v5.57.0

v5.57.0 - 2026-06-25

Changed

• Harden the production container images. Closes #13477. Changes made:
  • Run all containers in both the Docker-composition and the Helm chart with a read-only root filesystem (except the development-only LDAP and Mongo Express containers in the Docker-composition), with mounts for the locations the components write to, such as /tmp.
  • Collector and notifier now write the health check file to /tmp. The HEALTH_CHECK_FILE environment variable can still be used to configure a different location if needed.
  • Add liveness probes (all components) and readiness probes (all components that serve traffic) to the Helm chart, mirroring the Docker health checks.
  • Remove the shell, package manager, and Python installer and developer tools from the production Python container images to reduce their attack surface. As a result, the running container no longer has a shell, so opening a shell in it (for example with docker exec or kubectl exec) is no longer possible.
  • Remove the package manager from the frontend and proxy container images to reduce their attack surface.
  • Remove npm and the package manager from the renderer container image to reduce its attack surface.
  • Run the renderer container as a non-login system user, consistent with the other components.
  • Remove the unused MongoDB database tools (mongodump, mongorestore, mongoexport, mongostat, and so on) from the database container image to reduce its attack surface. Backups continue to work as documented, using a separate Mongo container.
  • Use the default non-root mongodb user (UID 999) so that gosu can be removed from the database container image to reduce its attack surface. The database image also supports running as a UID >= 1000 or an arbitrary UID (for example on OpenShift); see the "Customizing" section in the Helm chart README.

Fixed

• When using GitLab as source for the 'failed jobs' metric, instead of asking GitLab for only failed jobs, fetch all jobs within the look-back period and then filter them for status so that jobs that first fail and then pass are not reported as failed. Fixes #13478.
• Show the singular version of the metric unit when the measurement value is one. Note: when multiple dates are shown, the plural version of the unit is used regardless of the measurement values. Fixes #13479.
• When using Dependency-Track as source for the 'security warnings' metric, don't fail when a vulnerability has no description or severity. Fixes #13608.
• Truncate long titles on the dashboard cards with an ellipsis. The full title is shown in a tooltip on hover. Fixes #10841.