v0.27.1

Ofelia v0.27.1 — a patch release since v0.27.0 (2026-06-25). One fix for type=run jobs created through the web UI or API, plus a dependency and toolchain refresh. Backwards compatible; no configuration changes needed. See the full changelog for the complete entry.

🐛 Fixed

• type=run jobs created through the web UI or API now clean up their containers — such a job left its container behind after every execution, so the next scheduled run failed to start with job run: creating container: create container "<name>": resource conflict. A daily job would run once and then fail every day after, with the finished container still visible in docker ps -a. Jobs defined in config.ini were never affected: the delete default only reached jobs built by the config decoder, and jobs created through the API — or restored from the state file after a daemon restart — bypassed it. Both paths now get the same default. Nothing to change on upgrade; existing leftover containers can be removed with docker rm. (#745)

🔧 Maintenance

• Go toolchain 1.26.4 → 1.26.5. This clears GO-2026-5856, an Encrypted Client Hello privacy leak in crypto/tls that was reachable from the Docker client's TLS dialer. (#746)
• Dependency refresh across the module graph, including docker/cli 29.5.3 → 29.6.2 and golang.org/x/crypto 0.53.0 → 0.54.0. The docker/docker advisories reported by govulncheck remain: they have no fix on the v28 line and are tracked in #667. (#744, #746)

Full changelog: v0.27.0...v0.27.1

Container image

ghcr.io/netresearch/ofelia:0.27.1
ghcr.io/netresearch/ofelia:0.27
ghcr.io/netresearch/ofelia:0

Verify your download

Per-asset signatures are bundled. Verify any single file:

cosign verify-blob \
  --bundle ofelia-linux-amd64.sigstore.json \
  --certificate-identity-regexp "^https://github\.com/netresearch/\.github/\.github/workflows/release-go-app\.yml@" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  ofelia-linux-amd64

Verify checksums against the signed manifest:

cosign verify-blob \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp "^https://github\.com/netresearch/\.github/\.github/workflows/release-go-app\.yml@" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  checksums.txt
sha256sum -c checksums.txt --ignore-missing

Verify build provenance. Releases are built by a reusable
workflow, so the signing identity is that workflow rather than
this repository -- --signer-workflow is required and
verification fails without it:

gh attestation verify <artifact> \
  --repo netresearch/ofelia \
  --signer-workflow netresearch/.github/.github/workflows/release-go-app.yml

Verify container image:

cosign verify ghcr.io/netresearch/ofelia:0.27.1 \
  --certificate-identity-regexp "^https://github\.com/netresearch/\.github/\.github/workflows/release-go-app\.yml@" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"
gh attestation verify oci://ghcr.io/netresearch/ofelia:0.27.1 \
  --repo netresearch/ofelia \
  --signer-workflow netresearch/.github/.github/workflows/release-go-app.yml

👥 Contributors

Thanks to everyone who made this release — code and reports alike:

• Code: @matheusamendola (#745), @CybotTM
• First contribution: @matheusamendola, who hit the leftover-container bug on a daily ETL job in a live deployment, traced it to the two construction paths that bypass the config decoder, and shipped the fix with a regression test for each path.