v4.3.0

What's Changed

• ci: trim the workflow_run rationale down to the commit message by @mauro-agent in #4334
• ci: add ssh-hardening job running DevSec ssh-baseline by @jimmykarily in #4306
• Add diagnostics to find out what's wrong with ssh-hardening test by @jimmykarily in #4341
• sdk: absorb into monorepo, importable at github.com/kairos-io/kairos/sdk by @jimmykarily in #4343
• Feat/monorepo dispatcher by @jimmykarily in #4344
• ci: pass prefer_secboot via env in find-ovmf-firmware action by @jimmykarily in #4339
• Feat/monorepo followups by @jimmykarily in #4353
• kairos-init: deploy the multi-call kairos binary with symlinks by @jimmykarily in #4356
• encryption tests: consume the just-built kcrypt-challenger image by @jimmykarily in #4357
• cmd/kairos: register "init" as an alias for immucore by @jimmykarily in #4366
• ci(master): build riscv64 on every master push, not release-only by @mauro-agent in #4377
• workflows: opt into actions/checkout's allow-unsafe-pr-checkout via caller-vetted-ref by @jimmykarily in #4380
• chore: drop leftover per-subdir files, refresh READMEs by @jimmykarily in #4382
• 🐛 sdk: surface OCI layer read errors by @mudler-agent in #4375
• Chore/consolidate e2e tests by @jimmykarily in #4383
• chore: declare the monorepo module as github.com/kairos-io/kairos/v4 by @jimmykarily in #4385
• ✨ sdk: resolve extension catalog artifacts by @mudler-agent in #4384
• ci: add qemu-tests-core-fips coverage by @jimmykarily in #4387
• agent: install extensions from catalogs by @mudler-agent in #4388
• Feat/ubuntu 20 qemu tests by @jimmykarily in #4389
• Feat/monorepo installer by @jimmykarily in #4396
• Fix/flaky tests registry and reboot connect by @jimmykarily in #4401
• ci: run ginkgo from tests/ instead of copying tests/go.* to repo root by @jimmykarily in #4410
• fix: let the p2p provider choose the edgevpn API address by @jimmykarily in #4411
• Feat/ci iso size diff by @thev1ndu in #4281
• Fix encrypted-partition boot flake (#4403) by @jimmykarily in #4404
• Feat/absorb provider kairos by @jimmykarily in #4422
• Fix/kubevip provider issues by @jimmykarily in #4434
• Fix/scan and version from tree by @jimmykarily in #4433
• ci: add a Security fixes section to generated release notes by @mauro-agent in #4436
• examples: add a boot audit for missing COS_PERSISTENT by @mudler in #4424
• fix(tui): hash installer passwords by @ci-robbot in #4421
• docs: fix leftover 'Box organization' reference in CONTRIBUTING.md by @mauro-agent in #4439
• ci: make yamllint strict for the OpenSSF warnings_strict criterion by @mauro-agent in #4440
• ci: enable golangci-lint on the shared lint gate by @jimmykarily in #4435
• fix(immucore): stop a boot whose mount DAG never completed by @ci-robbot in #4446
• refactor(cli): move edit-config to top-level kairos sub-tool by @jimmykarily in #4447
• ci: let iso-size-diff check out a fork PR ref by @ci-robbot in #4449
• deps: fold every pending bump from #4441 into one PR by @itxaka-agent in #4442
• ci(lint): pin golangci-lint and add local make lint-go by @jimmykarily in #4453
• 🐛 reject unsigned dm-verity sysext/confext merges under Trusted Boot by @pujitha24 in #4444
• ⬆️ Update azure/login digest to 7ddb5af by @renovate[bot] in #4406
• ⬆️ Update docker/setup-buildx-action digest to 37fe631 by @renovate[bot] in #4347
• Fix/release pipeline x crypto bump by @jimmykarily in #4478
• ⬆️ Update golang Docker tag by @renovate[bot] in #4371
• fix(uki): honour the type 2 uki key when skipping install entries by @ci-robbot in #4475
• 🐛 fix blank post-install action after Customize Further by @pujitha24 in #4443
• ⬆️ Update azure/login digest to 7ddb5af by @renovate[bot] in #4463
• test(e2e): retry the registry container on a stalled bridge port by @ci-robbot in #4481
• Fix/skip fips uki image push by @jimmykarily in #4484
• feat(kairos-init): stop shipping the suc-upgrade script by @ci-robbot in #4460
• fix(kairos-init): clear the tentative sentinel on every upgrade by @ci-robbot in #4459
• fix(sysext): install the raw extension artifacts hadron-layers publishes by @ci-robbot in #4486
• ci(encryption): wait for the API server before running kubectl by @ci-robbot in #4488
• refactor(immucore): drop the losetup binary dependency by @ci-robbot in #4461
• fix(deps): bump quic-go/webtransport-go to close memory exhaustion DoS by @mauro-agent in #4497
• fix(ci): repoint upload-cloud-images at the renamed release workflow by @mauro-agent in #4496
• fix(ci): pin kcrypt-challenger base image by digest by @mauro-agent in #4498
• docs: link the contributor ladder from CONTRIBUTING.md by @mauro-agent in #4501
• Fix decentralized Kubernetes CI module checksums by @Itxaka with @Copilot in #4516
• ⬆️ Update module github.com/google/go-containerregistry to v0.22.1 by @renovate[bot] in #4500
• fix(image): spool daemon.Image saves to disk by @ci-robbot in #4515
• fix(image): retry a pull that breaks part-way through a layer by @ci-robbot in #4492

New Contributors

• @mudler-agent made their first contribution in #4375
• @itxaka-agent made their first contribution in #4442
• @pujitha24 made their first contribution in #4444

Full Changelog: v4.2.0...v4.3.0

Security fixes

• Bump deps for CVE-2024-41110 (#84) by @Itxaka in 09e1558
• Bump yip for CVE-2024-41110 (#436) by @Itxaka in 523f363
• bump deps for CVE-2024-41110 (#361) by @Itxaka in 04a030d
• fix(deps): bump go.opentelemetry.io/otel to 1.44.0 (CVE-2026-41178) (#1318) by @wrkode in 0188f7c

Changes since previous version (v4.2.0)

Kairos v4.3.0 is the first release cut from the monorepo. The v4.2.0...v4.3.0 compare view surfaces every commit from the absorbed sub-repositories (kairos-agent, kairos-sdk, provider-kairos), so a full commit listing here would be historical noise rather than a release changelog. The new work in this release is captured in the What's Changed section above.

Component version bumps

Component	Previous	Current	Notes
kairos-init	v0.17.2	v0.17.3	#432 feat: harden sshd against the DevSec ssh-baseline
kairos-agent	v2.31.3	v2.31.4	#1346 hooks: honour ssh_hardening: true via a post-install drop-in
kairos-sdk	v0.25.2	v0.25.3	#833 schema: add ssh_hardening flag and its semantic validator

Components unchanged in this release: Immucore (v0.20.4), kcrypt-discovery-challenger (v0.13.4), provider-kairos (v2.16.4), edgevpn (v0.35.4), entities (v0.8.3), go-pluggable, yip (v1.25.1), xpasswd (v0.4.8).