LinearB On-Prem Agent v5.0.2

Released 2026-09-09.

This release fixes the corporate HTTP proxy integration, corrects three pieces of incorrect guidance in the v5 upgrade and corporate-proxy guides, and slims the service images down to a smaller runtime footprint. If you upgraded to v5 by following those guides, please read Action required below — two of the corrections describe settings that silently did nothing.

Action required

• If you configured Datadog behind a corporate proxy using the snippet from the v5.0.1 corporate-proxy guide, check your values file for a datadog-agent.datadog.env override. That key is a list, and Helm replaces lists rather than merging them, so the override silently removed the RabbitMQ credentials the Datadog agent needs — its RabbitMQ check then fails to authenticate. The guide now uses envDict, which merges. Move your override across, or re-add the credential entries.
• If you set worker CPU or memory by following the "worker sizing" section of the v5 upgrade guide, your job pods are most likely running with no resource limits at all. That section pointed at global.workerPods, which only controls pod placement and has no effect on resources. Set WORKER_REQUEST_CPU, WORKER_REQUEST_MEMORY, WORKER_LIMIT_CPU and WORKER_LIMIT_MEMORY through scheduler.image.env.plain instead.
• If you intended to disable the bundled NGINX ingress controller — on OpenShift, for example — check that it is actually disabled. The upgrade guide gave the key as ingress.installController, which the chart does not read, so the controller installed anyway. The correct key is global.ingress.installController.

Bug fixes

• Corporate proxy: the agent now presents the real LinearB API hostname during the TLS handshake instead of an internal cluster name. transparent proxy mode did not work before this fix, and connect mode only worked where the proxy tolerated the mismatch. No configuration change is needed — upgrading is enough.
• gitStream retries managed clones that fail with a TLS certificate mismatch or a dropped connection, rather than giving up on the first failure
• gitStream reports an unreachable GitLab instance as unreachable instead of failing with an unrelated configuration error
• An unrecognised /gs command no longer triggers an AI review
• Oversized GitHub workflow dispatches are now shrunk and sent rather than skipped, so the run still happens
• Bitbucket Server reports the provider's own status code when a branching-model lookup fails, instead of a generic error
• Repository visibility is now recorded correctly for private Bitbucket Cloud repositories

Improvements

• Coding time is now reported separately by commit and by issue, rather than as a single combined figure
• Commits made by sync bots are identified by author and subject, so they no longer count as developer activity
• Permission problems with Kiro and Amazon Q integrations are surfaced as permission errors instead of appearing as missing data
• Jira Cloud teams are fetched directly instead of by crawling every issue, which is substantially faster on large projects
• The GitHub issues collector now gathers fields that were previously missing

Security and dependency updates

• Service images no longer ship setuptools/pkg_resources, resolving CVE-2026-59890 by removing the affected package rather than pinning around it
• The agent-api and webhook-receiver runtime images are reduced to ca-certificates only, and compilers and development headers are no longer present in any runtime image
• socat updated to 1.8.1.3
• FastAPI updated to 0.141.1 and Pydantic to 2.13.4
• Datadog agent and cluster agent updated to 7.82.1 (image tags only — the Datadog chart version is unchanged, so no values change is required)
• pip, setuptools and wheel removed from the sensors runtime image, and gunicorn and gevent updated in the project-management connector images

Note for anyone debugging inside a pod

The slimmed runtime images no longer include curl, wget, ps, top or gnupg, and the agent-api and webhook-receiver images no longer include compilers. Certificate trust is unaffected. If you rely on kubectl exec for troubleshooting, use an ephemeral debug container with your own tooling instead.

Component versions