Skip to content

Update ghcr.io/actions/actions-runner Docker tag to v2.337.0 - #2963

Merged
claytono merged 2 commits into
mainfrom
renovate/ghcr.io-actions-actions-runner-2.337.0
Sep 9, 2026
Merged

Update ghcr.io/actions/actions-runner Docker tag to v2.337.0#2963
claytono merged 2 commits into
mainfrom
renovate/ghcr.io-actions-actions-runner-2.337.0

Conversation

@renovate

@renovate renovate Bot commented Sep 9, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Update Change
ghcr.io/actions/actions-runner minor 2.336.0 → 2.337.0

Release Notes

actions/runner (ghcr.io/actions/actions-runner)

v2.337.0

Compare Source

What's Changed

Full Changelog: actions/runner@v2.336.0...v2.337.0

Note: Actions Runner follows a progressive release policy, so the latest release might not be available to your enterprise, organization, or repository yet.
To confirm which version of the Actions Runner you should expect, please view the download instructions for your enterprise, organization, or repository.
See https://github.com/proxy/docs.github.com/en/enterprise-cloud@latest/actions/hosting-your-own-runners/adding-self-hosted-runners

Windows x64

We recommend configuring the runner in a root folder of the Windows drive (e.g. "C:\actions-runner"). This will help avoid issues related to service identity folder permissions and long file path restrictions on Windows.

The following snipped needs to be run on powershell:

# Create a folder under the drive root
mkdir \actions-runner ; cd \actions-runner

# Download the latest runner package
Invoke-WebRequest -Uri https://github.com/actions/runner/releases/download/v2.337.0/actions-runner-win-x64-2.337.0.zip -OutFile actions-runner-win-x64-2.337.0.zip

# Extract the installer
Add-Type -AssemblyName System.IO.Compression.FileSystem ;
[System.IO.Compression.ZipFile]::ExtractToDirectory("$PWD\actions-runner-win-x64-2.337.0.zip", "$PWD")

Windows arm64

We recommend configuring the runner in a root folder of the Windows drive (e.g. "C:\actions-runner"). This will help avoid issues related to service identity folder permissions and long file path restrictions on Windows.

The following snipped needs to be run on powershell:

# Create a folder under the drive root
mkdir \actions-runner ; cd \actions-runner

# Download the latest runner package
Invoke-WebRequest -Uri https://github.com/actions/runner/releases/download/v2.337.0/actions-runner-win-arm64-2.337.0.zip -OutFile actions-runner-win-arm64-2.337.0.zip

# Extract the installer
Add-Type -AssemblyName System.IO.Compression.FileSystem ;
[System.IO.Compression.ZipFile]::ExtractToDirectory("$PWD\actions-runner-win-arm64-2.337.0.zip", "$PWD")

OSX x64

# Create a folder
mkdir actions-runner && cd actions-runner

# Download the latest runner package
curl -O -L https://github.com/actions/runner/releases/download/v2.337.0/actions-runner-osx-x64-2.337.0.tar.gz

# Extract the installer
tar xzf ./actions-runner-osx-x64-2.337.0.tar.gz

OSX arm64 (Apple silicon)

# Create a folder
mkdir actions-runner && cd actions-runner

# Download the latest runner package
curl -O -L https://github.com/actions/runner/releases/download/v2.337.0/actions-runner-osx-arm64-2.337.0.tar.gz

# Extract the installer
tar xzf ./actions-runner-osx-arm64-2.337.0.tar.gz

Linux x64

# Create a folder
mkdir actions-runner && cd actions-runner

# Download the latest runner package
curl -O -L https://github.com/actions/runner/releases/download/v2.337.0/actions-runner-linux-x64-2.337.0.tar.gz

# Extract the installer
tar xzf ./actions-runner-linux-x64-2.337.0.tar.gz

Linux arm64

# Create a folder
mkdir actions-runner && cd actions-runner

# Download the latest runner package
curl -O -L https://github.com/actions/runner/releases/download/v2.337.0/actions-runner-linux-arm64-2.337.0.tar.gz

# Extract the installer
tar xzf ./actions-runner-linux-arm64-2.337.0.tar.gz

Linux arm

# Create a folder
mkdir actions-runner && cd actions-runner

# Download the latest runner package
curl -O -L https://github.com/actions/runner/releases/download/v2.337.0/actions-runner-linux-arm-2.337.0.tar.gz

# Extract the installer
tar xzf ./actions-runner-linux-arm-2.337.0.tar.gz

Using your self hosted runner

For additional details about configuring, running, or shutting down the runner please check out our product docs.

SHA-256 Checksums

The SHA-256 checksums for the packages included in this build are shown below:

  • actions-runner-win-x64-2.337.0.zip 1150692afa94e71f872017e254ea55b6eece1eece3fe7e3a6d4c93d0a1b85cfc
  • actions-runner-win-arm64-2.337.0.zip 7ee1a72a0e0ad384ac7871ffc2356063a116e20d1db3ea41000eb49272cf0030
  • actions-runner-osx-x64-2.337.0.tar.gz d383f505d7ed041b1873ab68c35dd766fc093f2252330f95bb427be8f2c6dcfc
  • actions-runner-osx-arm64-2.337.0.tar.gz 5a2cd92908a93d7276a194e1de6008099f3e7946f3f8e14aa7a1a7b4a31fdec2
  • actions-runner-linux-x64-2.337.0.tar.gz 70920811a4f8ad4328818682bca5c6469c1c942fab52448868071d0063816613
  • actions-runner-linux-arm64-2.337.0.tar.gz 9b1dc70626422526e3c94767cf024896beb15da5342a3f4819bf2feac13e0393
  • actions-runner-linux-arm-2.337.0.tar.gz 3ea05289b7f7e1bc9a7bb35e2f738a903e0f757cb27ed32a3ef701404cf6d8e8

Configuration

📅 Schedule: (in timezone America/New_York)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, on day 1 through 7 and 15 through 21 of the month, and on Monday (* 0-3 1-7,15-21 * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the renovate label Sep 9, 2026
@renovate
renovate Bot requested a review from claytono as a code owner September 9, 2026 04:54
@github-actions

github-actions Bot commented Sep 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ghcr.io/actions/actions-runner (docker) 2.336.0 -> 2.337.0

Risk: 🟡 Caution

The Deep Dive

Update Scope

Updates the digest-pinned runner image 2.336.0 → 2.337.0 in shared values and four rendered scale sets (dotfiles, github-actions, go-unifi-mcp, infra). The Kustomization includes all four without an image override, so this changes the intended deployed runner. Scale-set chart and controller chart remain 0.14.2; the auth-copy image, UID/GID 1001, job-start hook, and 0–4 runners per set remain unchanged (values, PR diff).

Performance & Stability

  • Live log reconnection: WebSocket retry fix recreates and disposes connection objects correctly, avoiding a null reference after a failed connection. It takes effect automatically when GitHub supplies a live-console endpoint; these GitHub.com runners can benefit without configuration changes, although CI cannot establish whether they have encountered the failure.
  • Debugger tunnel failures: DAP tunnel handling reports initial connection failures and terminal disconnects as infrastructure failures and releases jobs waiting for the debugger. It applies automatically to debugger-enabled jobs; pod environment has no debugger configuration, but server-supplied debug sessions are not observable from this checkout. Normal jobs do not activate the debugger.

Features & UX

  • Optional host secret notification: Linux VSock notifier can forward runner-masked secrets to a host consumer. Activation requires GITHUB_ACTIONS_RUNNER_VSOCK_CID_PORT=CID:PORT and a reachable VSock consumer; this is infrastructure integration, not a new user-facing debugger switch. Neither the configured runner environment nor the inspected image environment sets it, so the declared deployment does not activate it. Enabling it later would explicitly trust that host with secrets; CI cannot observe externally injected environment (implementation).
  • Bundled runtimes and tools: Node 24.18.0 → 24.19.0 updates the JavaScript-action runtime automatically; Node 20 stays 20.20.2. The .NET SDK moves 8.0.422 → 8.0.424, staying on .NET 8. Docker 29.6.1 → 29.7.2 and Buildx 0.35.0 → 0.36.1 ship in the image; container hooks stay 0.7.0. Pod configuration has no Docker daemon sidecar, socket mount, or remote Docker endpoint, so running the bundled daemon requires workflow setup; Buildx can also use remote or Kubernetes builders without a local daemon. External workflow use remains unknown. Ubuntu 24.04, runner UID 1001 and passwordless sudo are retained, preserving the apt-based startup hook.
  • Bake and builder policy: Buildx 0.36.0 adds overrides for declared Bake secret sources and optional file resolution relative to the Bake file (BUILDX_BAKE_FILE_RELATIVE_PATHS=true). Opt-in default source policy (BUILDX_DEFAULT_POLICY=1) verifies signed moby/buildkit tags when creating a docker-container builder; it does not start verifying arbitrary repositories by default. Policy authors also gain array.flatten and OPA template strings. These features are available in the new binary but require corresponding commands/options; no use is established by the checked runner configuration.
  • Buildx compatibility and reliability: 0.36.0 validates descriptor-file inputs more strictly and updates Compose-file parsing compatibility to 2.13.0. Fixes improve broken-builder removal, containerd-backed Docker iidfile, Kubernetes random balancing and ended exec streams, remote-driver authority headers, and source-policy file-descriptor handling. They activate when those commands/drivers are used; malformed descriptor files may now be rejected. The runner configuration establishes no selected Buildx driver or descriptor/Compose input, so external workflow relevance remains unknown. Windows binary signing and Windows-local policy fixes do not affect the Linux binaries.
  • Attestation format compatibility: Buildx 0.36.1 adds BUILDX_NO_DEFAULT_OCI_ARTIFACT=true to keep attestations while opting out of OCI-artifact storage when registries reject it; explicit oci-artifact options win. This option itself changes no default. The default format change belongs to BuildKit server 0.32, reached if a workflow starts the newly bundled Docker daemon. Existing remote builders are not upgraded by this image change, and the docker-container driver's default mutable moby/buildkit:buildx-stable-1 reference is unchanged from 0.35.0; its server version cannot be inferred from the CLI update. Actual registry compatibility and workflow-provided backend selection are unobserved.
  • Docker daemon changes require activation: Across 29.6.2–29.7.2, Docker adds experimental embedded-containerd support, stable image mounts and configurable default-stop-timeout. Containerd-image-store pull/push concurrency limits now take effect; setting both maximum-concurrency options to zero retains unlimited transfers. These affect a workflow-started bundled daemon, not an external daemon or the default run.sh pod. Network/Swarm, rootless cgroup, user-namespace copy ownership and live-restore fixes are included; archive regressions introduced in 29.7.0 are already repaired in 29.7.1/2, and 29.7.2 fixes nftables compatibility. Client fixes also address duplicate-env service-command panics and misleading force-removal errors; the archive security change is detailed in Security.
  • Bundled backend compatibility: Docker's embedded BuildKit 0.32.2 includes 0.32 changes to remote-cache OCI media types, removal of legacy OTEL_TRACE_PARENT/OTEL_TRACE_STATE fallbacks in favor of TRACEPARENT/TRACESTATE, per-step tracing overrides, Dockerfile frontend 1.26.0, solver/database performance and SSH-port/S3/shared-cache fixes. Static containerd and runc advance to 2.3.3 and 1.4.3 (Docker notes). These do not upgrade the Kubernetes node runtime. They matter only if workflows activate the bundled backend; Buildx linking the newer library alone is not proof that its server changes.

Security

  • Debugger output hardening: The DAP welcome-message fix masks registered secrets and strips control characters before rendering server-supplied text. It applies automatically to debug sessions; the checkout does not establish whether server-side debugging is used. No CVE is assigned in the upstream change.
  • Node HTTP-client fixes: Node 24's embedded Undici 7.28.0 becomes 7.29.0, fixing CVE-2026-13697, CVSS 7.4 and CVE-2026-14643, 5.9 in cache interception; CVE-2026-16728, 4.8 in retry interception; CVE-2026-16729, 4.8 in cookie helpers; and CVE-2026-15157, 4.2 in blob-like request bodies. The bundled versions match affected/fixed ranges, but exploitable use of these specific APIs by workflow actions is unconfirmed; updating the runner also does not replace libraries vendored by individual actions.
  • Verified packaged .NET security fixes: Direct inspection of Listener/Worker runtime configurations, dependency manifests and native runtime version strings in both Linux x64 and arm64 2.336.0 archives and 2.337.0 archives confirms 8.0.28 → 8.0.30. This automatically removes the following affected runtime versions; it is stronger evidence than the SDK mapping, but does not prove any vulnerability was exploited.
  • System.Net.Http HTTP/2 client DoS: CVE-2026-50651, CVSS 3.1 7.5. Runtime 8.0.0–8.0.28 is affected; fixed in 8.0.29 and included here.
  • System.Net.Security TLS handshake DoS: CVE-2026-50524, CVSS 3.1 7.5. Runtime 8.0.0–8.0.28 is affected; fixed in 8.0.29 and included here.
  • System.Xml / XML encryption DoS (runtime package explicitly affected): CVE-2026-47302, CVSS 3.1 7.5. Runtime 8.0.0–8.0.28 is affected; fixed in 8.0.29 and included here.
  • CryptoNative_GetX509NameInfo X.509 DoS: CVE-2026-57108, CVSS 3.1 7.5. Runtime 8.0.0–8.0.28 is affected; fixed in 8.0.29 and included here.
  • System.Net.Security SslStream authorization bypass: CVE-2026-50528, CVSS 3.1 8.2. Runtime 8.0.0–8.0.28 is affected; fixed in 8.0.29 and included here.
  • System.Net.Mail SMTP spoofing: CVE-2026-50659, CVSS 3.1 6.5. Runtime 8.0.0–8.0.28 is affected; fixed in 8.0.29 and included here.
  • System.Net.HttpListener request smuggling bypass: CVE-2026-62899, CVSS 3.1 5.9. Runtime 8.0.0–8.0.29 is affected; fixed in the packaged 8.0.30.
  • System.Net.WebSockets network DoS: CVE-2026-62901, CVSS 3.1 7.5. Runtime 8.0.0–8.0.29 is affected; fixed in the packaged 8.0.30.
  • .NET diagnostics IPC Linux/macOS ACL local elevation: CVE-2026-62909, CVSS 3.1 6.7. Runtime 8.0.0–8.0.29 is affected; fixed in the packaged 8.0.30.
  • Runtime exposure and exclusions: The runner directly uses HTTP clients and ClientWebSocket, making network-client hardening useful; malicious peer behavior, particular XML/SMTP/HttpListener paths and local diagnostics-IPC attack prerequisites are unconfirmed. The Linux pod configuration does not disable .NET diagnostics. Advisory-level triage of every July and August metadata entry excludes Windows-only WPF/QUIC issues and absent SDK/SourceLink, Negotiate-server and separate Cryptography.Xml components from this packaged runner. Worker WebUtilities 8.0.25 remains unchanged and is not those affected components; workflow-installed software is outside this runner runtime fix.
  • Release-listed CVE with unavailable detail: CVE-2026-56158 is listed as an RCE fix in 8.0.29. CVSS, affected component and precise range could not be confirmed: GitHub advisory lookup was empty, and CVE/MSRC detail APIs returned 404. The new runtime includes that servicing release, but this report does not assert either exploitability or exclusion. This limits quantification of a possible security benefit; it is not evidence of an introduced vulnerability.
  • Pre-existing security context: CVE-2026-19534, CVSS 7.5, WebSocket process denial of service on an unexpected subprotocol, affects both embedded Undici versions and is fixed in 7.29.1. Workflow use of the affected client is unknown. It does not increase this PR's risk. The runner advisory list yielded no advisory introduced by this version range.
  • Historical runner advisory excluded by version: CVE-2022-39321, CVSS 8.8 concerns Docker command escaping in much older runner releases; both versions here are outside its affected ranges.
  • Docker CLI archive extraction fixed: CVE-2026-17106, CVSS 4.0 7.1 can write outside an extraction directory through malicious archive entries. The CLI's go-archive dependency changes from affected 0.2.0 to patched 0.3.3; client-side archive operations can benefit without starting a local daemon. Actual untrusted archive use is unknown. This is not image-wide remediation: Buildx still embeds affected go-archive 0.2.1, versus 0.2.0 previously; its reachable extraction path is unconfirmed and that dependency exposure predates the PR.
  • Conditional BuildKit server fixes: Docker's bundled BuildKit moves from 0.31.1 to 0.32.2, crossing the 0.31.2 fixes for CVE-2026-15793 (Git command injection through a custom frontend/raw API and malicious bundle), CVE-2026-15792 (malicious frontend/client panic), CVE-2026-15791 (raw API temporary-file deletion), and CVE-2026-15789 (authenticated malicious local-source upload traversal). These advisories publish severity moderate/moderate/low/moderate respectively but no numerical CVSS score. The first affects 0.30.0–0.31.1; the others affect versions through 0.31.1. Benefits require using the bundled server; declared pods do not start it, and updating this runner does not patch an external builder. Normal Dockerfile use is not the documented injection/deletion vector. The companion CVE-2026-15788, CVSS 4.0 5.6 is a Windows-container junction escape before 0.31.2, excluded for this Linux image (Docker release notes).

Newer Versions

Upstream releases list 2.337.0 (August 26, 2026) as the newest stable release at evaluation time; no newer runner fix is available. The initial container publication delay was resolved, and registry inspection confirms both PR digests match their tags.

  • ARC hang report is not established as a new regression: Job acquisition hang report overlaps this repository's runner/controller versions, but the cited RunServer, RunnerService and underlying raw HTTP timeout code is byte-identical in both tags. Its root cause is unconfirmed; the report does not establish regression from 2.336.0 and does not drive this PR's label.
  • Windows reports do not establish a Linux regression: The Thai-locale secret-masker report involves unchanged ValueEncoders code, and the parallel event.json locking report already affected 2.336.0. Neither demonstrates newly introduced failure for the declared Linux runner image.

Hazards & Risks

  • Throttled action downloads can occupy runners much longer: HTTP retry changes automatically retry HTTP 429 in shared service clients and honor Retry-After as seconds or a date. Action archive downloads replace their former 10–30-second retry wait with a server-directed wait up to 600 seconds, or 600–630 seconds when an oversized header is clamped with jitter; the existing three-attempt limit permits two waits. This reaches actual usage because issue triage downloads checkout and Nix actions, while each scale set is capped at four runners. The archive backoff still uses Task.Delay without a cancellation token, so the longer wait can prevent graceful cancellation until the listener force-kills the worker; it does not prove a permanent pod hang (download loop, cancellation fallback). Normal successful downloads incur no new wait. This specific queue-capacity/cancellation consequence warrants targeted throttling validation beyond ordinary successful-job smoke tests.
  • Legacy broker error mapping removed: Unstructured HTTP 403 no longer unconditionally means the runner version is deprecated; it takes the generic failure path. Structured RunnerVersionTooOld handling remains. The GitHub.com configuration does not target an older enterprise appliance, and no local credential or registration migration is indicated (broker implementation).

Further Follow-up

Throttling and cancellation outcome: Source inspection establishes the longer archive wait and independent worker-kill fallback, but CI-only read access cannot measure queue occupancy or graceful versus forced cancellation in ARC. The checked workload, four-runner cap, and retry implementation identify the affected path. The remaining focused experiment is an isolated runner job against a controlled action-archive endpoint returning 429 with Retry-After: 600, followed by cancellation, recording worker exit and scale-set capacity recovery. Timely recovery with an accepted throttling wait clears this concern toward renovate:safe; demonstrated stuck capacity or broken cleanup raises it to renovate:risk. No jobs or deployments were created because this evaluation forbids them.

Sources

🟡 Verdict: Caution

Caution: the new action-download retry timing can prolong occupation of this deployment’s four-runner scale sets and push cancellation into forced worker termination. The concern is that specific operational change, not ordinary rollout validation or pre-existing issues.

@renovate
renovate Bot force-pushed the renovate/ghcr.io-actions-actions-runner-2.337.0 branch 6 times, most recently from 4cd9540 to 6ef53df Compare September 9, 2026 19:35
@renovate
renovate Bot force-pushed the renovate/ghcr.io-actions-actions-runner-2.337.0 branch from d6f55fd to 3e5af64 Compare September 9, 2026 19:54
@claytono
claytono merged commit cbb79c3 into main Sep 9, 2026
20 checks passed
@claytono
claytono deleted the renovate/ghcr.io-actions-actions-runner-2.337.0 branch September 9, 2026 21:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@claytono claytono Awaiting requested review from claytono claytono is a code owner

Assignees

No one assigned

Labels

renovate:caution renovate:evaluated renovate

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@claytono