The Xcode 27.0 Beta 2 image is now available to be used in CircleCI pipelines.

The full manifest of installed software can be found here.

The Xcode 26.6 RC 2 image is now available to be used in CircleCI pipelines.

The full manifest of installed software can be found here.

The Xcode 27.0 Beta 1 image is now available to be used in CircleCI pipelines.

The full manifest of installed software can be found here.

Machine Runner:

Machine Runner:

• Fixed a bug where a runner with a cached task-agent binary could fail every job with an “unsupported platform” error until the process was restarted. The fix ensures newer task-agent versions are still fetched on demand when available.

Container Runner:

• You can now override the container entrypoint per resource class in your runner configuration. See the documentation for details.

We now have a consistent way to validate if your config is impacted by any of the upcoming breaking changes before they take effect on August 17, 2026.

We now have a consistent way to validate if your config is impacted by any of the upcoming breaking changes before they take effect on August 17, 2026.

CLI: Run circleci config validate

Config editor: Enable the “config next” toggle in your config editor

For more info on how to utilize the config editor or the new CLI flag, see the Discuss post.

The Xcode 26.6 RC 1 image is now available to be used in CircleCI pipelines.

The full manifest of installed software can be found here.

Note: This replaces three earlier changelogs that covered these changes separately. The breaking change date for all three is now July 17, 2026. Refer to this post going forward..

Note: This replaces three earlier changelogs that covered these changes separately. The breaking change date for all three is now July 17, 2026. Refer to this post going forward..

On August 17, 2026, CircleCI is shipping three changes to how configs are compiled. Pipelines affected by any of these changes will fail to compile after this date. Here are the 3 upcoming breaking changes:

1. Undeclared parameters

Previously, referencing a parameter that is not declared in the current scope could silently resolve instead of raising an error, allowing invalid configs to compile.

After this date, configs that reference an undeclared parameter will fail to compile.

1. Regex engine update

The regex engine used to evaluate regex conditions is being updated to improve the security and reliability of config compilation. After this date, configs using any of the following regex features will fail to compile:

• Negative lookaheads
• Negative lookbehinds
• Possessive quantifiers
• Backreferences

1. version: 2.0 config support removed

Support for version: 2.0 configs is ending. All pipelines must use version: 2.1. Version 2.1 introduced orbs, pipeline parameters, reusable commands and executors, and a well-defined schema with strict validation.

For details on identifying impact and resolving any issues, see the Discuss post.

New:

New:

• The provisioner now supports high-availability deployments: with multiple replicas, one is elected leader and standbys take over automatically on failover.
• Uninstalling the Helm release now scales the VM pool down to zero before deletion, so runner VMs are cleaned up automatically.
• Runner logs are now forwarded to each VM’s serial console, making runner output visible through the virtualization layer for troubleshooting.
• AWS EKS now supports nested virtualization, and runner-provisioner has been validated against it. Bare metal nodes are no longer required to run runner VMs.

Improvements:

• Pool VMs now install the circleci-runner packages from a bundled containerDisk image at boot instead of fetching from packagecloud each time. This speeds up boots once the image is cached and enables air-gapped clusters, since the bundle can be rehosted on an internal registry. Configurable via runnerBundle.image; enabled by default.
• Provisioned VMs now default to masquerade networking.
• The container image pull policy now defaults to Always.
• imagePullSecrets is no longer set by default on the provisioner deployment.

Dependency updates: routine dependency and security bumps, including a moderate-severity HTTP/3 fix in quic-go (CVE-2026-40898).

IMPORTANT: This changelog has been superseded. This breaking change has been consolidated with two others into a single entry, and the date is now July 17, 2026. Please refer to the updated changelog for up-to-date details. The information below is retained for reference only.

IMPORTANT: This changelog has been superseded. This breaking change has been consolidated with two others into a single entry, and the date is now July 17, 2026. Please refer to the updated changelog for up-to-date details. The information below is retained for reference only.

On July 8th, 2026, CircleCI is updating how undeclared parameters are handled. Previously, referencing a parameter that is not declared in the current scope could silently resolve instead of raising an error, allowing invalid configs to compile.

After this date, configs that reference an undeclared parameter will fail to compile. You can preview whether your config is affected today using the “config next” validation in the UI or the CLI.

For more information, see our Discuss post.

We’ve resolved two issues that caused Chunk to abandon tasks without producing a fix:

We’ve resolved two issues that caused Chunk to abandon tasks without producing a fix:

• When a failing job auto-retried before Chunk fetched its step output, Chunk would see no failed steps and stop. Chunk now resolves against the originally-failing step regardless of retries.

• When triggered from a workflow-level failure, Chunk only inspected the directly-linked job and missed failed steps in downstream jobs. Chunk now inspects all failed jobs in the workflow.

Chunk now calls git tools directly to commit changes and open pull requests during its run, rather than delegating that step to a separate process afterward.

This means Chunk can retry git operations if committing or opening a PR fails, improving reliability and reducing the chances of a fix being lost due to a transient git error.

When Chunk encounters a transient or infrastructure failure, it can now trigger a pipeline rerun directly instead of stopping. If your prompt indicates rerun approval for example, “fix my workflow, rerun if needed” Chunk will rerun automatically. Otherwise, Chunk will ask before proceeding.

Previously, Chunk had no path forward on infrastructure failures and required you to rerun manually.

We’ve fixed confusing empty states in the Chunk task output view when running a Chunk Task:

We’ve fixed confusing empty states in the Chunk task output view when running a Chunk Task:

• The Logs tab now shows “Chunk is working on your task and will provide execution logs when finished.” instead of “Unable to load logs” while a run is in progress.
• The Diff tab now shows “Chunk is working on your task and will provide diffs when finished.” instead of “Unable to load branch diff” while a run is in progress.

We’ve resolved an issue where Chunk would report a Task as successful but produce no diff and open no PR.

When creating or editing an automated task, you can now add a custom MCP server instruction directly from the task form. MCP servers give Chunk additional context and information to act upon, making automated tasks more powerful and precise.

When creating or editing an automated task, you can now add a custom MCP server instruction directly from the task form. MCP servers give Chunk additional context and information to act upon, making automated tasks more powerful and precise.

To create an automated task, navigate to Chunk → Automations (top right corner), then select New automated task.

We’ve fixed an issue where clicking Fix error (Beta) on a failed job step showed a “Branch not found” error instead of prompting you to install the GitHub App when it wasn’t set up yet.

Chunk now has a dedicated Automations page where you can create, view, and manage your automated tasks in one place. The page includes a task creation form, an automations list, and the ability to edit or force-run automations from a contextual menu.

Chunk now has a dedicated Automations page where you can create, view, and manage your automated tasks in one place. The page includes a task creation form, an automations list, and the ability to edit or force-run automations from a contextual menu.

Use the Automations page to set up recurring tasks like fixing flaky tests on a schedule, keeping dependencies up to date, or running custom prompts against your repositories automatically.

To get started, navigate to Chunk → Automations (top right corner).

The Chunk Tasks view now has two tabs: Tasks and Scheduled Runs so you can easily distinguish manually triggered runs from automated ones.

The Chunk Tasks view now has two tabs: Tasks and Scheduled Runs so you can easily distinguish manually triggered runs from automated ones.

The Windows Server 2022 and Windows Server 2025 machine images (including CUDA/NVIDIA variants) are now available under the current tag. Full release notes are available here.

The Android machine image is now available under the default tag. Full release notes are available here.

Chunk now sends a weekly email digest 09:00 UTC every Monday summarizing your team’s activity. Each digest shows completed tasks, PRs opened, and failed tasks at a glance, plus a list of the most recent PRs awaiting your review.

Chunk now sends a weekly email digest 09:00 UTC every Monday summarizing your team’s activity. Each digest shows completed tasks, PRs opened, and failed tasks at a glance, plus a list of the most recent PRs awaiting your review.

Click Review tasks to jump directly to see Chunk tasks with open PRs To disable the digest, go to User Settings (top right) → Notifications → scroll to Chunk → Digest

Runner Provisioner, a new Kubernetes controller that automatically scales CircleCI runner VMs using KubeVirt, is now available in preview. The controller polls the CircleCI API for pending and running tasks and adjusts a VirtualMachinePool replica count to match demand — giving teams elastic, on-demand self-hosted runner capacity inside their own Kubernetes clusters.

Runner Provisioner, a new Kubernetes controller that automatically scales CircleCI runner VMs using KubeVirt, is now available in preview. The controller polls the CircleCI API for pending and running tasks and adjusts a VirtualMachinePool replica count to match demand — giving teams elastic, on-demand self-hosted runner capacity inside their own Kubernetes clusters.

Preview version 0.1.0 includes:

• A Helm chart for installation into any Kubernetes cluster with KubeVirt v1.8+
• Automatic scaling of runner VMs based on real-time CircleCI task demand
• Support for CircleCI Cloud and Server v4+
• Setup guidance for GKE, AKS, and EKS, including nested-virtualization and tainted-node-pool configurations
• Externally managed secrets via provisioner.existingSecret (e.g., Vault, Sealed Secrets)
• Customizable VirtualMachineInstanceSpec per resource class

Configuration schema and APIs may change before GA.

Read the docs →

Gen2 Remote Docker now supports pinning to specific Docker versions. Use the docker28 or docker29 aliases to lock your jobs to a specific version, rather than relying on the floating default (currently Docker 28) or edge (currently Docker 29) aliases.

Gen2 Remote Docker now supports pinning to specific Docker versions. Use the docker28 or docker29 aliases to lock your jobs to a specific version, rather than relying on the floating default (currently Docker 28) or edge (currently Docker 29) aliases.

resource_class: medium.gen2
 steps:
 - setup_remote_docker:
 version: docker28

The Remote Docker default tag is currently Docker 28, while edge is Docker 29.

IMPORTANT: This changelog has been superseded. This breaking change has been consolidated with two others into a single entry, and the date is now July 17, 2026. Please refer to the updated changelog for up-to-date details. The information below is retained for reference only.

IMPORTANT: This changelog has been superseded. This breaking change has been consolidated with two others into a single entry, and the date is now July 17, 2026. Please refer to the updated changelog for up-to-date details. The information below is retained for reference only.

On June 26, 2026, CircleCI is updating the regex engine used to evaluate when: matches: pattern: conditions in pipeline configs. This change improves the security and reliability of config compilation.

After this date, the following regex features will no longer be supported in pattern: fields and configs using them will fail to compile:

• Negative lookaheads
• Negative lookbehinds
• Possessive quantifiers
• Backreferences

Please refer to our Discuss post for full details with regex examples and fixes.

IMPORTANT: This changelog has been superseded. This breaking change has been consolidated with two others into a single entry, and the date is now July 17, 2026. Please refer to the updated changelog for up-to-date details. The information below is retained for reference only.

IMPORTANT: This changelog has been superseded. This breaking change has been consolidated with two others into a single entry, and the date is now July 17, 2026. Please refer to the updated changelog for up-to-date details. The information below is retained for reference only.

CircleCI will end support for configuration version: 2.0 on June 27, 2026. After this date, all pipelines must use version: 2.1.

CircleCI has supported two config versions for several years: v2 (legacy) and v2.1 (current). Version 2.1 introduced orbs, pipeline parameters, reusable commands, reusable executors, and a well-defined schema with strict validation. As we build next-generation config tooling, we are consolidating onto v2.1 as the single supported configuration format.

For a step-by-step migration guide and common issues, see the detailed guide on CircleCI Discuss.

An updated edge image is now available for the Android machine executor, with refreshed toolchains (Gradle 9.5.1, Docker 29.4.2, Node.js 24 LTS, Python 3.14, OpenJDK 21.0.10) and an updated Android SDK (platform-tools 37.0.0, Emulator 36.5.11). Dated tag: android:2026.05.1. Full release notes are available here.

Updated edge images are now available for Windows Server 2022 and Windows Server 2025, including CUDA variants. CUDA images have been refreshed with NVIDIA driver 596.49 (CUDA 13.2). Dated tags: windows-server-2022-gui:2026.05.1, windows-server-2022-nvidia-medium:2026.05.1, windows-server-2025-gui:2026.05.1, windows-server-2025-nvidia-medium:2026.05.1. Full release notes are available here.

Updates

• Refreshed GovCloud AMIs to use the latest base images for improved security and stability. These AMIs address the Copy Fail Vulnerability.

CVE Fixes

• CVE-2026-33814 in golang.org/x/net was addressed in distributor, output services.
• CVE-2026-39882 in OpenTelemetry OTLP HTTP exporters was addressed in docker-provisioner service.
• May 2026 CVEs in nginx unprivileged container were addressed by updating the default nginx image to 1.30.1.

Configuration Changes

• Added new Helm value for configuring builds-service JVM heap size. Operators can now tune memory allocation for the builds-service to match their infrastructure requirements.

NOTE: This is the last patch for server 4.8 as it has now reached end of life. Please upgrade to a supported version.

NOTE: This is the last patch for server 4.8 as it has now reached end of life. Please upgrade to a supported version.

Updates

• Fixed nginx ACM configuration to restrict SSL ports to 80 and 443, matching actual Service ports. This prevents AWS Load Balancer Controller reconciliation failures that could occur when invalid ports were specified.
• Refreshed AMIs for server 4.8 with Q2 2026 security updates and improvements for both standard AWS and GovCloud regions as well as GCP. These AMIs address the Copy Fail Vulnerability.
• Released an updated startup script in our server-terraform to address the Copy Fail Vulnerability. Please reference the corresponded 4.8.11 release in the server-terraform repository.
• Updated contexts-service security context user configuration to improve service security posture.
• Fixed various pathing issues in component templates which blocked customers from being able to set the replica number for some of our services.

CVE Fixes

• CVE-2026-39882 in OpenTelemetry OTLP HTTP exporter was addressed in docker-provisioner service.
• CVE-2026-39883 in OpenTelemetry SDK was addressed in execution-gateway, machine-provisioner, distributor services.
• CVE-2026-33186 in gRPC was addressed in public-api-service, policy-service, permissions-service, oidc-service, ciam-gateway services.
• CVE-2026-34986 in go-jose was addressed in public-api-service, oidc-service, ciam-gateway, output services.
• CVE-2026-33816 in pgx was addressed in oidc-tasks-service, policy-service, permissions-service, machine-provisioner, distributor services.
• CVE-2025-13465 in lodash was addressed in web-ui-consolidated service.
• CVE-2026-33870 in Netty was addressed in domain-service, contexts-service services.
• CVE-2026-33871 in Netty was addressed in domain-service, contexts-service services.
• CVE-2026-33814 in golang.org/x/net was addressed in step, execution-gateway services.
• Updated default nginx unprivileged image tag to 1.30.1 to address the following CVEs: CVE-2026-40460, CVE-2026-40701, CVE-2026-42926, CVE-2026-42934, CVE-2026-42945, CVE-2026-42946
• Updated RabbitMQ to fix known CVEs in the message broker component. This addresses security vulnerabilities in the messaging infrastructure.

Container Runner:

Container Runner:

• Fixed an issue where the logging collector exited with a non-zero status on clean shutdown, causing successful jobs to be reported as failed.
• Task pods are now labeled when unsafe retries are enabled.
• Tasks are now only unclaimed after cleanup completes successfully, preventing rescheduling onto an unprepared environment.
• Resource class definitions can now be hot-reloaded from the task pod ConfigMap without requiring a container agent restart.

Machine Runner:

• Fixed an issue where a relative working_directory in config resolved from the task agent’s directory instead of the runner’s, causing steps to run in the wrong location.

The Xcode 26.5 image is now available to be used in CircleCI pipelines.

The full manifest of installed software can be found here.

The updated Linux machine images are now available under the current tag for Ubuntu 22.04, 24.04, and 26.04. CUDA images have also been promoted to default. Full release notes are available here.

To reduce load on Maven Central and help avoid rate limit errors when pulling dependencies, CircleCI has introduced a registry cache and proxy. You can opt in to this by running the following command in your job before any dependency installation steps:

To reduce load on Maven Central and help avoid rate limit errors when pulling dependencies, CircleCI has introduced a registry cache and proxy. You can opt in to this by running the following command in your job before any dependency installation steps:

circleci experiment registry config --maven

This writes a Maven settings file to ~/.m2/settings.xml that mirrors Maven Central through the CircleCI proxy. It also exports CIRCLECI_MAVEN_REGISTRY_ENDPOINT and CIRCLECI_REGISTRY_TOKEN to $BASH_ENV for use in subsequent steps.

Additional flags are available:

• --gradle configures Gradle to use the proxy
• --lein configures Leiningen to use the proxy
• --all configures all three (Maven, Gradle, and Leiningen)
• --env exports registry credentials as environment variables only, without writing config files

This is an experimental command and the interface may change. We plan to add support for additional package registries and to make this configuration automatic in future updates.

What happened: Customers running jobs that pulled dependencies from Maven Central experienced elevated HTTP 429 (rate limit) errors due to newly enforced rate limits from Sonatype/Maven Central.

What happened: Customers running jobs that pulled dependencies from Maven Central experienced elevated HTTP 429 (rate limit) errors due to newly enforced rate limits from Sonatype/Maven Central.

What we did: We worked with Sonatype to allowlist CircleCI’s dedicated IP ranges. Customers using our IP Ranges feature should no longer see Maven Central rate limits affecting their jobs. We are continuing work to fully address the issue for all customers.

What you should do: If your jobs failed during this window, you can safely rerun them. No configuration changes are required at this time.

What’s happening Maven Central has begun enforcing new rate limits on requests. Customer jobs that download dependencies from Maven Central are receiving HTTP 429 responses as a result. Additional background is available in Sonatype’s FAQ on 429 errors.

What’s happening Maven Central has begun enforcing new rate limits on requests. Customer jobs that download dependencies from Maven Central are receiving HTTP 429 responses as a result. Additional background is available in Sonatype’s FAQ on 429 errors.

What’s impacted Customers running jobs that pull dependencies from Maven Central.

What can you expect Affected jobs will see 429 responses when downloading dependencies from Maven Central. Thank you for your patience while our engineers investigate options to mitigate or reduce these issues. Discuss post to stay up to date on progress.

Before Upgrading

See the CircleCI server 4.10 release notes and upgrade guide for this release.

Before Upgrading

See the CircleCI server 4.10 release notes and upgrade guide for this release.

NOTE: Vault is being deprecated and will no longer be supported in server 5.0. Refer to our script for steps to migrate to Tink.

What’s New in Release 4.10.0

Updates

• Upgraded Nomad server to version 1.11.3, incorporating security fixes and performance improvements for job scheduling.
• Upgraded Nomad Autoscaler to 0.4.9, providing improved scaling control and reliability for VM auto-scaling.
• Increased Nomad server liveness probe tolerances to prevent unnecessary restarts during high-load periods while maintaining cluster health.
• Added automated liveness checks to GCP and AWS Nomad client machines that detect server IP changes and trigger automatic reconnection, eliminating silent job failures when the server is replaced.
• Migrated audit log functionality from a legacy service to the notifications service, streamlining maintenance and enabling S3 bucket export for audit logs.
• Updated machine image AMIs for AWS, GCP, and GovCloud regions to include latest security patches and system updates.
• Removed app. subdomain requirement for Circle Server UI access, simplifying deployment topology.
• Enabled gRPC client-side load balancing via headless Services. All internal gRPC paths now use Kubernetes Headless Service instead of ClusterIP, enabling proper client-side load balancing across replicas. This reduces hotspotting on large Server clusters.

New Features

• Added support for configurable SSH key algorithms (RSA, ECDSA, Ed25519) for deploy keys using the SSH_KEY_ALGORITHM environment variable, enabling FIPS 140-compliant environments and GovCloud deployments.
• It is now possible to delete Self-Hosted Runners resource classes directly in the Web UI, in the Runners inventory page. Customers can still do the same using CircleCI CLI.
• Added configuration options to customize CPU and memory resource requests and limits for internalized Nomad servers using nomad.server.resources.requests.cpu, nomad.server.resources.requests.memory, nomad.server.resources.limits.cpu, and nomad.server.resources.limits.memory values.
• Added Ubuntu 26.04 (ubuntu-2604) machine image support to EC2 image lists.
• RabbitMQ memory requests and limits are now exposed and configurable via your helm values.yaml.

Bug Fixes

• Fixed serial group deadlock when jobs have Unauthorized status by treating unauthorized as a terminal state for unlock job dependencies.
• Before, when users enabled the organization wide “Block all new work from starting for this organization” setting, it was still possible to bypass that when disabling the block at the project level using the “Block all new work from starting for this project” setting. This is now fixed and the organization level setting will not be bypassed anymore.
• Fixed runner resource class creation via the UI which was previously failing due to backend validation errors.
• Fixed NGINX AWS Certificate Manager configuration to ensure Load Balancer Controller ports match Service ports, resolving reconciliation failures.
• Fixed ‘project not found’ errors in workflow rerun handler to return proper NOT_FOUND status instead of UNKNOWN for deleted projects.
• Fixed job page UI jitter and step disclosure collapse during background updates, improving user experience when viewing running jobs.

CVE Fixes

• CVE-2026-39882 in OpenTelemetry OTLP HTTP exporter was addressed in build-agent service.
• CVE-2026-34986 in go-jose library was addressed in oidc-tasks-service, public-api-service services.
• CVE-2026-33816 in pgx PostgreSQL driver was addressed in oidc-tasks-service, machine-provisioner, distributor, contexts-service services.
• CVE-2026-33814 in golang.org/x/net library was addressed in execution-gateway, docker-provisioner, output, distributor services.
• CVE-2026-45022 in go-git library was addressed in build-agent service.
• CVE-2026-45109 in Next.js was addressed in web-ui-server-admin service.

Configuration Changes

• MongoDB 7.0 is the default database image shipped with CircleCI Server 4.10.0 and above. MongoDB 4.4 has reached end of life and is no longer receiving security patches or updates from MongoDB, Inc. Customers must upgrade to MongoDB 7.0 before upgrading to server 4.10. Please use our mongo 7 upgrade script to upgrade the mongoDB in your CircleCI Server instance to 7.0.
• Implemented hard limit of 100 retries per workflow to prevent abuse. This limit is automatically enforced and cannot be configured.
• The trigger_parameters field in the pipeline values has been deprecated in favour of pipeline VCS fields. Customers should upgrade their integrations to use the new VCS field structure for pipeline triggers.
• Migrated to OpenTelemetry collector; removed Telegraf collector. Updated related configuration and deployment templates.

New Components

• notifications

Deprecated Components

• audit-log-service

Updates

• Increased default RabbitMQ memory allocation to improve messaging reliability and prevent out-of-memory failures.
• Updated Nomad server to version 1.11.3 for performance and stability improvements.
• Enabled gRPC client-side load balancing.
• Switched gRPC client paths to use headless Services.
• Updated AWS AMIs with the latest security patches and updates.

Bug Fixes

• Fixed presigned URL expiry issue in test results index to prevent premature link expiration when downloading previous test results.
• Fixed nginx AWS ACM configuration.
• Fixed soft-fail policy violation banners not displaying in Server UI by adding policy decision enrichment to pipeline handlers.
• Fixed OIDC token minting panic.
• Fixed Nomad client startup script failures.
• Fixed a bug which made the admin-setting page inaccessible.

CVE Fixes

• CVE-2026-24051 in OpenTelemetry SDK was addressed.
• CVE-2026-1229 in Cloudflare CIRCL library was addressed.
• CVE-2025-64702 in quic-go library was addressed.
• CVE-2025-47911 in golang.org/x/net was addressed.
• CVE-2026-33186 in gRPC library was addressed
• CVE-2026-39882 in OpenTelemetry OTLP HTTP exporter was addressed.
• CVE-2026-39883 in OpenTelemetry SDK was addressed.
• CVE-2026-27141 in golang.org/x/net was addressed.
• CVE-2026-34986 in go-jose library was addressed.
• CVE-2025-67721 in aircompressor library was addressed.

Configuration Changes

• Added NOMAD_RPC_MAX_CONNS_PER_CLIENT configuration option to Helm values to control Nomad RPC connection limits and fix client rejection errors under load.
• Exposed Nomad server CPU and memory resource limits and requests in Helm values for better resource control.

Component Updates

• api-gateway
• api-service
• approval-job-provider-migrator
• audit-log-service
• authentication-svc
• authentication-svc-migrator
• branch-service
• branch-service-migrator
• builds-service
• builds-service-migrator
• ciam
• ciam-gateway
• circle-www-api
• contexts-service
• contexts-service-migrator
• cron-service
• cron-service-migrator
• distributor
• distributor-migrator
• docker-provisioner
• domain-service
• domain-service-migrator
• execution-gateway
• insights-service
• insights-service-migrator
• lock-job-provider
• machine-provisioner
• machine-provisioner-migrator
• no-op-job-provider
• oidc-service
• oidc-tasks-service
• oidc-tasks-service-migrator
• orb-service
• orb-service-analytics-migrator
• orb-service-migrator
• output
• permissions-service
• permissions-service-migrator
• picard
• policy-service
• public-api-service
• runner-admin
• runner-admin-migrator
• server-postgres
• server-rabbitmq
• server-redis
• step
• web-ui
• web-ui-server-admin
• webhook-service
• webhook-service-migrator
• workflows-conductor
• workflows-conductor-migrator

Known Issues

• The Ubuntu images provided by CircleCI in AWS GovCloud have not been updated.
• The Ubuntu images provided by CircleCI in GCP have not been updated.

Previously, getting CircleCI notifications into Slack meant configuring the Slack orb yourself — wiring up tokens, managing secrets, and maintaining that setup per project. It worked, but it was a lot of ceremony for something that should just be a setting.

Previously, getting CircleCI notifications into Slack meant configuring the Slack orb yourself — wiring up tokens, managing secrets, and maintaining that setup per project. It worked, but it was a lot of ceremony for something that should just be a setting.

Now, there’s a native Slack integration built directly into CircleCI.

What’s new: Install the CircleCI Slack app once at the org level, then connect individual projects to the Slack channels of your choice. Workflow notifications — including failures, errors, and unauthorized runs on your default branch — start flowing automatically.

Why it matters: No config changes. No orb version pinning. No secrets to rotate. Just connect and go.

How it works: Go to Org Settings > Slack Integration to install the app, then configure per-project notifications from Project Settings > Slack Notifications.

Read the docs · Share feedback

Updated edge images are now available for Ubuntu 22.04 and 24.04, and Ubuntu 26.04 LTS (Resolute) is now available as a machine image for the first time. CUDA images have also been refreshed, with CUDA 13 now offering versions 13.0, 13.1, and 13.2. Dated tags: ubuntu-2204:2026.05.1, ubuntu-2404:2026.05.1, ubuntu-2604:2026.05.1. Full release notes are available here.

Inconclusive Deployments: Better Visibility and Control These improvements apply to projects using the CircleCI release agent. When a progressive delivery analysis run returns an inconclusive result, your deployment no longer silently stalls. We’ve shipped a set of improvements that give you clearer status, timely notifications, and automatic resolution.

Inconclusive Deployments: Better Visibility and Control These improvements apply to projects using the CircleCI release agent. When a progressive delivery analysis run returns an inconclusive result, your deployment no longer silently stalls. We’ve shipped a set of improvements that give you clearer status, timely notifications, and automatic resolution.

What’s new:

• Inconclusive status in the UI — the Releases page now displays a dedicated Inconclusive badge with clear guidance to promote or cancel, instead of an ambiguous unknown state
• Email and Slack notifications — when a release becomes inconclusive, the person who triggered it is notified with a reason and direct action links to promote or cancel
• Auto-cancel after timeout — releases stuck in Inconclusive are automatically canceled after a configurable timeout, so stalled releases don’t accumulate
• Configurable timeout in org settings — set a custom inconclusive release timeout per org under Settings > Releases
• Email CTAs with deep links — “Promote All” and “Cancel Release” buttons in notification emails now link directly to the action on the release detail page

Personal API Tokens (PATs) on CircleCI now require an expiration date. All newly created tokens must have an expiry set, with a maximum validity of 1 year.

Personal API Tokens (PATs) on CircleCI now require an expiration date. All newly created tokens must have an expiry set, with a maximum validity of 1 year.

When creating a new Personal API Token you will be required to set an expiration date. This only applies to new tokens; existing Personal API Tokens created before today are not affected and will continue to work as before.

Long-lived tokens that never expire are a security risk. Requiring an expiration date limits the damage if a token is ever compromised and encourages regular credential rotation as a security best practice.

When creating new tokens going forward, you’ll need to specify an expiration date (max 1 year). We recommend reviewing your existing tokens and planning to rotate them with expiry dates set as part of your regular security practices.

The Xcode 26.5 RC 1 image is now available to be used in CircleCI pipelines.

The full manifest of installed software can be found here.

When a serial group is in use, it can be difficult to figure out which job is currently holding it — especially if that job is stuck or buried across many pipelines. Now, from any queued serial group job, you can see exactly which job holds the serial group and navigate directly to it. This makes it easy to spot stuck jobs that are preventing your serial group from progressing, and release it if needed.

When a serial group is in use, it can be difficult to figure out which job is currently holding it — especially if that job is stuck or buried across many pipelines. Now, from any queued serial group job, you can see exactly which job holds the serial group and navigate directly to it. This makes it easy to spot stuck jobs that are preventing your serial group from progressing, and release it if needed.

This feature is available in the new Pipelines view (beta). Select any queued serial group job, then select “View job” to jump straight to the job holding the serial group.

See our documentation for details.

Gen2 x86 Docker resource classes are now generally available on CircleCI. Based on realistic workload benchmarking, we found gen2 to be 1.4x faster than gen1 equivalents.

Gen2 x86 Docker resource classes are now generally available on CircleCI. Based on realistic workload benchmarking, we found gen2 to be 1.4x faster than gen1 equivalents.

Gen2 x86 Docker resource classes are available for users on paid plans in the following configurations:

Not supported:

• Free plans - gen2 Docker resource classes require a paid plan
• Arm-based Docker jobs
• Remote Docker with small.gen2 - the smallest available size for remote Docker is medium.gen2
• IP Ranges
• CircleCI Server

See the x86 (gen2) Docker documentation and CircleCI price list for details.

Following our Xcode image retention policy we will be deprecating both Xcode 16.3 and Xcode 26.0.1 on June 2nd, 2026.

Following our Xcode image retention policy we will be deprecating both Xcode 16.3 and Xcode 26.0.1 on June 2nd, 2026.

We will be performing 24 hour brownouts from 00:00:01 to 23:59:59 UTC during which these images will be unavailable. The brownout and deprecation schedule can be found below.

We’re making Chunk sidecars and Chunk microbuilds available as a Preview for Performance and Scale customers.

We’re making Chunk sidecars and Chunk microbuilds available as a Preview for Performance and Scale customers.

Chunk sidecars are fast reproducible cloud based environments for coding agents to validate changes. Chunk sidecars can be customized for your repository and turned into reusable snapshots with all dependencies pre-installed and cached. Just install the skill and ask your agent to create a Chunk sidecar.

With a Chunk sidecar your coding agents can run microbuilds - consistent pre-configured validation checks without having to push code and monitor CI pipelines. Feedback from a microbuild is sent directly into the context window, where the agent can iterate until the validation checks passes. Agent hooks allow you to continuously prompt your agent to keep working until the build passes.

Install the chunk-cli to get started.

You can now sync your CircleCI deployments to Linear Releases by adding a single step to any deploy job. Now, you can:

You can now sync your CircleCI deployments to Linear Releases by adding a single step to any deploy job. Now, you can:

1. Add the circleci/linear-release orb to your pipeline
2. Have every deployment automatically create a release in Linear with the issues that shipped
3. See exactly which Linear issues went out with each deploy, directly in Linear

What’s new:

• New circleci/linear-release orb available in the CircleCI Orb Registry
• Add linear-release/sync as a step in any deploy job — no shell scripting required
• Works with continuous and scheduled Linear release pipelines
• Compatible with all CircleCI executors

Get started

The Xcode 26.5 beta 5 image is now available to be used in CircleCI pipelines.

The full manifest of installed software can be found here.

We’re excited to announce that Smarter Testing is now available in beta for all Cloud customers. This includes test impact analysis, dynamic test splitting, and automatic rerun of failed tests — all designed to help you run fewer tests, run them faster, and get signal sooner, while maintaining full confidence.

We’re excited to announce that Smarter Testing is now available in beta for all Cloud customers. This includes test impact analysis, dynamic test splitting, and automatic rerun of failed tests — all designed to help you run fewer tests, run them faster, and get signal sooner, while maintaining full confidence.

What beta means

Beta means the product is in early stages and you may encounter bugs, unexpected behaviour, or incomplete features. When the feature is made generally available, there will be a cost associated with access and usage.

To learn more or share your feedback, please refer to our Discuss post.

Until now, serial groups could only serialize one job at a time — there was no built-in way to keep other pipelines from slipping in between a set of jobs that needed to run together. Many teams worked around this using the Queue Orb, which repeatedly polls the CircleCI API and burns credits while waiting.

Until now, serial groups could only serialize one job at a time — there was no built-in way to keep other pipelines from slipping in between a set of jobs that needed to run together. Many teams worked around this using the Queue Orb, which repeatedly polls the CircleCI API and burns credits while waiting.

Now you can define job groups — a named set of jobs that run as one unit. When serialized with serial-group, no other pipeline can start the same serial group until all jobs in it finish.

Job groups are defined under a new top-level job-groups key. You can use them with or without serial-group — without it, they’re just a way to organize and reuse a set of jobs.

Note: Rerunning any job in a serial group reruns the entire group — including “Rerun job with SSH,” which will enable SSH for all jobs in the group, not just the one you selected.

See our documentation for details.