Recent Updates

Stay up to date with the latest changes and improvements from the Runbook Automation development team.

This page shows recently merged pull requests from both the Runbook Automation product repository and the open source Rundeck repository merged since the last self-hosted release of 6.2.1 on September 9, 2026.

Recent Changes

PR #10670

Job pages now show a warning when a scheduled job's saved user is no longer authorized to run it.

🤖 Generated with Claude Code

PR #10602

Fixed several security issues in the plugin upload/install flow: .groovy plugin files are no longer accepted without validation, uploaded/installed filenames are sanitized against path traversal, plugin install/uninstall authorization now correctly checks the plugin resource kind, and installPlugin no longer accepts local file: URLs.

PR #10650

Project archive imports that include project configuration, node sources, or SCM settings now require project configure authorization.

PR #10629

SCM git import and export now resolve job status with a single repository history walk per HEAD instead of one walk per job, and the SCM loader no longer runs catch-up cycles back-to-back when a cycle exceeds rundeck.scmLoader.interval. Large projects tracking repositories with deep history see import status refresh in seconds instead of minutes.

🤖 Generated with Claude Code

PR #10477

Webhook auth tokens are now hashed at rest (SHA-256), matching every other API token type. Existing webhook tokens are automatically migrated on next server startup; no action is required and existing webhook URLs continue to work unchanged.

Add Disable option to Azure Resource Model node source

Added a Disable option to the Azure Resource Model node source so you can turn off a misconfigured or unwanted node source without deleting it. When disabled, Rundeck skips Azure API calls and the source contributes no nodes; disabled entries appear greyed out in the node sources list. Defaults to off so existing configurations are unchanged.

PagerDuty plugin fixes and enhancements

Fixed several bugs in the PagerDuty plugins (multi-byte characters and empty notes in "Add Note", a response-parsing crash in "Update Incident" after setting Priority, malformed Authorization headers in "Send a Change Event" and "Add Responders"), removed an unused API Key field from "Send a Change Event", added include[] option checkboxes to "Get Incident" and a Priority field to "Update Incident", and pretty-printed JSON in debug-mode HTTP logs.

PR #10539

Fixed the Workflow Strategy configuration so its descriptive help text is no longer saved into the job definition and exported YAML as raw HTML. This will not fix existing jobs, but opening and resaving the job manually will fix the issue.

PR #10532

Fixed LDAP authentication (JettyCachingLdapLoginModule) so that first name, last name, and email are correctly synced from directories (e.g. Active Directory) that require attributes to be explicitly requested in the search, rather than silently syncing null values.

PR #10592

Fixed: the Nodes page could return an HTTP 500 instead of a normal error indicator when a node source failed to load.

🤖 Generated with Claude Code

PR #10596

Fixed a regression where Rundeck could mark the session cookie Secure even when this server's own listener is plain HTTP (deployments behind a TLS-terminating reverse proxy with forwarded headers enabled), which broke session/cookie-based authentication for clients like rundeck-cli connecting directly to that HTTP port.

PR #10531

Fixed the official Docker image so that RUNDECK_METRICS_LEGACY_ENABLED is honored, enabling the legacy /metrics/* endpoints when set.

PR #10595

Fixed CVE-2026-26032 by upgrading the transitively-included Apache Ivy dependency to 2.6.0.

PR #10594

The ${job.serverUrl} job context variable no longer ends with a trailing slash, so it can be safely concatenated with an absolute path (for example ${job.serverUrl}/api/50/projects). Job steps that previously relied on the trailing slash (${job.serverUrl}api/...) must add the slash explicitly.

🤖 Generated with Claude Code

PR #10537

Fixed a regression where creating system ACL policies via the API or rd CLI with a YAML request body and a JSON Accept header could fail with a parse error even though the ACL was created successfully. The server now returns JSON when requested via the Accept header instead of defaulting to the request body's content type.

Promote incubating cluster API endpoints to official, versioned endpoints

Promoted the incubating cluster info/member API endpoints to official, versioned (v60) endpoints, with typed response DTOs.

PR #10530

Added a new LDAP JAAS module option, forceBindingLoginNoAnonymousSearch, for use with forceBindingLogin. When enabled, Rundeck authenticates against LDAP servers that don't allow anonymous or bind-user search by constructing the user's bind DN directly from userRdnAttribute/userBaseDn instead of searching for it first.

Subscribe to Updates

Stay informed about Rundeck development by subscribing to a feed:

• RSS Feed
• Atom Feed

These feeds are updated regularly to highlight changes that are available in Runbook Automation SaaS and will be included in upcoming Self Hosted releases.

About These Updates

The development updates are automatically generated from both our private repository for the commercial product and the public open source repository. These changes have been merged since the last GA release and provide insight into what's coming in the next Self Hosted release.

Note: These updates reflect changes merged since the last GA release. Self-hosted customers should refer to the Release Notes section for version-specific updates applicable to their installation.

---

List Last updated: 2026-10-08