Upgraded Concourse to 8.1.1

Concourse has been upgraded from 8.0.2 to 8.1.1, new pipeline features, several bug fixes, and security updates.

New features

• Wolfi base image — The concourse/concourse Docker image and all built-in resource-types now use Wolfi as their base image.
• Pipeline identity token — The pipeline identity token can now be used as a native var_source credential manager. See the docs for details.
• S2 compression — New S2 compression option for streaming container volumes, improving performance.
• CONCOURSE_POSTGRES_APPLICATION_NAME — New environment variable to name the PostgreSQL connection on the web node.

UI & security improvements

• Pipeline name now shows a tooltip with the last updated date on hover.
• SameSite attribute added to authentication and CSRF cookies.
• Identifiers in configs can now start with a number.

fly improvements

• fly destroy no longer asks for confirmation if the pipeline does not exist.
• Unknown fields in inline task configs are now validated.
• Improved error handling during fly login via async XHR.

Security fixes (8.1.1)

• Symlink breakout — A BreakoutError is now returned when a symlink points outside the destination directory.
• Static containerd binaries — containerd, runc, and CNI plugin binaries are now statically compiled from Wolfi, eliminating Go-related CVEs. No known CVEs in the Linux tarball at time of release.

Resource-type updates

References

• Release notes v8.1.1
• Release notes v8.1.0