Repository navigation
Releases
Releases · step-security/harden-runner
v2.22.4
Immutable
release. Only release title and notes can be modified.
What's Changed
- Fixed a Linux agent memory leak that could cause runners to run out of memory during jobs with heavy process or network activity.
- The workaround for GitHub’s DNS resolver and outbound proxy experiment on GitHub-hosted Linux runners now defaults to enabled when feature flags can’t be fetched.
- Improved HTTP/2 TLS interception on Linux (enterprise tier).
- Added retries for failed monitoring API requests, improving reliability of monitoring initialization and raw-event uploads.
Full Changelog: v2.22.3...v2.22.4
v2.22.3
Immutable
release. Only release title and notes can be modified.
What's Changed
- Added support for Avrea-hosted runners (enterprise tier)
- Fixed unexpected blocking of allowed connections caused by GitHub’s DNS resolver and outbound proxy experiment on GitHub-hosted Linux runners
- Added a feature flag to disable implicit AWS endpoint allowances on self-hosted Linux runners (enterprise tier)
Full Changelog: v2.22.2...v2.22.3
v2.22.2
Immutable
release. Only release title and notes can be modified.
What's Changed
- Fixed inbound (ingress) network traffic being incorrectly classified as outbound (egress) traffic on macOS
- Fixed implicit endpoints intended for self-hosted runners being applied to custom VM environments on Linux (enterprise tier)
- Improved network and DNS tracing, enforcement logic, and process information correlation on Linux (enterprise tier)
Full Changelog: v2.22.1...v2.22.2
v2.22.1
Immutable
release. Only release title and notes can be modified.
What's Changed
- Fixed security rules not initializing on GHES self-hosted runners
- Fixed GHES connectivity in block mode by implicitly allowing the GHES hostname
Full Changelog: v2.22.0...v2.22.1
v2.22.0
Immutable
release. Only release title and notes can be modified.
What's Changed
- Linux ARM64 support for community tier
- GHES support for self-hosted VMs (enterprise tier)
- MacOS and Windows runner deny list support for block policy (enterprise tier).
Full Changelog: v2.21.1...v2.22.0
v2.21.1
Immutable
release. Only release title and notes can be modified.
What's Changed
- Improved performance of the
disable-sudofeature. - Fixed an issue in the Community tier where new endpoints required by the GitHub Actions runner were not being implicitly allowed in block mode.
- Fixed the Harden-Runner post step failing on Linux distributions that do not have a merged
/usrfilesystem layout (for example Debian 11), where/usr/bin/echodoes not exist. This mainly affected self-hosted runners. - Documentation updates: clarified which features are in the Community (free) vs Enterprise tier.
Full Changelog: v2.21.0...v2.21.1
v2.21.0
Immutable
release. Only release title and notes can be modified.
What's Changed
- Support for denied endpoints in block mode. This is included in the enterprise tier. Customers can deny outbound calls, for example, to public package registries.
- Improved Support for AWS CodeBuild GitHub Actions Runners.
- Bug fixes.
Full Changelog: v2.20.1...v2.21.0
v2.20.1
Immutable
release. Only release title and notes can be modified.
What's Changed
- AWS CodeBuild-hosted runner support
- Implicitly allow single-labeled (internal) domains in block-mode
Full Changelog: v2.20.0...v2.20.1
v2.20.0
Immutable
release. Only release title and notes can be modified.
What's Changed
- Support for block policy for MacOS and Windows GitHub-hosted runners
- Support for Bitrise MacOS GitHub Actions runners
- HTTPS monitoring support for Bun for Linux runners (enterprise tier)
Full Changelog: v2.19.4...v2.20.0
v2.19.4
Immutable
release. Only release title and notes can be modified.
What's Changed
- Improvements for HTTPS Monitoring for the Enterprise tier of Harden Runner
Full Changelog: v2.19.3...v2.19.4
