woodpecker

Breaking changes

What to check before upgrading, taken from the notes of the last 30 releases.

• v3.20.0Oct 28, 2026

  ⚠️ this release has an unintended breaking change [#7398], use 3.20.1

  ❤️ Thanks to all contributors! ❤️

  @6543, @AhmadNajiKam, @AkashKumar7902, @CamiloEspinoza, @Javex, @M0Rf30, @MannXo, @Mihir-Rabari, @PatelFarhaan, @Sawarz, @Sriram-PR, @YouCD, @aniketatgithub, @arcaartem, @asyntai, @carstenschmidt77, @confusedsushi, @cuducos, @eknathdj, @fredrikblau, @lafriks, @njaaazi, @pcbeingused333, @qwerty287, @roian6, @sugar700, @supertj, @tritsystem, @wolffberg, @xoxys

  Special thanks to @baradika for reporting a security vulnerability

  🔒 Security

  • Remove agent token from process os environments [#7412]
  • Make sure CLI self-update can target cli install dir only [#7400]
  • Document security boundaries [#7281]
  • Keep revoked env admins revoked until the server restarts [#7403]
  • Fix gitlab to set tag pipeline author from webhook metadata [#7397]
  • Update module github.com/woodpecker-ci/envsubst to v1.2.0 [#7398]
  • Rotate repo JWT on repo repair [#7361]
  • Fix and harden config fetching [#7386]
  • Enhance matrix feature [#7353]
  • Recover from config parsing panic in server [#7348]
  • Fix server panics while parsing config [#7336]
  • Only link http(s) error URIs on the login page [#7318]
  • Do not log bearer credentials at trace level [#7317]
  • Fall back to read only if the forge permission sync fails [#7282]
  • Quote all YAML line breaks in environment substitution [#7283]

  ✨ Features

  • Add support for selecting workflow to run for manual pipelines [#7393]
  • Add option to restrict organization and user to use its agents only [#7359]
  • Make CLI lint prefer detected Woodpecker config [#6634]
• v3.18.0Aug 24, 2026
  • ⚠️ This release contains a migration that alters log storage. Depending on the number of stored log lines, it can take a while to complete. Back up before upgrading and allow for extra downtime.