Release v2026.2 by matthew-white · Pull Request #1835 · getodk/central

matthew-white · 2026-04-22T04:21:54Z

This PR prepares the release of v2026.2. It should only contain changes from other PRs that have already been approved and merged (and possibly merge commits from the master branch).

Closes #1818

Previously called `disallow-all`; rename to `backend-strict` to better reflect its usage rather than current implementation details.

Closes #1819

Looks like a merge error.

Closes #1856

Switch from Content-Security-Policy-Report-Only to Content-Security-Policy.

Closes #1775

In line with #1854.

Closes #1851

Switch from Content-Security-Policy-Report-Only to Content-Security-Policy.

It looks like the checkout code from the `test-images` job was copy/pasted elsewhere. Simplifying this config should speed up git checkout in affected jobs.

Fixes: expected docker context is increased due to WF merge

Fixes/install openssl

The `DB_SSL` env var was made illegal in #1647. The check was then moved from runtime to build time in #1671. Checking at build-time allows for faster failure and clearer feedback to sysadmins who are upgrading, and previously depended on this env var. However, the downside is that if container images are pre-built centrally, this check will be skipped. With this commit, the check will move to container startup. However, it will now be skipped if the container is started with a non-standard CMD/command/COMMAND.

Switch all headers from `Content-Security-Policy-Report-Only` to `Content-Security-Policy`.

Restrict TCP ports to the local machine. This will prevent exposing these dev services on the local network or wider.

Tests pass with nginx: ✅ `1.29.7` Tests fail with nginx: ☠️ `1.29.5` ☠️ `1.29.6` Closes #1736

Restrict TCP ports to the local machine. This will prevent exposing these dev services on the local network or wider.

Increase the lower and upper bounds to: * take account of larger contexts in forked repositories, and * tighten the acceptable margin

One less place to keep up-to-date.

Closes #1810

sn>

Reduces max-old-space-size allocation by 2GB (50%). On dev.getodk.cloud this currently: * fails with 1024 * passes with 1536 This suggests decreasing to 2048 is: 1. a good saving, and 2. fairly safe

Use no longer encouraged. Closes #1894

Introduced in fe34e41, it looks like this volume was never referenced. Ref #1894

Instead of changing the global builder default, just use the `docker_context_checker` custom builder for the specific job it was written for. This is helpful for dev machines so that other docker jobs are not affected by this script.

The linked PR is very long, and doesn't give clear guidance/explanation of what's going on. Ultimately this test should be the source of truth for the paths which serve web-forms content, and more context can be added here if required.

Related: #1978

Closes #1975

Closes #1996

Newer versions have been released but less than 14 days ago. None of the high priority CVEs fixed affect us.

It was released only a week ago but it fixes additional buffer overread and overflow issues over 1.31.1 released a month ago.

2.0.0 was released 3 weeks ago and followed up with point releases. Let's wait until it stabilizes, we don't need any of the udpates.

8.8 has been out a month but it makes some significant changes so I'd rather be conservative

Update infrastructure dependencies for v2026.2

alxndrsn and others added 30 commits April 18, 2026 08:08

ci/test-nginx: show mock-sentry logs (#1816)

6c764ea

ci/ghcr: update deprecated docker action versions (#1821)

0379dcf

Closes #1818

test/nginx/csp: rename backend-strict policy (#1823)

ae72624

Previously called `disallow-all`; rename to `backend-strict` to better reflect its usage rather than current implementation details.

ci: only publish containers if tests passed (#1820)

963b9dc

Closes #1819

test/nginx/csp: remove duplicate test (#1860)

94aa904

Looks like a merge error.

nginx/csp: blank.html: allow form-action 'self' (#1857)

1431cb1

Closes #1856

nginx/csp: enforce policy for blank.html (#1858)

e6df530

Switch from Content-Security-Policy-Report-Only to Content-Security-Policy.

csp: allow data: URLs in worker-src for web-forms (#1776)

9122bb2

Closes #1775

nginx/csp: tighten favicon allowance for blank.html (#1855)

711c6ad

In line with #1854.

nginx/csp: allow favicons for backend requests (#1854)

c9b359a

Closes #1851

Merge branch 'master' into next

d3eb696

nginx/csp: enforce policy for central-backend (#1859)

af64f1d

Switch from Content-Security-Policy-Report-Only to Content-Security-Policy.

nginx: fix escaping in /fonts/ matcher (#1863)

625eb98

ci: simplify checkout (#1890)

97b3251

It looks like the checkout code from the `test-images` job was copy/pasted elsewhere. Simplifying this config should speed up git checkout in affected jobs.

Fixes: expected docker context is increased due to WF merge

fe411c8

Merge pull request #1893 from sadiqkhoja/fixes/docker-context

448b96a

Fixes: expected docker context is increased due to WF merge

Fixes: install openssl in service container

1a9c7f9

Merge pull request #1892 from sadiqkhoja/fixes/install-openssl

b9a1d3f

Fixes/install openssl

nginx: enable Content Security Policies (#1909)

95717b1

Switch all headers from `Content-Security-Policy-Report-Only` to `Content-Security-Policy`.

test/nginx: fix comment typo (#1938)

a4e5b06

test/nginx/docker-compose: restrict open ports to local machine (#1927)

48b7478

Restrict TCP ports to the local machine. This will prevent exposing these dev services on the local network or wider.

nginx: test stream interruption (#1939)

fc457ec

Tests pass with nginx: ✅ `1.29.7` Tests fail with nginx: ☠️ `1.29.5` ☠️ `1.29.6` Closes #1736

dev/docker-compose: restrict open ports to local machine (#1925)

c182517

Restrict TCP ports to the local machine. This will prevent exposing these dev services on the local network or wider.

nginx: reject form previews with unexpected query params (#1947)

18b9667

test: disable case-sensitive routing for express servers (#1953)

007fd5c

ci: increase docker-context file size expecations (#1948)

28206d5

Increase the lower and upper bounds to: * take account of larger contexts in forked repositories, and * tighten the acceptable margin

test/nginx: extract request() and add testing (#1955)

0c07aaa

ci: read node version from volta declaration (#1958)

40868ce

One less place to keep up-to-date.

test: make ExpressJS host-bindings explicit (#1954)

f098936

alxndrsn and others added 30 commits June 11, 2026 08:38

test/check-docker-context: ignore .git directory (#1967)

c20f3ed

Closes #1810

test: disable extended query parser for express servers (#1964)

96cf4ed

sn>

Upgrade Enketo to 7.6.2 (#1965)

ce03665

fix(web-forms#535): separate enketo and web-forms into their own vue app

c91fe3d

fix: reduce runtime memory usage in nginx service

1f0cf1e

nginx/web-forms: assert correct HTML is served (#1980)

6f8fe88

nginx: narrow scope of NodeJS max-old-space-size (#1993)

27cc8ef

build/nginx: reduce gc heap space allocation (#1994)

4007043

Reduces max-old-space-size allocation by 2GB (50%). On dev.getodk.cloud this currently: * fails with 1024 * passes with 1536 This suggests decreasing to 2048 is: 1. a good saving, and 2. fairly safe

service: remove volume: data/transfer (#1992)

ddaf82f

Use no longer encouraged. Closes #1894

docker-compose: remove dangling volume: transfer (#1973)

6c70ffb

Introduced in fe34e41, it looks like this volume was never referenced. Ref #1894

nginx: remove misleading web-forms config (#1982)

8ecbaa7

Related: #1978

nginx/web-forms: simplify try_files directive (#1983)

3a437ac

nginx: merge duplicate web-forms regexes (#1984)

1288db9

Closes #1975

test/nginx: add more fake webforms paths (#1985)

8967ba0

chore: pass frontend Sentry DSN (#2005)

883431c

client: replace submodule with specific release (#1998)

8b8a038

Closes #1996

chore: rename variable to SENTRY_DSN_FRONTEND (#2010)

259f9fa

chore: updates PR template (#2014)

7489585

Update pyxform image version to v4.5.0 (#2020)

17ec5a4

Upgrade node to 24.16.0

1214873

Newer versions have been released but less than 14 days ago. None of the high priority CVEs fixed affect us.

Upgrade nginx to 1.31.2

1e4cf82

It was released only a week ago but it fixes additional buffer overread and overflow issues over 1.31.1 released a month ago.

Upgrade Postgres to 14.23

ac22116

Upgrade smtp image to latest in 1.2.x

eb8127f

2.0.0 was released 3 weeks ago and followed up with point releases. Let's wait until it stabilizes, we don't need any of the udpates.

Upgrade redis to latest in 8.6.x

41d0827

8.8 has been out a month but it makes some significant changes so I'd rather be conservative

Upgrade test dependencies

d058b88

Upgrade playwright to fix CI

c0898a8

Merge pull request #2022 from lognaturel/v2026.2-deps

2a4967e

Update infrastructure dependencies for v2026.2

Update FRONTEND_VERSION before regression testing

d30c049

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Release v2026.2#1835

Release v2026.2#1835
matthew-white wants to merge 63 commits into
masterfrom
next

matthew-white commented Apr 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Uh oh!

Conversation

matthew-white commented Apr 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants