v4.0.2

What's Changed

• Retire leftover Asahi alarm from wheel on existing installs by @malik-na in #258
• Allow a Mac-only pkgrel when building omarchy packages by @malik-na in #263
• fix: detect Apple Silicon lid state by @dl-alexandre in #249
• test: cover default keyring provisioning by @dl-alexandre in #253
• fix: escape guided setup resume config by @dl-alexandre in #244
• fix: retry first-run after user finalization failure by @dl-alexandre in #242
• fix: restore the ARM Obsidian preinstall by @dl-alexandre in #243
• fix: expand ARM mirror test paths by @dl-alexandre in #245
• fix: refresh ARM packages during upgrade by @dl-alexandre in #250
• fix: skip timezone prompt for configured zones by @dl-alexandre in #236
• Avoid repeated zram activation for additional users by @Skeptomenos in #259
• [Patch/shell] Moved calendar panel to the right by @tayowrld in #241
• fix(menu): show Mac F-key names for brightness keys in keybindings menu by @sambai-dev in #215
• Allow fresh Steam installs to bootstrap on Apple Silicon by @dl-alexandre in #251
• fix: keep optional recorder failures nonfatal by @dl-alexandre in #248
• fix: isolate Apple package build outputs by @dl-alexandre in #247
• Merge upstream Omarchy 4.0.2 into quattro by @scottjones in #308

New Contributors

• @sambai-dev made their first contribution in #215

Fixes from upstream

• Fix shell injection in theme and application installers by @mdisec, @Adolanium
• Fix Codex usage collection on version 0.149 by @orienw
• Fix migration failures on Bash 5.3 by @ryanrhughes
• Fix SSH hardening verification failing on OpenSSH 10.x by @ryanrhughes
• Prevent web app installers from creating nested directories via the app name by @Chessing234
• Security
• Require signed packages from the Omarchy repository by @ryanrhughes
• Harden CUPS printer discovery and administration by @mdisec
• Secure Plymouth and SDDM asset publication by @AFOliveira, @ErikMelton, @itz4blitz
• Secure Windows VM host mounts in Codex by @AFOliveira
• Prevent remote image injection in shell text elements by @ErikMelton
• Harden browser policy directory permissions by @acrogenesis
• Restrict sudoers rule for timezone updates by @omarchybot
• Validate web app URLs and escape desktop entry values by @bastidotnet, @Chessing234
• Harden existing SSH installations and disable password authentication by default by @acrogenesis, @ryanrhughes
• Close unprivileged input and SSH escalation paths by @acrogenesis, @fuchsblau, @ryanrhughes

Full Changelog: v4.0.1...v4.0.2