Add Chef Infra Server 15.10.108 release notes (#4655)

* Add Chef Infra Server 15.10.108 release notes

- Security: JWT CVE-2026-45363, addressable CVE-2026-35611, Erlang 10x CVEs
- Security: Reduced /version endpoint information disclosure
- Bug fix: Bifrost crash.log rotation config
- Bug fix: chef-server-ctl reconfigure inspec-core crash
- Improvement: log_rotation_type config option
- Improvement: local license file check (OC_LICENSE_PATH, default off)
- Updated: Chef Infra Client 18.10.17, knife 19.0.105, knife-ec-backup 3.0.8
- Updated: PostgreSQL client 13→14, Rails 7.1.6

Jira: CHEF-32260

Signed-off-by: Lincoln Baker <51833247+lbakerchef@users.noreply.github.com>

* Edit release notes

Signed-off-by: Ian Maddaus <ian.maddaus@progress.com>

* Editing

Signed-off-by: Ian Maddaus <ian.maddaus@progress.com>

* Updated the release date based on a message from Vikram in the Sync chat server.md

Signed-off-by: lbarry316 <118758673+lbarry316@users.noreply.github.com>

* Updated date format based on #4678 server.md

Signed-off-by: lbarry316 <118758673+lbarry316@users.noreply.github.com>

* Updated version (as confirmed by Vikram) server.md

Signed-off-by: lbarry316 <118758673+lbarry316@users.noreply.github.com>

---------

Signed-off-by: Lincoln Baker <51833247+lbakerchef@users.noreply.github.com>
Signed-off-by: Ian Maddaus <ian.maddaus@progress.com>
Signed-off-by: lbarry316 <118758673+lbarry316@users.noreply.github.com>
Co-authored-by: Ian Maddaus <ian.maddaus@progress.com>
Co-authored-by: lbarry316 <118758673+lbarry316@users.noreply.github.com>

Author: 3 people

content/release_notes/server.md

@@ -17,6 +17,56 @@ summary = "Chef Infra Server release notes"
 <!-- cSpell:disable  -->
 <!-- vale off -->
 
+## Chef Infra Server 15.10.114
+
+Released on June 25, 2026
+
+### Security
+
+- Updated `jwt` from 3.1.2 to 3.2.0 in `oc-id` and `chef-server-ctl`.
+- Updated `addressable` from 2.8.7 to 2.9.0 in `oc-id` and `chef-server-ctl`.
+- Updated Erlang/OTP from 26.2.2 to 26.2.5.
+- Updated Rack from 3.2.4 to 3.2.6.
+- The `/version` API endpoint no longer exposes internal library names and version details.
+
+### Bug fixes
+
+- Fixed an incorrect log rotation configuration in the Bifrost service where the request logger
+  was writing to `crash.log` instead of `requests.log`. ([#4188](https://github.com/chef/chef-server/pull/4188))
+- Fixed a crash in `chef-server-ctl reconfigure` that caused a `NameError: uninitialized constant
+  Parser::AST::Processor::Mixin` when the `addressable 2.9.0` security pin was active.
+  ([#4195](https://github.com/chef/chef-server/pull/4195))
+
+### Improvements
+
+- Added a `log_rotation_type` configuration option to select between `rotate` and `wrap` style
+  request logging. Default behavior is unchanged.
+  ([#4188](https://github.com/chef/chef-server/pull/4188))
+- Added support for a local license file check, controlled by the `OC_LICENSE_PATH` build-time
+  macro. When the macro is unset (the default), Chef Infra Server uses the `chef-automate` CLI to check the license, which is the previous default behavior. When set to
+  a file path, Chef Infra Server reads the license from that location at runtime. If the file is
+  missing or invalid, a 90-day trial period begins from the time of upgrade.
+  ([#4152](https://github.com/chef/chef-server/pull/4152))
+
+### Updated components
+
+- Chef Infra Client updated from 18.8.46 to 18.10.17.
+- knife updated from 18.8.68 to 19.0.105.
+- knife-ec-backup updated from 3.0.5 to 3.0.8.
+- PostgreSQL client updated from version 13 to 14.
+- Rails updated from 7.1.5.2 to 7.1.6 (includes a pending security fix).
+
+### Service versions
+
+This release uses:
+
+- OpenResty 1.27.1.2
+- OpenJRE 17.0.9+9
+- PostgreSQL 13.22.tuxcare.1.0.1
+- OpenSearch 1.3.20-tuxcare-1.0.2
+- Rack 3.2.6
+- Valkey 7.2.11
+
 ## Chef Infra Server 15.10.91
 
 Released on February 10, 2026