v2.6.1

Externally visible changes since v2.6.0:

• Remove items which can't be read from disk #863
• Fix azure auth regression #862
• Fix building with the upcoming bazel 9.x

The linux binaries below should work on ubuntu 20.04 and later, and the darwin binaries should work on macOS 13 and later.

v2.6.0

Externally visible changes since v2.5.2:

• Reject high-cost requests instead of creating more OS threads when overloaded
• Optimize file removals
• Add SpliceBlob support

2025-09-04: replaced release binaries, with versions compiled with cgo support.
2025-09-28: replaced bazel-remote-2.6.0-linux-amd64 with a version built to run on ubuntu 20.04 and later.

v2.5.2

Externally visible changes since v2.5.1:

• Advertise MaxCasBlobSizeBytes via the Capabilities API
• Bugfix: verify CAS blobs when using uncompressed storage mode
• Add more human-readable GitTags item to the status page
• s3: use a higher value for max idle connections to reduce TLS handshakes

2025-09-04: replaced release binaries, with versions compiled with cgo support.
2025-09-28: replaced bazel-remote-2.5.2-linux-amd64 with a version built to run on ubuntu 20.04 and later.

v2.5.1

Externally visible changes since v2.5.0:

• Only show supported zstd implementations in help text
• Ensure that we build the linux amd64 container image with cgo enabled

v2.5.0

Externally visible changes since v2.4.4:

• Support Remote Asset API HTTP headers, supported in bazel 7.1
• Add support for LDAP authentication
• More informative error message in case of corrupted blob headers
• Ensure that DecoderWrappers are returned to the pool after use in bytestream Writes
• Use syncpool for chunk buffer
• Add prometheus summary for entries' size
• prom: Add option to enable a "bazel_remote" HTTP metrics prefix
• Fix conflict between enable_ac_key_instance_mangling and disable_http_ac_validation
• Support session tokens for the s3 proxy backend

v1.3.4

This release contains an important security fix: Upgrade github.com/mostynb/go-grpc-compression to avoid decompression bomb DoS (#755)

This issue was uncovered during a security audit performed by 7ASecurity, facilitated by OSTIF, for the OpenTelemetry project.

https://opentelemetry.io/blog/2024/cve-2024-36129/
GHSA-c74f-6mfw-mm4v

v2.4.4

Externally visible changes since v2.4.3:

• Add experimental gRPC proxy backend
• Add --min_tls_version flag (does not apply to proxy backends)
• [metrics] initialize hits/misses for each cache entry kind
• Fix container entrypoints
• Upgrade to debian12 base container images
• Fix infinite recursion with idle timer
• [s3proxy] add signature_type config option
• Upgrade azidentity to v1.5.2

Update 2024-07-11: replaced bazel-remote-2.4.4-linux-x86_64 with a version built on ubuntu 20.04.

v2.4.3

Externally visible changes since v2.4.2:

• Make config files work again (#694)
• Fix serving uncompressed blob as compressed (#691)

v2.4.2

The use of config files is broken in this release. Please upgrade to v2.4.3 for a fix.

Externally visible changes since v2.4.1:

• Log an error when unable to reserve enough space to download a blob from proxy backends. #649
• Always enable cgo in builds made with bazel. #655
• Require the max_size argument (or corresponding environment variable) when running the container images. #660
• Add s3 addressing style support. #662 #668
• Http proxy sets content length when uncompressed. #676
• Support HTTP proxy with mTLS. #679
• Make unsupported /metrics requests more obvious. #687

Note: the mac binaries attached here were made from 43755b3 - hopefully the release trigger works automatically in the next release.

v2.4.1

Externally visible changes since v2.4.0:

• Delete .DS_Store files when migrating cache dir, ignore them when loading a current cache dir #640
• Make bazel-remote packages consumable as a module #635

Update 2023-04-29: re-uploaded bazel-remote-2.4.1-linux-arm64 correctly built with cgo zstd support.