feat(semaphore): update image docker.io/semaphoreui/semaphore v2.17.39 → v2.18.1 (#47867)

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
|
[docker.io/semaphoreui/semaphore](https://redirect.github.com/semaphoreui/semaphore)
| minor | `0a5db8f` → `e49c769` |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/18710) for more information.

Add the preset `:preserveSemverRanges` to your config if you don't want
to pin your dependencies.

---

### Release Notes

<details>
<summary>semaphoreui/semaphore
(docker.io/semaphoreui/semaphore)</summary>

###
[`v2.18.1`](https://redirect.github.com/semaphoreui/semaphore/releases/tag/v2.18.1)

[Compare
Source](https://redirect.github.com/semaphoreui/semaphore/compare/v2.17.39...v2.18.1)

This is a substantial beta release that pushes Semaphore meaningfully
further into **enterprise-grade secrets management**, hardens the **API
token lifecycle**, expands the **runner scheduling model**, and absorbs
a flurry of security and dependency fixes — many of them caught and
triaged by automated review bots (Cursor, ChatGPT Codex) before merge.
It also bumps the bundled Ansible runtime by two major versions.

Below is a qualitative, themed walkthrough rather than a flat PR list.

***

#### Secret storage: two new external backends + a hard look at
ownership

The headline feature of this release is **first-class support for two
more enterprise secret backends**, joining the existing Devolutions
Server (DVLS) integration:

- **AWS Secrets Manager**
(\[[#&#8203;3750](https://redirect.github.com/semaphoreui/semaphore/pull/3750)]\([#&#8203;3750](https://redirect.github.com/semaphoreui/semaphore/pull/3750)))
— adds a full Secret Storage type for AWS SM with a dedicated form,
icon, and a **Sync button** to pull secrets on demand. The PR also
introduced a generalized **rekey** flow and "source details" surfacing
for individual secrets.
- **Azure Key Vault**
(\[[#&#8203;3752](https://redirect.github.com/semaphoreui/semaphore/pull/3752)]\([#&#8203;3752](https://redirect.github.com/semaphoreui/semaphore/pull/3752)))
— symmetric implementation for Azure, using the official Microsoft SDKs
(`azcore`, `azidentity`, `azsecrets`). Auth follows the same DB /
env-var / file pattern as AWS SM and DVLS, and the backend was
refactored to consolidate `SyncSecrets` across all storage types into a
single function.

Alongside the new backends, an unusually large cluster of
**secret-related security fixes** landed — almost all of them
automatically flagged by `cursor[bot]` during review:

-
\[[#&#8203;3753](https://redirect.github.com/semaphoreui/semaphore/pull/3753)]\([#&#8203;3753](https://redirect.github.com/semaphoreui/semaphore/pull/3753))
/
\[[#&#8203;3762](https://redirect.github.com/semaphoreui/semaphore/pull/3762)]\([#&#8203;3762](https://redirect.github.com/semaphoreui/semaphore/pull/3762))
— broken ownership checks on environment secret delete/update (nil deref
+ auth bypass). These are real authorization bugs where an
unauthenticated edge case could fall through.
-
\[[#&#8203;3768](https://redirect.github.com/semaphoreui/semaphore/pull/3768)]\([#&#8203;3768](https://redirect.github.com/semaphoreui/semaphore/pull/3768))
— broken `ErrReadOnlyStorage` sentinel + a *silent* delete error on
environment secrets (the operation appeared to succeed while failing).
-
\[[#&#8203;3778](https://redirect.github.com/semaphoreui/semaphore/pull/3778)]\([#&#8203;3778](https://redirect.github.com/semaphoreui/semaphore/pull/3778))
— vault rekey now correctly **skips keys that live in external storage**
(AWS/Azure/DVLS), since rekeying them locally would be incoherent.
-
\[[#&#8203;3784](https://redirect.github.com/semaphoreui/semaphore/pull/3784)]\([#&#8203;3784](https://redirect.github.com/semaphoreui/semaphore/pull/3784))
— `unsetenv` for sensitive config fields after they're consumed, so they
don't linger in process memory available to child processes.
-
\[[#&#8203;3792](https://redirect.github.com/semaphoreui/semaphore/pull/3792)]\([#&#8203;3792](https://redirect.github.com/semaphoreui/semaphore/pull/3792))
— missing `return` statements after error responses in auth/env handlers
(classic continue-after-error logic bug).

The pattern here is notable: the new backends were merged together with
a methodical sweep of the *existing* secret-handling code, suggesting
the secrets subsystem received a deliberate audit pass.

***

#### API tokens grow up

Two complementary PRs turn API tokens from disposable opaque strings
into something closer to a managed credential:

- **Expiration support**
(\[[#&#8203;3795](https://redirect.github.com/semaphoreui/semaphore/pull/3795)]\([#&#8203;3795](https://redirect.github.com/semaphoreui/semaphore/pull/3795)))
— tokens can now carry an optional `expires_at`. Creation rejects
non-future values; bearer-token authentication checks expiry on every
request via a new `IsExpiredAt` method, so revocation-by-time is
enforced before the request handler even runs. This also added rollback
SQL for the migration.
- **Named tokens**
(\[[#&#8203;3788](https://redirect.github.com/semaphoreui/semaphore/pull/3788)]\([#&#8203;3788](https://redirect.github.com/semaphoreui/semaphore/pull/3788)))
— first contribution from `@setswei`. Tokens get a `name` field, which
is the small UX touch that finally makes a token list legible when you
have more than two of them.

Together with
\[[#&#8203;3785](https://redirect.github.com/semaphoreui/semaphore/pull/3785)]\([#&#8203;3785](https://redirect.github.com/semaphoreui/semaphore/pull/3785))
(a nil pointer dereference fix in TOTP session verification), the auth
surface in this release is meaningfully more robust.

***

#### Runners: tags become a first-class scheduling primitive


\[[#&#8203;3804](https://redirect.github.com/semaphoreui/semaphore/pull/3804)]\([#&#8203;3804](https://redirect.github.com/semaphoreui/semaphore/pull/3804))
is the largest single feature in the release (24 commits) and is worth
understanding architecturally rather than as a list of bullets:

- A new `runner__tag` join table replaces the previous single-string
`tag` column, so a runner can carry **multiple tags**.
- **Global runners can now be tagged**, not just project runners. This
bridges the "platform team owns a fleet, project teams target subsets"
model that previously required workarounds.
- The runner list UI gains **Default** and **Global** labels, label
wrapping, autocompletion in the tag input, and a **partial-tag filter**
("get runners with any tag matching X").
- A new `RunnerTagFilterMode` enum (`CompleteMatch`, `HasNoTags`,
`IsDefault`, `IgnoreTags`, `HasAnyTag`) governs how tasks pick runners.
- Non-admin users have actions disabled on globally-tagged runners — the
UI honors the ownership boundary.

The PR is also a fascinating case study in **automated code review
actually working**: `cursor[bot]` repeatedly flagged an inverted
condition in `services/tasks/RemoteJob.go` where `tagFilterMode` was set
backward (tagged jobs would have routed to untagged runners and vice
versa, breaking the isolation guarantee that's the whole point of the
feature). Across roughly five review cycles the maintainer (`@fiftin`)
iterated until the logic was right. A `bolt` driver caveat — `db:"-"`
tags causing tag persistence to silently break on Bolt deployments — was
raised by the Codex reviewer; worth verifying for anyone still on Bolt.

A related smaller change,
\[[#&#8203;3793](https://redirect.github.com/semaphoreui/semaphore/pull/3793)]\([#&#8203;3793](https://redirect.github.com/semaphoreui/semaphore/pull/3793)),
refactored the `sync` flag handling, which was prerequisite plumbing.

***

#### Admin observability


\[[#&#8203;3782](https://redirect.github.com/semaphoreui/semaphore/pull/3782)]\([#&#8203;3782](https://redirect.github.com/semaphoreui/semaphore/pull/3782))
adds a **System Information dialog for admins** — a new admin-only `GET
/admin/info` endpoint backing a UI dialog that surfaces:

- `tmp_path`, `home_dir_mode`
- Go version / arch / OS, Ansible version, git client
- DB dialect, HA configuration
- Auth method flags (LDAP, OIDC, etc.)
- Task limits, runner settings, notification flags

This is genuinely useful for support triage — the kind of "what version
of everything is this server running?" question that previously required
SSH access. The endpoint is correctly gated by `adminMiddleware`
server-side, with the UI also guarding render with `v-if="user &&
user.admin"`. Notably, several of these values were already exposed to
all authenticated users via `/api/info`; the new endpoint is *more*
restrictive than what existed before.

***

#### Ansible jumps two major versions


\[[#&#8203;3736](https://redirect.github.com/semaphoreui/semaphore/pull/3736)]\([#&#8203;3736](https://redirect.github.com/semaphoreui/semaphore/pull/3736))
(first contribution from `@sevencastles`) bumps the bundled Ansible from
**11.1.0 → 13.5.0** (`ansible-core 2.20.4`). This is a non-trivial jump
for anyone running Ansible workloads against the Semaphore image —
playbooks that relied on collections or behavior from Ansible 11 should
be re-tested. There are no notes about pinned-version overrides, so the
upgrade is mandatory for users on the official image.

***

#### Terraform: stop logic finally works


\[[#&#8203;3694](https://redirect.github.com/semaphoreui/semaphore/pull/3694)]\([#&#8203;3694](https://redirect.github.com/semaphoreui/semaphore/pull/3694))
— a long-standing bug from `@JulianKap`: stopping a Terraform task while
it sat in `waiting_confirmation` (the human-approval gate between plan
and apply) didn't actually stop it. Now it does. For anyone using
Terraform integration, this closes one of the more annoying state
machine quirks.

***

#### Quality-of-life and infrastructure

A few smaller items worth flagging:

- **i18n correctness**
(\[[#&#8203;3764](https://redirect.github.com/semaphoreui/semaphore/pull/3764)]\([#&#8203;3764](https://redirect.github.com/semaphoreui/semaphore/pull/3764)),
first contribution from `@lawrence3699`) — CLI command strings are no
longer translated. Translating `ansible-playbook` into other languages
was, predictably, breaking command execution.
- **Process file ownership**
(\[[#&#8203;3777](https://redirect.github.com/semaphoreui/semaphore/pull/3777)]\([#&#8203;3777](https://redirect.github.com/semaphoreui/semaphore/pull/3777)))
— `chown` is now scoped to directories the process actually has access
to, instead of attempting it everywhere and erroring noisily.
- **README**
(\[[#&#8203;3742](https://redirect.github.com/semaphoreui/semaphore/pull/3742)]\([#&#8203;3742](https://redirect.github.com/semaphoreui/semaphore/pull/3742)),
first contribution from `@gaetan-steininger`) — updated to recommend
SQLite over Bolt, which is now deprecated. Worth noting alongside the
Bolt-driver concern raised on
[#&#8203;3804](https://redirect.github.com/semaphoreui/semaphore/issues/3804):
**Bolt's days are numbered**, and new features may not get the same
testing coverage on it.

***

#### Dependency churn

This release pulled in a high volume of dependency bumps. The notable
security-relevant ones:

- `go-git/go-git/v5` → **v5.17.2**
(\[[#&#8203;3732](https://redirect.github.com/semaphoreui/semaphore/pull/3732)]\([#&#8203;3732](https://redirect.github.com/semaphoreui/semaphore/pull/3732)),
\[[#&#8203;3751](https://redirect.github.com/semaphoreui/semaphore/pull/3751)]\([#&#8203;3751](https://redirect.github.com/semaphoreui/semaphore/pull/3751)))
— security advisory fix.
- `go-jose/go-jose/v4` → **v4.1.4**
(\[[#&#8203;3745](https://redirect.github.com/semaphoreui/semaphore/pull/3745)]\([#&#8203;3745](https://redirect.github.com/semaphoreui/semaphore/pull/3745)))
— patches CVE-2026-34986 (DoS via JWE decryption panic), which is in
Semaphore's path because it's transitively used by the OIDC login flow.
- `axios` → **v1.15.0/v1.15.2**
(\[[#&#8203;3756](https://redirect.github.com/semaphoreui/semaphore/pull/3756)]\([#&#8203;3756](https://redirect.github.com/semaphoreui/semaphore/pull/3756)),
\[[#&#8203;3800](https://redirect.github.com/semaphoreui/semaphore/pull/3800)]\([#&#8203;3800](https://redirect.github.com/semaphoreui/semaphore/pull/3800)))
— security advisory.
- `node-forge` → **1.4.0**
(\[[#&#8203;3728](https://redirect.github.com/semaphoreui/semaphore/pull/3728)]\([#&#8203;3728](https://redirect.github.com/semaphoreui/semaphore/pull/3728)))
- `go-ldap/ldap/v3` → **v3.4.13**
(\[[#&#8203;3767](https://redirect.github.com/semaphoreui/semaphore/pull/3767)]\([#&#8203;3767](https://redirect.github.com/semaphoreui/semaphore/pull/3767)))
- `Azure/go-ntlmssp` → **v0.1.1**
(\[[#&#8203;3794](https://redirect.github.com/semaphoreui/semaphore/pull/3794)]\([#&#8203;3794](https://redirect.github.com/semaphoreui/semaphore/pull/3794)))
— also feeds into the Azure work.

Plus routine bumps of `lodash`, `picomatch`, `flatted`,
`follow-redirects`, `prettier`, `core-js`, `dotenv`, `openai`, and
`actions/checkout`.

A small style/config cleanup
([`[588b369d](https://redirect.github.com/semaphoreui/semaphore/commit/588b369d)`](https://redirect.github.com/semaphoreui/semaphore/commit/588b369d))
removes some extra config validation.

***

#### New contributors

Four first-time contributors landed code this release:
`@gaetan-steininger`, `@lawrence3699`, `@sevencastles`, and `@setswei`.
The community continues to broaden.

***

#### Headline takeaways for upgraders

1. **If you use external secret managers**, this is a meaningful release
— AWS SM and Azure KV are now first-class.
2. **If you provision API tokens programmatically**, plan for the new
`expires_at` and `name` fields; they're optional but the inflection
point to start using them is now.
3. **If you run Ansible playbooks via Semaphore**, validate against
ansible-core 2.20.4 before upgrading production.
4. **If you're still on the Bolt driver**, evaluate migrating to SQLite
— the README now recommends it and at least one PR in this release
(\[[#&#8203;3804](https://redirect.github.com/semaphoreui/semaphore/pull/3804)]\([#&#8203;3804](https://redirect.github.com/semaphoreui/semaphore/pull/3804)))
had a noted Bolt-specific concern.
5. **If you operate a multi-team installation**, the new
tagged-global-runner model is worth designing around — it removes one of
the longest-standing rough edges in shared-fleet runner setups.

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMzAuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEzMC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImFwcC9zZW1hcGhvcmUiLCJhdXRvbWVyZ2UiLCJyZW5vdmF0ZS9jb250YWluZXIiLCJ0eXBlL21pbm9yIl19-->

charts/stable/semaphore/Chart.yaml

@@ -9,7 +9,7 @@ annotations:
   trueforge.org/min_helm_version: "3.14"
   trueforge.org/train: stable
 apiVersion: v2
-appVersion: 2.17.39
+appVersion: 2.18.1
 dependencies:
   - name: common
     version: 29.2.8
@@ -37,5 +37,5 @@ sources:
   - https://github.com/trueforge-org/truecharts/tree/master/charts/stable/semaphore
   - https://hub.docker.com/r/semaphoreui/semaphore
 type: application
-version: 7.2.0
+version: 7.3.0
 

charts/stable/semaphore/values.yaml

@@ -1,7 +1,7 @@
 # yaml-language-server: $schema=./values.schema.json
 image:
   repository: docker.io/semaphoreui/semaphore
-  tag: v2.17.39@sha256:0a5db8fffcc6df148e8682acdd860aa96a82cb7b07540c10a688a6076838d3d1
+  tag: v2.18.1@sha256:e49c76938a77f2ffa50d642e24bde7ddf27b7e35ab880813d72e8ea3ef5da90e
   pullPolicy: IfNotPresent
 
 securityContext: