buildkite/elastic-ci-stack-for-aws v7.8.0 on GitHub

v7.8.0 (2026-10-21)

Full Changelog

Security

Remediate compromised eMudhra certificate chains in Linux and Windows image trust stores, including the separate AWS CLI and Git for Windows CA bundles #1939 (@omehegan).

Changed

Update the stable Buildkite agent from v4.6.0 to v4.7.0 #1939 (@omehegan).

Fixed

Fix Windows image reboot and WinRM provisioning races, and validate Docker before publishing the base image #1941 (@omehegan).

Internal

Update changelogs for v7.7.0 and v6.71.7 #1933, #1934 (@scadu).

Agent Changelog (v4.7.0)

v4.7.0

Important security update

Upgrade to v4.7.0 promptly. This release addresses compromised eMudhra certificate chains (CVE-2026-111943) by building the agent with Go 1.26.10, which rejects the affected chains, including alternate cross-signed paths.

Installing the updated agent is required to receive this protection. It doesn't update OS, container or custom trust stores, or protect external tools run by jobs; remediate those separately.

What's Changed

🔒 Security

Reject compromised eMudhra certificate chains (CVE-2026-111943) by building with Go 1.26.10 by @duckalini in buildkite/agent#4550
Prevent artifact downloads escaping their destination through directory symlinks by @isaacsu in buildkite/agent#4541
Add opt-in --git-commit-verification=fail-closed to reject checkouts when commit verification can't succeed by @dahtey-bk in buildkite/agent#4530
Protect GIT_ALLOW_PROTOCOL when --protect-dangerous-git-environment-variables is enabled and list the protected variables in help by @moskyb in buildkite/agent#4527

🐛 Fixed

Redact secrets containing apostrophes in buildkite-agent secret get --format env output in build logs by @isaacsu in buildkite/agent#4531
Honour the agent's BUILDKITE_CAPTURE_AGENT_ERRORS setting when it's protected from job overrides by @123sarahj123 in buildkite/agent#4524

🔧 Changed

Show the cache command in buildkite-agent --help by @ss1909 in buildkite/agent#4482

🏠 Internal

Replace deprecated HTTP/2 transport configuration by @isaacsu in buildkite/agent#4542
Add a pipeline to close stale issues and PRs by @moskyb in buildkite/agent#4544
Run stale issue and PR cleanup on elastic runners by @moskyb in buildkite/agent#4546
Dependency updates by @dependabot[bot] in buildkite/agent#4536, buildkite/agent#4535, buildkite/agent#4419, buildkite/agent#4537, buildkite/agent#4447, buildkite/agent#4545, buildkite/agent#4504, buildkite/agent#4505, buildkite/agent#4540 and buildkite/agent#4416

New Contributors

@dahtey-bk made their first contribution in buildkite/agent#4530

Full Changelog: buildkite/agent@v4.6.0...v4.7.0

Upgrading

Follow the v7 upgrade guide before updating. Remove or replace retired parameters in parameter files and deployment automation. If you use a custom AMI through ImageId or ImageIdParameter, rebuild it from the v7 base AMI and update it in the same stack update; a v6-based AMI might not boot under the v7 template depending on the configuration.

Perform a CloudFormation stack update with the following URL:

https://s3.amazonaws.com/buildkite-aws-stack/v7.8.0/aws-stack.yml

If you want to launch a new stack, you can use this link (make sure not to use your production AWS account, create a new one for CI):

Full Changelog: v7.7.0...v7.8.0