v0.1.73

[garybowers]

v0.1.73

Security

• Fixed a missing-authorisation flaw in the admin REST API (security: any logged-in user can take over the admin account #84, CWE-862, CVSS 8.8). The API validated the session token but did not check administrator rights, so any logged-in user could reach admin-only operations such as creating admin accounts or resetting passwords. Admin endpoints now enforce administrator status, re-checked against the database on every request. Upgrading is strongly recommended for any multi-user deployment. Reported by @djnnvx.

Highlights

• UEFI Secure Boot bootloader-set wiring and Windows 24H2/25H2 network boot support; proxyDHCP now advertises the active set's bootfiles. Thanks to @NPetersenDK (Fix Secure Boot bootloader-set wiring and Windows 24H2+ netboot #96).
• In-process NFS server with a UI option for streamed live-distro roots.
• New bootimus user set-password <user> command: reset a password directly against the database without starting the server (interactive prompt, or --password for scripts). Requested by @adrianipopescu (Add bootimus user set-password subcommand to close password-reset ergonomics gap #81).
• New bootimus profiles update command: refresh the built-in distro profiles from the CLI.

Fixes

• Image download descriptions are now saved. Reported by @rgl (image download description not set #89).
• ISO filenames with an uppercase .ISO extension are handled correctly. Reported by @TannenBaum1337 (Windows Setup is not working, path not found. #68).
• MAC address substitution in the kernel boot line. Thanks to @codyro (Add MAC substition in kernel boot line #86).
• Corrected admin ASCII-art table alignment. Thanks to @rgl (fix the admin ascii-art table alignment #91).
• Updated distro profiles (Ubuntu 26.04 URLs, Linux Mint links). Thanks to @AgentK7 (Updated distro-profiles.json to reflect Ubuntu 26.04 release in Download URLs, fixed Linux Mint Download links #75, Updated distro-profiles.json #83).

Notes

• Releases are now built by GitHub Actions: tagged binaries with checksums, plus multi-arch Docker images.

Thanks to everyone who reported issues and contributed to this release: @djnnvx, @NPetersenDK, @adrianipopescu, @rgl, @TannenBaum1337, @codyro, @AgentK7.

---

This discussion was created from the release v0.1.73.