v4.2.0

Changes since previous version (v4.1.2)

Kairos changes

• chore: bump kairos-init to v0.16.1 by @mauromorales in #4238
• Add e2e test for kairos-agent kcrypt subcommands by @jimmykarily in #4274
• docs: link CLOTributor for contributors seeking issues by @thev1ndu in #4280
• Bump kairos-init by @jimmykarily in 57f9129
• Bump hadron to v0.5.1 by @jimmykarily in d156b2d
• fix: add renovate regex to match auroraboot_version by @wcrum in #4295
• ci: gate releases on a vulnerability scan of the shipped bundle by @mauro-agent in #4300
• ci: bump the factory pin to v1.3.0 by @mauro-agent in #4311
• ci: bump the factory pin to v1.4.0 and drop the Jetson SBOM attestation by @mauro-agent in #4315
• ci: pass the qemu tests only the secrets they use by @mauro-agent in #4309
• chore: bump kairos-init to v0.17.0 by @mauro-agent in #4317
• ci: clear boringcrypto false positives from the release scan by @mauro-agent in #4318
• chore: bump kairos-init to v0.17.1 by @mauro-agent in #4322
• ci: scope image-pr-arm.yaml and uki.yaml off the production quay credential by @mauro-agent in #4327
• ci: let a fork pull request build, behind a reviewer gate by @mauro-agent in #4323
• chore: bump kairos-factory-action pin to v1.4.1 by @mauro-agent in #4329
• fix: allow reusable-qemu-test.yaml's checkout to fetch a caller's ref by @mauro-agent in #4330
• ci: extend the fork-pr-builds gate to image-pr-arm.yaml and uki.yaml by @mauro-agent in #4328
• ci: sequence cloud image uploads after the release build, not the tag push by @mauro-agent in #4333
• chore: bump kairos-init to v0.17.2, clear the two edgevpn pion CVEs by @mauro-agent in #4332

kairos-init changes

• Version: v0.14.6 -> v0.17.2
• feat: place default kairos-installer at /system/installer by @mudler in #374
• Refactor kairos-installer handling and use kairos-sdk constants by @mudler in #378
• Bump bundled kairos-agent to v2.30.0 by @Copilot in #381
• Clean up riscv64 platform entries in test.yml by @Itxaka in 843d622
• Fix tpm2 dependency conflict causing zypper failure on openSUSE Leap 16.0 by @Copilot in #383
• Use kairos-sdk AgentDefaultPath when installing kairos-agent by @mauromorales in #389
• Fix Ubuntu RPi images booting the wrong kernel by @mauromorales in #395
• feat(maas): enable maas datasource provider in default datasource list by @jimmykarily in #388
• ci: recover generic arm64 hadron test jobs overwritten by rpi4 matrix includes by @Copilot in #399
• fix(packages): install riscv64 GRUB EFI packages on Debian family by @mauromorales in #398
• Always add xhci_pci_renesas module to initramfs by @Copilot in #405
• fix: skip nvdimm modules-extra workaround when package is gone by @Itxaka in #407
• fix: fail early when model arch does not match host arch by @Itxaka in #406
• fix: detect QEMU standard PC guests by @mudler-agent in #410
• Update INSTALLER_VERSION to v0.1.4 by @Itxaka in cfc82bb
• Track kairos-installer version in Makefile via Renovate by @Copilot in #416
• Bump thor l4t 39.2, trigger uefi capsule update by @mudler in #411
• fix: reserve dracut verbosity for trace logging by @mudler-agent in #417
• chore: track Jetson Thor L4T releases by @mudler-agent in #420
• ⬆️ Update dependency kairos-io/immucore to v0.20.0 by @mudler in #425
• Fix unit-test pipeline missing binaries by @jimmykarily in #426
• Bump kairos-agent by @jimmykarily in 3f78657
• fix: detect QEMU guests by DMI vendor by @mudler-agent in #418
• fix(deps): bump provider-kairos to v2.16.2 (clears 9 advisories) by @mauro-agent in #428
• Feat/publish pr images ghcr by @jimmykarily in #430
• feat: add support for Nvidia DGX Spark by @mudler in #421
• chore: bump kairos-agent, provider-kairos and kairos-installer by @mauro-agent in #433
• fix(deps): bump immucore to v0.20.3 — a non-UKI state reset boots again by @mauro-agent in #436
• fix(deps): bump kairos-agent to v2.31.3 by @mauro-agent in #438
• ci: cap the release build jobs at 30 minutes by @mauro-agent in #439
• ci: push the release images to quay, not ttl.sh by @mauro-agent in #440
• fix(deps): bump provider-kairos to v2.16.4 (clears GO-2026-6222) by @mauro-agent in #441

Immucore changes

• Version: v0.16.2 -> v0.20.4
• Update toolchain version in go.mod by @Itxaka in cecb722
• Add custom manager configuration for Go dependencies by @Itxaka in 029b513
• fix(mounts): modify vgchange command to avoid refresh by @Itxaka in #573
• fix(uki): pin sysroot tmpfs to mode 0755 by @Itxaka in #579
• feat(boot): print failure summary before emergency shell by @Itxaka in #582
• Bump yip to v1.24.1 by @jimmykarily in #586
• Make scan-pr / osv-scan non-blocking while preserving OSV reporting by @Copilot in #598
• refactor: delegate kernel cmdline parsing to kairos-sdk by @Itxaka in #600
• feat: in-RAM boot workflow by @Itxaka in #601
• feat: support in-RAM boot under trusted boot by @Itxaka in #602
• Feat/config url templating by @jimmykarily in #604
• Bump kairos-sdk to v0.25.2 by @jimmykarily in da8bd84
• fix: a missing ephemeral overlay path no longer skips every persistent bind by @bsperduto in #610
• fix: resolve the sysroot labels for an AutoReset boot by @mauro-agent in #611
• fix: install the recovery extensions on an AutoReset boot by @mauro-agent in #613
• ci: make a switch over state.Boot fail the lint when it misses a case by @mauro-agent in #614

kairos-agent changes

• Version: v2.29.4 -> v2.31.3
• fix(tui): paginate disk selection list when it overflows the terminal by @Itxaka in #1237
• feat: dispatch interactive install to external installer + progress markers by @mudler in #1240
• fix(install): skip dm devices in target auto-detection by @Itxaka in #1248
• Stop reading deprecated /etc/elemental config directory by @jimmykarily in #1247
• Potential fix for code scanning alert no. 186: Workflow does not contain permissions by @Itxaka in #1257
• Potential fix for code scanning alert no. 187: Workflow does not contain permissions by @Itxaka in #1256
• Potential fix for code scanning alert no. 188: Workflow does not contain permissions by @Itxaka in #1255
• feat: support pulling images from insecure registries by @jimmykarily in #1254
• fix: stream sysext files to avoid OOM on large extensions by @Dr-N00B in #1266
• Validate partitions fit disk by @jimmykarily in #1265
• fix(phonehome): resolve agent binary path for systemd unit by @mauromorales in #1275
• fix: run grub-install chrooted into source rootfs for non-kairos liveCDs by @jimmykarily in #1269
• Use kairos-sdk installer contract instead of private copy by @mudler in #1260
• Bump yip to v1.24.2 by @jimmykarily in #1285
• Modifying initialization sequence based on providers.paths by @Copilot in #1282
• fix(phonehome): use kairos-sdk AgentDefaultPath in systemd unit by @mauromorales in #1286
• fix(security): clear unfixed OSV findings on main by @mauromorales in #1289
• feat: announce the shutdown/reboot grace period to the user by @jimmykarily in #1284
• fix(deps): bump kairos-sdk to v0.23.3 by @mauromorales in #1295
• fix: validate partitions fit disk on UKI install by @Itxaka in #1297
• fix(upgrade): point next boot at active after system upgrade by @Itxaka in #1300
• fix(install): align extra partition filesystem semantics by @mudler-agent in #1306
• fix(partitioner): reject GPT layouts that overflow the disk by @Itxaka in #1305
• fix(phonehome): boot into automatic reset by @mudler-agent in #1307
• fix: detach loop device when image mount fails by @mudler-agent in #1310
• feat: Record install/upgrade/reset history in .kairos-state by @Itxaka in #1304
• fix(bootentry): list grubcustom entries without IDs by @mudler-agent in #1311
• fix(phonehome): store artifact downloads on persistent disk by @mudler-agent in #1312
• fix(deps): bump go.opentelemetry.io/otel to 1.44.0 (CVE-2026-41178) by @wrkode in #1318
• feat(phonehome): report node addresses and boot state on register/heartbeat by @wrkode in #1317
• test(pkg): raise coverage past 60% by @Itxaka in #1239
• refactor(runstage): delegate kairos cmdline parsing to sdk by @Itxaka in #1320
• fix(phonehome): retry transient artifact downloads by @mudler-agent in #1319
• feat: carry a configured EFI partition size through install spec by @mudler in #1321
• fix: remediate OSV scan failures (GO-2026-5841, GO-2026-5932) by @Copilot in #1323
• perf(e2e): enable KVM and share one VM across specs by @Itxaka in #1322
• Pin kairos-sdk to released v0.25.0 by @Copilot in #1327
• chore(deps): consume legacy unlock SDK fix by @mudler-agent in #1332
• Feat/config url templating by @jimmykarily in #1330
• chore: bump golang.org/x/mod to v0.40.0 by @mauro-agent in #1341
• fix(deps): bump golang.org/x/image to v0.45.0 by @mauro-agent in #1342
• fix(runstage): a bad cmdline config_url must not skip the cloud-init files by @mauro-agent in #1344

kairos-sdk changes

• Version: v0.22.0 -> v0.25.2
• Port OCIImageExtractor from kairos-agent by @jimmykarily in #776
• feat(agentrun): add package to drive kairos-agent manual-install by @mudler in #777
• feat(agentrun): add installer-contract constants (events, steps, env) by @mudler in #778
• fix(ghw): skip kernel-hidden block devices in GetDisks by @Itxaka in #784
• Add installer path constants and resolution helpers by @mudler in #785
• feat(agentrun): add RunWithOutput to capture the full agent transcript by @mudler in #792
• Open source ISO read-only in ExtractFileFromIso by @Copilot in #796
• feat(constants): add shared kairos-agent install path contract by @mauromorales in #794
• fix(deps): migrate from EOL containerd v1 archive to containerd/v2 by @jimmykarily in #798
• fix: resolve remaining OSV scanner findings (go-attestation) by @mauromorales in #799
• feat: power off immediately with shutdown now by @jimmykarily in #797
• fix(utils): add openSUSE riscv64 GRUB EFI path to GetEfiGrubFiles by @mauromorales in #806
• fix(security): bump Go to 1.26.5 and ignore GO-2026-5932 by @mauromorales in #807
• fix(schema): validate stage command lists by @mudler-agent in #813
• feat(cmdline): centralize kairos.config and cos.setup parsing by @Itxaka in #812
• Bump google.golang.org/grpc to v1.82.1 to fix osv-scan failure by @Copilot in #814
• feat(state): node network addresses + non-UKI autoreset detection by @wrkode in #816
• feat: let SetFirmwarePartitions honor a configured EFI size by @mudler in #818
• feat: add in-RAM boot detection for the kairos.ram namespace by @Itxaka in #819
• feat(utils): add live media grub paths by @mudler-agent in #823
• feat(collector): template config_url before fetching by @jimmykarily in #820
• Fix OSV scanner reports by @jimmykarily in #824
• fix(kcrypt): unlock legacy unlabeled partitions by @mudler-agent in #822

kcrypt-discovery-challenger changes

• Version: v0.13.2 -> v0.13.4
• ci(osv): own the scanner setup instead of the reusable workflow by @jimmykarily in #248
• Fix challenger_server URL when it has a trailing slash by @jimmykarily in #249
• chore(deps): bump controller-runtime to v0.24.1 and k8s to v0.36.3 by @jimmykarily in #250
• chore: build with Go 1.26.6 by @mauro-agent in #267

provider-kairos changes

• Version: v2.16.1 -> v2.16.4
• fix: default EdgeVPN API to Unix socket by @mudler-agent in #944
• chore: build with Go 1.26.6 by @mauro-agent in #960
• fix(deps): bump golang.org/x/image to v0.45.0 by @mauro-agent in #961

edgevpn changes

• Version: v0.35.2 -> v0.35.4
• Fix typo --peerguardian flag in docs by @julianpistorius in #1010
• react UI design system by @mudler in #1063
• fix: repair HTTP egress, the proxy subcommand and ledger ownership by @localai-bot in #1064
• Fix/proxy egress ownership by @mudler in #1066
• fix: correct license badge in README from GPL3 to Apache 2.0 by @Copilot in #1072
• fix(deps): bump pion/stun to v3.1.5 and pion/dtls to v3.1.4 (2 CVEs) by @mauro-agent in #1075

entities changes

• No changes (v0.8.3)

go-pluggable changes

• No changes (v0.0.0-20230126220627-7710299a0ae5)

yip changes

• Version: v1.24.0 -> v1.25.1
• Maas datasource by @jimmykarily in #302
• fix(deps): migrate from EOL containerd v1 archive to containerd/v2 by @jimmykarily in #307
• fix(users): keep uids stable when adding a user between existing ones by @Itxaka in #308
• fix(layout): keep expanded partitions inside the last usable sector by @mudler in #316

xpasswd changes

• Version: v0.4.7 -> v0.4.8
• No changes

New Contributors

• @thev1ndu made their first contribution in #4280
• @wcrum made their first contribution in #4295
• @mauro-agent made their first contribution in #4300

Full Changelog: v4.1.2...v4.2.0