-
Notifications
You must be signed in to change notification settings - Fork 1
Release Notes
Every BootstrapMate for Windows release, newest first, with the changes that went into it. Use this page to work out which version introduced a behaviour you are seeing, and what upgrading will change. Each entry lists the commit subjects in that release; where a change altered behaviour an administrator would notice, that is called out.
Releases are tagged vYYYY.MM.DD.HHMM — the build timestamp, not semantic versioning. There is no
notion of a major, minor or patch release; a later tag is just a later build. The tag date shown
below is when the tag was created, which can sit a few hours either side of the timestamp encoded in
the version string.
Inside the MSI, the same version is recorded in the shortened YY.M.D.HHMM form that Windows
Installer requires. See
Building and Signing for both schemes and a
worked example.
Pushing a v* tag runs the release workflow, which publishes a GitHub Release containing, for each
of x64 and arm64:
BootstrapMate-<arch>-<version>.msi-
BootstrapMate-<arch>-<version>.zip, containingmanagedbootstrapinstall.exeand the GUI
Those artifacts are unsigned. Sign them with your own code signing certificate before you
distribute them, or build locally with build.ps1, which signs as part of the build. The
release notes generated by the workflow say the same thing.
d77f76c Give each run a session directory with structured events (#21, #22)
519dd72 Fail the run when its packages failed (#23)
Two changes an administrator will notice.
Logs moved. A run now writes to its own directory,
C:\ProgramData\ManagedBootstrap\logs\<yyyy-MM-dd>\<HHmmss>\, holding bootstrap.log beside
events.jsonl and session.json rather than a single flat file at the logs root. Anything that
globbed logs\*.log needs to recurse. Retention now drops day directories past the 30-day window
and session directories past a cap of 100, and still sweeps the flat files the old layout left.
See Logging and Reporting.
A run whose packages failed now says so. Package failures are still caught so the run continues,
but they are carried out of the loop: the phase is marked Failed with the failed names,
LastRunVersion is not written, the log ends BootstrapMate completed with N failed package(s),
and the run summary POSTs success: false. Before this, such a run recorded a clean completion
and a detection rule reading LastRunVersion never retried it. The process exit code was not
changed and is still 0. If you deploy with an Intune detection rule on LastRunVersion, expect
devices whose packages have been failing silently to start failing detection and reinstalling.
e9c0498 Stamp output captured from a package's own process (#20)
Output captured from an installer's own stdout and stderr is now written one stamped line at a time rather than as a single stamped block, so a multi-line block of package output no longer sits undated in the middle of a log. See Logging and Reporting.
61c8231 Write log lines in the shared session log format and fix the -v flag (#19)
The log file adopts the shared session log format, and -v is fixed to mean verbose. Note that
-V prints the version only when it is the first argument; anywhere else it is treated as -v.
See Command Line Reference.
1894d18 Expire session logs older than the retention window (#17)
Session logs are pruned at startup against a 30-day retention window, based on each file's last write time. Before this, the log directory grew without bound. Superseded in part by v2026.09.04.0436, which prunes session directories as well.
5d3d40d Scope the policy Authorization header to the manifest host (#13)
The configured Authorization header is now attached only to requests whose host matches the
manifest's host. Package downloads from any other host go out without it. This fixes downloads that
failed with Download failed: Forbidden because a storage backend rejected an unvalidatable
Authorization header on an otherwise public object.
04e72ac Serialize concurrent sessions; demote critical-package retry note to Info (#12)
Concurrent invocations serialize behind a global mutex instead of colliding, and the critical-package retry notice was demoted from a warning to Info.
050e6bf installer: wait on _MSIExecute mutex instead of failing on 1618 (#9)
MSI error 1618, another Windows Installer transaction already running, is no longer a package
failure. BootstrapMate waits on the Global\_MSIExecute mutex before each launch, and a 1618
result is retried without consuming the retry budget. See
Retries and Timeouts.
07d998d Rename CLI executable to managedbootstrapinstall.exe (#8)
b19f5fc Upgrade GitHub Actions to Node24-compatible versions
742573a Post a vendor-neutral run summary on completion (#7)
7974e4e Rename policy detector and references to Management (#6)
5930b1e Verify installer Authenticode signatures before running elevated (#5)
5c15b89 Strip user attribution from generated release notes
Two changes matter operationally. The command-line executable was renamed to
managedbootstrapinstall.exe; the MSI removes the previous installapplications.exe on install, so
scripts and scheduled tasks referencing the old name need updating. And MSI and EXE packages are now
Authenticode-verified before they are run elevated — see
Security and Package Verification. A run summary can also be
POSTed to a configured reporting endpoint on completion.
076a7be wxs: delegate post-install to SelfHeal scheduled task (avoids MSI mutex deadlock) (#4)
The MSI no longer invokes the executable directly from a deferred custom action, which deadlocked
against the Windows Installer mutex the install itself held. It triggers the BootstrapMate Self-Heal scheduled task instead. See Deployment.
2160039 wxs: avoid -- in XML comment body (WIX0104)
fe87294 config: HKLM Settings fallback + baked-in default URL; MSI registers self-heal task and runs --force --no-dialog
Machine-scope settings under HKLM became part of the configuration chain, a default manifest URL
was baked into the binary, and the MSI began registering the daily self-heal scheduled task. See
Preferences.
68403ce ci(release): drop duplicate TZ env key (broke YAML parse)
7899695 fix: Start Menu shortcut + KB display for sub-MB downloads (#3)
9b98d86 release: drop "for Windows" suffix from title
239d30b release(ci): styled release notes + Vancouver timezone
e949260 fix(msi): ship WinUI 3 GUI; pick host-arch makepri.exe (#2)
e815814 Split combined release.yaml into ci.yml + release.yml
The WinUI 3 GUI began shipping inside the MSI from this release.
0bb5dc2 docs: Add SignTool signing instructions to GitHub Release notes
The first tagged release. Everything before it is untagged development, including the initial WinUI
3 GUI, the release workflow, YAML manifest support, the progress dialog, and the switch to
OSArchitecture for architecture detection so an x64 binary under ARM64 emulation reports ARM64.
Between this tag and v2026.05.09.1757, notable untagged work included
f2258eb Attach AuthorizationHeader from policy to all HTTP requests,
7d4956d Prefer sbin-installer for cimipkg-built MSI packages,
eff4310 Mark .pkg installation case for sunset in bootstrap,
622dc66 Resolve conflicts: complete Intune CSP/OMA-URI refactoring, remove run.ps1 and BootstrapUrl approach, and
c80f4cc fix(build): reliable signtool resolution on clean Windows SDK hosts (#1).
Each new v* tag adds a section to the top of this page, with the tag, the commits it contains, and
a note on any change that alters behaviour an administrator would notice.