v0.25.0

Highlights

Machines that fit your host

Cubic now looks at your CPU and memory before it creates or starts a machine.
Small laptops get a machine they can actually run, big workstations get a much
bigger one, and a machine that no longer fits is offered a size that does. You
can still set --cpus and --memory yourself whenever you want.

Machines also run on a full virtio device set now, which makes them faster and
lighter on the host.

Change ports without a restart

cubic modify --port and --rm-port take effect immediately on a running
machine. Expose a live service and reach it a second later.

Key only login

New machines drop the built in default password and log in by SSH key alone.
The account password is locked, so the credentials that used to be in the
source code no longer open anything. Serial console login now needs a password
you set yourself, and a new howto walks you through it. Names and usernames
are checked before they are used anywhere.

A command line that talks back

Info, warn and error messages come with colored labels in the familiar cargo
style. SSH sessions show live spinners while connecting and logging in. cubic show and cubic ports lead with what you need and keep the rest behind
--all, and -v gives you the full story when something looks off.

Ready for scripts

Cubic reports success and failure to the shell, so CI and shell scripts can
branch on the exit code. Image listing keeps working when a mirror is slow,
delete finishes quickly, and disk sizes always match the real image.

Easier to install and learn

Install on Windows with winget, or grab a ready to run binary for Linux amd64,
Linux arm64 and Windows amd64 from this release. A new documentation site adds
a getting started walkthrough and a troubleshooting guide.

What's Changed

• Improve documentation structure and content by @rogkne in #372
• fix: pin Rust toolchain to 1.92.0 in PR checks by @rogkne in #382
• fix: report missing qemu executables by @GHX5T-SOL in #380
• Remove SCP workaround as SFTP throughput issue resolved upstream by @rogkne in #383
• docs: add how-to guide for connecting via host SSH client by @rogkne in #387
• fix: update russh to 0.60.3 to address CVE-2026-46673 by @rogkne in #389
• feat: introduce Vulnlog for structured vulnerability tracking by @rogkne in #384
• chore: validate PR commit messages by @GHX5T-SOL in #386
• refactor: consolidate all plain-data models under src/models/ by @rogkne in #390
• docs: add how-to guide for recovering data from a VM disk image by @SAY-5 in #388
• feat: allow passing environment variables to the guest by @rogkne in #391
• refactor: code quality improvements across error handling and parsing by @rogkne in #392
• fix: correct workflow toolchain pinning and packaging flags by @rogkne in #393
• feat: look up edk2/OVMF firmware instead of hardcoding paths by @rogkne in #394
• Add env vars to override QEMU, qemu-img and firmware paths by @rogkne in #395
• chore: update Rust dependencies by @rogkne in #397
• ci: support release/v* branches in workflows by @rogkne in #396
• chore: improve commit message check error reporting by @rogkne in #398
• Fix Windows Compatibility by @rogkne in #401
• Cross-platform QEMU communication with mTLS by @rogkne in #403
• Add Security Documentation by @rogkne in #404
• fix: list fedora images from the stable download host by @rogkne in #406
• refactor: consolidate qemu code and let wrappers own errors by @rogkne in #408
• fix: raise the web request timeout to 30 seconds by @rogkne in #409
• fix: use canonical ssh_authorized_keys cloud-init key by @rogkne in #411
• fix: show disk size for running instances by @rogkne in #412
• feat: improve QEMU and firmware discovery by @rogkne in #414
• docs: refresh project description and documentation by @rogkne in #415
• fix: keep SSH port in sync with instance.toml by @rogkne in #416
• feat: locate QEMU modules and trim firmware blobs by @rogkne in #418
• feat: force-kill stalled VMs and detect crashed QEMU processes by @rogkne in #419
• feat: show more details in the show command by @rogkne in #420
• feat: prefer cubic SSH key and deprecate legacy auth and config by @rogkne in #421
• fix: show the configured username in console credentials by @rogkne in #422
• chore: update Rust dependencies by @rogkne in #423
• chore: trim duplicate and unused dependencies by @rogkne in #426
• chore: publish release binaries on version tags by @rogkne in #427
• fix: show running state and port forwards in instance view by @rogkne in #428
• refactor: read host username via sysinfo instead of whoami by @rogkne in #429
• docs: document minimum Rust version and dependencies by @rogkne in #430
• fix: read disk size from qcow2 image on load by @rogkne in #431
• docs: add demo GIF and update CLI help in README by @rogkne in #432
• feat: size new machine defaults from host resources by @rogkne in #433
• feat: fit machine to free memory on start by @rogkne in #434
• docs: add landing page and publish it through the build pipeline by @rogkne in #435
• docs: use Unicode emoji in README for crates.io by @rogkne in #436
• feat: use virtio devices and drop emulated defaults by @rogkne in #437
• Rework console progress animations to be width-aware by @rogkne in #438
• feat: add colored info/warn/error console output by @rogkne in #439
• fix: validate instance name arguments against path traversal by @rogkne in #472
• Docker Clean up by @rogkne in #473
• Verbose debug logging and SSH connection spinners by @rogkne in #474
• Document Windows winget Installation by @rogkne in #475
• chore: lock cargo commands in pull request workflow by @rogkne in #477
• fix: make cubic report failure to the shell by @rogkne in #478
• fix: stop unknown images from silently resolving to almalinux by @rogkne in #480
• Small Clean ups by @rogkne in #481
• fix: disable raw mode on panic by @rogkne in #482
• Route terminal prompts through Console and fix SSH password entry bugs by @rogkne in #483
• docs: allow ci, test, perf, style, build commit prefixes by @rogkne in #485
• Test Suite Clean up by @rogkne in #484
• Run cargo test on macOS and Windows for pull requests by @rogkne in #486
• docs: add GitHub pull request template by @rogkne in #487
• ci: pin cargo-audit install to its own lockfile by @rogkne in #492
• fix: resolve username from environment variables by @rogkne in #491
• fix: use forward slash for remote scp paths on Windows by @rogkne in #494
• refactor: add System trait for testable env var access by @rogkne in #496
• refactor: route console I/O through System, drop Console trait by @rogkne in #497
• refactor: run AsyncCaller on a single-threaded tokio runtime by @rogkne in #498
• docs: redesign landing page layout by @rogkne in #499
• fix: validate usernames before cloud-init and SSH (#447) by @rogkne in #501
• refactor: relay ssh/console stdio with tokio::io::copy and a shared d… by @rogkne in #502
• refactor: drop qemu-sandbox cargo feature by @rogkne in #503
• feat: apply port forwarding changes live via QEMU monitor by @rogkne in #504
• refactor: move file system access into the System trait by @rogkne in #505
• refactor: move OsSystem into its own file by @rogkne in #506
• refactor: rename the ssh_cmd module to ssh by @rogkne in #507
• fix: disable whpx acceleration on Windows by @rogkne in #508
• refactor: move process and host access into the System trait by @rogkne in #511
• refactor: group the system mock state by concern by @rogkne in #512
• refactor: move command execution into the System trait by @rogkne in #513
• refactor: turn the image store into one stateless type by @rogkne in #514
• chore: update Rust dependencies by @rogkne in #515
• Fix documentation issues by @rogkne in #516
• fix: remove the shared default password from new machines by @rogkne in #517
• docs: fix the getting started examples and add a QEMU troubleshooting page by @rogkne in #520
• refactor: mock network connections through the System trait by @rogkne in #521
• fix: parse data sizes without panics or overflows by @rogkne in #522
• fix: bound the console wait so it cannot hang forever by @rogkne in #523
• refactor: hash downloads once and buffer the writes by @rogkne in #524
• fix: a batch of small fixes to the read commands by @rogkne in #525
• refactor: split System into one trait per OS resource by @rogkne in #526
• fix: enable the security pocket for arm64 snap builds by @rogkne in #527
• fix: name only the instances that are started or stopped by @rogkne in #528
• docs: rework the landing page around the new demo gif by @rogkne in #530
• chore: update vulnlog and format vulnlog.yml by @rogkne in #529
• chore: release v0.25.0 by @rogkne in #531

New Contributors

• @GHX5T-SOL made their first contribution in #380
• @SAY-5 made their first contribution in #388

Full Changelog: v0.22.1...v0.25.0