RhodeCode Enterprise 5.13.0 Release Notes¶

Release Date¶

SSH: added ssh.executable.git_ext_config, extra server-side git -c options appended to the upload-pack/receive-pack command run by the ssh-wrapper. The default caps pack memory (pack.threads, pack.windowMemory, pack.deltaCacheSize, core.bigFileThreshold) so a single large clone or fetch can no longer grow the git child process to several GB and OOM the host under concurrency. The option is exposed and documented in the production and development ini templates; set it empty to disable the caps.

Celery: prefork workers now dispose SQLAlchemy connections inherited from the parent process on worker start, and cleanly remove the session and dispose the engine pool on worker shutdown.
VCSServer: dropped the remaining dulwich call sites from the git backend; get_description now reads the control-dir file directly and the unused GIT_LINK constant was removed.
Dependencies: upgraded aiohttp to 3.14.1, bleach to 6.4.0, click to 8.3.3, greenlet to 3.5.0, idna to 3.15, mako to 1.3.12, mistune to 3.3.0, msgpack to 1.2.1, pyasn1 to 0.6.4, soupsieve to 2.8.4, tornado to 6.5.7, urllib3 to 2.7.0, webob to 1.8.10, zope.interface to 8.4 and zope.event to 6.2.
Dependencies: bumped rhodecode-tools to 4.6.0, markupsafe to 3.0.3 in the docs requirements, and pinned pipdeptree to 4.1.0 across CE, EE and VCSServer.
Tests: the gunicorn-backed test server now disposes DB connections inherited from the arbiter in a post_fork hook and disables worker recycling, removing a source of random 500s during VCS operation tests.

Dependencies: upgraded cryptography from 46.0.7 to 48.0.1 (GHSA-537c-gmf6-5ccf). The PyPI wheels statically link OpenSSL, and every release through 48.0.0 bundled a copy with a network-reachable out-of-bounds read (CWE-125, CVSS 7.5, availability impact only). 48.0.1 recompiles the wheels against OpenSSL 4.0.1; no library code changed.

pull-request: the close-branch-before-merging check now reads edition_id from rhodecode.CONFIG instead of the Pyramid registry, which is not populated in Celery task-reachable code. Merges running as async tasks no longer skip the EE close-branch behaviour.
vcsserver/git: fixed add_object, which built a dulwich Blob but ran against a libgit2 repository and raised AttributeError on every call; it now uses repo.create_blob.
celery: disposing inherited connections on worker start prevents “MySQL server has gone away” and “Commands out of sync” errors caused by shared-socket corruption after forking; disposing the pool on shutdown prevents Aborted_clients entries in MySQL when workers are recycled via max_tasks_per_child.

RhodeCode 5.13.0 is a scheduled feature release.
SSH git operations now run with conservative pack-memory caps by default. The default is applied through sanitize_settings_and_apply_defaults, so existing installs get the caps without editing their ini file. Servers with plenty of RAM and cores that see a throughput regression on large clones should raise ssh.executable.git_ext_config values, or set the option to an empty string to restore the previous unbounded behaviour.
Celery deployments: workers now dispose inherited database connections on start. No configuration change is required, but deployments that relied on max_tasks_per_child workarounds for connection errors can drop them.