We’ve resolved two issues that caused Chunk to abandon tasks without producing a fix:

• When a failing job auto-retried before Chunk fetched its step output, Chunk would see no failed steps and stop. Chunk now resolves against the originally-failing step regardless of retries.

• When triggered from a workflow-level failure, Chunk only inspected the directly-linked job and missed failed steps in downstream jobs. Chunk now inspects all failed jobs in the workflow.

We’ve fixed confusing empty states in the Chunk task output view when running a Chunk Task:

• The Logs tab now shows “Chunk is working on your task and will provide execution logs when finished.” instead of “Unable to load logs” while a run is in progress.
• The Diff tab now shows “Chunk is working on your task and will provide diffs when finished.” instead of “Unable to load branch diff” while a run is in progress.

When creating or editing an automated task, you can now add a custom MCP server instruction directly from the task form. MCP servers give Chunk additional context and information to act upon, making automated tasks more powerful and precise.

To create an automated task, navigate to Chunk → Automations (top right corner), then select New automated task.

Chunk now has a dedicated Automations page where you can create, view, and manage your automated tasks in one place. The page includes a task creation form, an automations list, and the ability to edit or force-run automations from a contextual menu.

Use the Automations page to set up recurring tasks like fixing flaky tests on a schedule, keeping dependencies up to date, or running custom prompts against your repositories automatically.

To get started, navigate to Chunk → Automations (top right corner).

The Chunk Tasks view now has two tabs: Tasks and Scheduled Runs so you can easily distinguish manually triggered runs from automated ones.

Chunk now sends a weekly email digest 09:00 UTC every Monday summarizing your team’s activity. Each digest shows completed tasks, PRs opened, and failed tasks at a glance, plus a list of the most recent PRs awaiting your review.

Click Review tasks to jump directly to see Chunk tasks with open PRs To disable the digest, go to User Settings (top right) → Notifications → scroll to Chunk → Digest

Runner Provisioner, a new Kubernetes controller that automatically scales CircleCI runner VMs using KubeVirt, is now available in preview. The controller polls the CircleCI API for pending and running tasks and adjusts a VirtualMachinePool replica count to match demand — giving teams elastic, on-demand self-hosted runner capacity inside their own Kubernetes clusters.

Preview version 0.1.0 includes:

• A Helm chart for installation into any Kubernetes cluster with KubeVirt v1.8+
• Automatic scaling of runner VMs based on real-time CircleCI task demand
• Support for CircleCI Cloud and Server v4+
• Setup guidance for GKE, AKS, and EKS, including nested-virtualization and tainted-node-pool configurations
• Externally managed secrets via provisioner.existingSecret (e.g., Vault, Sealed Secrets)
• Customizable VirtualMachineInstanceSpec per resource class

Configuration schema and APIs may change before GA.

Read the docs →

Gen2 Remote Docker now supports pinning to specific Docker versions. Use the docker28 or docker29 aliases to lock your jobs to a specific version, rather than relying on the floating default (currently Docker 28) or edge (currently Docker 29) aliases.

resource_class: medium.gen2
    steps:
      - setup_remote_docker:
          version: docker28

The Remote Docker default tag is currently Docker 28, while edge is Docker 29.

On June 26, 2026, CircleCI is updating the regex engine used to evaluate when: matches: pattern: conditions in pipeline configs. This change improves the security and reliability of config compilation.

After this date, the following regex features will no longer be supported in pattern: fields and configs using them will fail to compile:

• Negative lookaheads
• Negative lookbehinds
• Possessive quantifiers
• Backreferences

Please refer to our Discuss post for full details with regex examples and fixes.

CircleCI will end support for configuration version: 2.0 on June 27, 2026. After this date, all pipelines must use version: 2.1.

CircleCI has supported two config versions for several years: v2 (legacy) and v2.1 (current). Version 2.1 introduced orbs, pipeline parameters, reusable commands, reusable executors, and a well-defined schema with strict validation. As we build next-generation config tooling, we are consolidating onto v2.1 as the single supported configuration format.

For a step-by-step migration guide and common issues, see the detailed guide on CircleCI Discuss.

NOTE: This is the last patch for server 4.8 as it has now reached end of life. Please upgrade to a supported version.

Updates

• Fixed nginx ACM configuration to restrict SSL ports to 80 and 443, matching actual Service ports. This prevents AWS Load Balancer Controller reconciliation failures that could occur when invalid ports were specified.
• Refreshed AMIs for server 4.8 with Q2 2026 security updates and improvements for both standard AWS and GovCloud regions as well as GCP. These AMIs address the Copy Fail Vulnerability.
• Released an updated startup script in our server-terraform to address the Copy Fail Vulnerability. Please reference the corresponded 4.8.11 release in the server-terraform repository.
• Updated contexts-service security context user configuration to improve service security posture.
• Fixed various pathing issues in component templates which blocked customers from being able to set the replica number for some of our services.

CVE Fixes

• CVE-2026-39882 in OpenTelemetry OTLP HTTP exporter was addressed in docker-provisioner service.
• CVE-2026-39883 in OpenTelemetry SDK was addressed in execution-gateway, machine-provisioner, distributor services.
• CVE-2026-33186 in gRPC was addressed in public-api-service, policy-service, permissions-service, oidc-service, ciam-gateway services.
• CVE-2026-34986 in go-jose was addressed in public-api-service, oidc-service, ciam-gateway, output services.
• CVE-2026-33816 in pgx was addressed in oidc-tasks-service, policy-service, permissions-service, machine-provisioner, distributor services.
• CVE-2025-13465 in lodash was addressed in web-ui-consolidated service.
• CVE-2026-33870 in Netty was addressed in domain-service, contexts-service services.
• CVE-2026-33871 in Netty was addressed in domain-service, contexts-service services.
• CVE-2026-33814 in golang.org/x/net was addressed in step, execution-gateway services.
• Updated default nginx unprivileged image tag to 1.30.1 to address the following CVEs: CVE-2026-40460, CVE-2026-40701, CVE-2026-42926, CVE-2026-42934, CVE-2026-42945, CVE-2026-42946
• Updated RabbitMQ to fix known CVEs in the message broker component. This addresses security vulnerabilities in the messaging infrastructure.

Container Runner:

• Fixed an issue where the logging collector exited with a non-zero status on clean shutdown, causing successful jobs to be reported as failed.
• Task pods are now labeled when unsafe retries are enabled.
• Tasks are now only unclaimed after cleanup completes successfully, preventing rescheduling onto an unprepared environment.
• Resource class definitions can now be hot-reloaded from the task pod ConfigMap without requiring a container agent restart.

Machine Runner:

• Fixed an issue where a relative working_directory in config resolved from the task agent’s directory instead of the runner’s, causing steps to run in the wrong location.

To reduce load on Maven Central and help avoid rate limit errors when pulling dependencies, CircleCI has introduced a registry cache and proxy. You can opt in to this by running the following command in your job before any dependency installation steps:

circleci experiment registry config --maven

This writes a Maven settings file to ~/.m2/settings.xml that mirrors Maven Central through the CircleCI proxy. It also exports CIRCLECI_MAVEN_REGISTRY_ENDPOINT and CIRCLECI_REGISTRY_TOKEN to $BASH_ENV for use in subsequent steps.

Additional flags are available:

• --gradle configures Gradle to use the proxy
• --lein configures Leiningen to use the proxy
• --all configures all three (Maven, Gradle, and Leiningen)
• --env exports registry credentials as environment variables only, without writing config files

This is an experimental command and the interface may change. We plan to add support for additional package registries and to make this configuration automatic in future updates.

What happened: Customers running jobs that pulled dependencies from Maven Central experienced elevated HTTP 429 (rate limit) errors due to newly enforced rate limits from Sonatype/Maven Central.

What we did: We worked with Sonatype to allowlist CircleCI’s dedicated IP ranges. Customers using our IP Ranges feature should no longer see Maven Central rate limits affecting their jobs. We are continuing work to fully address the issue for all customers.

What you should do: If your jobs failed during this window, you can safely rerun them. No configuration changes are required at this time.

What’s happening Maven Central has begun enforcing new rate limits on requests. Customer jobs that download dependencies from Maven Central are receiving HTTP 429 responses as a result. Additional background is available in Sonatype’s FAQ on 429 errors.

What’s impacted Customers running jobs that pull dependencies from Maven Central.

What can you expect Affected jobs will see 429 responses when downloading dependencies from Maven Central. Thank you for your patience while our engineers investigate options to mitigate or reduce these issues. Discuss post to stay up to date on progress.

Before Upgrading

See the CircleCI server 4.10 release notes and upgrade guide for this release.

NOTE: Vault is being deprecated and will no longer be supported in server 5.0. Refer to our script for steps to migrate to Tink.

What’s New in Release 4.10.0

Updates

• Upgraded Nomad server to version 1.11.3, incorporating security fixes and performance improvements for job scheduling.
• Upgraded Nomad Autoscaler to 0.4.9, providing improved scaling control and reliability for VM auto-scaling.
• Increased Nomad server liveness probe tolerances to prevent unnecessary restarts during high-load periods while maintaining cluster health.
• Added automated liveness checks to GCP and AWS Nomad client machines that detect server IP changes and trigger automatic reconnection, eliminating silent job failures when the server is replaced.
• Migrated audit log functionality from a legacy service to the notifications service, streamlining maintenance and enabling S3 bucket export for audit logs.
• Updated machine image AMIs for AWS, GCP, and GovCloud regions to include latest security patches and system updates.
• Removed app. subdomain requirement for Circle Server UI access, simplifying deployment topology.
• Enabled gRPC client-side load balancing via headless Services. All internal gRPC paths now use Kubernetes Headless Service instead of ClusterIP, enabling proper client-side load balancing across replicas. This reduces hotspotting on large Server clusters.

New Features

• Added support for configurable SSH key algorithms (RSA, ECDSA, Ed25519) for deploy keys using the SSH_KEY_ALGORITHM environment variable, enabling FIPS 140-compliant environments and GovCloud deployments.
• It is now possible to delete Self-Hosted Runners resource classes directly in the Web UI, in the Runners inventory page. Customers can still do the same using CircleCI CLI.
• Added configuration options to customize CPU and memory resource requests and limits for internalized Nomad servers using nomad.server.resources.requests.cpu, nomad.server.resources.requests.memory, nomad.server.resources.limits.cpu, and nomad.server.resources.limits.memory values.
• Added Ubuntu 26.04 (ubuntu-2604) machine image support to EC2 image lists.
• RabbitMQ memory requests and limits are now exposed and configurable via your helm values.yaml.

Bug Fixes

• Fixed serial group deadlock when jobs have Unauthorized status by treating unauthorized as a terminal state for unlock job dependencies.
• Before, when users enabled the organization wide “Block all new work from starting for this organization” setting, it was still possible to bypass that when disabling the block at the project level using the “Block all new work from starting for this project” setting. This is now fixed and the organization level setting will not be bypassed anymore.
• Fixed runner resource class creation via the UI which was previously failing due to backend validation errors.
• Fixed NGINX AWS Certificate Manager configuration to ensure Load Balancer Controller ports match Service ports, resolving reconciliation failures.
• Fixed ‘project not found’ errors in workflow rerun handler to return proper NOT_FOUND status instead of UNKNOWN for deleted projects.
• Fixed job page UI jitter and step disclosure collapse during background updates, improving user experience when viewing running jobs.

CVE Fixes

• CVE-2026-39882 in OpenTelemetry OTLP HTTP exporter was addressed in build-agent service.
• CVE-2026-34986 in go-jose library was addressed in oidc-tasks-service, public-api-service services.
• CVE-2026-33816 in pgx PostgreSQL driver was addressed in oidc-tasks-service, machine-provisioner, distributor, contexts-service services.
• CVE-2026-33814 in golang.org/x/net library was addressed in execution-gateway, docker-provisioner, output, distributor services.
• CVE-2026-45022 in go-git library was addressed in build-agent service.
• CVE-2026-45109 in Next.js was addressed in web-ui-server-admin service.

Configuration Changes

• MongoDB 7.0 is the default database image shipped with CircleCI Server 4.10.0 and above. MongoDB 4.4 has reached end of life and is no longer receiving security patches or updates from MongoDB, Inc. Customers must upgrade to MongoDB 7.0 before upgrading to server 4.10. Please use our mongo 7 upgrade script to upgrade the mongoDB in your CircleCI Server instance to 7.0.
• Implemented hard limit of 100 retries per workflow to prevent abuse. This limit is automatically enforced and cannot be configured.
• The trigger_parameters field in the pipeline values has been deprecated in favour of pipeline VCS fields. Customers should upgrade their integrations to use the new VCS field structure for pipeline triggers.
• Migrated to OpenTelemetry collector; removed Telegraf collector. Updated related configuration and deployment templates.

New Components

• notifications

Deprecated Components

• audit-log-service

Previously, getting CircleCI notifications into Slack meant configuring the Slack orb yourself — wiring up tokens, managing secrets, and maintaining that setup per project. It worked, but it was a lot of ceremony for something that should just be a setting.

Now, there’s a native Slack integration built directly into CircleCI.

What’s new: Install the CircleCI Slack app once at the org level, then connect individual projects to the Slack channels of your choice. Workflow notifications — including failures, errors, and unauthorized runs on your default branch — start flowing automatically.

Why it matters: No config changes. No orb version pinning. No secrets to rotate. Just connect and go.

How it works: Go to Org Settings > Slack Integration to install the app, then configure per-project notifications from Project Settings > Slack Notifications.

Read the docs · Share feedback

Inconclusive Deployments: Better Visibility and Control These improvements apply to projects using the CircleCI release agent. When a progressive delivery analysis run returns an inconclusive result, your deployment no longer silently stalls. We’ve shipped a set of improvements that give you clearer status, timely notifications, and automatic resolution.

What’s new:

• Inconclusive status in the UI — the Releases page now displays a dedicated Inconclusive badge with clear guidance to promote or cancel, instead of an ambiguous unknown state
• Email and Slack notifications — when a release becomes inconclusive, the person who triggered it is notified with a reason and direct action links to promote or cancel
• Auto-cancel after timeout — releases stuck in Inconclusive are automatically canceled after a configurable timeout, so stalled releases don’t accumulate
• Configurable timeout in org settings — set a custom inconclusive release timeout per org under Settings > Releases
• Email CTAs with deep links — “Promote All” and “Cancel Release” buttons in notification emails now link directly to the action on the release detail page

Personal API Tokens (PATs) on CircleCI now require an expiration date. All newly created tokens must have an expiry set, with a maximum validity of 1 year.

When creating a new Personal API Token you will be required to set an expiration date. This only applies to new tokens; existing Personal API Tokens created before today are not affected and will continue to work as before.

Long-lived tokens that never expire are a security risk. Requiring an expiration date limits the damage if a token is ever compromised and encourages regular credential rotation as a security best practice.

When creating new tokens going forward, you’ll need to specify an expiration date (max 1 year). We recommend reviewing your existing tokens and planning to rotate them with expiry dates set as part of your regular security practices.

When a serial group is in use, it can be difficult to figure out which job is currently holding it — especially if that job is stuck or buried across many pipelines. Now, from any queued serial group job, you can see exactly which job holds the serial group and navigate directly to it. This makes it easy to spot stuck jobs that are preventing your serial group from progressing, and release it if needed.

This feature is available in the new Pipelines view (beta). Select any queued serial group job, then select “View job” to jump straight to the job holding the serial group.

See our documentation for details.

Gen2 x86 Docker resource classes are now generally available on CircleCI. Based on realistic workload benchmarking, we found gen2 to be 1.4x faster than gen1 equivalents.

Gen2 x86 Docker resource classes are available for users on paid plans in the following configurations:

Not supported:

• Free plans - gen2 Docker resource classes require a paid plan
• Arm-based Docker jobs
• Remote Docker with small.gen2 - the smallest available size for remote Docker is medium.gen2
• IP Ranges
• CircleCI Server

See the x86 (gen2) Docker documentation and CircleCI price list for details.

Following our Xcode image retention policy we will be deprecating both Xcode 16.3 and Xcode 26.0.1 on June 2nd, 2026.

We will be performing 24 hour brownouts from 00:00:01 to 23:59:59 UTC during which these images will be unavailable. The brownout and deprecation schedule can be found below.

We’re making Chunk sidecars and Chunk microbuilds available as a Preview for Performance and Scale customers.

Chunk sidecars are fast reproducible cloud based environments for coding agents to validate changes. Chunk sidecars can be customized for your repository and turned into reusable snapshots with all dependencies pre-installed and cached. Just install the skill and ask your agent to create a Chunk sidecar.

With a Chunk sidecar your coding agents can run microbuilds - consistent pre-configured validation checks without having to push code and monitor CI pipelines. Feedback from a microbuild is sent directly into the context window, where the agent can iterate until the validation checks passes. Agent hooks allow you to continuously prompt your agent to keep working until the build passes.

Install the chunk-cli to get started.

You can now sync your CircleCI deployments to Linear Releases by adding a single step to any deploy job. Now, you can:

1. Add the circleci/linear-release orb to your pipeline
2. Have every deployment automatically create a release in Linear with the issues that shipped
3. See exactly which Linear issues went out with each deploy, directly in Linear

What’s new:

• New circleci/linear-release orb available in the CircleCI Orb Registry
• Add linear-release/sync as a step in any deploy job — no shell scripting required
• Works with continuous and scheduled Linear release pipelines
• Compatible with all CircleCI executors

Get started

We’re excited to announce that Smarter Testing is now available in beta for all Cloud customers. This includes test impact analysis, dynamic test splitting, and automatic rerun of failed tests — all designed to help you run fewer tests, run them faster, and get signal sooner, while maintaining full confidence.

What beta means

Beta means the product is in early stages and you may encounter bugs, unexpected behaviour, or incomplete features. When the feature is made generally available, there will be a cost associated with access and usage.

To learn more or share your feedback, please refer to our Discuss post.

Until now, serial groups could only serialize one job at a time — there was no built-in way to keep other pipelines from slipping in between a set of jobs that needed to run together. Many teams worked around this using the Queue Orb, which repeatedly polls the CircleCI API and burns credits while waiting.

Now you can define job groups — a named set of jobs that run as one unit. When serialized with serial-group, no other pipeline can start the same serial group until all jobs in it finish.

Job groups are defined under a new top-level job-groups key. You can use them with or without serial-group — without it, they’re just a way to organize and reuse a set of jobs.

Note: Rerunning any job in a serial group reruns the entire group — including “Rerun job with SSH,” which will enable SSH for all jobs in the group, not just the one you selected.

See our documentation for details.

Previously, when a serial group start job was superseded by a higher-priority run in the same serial group, it was marked as failed — even though there was no issue and no action was needed. This caused the workflow to also show as failed, which could be misleading.

Now, superseded serial group start jobs are marked as not run instead. As a result, the workflow will show as skipped rather than failed, making it clear that the workflow was simply superseded — not broken.

CircleCI’s OpenTelemetry integration now includes resource usage data on task spans, making it easier to understand how your jobs consume compute resources at runtime — not just what was allocated. To surface this data, CircleCI emits a new set of com.circleci.resource.usage.* attributes on task spans for build jobs.

The following attributes are now available when usage data is present:

CPU Usage

Values range from 0.0 to 1.0, representing 100% usage across all cores.

Memory Usage

Values are in bytes.

Network Usage

Only present when the value is greater than zero.

Note: All com.circleci.resource.usage.* attributes are only available on build jobs and only when usage data is collected. They complement the existing com.circleci.resource.cpu and com.circleci.resource.ram allocation attributes, enabling you to compare allocated vs. actual resource consumption directly in your OTel-compatible observability tooling.

Gen2 Remote Docker Resource Classes now have Docker version 26 and 27 available for use.

Users can specify these versions using the docker27 or docker26 aliases.

setup_remote_docker:
  version: docker27

Remote Docker default is currently Docker 28, while edge is Docker 29. Docker 26 will be deprecated when Docker 29 is promoted to default, at which point Docker 28 will be available via alias.

Chunk tasks can now route outbound traffic through CircleCI’s known static IP addresses.

Enable IP Ranges in Chunk Tasks toggle in Organization Settings → Chunk to get started. Available on Performance and Scale plans.

Learn more in the documentation