v0.0.21

What's Changed

• build(deps): bump the go_modules group across 1 directory with 2 updates by @dependabot[bot] in #193
• Use libudev for USB device selection by @pjbgf in #196
• fix(deps): update golang by @qubesome-renovate[bot] in #194
• fix(deps): update module github.com/cyphar/filepath-securejoin to v0.7.0 by @qubesome-renovate[bot] in #195
• build: bump Go to 1.27 by @pjbgf in #197
• build: replace gopkg.in/yaml.v3 with go.yaml.in/yaml/v3 by @pjbgf in #198
• fix(deps): update module github.com/urfave/cli/v3 to v3.10.1 by @qubesome-renovate[bot] in #200
• fix(deps): update module github.com/stretchr/testify to v1.12.0 by @qubesome-renovate[bot] in #199
• fix(deps): update module github.com/urfave/cli/v3 to v3.11.0 by @qubesome-renovate[bot] in #201
• fix(deps): update module github.com/stretchr/testify to v1.12.1 by @qubesome-renovate[bot] in #202
• chore(deps): update dependency golangci/golangci-lint to v2.13.1 by @qubesome-renovate[bot] in #204
• chore(deps): update dependency protocolbuffers/protobuf to v36 by @qubesome-renovate[bot] in #205
• fix(deps): update module google.golang.org/grpc to v1.83.2 by @qubesome-renovate[bot] in #203
• chore(deps): update dependency protocolbuffers/protobuf to v36.1 by @qubesome-renovate[bot] in #206
• chore(deps): update dependency golangci/golangci-lint to v2.13.2 by @qubesome-renovate[bot] in #207
• gpu: Detect Mesa GPUs and share host drivers via CDI by @pjbgf in #208
• mounts: create missing mapped dirs as the current user by @pjbgf in #209
• config: Fail closed on strict YAML decode errors by @pjbgf in #210
• types: Validate workload and profile fields at their point of use by @pjbgf in #211
• inception: Carry workload arguments as a list over the RPC by @pjbgf in #212
• clipboard: Build the copy commands as argv by @pjbgf in #213
• runners: Keep the runtime seccomp profile and drop capabilities by @pjbgf in #214
• runners: Share only the requested USB device nodes by @pjbgf in #215
• runners: Resolve the runtime and image home dir without trusting input by @pjbgf in #216
• firecracker: Verify the downloaded kernel before using it by @pjbgf in #217
• xauth: Write the display number with its real length by @pjbgf in #218
• Minor fixes by @pjbgf in #220

Full Changelog: v0.0.20...v0.0.21