full release notes list and script fix

fdevans · fdevans · commit 33fded5e1bf9 · 2026-06-03T07:56:34.000-07:00
diff --git a/docs/.vuepress/pr-utils.mjs b/docs/.vuepress/pr-utils.mjs
@@ -29,6 +29,87 @@ export function parseSaasCutTag(tag) {
   };
 }
 
+/**
+ * Fetch PRs by milestone as a fallback for large commit ranges
+ * @param {Object} octokit - Initialized Octokit instance
+ * @param {string} owner - Repository owner
+ * @param {string} repo - Repository name
+ * @param {string} milestone - Milestone version (e.g., "6.0.0")
+ * @param {Array<string>} includeLabels - Labels that PRs must have (empty array = all PRs)
+ * @param {Array<string>} excludeLabels - Labels to exclude from results
+ * @returns {Promise<Array>} Array of PR objects
+ */
+async function fetchPRsByMilestone(octokit, owner, repo, milestone, includeLabels = [], excludeLabels = []) {
+  console.log(`  Using milestone-based search for ${owner}/${repo} milestone ${milestone}`);
+  
+  const prs = [];
+  let page = 1;
+  const perPage = 100;
+  let hasMore = true;
+  
+  while (hasMore) {
+    try {
+      const { data: pullRequests } = await octokit.rest.pulls.list({
+        owner,
+        repo,
+        state: 'closed',
+        per_page: perPage,
+        page: page,
+        sort: 'updated',
+        direction: 'desc'
+      });
+      
+      if (pullRequests.length === 0) {
+        hasMore = false;
+        break;
+      }
+      
+      for (const pr of pullRequests) {
+        // Only include merged PRs
+        if (!pr.merged_at) continue;
+        
+        // Check milestone if it exists
+        if (pr.milestone && pr.milestone.title === milestone) {
+          const prLabels = pr.labels.map(label => label.name);
+          
+          // Check exclude labels
+          if (excludeLabels.length > 0 && excludeLabels.some(label => prLabels.includes(label))) {
+            continue;
+          }
+          
+          // Check include labels (empty = all PRs)
+          if (includeLabels.length === 0 || includeLabels.some(label => prLabels.includes(label))) {
+            prs.push({
+              ...pr,
+              _repoOwner: owner,
+              _repoName: repo
+            });
+          }
+        }
+      }
+      
+      // GitHub's list PRs API paginates
+      if (pullRequests.length < perPage) {
+        hasMore = false;
+      } else {
+        page++;
+      }
+      
+      // Safety limit
+      if (page > 100) {
+        console.log(`  ⚠ Reached pagination safety limit (${prs.length} PRs found)`);
+        hasMore = false;
+      }
+    } catch (error) {
+      console.warn(`  Warning: Error fetching PRs by milestone: ${error.message}`);
+      hasMore = false;
+    }
+  }
+  
+  console.log(`  Found ${prs.length} PRs with milestone ${milestone}`);
+  return prs;
+}
+
 /**
  * Fetch PRs merged between two tags using git comparison
  * @param {Object} octokit - Initialized Octokit instance
@@ -82,6 +163,15 @@ export async function fetchPRsBetweenTags(octokit, owner, repo, fromVersion, toV
     return [];
   }
   
+  const totalCommits = comparison.data.total_commits || comparison.data.commits.length;
+  
+  // GitHub's compareCommits API has a 250 commit limit
+  // For large ranges, we need a different approach
+  if (totalCommits > 250) {
+    console.log(`  ⚠ Large commit range (${totalCommits} commits) - using milestone/search fallback`);
+    return await fetchPRsByMilestone(octokit, owner, repo, toVersion, includeLabels, excludeLabels);
+  }
+  
   // Extract PR numbers from merge commits
   const prNumbers = new Set();
   for (const commit of comparison.data.commits) {
diff --git a/docs/history/6_x/version-6.0.0.md b/docs/history/6_x/version-6.0.0.md
@@ -21,51 +21,89 @@ feed:
 - MySQL 8.4 support
 - Lots More
 
+<!-- <VidStack src="youtube/REPLACE" poster="https://img.youtube.com/vi/REPLACE/maxresdefault.jpg"/> -->
 
 ## Runbook Automation Updates
 
-##### ::circle-dot:: Fix project runner replica list gated on delete permission
+##### ::circle-dot:: Password reset links now automatically expire
   
-Fixed a bug where **viewing runner replicas** in a project incorrectly required **delete** permission on project runners in addition to read. **Read access alone is now enough** to see replica information in Runner Management, so least-privilege ACLs work as administrators expect.
+Password reset links now automatically expire after a configurable period (7 days by default), improving security by limiting the window of opportunity for unauthorized password resets. If a user attempts to use an expired reset link, they&#39;ll simply need to request a new one—no manual cleanup or administrative action required.
 
 ##### ::circle-dot:: Fix search not working in User Management tables
   
 Fix User Management search — typing in the search box in the User Classes, Manage Local Users, and Manage Local Groups tabs now correctly filters rows by all searchable columns, including User Class name and Group Name.
 
+##### ::circle-dot:: Fix project runner replica list gated on delete permission
+  
+Fixed a bug where **viewing runner replicas** in a project incorrectly required **delete** permission on project runners in addition to read. **Read access alone is now enough** to see replica information in Runner Management, so least-privilege ACLs work as administrators expect.
+
+##### ::circle-dot:: Execution log runner UI (i18n + badge settings)
+  
+Execution log: runner plugin registers i18n for the “Display Runner Badge” setting; fixes missing translation key and non-functional toggle when combined with updated ui-trellis LogViewer `addUiMessages` provider.
+
 
 ## Rundeck Open Source Product Updates
 
-#####  ::circle-dot:: [Upgrade log4J to 2.25.4](https://github.com/rundeck/rundeck/pull/10086)
+#####  ::circle-dot:: [NextUI: Vue migration for User and System Configuration menus](https://github.com/rundeck/rundeck/pull/9899)
   
-Fix CVE-2026-34478 and CVE-2026-34480 by upgrading to 2.25.4
+&lt;!-- If you have suggested content that would describe this PR to other Rundeck community users, please enter it here.--&gt;
 
-#####  ::circle-dot:: [Upgrade mina-core to 2.2.7 to fix CVE-2026-42779](https://github.com/rundeck/rundeck/pull/10118)
+#####  ::circle-dot:: [Upgrade to Grails 7.0.9, Spring Boot 3.5.11, Groovy 4.0.30, Java 17](https://github.com/rundeck/rundeck/pull/9922)
+  
+Initial Grails 7 Upgrade for Rundeck Core.  Versions and code from this pull request have been improved and updated since merge, but this is the original PR for the 6.0 upgrade.
 
-#####  ::circle-dot:: [Make UUID field read-only in job Other tab](https://github.com/rundeck/rundeck/pull/10146)
+#####  ::circle-dot:: [Bump Jetty to 12.0.33 for CVE-2026-2332 (CWE-444 request smuggling)](https://github.com/rundeck/rundeck/pull/10050)
+
+#####  ::circle-dot:: [Eliminate Jasypt dependency and upgrade BouncyCastle to 1.84](https://github.com/rundeck/rundeck/pull/10094)
   
-UUID is no longer be editable on Jobs Other tab
+Rundeck&#39;s storage encryption has been upgraded to use modern AES-256-GCM authenticated encryption, replacing the legacy Jasypt library and resolving security vulnerability CVE-2026-5588 by upgrading BouncyCastle to version 1.84. This enhancement provides stronger encryption for stored credentials and keys while maintaining full backward compatibility—existing encrypted data continues to work and is automatically migrated to the new encryption format when next updated, requiring no manual intervention or downtime.
 
-#####  ::circle-dot:: [Improve Dutch translations to be better understandable - Community Submission](https://github.com/rundeck/rundeck/pull/10164)
+#####  ::circle-dot:: [Make script editor min/max lines configurable via System Configuration](https://github.com/rundeck/rundeck/pull/10137)
+
+#####  ::circle-dot:: [Conditional step with multiple sub-steps breaks job output](https://github.com/rundeck/rundeck/pull/10140)
   
-Community Submission from @TheSander562.  Enhancement for dutch speaking people so the words and sentences makes sense when reading them in Rundeck.
+This fixes some issues with the Job Output view when there are multiple sub steps in a Conditional Step.
 
-#####  ::circle-dot:: [Update commons-compress to 1.28.0 to fix CVE-2025-48924](https://github.com/rundeck/rundeck/pull/10165)
+#####  ::circle-dot:: [Remove Community News Subscribe Button](https://github.com/rundeck/rundeck/pull/10148)
   
-Updated Apache Commons Compress to version 1.28.0 to address CVE-2025-48924, which resolves a vulnerability in the transitively included commons-lang3 dependency.
+The news subscribe button has been removed as a product feature.  You can sign up for Release Notes emails at https://www.rundeck.com/release-notes-signup or join us in the [community forums](https://community.pagerduty.com/).
 
-#####  ::circle-dot:: [Update follow-redirects for CVE-2026-40895](https://github.com/rundeck/rundeck/pull/10169)
+#####  ::circle-dot:: [Fix/add created by field](https://github.com/rundeck/rundeck/pull/10150)
   
-Updates the follow-redirects dependency to version 1.16.0 to address security vulnerability CVE-2026-40895.
+Job creation tracking now permanently preserves the original job creator&#39;s identity. When viewing job details, you&#39;ll see who originally created the job, even if the job has been modified by other users over time. This enhancement improves audit trails and accountability by ensuring the original creator information is never lost during job updates or imports.
+
+#####  ::circle-dot:: [Fix cluster member state showing as unknown on Job page](https://github.com/rundeck/rundeck/pull/10172)
 
 #####  ::circle-dot:: [Restore step property value colors for dark background contexts](https://github.com/rundeck/rundeck/pull/10153)
   
 Fixed a regression in 5.20.0 where step configuration property values in the workflow editor step cards appeared invisible or hard to read due to dark color overrides that conflicted with the dark-background step list UI. Values now render in the original readable green color (Bootstrap `text-success`) as in previous versions.
 
-
 #####  ::circle-dot:: [Fix cron expression selector not updating in Execution History Clean](https://github.com/rundeck/rundeck/pull/10154)
   
 Fix cron expression selector in Project Settings &gt; Execution History Clean. Selecting a predefined cron option now correctly updates the schedule input field.
 
+#####  ::circle-dot:: [Improve Dutch translations to be better understandable - Community Submission](https://github.com/rundeck/rundeck/pull/10164)
+  
+Community Submission from @TheSander562.  Enhancement for dutch speaking people so the words and sentences makes sense when reading them in Rundeck.
+
+#####  ::circle-dot:: [Update follow-redirects for CVE-2026-40895](https://github.com/rundeck/rundeck/pull/10169)
+  
+Updates the follow-redirects dependency to version 1.16.0 to address security vulnerability CVE-2026-40895.
+
+#####  ::circle-dot:: [Update commons-compress to 1.28.0 to fix CVE-2025-48924](https://github.com/rundeck/rundeck/pull/10165)
+  
+Updated Apache Commons Compress to version 1.28.0 to address CVE-2025-48924, which resolves a vulnerability in the transitively included commons-lang3 dependency.
+
+#####  ::circle-dot:: [Upgrade mina-core to 2.2.7 to fix CVE-2026-42779](https://github.com/rundeck/rundeck/pull/10118)
+
+#####  ::circle-dot:: [Make UUID field read-only in job Other tab](https://github.com/rundeck/rundeck/pull/10146)
+  
+UUID is no longer be editable on Jobs Other tab
+
+#####  ::circle-dot:: [Upgrade log4J to 2.25.4](https://github.com/rundeck/rundeck/pull/10086)
+  
+Fix CVE-2026-34478 and CVE-2026-34480 by upgrading to 2.25.4
+
 
 [Here is a link to the full list of public PRs](https://github.com/rundeck/rundeck/pulls?q=is%3Apr+milestone%3A6.0.0+is%3Aclosed)
 
