2026.21

What’s Changed

API

Features

• Add template manager status logging by @tvi in #2647
• Distinguish joined vs regular requests in metrics by @jakubno in #2699

Improvements

• Replace per-release goroutines with shared publish worker by @jakubno in #2668
• Add configurable max concurrent evictions via feature flag by @jakubno in #2727
• Enforce one default team per user via unique partial index by @jakubno in #2621

Bug Fixes

• Keep API alive until in-flight requests complete by @jakubno in #2708

---

Auth

Features

• Add OIDC auth provider support for API and Dashboard API by @tvi in #2673
• Allow unconfigured AUTH_PROVIDER_CONFIG by @tvi in #2716

Improvements

• Move dashboard member emails to auth profiles by @ben-fornefeld in #2721
• Expose auth profile admin routes in Dashboard API by @ben-fornefeld in #2743

---

Orchestrator

Features

• Use memfd to track sandbox memory by @bchalios in #2522

Improvements

• Add self-reported status gauge with version label by @jakubno in #2667
• Add v4HeaderForUncompressed feature-flag bit by @levb in #2669
• Drain virtio-balloon free-page-hinting before pause by @ValentaTomas in #2552
• Add team-target free-page-hinting at template creation by @ValentaTomas in #2677
• Record envd init duration histograms on failures by @arkamar in #2749
• Record upload compression metrics by @ValentaTomas in #2761
• Avoid serializing upload headers twice by @ValentaTomas in #2762
• Pin UFFD copy source buffers by @ValentaTomas in #2745

Bug Fixes

• Stop health-loop leaks in Checks by @levb in #2739
• Report real V4 header compression ratio by @ValentaTomas in #2771
• Stop cloning Mapping in CloneForUpload by @levb in #2733

---

Template Manager

Improvements

• Add less, nftables, iputils-ping, and jq to base provisioning by @arkamar in #2736

Bug Fixes

• Preserve full ENV values across stdout chunks by @ValentaTomas in #2740

---

Sandbox Runtime (envd)

Improvements

• Give envd realtime I/O priority and reset priority for user processes by @ValentaTomas in #2681
• Minimize binary size with build flag tweaks by @ValentaTomas in #2664
• Extract run() to ensure defers execute on server errors by @arkamar in #2666
• Stop logging streamed payload content by @kalyazin in #2755

Bug Fixes

• Suppress repeat MMDS poll failures by @ValentaTomas in #2678
• Bound the in-memory logs queue by @ValentaTomas in #2676
• Include suppressed counts in exporter error logs by @ValentaTomas in #2680
• Fall back to lazy unmount when forced NFS unmount fails by @ValentaTomas in #2683
• Make CA install lock context-aware by @ValentaTomas in #2690
• Make /init lock context-aware to prevent retry pile-up by @ValentaTomas in #2702
• Replace env vars in /init instead of merging by @ValentaTomas in #2706
• Self-heal MMDS routing on /init lookup failure by @ValentaTomas in #2701
• Ignore closed PTY read errors by @ValentaTomas in #2769

---

Infrastructure & IaC

Features

• Support custom VPC and subnet configuration for cluster image builds by @sitole in #2633
• Support new Traefik internal entrypoint by @djeebus in #2714

Improvements

• Add ingress safe rollout support by @sitole in #2711

---

Tooling & Developer Experience

Dependencies

• Update Go to 1.26.3 by @jakubno in #2751

---

New Contributors

• @drankou made their first contribution in #2659
• @sarimrmalik made their first contribution in #2741
• @kalyazin made their first contribution in #2755

---

Full Changelog:
2026.20...2026.21