Update docker.io/portainer/portainer-ce Docker tag to v2.44.0
No problems deploying to Proxmox VE K3s Kubernetes cluster via Helm Chart and Flux V2 reconciliation in a GitOps approach with dependency update facilitated by Mend's Renovate Bot.
Also the corresponding agents were automatically rolled out via Watchtower infrastructure on the Docker-only nodes including arm node with dependency update facilitated by Mend's Renovate Bot.
This MR contains the following updates:
| Package | Update | Change |
|---|---|---|
| docker.io/portainer/portainer-ce (source) | minor | 2.43.0 → 2.44.0 |
Release Notes
portainer/portainer (docker.io/portainer/portainer-ce)
v2.44.0: STS
Known issues
- On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot
Known issues with Podman support
- Podman environments aren't supported by auto-onboarding script
- It's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)
- Support for only CentOS 9, Podman 5 rootful
Changes
New and improved features
- Added a basic workflow details screen
- Added GPU visibility in the Environment Details view
- Made the Portainer setup token easier to spot in the installation logs
- Tracked the Source, Workflow, and Artifact status persistently
- Upgraded bbolt to v1.5.0 for performance and robustness improvements
- Moved the build pipeline to BuildKit v0.31.2 (previously v0.27.0); image build provenance attestations moved to the SLSA v1.0 format (previously v0.2) — any tooling that parses attestations needed to be verified against the new format
Security improvements
- Fixed unauthorized access via leftover service accounts
- Fixed path traversal in the swarm compose deployer, where configs/secrets file paths escaped the project root
- CVE remediation:
- Upgraded oras.land/oras-go/v2 to 2.6.1 to remediate CVEs
- Upgraded containerd to 1.7.33 / v2 2.2.5 to remediate CVEs
- Upgraded google.golang.org/grpc to 1.82.1 to remediate GHSA-hrxh-6v49-42gf
- Upgraded axios to 1.18.0 to remediate CVEs
- Upgraded shell-quote to 1.8.4 to remediate CVEs
Bug fixes
- Fixed the "This node is not a swarm manager" error message when running inside a swarm
- Fixed image builds failing to authenticate against private registries in FROM lines by allowing the X-Registry-Config header through the proxy
- Fixed a team with valid access not appearing in Config access control while another team with identical access was visible
- Fixed AD/LDAP settings defects where special characters were stripped, the username format selection was invisible, the root domain was unpopulated, and the delete button was broken
- Fixed an issue where [object Object] appeared as an element name on the Alerting page
- Fixed a problem that caused sources to fail to load
- Brought back shared Git credentials for GitOps Sources
- Fixed an issue where a space-delimited list of scopes wasn't correctly requesting access to resources on the user's behalf, so the Google consent screen didn't show the expected permissions
- Fixed the poll frequency selection dropdown staying on the default value
- Fixed RBAC policy's datatable namespace input
- Fixed the forced polling usage in Git sources
- Fixed Helm chart uninstall showing cosmetic errors only
- Fixed the tooltip rendering for environment variables in Portainer Application Templates
- Fixed the Ingress service port number being displayed as 0 instead of the configured value
- Fixed Kubernetes manifest deployments reporting success but silently failing when "Use namespace from manifest" was disabled
- Fixed an output mismatch in the Kubectl shell between BE and CE
- Fixed an issue where logout caused an infinite page reload
- Fixed a missing source in the list until refresh
- Fixed non-admin redeploy failing when numeric environment variables were quoted in a stack (invalid containerPort)
- Fixed Portainer STS 2.42.0 showing "1 Agent needs upgrading" when none did
- Fixed Docker stack deployments that exceeded the 15-minute timeout remaining stuck in the "Deploying" state and blocking further redeployments
- Fixed RBAC policies not creating RoleBindings for grants with no namespace list (e.g. Operator, Helpdesk)
- Fixed re-assigning an edge group to an edge stack bringing back old state
- Fixed a regression where relative env_file: in Git sub-directory stacks resolved from the project root instead of the compose file's directory
- Removed the hint box from the Applications page
- Fixed Swarm stack and service deployments reporting success despite image pull failures caused by insufficient disk space
- Fixed the issue where a standard user couldn't deploy a Git stack against an admin-created Source
Improved edge tunnel resiliency over high-latency/lossy network links - Fixed Swarm edge stacks with edge configs failing to deploy
- Fixed Swarm image deletion inconsistencies
- Fixed Swarm stack deployments failing to re-pull private Docker Hub images despite valid registry credentials
- Improved the containers list to show only the first three published ports inline, collapsing the rest into a "+N more" badge, so containers with many ports no longer broke the table layout
- Fixed a v2.43.0 migration related to stacks and sources
- Fixed incorrect WebSocket handler error messages
- Fixed dark mode styling issues on the Workflows page
- Fixed the way ListRefs ignored request context, causing "context deadline exceeded" on large repos
- Fixed SSRF protection ignoring Dialer timeouts
Deprecated and removed features
Deprecated features
None.
Removed features
None
