The 2.1 series release notes contain important changes in this release series.
Bug Fixes
- Ubuntu packages have been updated to the latest bug fix versions.
- With LDAP authentication enabled, users who renamed their accounts and then had their DN changed couldn't log in.
- LDAP user search in the site admin was limited to 1000 results. This performed poorly when searching some directories, and people are more likely to refine the search than to page through so many results, so it's now limited to 150 results.
- Setting up static networking could fail when trying to stop the DHCP client.
- Configuring high availability replication incorrectly wrote a key fingerprint to the
git user's authorized_keys file, which caused warning messages to be logged on the primary.
- Logging of notification deliveries was extremely verbose, which could put I/O pressure on busy instances.
- When maintenance mode was enabled, we ignored the configured support email address and always showed the default.
- We showed the wrong clone URL when displaying a Gist when subdomain isolation was enabled.
- Elasticsearch wasn't properly tuned based on available memory.
- Notification, event, and session database entries weren't properly archived, which could cause those tables to grow very large on busy instances.
- The activity dashboard graph could dip to zero periodically, creating misleading sawtooth patterns.
- Checking file size limits for Git pushes could be expensive and time consuming.
- With LDAP authentication enabled, entering the wrong password could cause a timeout for some users. (updated 2015-09-02)
Security Fixes
SAML response validation changes
We've improved the validation of the SAML responses we receive. A response message must now contain a Recipient set to the Assertion Consumer Service URL, http(s)://[hostname]/saml/consume.
In addition to the Recipient attribute, GitHub Enterprise will now also verify the Destination and Audience attributes, if they are supplied in the response message.
Most SAML implementations already provide this information in their responses.
Known Issues
- Creating the OpenVPN connection can fail, causing replication set up with
ghe-repl-setup to hang.
- Git replication can be slow and CPU intense during initial push of large or complex repositories.
- The management console settings interface doesn't clearly show if you have previously uploaded certificate files or a private key.
- Jobs stuck on code indexing can delay other jobs from running.
- Dashboard activity feed links point to wrong hostname after restoring from backup if the hostname has changed.
- On a freshly set up GitHub Enterprise without any users, an attacker could create the first admin user.
- Events in the
github_audit log stream are being logged twice.
- Gists can't be created when using Safari 8.x in Private Mode.
- LDAP Sync fails for groups that have a period in their CN.
- Replication setup fails for IPv6 hosts.
- It's not possible to convert a user account to an organization.
- Accessing GitHub Enterprise using a hostname alias with private mode enabled as an unauthenticated user will redirect you to the dashboard instead of the page you were trying to visit after you log in.
- In some circumstances, after an upgrade we prompt you to upload a license, even though there's already a valid license.
- A high availability replica that's been promoted to primary and then set up as a replica again doesn't properly show the replica status page, but shows "Starting..." instead.
- Gist profile pages don't have proper styling when subdomain isolation disabled.
- SNMP can't be run on high availability replicas.
- Custom firewall rules aren't maintained during an upgrade.
- Management console sessions can expire too quickly for Safari users.
- Some processes continued to write to logs after they were rotated. This could cause the root file system to fill up.
- We can fail to properly create the key for the secure connection between a high availability replica and the primary, which causes replication setup to fail.
- Promoting a high availability replica can fail if Elasticsearch takes too long to restart.
- Deleting a user doesn't delete their gists, which can cause problems with replication.
- In our instructions to merge a pull request on the command line, we show the steps to merge using the Git protocol even when private mode is on. Private mode forces authentication but the Git protocol is unauthenticated so the steps will always fail. We also don't show the steps to merge using SSH.
- Accessing GitHub Enterprise using a hostname alias with private mode enabled as an unauthenticated user will redirect you to the dashboard instead of the page you were trying to visit after you log in.
- Individual application logs are not reliably forwarded. (updated 2015-04-20)
- Avatars, release downloads, and image attachments to wikis and issues are not copied correctly by high availability replication. (updated 2015-05-20)
- We show your gravatar or identicon on Gists instead of your custom profile picture. (updated 2015-06-15)
- Repositories with a leading dot in their name fail to replicate if they were created before replication was set up. (updated 2015-06-16)
- We display the time in the scheduled maintenance banner in UTC instead of the viewer's timezone. (updated 2015-06-18)
- Users with LDAP DNs longer than 255 characters are suspended if LDAP Sync is enabled. (updated 2015-06-19)
- Images uploaded to issues save with an absolute URL, so they can be broken if the hostname changes. (updated 2015-07-14)
- With private mode enabled, a Pages site with no default page serves a generic error rather than an informative message. (updated 2015-07-14)
- Updates to Wiki pages by users without a primary email address set throw errors. (updated 2015-08-25)
- Trying to add a file to a repository with Subversion 1.9 clients incorrectly detects the file already exists and fails. (updated 2016-01-14)
Thanks!
The GitHub Team