Release 18.4.1 (#61621)

* Release 18.4.1

* Adding goaway to cspell to fix lint issues

Author: doggydogworld

CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 18.4.1 (11/20/25)
+
+* Fixed a bug that prevented searching audit log events in the web UI when using Athena audit storage. [#61603](https://github.com/gravitational/teleport/pull/61603)
+* Prevented Trivy from reporting false positives when scanning the Teleport binaries. [#61539](https://github.com/gravitational/teleport/pull/61539)
+* Added support for `tsh logout --proxy` (or `TELEPORT_PROXY` set) to work without `--user` flag when one identity exists. [#61404](https://github.com/gravitational/teleport/pull/61404)
+* Fixed web upload/download failure behind load balancers when web listen address is unspecified. [#61393](https://github.com/gravitational/teleport/pull/61393)
+* Fixed corrupted private keys breaking tsh. [#61388](https://github.com/gravitational/teleport/pull/61388)
+* Resource names are now properly validated for AWS Roles Anywhere integration `Generate Command`. [#61385](https://github.com/gravitational/teleport/pull/61385)
+* Added caches to reduce Active Directory user SID lookups and TLS certificate requests. [#61317](https://github.com/gravitational/teleport/pull/61317)
+* GOAWAY errors received from Kubernetes API Servers configured with a non-zero --goaway-chance are now forward to clients to be retried. [#61256](https://github.com/gravitational/teleport/pull/61256)
+* Added support for creating and managing scoped tokens using `tctl scoped tokens add/ls/rm`. SSH nodes can now join a cluster within a particular scope by joining with a scoped token. [#60758](https://github.com/gravitational/teleport/pull/60758)
+
+Enterprise:
+* Removed sync of the model identifier from Intune to avoid mismatches between the identifier reported by Intune vs Teleport clients.
+* Added support for Jamf's /v2/computers-inventory API (addresses Jamf's deprecation of /v1/computers-inventory).
+* Updated the AWS Identity Center resource synchronizer to handle AWS Account name changes more gracefully.
+* Added audit events in response to SCIM provisioning requests.
+
 ## 18.4.0 (11/13/25)
 
 ### Streamable-HTTP and SSE support for MCP Zero-Trust Access

Makefile

@@ -13,7 +13,7 @@
 #   Stable releases:   "1.0.0"
 #   Pre-releases:      "1.0.0-alpha.1", "1.0.0-beta.2", "1.0.0-rc.3"
 #   Master/dev branch: "1.0.0-dev"
-VERSION=18.4.0
+VERSION=18.4.1
 
 DOCKER_IMAGE ?= teleport
 

api/version.go

@@ -19,13 +19,13 @@
 		<key>CFBundlePackageType</key>
 		<string>APPL</string>
 		<key>CFBundleShortVersionString</key>
-		<string>18.4.0</string>
+		<string>18.4.1</string>
 		<key>CFBundleSupportedPlatforms</key>
 		<array>
 			<string>MacOSX</string>
 		</array>
 		<key>CFBundleVersion</key>
-		<string>18.4.0</string>
+		<string>18.4.1</string>
 		<key>DTCompiler</key>
 		<string>com.apple.compilers.llvm.clang.1_0</string>
 		<key>DTPlatformBuild</key>

build.assets/macos/tsh/tsh.app/Contents/Info.plist

@@ -17,13 +17,13 @@
 		<key>CFBundlePackageType</key>
 		<string>APPL</string>
 		<key>CFBundleShortVersionString</key>
-		<string>18.4.0</string>
+		<string>18.4.1</string>
 		<key>CFBundleSupportedPlatforms</key>
 		<array>
 			<string>MacOSX</string>
 		</array>
 		<key>CFBundleVersion</key>
-		<string>18.4.0</string>
+		<string>18.4.1</string>
 		<key>DTCompiler</key>
 		<string>com.apple.compilers.llvm.clang.1_0</string>
 		<key>DTPlatformBuild</key>

build.assets/macos/tshdev/tsh.app/Contents/Info.plist

@@ -89,6 +89,7 @@
     "GCP's",
     "GENPASS",
     "GHES",
+    "GOAWAY",
     "GODEBUG",
     "GOMAXPROCS",
     "GSLB",
@@ -564,6 +565,7 @@
     "gitref",
     "glmhf",
     "gncm",
+    "goaway",
     "googleoidc",
     "googleusercontent",
     "goroutines",

docs/cspell.json

@@ -1,4 +1,4 @@
-.version: &version "18.4.0"
+.version: &version "18.4.1"
 
 apiVersion: v2
 name: teleport-plugin-datadog

e

@@ -26,6 +26,6 @@ should match the snapshot:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-datadog
-        app.kubernetes.io/version: 18.4.0
-        helm.sh/chart: teleport-plugin-datadog-18.4.0
+        app.kubernetes.io/version: 18.4.1
+        helm.sh/chart: teleport-plugin-datadog-18.4.1
       name: RELEASE-NAME-teleport-plugin-datadog

examples/chart/access/datadog/Chart.yaml

@@ -7,8 +7,8 @@ should match the snapshot:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-datadog
-        app.kubernetes.io/version: 18.4.0
-        helm.sh/chart: teleport-plugin-datadog-18.4.0
+        app.kubernetes.io/version: 18.4.1
+        helm.sh/chart: teleport-plugin-datadog-18.4.1
       name: RELEASE-NAME-teleport-plugin-datadog
     spec:
       replicas: 1
@@ -22,8 +22,8 @@ should match the snapshot:
             app.kubernetes.io/instance: RELEASE-NAME
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: teleport-plugin-datadog
-            app.kubernetes.io/version: 18.4.0
-            helm.sh/chart: teleport-plugin-datadog-18.4.0
+            app.kubernetes.io/version: 18.4.1
+            helm.sh/chart: teleport-plugin-datadog-18.4.1
         spec:
           containers:
           - command: