Spinnaker Release 2026.3.2
Breaking Changes
Features
- gate: add an allowlist for MCP tools (backport #8184) (#8185) ( e2ca1bc2 )
- gate: optionally check private GitHub organization memberships (#8193) ( 33a9d2f1 )
Configuration
Fixes
- ci: skip API docs PR when Gate’s OpenAPI spec is unchanged (#8089) (#8090) ( bb05aeca )
- clouddriver: cache AWS SDK v2 timestamps as epoch millis (#8141) (#8145) ( 9eb46f7b )
- clouddriver: cache named-image enums as their AWS wire values (#8163) (#8164) ( ba289f7b )
- clouddriver: make clouddriver-sql retries actually run (backport #8111) (#8149) ( ad8ddfeb )
- clouddriver: order SQL task state by a per-task sequence and make terminal states final (backport #8130) (#8168) ( 40645678 )
- deck: keep pipeline editors in sync with pipeline changes (backport #8202) (#8203) ( b2cb58a5 )
- echo: compare GitHub webhook signatures in constant time (backport #8162) (#8165) ( a0893b61 )
- ecs: reload ECS account credentials when their backing AWS account changes (#8196) (#8199) ( 5170b9bd )
- fiat: deserialize extension resources in UserPermission.View (backport #8253) (#8256) ( 42da7f83 )
- fiat: harden GitHub App team role sync (follow-up to #8224) (backport #8229) (#8233) ( ebeabb65 )
- fiat: renew GitHub App installation tokens and keep cached memberships on errors (#8224) (#8225) ( bdb215de )
- front50: serialize cache refresh and de-flake multi-threaded pipeline cache refresh specs (#8228) (#8230) ( ca5f488e )
- gate: let JsonHttpMessageConverter hand back raw JSON bodies as String (#8126) (#8127) ( 2f4b480d )
- orca: ack queue messages atomically so a concurrent push survives for stages that have looping tasks (#7919) (#8206) ( 86b9971f )
- orca: send Clouddriver requests that the Retrofit2 migration left unexecuted (#8144) (#8146) ( eccef16f )
- security: drop emSign ECC Root CA - G3 from service images (#8243) ( d11321f0 )
- security: update image packages and shared Java dependencies (backport #8181) (#8182) ( 4fddd36b )