Skip to main content

Release 1.9.9

Release Number1.9.9
Release DateJune 23rd, 2026
Taginfrahub-v1.9.9

Security​

  • Upgraded GitPython to 3.1.50 to address GHSA-mv93-w799-cj2w, a configuration-injection vulnerability that could lead to arbitrary code execution via crafted git config section names.

Added​

  • Added a link in the Proposed Change "Checks" tab from each artifact validator to the originating CoreArtifactDefinition, so users can navigate directly to the definition that produced the check.

Fixed​

  • Importing a Git repository now succeeds even when one of its branches has a merge conflict against the default branch. The conflicting branch is imported as-is and a warning is logged; the conflict is reported when a user later attempts to merge the branch. (#2293)
  • Fixed the unclear error message shown when picking a time earlier than the Infrahub instance was created. (#4076)
  • Narrowed the git repository lock so it only guards on-disk git working-copy mutations (clone, fetch, worktree creation) and no longer wraps importing repository objects into the graph. (#6639)
  • Added a refresh button to the artifact detail page so regenerated artifact content can be reloaded in place, without requiring a full browser refresh. (#9335)
  • Fixed git repository synchronization so that a failure on one branch no longer prevents the other branches from being synchronized. (#9463)
  • Fixed the file action reported by the repository diff so a file added on a branch is labelled added (and a deleted file removed) instead of being inverted in GET /api/diff/files and the Proposed Change Files tab. (#9530)
  • Rebasing a branch now only requires the global:rebase_branch:allow_all permission. Previously the default-branch permission check ran ahead of the rebase check and also demanded global:edit_default_branch:allow_all, so users granted only the rebase permission were denied with "You are not allowed to change data in the default branch". (#9604)
  • Fixed the repository Import latest commit and Reimport current commit actions running against main instead of the branch currently selected in the UI. (#9653)
  • Computed attribute updates no longer raise a ValueError when PREFECT_SERVER_EVENTS_MAXIMUM_RELATED_RESOURCES is set to 1. The workflow submission chunk size is now floored at 1.
  • Concurrent imports of the same repository no longer race to create the same object and fail on a name uniqueness constraint, which could leave the repository out of sync. The graph-changing phase of a repository import is now serialized under the repository lock.
  • Repository synchronization now resolves both a new repository's initial import and the pinned worker-pool commit from the repository's Git default branch rather than Infrahub's default branch name, fixing repositories whose Git default branch differs and staging-branch syncs.