1229, CVE-2026-24051, CVE-2026-25934, CVE-2026-32285, CVE-2026-32952, CVE-2026-33186, CVE-2026-33762, CVE-2026-34165, CVE-2026-35206, CVE-2026-35469, CVE-2026-39882, CVE-2026-39883, GHSA-3xc5-wrhm-f963, and GHSA-xmrv-pmrh-hhx2 ##### Known issues - On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot ###### Known issues with Podman support - Podman environments aren't supported by auto-onboarding script - It's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa) - Support for only CentOS 9, Podman 5 rootful ##### Changes - Fixed a Docker API proxy authorisation bypass that allowed regular users to circumvent deny-plugin restrictions - Changed a default setting to enforce server-side EdgeID on first connection - Fixed a path traversal vulnerability in custom template handling - Fixed unauthorized access to custom template file contents via a direct API endpoint - Removed the option to pass a JWT token as a query string parameter - Removed the possibility to clone Git repositories that contain symlinks - Fixed a bind mount restriction bypass via HostConfig.Mounts during container creation - Fixed a bind mount restriction bypass during Swarm service creation - Fixed a container capabilities and sysctl restriction bypass during Swarm service creation - Fixed an error handling condition in the database - Added missing return statements to prevent continued execution after failed authorisation checks - Fixed an issue where Edge stack deployment retries stopped working - Resolved the following CVEs: - CVE-2026-25679 - CVE-2026-27139 - CVE-2026-27142 - CVE-2026-32280 - CVE-2026-32281 - CVE-2026-32282 - CVE-2026-32283 - CVE-2026-32288 - CVE-2026-32289 - CVE-2025-58058 - CVE-2026-1229 - CVE-2026-24051 - CVE-2026-25934 - CVE-2026-32285 - CVE-2026-32952 - CVE-2026-33186 - CVE-2026-33762 - CVE-2026-34165 - CVE-2026-35206 - CVE-2026-35469 - CVE-2026-39882 - CVE-2026-39883 - GHSA-3xc5-wrhm-f963 - GHSA-xmrv-pmrh-hhx2 ##### Deprecated and removed features ###### Deprecated features None. ###### Removed features None ### 2.41.0 — Release 2.41.0 STS - Date: 2026-04-29 - Version: 2.41.0 - Original notes: https://github.com/portainer/portainer/releases/tag/2.41.0 - Permalink: https://whatsnew.fyi/product/portainer/releases/2.41.0 - **added** — Support for deploying Helm chart edge stacks sourced from Helm repositories and Git repositories - **added** — TUI (text-based UI) application support to the Web Console and kubectl shell, including proper terminal resize handling - **added** — Redeploy button to the Git-backed stack detail view for pulling and redeploying from the repository - **added** — Visible rendering of special and non-printable characters in the web code editor - **added** — Edit YAML and Describe actions to Services, Jobs, CronJobs, Roles, RoleBindings, ClusterRoles, and ClusterRoleBindings datatables in the Kubernetes UI - **added** — Support for pruning unused Docker images from the Images list, with a confirmation modal - **added** — Registry-access notice on Kubernetes app create/edit and Helm install/upgrade views to guide users to configure registry access - **added** — GitOps Workflows page as a new top-level sidebar item that lists every GitOps workflow across environments and edge stacks with a status summary bar, sortable list, and cross-jump to each stack's edit view - **added** — Custom namespace support when deploying Helm-based edge stacks - **changed** — Kubernetes Manifest GitOps stacks can now be edited after deployment to update the Git repository URL, reference, manifest filename, and credentials - **changed** — Docker stack creation and deployment reworked to an async flow for consistent behaviour with Compose - **changed** — Navigation bar and page header styling refreshed - **changed** — Home UI improvements to highlight environment groups - **changed** — CSRF protection implementation now requires each trusted origin entry to be a full URL including scheme instead of bare hostnames - **changed** — Bundled Docker binary upgraded from v29.3.0 to v29.4.1 - **changed** — Go toolchain bumped to 1.26.2 - **changed** — helm.sh/helm/v4 bumped to v4.1.4 - **changed** — github.com/moby/spdystream bumped to v0.5.1 - **fixed** — Keyword search failing to highlight matches in application and container log views - **fixed** — Data races in Kubernetes environment detection by switching to transactional code - **fixed** — Use-after-close data race in the endpoint force-update service - **fixed** — Published-port rendering in the Containers list so the icon and port text appear on the same row instead of wrapping ##### Known issues - On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot ###### Known issues with Podman support - Support for only CentOS 9, Podman 5 rootful ##### Changes ###### Breaking changes Changes to the CSRF protection implementation may cause failures when upgrading: - Portainer fails to start with a fatal log entry like `failed to build server | error="invalid url for trusted origin... trusted_origin: \"portainer.example.com\""`. The new implementation requires each entry in the trusted origins list to be a full URL including scheme (e.g. `https://portainer.example.com/`); bare hostnames are no longer accepted. - Browser requests return `403 Forbidden` on state-changing actions, with `CSRF check failed` entries in the server logs. This means the browser's origin is not in the trusted origins list and needs to be added. The previous CSRF implementation can be re-enabled by starting Portainer with the `legacy-csrf` feature flag (`-feat legacy-csrf`). This flag is provided for 2.41 only and is scheduled for removal in 2.42 — please report any problems so they can be addressed before the flag is removed. ###### New and improved features - Added support for deploying Helm chart edge stacks sourced from Helm repositories and Git repositories. - Reworked Docker stack creation and deployment to an async flow for consistent behaviour with Compose. - Kubernetes Manifest GitOps stacks can now be edited after deployment — admins can update the Git repository URL, reference, manifest filename, and credentials from the application detail view instead of tearing down and recreating the stack. - Added TUI (text-based UI) application support to the Web Console and kubectl shell, including proper terminal resize handling. - Added a "Redeploy" button to the Git-backed stack detail view for pulling and redeploying from the repository. - Added visible rendering of special and non-printable characters in the web code editor. - Added Edit YAML and Describe actions to Services, Jobs, CronJobs, Roles, RoleBindings, ClusterRoles, and ClusterRoleBindings datatables in the Kubernetes UI. - Added support for pruning unused Docker images from the Images list, with a confirmation modal. - Refreshed the navigation bar and page header styling. - Added a registry-access notice on Kubernetes app create/edit and Helm install/upgrade views to guide users to configure registry access. - Added a GitOps Workflows page — a new top-level sidebar item that lists every GitOps workflow across environments and edge stacks with a status summary bar, sortable list, and cross-jump to each stack's edit view. The backing API is RBAC-aware: admins see everything; Edge admins see Edge-stack workflows; environment and Kubernetes-namespace operators see workflows scoped to what they manage; standard users see workflows on stacks they can access via team membership. - Added custom namespace support when deploying Helm-based edge stacks. - Home UI improvements to highlight environment groups. ###### Security improvements - Bumped Go toolchain to 1.26.2 to remediate the following CVEs: - CVE-2026-32280 (crypto/x509 excessive chain-building work in Verify, denial of service) - CVE-2026-32281 (crypto/x509 inefficient policy validation, denial of service) - CVE-2026-32283 (crypto/tls 1.3 key update deadlock, uncontrolled resource consumption) - CVE-2026-33810 (crypto/x509 excluded DNS constraints not applied to wildcard domains in different case) - Bumped helm.sh/helm/v4 to v4.1.4 to remediate the following CVEs: - CVE-2026-35204 (plugin version path traversal enables arbitrary file write; GHSA-vmx8-mqv2-9gmg) - CVE-2026-35205 (plugin missing-provenance signature-verification bypass; GHSA-q5jf-9vfq-h4h7) - Bumped github.com/moby/spdystream to v0.5.1 to remediate CVE-2026-35469. - Upgraded the bundled Docker binary from v29.3.0 to v29.4.1 (agent, server-ce, s _[Truncated at 4000 characters — full notes: https://github.com/portainer/portainer/releases/tag/2.41.0]_