Spitfire 0.37.3 release notes
Released: 2026-10-16
- Security update, recommended for every install. Against a SAML signature verification flaw, the signature library (goxmldsig 1.6.0), Go 1.26.9 and x/net are updated.
- SSO: a sign-in finishes only in the browser that started it (against login CSRF); linking to an existing account by e-mail needs an e-mail the provider verified; matching the CN part of a DN group name is for LDAP only, so SAML setups that send DNs should put the full DN in their group rules. SSO sign-ins in progress during the upgrade must start again.
- SCIM can change only accounts that came through SSO or SCIM, never local password accounts. A password change, reset or deactivation also ends existing access tokens; API tokens are not affected.
- Steps check the address after variables are filled in: browser, HTTP, GraphQL and SSE go only to http/https (file:// is refused). Connections to cloud metadata addresses (169.254.0.0/16 and the like) are blocked; SPITFIRE_ALLOW_LINK_LOCAL=1 lifts it for test steps if needed.
- When a connection's address changes, its stored password or token must be entered again in the same save. Only the install admin can change the endpoint of an AWS connection that uses the machine's own credentials. Very deeply nested k6 scripts are refused with an error instead of crashing the process.
- Runners get their own secret on first connect; their id cannot be taken over without it (older runners work as before). Removing a runner can also revoke its registration key. License dates are judged by the latest time seen, even if the clock is set back.
- X-Content-Type-Options: nosniff on every response, HSTS over HTTPS. With SPITFIRE_TRUST_PRIVATE_NETWORKS=false only loopback and SPITFIRE_TRUSTED_PROXIES set the client address. Turning on two-step verification e-mails the account owner. CLI downloads in the CI docs check SHA-256.
Updating
Your installation tells you about a new release itself: admins see its notes and the update command for that installation at the top of the UI. The command backs up the database first and keeps the settings (Updating). You can also follow new releases with the RSS feed.