Release - Ascender v25.4.0

blaipr

ctrliq/ascenderreleases/tag/25.4.0

What's Changed

Notable Items

Add new inventory type "Federated" in ctrliq/ascender361
Create production images for ARM64 in ctrliq/ascender366
Add option for custom header logo / browser title in ctrliq/ascender365
Add option for DR deployments for disabling all Schedules in ctrliq/ascender326
New design theme in ctrliq/ascender351
Fix missing columns on User List table in ctrliq/ascender304
Dockerfile cleanup in ctrliq/ascender323
chore(ci): bump GitHub Actions off Node 20 runtimes by @clo-ciq in ctrliq/ascender327
Add revert buttons to Notification secret fields in ctrliq/ascender331
Codecs.open() is being deprecated, and native open is faster in most situations in ctrliq/ascender333
Add per-user preferred language setting by @blaipr in ctrliq/ascender335
Add dark mode support to the UI (PatternFly 4) by @blaipr in ctrliq/ascender338
Add a few more UI tweaks for Darkmode in ctrliq/ascender342
Bump npm patch/minor dependencies by @blaipr in ctrliq/ascender341
Fix: canceled jobs that never started should not set finished time by @flechoide in ctrliq/ascender343
Upgrade to Node 22 as 20 is EOL in ctrliq/ascender355
Update API theme in ctrliq/ascender356
Fix race condition in project directory creation in ctrliq/ascender358
Fix linting issues in codebase in ctrliq/ascender360
Update Federated Inventory docs in ctrliq/ascender362
Pin GitHub Actions to SHAs [SRE-1802] by @tylergohl in ctrliq/ascender353
Update short-sha to v4 in ctrliq/ascender363

Upstream Patches

Upstream 15970 - Revise start_fact_cache and finish_fact_cache to use JSON file in ctrliq/ascender332
Upstream 16417 - Balance controller node selection during capacity ties in ctrliq/ascender318
Upstream 16332 - perf: derive last_job_host_summary from query instead of denormalized FK in ctrliq/ascender319
Upstream 16433 - fix: constructed inventories no longer increase the host count in ctrliq/ascender322

Security Fixes

These CVEs were against the underlying packages we depend on, not directly on Ascender. For several of these, we did not use the affected code at all. They were resolved nevertheless as they will still be reported on any vulnerability scan on the container in your environment.

Upgrade brace-extension to resolve CVE-2026-45149 in ctrliq/ascender348
Upgrade css-minimizer-webpack-plugin to resolve CVE-2026-34043 GHSA-5c6j-r48x-rmvq in ctrliq/ascender310
Upgrade Django to resolve CVE-2026-5766 CVE-2026-35192 CVE-2026-6907 in ctrliq/ascender329
Upgrade dompurify to resolve GHSA-39q2-94rc-95cp in ctrliq/ascender309
Upgrade fast-uri to resolve CVE-2026-6321 in ctrliq/ascender328
Upgrade follow-redirects to resolve GHSA-r4q5-vmmm-2653 in ctrliq/ascender308
Upgrade GitPython to resolve CVE-2026-44244 CVE-2026-44243 in ctrliq/ascender325
Upgrade GitPython to resolve GHSA-rpm5-65cw-6hj4 GHSA-x2qx-6953-8485 in ctrliq/ascender316
Upgrade idna to resolve CVE-2026-45409 in ctrliq/ascender352
Upgrade jwcrypto to resolve CVE-2024-28102 in ctrliq/ascender311
Upgrade lxml to resolve CVE-2026-41066 in ctrliq/ascender330
Upgrade pip to resolve CVE-2026-3219 in ctrliq/ascender321
Upgrade pyjwt to resolve CVE-2026-48526 CVE-2026-48525 CVE-2026-48524 CVE-2026-48523 CVE-2026-48522 in ctrliq/ascender364
Upgrade qs to resolve CVE-2026-8723 in ctrliq/ascender359
Upgrade requests to resolve CVE-2026-44431 CVE-2026-44432 in ctrliq/ascender336
Upgrade Twisted to resolve CVE-2026-42304 in ctrliq/ascender324
Upgrade uuid to resolve CVE-2026-41907 in ctrliq/ascender357
Replace workbox-webpack-plugin to resolve CVE-2026-34043 GHSA-5c6j-r48x-rmvq in ctrliq/ascender312
Upgrade ws to resolve CVE-2026-45736 in ctrliq/ascender349

New Contributors

@clo-ciq made their first contribution in ctrliq/ascender327
@blaipr made their first contribution in ctrliq/ascender335
@flechoide made their first contribution in ctrliq/ascender343
@tylergohl made their first contribution in ctrliq/ascender353

Full Changelog: ctrliq/ascender25.3.6 → 25.4.0