v267

Contents

• Notices
• Job Spec Changes
• Security Notices
• Compatible Releases and Stemcells
• Subcomponent Updates

Notices

• None

Job Spec Changes

• None

Security Notices

Affecting v267

• None

Resolved in v267

• Not yet updated

Subcomponent Updates

• Cloud Controller and Service Broker API:
  • capi-release 1.32.0
• Identity:
  • uaa-release v41 (no change)
• Routing:
  • routing-release v0.159.0
• Loggregator:
  • loggregator v90.1 (no change)
  • statsd-injector-release v1.0.28
• Java Buildpack:
  • java-buildpack v3.18 (no change)
• Ruby Buildpack:
  • ruby-buildpack v1.6.41 (no change)
• Go Buildpack:
  • go-buildpack v1.8.5 (no change)
• Node.js Buildpack:
  • nodejs-buildpack v1.5.36 (no change)
• Python Buildpack:
  • python-buildpack v1.5.19 (no change)
• PHP Buildpack:
  • php-buildpack v4.3.35 (no change)
• Staticfile Buildpack:
  • staticfile-buildpack v1.4.9 (no change)
• Binary Buildpack:
  • binary-buildpack v1.0.13 (no change)
• .Net Core Buildpack:
  • dotnet-core-buildpack v1.0.20 (no change)
• Consul:
  • consul-release v152 (no change)
• Etcd:
  • etcd-release v104 (no change)
• NATS:
  • nats-release v19
• Postgres:
  • postgres-release v17 (no change)

Compatible Releases and Stemcells

• Diego release v1.21.0. Release notes for v1.21.0 · v1.20.0.
• Garden-Runc release v1.9.0. Release notes for v1.9.0.
• cflinuxfs2 release v1.137.0. Release notes for v1.137.0 · v1.136.0 · v1.135.0 · v1.134.0.
• cf-networking release v1.2.0. Release notes for v1.2.0.
• grootfs release v0.21.0. Release notes for v0.21.0.
• stemcell: 3421.11

v266

Contents

• Notices
• Job Spec Changes
• Security Notices
• Compatible Releases and Stemcells
• Subcomponent Updates

Notices

• There are changes to the way Cloud Controller stores resource matched blobs. Read here for more information.

Job Spec Changes

• None

Security Notices

Affecting v266

• None

Resolved in v266

• CVE-2017-8032: UAA Identity Zone Admin Privilege Escalation

Subcomponent Updates

• Cloud Controller and Service Broker API:
  • capi-release 1.31.0
• Identity:
  • uaa-release v41
• Routing:
  • routing-release v0.157.0
• Loggregator:
  • Loggregator 90.1
  • statsd 1.0.28
• Java Buildpack:
  • java-buildpack v3.18
• Ruby Buildpack:
  • ruby-buildpack v1.6.41
• Go Buildpack:
  • go-buildpack v1.8.5
• Node.js Buildpack:
  • nodejs-buildpack v1.5.36 (no change)
• Python Buildpack:
  • python-buildpack v1.5.19 (no change)
• PHP Buildpack:
  • php-buildpack v4.3.35
• Staticfile Buildpack:
  • staticfile-buildpack v1.4.9
• Binary Buildpack:
  • binary-buildpack v1.0.13 (no change)
• .Net Core Buildpack:
  • dotnet-core-buildpack v1.0.20
• Consul:
  • consul-release v152 (no change)
• Etcd:
  • etcd-release v104 (no change)
• NATS:
  • nats-release v18 (no change)
• Postgres:
  • postgres-release v17 (no change)

Compatible Releases and Stemcells

• Diego release v1.19.0. Release notes for v1.19.0.
• Garden-Runc release v1.8.0. Release notes for v1.8.0.
• cflinuxfs2 release v1.133.0. Release notes for v1.133.0.
• cf-networking release v1.1.0. Release notes for v1.1.0.
• grootfs release v0.20.0. Release notes for v0.20.0.
• stemcell: 3421.9

v265

Contents

• Notices
• Job Spec Changes
• Security Notices
• Compatible Releases and Stemcells
• Subcomponent Updates

Notices

• This release removes the nats_stream_forwarder job from the nats_z* instance groups. This was a component that existed only for monitoring, so there should be no issues with platform functionality.

Job Spec Changes

• None.

Security Notices

Affecting v265

• None.

Resolved in v265

• None.

Subcomponent Updates

• Cloud Controller and Service Broker API:
  • capi-release v1.30 (no change)
• Identity:
  • uaa-release v41 (no change)
• Routing:
  • routing-release v0.157.0
• Loggregator:
  • Loggregator 89
  • statsd 1.0.25
• Java Buildpack:
  • java-buildpack v3.17 (no change)
• Ruby Buildpack:
  • ruby-buildpack v1.6.40 (no change)
• Go Buildpack:
  • go-buildpack v1.8.4 (no change)
• Node.js Buildpack:
  • nodejs-buildpack v1.5.36 (no change)
• Python Buildpack:
  • python-buildpack v1.5.19 (no change)
• PHP Buildpack:
  • php-buildpack v4.3.34 (no change)
• Staticfile Buildpack:
  • staticfile-buildpack v1.4.6 (no change)
• Binary Buildpack:
  • binary-buildpack v1.0.13 (no change)
• .Net Core Buildpack:
  • dotnet-core-buildpack v1.0.19 (no change)
• Consul:
  • consul-release v152 (no change)
• Etcd:
  • etcd-release v104 (no change)
• NATS:
  • nats-release v18
• Postgres:
  • postgres-release v17 (No changes)

Compatible Releases and Stemcells

• Diego release v1.19.0. Release notes for v1.19.0.
• Garden-Runc release v1.8.0. Release notes for v1.8.0.
• cflinuxfs2 release v1.133.0. Release notes for v1.133.0 · v1.132.0 · v1.131.0 · v1.130.0.
• cf-networking release v1.1.0. Release notes for v1.1.0.
• grootfs-release 0.20.0. Release notes for v0.20.0.
• stemcell: 3421.6

v264

Contents

• Notices
• Job Spec Changes
• Security Notices
• Compatible Releases and Stemcells
• Subcomponent Updates

Notices

This release transitions the buildpacks to online mode, which requires an internet connection to stage apps. See here for more details.

Job Spec Changes

• None.

Security Notices

Affecting v264

• None

Resolved in v264

• None.

Subcomponent Updates

• Cloud Controller and Service Broker API:
  • capi-release v1.30 (no change)
• Identity:
  • uaa-release v41
• Routing:
  • routing-release v0.157.0
• Loggregator:
  • Loggregator 89
  • statsd 1.0.25
• Java Buildpack:
  • java-buildpack v3.17
• Ruby Buildpack:
  • ruby-buildpack v1.6.40
• Go Buildpack:
  • go-buildpack v1.8.4
• Node.js Buildpack:
  • nodejs-buildpack v1.5.36
• Python Buildpack:
  • python-buildpack v1.5.19
• PHP Buildpack:
  • php-buildpack v4.3.34
• Staticfile Buildpack:
  • staticfile-buildpack v1.4.6 (no change)
• Binary Buildpack:
  • binary-buildpack v1.0.13
• .Net Core Buildpack:
  • dotnet-core-buildpack v1.0.19
• Consul:
  • consul-release v152 (no change)
• Etcd:
  • etcd-release v104 (no change)
• NATS:
  • nats-release v17 (no change)
• Postgres:
  • postgres-release v17 (No change)

Compatible Releases and Stemcells

• Diego release v1.18.1. Release notes for v1.18.1 · v1.18.0.
• Garden-Runc release v1.8.0. Release notes for v1.8.0.
• cflinuxfs2 release v1.129.0. Release notes for v1.129.0 · v1.128.0 · v1.127.0.
• cf-networking release v1.0.0. Release notes for v1.0.0.
• grootfs release v0.19.0. Release notes for v0.19.0.
• stemcell: 3421.4

v263

Contents

• Notices
• Job Spec Changes
• Security Notices
• Compatible Releases and Stemcells
• Subcomponent Updates

Notices

• Staging tasks may intermittently fail while deploying this release. Read here for more.

Job Spec Changes

• If you are using cf-networking-release, the value for cf_networking.garden_external_networker.cni_config_dir now defaults to /var/vcap/jobs/silk-cni/config/cni. We recommend that you remove any overrides for this property, unless you are intending to use a 3rd party CNI plugin.

Security Notices

Affecting v263

• None.

Resolved in v263

• None.

Subcomponent Updates

• Cloud Controller and Service Broker API:
  • capi-release v1.30.0
• Identity:
  • uaa-release v40
• Routing:
  • routing-release v0.156.0
• Loggregator:
  • Loggregator 89
  • statsd 1.0.25
• Java Buildpack:
  • java-buildpack v3.16 (no change)
• Ruby Buildpack:
  • ruby-buildpack v1.6.39 (no change)
• Go Buildpack:
  • go-buildpack v1.8.2 (no change)
• Node.js Buildpack:
  • nodejs-buildpack v1.5.34 (no change)
• Python Buildpack:
  • python-buildpack v1.5.18 (no change)
• PHP Buildpack:
  • php-buildpack v4.3.33 (no change)
• Staticfile Buildpack:
  • staticfile-buildpack v1.4.6 (no change)
• Binary Buildpack:
  • binary-buildpack v1.0.12 (no change)
• .Net Core Buildpack:
  • dotnet-core-buildpack v1.0.18 (no change)
• Consul:
  • consul-release v152 (No change)
• Etcd:
  • etcd-release v104 (No change)
• NATS:
  • nats-release v17
• Postgres:
  • postgres-release v17 (No change)

Compatible Releases and Stemcells

• Diego release v1.17.0. Release notes for v1.17.0.
• Garden-Runc release v1.7.0. Release notes for v1.7.0.
• cflinuxfs2 release v1.126.0. Release notes for v1.126.0 · v1.125.0 · v1.124.0 · v1.123.0.
• cf-networking release v0.25.0. Release notes for v0.25.0.
• grootfs-release v0.19.0. Release notes for v0.19.0.
• stemcell: 3421.3

v262

Contents

• Notices
• Job Spec Changes
• Security Notices
• Compatible Releases and Stemcells
• Subcomponent Updates

Notices

• This release officially removes the DEA and HM9000 from cf-release.
• If your deployment still contains DEAs and HM9000, you must first scale down the DEA and HM9000 jobs to zero instances before upgrading to CF 262. Failure to scale do so will result in the following error:

  Failed compiling packages > ... Unknown CPI error 'Unknown' with message 'Address 10.10.16.41 is in use.' in 'create_vm' CPI method (00:09:52)
  

  The jobs in the manifest are named:
  • runner_z1
  • runner_z2
  • hm9000_z1
  • hm9000_z2

The default configuration for a new metron '/health' endpoint collides with CAPI. Update the metron.health_port to avoid this collision.

Job Spec Changes

• None

Security Notices

Affecting v262

• None

Resolved in v262

• None

Subcomponent Updates

• Cloud Controller and Service Broker API:
  • capi-release v1.28.0 (no change)
• Identity:
  • uaa-release v37
• Routing:
  • routing-release v0.155.0
• Loggregator:
  • Loggregator 88
  • statsd 1.0.25
• Java Buildpack:
  • java-buildpack v3.16 (no change)
• Ruby Buildpack:
  • ruby-buildpack v1.6.39 (no change)
• Go Buildpack:
  • go-buildpack v1.8.2 (no change)
• Node.js Buildpack:
  • nodejs-buildpack v1.5.34 (no change)
• Python Buildpack:
  • python-buildpack v1.5.18 (no change)
• PHP Buildpack:
  • php-buildpack v4.3.33 (no change)
• Staticfile Buildpack:
  • staticfile-buildpack v1.4.6 (no change)
• Binary Buildpack:
  • binary-buildpack v1.0.12 (no change)
• .Net Core Buildpack:
  • dotnet-core-buildpack v1.0.18 (no change)
• Consul:
  • consul-release v152
• Etcd:
  • etcd-release v104
• NATS:
  • nats-release v14 (no change)
• Postgres:
  • postgres-release v17 (no change)
• DEA-Warden-HM9000:
  • Removed.

Compatible Releases and Stemcells

• Diego release v1.16.1. Release notes for v1.16.1.
• Garden-Runc release v1.7.0. Release notes for v1.7.0.
• cflinuxfs2 release v1.123.0. Release notes for v1.123.0.
• cf-networking release v0.24.0. Release notes for v0.24.0.
• grootfs-release v0.19.0. Release notes for v0.19.0.
• stemcell: 3363.22

v261

IMPORTANT

• Known issue fixed with Create Account flow in UAA UI causing infinite redirects.
• Known issue fixed with /check_token failing on GET request.
• This release includes breaking changes for OAuth clients thats are defined in the cf-release manifest. Starting with UAA Release v36 we have added validation for OAuth Clients. You can find the full list here, but below are the changes deployers are most likely to see:
  • For cf client please ensure that secret is set to empty string ''
  • For ssh-proxy replace redirect-uri of /login with https://login.{system-domain}/login

Contents

• Notices
• Job Spec Changes
• Security Notices
• Compatible Releases and Stemcells
• Subcomponent Updates

Notices

• Not yet updated

Job Spec Changes

• Not yet updated

Security Notices

Affecting v261

• None

Resolved in v261

• CVE-2017-4992: Privilege escalation with user invitations
  Severity (high severity)

Subcomponent Updates

• Cloud Controller and Service Broker API:
  • No changes.
• Identity:
  • uaa-release v37
• Routing:
  • routing-release v0.154.0 (no changes)
• Loggregator:
  • loggregator v87 (no change)
  • statsd-injector-release v1.0.25 (no changes)
• Java Buildpack:
  • java-buildpack v3.16 (no change)
• Ruby Buildpack:
  • ruby-buildpack v1.6.39 (no change)
• Go Buildpack:
  • go-buildpack v1.8.2 (no change)
• Node.js Buildpack:
  • nodejs-buildpack v1.5.34 (no change)
• Python Buildpack:
  • python-buildpack v1.5.18 (no change)
• PHP Buildpack:
  • php-buildpack v4.3.33 (no change)
• Staticfile Buildpack:
  • staticfile-buildpack v1.4.6 (no change)
• Binary Buildpack:
  • binary-buildpack v1.0.12 (no change)
• .Net Core Buildpack:
  • dotnet-core-buildpack v1.0.18 (no change)
• Stacks:
  • stacks v1.122.0
  • stacks v1.121.0
• Consul:
  • consul-release v152 (no changes)
• Etcd:
  • etcd-release v104 (no change)
• NATS:
  • nats-release v14 (no changes)
• Postgres:
  • postgres-release v17 (no change)
• DEA-Warden-HM9000:
  • No update.

Compatible Releases and Stemcells

• Diego release v1.16.0. Release notes for v1.16.0.
• Garden-Runc release v1.7.0. Release notes for v1.7.0.
• cflinuxfs2 release v1.122.0. Release notes for v1.122.0 · v1.121.0 · v1.120.0.
• cf-networking release v0.24.0. Release notes for v0.24.0.
• grootfs-release: v0.19.0. Release notes for v0.19.0 · v0.19.0
• stemcell: 3363.22

v260

IMPORTANT

• Known issue with the Create Account flow in UAA UI which causes infinite redirects. The workaround is to set login.links.homeRedirect: null in the cf-release manifest
• Known issue with /check_token failing on GET request.
• This release includes breaking changes for OAuth clients thats are defined in the cf-release manifest. Starting with UAA Release v36 we have added validation for OAuth Clients. You can find the full list here, but below are the changes deployers are most likely to see:
  • For cf client please ensure that secret is set to empty string ''
  • For ssh-proxy replace redirect-uri of /login with https://login.{system-domain}/login

Contents

• Notices
• Job Spec Changes
• Security Notices
• Compatible Releases and Stemcells
• Subcomponent Updates

Notices

• Starting with this release, CF deployments will use Diego as its default backend. This change comes in advance of the DEAs being officially deprecated on May 22.
• The Postgres job will upgrade PostgreSQL to version 9.6.3. This drops support for upgrading from PostgreSQL 9.4.6. Only upgrades from PostgreSQL 9.4.9 (since cf v241) and PostgreSQL 9.6.2 (since cf v256) are supported. Before deploying, please review considerations at postgres-release v17.

Job Spec Changes

• Not yet updated

Security Notices

Affecting v260

• None

Resolved in v260

• CVE-2017-4991: UAA password reset vulnerability (high severity)

Subcomponent Updates

• Cloud Controller and Service Broker API:
  • capi-release 1.28.0
• Identity:
  • uaa-release v36
• Routing:
  • routing-release v0.154.0
• Loggregator:
  • Loggregator 86
  • statsd-injector-release 1.0.25
• Java Buildpack:
  • java-buildpack v3.16 (no change)
• Ruby Buildpack:
  • ruby-buildpack v1.6.38
  • ruby-buildpack v1.6.39
• Go Buildpack:
  • go-buildpack v1.8.2
• Node.js Buildpack:
  • nodejs-buildpack v1.5.32
  • nodejs-buildpack v1.5.34
• Python Buildpack:
  • python-buildpack v1.5.18 (no change)
• PHP Buildpack:
  • php-buildpack v4.3.33
• Staticfile Buildpack:
  • staticfile-buildpack v1.4.6
• Binary Buildpack:
  • binary-buildpack v1.0.12
• .Net Core Buildpack:
  • dotnet-core-buildpack v1.0.18
• Stacks:
  • stacks v1.120.0
• Consul:
  • consul-release v152 (no changes)
• Etcd:
  • etcd-release v104
• NATS:
  • nats-release v14 (no changes)
• Postgres:
  • postgres-release v17
• DEA-Warden-HM9000:
  • No update.

Compatible Releases and Stemcells

• Diego release v1.15.3. Release notes for v1.15.3 · v1.15.2 · v1.15.1.
• Garden-Runc release v1.7.0. Release notes for v1.7.0 · v1.6.0.
• cflinuxfs2 release v1.119.0. Release notes for v1.119.0 · v1.118.0 · v1.117.0.
• cf-networking release v0.24.0. Release notes for v0.24.0 · v0.23.0.
• grootfs-release v0.19.0. Release notes for v0.19.0 · v0.19.0
• stemcell: 3363.22

v259

Contents

• Notices
• Job Spec Changes
• Security Notices
• Compatible Releases and Stemcells
• Subcomponent Updates

Notices

• Not yet updated

Job Spec Changes

• Not yet updated

Security Notices

Affecting v259

• None

Resolved in v259

• Not yet updated

Subcomponent Updates

• Cloud Controller and Service Broker API:
  • capi-release 1.27.0
• Identity:
  • uaa-release v34
• Routing:
  • routing-release 0.152.0
• Loggregator:
  • Loggregator 85
  • statsd-injector-release 1.0.22
• Java Buildpack:
  • java-buildpack v3.16 (no change)
• Ruby Buildpack:
  • ruby-buildpack v1.6.37 (no change)
• Go Buildpack:
  • go-buildpack v1.8.1 (no change)
• Node.js Buildpack:
  • nodejs-buildpack v1.5.31 (no change)
• Python Buildpack:
  • python-buildpack v1.5.18 (no change)
• PHP Buildpack:
  • php-buildpack v4.3.31 (no change)
• Staticfile Buildpack:
  • staticfile-buildpack v1.4.5 (no change)
• Binary Buildpack:
  • binary-buildpack v1.0.11 (no change)
• .Net Core Buildpack:
  • dotnet-core-buildpack v1.0.15 (no change)
• RootFS:
  • cflinuxfs2 v1.116.0
• Consul:
  • No updates
• Etcd:
  • No updates
• NATS:
  • nats-release v14 (no changes)
• Postgres:
  • postgres-release v16 (no changes)
• DEA-Warden-HM9000:
  • No changes.

Compatible Releases and Stemcells

• Diego release v1.15.0. Release notes for v1.15.0.
• Garden-Runc release v1.5.0. Release notes for v1.5.0.
• cflinuxfs2 release v1.116.0. Release notes for v1.116.0.
• cf-networking release v0.22.0. Release notes for v0.22.0.
• grootfs release v0.17.1. Release notes for v0.17.1.
• stemcell: 3363.20

v258

Contents

• Notices
• Job Spec Changes
• Security Notices
• Compatible Releases and Stemcells
• Subcomponent Updates

Notices

• This release requires includes changes that require BOSH v261.3.
  Details: As we warned in CF v254, if your BOSH director uses a MySQL database as its data store, a version of cf-release that contains links for consul jobs will fail to deploy due to a bug in the database schema. BOSH v261.3 contains the necessary fix.
• Known issue for DEA deployers: Stemcell 3363.19 and greater introduce a change incompatible with the DEAs. For deployers still using the DEAs, use the 3312.X stemcell series. Also, recall that DEA support ends on May 22, so we recommend migrating to Diego soon.

Job Spec Changes

• Not yet updated

Security Notices

Affecting v258

• None

Resolved in v258

• Not yet updated

Subcomponent Updates

• Cloud Controller and Service Broker API:
  • No changes
• Identity:
  • uaa-release v34
• Routing:
  • routing-release v0.151.0
• Loggregator:
  • Loggregator 85
  • statsd 1.0.22
• Java Buildpack:
  • java-buildpack v3.16
• Ruby Buildpack:
  • ruby-buildpack v1.6.37 (no change)
• Go Buildpack:
  • go-buildpack v1.8.1
• Node.js Buildpack:
  • nodejs-buildpack v1.5.31 (no change)
• Python Buildpack:
  • python-buildpack v1.5.18
• PHP Buildpack:
  • php-buildpack v4.3.31
• Staticfile Buildpack:
  • staticfile-buildpack v1.4.5
• Binary Buildpack:
  • binary-buildpack v1.0.11 (no change)
• .Net Core Buildpack:
  • dotnet-core-buildpack v1.0.15 (no change)
• RootFS:
  • cflinuxfs2 v1.115.0
  • cflinuxfs2 v1.114.0
• Consul:
  • No changes.
• Etcd:
  • No changes. (still v101)
• NATS:
  • nats-release v14 (no changes)
• Postgres:
  • No changes.
• DEA-Warden-HM9000:
  • No changes.

Compatible Releases and Stemcells

• Diego release v1.14.1. Release notes for v1.14.1 · v1.14.0.
• Garden-Runc release v1.5.0. Release notes for v1.5.0.
• cflinuxfs2-rootfs release v1.115.0. Release notes for v1.115.0 · v1.114.0 · v1.113.0 · v1.112.0.
• cf-networking release v0.21.0. Release notes for v0.21.0.
• grootfs-release release v0.17.1. Release notes for v0.17.1.
• stemcell: 3363.20