17.0.0-lts

What's Changed

• Collect-Info: put after post by @christoph-zededa in #5302
• spec.sh -v - print valid json by @christoph-zededa in #5312
• [storage-init.sh] recreate /persist correctly for eve-k by @eriknordmark in #5313
• eve-k: reduce idle logging, ignore api outage during failover by @andrewd-zededa in #5314
• Update and pin GitHub actions to latest commit hashes by @shjala in #5316
• Enable automatic TCP MSS clamping for forwarded app traffic by @milan-zededa in #5319
• Allow node uuid label to be repleaced in cluster by @naiming-zededa in #5320
• Bump eden version to 1.0.13 by @europaul in #5323
• Fix a bug where edgeview tcp/kube set port number incorrectly by @naiming-zededa in #5324
• Put device in maintenance mode if no edge node certs by @eriknordmark in #5328
• Introduce Internal Memory Monitor for Pillar by @OhmSpectator in #5330
• pillar: go mod tidy by @eriknordmark in #5335
• Use Pubsub Large to handle large KubeClusterInfo structures. by @andrewd-zededa in #5336
• Fixed issue with threshold column in SMART Attributes by @jsfakian in #5337
• Remove LiveMigration feature gate by @zedi-pramodh in #5338
• MAINTAINERS: Add Shah by @eriknordmark in #5339
• Delete VMPersistentState support for EFI bootloader by @zedi-pramodh in #5340
• Add Zizmor workflow by @shjala in #5341
• eve-k fixes app delete, tie-breaker failover by @andrewd-zededa in #5342
• .golangci.yml: Update config to newer versions of golangci-lint by @rene in #5345
• Add async notification support to MemoryDriver for event-driven testing by @rucoder in #5348
• docs: add security policy and architecture documentation by @shjala in #5349
• Add a proper error message when user tries to share a file-based volume between apps by @europaul in #5350
• Evaluation EVE: Automatic Partition Testing and Onboarding Control by @rucoder in #5351
• Interleave DNS servers across interfaces inside resolv.conf to mitigate resolver limit issues by @milan-zededa in #5357
• build(deps): bump github.com/containerd/containerd/v2 from 2.1.3 to 2.1.5 in /tools/dockerfile-from-checker by @dependabot[bot] in #5359
• build(deps): bump github.com/containerd/containerd from 1.7.27 to 1.7.29 in /pkg/pillar by @dependabot[bot] in #5360
• Harden NI Reconciler to prevent and recover from dnsmasq host file conflicts by @milan-zededa in #5361
• build(deps): bump github.com/containerd/containerd from 1.7.27 to 1.7.29 in /pkg/wwan/mmagent by @dependabot[bot] in #5362
• build(deps): bump github.com/opencontainers/selinux from 1.11.0 to 1.13.0 in /pkg/newlog by @dependabot[bot] in #5363
• Omit empty fields in dpc.go on JSON serialization by @OhmSpectator in #5364
• build(deps): bump github.com/opencontainers/selinux from 1.11.0 to 1.13.0 in /pkg/pillar by @dependabot[bot] in #5365
• build(deps): bump github.com/containerd/containerd from 1.7.27 to 1.7.29 in /pkg/newlog by @dependabot[bot] in #5366
• build(deps): bump github.com/containerd/containerd/v2 from 2.1.4 to 2.1.5 in /eve-tools/bpftrace-compiler by @dependabot[bot] in #5367
• Fix issue of zedkube publish Kube Status without token by @naiming-zededa in #5368
• Updated eve-libs to support resume for http datastores by @jsfakian in #5370
• eve-k: Enable ext4 vault support by @andrewd-zededa in #5373
• Set unique per-interface route metrics for components not using source-based routing by @milan-zededa in #5374
• eve-k: don't block during kubevirt-operator delete by @andrewd-zededa in #5375
• Bump lf-edge/edge-containers by @eriknordmark in #5376
• build(deps): bump github.com/containerd/containerd/v2 from 2.1.4 to 2.1.5 in /tools/get-deps by @dependabot[bot] in #5377
• build(deps): bump github.com/opencontainers/selinux from 1.11.0 to 1.13.0 in /pkg/wwan/mmagent by @dependabot[bot] in #5378
• installer: Update crossbeam-channel to 0.5.15 by @eriknordmark in #5379
• mmagent: apply route metric received from NIM by @milan-zededa in #5382
• tui: update to release 0.6.2 by @rucoder in #5392
• Use Yetus container from lfedge/eve-yetus by @rene in #5397
• Add dynamic PCR policy support for disk key sealing by @shjala in #5398
• Build yetus image on demand by @rene in #5399
• Add Eden version selection based on PR target branch by @europaul in #5402
• Edge apps are not activated after rolling back from a snapshot by @jsfakian in #5403
• Fix rungetty.sh to strip non-numeric suffix from console speed parameter by @rucoder in #5404
• Convert vtpm Dockerfile to use automatic hashes by @rucoder in #5405
• Kernel update - [amd64-generic] by @rene in #5406
• github/workflows: Update CodeQL by @rene in #5407
• bump runc to v3.3.0, containerd to v2.2.0; addresses critical CVEs by @deitch in #5409
• eve-k: Increment EFI and rootfs partition size by @rene in #5410
• Fixes newc initrd filename null termination by @sultatos in #5412
• Fix MMIO overhead calculation for unreserved adapters by @OhmSpectator in #5413
• build(deps): bump golang.org/x/crypto from 0.41.0 to 0.45.0 in /pkg/pillar by @dependabot[bot] in #5414
• build(deps): bump golang.org/x/crypto from 0.39.0 to 0.45.0 in /tools/dockerfile-from-checker by @dependabot[bot] in #5415
• github/workflows: Move go-tests action to self-hosted runners by @rene in #5421
• github/workflows: Fix go-tests Docker login by @rene in #5422
• Fix log.Errorf usage by @eriknordmark in #5423
• build(deps): bump golang.org/x/crypto from 0.41.0 to 0.45.0 in /pkg/vtpm/swtpm-vtpm by @dependabot[bot] in #5424
• build(deps): bump golang.org/x/crypto from 0.41.0 to 0.45.0 in /pkg/edgeview by @dependabot[bot] in #5425
• Add udev to installer and implement cold start by @rucoder in #5430
• github/workflows: Fix go-tests Docker login by @rene in #5431
• github/workflows: Give secret access to go-tests by @rene in #5432
• Bpftrace compiler increase timeout by @christoph-zededa in #5437
• build(deps): bump golang.org/x/crypto from 0.41.0 to 0.45.0 in /eve-tools/bpftrace-compiler by @dependabot[bot] in #5438
• build(deps): bump golang.org/x/crypto from 0.42.0 to 0.45.0 in /tools/get-deps by @dependabot[bot] in #5439
• pillar container: set proper root overlayf by @deitch in #5441
• build(deps): bump golang.org/x/crypto from 0.41.0 to 0.45.0 in /pkg/recovertpm/src by @dependabot[bot] in #5452
• build(deps): bump golang.org/x/crypto from 0.41.0 to 0.45.0 in /pkg/newlog by @dependabot[bot] in #5456
• build(deps): bump golang.org/x/crypto from 0.41.0 to 0.45.0 in /pkg/installer/src by @dependabot[bot] in #5457
• build(deps): bump golang.org/x/crypto from 0.41.0 to 0.45.0 in /pkg/wwan/mmagent by @dependabot[bot] in #5458
• tools/collect-sources.sh: Exclude var/lock from tarball extraction by @rene in #5459
• tools/collect-sources.sh: Fix comment by @rene in #5460
• Fix flaky GoroutinesMonitor Go test by @OhmSpectator in #5467
• Update linuxkit/sysctl by @deitch in #5471
• github/workflows: Run zizmor only on EVE's GH workflows by @rene in #5472
• Bump linuxkit/runc and linuxkit/memlogd by @deitch in #5476
• build: fix LIVE_UPDATE=1 live target for ext4 rootfs by @europaul in #5479
• Use nvidia-container-runtime to load CDI devices through kubernetes by @zedi-pramodh in #5480
• bpftrace-compiler: increase overall test timeout by @christoph-zededa in #5481
• Bump k3s version to v1.34.2+k3s1 by @zedi-pramodh in #5483
• Improve robustness of TestSingleDPC by @milan-zededa in #5484
• Updated runc in installer and rootfs by @deitch in #5486
• fix(agentlog): use proper file permissions when appending logs by @shjala in #5487
• Bump up KUBE_VERSION by @zedi-pramodh in #5489
• pkg: nvidia: Bump nvidia-container-toolkit to 1.16.2 by @rene in #5490
• Change the Edgeview script expire to human readable time by @naiming-zededa in #5491
• Fix an issue of zedkube EdgeNodeClusterStatus Miss token by @naiming-zededa in #5492
• Fix VLAN sub-interface dependencies by @milan-zededa in #5493
• Allow k3s config overrides from config property k3s.config.override by @andrewd-zededa in #5495
• Non cancelable context by @europaul in #5497
• Add missing Intel AX210 (TY) firmware required by iwlwifi by @jsfakian in #5503
• Copy nvidia device plugin only on nvidia platform by @zedi-pramodh in #5504
• Replace MD5 with a cryptographically secure random IV generation by @naiming-zededa in #5505
• spec.sh json output fix for pkg/debug build. by @andrewd-zededa in #5506
• Configure USB priority in VM boot order by @OhmSpectator in #5507
• Enable strict node scheduling for cluster app instances. by @andrewd-zededa in #5508
• .github/workflows: Change docker login and remove pull_request_target by @rene in #5512
• pkg/debug: fix spec.sh to print valid json by @christoph-zededa in #5520
• Fix cluster join: k3s 1.34.0+k3s1 does not set master label. by @andrewd-zededa in #5521
• Support ClusterType EVE-API for modes by @andrewd-zededa in #5522
• pkg/installer: bump debug package by @christoph-zededa in #5523
• installer: align rust package by @christoph-zededa in #5524
• gh/template: add backport branch by @christoph-zededa in #5525
• Makefile: add canbus for qemu by @christoph-zededa in #5529
• migrate message encryption to AEAD (AES‑GCM) + HKDF by @naiming-zededa in #5530
• eve-k: Accept an override k3s version for upgrades by @andrewd-zededa in #5531
• Enable edgeview certificate validation by @naiming-zededa in #5532
• Fix device config props handling in maybeRetryBoot. by @OhmSpectator in #5533
• CI: Eden status fix by @europaul in #5534
• Send HW inventory by @europaul in #5535
• Convert from bytes.Equal into hmac.Equal by @naiming-zededa in #5540
• eve-k: Handle k3s restarts in k3s components update path. by @andrewd-zededa in #5544
• Add device bound MAC address for Network Instance by @naiming-zededa in #5545
• Fix QMP flooding on VM restart. by @OhmSpectator in #5548
• installer: use current debug container by @christoph-zededa in #5549
• Revert "Add null key verification to detect TPM reset attacks" by @shjala (#5550) in [#5550](backport of #5214)
• pr-gate: increase limit for gh tool by @europaul in #5551
• Load TLS root CA directly from /config instead of /persist/certs by @shjala in #5553
• Revert automatic lkt hashes by @christoph-zededa in #5554
• Fix the issue of eve-k VM logging, got five-five-five-five! by @naiming-zededa in #5555
• continue the migrate message encryption to AEAD PR by @naiming-zededa in #5556
• pillar: use current uefi container by @christoph-zededa in #5558
• Do not check for network connection everytime by @zedi-pramodh in #5559
• github/workflows: Fix image name on buildyetusondemand.yml by @rene in #5560
• Remove /config/v2tlsbaseroot-certificates.pem - use root CAs from rootfs by @eriknordmark in #5561
• Fix IPv4-only mode for static IPv4 configuration by @milan-zededa in #5565
• pillar/usbmanager: use ghw library by @christoph-zededa in #5568
• Remove noisy logging and remove previous external boot images by @naiming-zededa in #5570
• Fix the issue of eve-k shim/container VMI logging by @naiming-zededa in #5571
• Do not download contenttree on all nodes by @zedi-pramodh in #5572
• Fix edgeview encryption change issue from previous PR 5556 by @naiming-zededa in #5573
• fix: clean log w/o removing non-standard fields by @europaul in #5574
• Move wpa_supplicant into pillar and remove wlan container by @milan-zededa in #5575
• docs : update link to security architecture document in CONFIG.md by @shjala in #5576
• pkg/pillar: skip TestPciLongExists in unit tests by @shjala in #5583
• Simplify/remove /persist/status/zedagent/* by @eriknordmark in #5584
• Improve or refine the Error statement in EVE installation logs by @jsfakian in #5585
• pkg/kvm-tools: delete by @christoph-zededa in #5586
• Makefile: add eden target for running Eden tests by @shjala in #5587
• pillar: make URL joins use url.JoinPath by @europaul in #5588
• pkg/grub: get source from git instead of tar.gz by @europaul in #5589
• Update vTPM to work with latest evetpm changes by @shjala (#5591) in [#5591](backport of #5398)
• Makefile: Fail for unsupported hypervisor by @rene in #5592
• CI: Add automated CVE scanning gate for PRs by @shjala in #5593
• docs: update supported versions in SECURITY.md by @shjala in #5594
• newlog: fix ANSI escape code stripping by @europaul in #5596
• Support Remote-console and Edgeview-UI VNC for eve-k by @naiming-zededa in #5598
• docs: Add comprehensive kernel documentation by @rucoder in #5599
• pkg/apparmor: bump to v4.1.3 by @christoph-zededa in #5601
• eve-k: set longhorn node-down-pod-deletion-policy by @andrewd-zededa in #5603
• SR-IOV: Fix API logic and add I350 NIC support by @uncleDecart in #5604
• Tune kube-controller-arg and kube-controller-manager-arg for cpu/net availability by @andrewd-zededa in #5605
• Fix linter warnings in shell scripts and Dockerfile syntax by @rucoder in #5607
• Kernel update - [amd64-generic] - Introduce NUMA support by @rucoder in #5608
• Fix for code scanning alert 1496: Use of a broken or weak cryptographic hashing algorithm on sensitive data by @eriknordmark in #5609
• edgeview: Fixed appearance of being able to open arbitrary files by @eriknordmark in #5610
• Fix for code scanning alert no. 75: Clear-text logging of sensitive information by @eriknordmark in #5612
• Fix 'Incorrect conversion between integer types' from CodeQL by @eriknordmark in #5613
• Disable LED disk enforcement by @rene in #5614
• mock all inventory commands in evalmgr tests by @rucoder in #5615
• pkg/pillar: update zededa/ghw library by @christoph-zededa in #5617
• zedmanager: drive purge state machine to completion in doUpdate by @rucoder in #5618
• Redact debug logging in execRawCmd to QMP by @eriknordmark in #5619
• pillar: nireconciler: fix "already connected" error on app re-activation by @rucoder in #5620
• eve-k: Enable local-path storage for CLUSTER_TYPE_K3S_BASE by @andrewd-zededa in #5622
• Support kvm use virtio-vga device for higher resolution VNC console by @naiming-zededa (#5623) in [#5623](backport of #5638)
• pillar: NOHYPE direct-attach network interface passthrough by @rucoder in #5624
• grub: increase kernel ring buffer size to 2MB by @rucoder in #5627
• gpt-tools: support multiple sector sizes by @rene in #5628
• eve: add "app" subcommands for user application management by @rucoder in #5629
• update kubevirt api kubevirt.io/api and client-go to v1.6.0 by @naiming-zededa in #5630
• 010-eve-cgroup: skip soft_limit_in_bytes writes on RT kernels by @rucoder in #5635
• Fix "Incorrect conversion between integer types" for nCPUs by @eriknordmark in #5636
• eve-k: fix node delete if replicas list encounters crd get error by @andrewd-zededa in #5637
• kubevirt: Support kubevirt use virtio device by @naiming-zededa in #5638
• remove acrn hypervisor support by @christoph-zededa in #5640
• build(deps): bump go.opentelemetry.io/otel/sdk from 1.37.0 to 1.40.0 in /tools/dockerfile-from-checker by @dependabot[bot] in #5641
• build(deps): bump go.opentelemetry.io/otel/sdk from 1.38.0 to 1.40.0 in /tools/get-deps by @dependabot[bot] in #5642
• build(deps): bump go.opentelemetry.io/otel/sdk from 1.38.0 to 1.40.0 in /eve-tools/bpftrace-compiler by @dependabot[bot] in #5643
• pkg/xen-tools: remove unused firmware by @christoph-zededa in #5645
• github/workflows: Build x86 + arm64 Yetus images at once by @rene in #5646
• Fix: the issue of kubevirt feature backwards compatibity by @naiming-zededa in #5647
• Refactor and fix network tracing integration in controllerconn by @milan-zededa in #5648
• remove deitch from CODEOWNERS by @deitch in #5649
• Bump alpine 3.22 by @christoph-zededa in #5650
• pkg/fw: add Intel Wi-Fi 6E AX211 firmware for ASUS-NUC14SRK by @rucoder in #5651
• build(deps): bump github.com/docker/cli from 28.4.0+incompatible to 29.2.0+incompatible in /tools/get-deps by @dependabot[bot] in #5653
• build(deps): bump github.com/docker/cli from 28.3.3+incompatible to 29.2.0+incompatible in /eve-tools/bpftrace-compiler by @dependabot[bot] in #5655
• build(deps): bump github.com/docker/cli from 28.3.0+incompatible to 29.2.0+incompatible in /tools/dockerfile-from-checker by @dependabot[bot] in #5656
• go-tests.yml: remove pull request target by @europaul in #5657
• pkg/pillar: remove unsupported linuxkit build.yml fields by @rucoder in #5662
• Fix: cluster-ip should not be part of the source ip for SendOnIntf by @naiming-zededa in #5663
• README: update Onlogic FR201 installation and boot configuration by @sultatos in #5664
• build.yml: fix eve job cache handling by @europaul in #5665
• pkg/fw: add Intel Wi-Fi 6E AX1690i/AX211 gf4 firmware for NUC12SNKi7 by @rucoder in #5666
• Makefile: let docker hash check ignore eden by @christoph-zededa in #5667
• pkg/storage-init: Fix CONFIG partition tmpfs size by @rene in #5668
• Update Eden to version 1.0.14 by @eriknordmark in #5671
• Fix: remove stale flannel.1 before restart k3s by @naiming-zededa in #5672
• hypervisor/kubevirt: implement CPU pinning for HV=k (KubeVirt) by @zedi-pramodh in #5676
• Improve logging in cpuallocator by @zedi-pramodh in #5677
• mini-yetus: fix Docker image tag to match CI by @rucoder in #5679
• tools: add little helper to bump Dockerfiles by @christoph-zededa in #5680
• Fix Eden version bump: keep 16.0-stable on 1.0.13 by @europaul in #5682
• add controller-driven kube-vip load balancer for K3S_BASE clusters by @naiming-zededa in #5683
• dom0-ztools: bump ZFS to 2.3.6 by @rucoder in #5684
• build(deps): bump google.golang.org/grpc from 1.75.0 to 1.79.3 in /pkg/pillar by @dependabot[bot] in #5685
• Intel iGPU passthrough support for KVM with UEFI by @rucoder in #5686
• build(deps): bump google.golang.org/grpc from 1.73.0 to 1.79.3 in /tools/dockerfile-from-checker by @dependabot[bot] in #5687
• build(deps): bump google.golang.org/grpc from 1.75.0 to 1.79.3 in /eve-tools/bpftrace-compiler by @dependabot[bot] in #5688
• build(deps): bump google.golang.org/grpc from 1.75.1 to 1.79.3 in /tools/get-deps by @dependabot[bot] in #5689
• build(deps): bump google.golang.org/grpc from 1.75.0 to 1.79.3 in /pkg/wwan/mmagent by @dependabot[bot] in #5690
• Add SCEP certificate enrollment and 802.1x port-based network access control (PNAC) by @milan-zededa in #5691
• Provide manual k3s stop and start option by @mrangana in #5694
• build(deps): bump google.golang.org/grpc from 1.75.0 to 1.79.3 in /pkg/newlog by @dependabot[bot] in #5695
• build(deps): bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 in /pkg/pillar by @dependabot[bot] in #5696
• mmdbus: improve eSIM detection using EID and handle missing slot paths by @milan-zededa in #5697
• bump_eve_pillar to update pkg/edgeview, pkg/vtpm, and pkg/wan by @eriknordmark in #5698
• Makefile: use linuxkit env vars for org and builder config by @europaul in #5700
• build: add HV=k package build to PR workflow by @europaul in #5702
• build(deps): bump github.com/moby/buildkit from 0.23.1 to 0.28.1 in /tools/dockerfile-from-checker by @dependabot[bot] in #5704
• build(deps): bump github.com/moby/buildkit from 0.23.2 to 0.28.1 in /eve-tools/bpftrace-compiler by @dependabot[bot] in #5705
• Fix a race condition when eve-k app restart app lost IP address by @naiming-zededa in #5706
• pkg/grub: include EFI status code in "unknown TPM error" message by @rucoder in #5708
• update linuxkit by @europaul in #5709
• pkg/grub: migrate to GRUB 2.12 by @rucoder in #5710
• Add salted HMAC session with AES-128-CFB parameter encryption for TPM seal/unseal by @shjala in #5711
• installer: create EFI NVRAM boot entry for EVE-OS after installation by @rucoder in #5712
• ci: update GitHub Actions to Node.js 24 compatible versions by @rucoder in #5713
• build: stop exporting GOOS=linux globally by @rucoder in #5714
• downloader: fix SAS token corruption in constructDatastoreContext by @jsfakian in #5715
• ci: reduce unit test CI time by running fuzz tests in a separate job by @shjala in #5716
• Revert "build(deps): bump github.com/moby/buildkit" by @rene in #5717
• readthedocs.yaml: Bump Ubuntu and Python versions by @rene in #5718
• zedagent: report EtcdSnapshot optional capability by @zedi-pramodh in #5719
• Fix an issue of edge-node clustering interface using logical-label by @naiming-zededa in #5720
• ci: use Eden workflow from 1.0.15 tag by @europaul in #5727
• .github: run cvewatch after build by @christoph-zededa in #5729
• nvidia: Improve CDI and .deb package processing by @rene in #5731
• pkg: exclude Dockerfile from COPY in all packages by @christoph-zededa in #5732
• mkdocs.yml: Fix broken links in documentation by @rene in #5733
• Unify partition layout: 2GB (EFI) + 4GB (rootfs) by @rene in #5735
• eden: Use backport branches instead of tagged releases by @europaul in #5736
• ci: cancel stale Go Tests runs on force-push by @rucoder in #5738
• build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 in /pkg/pillar by @dependabot[bot] in #5739
• Update go-jose to v4.1.4 by @eriknordmark in #5740
• build: add workflow to bootstrap eve-alpine-base on demand by @rucoder in #5741
• zedmanager: fix purge stuck when app was never activated by @eriknordmark in #5742
• rust: bump time to 0.3.47 in pkg/installer (fix CVE-2026-25727) and update rustc to 1.93.1 by @eriknordmark in #5744
• Move kube-save-var-lib under vault by @andrewd-zededa in #5745
• build: use unique hash for alpine-base bootstrap to avoid cache collisions by @rucoder in #5747
• hypervisor/kubevirt: use purge counter in VMI ReplicaSet name to fix purge collisions by @zedi-pramodh in #5748
• Update eve-alpine hash by @eriknordmark in #5749
• build: add musl-cross-make cross-compiler build infrastructure by @rucoder in #5752
• Avoid issues when upgrading to checkpointed controllercerts by @eriknordmark in #5754
• pkg/pillar: fix arm64→amd64 cross-compilation for Alpine 3.22 / GCC 14 by @zedi-pramodh in #5755
• Disable github actions to choose jumbo runners / increase build timeout by @christoph-zededa in #5756
• ci: fix empty with: block in cross-compilers workflow by @rucoder in #5757
• ci: add actionlint check for workflow files by @rucoder in #5758
• tests/eden: use EDEN_HOME for config isolation by @shjala in #5760
• pkg/uefi: enable parallel builds with -j/-n $(nproc) by @rucoder in #5761
• Fix an issue of cluster loadbalancing using logical-lable by @naiming-zededa in #5763
• alpine 3.22: Only update hash in pkg/recovertpm/Dockerfile by @eriknordmark in #5764
• eve-k pillar: upgrade longhorn-manager to v1.9.1 and fix BackupTargetName on failover by @andrewd-zededa in #5765
• build(deps): bump github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream from 1.6.10 to 1.7.8 in /pkg/pillar by @dependabot[bot] in #5766
• build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.80.0 to 1.97.3 in /pkg/pillar by @dependabot[bot] in #5767
• Introduces NVIDIA Jetpack 7.1 by @rene in #5768
• Fix and simplify broken leader election in Kubernetes cluster by @milan-zededa (#5773) in [#5773](backport of #5821)
• Update more alpine hashes and temporarily increase/jumbo build timeout by @eriknordmark in #5774
• Fix bootstrap config failing on missing ECDH cert by @milan-zededa (#5775) in [#5775](backport of #5584)
• build(deps): bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.43.0 in /eve-tools/bpftrace-compiler by @dependabot[bot] in #5776
• build(deps): bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.43.0 in /tools/get-deps by @dependabot[bot] in #5777
• Makefile: save QEMU PID to file by @shjala in #5779
• Delete cpu_manager_state file on every reboot by @zedi-pramodh in #5781
• ci: refactor PR build into two-stage pipeline with reusable workflow by @rucoder in #5782
• Makefile: Build eve-fw generic variant for evaluation platform by @europaul in #5785
• build(deps): bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.43.0 in /tools/dockerfile-from-checker by @dependabot[bot] in #5787
• pkg/kube: symlink host-local into PATH for k3s v1.34+ compatibility by @mrangana in #5788
• Fix boot measurement on grub 2.12 by @rene in #5789
• pkg/gpt-tools: fix cgpt static build for riscv64 by @christoph-zededa in #5790
• pkg/alpine: update zlib to 1.3.2-r0 from Alpine main and add efibootmanager package by @eriknordmark in #5793
• cross-compilers: ignore pkg hash inconsistencies by @christoph-zededa in #5798
• refactor(kubeapi): introduce WaitForKubernetesOptions to control optional waits by @andrewd-zededa in #5799
• eve-k: fix cluster delete regression by @andrewd-zededa in #5800
• alpine 3.22: fix bpftrace by @christoph-zededa in #5803
• eve-k: skip pod eviction when cluster-wide simultaneous drain is detected by @andrewd-zededa in #5804
• Fix SCEPClient after removal of EVE V1 API support by @milan-zededa in #5805
• ci: replace build-eve reusable workflow with composite action by @eriknordmark in #5807
• coverage: add Go basic-block coverage support for unit and E2E tests by @eriknordmark in #5808
• Fix bond link monitoring by @milan-zededa in #5809
• monitor: bump monitor-rs to v0.6.3 by @rucoder in #5810
• Fix Go package cross-compilation and add parallel builds by @rucoder in #5811
• ci: bump guyarb/golang-test-annotations to v0.9.0 by @rucoder in #5812
• github/workflows: Fix build.yml workflow by @rene in #5813
• ci: switch actionlint reporter to github-check by @rucoder in #5814
• build(deps): bump github.com/moby/spdystream from 0.5.0 to 0.5.1 in /pkg/pillar by @dependabot[bot] in #5815
• zedkube: bound k8s API calls with context timeout to prevent watchdog by @naiming-zededa in #5816
• Disable app logs and set Firmware UUID by @zedi-pramodh in #5817
• Tune iscsid.conf for better performance by @zedi-pramodh in #5818
• stagger k3s startup using persisted control-plane rank by @naiming-zededa in #5819
• Fix DevicePortConfig.MostlyEqual ignoring L2 (VLAN/bond) config changes by @milan-zededa in #5820
• pkg/uefi: upgrade EDK2 to edk2-stable202508.01 by @rucoder in #5822
• Publish ZInfoKubeCluster for single-node eve-k deployments by @milan-zededa in #5823
• pkg/pillar: Disable vmx for FML virtualization mode by @rene in #5824
• zedkube/dpcmanager: detect LB CIDR conflicts and fix VIP filtering by @naiming-zededa in #5827
• bpftrace-compiler: skip nvidia kernels in tests by @christoph-zededa in #5831
• edgeview: fix wwan0 excluded from websocket interface list by @naiming-zededa in #5832
• Fix regression causing potential panic in triggerPublishAllInfo by @eriknordmark in #5833
• Publish bond adapter status and metrics by @milan-zededa in #5834
• bpftrace-compiler: Remove full path from qemu command by @rene in #5835
• Add log rotation for swtpm by @shjala (#5838) in [#5838](backport of #5796 #5797)
• Introduces the optee-client package by @rene in #5839
• Increase the size of CONFIG partition from 1MB to 5MB by @rene in #5840
• eve-k: set Longhorn node disk reserved space via global config by @andrewd-zededa in #5841
• vtpm,vector: fix cross-compilation and runtime issues by @rucoder in #5842
• installer: Add option to skip device certificate generation by @rene in #5843
• pkg/storage-init: Copy fTPM provision data by @rene in #5844
• Fix SCEP CA trust anchor certs being silently skipped by @milan-zededa in #5845
• eve-k: fix pillar 'make test' for macOS M-series (ZARCH=arm64 HV=k) by @andrewd-zededa in #5846
• zedkube: fix ECDH cert missed during WaitForKubernetes blocking k3s by @naiming-zededa in #5847
• fix yetus golangci --out-format by @christoph-zededa in #5848
• pkg: enable riscv64 builds for vector, monitor, installer by @rucoder in #5849
• pkg/pillar: Remove lk-build-arg-COVER (fixes broken publish workflow) by @rene in #5850
• Fix lost NTP telemetry by @OhmSpectator in #5851
• fix missed LonghornDiskReservedGB in global_test.go by @andrewd-zededa in #5852
• pillar: trust cluster recovery for kubevirt apps and add stuck-Pending VMI handler by @naiming-zededa in #5853
• Simplify Longhorn_is_ready log gate flag, tmp file not needed. by @andrewd-zededa in #5854
• eden-trusted: use eden master for EVE master CI by @eriknordmark in #5855
• pillar: remove executor, command, execlib, and exectypes by @eriknordmark in #5856
• kube: move k3s-stop flag to /run/kube so reboot clears it by @mrangana in #5857
• dpcmanager: increase PNAC DHCP reacquire timeout to avoid flaky tests by @rene in #5860
• HW inventory fixes by @christoph-zededa in #5861
• Make DIRSYNC for persist/vault configurable via grub option by @milan-zededa in #5862
• build(deps): bump go.opentelemetry.io/otel from 1.40.0 to 1.41.0 in /pkg/pillar by @dependabot[bot] in #5863
• kube: restart standalone containerd if it dies by @mrangana in #5864
• eve-k: update to kubevirt 1.7.3 by @andrewd-zededa in #5865
• edgeview: fix build after ServerSigningCertFileName removal by @eriknordmark in #5866
• zedmanager: report app status from DNID when no pod in cluster by @naiming-zededa in #5867
• build(deps): bump gitpython from 3.1.43 to 3.1.47 in /tools/check-commit-messages by @dependabot[bot] in #5868
• kube: fix cluster-init stuck loop after basek3s conversion by @naiming-zededa in #5869
• github/workflows: Fix yetus workflow for large patches by @rene in #5870
• github/workflows: Add codecov to publish workflow by @rene in #5871
• Enable auto compact of etcd database by @zedi-pramodh in #5872
• build(deps): bump go.opentelemetry.io/otel from 1.40.0 to 1.41.0 in /pkg/newlog by @dependabot[bot] in #5873
• Fix the removal of edgeview singing cert file by @naiming-zededa in #5874
• zedkube/edgeview: fix stale vmiVNC.run blocking new VNC sessions by @naiming-zededa in #5875
• pkg/debug: fix COM port detection by @christoph-zededa in #5876
• bpftrace-compiler: add vendoring by @christoph-zededa in #5877
• github/workflows: Fix yetus when no patch-*-result.txt files are present by @rene in #5878
• Install kubevirt 1.7.3 with patched env for virt-operator daemonset by @andrewd-zededa in #5879
• Remove patch file leftover from 161360e by @rene in #5880
• build(deps): bump go.opentelemetry.io/otel from 1.40.0 to 1.41.0 in /pkg/wwan/mmagent by @dependabot[bot] in #5881
• pillar: tear down VMIRS on purge and restart in eve-k by @naiming-zededa in #5882
• Makefile: Signing-Off setting server to prod commit by @rene in #5883
• feat(zedkube): configurable VMI descheduler for failback by @andrewd-zededa in #5885
• pkg/eve: Fix image sizes for the new partition layout by @rene in #5886
• Pull in newest lf-edge/edge-containers by @eriknordmark in #5887
• Kernel update - [arm64-nvidia-jp5, arm64-nvidia-jp6, arm64-generic, a… by @rucoder in #5893
• fix(volumemgr): floor deferContentDelete ticker at 1 second by @akaouris in #5894
• Update CODEOWNERS and MAINTAINERS.md files by @rouming in #5895
• hypervisor/kubevirt: fix CPU metrics always reporting zero by @naiming-zededa in #5896
• tests/types: improve unit test coverage to 83% by @eriknordmark in #5897
• zedagent: extend docs with internals and startup sequence unit tests by @eriknordmark in #5898
• docs: add microservice classification by @eriknordmark in #5899
• docs: fix broken links and add inventory_win by @eriknordmark in #5900
• Force bonds/vlans re-parsing when lower layer changes by @milan-zededa in #5902
• pillar: bump otel/sdk to v1.41.0 by @eriknordmark in #5903
• LPS Network Endpoint Enhancements and Signaling by @milan-zededa in #5904
• zedmanager: fix ENC app reporting race and ActivateInprogress stuck failback by @naiming-zededa in #5905
• Make sure SenderStatusCertMiss is not overwritten by @eriknordmark (#5906) in [#5906](backport of #5584)
• GHA: add arm64 kubevirt and nvidia-jp7 build/publish coverage by @europaul in #5907
• Fix CSR attribute ordering for SCEP enrollment by @milan-zededa in #5909
• build(deps): bump gitpython from 3.1.47 to 3.1.49 in /tools/check-commit-messages by @dependabot[bot] in #5912
• github/workflows: add Claude automated PR review workflow by @rene in #5917
• device-steps: disable mdev hotplug by @christoph-zededa in #5924
• msrv: fix OpenStack metadata routing by @eriknordmark in #5925
• kube: clean up stale etcd masterleases after single-to-cluster transition by @naiming-zededa in #5927
• build(deps): bump github.com/in-toto/in-toto-golang from 0.9.0 to 0.11.0 in /eve-tools/bpftrace-compiler by @dependabot[bot] in #5928
• build(deps): bump github.com/in-toto/in-toto-golang from 0.10.0 to 0.11.0 in /tools/dockerfile-from-checker by @dependabot[bot] in #5929
• build(deps): bump github.com/in-toto/in-toto-golang from 0.9.0 to 0.11.0 in /tools/get-deps by @dependabot[bot] in #5930
• build(deps): bump gitpython from 3.1.49 to 3.1.50 in /tools/check-commit-messages by @dependabot[bot] in #5931
• pkg/eve: Fix image sizes for evaluation variant and bump live to 16GB by @rene in #5932
• docs(config-properties): correct debug.enable.{usb,vga,console} defaults by @mvanhorn in #5935
• pillar: emit coverage for short-lived agents by @eriknordmark in #5937
• bond: Enable active ARP validation to prevent cross-node interference by @milan-zededa in #5939
• scepclient: clean up obsolete enrolled certs on boot by @milan-zededa in #5942
• pkg/fw: Add .pnvm firmware file for Intel AX210 by @rene in #5945
• PNAC: fix DHCP reacquire being lost on concurrent DPC update by @milan-zededa in #5947
• dnsmasq: update to use alpine dnsmasq by @christoph-zededa in #5948
• baseosmgr: clean up orphan BaseOsStatus on ContentTreeStatus delete by @eriknordmark in #5951
• remove uncleDecart from CODEOWNERS by @uncleDecart in #5952
• client: drop unused /config fallback by @eriknordmark in #5954
• eve-k: kube/longhorn: tune replica rebuild, add snapshot management, fix replica/PVC size reporting by @andrewd-zededa in #5955
• tests/eden: pin coverage runs to eden master by @eriknordmark in #5959
• Fix SBOM: Add missing packages by @shjala in #5961
• grub: disable PCIe ACS override for EVE-K boot by @rucoder in #5969
• Bump rootfs partition size from 4GB to 10GB by @rene in #5973
• zedkube: prune stale master nodes from EdgeNodeCluster config by @naiming-zededa in #5974
• zedagent: report size of EFI and IMGx partitions by @eriknordmark in #5976
• newlog: sanitize non-Latin-1 chars in gzip header by @eriknordmark in #5977
• Syncup commits from master to 17.0. by @rene in #6048
• Syncup PRs from master to 17.0.0-rc3 by @rene in #6017
• [17.0] pillar: promptly reap powered-off kvm domains by @eriknordmark in #6155
• Syncup PRs from master to 17.0.0-rc4 by @rene in #6156
• [17.0] volumemgr,kubeapi: defer+retry app volumes until EVE-k cluster storage is ready by @eriknordmark in #6172
• [17.0] dpcreconciler: drop alternativeMAC by @eriknordmark in #6175
• [17.0] pkg/xen-tools: recover from disabled-BAR mmap SIGBUS as Unsupported Request by @eriknordmark in #6179

Full Changelog: 16.0.1-lts...17.0.0-lts