Release - Ascender v25.6.1

cigamit

What's Changed

Bug Fixes

Fix blank Status on Inventory Source table by @cigamit in ctrliq/ascender781
Start social auth logins with a POST form by @samoz83 in ctrliq/ascender784
Allow deleting inventory hosts while jobs are running by @fernandorocagonzalez in ctrliq/ascender785
Recompile locale messages by @cigamit in ctrliq/ascender797
fix: quote the arguments the devel entrypoint execs by @blaipr in ctrliq/ascender801
Accept an explicit update_fields=None in the remaining save methods by @blaipr in ctrliq/ascender799
chore: ignore the e2e suite's node_modules in yamllint by @blaipr in ctrliq/ascender800
fix: guard the workflow graph's recovery refetch after unmount and on failure by @blaipr in ctrliq/ascender802

Backend Upgrades

build: bump jest-environment-jsdom from 30.4.1 to 30.5.0 in /awx/ui by @dependabot[bot] in ctrliq/ascender776
build: bump @testing-library/user-event from 14.6.5 to 14.6.6 in /awx/ui by @dependabot[bot] in ctrliq/ascender779
build: bump webpack-dev-server from 5.2.6 to 6.0.0 in /awx/ui by @dependabot[bot] in ctrliq/ascender780

Upstream Patches

Upstream 16426 - Fix workflow node update failing when JT has unprompted labels by @blaipr in ctrliq/ascender788
Upstream 16440 - fix: allow blank password field to fix OpenAPI schema validation by @blaipr in ctrliq/ascender791
Upstream 16451 - Fix analytics API requests to respect proxy environment variables by @blaipr in ctrliq/ascender792
Upstream 16466 - Fix TypeError when update_fields=None in model save methods by @blaipr in ctrliq/ascender793
Upstream 16516 - Fix SonarCloud security rating: remove user-controlled data from sqlite filepath by @blaipr in ctrliq/ascender794
Upstream 16547 - fix: delete inventory hosts in batches to avoid memory exhaustion by @blaipr in ctrliq/ascender790
Upstream 16555 - Optimize unified job list RBAC query and pagination count by @cigamit in ctrliq/ascender645
Upstream 16587 - AAP-87883: Use shared lock for project copy when no sync is needed by @cigamit in ctrliq/ascender798
Upstream 16623 - Fix JT admins unable to toggle ask*on_launch fields without project_inventory access by @blaipr in ctrliq/ascender789
Upstream 16477 - Prevent Execution Instances to be Added to the Control Plane by @blaipr in ctrliq/ascender787
Upstream 16620 - fix: check if the lock was acquired and return if not by @blaipr in ctrliq/ascender786

Security Fixes

These CVEs were against the underlying packages we depend on, not directly on Ascender. For several of these, we did not use the affected code at all. They were resolved nevertheless as they will still be reported on any vulnerability scan on the container in your environment.

Upgrade jwcrypto to resolve CVE-2026-80179 CVE-2026-84185 by @cigamit in ctrliq/ascender796
Upgrade qs to resolve CVE-2026-82562 CVE-2026-82417 by @cigamit in ctrliq/ascender795

Full Changelog: ctrliq/ascender25.6.0 → 25.6.1