2.8.0rc1: Bug fixes and document updates

What's Changed

• Update npm pacakges to address vulerabilities [skip ci] by @IsaacYangSLA in #3871
• Fix env variables used in vite build process by @IsaacYangSLA in #3874
• Fix the web components, which also need to import env vars by @IsaacYangSLA in #3875
• docs: compare vanilla versus tensor stream job by @rfilgueiras in #3870
• Add inference for secure vertical xgboost by @ZiyueXu77 in #3707
• Fix dashboard sqlite db location by @IsaacYangSLA in #3880
• Add functionality for a balanced device selection across clients by @ZiyueXu77 in #3661
• Consolidate BaseFedJob and fedavg.py by @nvkevlu in #3879
• Add Stats pool docs by @holgerroth in #3881
• Update npm dependencies by @IsaacYangSLA in #3885
• Downloader rework by @yanchengnv in #3873
• Allow only the seeding project admin by @IsaacYangSLA in #3886
• Address client-side vulneralbility for tree-based horizontal XGB by @ZiyueXu77 in #3878
• Fix import error for TBAnalyticsReceiver by @nvkevlu in #3892
• Refactor ml-to-fl examples by @YuanTingHsieh in #3882
• Fixed CI Errors cased by Downloader by @nvidianz in #3902
• Remove broken link by @YuanTingHsieh in #3904
• Changed default scheme to http by @nvidianz in #3903
• Improve admin client - unzip files after downloading by @yanchengnv in #3900
• Convert PSI example to use recipe by @YuanTingHsieh in #3901
• Remove overseer codes by @IsaacYangSLA in #3898
• Add Codon-FM example by @holgerroth in #3889
• Lower Downloader log verbosity by @nvidianz in #3912
• Add Optional by @cyyever in #3721
• Fix PSI doc based on review by @YuanTingHsieh in #3914
• Fix LR recipe and persistor issue by @YuanTingHsieh in #3915
• Remove old examples by @YuanTingHsieh in #3906
• Add back prostate data prepare in research folder by @YuanTingHsieh in #3921
• Add recipe for experiment tracking by @nvkevlu in #3907
• Fix TLS corruption by replacing fork with posix_spawn by @GeorgeWang-nv in #3856
• Fix preflight check and ci by @YuanTingHsieh in #3917
• Comprehensively remove mention of SAG by @nvkevlu in #3924
• [Doc] How-to: Doc update part 1 [skip ci] by @chesterxgchen in #3928
• [Doc] How-to: Doc update part 2 [skip-ci] by @chesterxgchen in #3931
• Convert JobAPI to Recipe for Kaplan-Meier example by @ZiyueXu77 in #3894
• [Doc] Enable how to guide [skip ci] by @chesterxgchen in #3932
• Add cross-site evaluation utility and examples by @nvkevlu in #3923
• Fix Job API TF examples by @holgerroth in #3927
• Fix path for FedAvgRecipe by @nvkevlu in #3934
• fix fed stats example notebook by @chesterxgchen in #3937
• KM example - apply 2.7 updates by @ZiyueXu77 in #3941
• Add multi gpu example by @YuanTingHsieh in #3930
• Improve error message in client API by @holgerroth in #3948
• Removed references to wss as a scheme by @nvidianz in #3949
• change sklearn example based on per site config by @YuanTingHsieh in #3945
• Consolidate LR examples by @YuanTingHsieh in #3944
• Simplifies cross site evaluation recipe and remove parameters by @nvkevlu in #3942
• Convert job to recipe for LLM_HF example by @ZiyueXu77 in #3888
• Fix NumpyFedAvgRecipe and other minor fixes by @nvkevlu in #3958
• Update web page by @nvkevlu in #3964
• Convert job_template to recipe for GNN example by @ZiyueXu77 in #3891
• Remove step-by-step example by @ZiyueXu77 in #3967
• Enable custom key_metric for FedAvgRecipe by @ZiyueXu77 in #3962
• Hello Differential Privacy by @holgerroth in #3979
• Cherry-pick Multinode update by @holgerroth in #3978
• Cherry-pick CIFAR-10 recipe conversion by @holgerroth in #3975
• Fix docs [skip ci] by @pcnudde in #3974
• Update key_metric over all examples by @ZiyueXu77 in #3980
• Raise exception on fobs error by @nvidianz in #3968
• Add missing tensorboard requirements by @holgerroth in #3976
• Add recipe for xgboost by @nvkevlu in #3951
• Add multinode guides to llm_hf example by @ZiyueXu77 in #3990
• Make updates to Client API tutorials by @nvkevlu in #3960
• Convert MONAI examples to Recipe by @holgerroth in #3996
• Fix hello-numpy-cross-val example by @nvkevlu in #3988
• Bump diff from 5.2.0 to 5.2.2 in /web by @dependabot[bot] in #3989
• Bump h3 from 1.15.4 to 1.15.5 in /web by @dependabot[bot] in #3965
• BioNeMo Conversion to Recipes by @holgerroth in #4001
• merge fedavg.py with fedavgwithEarlyStopping by @chesterxgchen in #3987
• Expose launch_once option in ScriptRunner by @holgerroth in #3977
• Increase link check timeout by @YuanTingHsieh in #4002
• Ignore downloder no ref_id errors by @nvidianz in #4003
• Bump next from 14.2.30 to 14.2.35 in /examples/tutorials/self-paced-training/part-5_federated_learning_applications_in_industries/chapter-11_federated_learning_in_healthcare_lifescience/11.3_medical_devices/code/visualization/frontend/analytics-dashboard by @dependabot[bot] in #3893
• Convert AMPLIFY example to recipe by @holgerroth in #4030
• Add Brats back and convert to recipe+clientapi by @ZiyueXu77 in #4010
• Fix sklearn-svm by @nvkevlu in #4029
• Doc and config changes from 2.7 branch by @chesterxgchen in #4023
• Fixed the swarm bug by @nvidianz in #4024
• Add lightning eval example by @YuanTingHsieh in #4005
• Cherry pick 4014 4015 4020 4031 by @YuanTingHsieh in #4035
• Add server-side memory management with server_memory_gc_rounds parameter by @chesterxgchen in #4036
• Add NVIDIA FLARE Roadmap page with image display [skip ci] by @chesterxgchen in #4040
• LLM switch default model from llama to open model by @ZiyueXu77 in #4043
• Support bf16 in PT model persistor by @holgerroth in #4046
• Same llm updates to main by @ZiyueXu77 in #4048
• Add integration tests for examples by @pcnudde in #4041
• Move monai examples under advanced by @holgerroth in #4054
• add pcnudde to build permission list by @pcnudde in #4059
• Fix keycloak docker image tag (bitnamilegacy) by @pcnudde in #4061
• Update to notebooks by @ZiyueXu77 in #4067
• Increase BioNeMo external script init timeout by @holgerroth in #4063
• Update to standardize all cifar10 data location in self-paced tutorials by @ZiyueXu77 in #4073
• Update info logging of Cacheable by @holgerroth in #4069
• Fix examples for testing (#4039) by @nvkevlu in #4071
• Update Edge for Android, update GNN readme, Redesign Job-level Authorization Example, Replace NLP-NER with link to tutorial by @holgerroth in #4092
• Update amplify tutorial notebook by @ZiyueXu77 in #4088
• Fix notebooks (cherrypick from 2.7) by @pcnudde in #4085
• Logging tutorial fix by @holgerroth in #4097
• Update custom authentication example by @holgerroth in #4093
• Cherry-pick of [2.7] Remove link check on github (#4104) by @YuanTingHsieh in #4106
• Update docker example by @ZiyueXu77 in #4101
• Update holoscan tutorial to latest api by @ZiyueXu77 in #4094
• Improve df_stat example by @ZiyueXu77 in #4109
• Job CLI Tutorial Fixes, Chapter 1 TensorBoard Streaming Fix by @holgerroth in #4110
• Chapter 8 Fixes by @holgerroth in #4111
• Tensor streaming timeout issue by @YuanTingHsieh in #4107
• Remove TensorFlow multi-GPU example by @nvkevlu in #4118
• Update jobapi pt example by @ZiyueXu77 in #4112
• Fix potential data corrupt by @YuanTingHsieh in #4129
• Use dict-based config in HuggingFace example by @holgerroth in #4134
• Fixes to Chapters 2, 10, & 12 by @holgerroth in #4133
• CIFAR-10 Update tb event reader and requirements [skip ci] by @holgerroth in #4135
• LLM updates to main by @ZiyueXu77 in #4139
• Add claude config [skip ci] by @pcnudde in #4086
• Tutorials disclaimer by @holgerroth in #4143
• CIFAR-10 Experiment Tracking Instructions Corrections by @holgerroth in #4149
• Add FL_LOG_LEVEL environment variable support by @pcnudde in #4164
• Cherry pick pr4090 4091 4099 4114 by @IsaacYangSLA in #4163
• Cherry pick pr4008 add unit test by @IsaacYangSLA in #4162
• Cherry-pick documentation PRs from 2.7 to main [skip ci] by @chesterxgchen in #4170
• Cherry-pick of [2.7] Fix swarm controller + tensor streaming issue (#4141) by @YuanTingHsieh in #4146
• Remove roadmap from documentation by @chesterxgchen in #4180
• Initial checkpoint info by @holgerroth in #4182
• Sync recipe and related files from 2.7 branch by @YuanTingHsieh in #4177
• Cherry-pick #4087 and #4127 from 2.7: by @nvkevlu in #4184
• Update links on web page for main by @nvkevlu in #4161
• Cherry pick Recipe API fixes by @ZiyueXu77 in #4192
• Cherry-pick #4174 and #4186 from 2.7 to main by @pcnudde in #4193
• Cherry-pick #4168 to main: Fix hello-numpy-cross-val example by @nvkevlu in #4194
• Use Initial Global Model in BioNeMo Recipe Examples by @holgerroth in #4203
• Cherrypick from 2.7 #4004 Fix RxTask self-deadlock on stream error cleanup by @pcnudde in #4213
• Bump ajv from 8.17.1 to 8.18.0 in /web by @dependabot[bot] in #4219
• Fix a security issue on FileRetriever by @IsaacYangSLA in #4229
• Add AGENTS.md with NVFlare agent notes [skip CICD] by @pcnudde in #4214
• Fix FedOpt argument definitions (#4235) by @holgerroth in #4236
• Accept 'class_path' in component config for job API consistency… by @holgerroth in #4240
• Check full Apache license header and normalize inconsistent headers by @holgerroth in #4241
• Fix global model selection by @holgerroth in #4226
• Cherry-pick of [2.7] Fix cifar10 integration tests (#4150) by @YuanTingHsieh in #4199
• Cherry-pick #4190 from 2.7 to main by @pcnudde in #4245
• Skip unsupported metrics for aggregation (#4223) by @holgerroth in #4224
• Ignore local .codex artifacts [skip CI/CID] by @pcnudde in #4251
• Qwen3-VL Example by @holgerroth in #4212
• Follow-up to #4224: improve metrics presence semantics in FedAvg by @holgerroth in #4261
• Clarify TensorFlow recipe docs to require subclassed Keras models by @pcnudde in #4266
• Guard Flower integration against incompatible flwr CLI versions by @holgerroth in #4267
• Cherrypick XGB and FedBuff PRs to main by @ZiyueXu77 in #4265
• Improve FedAvg HE TenSEAL context provisioning guidance and validation by @holgerroth in #4269
• Qwen3-VL: add tensor streaming timeouts to fix mid-download kill warning by @holgerroth in #4268
• Fix: minor typos in tutorial notebooks by @kminhta in #4246
• Tensor Disk Offload for PyTorch in FedAvg and Swarm by @pcnudde in #4221
• Add device_wait_timeout to ET class by @ZiyueXu77 in #4274
• Bump rollup from 4.53.3 to 4.59.0 in /web by @dependabot[bot] in #4238
• Cherry pick 4181 to main by @nvkevlu in #4201
• Scaffold update: defensive check; docstring update by @holgerroth in #4281
• Add Python 3.13/3.14 support and docs updates by @pcnudde in #4248
• Cherry-pick [2.7] Enhancements on CI install_requirements (#4249) by @YuanTingHsieh in #4283
• Cherry-pick [2.7] Pin pandas<3.0 and fix pandas 3.x compatibility in federated statistics (#4227) by @YuanTingHsieh in #4292
• Cherry-pick [2.7] Fix hierarchical FL startup failures: deployment timeouts, selective client exclusion, and dead-detection debounce (#4209) by @YuanTingHsieh in #4288
• Qwen-VL LoRA Support by @holgerroth in #4277
• Passing run-config to Flower to override pyproject.toml hyperparameters by @d0uwe in #4311
• Feature Election contribution by @christofilojohn in #3876
• Cherry-pick of #4084 and #4132 by @YuanTingHsieh in #4286
• Cherry-pick [2.7] Client-side memory management (#4211) by @YuanTingHsieh in #4290
• Cherry-pick [2.7] pin fastdigest==0.4.0 due to API changes (#4217) by @YuanTingHsieh in #4291
• Cherry-pick [2.7] Pass-Through: Zero Tensor Copy at CJ for Large-Model Federated Training (#4210) by @YuanTingHsieh in #4289
• Cherry-pick [2.7] Fix recipe API bug list and harden recipe behavior (#4228) by @YuanTingHsieh in #4293
• Update astro web page example by @nvkevlu in #4284
• Bump svgo in /web by @dependabot[bot] in #4271
• Bump devalue from 5.6.2 to 5.6.4 in /web by @dependabot[bot] in #4300
• Cherry pick changes from 2.7 by @YuanTingHsieh in #4327
• Cherry pick f3 changes from 2.7 by @YuanTingHsieh in #4328
• Cheery-pick #4301 & #4308 by @IsaacYangSLA in #4313
• Add FSI fraud detection research page [skip ci] by @holgerroth in #4331
• Fix broken CIFAR-10 example README links [skip ci] by @holgerroth in #4338
• fix(dashboard): harden mass-assignment by @pcnudde in #4343
• fix: use safe deserialization for torch.load and np.load by @gn00295120 in #4344
• Cherry pick more changes from 2.7 by @YuanTingHsieh in #4329
• Port FOBS whitelist fix from 2.7 to main by @nvidianz in #4346
• Fix 3 F3 streaming bugs reported by QA by @nvidianz in #4341
• fix(dashboard): remove jwt_required from public GET endpoints by @pcnudde in #4350
• Cherry-pick [2.7] Remove pre-install tool and example from main (#3986) by @chesterxgchen in #4351
• Add shell=False to subprocess.Popen calls by @nvidianz in #4348
• Datasets license; swarm readme update [skip ci] (#4303) by @holgerroth in #4305
• Add webinars page to NVFlare website by @holgerroth in #4353
• Add deterministic repo Markdown relative-link check by @holgerroth in #4339
• Update publications and talks for 2025 by @holgerroth in #4354
• XGB Doc update: add TimberStrike attack analysis to security section by @ZiyueXu77 in #4304
• Fix links on webpage by @nvkevlu in #4355
• Fix stale publications and talks links by @holgerroth in #4356
• Cherry pick 4326 4334 by @YuanTingHsieh in #4357
• Document main branch versioning policy and reduce AGENTS/CLAUDE duplication [skip ci] by @holgerroth in #4360
• Remove orphaned swarm_pt client config by @holgerroth in #4363
• Fix stale pt_job_adv DeviceManagerConfig arg by @holgerroth in #4364
• Polish root README links and wording [skip ci] by @holgerroth in #4362
• Fail fast on invalid Flare API job folder names by @pcnudde in #4361
• Port remaining changes from 2.7 by @YuanTingHsieh in #4365
• Remove swarm tensor disk offload support by @pcnudde in #4368
• Cherry-pick 2.7 PR #4319: Update 2.7.2 release notes with CWE IDs for security fixes [skip ci] by @chesterxgchen in #4375
• Allow FlowerRecipe to pass extra_env with test by @Zare2001 in #4322
• Cache model and data across FL rounds in hello-flower examples by @vijaygovindaraja in #4372
• Add hello-jax MNIST example by @holgerroth in #4358
• Port doc changes from 2.7 [skip ci] by @YuanTingHsieh in #4378
• Update shared actions to Node 24 for GitHub Actions Node 20 deprecation [skip ci] by @pxLi in #4379
• [Research] FedUMM: Federated Learning for Unified Multimodal Models by @rollingsu in #4158
• Preserve CURRENT_ROUND context attrs in BaseModelController by @holgerroth in #4384
• Remove torch dependency from TBAnalyticsReceiver by @holgerroth in #4382
• Add notebook testing support and developer testing guide by @chesterxgchen in #4075
• Avoid pickle in data leakage example & bionemo by @holgerroth in #4388
• Cherry-pick Fix auth test: remove signature.json from expected ls output (non-CC participants no longer sign root after #4318) (#4347) by @YuanTingHsieh in #4387
• fix security critical issue due to old version of dependency by @chesterxgchen in #4389
• Job Launcher and Job Handle: design doc/implementation/unit tests (TA: NVFlare developers) by @IsaacYangSLA in #4336
• Disable shell commands for all roles in provisioning templates by @nvidianz in #4385
• Revert "Disable shell commands for all roles in provisioning templates (#4385)" by @nvidianz in #4396
• Add phase 1 study plumbing by @pcnudde in #4386
• Support Flower 1.26+ configuration flow by @holgerroth in #4383
• Fix ci torch version issue by @YuanTingHsieh in #4391
• Fix CVE-2026-27903: bump minimatch to patched versions in analytics-dashboard by @nvidianz in #4401
• Inject PYTHONPATH env to k8s job launcher by @IsaacYangSLA in #4393
• Remove deprecated FLAdminAPI surface by @pcnudde in #4400
• Add multi-study support by @pcnudde in #4398
• fix: create optimizer once instead of every batch in edge training by @vijaygovindaraja in #4377
• Add distributed provisioning: nvflare cert/package CLI + runtime security fixes by @chesterxgchen in #4380
• Add NVFLARE roadmap documentation page [skip ci] by @chesterxgchen in #4405
• [Research] Add fsi-fraud-detection code by @holgerroth in #4395
• Add MedGemma fine-tuning example with QLoRA by @holgerroth in #4359
• Add missing third-party license notices for example dependencies by @holgerroth in #4411
• fix(test): migrate test_distributed_provisioning to FLARE API Session by @pcnudde in #4419
• [fix/ci] Handle run-state polling connection teardown by @pcnudde in #4420
• Add ad-hoc connection limitations to the documentation by @nvidianz in #4406
• [Research] Update fedumm by @ZiyueXu77 in #4390
• Add study in k8s job launcher by @IsaacYangSLA in #4423
• Bump next from 14.2.35 to 15.5.14 in /examples/tutorials/self-paced-training/part-5_federated_learning_applications_in_industries/chapter-11_federated_learning_in_healthcare_lifescience/11.3_medical_devices/code/visualization/frontend/analytics-dashboard by @dependabot[bot] in #4345
• Bump lodash and @astrojs/language-server in /web by @dependabot[bot] in #4397
• Bump defu from 6.1.4 to 6.1.6 in /web by @dependabot[bot] in #4403
• Bump vite from 6.4.1 to 6.4.2 in /web by @dependabot[bot] in #4408
• Add heterogeneous-rank HLoRA enhancement to MedGemma example by @holgerroth in #4424
• [issue-003] Add missing return statement in aux_communicate error path by @GeorgeWang-nv in #4429
• [issue-005] Pass id_asserter to get_session for token verification by @GeorgeWang-nv in #4430
• Fix/issue 006 job failure validation by @GeorgeWang-nv in #4432
• [issue-009] Write private key files with restrictive permissions (0o600) by @GeorgeWang-nv in #4431
• Bump transformers from 4.57.1 to 5.0.0 in /examples/advanced/qwen3-vl by @dependabot[bot] in #4418
• [issue-010] Use secrets.token_bytes for SNP attestation nonce generation by @GeorgeWang-nv in #4433
• [issue-012] Clean up run directory when app authorization fails by @GeorgeWang-nv in #4434
• Add PyTorch param validation for model exchange by @holgerroth in #4392
• Bump transformers from 4.53.0 to 5.0.0 in /research/fed-bpt by @dependabot[bot] in #4417
• fix: read epoch count from training config in simulation mode by @vijaygovindaraja in #4404
• [issue-002] Fix incorrect field reference in AuthzFilter submitter role by @GeorgeWang-nv in #4428
• Bump pytest from 9.0.2 to 9.0.3 in /research/fsi-fraud-detection by @dependabot[bot] in #4437
• Bump pillow from 12.1.1 to 12.2.0 in /research/fsi-fraud-detection by @dependabot[bot] in #4435
• Bump torch from 2.6.0 to 2.8.0 in /examples/advanced/qwen3-vl by @dependabot[bot] in #4256
• Bump aiohttp from 3.13.3 to 3.13.4 in /research/fsi-fraud-detection by @dependabot[bot] in #4410
• Bump cryptography from 46.0.5 to 46.0.7 in /research/fsi-fraud-detection by @dependabot[bot] in #4421
• Bump pyasn1 from 0.6.2 to 0.6.3 in /research/fsi-fraud-detection by @dependabot[bot] in #4441
• Bump pygments from 2.19.2 to 2.20.0 in /research/fsi-fraud-detection by @dependabot[bot] in #4440
• Bump monai from 1.2.0 to 1.5.2rc1 in /research/condist-fl by @dependabot[bot] in #4412
• Bump requests from 2.32.5 to 2.33.0 in /research/fsi-fraud-detection by @dependabot[bot] in #4439
• Add helm chart by @IsaacYangSLA in #4427
• Add missing edge web model types to FOBS type whitelist by @nvshaxie in #4444
• fix(android): convert recursive fetchTask/fetchJob retries to a loop by @vijaygovindaraja in #4416
• Add multicloud Kubernetes deployment tooling by @pcnudde in #4450
• Fix mask dtype cast in ConDistDiceLoss (astype → to) by @holgerroth in #4455
• Add docker job launcher by @YuanTingHsieh in #4409
• Enhance NVFlare CLI commands and shared plumbing [Part 1 of 3] by @chesterxgchen in #4449
• Update NVFlare POC, provision, and backend flows [ Part 2 of 3] by @chesterxgchen in #4448
• Update NVFlare CLI docs and examples [ Part 3 of 3] by @chesterxgchen in #4447
• Distributed provisioning, job CLI connection args, system commands, and parity tests by @chesterxgchen in #4462
• [codex] Allow underscores in study names by @pcnudde in #4457
• Bump nbconvert from 7.17.0 to 7.17.1 in /research/fsi-fraud-detection by @dependabot[bot] in #4461
• Handle quoted admin submit_job paths by @holgerroth in #4456
• Persist server job storage on the workspace PVC by @pcnudde in #4468
• Optimize SVTPrivacy memory usage by @holgerroth in #4459
• Add launcher_spec to job meta by @YuanTingHsieh in #4464
• Fix JobRunner completion context race by @pcnudde in #4471
• K8s launcher: use CellNet workspace transfer instead of a shared workspace PVC by @pcnudde in #4469
• feat: add live job log streaming by @nvidianz in #4454
• Stop running POC before force prepare by @chesterxgchen in #4473
• replacing _ with - in flower project name for 1.28 and 1.29 compatibility by @d0uwe in #4466
• allowing to pass allow_runtime_dependency_installation from Flower recipe to the flower code by @d0uwe in #4467
• Rename BE (Best Effort) to Passthrough by @IsaacYangSLA in #4475
• Remove nvfletc PVC and exclude study PVC map from job pods by @pcnudde in #4474
• Multi-study CLI: runtime study management commands and registry by @chesterxgchen in #4472
• Fix Flare API multi-target command round-trip quoting by @nvshaxie in #4460
• add azure k8s devops by @YuanTingHsieh in #4465
• Enhance NVFlare CLI startup kit workflows by @chesterxgchen in #4479
• Add Helm pod annotation support by @pcnudde in #4483
• Add study support to PocEnv by @pcnudde in #4415
• Docs/syntax and grammar fixes [skip ci] by @GeorgeWang-nv in #4482
• Bump gitpython from 3.1.46 to 3.1.47 in /research/fsi-fraud-detection by @dependabot[bot] in #4480
• Support study_data.yaml dataset mounts and K8s resource config by @pcnudde in #4485
• Refine SVTPrivacy privacy accounting and release noise by @holgerroth in #4470
• fix(xgboost): correct tree count in update_model for multi:softprob (#4484) by @Hop-Le133884 in #4487
• Fix K8s custom folder imports by @pcnudde in #4491
• Fix task cleanup on workflow finalization by @pcnudde in #4493
• Harden ConDistFL checkpoint loads by @holgerroth in #4488
• Expose CSE participating clients helper option by @holgerroth in #4490
• Fail server job process on streamed submit_update decode failure by @pcnudde in #4496
• Clarify SVTPrivacy privacy accounting docs by @holgerroth in #4498
• Update available HE recipes docs by @holgerroth in #4494
• Enhance distributed provisioning workflow by @chesterxgchen in #4481
• Add user guide of brev k8s deployment by @IsaacYangSLA in #4497
• Add deploy prepare command for Docker and K8s runtime packaging by @YuanTingHsieh in #4499
• Enhance CLI agent readiness workflows by @chesterxgchen in #4500
• Document server tempdir for tensor disk offload [doc] by @pcnudde in #4495
• Clean up in-flight disk tensor downloads by @pcnudde in #4501
• Fix pull_task to enforce server-required minimum timeout by @YuanTingHsieh in #4198
• Add Auto-FL research starter bundle by @holgerroth in #4506
• Integrate deploy prepare with multicloud K8s deployment by @pcnudde in #4507
• Site config + per-site live log streaming control by @nvidianz in #4476
• Defense-in-depth zip-entry validation in zip_utils by @nvidianz in #4509
• Remove runtime provisioning builders by @YuanTingHsieh in #4511
• Add provision version support to distributed provisioning by @chesterxgchen in #4508
• Support custom FedAvg best model filename by @chesterxgchen in #4510
• Add optional system monitoring to multicloud Kubernetes deploy by @pcnudde in #4512
• Remove HA/Overseer by @nvidianz in #4503
• Add K8s launcher ephemeral storage overrides by @pcnudde in #4515
• Fix -gpu flag for nvflare poc start in Docker mode (#4445) by @MohanKrishnaGR in #4513
• [doc] Update Kubernetes deployment docs by @pcnudde in #4516
• Harden Docker job workspace isolation by @YuanTingHsieh in #4518
• Update POC Docker mode to use deploy runtime by @YuanTingHsieh in #4517

New Contributors

• @kminhta made their first contribution in #4246
• @d0uwe made their first contribution in #4311
• @christofilojohn made their first contribution in #3876
• @gn00295120 made their first contribution in #4344
• @Zare2001 made their first contribution in #4322
• @vijaygovindaraja made their first contribution in #4372
• @rollingsu made their first contribution in #4158
• @nvshaxie made their first contribution in #4444
• @Hop-Le133884 made their first contribution in #4487
• @MohanKrishnaGR made their first contribution in #4513

Full Changelog: 2.7.2...2.8.0rc1