The 2.9 series release notes contain important changes in this release series.

Security Fixes

• MEDIUM: Local privileged MySQL credentials and Alambic HMAC/API keys were exposed in log files included in the support bundle.
• None of the currently supported releases of GitHub Enterprise are affected by the Linux kernel UDP remote code execution vulnerability issued 4 April 2017 (CVE-2016-10229).
• Packages have been updated to the latest security versions.

Bug Fixes

• An issue or pull request comment containing the string "User-Agent: GitHub-Hookshot" incorrectly triggered a firewall rule that caused an internal server error on several pages, including the author's profile page.
• Collectd statistics were collected for the temporary pre-receive hook environment mount points.
• Users could be added to a team if they don't satisfy the Organization's 2FA requirements.
• Very large release or Git LFS assets failed to replicate due to a timeout in a high availability environment.
• In a clustering environment, several services failed to start following a reboot.
• In a clustering environment, configuring multiple nodes in parallel could lead to nodes overwriting each other's MySQL seed data.
• In clustering and high availability environments, the disk usage percentage and tooltip in the admin bar were incorrect.
• Attempts to authenticate via LDAP, would result in /var/log/github/auth.log log entries with via token repeated many times.
• A suggested branch name of "null" was displayed when using IE11 or Microsoft Edge browsers.
• Users were referred to the GitHub.com status page when a repository was offline.
• Pushes to a repository in a high availability environment could fail with ! [remote rejected] master -> master (missing necessary objects).
• New repositories created whilst a high availability replica was stopped were not created on disk and were marked offline.
• The Management Console did not become accessible after promoting a high availability replica.
• Saving custom messages containing UTF-8 characters in the Admin Center failed with a 500 error.
• HTTP clone URLs which include the username did not cause Git to prompt for credentials when password authentication is disabled.
• During maintenance mode for a high availability environment, the /setup/maintenance page did not list active processes.
• The /status endpoint on a high availability replica incorrectly returned 200 OK instead of 503 Service Unavailable.

Changes

• The jq utility has been added to the default pre-receive hook environment.
• More colors are used in the monitoring graphs in a high availability environment, making them more legible.
• Pinned Organization repositories can now only be modified by Organization owners.
• Backups of cluster environments with a large number of archived repositories has been optimized for improved performance.
• GitHub Flavored Markdown, which is now compliant with CommonMark, is used to render repository markdown (e.g. .md) files. (updated 2017-06-11)

Upcoming deprecation of GitHub Enterprise 2.6

GitHub Enterprise 2.6 will be deprecated as of April 26, 2017. That means that no patch releases will be made, even for critical security issues, after this date. For better performance, improved security, and new features, upgrade to the newest version of GitHub Enterprise as soon as possible.

Known Issues

• We incorrectly redirect to the dashboard if you accessed GitHub Enterprise using an alias while in private mode. This might happen if you set a fully qualified domain name but the subdomain resolves correctly.
• Images uploaded to issues save with an absolute URL, so they can be broken if the hostname changes.
• On a freshly set up GitHub Enterprise without any users, an attacker could create the first admin user.
• Custom firewall rules aren't maintained during an upgrade.
• Enqueued background jobs are sometimes not purged when a repository is deleted.
• svn checkout may timeout while the repository data cache is being built. In most cases, subsequent svn checkout attempts will succeed.
• Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.
• GitHub Enterprise clustering can not be configured without https.
• Site administrators can experience a 500 Internal Server Error after viewing the history for a file path containing Japanese characters.
• Deleting a search index doesn't delete all associated metadata, which are then incorrectly reused if a new search index is created. This causes search index repair jobs to be reported as finished in the site admin when they were not.
• collectd metric paths can be truncated, which causes multiple write attempts to the same file for different metrics. (updated 2017-07-10)
• After changing the visibility of a repository, wiki search results have a conflicting number of displayed search results. Administrators can reindex the wiki through the site admin dashboard. (updated 2017-11-09)
• The create team API endpoint returns a 500 error if LDAP Sync is enabled and the team already exists. (updated 2018-01-09)

Thanks!

The GitHub Team