cloudfoundry/stratos v5.5.4

Stratos v5.5.4

on GitHub

Features

• The all-in-one container image is now published for linux/arm64 as well
  as linux/amd64. It previously ran only on amd64, so it could not be used
  on arm64 Kubernetes nodes or on Apple Silicon without building it locally.
  The release payload now carries one Linux binary per architecture and the
  Dockerfile selects on TARGETARCH.

Bug Fixes

• Fixed the documentation site serving a stale search index. The search
  plugin derives the index's cache-busting hash by scanning docsDir and
  blogDir, which were left at their defaults and pointed at directories
  this site does not have. With no files to scan the hash came back empty
  and the index was fetched from an unversioned URL, so a returning
  visitor kept whatever their browser had cached from an earlier build.
• The manifest.yml in the repository root pushed the source tree through
  the retired stratos-buildpack, staging a build on the platform and
  asking for 1512M. The documented path pushes the prebuilt package under
  binary_buildpack at 256M and builds nothing during staging, so a
  clone-and-push took the stale route at six times the memory. The manifest
  now points at dist/cf-package, the directory make build release cf
  stages, with the command and buildpack that go with a prebuilt payload.
• Sized the console at 512M. Both packaged manifests claimed 256M, a figure
  dating from 2017 that was never checked against a running console; known
  production deployments run at 512M, and the Korifi manifest generated by the
  same script already said 512M. Disk stays at 1024M for log growth. The
  Memory Usage documentation still presented the old 1512M source-push figure
  as a requirement, when it was staging headroom for compiling Angular during
  cf push.
  The README example and the two manifests on the CF troubleshooting page
  named the same retired buildpack and have been corrected.
• An endpoint registered with a CA certificate is now reached using it. The CA
  was stored on the endpoint but never passed to the CF API client or to the
  OAuth and OIDC token calls, so against a foundation using a private CA —
  a lab, or Cloud Foundry on Kubernetes — connecting failed and every read
  returned x509: certificate signed by unknown authority. The console
  reported this as the endpoint being unreachable, which pointed at the network
  rather than at certificate trust.
• AUTO_REG_CF_URL had no way to supply a CA certificate, so on a foundation
  using a private authority the auto-registered endpoint reported itself
  connected and then failed every read with
  x509: certificate signed by unknown authority, while the same endpoint
  registered by hand with its CA worked. SKIP_SSL_VALIDATION was not a
  substitute: the CF API client will not honour it.
  AUTO_REG_CF_CA_CERT now takes the PEM inline and AUTO_REG_CF_CA_CERT_PATH
  reads it from a file, mirroring CONSOLE_PROXY_CERT and
  CONSOLE_PROXY_CERT_PATH. The path form is what a Kubernetes deployment
  wants, where the CA is a mounted secret; it wins over the inline value, and a
  path that cannot be read fails the registration rather than silently creating
  a CA-less endpoint.
• The endpoint connect dialog overwrote an auth form's default configuration
  with undefined whenever the auth type supplied none, and those templates
  read fields such as the help text without guarding. Every auth type shipped
  today supplies a configuration, so nothing was broken in practice — but the
  field is optional, the form component declares a default for exactly that
  case, and only coincidence stood between them.
• Jetstream crashed at startup when ENCRYPTION_KEY_VOLUME was configured
  without ENCRYPTION_KEY_FILENAME. The filename was indexed before being
  checked, so an empty one raised an index-out-of-range panic, and the guard
  meant to require both settings only rejected the case where neither was
  given. That combination is what the DevOps guide's own example showed. An
  empty filename is now a clear error.
• Terminal dimensions sent by the browser to the application SSH session were
  used without validation, so a negative value wrapped to a very large one and
  an oversized value was truncated when converted for the window-change
  request. Rows and columns are now clamped to a sensible range.

Maintainability

• Removed the Docker Build and Push workflow and the base-image push
  workflow. The stratos-ui and stratos-backend component images build
  from SUSE-era splatform bases carrying Node 12, which cannot compile the
  current source, so the workflow failed on every release and never pushed an
  image; the base-image workflow had been a silent no-op for years. The
  all-in-one image is unaffected and still publishes from the release
  workflow. See #5907.
• Synced the Angular versions declared by the frontend package manifests
  with the version the application actually installs. The manifests under
  src/frontend/packages/ still named 22.0.8 while the root manifest and
  lockfile had moved to 22.1.5. Nothing installs from those files — the
  devkit reads them for dependency names only — but the stale numbers were
  enough for dependency scanning to report five advisories against Angular
  packages that ship at a patched version, two of them rated high. The
  manifests were re-synced to 22.1.6 and then 22.1.7 as the root moved;
  they carry no lockfile of their own, so every root bump has to be
  followed by hand.
• Removed the korifi build modifier and the matching release-cf.sh
  mode. Korifi is retired — RFC-0060 was accepted on 2026-07-10 — and CF
  on Kubernetes is its replacement. make build korifi was the only
  consumer of zig in the build, needed for a static cgo cross-compile
  back when the sqlite driver required cgo; the pure-Go ncruces driver
  removed that need some time ago, so no build path asks for a C
  cross-compiler any more. The packager loses its MODE parameter along
  with the alternate Paketo procfile manifest it generated.
• Removed e2e/secrets.yaml, a developer's local E2E credentials file
  committed by accident. Nothing read it: the supported layout is a
  gitignored secrets.yaml at the repository root, created from
  e2e/secrets.yaml.template. The path is now in .gitignore so the
  copy cannot come back.
• Quietened the make audit secrets scan. gitleaks dir walks the
  filesystem rather than the git index, so every run reported the
  developer's own gitignored credentials and the third-party Helm chart
  cache. Those paths are allow-listed by exact path, leaving the scan
  clean and any finding in a trackable file visible.
• make audit secrets now fails when gitleaks reports a finding, instead
  of printing it and exiting 0. The full-history scan
  (make audit history) stays advisory: it carries years of accepted
  SUSE-era test fixtures.
• Removed autoprefixer from the root manifest. The Tailwind v4 migration
  dropped it from the PostCSS plugin list and left the dependency entry
  behind, so nothing had resolved it since. The application builds through
  @angular/build, which carries no autoprefixer reference at all — vendor
  prefixing comes from esbuild, whose target is derived from the
  browserslist file. Removing the entry also collapses a duplicate
  resolution: autoprefixer now appears once, as the build tooling's own
  transitive dependency, instead of twice at two versions. The emitted
  stylesheet is byte-identical with and without it.
• Pin drift between the frontend package manifests and the root manifest
  now fails the lint check instead of being found later. The files under
  src/frontend/packages/ install nothing, but Dependabot security
  updates scan every manifest in the repository regardless of the
  directory list in dependabot.yml, so a pin left behind the shipped
  tree raises advisories against packages that already ship at a patched
  version. That had been corrected by hand three times. Four non-Angular
  pins that the manual syncs never covered — core-js, marked and the
  two @analogjs packages — were brought into line at the same time.

Chores

• Corrected the deployment documentation, which promised a Helm chart in the
  release artifacts and a chart repository at cloudfoundry.github.io/stratos.
  Neither exists. The Kubernetes pages and the component-image instructions in
  the DevOps and release guides now state that this path does not currently
  work and point at the working Cloud Foundry and all-in-one options.
• The devkit install no longer rewrites its own lockfile. ensure-devkit
  ran npm install --legacy-peer-deps against a package-lock.json
  generated without that flag, so every root install — CI included —
  silently dropped the ten peer entries the lockfile records. It now runs
  npm ci, which installs exactly what the lockfile says and never writes
  to it.
• Removed deploy/ci/automation/cfpushtest.sh, which targeted the
  discontinued PCF Dev and had been producing a manifest with a duplicated
  env: key since the diagnostics setting was added. Nothing invoked it.
• Added live-foundation tests for endpoint capability detection. A Cloud
  Foundry with the V2 API disabled still answers 200 from /v2/info, so the
  behaviour could not be reproduced from fixtures and had to be confirmed
  against real foundations. Each test skips unless its foundation is named in
  STRATOS_LIVE_CF or STRATOS_LIVE_CF_V2OFF, so an ordinary test run is
  unaffected, and the expectations are read from what the foundation itself
  advertises rather than any particular installation's values.
• make audit backend and make audit tests reported success when the gosec
  scanner had not run at all. gosec exits non-zero both when it finds issues
  and when it cannot start, and every invocation tolerated failure so findings
  stayed advisory — which also hid a scanner built against an older Go
  aborting on every package. Findings remain advisory; a scanner that did not
  run is now an error naming the cause and the rebuild command.
• Moved the frontend unit tests to Vitest 5.0.1, together with
  @vitest/coverage-v8 and @vitest/ui, which Vitest 5 requires at the
  same exact version. Two changes made it work. @oxc-project/runtime is
  now installed, because Vitest 5 emits the decorator helper for
  decorated classes in the test setup as an import rather than inlining
  it. Each test project in vitest.config.ts also sets its own root:
  Vitest 5 ignores the root in the package config that a project extends,
  so every package would otherwise have run the whole tree without its
  Angular compiler setup. The suite results are unchanged: 666 test files
  pass and 2 are skipped.
• The build no longer downloads tsx from the npm registry every time it
  runs. The pre-build step ran the backend plugin generator through
  npx tsx, and because tsx is not a dependency, npx fetched whatever
  version was newest on each build. Node now runs the generator directly,
  and the generated extra_plugins.go is unchanged. The two e2e
  screenshot report scripts, which used bunx tsx the same way, now run
  with Node as well.
• Dependency updates: the Angular framework from 22.1.5 to 22.1.7, with
  the Angular CLI and build tooling from 22.1.7 to 22.1.8 (including the
  devkit's own lockfile); @types/node from 24.2.1 to 26.4.1; js-yaml
  from 5.4.1 to 5.4.2; and glob from 11.1.0 to 13.0.6 in the
  prebuild-application builder.

Security Updates

• Two CVEs were cleared in the build tooling. The devkit's js-yaml
  override moved 4.3.1 to 4.3.2 (CVE-2026-84375, high): the devkit
  resolves through its own package-lock.json, so the root workspace's
  earlier move to js-yaml 5 never reached it. adm-zip moved 0.6.0 to
  0.6.1 (CVE-2026-76845): the advisory covers extraction following
  symlinks at the destination, which the build never does — it only
  creates archives — but 0.6.1 also stops addLocalFolder following
  symlinks out of the folder being archived, and that is the call the
  prebuild zip step makes.