SECURITY Signal 51
Woodpecker CI 3.18 adds log download endpoint and tightens plugin env var handling
↗
Administrators can now download pipeline logs via a dedicated endpoint and benefit from stricter plugin environment variable handling that reduces exposure of sensitive data.
The log download endpoint simplifies troubleshooting and auditability for CI runs. Tighter plugin env var handling limits accidental leakage of secrets, improving security posture. Together these changes reduce operational overhead and risk for teams self-hosting Woodpecker.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
Woodpecker CI 3.18 introduces a dedicated endpoint for downloading pipeline logs, returning step logs in correct line order.
Plugin environment variable handling is tightened: additional and matrix variables are no longer automatically injected, reducing information exposed to plugins.
The release adds a Kubernetes option to disable runtime class name setting and allows separate organization configuration per forge for multi-forge installations.
THE CLUSTER