GitHub Enterprise - The best way to build and ship software

The 2.18 series release notes contain important changes in this release series.

Security Fixes

LOW: Git has been updated to address CVE-2019-1348, CVE-2019-1349, CVE-2019-1350, CVE-2019-1351, CVE-2019-1352, CVE-2019-1353, CVE-2019-1354, and CVE-2019-19604. These vulnerabilities could not be triggered on the GitHub Enteprise Server instance itself, but new restrictions prevent malicious repositories from being pushed to the server instance, protecting clients which have not yet been patched.
Packages have been updated to the latest security versions.

The root disk utilization graph in the Management Console was missing on AWS Nitro instance types.
The Alambic storage service could hit a file descriptor limit that could cause the kernel to hang and other services to log errors.
Importing of teams with nested teams with security visibility could fail. Nested teams will now be imported as top-level teams if they are imported as children of a team with secret visibility.
When a repository is locked users could still directly visit pull request URLs and modify the reviewers.
A team created via the API V3 would not automatically add its creator as a maintainer, which caused it to be inaccessible to that person.
A GitHub App with the proper set of permissions was not able to create teams with LDAP.
The DNS resolution for GitHub Connect could timeout.

On a freshly set up GitHub Enterprise Server without any users, an attacker could create the first admin user.
Custom firewall rules are not maintained during an upgrade.
Subversion (SVN) checkout may timeout while the repository data cache is being built. In most cases, subsequent Subversion checkout attempts will succeed.
Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.
Issues cannot be closed if they contain a permalink to a blob in the same repository where the file path is longer than 255 characters.
When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.
Security alerts are not reported when pushing to a repository on the command line. (updated 2020-06-23)

Thanks!

The GitHub Team