CNCF Releases

Version bump: minor (from v4.4.0)

• patch: ci: cut a release from green master every Monday (#6075) (d9db631)
• patch: chore(deps): roll up pending Renovate updates (#6078) (d533833)
• patch: fix(agent): rank a git-describe KAIROS_INIT_VERSION after its tag (#5594) (3674abc)
• patch: fix(deps): bump Go to 1.27.4 for GO-2026-6859 (#6080) (0d3616c)
• patch: fix(agent): unmount the downloaded ISO before removing its temp dir (#5904) (fa68014)
• patch: chore(deps): update AuroraBoot to v0.30.0 (#6065) (6b7191e)
• patch: fix(kcrypt): move kube-rbac-proxy sidecar to upstream image (#6049) (0d0b51b)
• patch: ci: check that pull request titles are Conventional Commits (#6050) (74f64dd)
• patch: fix(upgrade): read --exclude-path the same way for every source type (#6047) (1573430)
• patch: docs(agent): name install.encrypted_partitions in the install config guide (#5871) (2a91198)
• patch: fix(kairos-init): put run-stage flags before the stage name in datasource (#5939) (8498373)
• patch: fix(kcrypt): show the passphrase prompt on a Trusted Boot boot (#6024) (fc0acbb)
• patch: chore(deps): roll up pending CI action and zizmor updates (#6030) (33f1743)
• patch: fix(ci): re-date the osv ignores that expired on 2026-11-10 (#6039) (f35a874)
• patch: fix(versioneer): sort the os-release variables so the output is stable (#6042) (4d50b4e)
• patch: fix(release-notes): put the kairos-diff fallback reason on its own line (#6013) (3d25fe7)
• patch: fix(tests): require a Ready node row in the provider e2e waits (#6000) (e31d86c)
• patch: fix(upgrade): read the node's files correctly when upgrading from Kubernetes (#6035) (29ad93d)
• patch: fix(upgrade): refresh the grub.cfg on the state partition with the ESP (#6028) (5c9d963)
• patch: fix(immucore): encrypt pending partitions on an in-RAM boot too (#5411) (3a8d145)
• patch: fix(immucore): free the UKI initramfs after copying it to the sysroot (#6023) (d208e2a)
• minor: feat(kcrypt): unlock with a passphrase typed at boot (#6022) (1272743)
• patch: ci(pr): run the PR pipeline on docs-only changes too (#6002) (293018a)
• patch: chore(deps): roll up pending Renovate updates (#5995) (665db8d)
• patch: refactor: one retry helper instead of 10 hand-rolled backoff loops (#4549) (5120df4)
• patch: fix(immucore): drop /sysroot from overlay dirs in the fstab entry (#5950) (307f2c6)
• patch: fix(immucore): run cmdline yip stages with the immucore console (#5979) (00383fc)
• patch: fix(ci): check for an existing onboarding issue per role (#5948) (7989010)
• patch: fix(ci): parse the factory base_image tag per path component (#5945) (cd86811)
• patch: fix(immucore): strip the port from networkd DNS servers (#5972) (9691624)
• patch: fix(kairos-init): validate sees a unit masked in /etc or /run (#5976) (22dfcf9)
• patch: fix(kairos-init): dry-run no longer needs an installed kernel (#5981) (62c4c12)
• patch: fix(schema): anchor the users[].name pattern (#5964) (876445b)
• patch: fix(install): reject an unparsable install.source (#5954) (1e4459a)
• patch: fix(sdk): OSRelease reads only the file it is given (#5962) (f9ffa3a)
• patch: fix(uki): emit install progress steps (#5968) (0599d5c)
• patch: fix(provider): reject a role set call with missing arguments or an unknown role (#5975) (f8b891a)
• patch: ci: add a qa-gate check that requires the QA: pass label (#5983) (91986ec)
• patch: fix(provider): register stops when the --config file cannot be read (#5974) (bacd178)
• patch: fix(agent): phone-home uninstall strips every cloud-config the boot scan reads (#5895) (a0981f5)
• patch: fix(agent): install a sysext path or URI without fetching the catalog (#5897) (37e9861)
• patch: chore(deps): roll up pending Renovate updates (#5919) (b03ac8f)
• patch: fix(provider): reject a non-positive or non-numeric token interval (#5931) (9d80850)
• patch: fix(schema): declare kubevip.manifest_sha256 (#5933) (c005c19)
• patch: fix(kcrypt): route the escrow Service to the manager pod (#5934) (c22f49f)
• patch: fix(kairos-init): repeated --skip-step adds to the skipped steps (#5936) (293818d)
• patch: fix(kcrypt): keep the TOFU Secret partition label a valid label value (#5941) (62a14b4)
• patch: fix(provider): wait for a usable node IP on the LAN path (#5932) (6687828)
• patch: ci: run the PR smoke and CodeQL on merge queue branches (#5977) (6e79a4c)
• patch: fix(kairos-init): chown home dirs to the user's primary gid (#5903) (dc32ce4)
• patch: fix(collector): return the error from a malformed Overwrites (#5853) (b17638d)
• patch: fix(agent): record the reset state file on the persistent partition (#5870) (f6e0d93)
• patch: chore(agent): remove the Makefile whose e2e targets point at a deleted directory (#5872) (37df61d)
• patch: ci(zizmor): also run on changes to linting-composite-action (#5868) (bc340cd)
• patch: fix(agent): don't truncate a sysext installed from the extensions dir itself (#5893) (5c2e63c)
• patch: fix(kcrypt): report the challenger error sent in place of a challenge (#5894) (8618302)
• patch: fix(sdk): apply group, xattrs and mtime when extracting a sysext layer (#5898) (126002d)
• patch: chore(agent): remove the goreleaser and codecov configs nothing runs (#5899) (e6478e7)
• patch: fix(immucore): refuse a bind mount onto a symlink instead of following it (#4901) (b6c45e9)
• patch: fix(kcrypt): reach an mDNS challenger that only answers on IPv6 (#5896) (07781a1)
• patch: chore: move the kairos CLIs from urfave/cli to cobra (#5900) (7738742)
• patch: fix(immucore): run udevadm trigger after LVM activation (#5636) (3879a87)
• patch: fix(immucore): let the boot-failure banner outlive the unit stop timeout (#5145) (b758c1e)
• patch: fix(immucore): guard the recorded fstab entries with a mutex (#5789) (bfea6ca)
• patch: fix(immucore): keep custom mounts whose device path has a colon (#5828) (bf45ae8)
• patch: fix(agent): refuse a docker save archive built for another platform (#5877) (f796478)
• patch: fix(immucore): mount the /run/overlay tmpfs 0755 with nosuid,nodev (#5867) (80d6693)
• patch: fix(sysext): return layer errors instead of panicking (#5846) (2201daa)
• patch: fix(sysext): skip OCI whiteout markers when extracting the last layer (#5860) (eb2d37a)
• patch: fix(agent): report a phonehome config parse error in phone-home (#5848) (6e9c33a)
• patch: fix(kairos-init): skip the provider info hook on --dry-run (#5859) (e7ab5ee)
• patch: fix(tests): expect the 32-character TOFU names the challenger now creates (#5842) (1643e12)
• patch: fix(kcrypt): stop TOFU names colliding on the first 8 hash chars (#5755) (190426f)
• patch: fix(phonehome): fall back to the default for a negative heartbeat or backoff (#5788) (4b89cd5)
• patch: fix(tests): stop shadowing installOutput in upgrade-latest-with-cli (#5766) (8cbfdee)
• patch: fix(agent): skip releases with a null or non-semver name in FindReleases (#5764) (79b0d63)
• patch: fix(kcrypt): keep re-querying mDNS for the whole MDNSTimeout (#5761) (86bf730)
• patch: fix(images): default KAIROS_INIT to v4.4.0 and let renovate bump it (#5765) (7ff4e46)
• patch: fix(sdk): compare the Authenticode digest with the PE hash when verifying signatures (#5799) (a8561e2)
• patch: fix(agent): time out stalled downloads, not slow ones (#5800) (050a876)
• patch: fix(collector): let the later scalar win when kinds differ (#5801) (f4a24e8)
• patch: fix(examples): comment out the github SSH key in worker.yaml (#5762) (071c7be)
• patch: fix(agent): stop UKI upgrade panicking when no source is given (#5689) (b738859)
• patch: fix(immucore): strip only the leading /sysroot when writing fstab (#5635) (be39197)
• patch: fix(agent): deprecate the no-op start --force flag (#5634) (8f1dcf0)
• patch: fix(upgrade): run recovery finalize on the unpacked squashfs tree (#5633) (3b0ade9)
• patch: fix(agent): treat a bare install key as an empty install block (#5621) (78edb28)
• patch: fix(agent): exit on SIGINT and SIGTERM during an install (#5622) (324e2c9)
• patch: fix(sdk): reload systemd after OverrideCmd writes the drop-in (#5614) (100c7de)
• patch: fix(machine): keep backslashes and lone apostrophes in the kernel cmdline (#5610) (2c0d032)
• patch: fix(edit-config): keep the working copy out of the cloud-config dir and clean up on signals (#5609) (7dfd98a)
• patch: fix(partitions): stop letting the last disk win the EFI partition lookup (#5397) (97d4217)
• patch: test(p2p): use Auto.Enabled in the unpinned role specs (#5605) (12a261a)
• patch: chore(deps): roll up pending Renovate updates (#5604) (8c5e3be)
• patch: fix(schema): declare the partition keys the installer reads (#4904) (f8b7cff)
• patch: fix(immucore): log a failed cloud-init stage instead of discarding it (#4871) (a4b63f6)
• patch: fix(cloudconfigs): stop the accounting stage chmodding a symlink's target (#4872) (7c5a84e)
• patch: fix(provider): keep the k0s join token out of a world-readable file (#4773) (5a2b773)
• patch: fix(kcrypt): ask for the Secret the operator named, not a rewritten one (#4803) (2a57fce)
• patch: fix(immucore): do not claim the root was never mounted when it was (#4814) (bd2402f)
• patch: fix(cloudconfigs): enable each sysext unit only where the image has it (#4760) (558dd74)
• patch: fix(schema): read top-level options as the mapping the runtime holds (#4678) (9f794ea)
• patch: fix(schema): describe the Kubernetes blocks the provider reads (#4674) (a2a7bc6)
• patch: fix(p2p): accept the documented empty role, and stop erroring on "none" (#4671) (889022d)
• patch: fix(agent): make --override-cloud-init-paths actually remove the defaults (#4666) (cac767c)
• minor: feat(schema): suggest the schema key a misspelled one meant (#5488) (d03c7aa)
• patch: fix(provider): create the k0s system users at build time (#4469) (f3a70c6)
• patch: fix(kairos-init): stop installing tmux on SUSE (#5576) (2d18642)
• patch: fix(cis): check DIL 5.3.1 pwquality instead of waiving it (#5598) (ec724c0)
• patch: fix(agent): collect the journal for the edgevpn units the p2p provider writes (#5446) (85dafe0)
• patch: fix(release-notes): skip the kairos-init Makefile when the ref has none (#5592) (8c24a22)
• patch: fix(agent): do not resume an HTTP download onto an existing file (#4604) (a6eca34)

fix(oci,scheduler): harden manifest URL parsing and preheat request h…

This is release gRPC Core 1.84.3 (gimbal).

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes.

This is release gRPC Core 1.85.2 (googol).

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes.

Release Volcano v1.14.7 version

Release Volcano v1.15.4 version

What's New

🔤 General

• [Server] Exclude soft-deleted connections and mappings in GetEnvironmentConnections @harmanD-MAX (#23263)
• [Server] Retain API group paths in manifest errors and record partial registration @Supersaiyan101 (#23249)
• [mesheryctl] Update kubectl reference link and clean up README @AdityaChaudhary5412 (#23255)
• [Server] Guard nil dereferences, detached goroutines, and unmarshal errors in events streamer @Amansingh0807 (#23233)
• [Server] Propagate manifest extraction errors and add positive CRD test @Supersaiyan101 (#23232)
• [Server] Fix missing metrics query parameter in GetMesheryPattern @Swarup-Banik (#23227)
• fix: correct meshmodel policies pagination @Nixantsingh943 (#23231)
• [Server] Fix runtime panic in getResolvedManifest (MeshModel) @Supersaiyan101 (#23228)
• [Server] Fix HTTP error handling in DefaultLocalProvider.PublishMetrics @Swarup-Banik (#23218)
• [Server] Initialize valid MachineCtx for Kubernetes connection registration @Atharva-Mendhulkar (#23210)
• [Models] Seed cert-manager and dapr relationships on newest model version @BarbieRajput (#23204)
• fix(server): preserve correct annotation classification for alias components @VimalN2005 (#23177)
• [Server] Do not route non-Kubernetes status updates through the Kubernetes machine @sahillpaul (#23201)
• [Server] Resolve unused function and unchecked error lint failures @Atharva-Mendhulkar (#23181)
• [Server] Fix connection definition updates @0xmaster7 (#23192)
• [Server] Rollback in-memory state machine on database update failure @Atharva-Mendhulkar (#23155)
• [Server] Return HTTP 404 when deleting non-existent model or connection definition @Amansingh0807 (#22821)
• [Server] Handle registry lookup errors during connection registration @Nixantsingh943 (#23072)
• fix(handlers): preserve context for background FSM transitions @Atharva-Mendhulkar (#23146)
• [Server] Report Kubernetes context conversion failures instead of silently skipping connections @Nixantsingh943 (#23171)
• [Server] Cancel stalled Kubernetes discovery requests @0xmaster7 (#23166)
• [Server] Propagate database and marshal errors from GetMesheryK8sContexts @RameshwariS (#22967)
• fix(server): report asynchronous context deletion errors @Nixantsingh943 (#23145)
• [Server] Validate connection ID path parameter in telemetry handlers @bodapatisaikrishna (#23126)
• [Server] Align DeleteUserCredential invalid UUID error with ErrInvalidUUID @Supersaiyan101 (#23125)
• [Server] Validate multi-selector relationships and prevent ghost relationship bleed (#23111) @nishant-devv (#23113)
• [Server] Validate credential ID path parameter in GetUserCredentialByID @Supersaiyan101 (#23115)
• [Server] Resolve Kubernetes unreachable condition after connection deletion @Nixantsingh943 (#23101)
• [Server] Preserve composite string formatting and non-greedy reference matching in pattern filler @nishant-devv (#23090)
• [Server] Prevent index out-of-bounds panic in ExtensionProxy router @Supersaiyan101 (#23088)
• [Server] Dynamically size planner channels and eliminate mutex deadlock on fan-in @nishant-devv (#23085)
• [Server] Return HTTP 400 for malformed and 404 for non-existent filter deletion @pranav718 (#23087)
• [Server] Prevent send on closed channel panic in ProviderTracker @Supersaiyan101 (#23086)
• [Helm] Fix ingressClassName rendering in meshery chart @madhavzanwar (#23064)
• [Server] Reset registration status on component generation failure and allow retries @nishant-devv (#23081)
• [Server] Cascade mapping deletions on workspace and member removal and deduplicate designs @nishant-devv (#23077)
• [Server] Deduplicate environment connection mappings and cascade delete on removal @nishant-devv (#23048)
• [Server] Parse Content-Disposition when naming a design imported from a URL @BarbieRajput (#23045)
• [Server] Stop repeated workspace assignments from surviving removal @BarbieRajput (#23043)
• [Server] Match every label in MeshSync resource filters @BarbieRajput (#23041)
• [Server] Fix unauthenticated path traversal in model export via version fields @yi-nuo426 (#23031)
• [Server] Deduplicate workspace environment, view, and team mappings @nishant-devv (#23034)
• [Server] Keep a connection's created_at and owner when updating it @maindevhoon (#23027)
• [Server] Return 404 instead of creating a connection when updating an unknown ID @BarbieRajput (#23004)
• [Server] Prevent unchecked type assertions and detached goroutine nil panics in GraphQL resolvers @Amansingh0807 (#23011)
• [Server] Keep a performance profile's created_at when editing it @BarbieRajput (#23002)
• [Server] Apply Additional Options saved from the UI to load tests @BarbieRajput (#22996)
• [Server] Keep a filter's file, visibility and created_at when updating it @BarbieRajput (#22995)
• [Server] Prevent caching uninitialized state machine on Start failure @nishant-devv (#22975)
• [Server] Sum registration failure counts across models @Asheesh7298 (#22977)
• [Server] Save performance results when anonymous sharing is off @BarbieRajput (#22952)
• [Server] Retain ORDER BY clause in GetMeshSyncResources handler @Supersaiyan101 (#22829)
• [server] Prevent nil pointer dereference on pattern clone and ErrRequestBody @Supersaiyan101 (#22768)
• [Server] Prevent unchecked type assertion and detached goroutine nil panics in middlewares @Amansingh0807 (#22964)
• fix(server): guard against nil patternData in pattern update handler (#22898) @VimalN2005 (#22946)
• [Server] Fix file descriptor leaks in component SVG generation and OCI export (#22814) @muskan-creates352 (#22815)
• [Server] Prevent unbounded goroutine leak in MeshSyncRegistrationQueue.Send @Amansingh0807 (#22901)
• [Server] Close the gzip reader in TarXZ @Ankitavasudev (#22893)
• [Server] Prevent nil pointer dereferences on missing context values in state machines @Amansingh0807 (#22885)
• [Docker Extension] Fix nil-pointer panic in proxy ServeHTTP @BarbieRajput (#22691)
• [Server] Keep stored design fields when re-saving through POST /api/pattern @Karman580 (#22843)
• [Server] Use a valid OCI repository name when exporting models @kkm121 (#22862)
• [Server] Close temp certificate file descriptor and guard type assertion in LoadTestHandler @Amansingh0807 (#22818)
• [Server] Close file descriptor on all return paths in k8s_components_registration @Amansingh0807 (#22765)
• [Server] Close each adapter client per host in Provision @harshitsaxena214 (#22839)

⌨️ Meshery CLI

• [mesheryctl] Reject --page 0 and --pagesize 0 in components list and … @AdityaChaudhary5412 (#23260)
• [mesheryctl] Respect --skip-browser in system dashboard --port-forward @Eternity0207 (#23240)
• [mesheryctl] Align flag struct json tags with Cobra flag names @ayushbuilds-code (#23236)
• [mesheryctl] Enforce exact argument validation in registry purge @madhavzanwar (#23132)
• [mesheryctl] Add input validation for design apply @BHAUMIK0711 (#23211)
• [mesheryctl] Deprecate no-op --page flag on model export @ChackoPAbraham19 (#23214)
• [mesheryctl] Reject unexpected positional arguments in system login @BHAUMIK0711 (#23209)
• [mesheryctl] Reject ambiguous design ID prefixes @faneeshh (#23190)
• [mesheryctl] Reject --page 0 and --pagesize 0 in relationship list an… @ChackoPAbraham19 (#23195)
• [Docs] Correct invalid flags in mesheryctl command reference @0xmaster7 (#23191)
• [mesheryctl] Enforce exact argument validation in system provider list @ayushbuilds-code (#23180)
• [mesheryctl] Enforce exact argument validation in system context list @ayushbuilds-code (#23189)
• [mesheryctl] Validate --page and --pagesize in design list and connec… @ChackoPAbraham19 (#23176)
• [mesheryctl] Fix filter view example comment formatting in docs @ItsAbir005 (#23161)
• [mesheryctl] Enforce argument validation in system token view @ayushbuilds-code (#23143)
• [mesheryctl] Enforce maximum argument validation in system token view @madhavzanwar (#23123)
• [mesheryctl] Enforce argument validation in filter list @ayushbuilds-code (#23140)
• [mesheryctl] Show only the requested services in system logs on Docker @Eternity0207 (#23136)
• docs(mesheryctl): update design command and subcommands help text @patelshivani2283-lab (#23128)
• [mesheryctl] Enforce exact argument validation in environment create @madhavzanwar (#23119)
• fix/Reduce duplicated formatting logic in view subcommands @Aravind226 (#22928)
• [mesheryctl] Enforce exact argument validation in workspace create @madhavzanwar (#23121)
• [mesheryctl] Enforce exact argument validation in environment view @madhavzanwar (#23117)
• [mesheryctl] Enforce exact argument validation in environment list @ayushbuilds-code (#23105)
• [Server] Scope adapter events to the user and operation that requested them @Eternity0207 (#23098)
• [mesheryctl] Enforce exact argument validation in organization list @ayushbuilds-code (#23103)
• [mesheryctl] Add subcommand examples and action overview to registry help text @madhavzanwar (#23053)
• [mesheryctl] Fix invalid system channel view example @BHAUMIK0711 (#23100)
• [mesheryctl] Enforce exact argument validation in workspace list @ayushbuilds-code (#23075)
• [mesheryctl] Enforce exact argument validation in design list @ayushbuilds-code (#23069)
• [mesheryctl] Enforce exact argument validation in component list @ayushbuilds-code (#23058)
• [mesheryctl] Fix remaining HTTP response body leaks @ItsAbir005 (#23028)
• [mesheryctl] Prevent hang on empty token view prompt and respect --yes flag @nishant-devv (#23036)
• Fix/issue 22923 filter import url v2 @itsCodeTide (#23017)
• [mesheryctl] Send the deploy payload from design delete -f @Asheesh7298 (#23021)
• [mesheryctl] Reject unexpected positional arguments in system logout @1107-1108 (#23000)
• [mesheryctl] Respect --follow for system logs on Docker @mayank609 (#22979)
• fix(mesheryctl): use IsValidUrl to detect URLs in filter import @aditya-desale (#22969)
• [mesheryctl] Preserve silent flag across system restart @Swatantra-66 (#22776)
• feat(server): adopt the error and event condition contract from meshery/schemas @leecalcote (#22950)
• [mesheryctl] Restore TestApplyCmd for perf apply @BarbieRajput (#22944)
• [mesheryctl] Remove unused errPatternMsg constant @ayanasarkar (#22945)
• [mesheryctl] Print perf result latencies in milliseconds @BarbieRajput (#22939)
• [mesheryctl] Send saved headers, cookies and content type in perf apply @BarbieRajput (#22938)
• [mesheryctl] Propagate errors and handle non-200 responses in registry update and publish @aarushdubey (#22926)
• [mesheryctl] Restore the adapter event stream and fail fast without it @Eternity0207 (#22927)
• [mesheryctl] Fix unclosed file descriptors in helpers (#22902) @muskan-creates352 (#22908)
• fix: correct meshery performance CLI examples @aditya-desale (#22900)
• [mesheryctl] Find designs by name in design export @Eternity0207 (#22890)
• [mesheryctl] Save and fetch designs correctly in design apply and delete @Eternity0207 (#22887)
• fix(mesheryctl): surface error detail in ErrUndeployDesign @ThakurUjjwal1706 (#22866)
• refactor(mesheryctl): Update model to use schema instead of reference to server/models @lekaf974 (#22877)
• [mesheryctl] Remove the workspace --count flag that always failed @Eternity0207 (#22871)
• [mesheryctl] Prevent slice out-of-bounds panic and unchecked type assertions in model import @Swatantra-66 (#22867)
• [mesheryctl] Fix design and filter list showing wrong names by using strings.TrimSuffix @NerfedAce (#22668)
• [mesheryctl] Add perf delete command @harshitsaxena214 (#22840)
• [mesheryctl] Apply perf apply --options and --cert-path to existing profiles @Eternity0207 (#22861)
• [mesheryctl] Send perf apply durations in whole seconds and reject the rest @Eternity0207 (#22858)
• [mesheryctl] Accept any case of --output-format in the output formatter factories @Eternity0207 (#22855)
• fix(mesheryctl): support relative file paths in design undeploy @ThakurUjjwal1706 (#22838)
• fix(mesheryctl): support positional file argument and validate input in design delete @ThakurUjjwal1706 (#22773)
• [mesheryctl] Validate the provider before system provider switch asks for confirmation @Eternity0207 (#22789)
• [mesheryctl] Return an error instead of exiting on stdin read failures in prompts @harshitsaxena214 (#22850)
• [mesheryctl] Prevent nil pointer dereference panic and unhandled HTTP status in perf apply @Swatantra-66 (#22801)

🖥 Meshery UI

• [UI] Parse lowercase k quantity unit in memory and disk parsers @madhavzanwar (#23247)
• [UI] Read camelCase catalogData.publishedVersion in getDesignVersion @ayushbuilds-code (#23241)
• [UI] Fix Kubernetes dashboard columns that always render empty @MuhammadFaizan-prog (#23234)
• [UI] Prevent wire-level data leakage when view permission is denied in Environments, Settings, Performance, and Extensions @Amansingh0807 (#23203)
• [UI] Add accessible noscript fallback when JavaScript is disabled @Prakhar1Ojha (#23165)
• [UI] Add quick-access Delete action to Designs @Prakhar1Ojha (#23151)
• [UI] Use supported durations in performance preferences @0xmaster7 (#23107)
• [UI] Honor hideError in widget error indicators @dropps07 (#23109)
• [UI] Fix comparator contract, state mutation, and semver sorting in versionSort utility @madhavzanwar (#23055)
• [UI] Report total successfully scanned files in MUI audit @prashil0056 (#23046)
• [mesheryctl] Fix remaining HTTP response body leaks @ItsAbir005 (#23028)
• [UI] Notify when the Designs publish schema fails to load @mayank609 (#22990)
• [Server][UI] Store and show filter configuration @Asheesh7298 (#23040)
• [UI] Reset to the first page when searching or filtering resources @mayank609 (#22992)
• [UI] Reset to the first page when searching environments, workspaces and profiles @mayank609 (#22982)
• [UI] Roll back Catalog Content preference on save failure @spacenets7 (#23029)
• [UI] List every environment in the environment pickers @Asheesh7298 (#23024)
• [UI] Add stale MUI allowlist entry reporting @Nixantsingh943 (#23006)
• [UI] Send the canonical filter import bodies @Asheesh7298 (#22983)
• Fix typos in UI util comments @Evico85 (#23019)
• [UI] Show an error when deleting a performance profile fails @mayank609 (#22986)
• [UI] Notify when the SMP mesh list fails to load in the performance form @mayank609 (#22988)
• [UI] Fix dashboard edit options overflow on small screens @ItsAbir005 (#22984)
• [UI] Fix MUI audit false success on incomplete scans @Nixantsingh943 (#22972)
• [UI] Forward pageSize in useLazyGetConnectionsQuery @krishbuilds01 (#22971)
• fix: harden event replay, stale idempotency bindings, and revision ordering @leecalcote (#22965)
• feat(server): insert events, replay idempotent creates and correlate repeated failures on MeshKit v1.0.29 @leecalcote (#22958)
• [UI] Honor hideError in ObjectFieldTemplate error indicator @dropps07 (#22957)
• [UI] Report adapter and preference save failures instead of failing silently @mayank609 (#22941)
• feat(server): adopt the error and event condition contract from meshery/schemas @leecalcote (#22950)
• [UI] Show error notifications when filter actions fail @mayank609 (#22930)
• [UI] Show a single error toast when MeshSync resources fail to load @harshiltewari2004 (#22807)
• [UI] Forward options through initiateQuery @krishbuilds01 (#22847)
• [UI] Type ArrayFieldTemplate props and fix fixed-array detection @dropps07 (#22863)
• [UI] Fix notification center infinite scroll loading past the last page @ayushgade06 (#22793)

🧰 Maintenance

• [Server] Trigger Kubernetes cluster teardown on connection deletion @Atharva-Mendhulkar (#23219)
• feat(server): adopt the error and event condition contract from meshery/schemas @leecalcote (#22950)
• [CI] Paginate changed-file validation in auto-merge-meeting-minutes (fixes #22684) @BarbieRajput (#22692)

📖 Documentation

• [Docs] Fix grammar, spelling, and formatting in mesheryctl E2E testing guide @amalsaidov (#23264)
• [Docs] Fix duplicate response schema entry in REST API reference @amalsaidov (#23265)
• [mesheryctl] Deprecate no-op --page flag on model export @ChackoPAbraham19 (#23214)
• Fix/installation docs match install script @Aravind226 (#23168)
• [Docs] Show full MESHERY_SERVER_CALLBACK_URL with /api/user/token path @amalsaidov (#23212)
• [mesheryctl] Reject ambiguous design ID prefixes @faneeshh (#23190)
• [Docs] Correct invalid flags in mesheryctl command reference @0xmaster7 (#23191)
• [Docs] Fix broken help-wanted search link on Contributing page @lishfox (#23185)
• [Server] Index the events table for Notification Center queries @ayushgade06 (#23174)
• [mesheryctl] Fix filter view example comment formatting in docs @ItsAbir005 (#23161)
• [Docs] Document model export flags in mesheryctl reference @ChackoPAbraham19 (#23169)
• [Docs] Add perf delete and system delete to mesheryctl reference @ChackoPAbraham19 (#23158)
• [Docs] Add design evaluate and registry purge to mesheryctl reference @ChackoPAbraham19 (#23148)
• [Docs] Fix "Applilcation" typo in AWS Application Autoscaling model @prashil0056 (#23141)
• [Docs] Support system theme preference and cross-tab synchronization @SajanBisht (#23137)
• fix/Reduce duplicated formatting logic in view subcommands @Aravind226 (#22928)
• [mesheryctl] Fix invalid system channel view example @BHAUMIK0711 (#23100)
• [Docs] Define AI provider Connection contract @itsCodeTide (#23091)
• [Docs] Add newcomer introduction for Rithul Raveendran @rithulraveendran (#23067)
• [mesheryctl] Fix remaining HTTP response body leaks @ItsAbir005 (#23028)
• Introduction - Lekha @lekha-saradhi (#23037)
• Fix/issue 22923 filter import url v2 @itsCodeTide (#23017)
• [Docs] Fix illegible contrast on primary alerts @Lk-ux (#23030)
• [UI] Roll back Catalog Content preference on save failure @spacenets7 (#23029)
• fix(docs): standardize OpenAPI schema URL @Om-Beast (#21638)
• Introduction - Samuel Agbokpo @SamuelAgbokpo (#23001)
• fix: harden event replay, stale idempotency bindings, and revision ordering @leecalcote (#22965)
• feat(server): insert events, replay idempotent creates and correlate repeated failures on MeshKit v1.0.29 @leecalcote (#22958)
• docs: fix Everytime typo in build and release guide @Ankitavasudev (#22777)
• feat(server): adopt the error and event condition contract from meshery/schemas @leecalcote (#22950)
• [Docs] Use the API paths the server registers @BarbieRajput (#22953)
• [Server] Prevent nil pointer dereference on in-cluster context discovery @nishant-devv (#22823)
• Create profile for Vratesh Ghadge @VrateshGhadge (#22919)
• [Catalog] Migrate Kafka design to Apache Kafka 4.4.0 @spacenets7 (#22872)
• [docs] Add introduction for Ragil Amirzaky in meeting notes @Lapnes (#22917)
• Introduction-ShubhiParashar @ShubhiParashar-CSE (#22915)
• Add introduction for Prashil in meeting notes @prashil0056 (#22916)
• Add Suryansh Garg's introduction to meetings doc @SuryanshGarg04 (#22914)
• Introduction - Rutuja.md @rutujakulkarni895-spec (#22912)
• Introduction-Andrean @etherift (#22910)
• Add Alehegne Geta's meeting notes @Alehegne (#22911)
• Add Shubhi Parashar's introduction to meetings documentation @ShubhiParashar-CSE (#22913)
• Introduction - Srishti Mishra @srishtimishra520-beep (#22909)
• Create Siddeshwar.md with personal details @spacenets7 (#22906)
• Create Dhananjay.md @dhananjaysharma2004 (#22905)
• [Docs] Add Harshil Tewari introduction for week-of-11-05-2026 newcomers meeting @harshiltewari2004 (#22907)
• Add Maanvi's introduction to meeting notes @Maanvi212006 (#22903)
• Introduction - Uchechukwu Emmanuel @onlyoneuche (#22904)
• docs: add Shape Builder extension guide @tanav29 (#22895)
• fix: correct meshery performance CLI examples @aditya-desale (#22900)
• Docs(meeting): add Nishant JS introduction for week-of-11-05-2026 @nishant-devv (#22892)
• Create PRIYESHSINGH.md for personal introduction @PRIYESHSINGH24 (#22888)
• Add newcomer meeting documentation for 2026 @Maanvi212006 (#22881)
• [Docs] Add stable error code pages and index @itsCodeTide (#22879)
• [mesheryctl] Remove the workspace --count flag that always failed @Eternity0207 (#22871)
• [mesheryctl] Add perf delete command @harshitsaxena214 (#22840)
• Add Maanvi Chetwanii's introduction to meetings doc @Maanvi212006 (#22828)

👨🏽‍💻 Contributors

Thank you to our contributors for making this release possible:
@0xmaster7, @1107-1108, @AdityaChaudhary5412, @Alehegne, @Amansingh0807, @Ankitavasudev, @Aravind226, @Asheesh7298, @Atharva-Mendhulkar, @BHAUMIK0711, @BarbieRajput, @ChackoPAbraham19, @CodeAhmedJamil, @Copilot, @Eternity0207, @Evico85, @ItsAbir005, @Karman580, @Lapnes, @Lk-ux, @Maanvi212006, @MuhammadFaizan-prog, @NerfedAce, @Nixantsingh943, @Om-Beast, @PRIYESHSINGH24, @Prakhar1Ojha, @RameshwariS, @SajanBisht, @SamuelAgbokpo, @ShubhiParashar-CSE, @Supersaiyan101, @SuryanshGarg04, @Swarup-Banik, @Swatantra-66, @ThakurUjjwal1706, @VimalN2005, @VrateshGhadge, @aarushdubey, @aditya-desale, @alexquincy, @amalsaidov, @ayanasarkar, @ayushbuilds-code, @ayushgade06, @bodapatisaikrishna, @carlosriosilva, @chellej, @dhananjaysharma2004, @dropps07, @etherift, @faneeshh, @fitzergerald, @harmanD-MAX, @harshiltewari2004, @harshitsaxena214, @hortison, @itsCodeTide, @jamieplu, @kkm121, @krishbuilds01, @leecalcote, @lekaf974, @lekha-saradhi, @lishfox, @madhavzanwar, @maindevhoon, @marblom007, @mayank609, @meshery-ci, @miacycle, @muskan-creates352, @nishant-devv, @onlyoneuche, @patelshivani2283-lab, @pontusringblom, @pranav718, @prashil0056, @rithulraveendran, @ritzorama, @rutujakulkarni895-spec, @sahillpaul, @simihablo, @spacenets7, @srishtimishra520-beep, @suttonskate, @tanav29, @winkletinkle, @yi-nuo426, Aarush Dubey, Aditya Chaudhary, Ayush, Pontus Ringblom, Prakhar1Ojha and Yi Nuo

What's Changed

Fixed

• Fix restore on WHP not rewinding the guest TSC on hosts with TSC_ADJUST support.

Full Changelog (excl. dependencies)

• fix(ci): limit setup for golden checks and benchmark reports by @cshung in #2031
• Moves the surrogate from the shared target\release\build\hls by @simongdavies in #2038
• HIP 0008: Postcard serialization for host-guest messages by @ludfjig in #1999
• Fix C# rejection tests with the stricter WIT parser by @jsturtevant in #2049
• Restore the guest TSC exactly on WHP by @ludfjig in #2022
• Test guest CET access across KVM kernels by @jsturtevant in #2051

Full Changelog (dependencies)

• chore(deps): bump log from 0.4.34 to 0.4.35 in /src/tests/rust_guests by @dependabot[bot] in #2037
• chore(deps): bump iced-x86 from 1.21.0 to 1.22.0 by @dependabot[bot] in #2035
• chore(deps): bump log from 0.4.34 to 0.4.35 by @dependabot[bot] in #2036
• chore(deps): bump actions-rust-lang/setup-rust-toolchain from 2.0.0 to 2.0.1 by @dependabot[bot] in #2032
• chore(deps): bump crate-ci/typos from 1.51.1 to 1.52.0 by @dependabot[bot] in #2034
• chore(deps): bump taiki-e/install-action from 2.87.31 to 2.89.1 by @dependabot[bot] in #2033
• chore(deps): bump cc from 1.10.0 to 1.11.0 by @dependabot[bot] in #2041
• chore(deps): bump toml from 1.1.8+spec-1.1.0 to 1.2.0+spec-1.1.0 by @dependabot[bot] in #2046
• chore(deps): bump the wasm-tools group across 1 directory with 4 updates by @dependabot[bot] in #1964
• chore(deps): bump oras-project/setup-oras from 2.0.2 to 2.0.3 by @dependabot[bot] in #2017
• chore(deps): bump taiki-e/install-action from 2.89.1 to 2.90.1 by @dependabot[bot] in #2045
• chore(deps): bump ruzstd to 0.9.1 by @jsturtevant in #2048
• chore(deps): bump libz-sys to 1.1.31 by @jsturtevant in #2047

Full Changelog: v0.19.0...dev-latest

What's Changed

Other Changes

• [backport] adk/telemetry: honor runtime content capture settings by @shashankram in #3611
• [backport] adk/sts: preserve session identity on outbound MCP requests by @shashankram in #3612
• [backport] feat: improve install and first-agent onboarding by @EItanya in #3629

Full Changelog: v1.0.0...v1.0.1

Release v5.2.15

Download Artifacts

• 📦 Krkn sources (noarch): krkn-v5.2.15-src.tar.gz

Changes

What's Changed

• Fix: Validate resiliency durations and clarify CLI help by @rohIta-k in #1652
• Adding trigger type and require type by @paigerube14 in #1686
• add guest ping time, update MTTR by @minlei98 in #1688
• fix(storage_throttle): stop the scenario when rollback registration fails by @Samurai007AK in #1679
• fix(vmi_pvc_fill): register a loadable rollback for filesystem fills by @Somay-kousis in #1693
• fix(storage_throttle): fix missing imports in serialized rollback callable by @vishalmore90 in #1685

New Contributors

• @minlei98 made their first contribution in #1688
• @vishalmore90 made their first contribution in #1685

Full Changelog: v5.2.14...v5.2.15

Merge pull request #874 from TrekkieCoder/main

gh-868 Generate packages runnable with systemd

v1.20.0

All mandatory release validation and remote verification completed for f666af06e9bd310c7e730f1523c0430e90371a89.
Charts: {"kyverno": "3.10.0-rc.5", "kyverno-policies": "3.10.0-rc.5"}.
Full matrix and diagnostics: https://github.com/kyverno/kyverno/actions/runs/43024900538.

What's Changed

Component updates ⬆️

• fix(portal): Add the missing i18n entries for the operate action and the configuration resource by @bupd in #24104
• fix(http): redact the pagination Link in rejection errors by @bupd in #24095
• fix(api): bound audited and manifest request bodies by @bupd in #24102
• fix(webhook): store the normalized target address (backport #24075) by @bupd in #24098
• [release-2.15] fix(cnai-parser): enforce actual byte limit to prevent decompression (#23497) by @Vad1mo in #24146
• [release-2.15] fix(replication): make the image resource filter take effect again (#24176) by @chlins in #24180
• [release-2.15] bump: bump Go to 1.26.10 for release-2.15.0 by @Vad1mo in #24211
• fix(http): compare the IPv6 zone identifier exactly in SameOrigin by @bupd in #24096
• fix(registry): redact the upload Location in rejection errors by @bupd in #24094
• Bump Trivy to v0.76.2 and adapter to v0.40.1-rc1 by @stonezdj in #24339
• Bump up distribution to v2.8.3-harbor.4-rc1 and bump up golang to 1.27.3 by @stonezdj in #24351
• (cherry-pick): preserve artifact type for multi-tier accessories by @stonezdj in #24360
• (cherry-pick): ignore 401 when listing labels of a Harbor registry by @stonezdj in #24359

Bump Component Version 🤖

• chore(deps-dev): bump copy-webpack-plugin from 11.0.0 to 14.0.0 in /src/portal/app-swagger-ui by @dependabot[bot] in #23847
• fix(deps): update Go modules for high severity CVEs and bump photon by @stonezdj in #24336
• Bump Trivy adapter and distribution for release-2.15.0 by @stonezdj in #24361

Full Changelog: v2.15.4...v2.15.5-rc1

Changelog

Refer to the 2.14 Upgrade Guide for backwards compatibility notes with 2.12.x. Please note that the 2.13.x version was skipped.

Go Version

• 1.26.11

Dependencies

• github.com/nats-io/jwt/v2 v2.8.3 (#8861)
• github.com/nats-io/nkeys v0.4.17 (#8861)
• github.com/antithesishq/antithesis-sdk-go v0.9.0-default-no-op (#8885)
• github.com/klauspost/compress v1.20.4 (#8885)
• golang.org/x/sys v0.50.0 (#8885)

Added

General

• Account subject mappings, imports, exports and leafnode remote permissions now support the {{account-hash()}}, {{account-hash-import()}} and {{account-hash-leaf-remote()}} subject mapping functions (#8670)
• TLS configuration now supports verify: optional, and the command line supports --tlsverify=optional, verifying client certificates when provided while allowing clients without certificates (#8812, contributed by @macphersonjamie)
• Leafnode connections now support a configurable ping_interval (#8718, contributed by @stackedbyaradhya)
• Gateway connections now support a configurable ping_interval (#8717, contributed by @stackedbyaradhya)

Monitoring

• Healthz now supports leaf-remotes-connected=true, returning an unavailable status until every enabled solicited leafnode remote is connected (#8735, contributed by @edjeffreys)

Improved

General

• Route, gateway and leafnode connection logs now include remote destinations (#8755)
• Account import failures now log their reasons at error level (#8771)
• Gateway connections now validate protocol operations consistently with route connections (#8780)

JetStream

• Filestore subject matching and pending message calculations now avoid unnecessary scans and stop earlier when matches are found (#8784, #8803, #8806, #8808, #8813)
• Looking up the last sequence for a subject no longer requires loading the message, reducing work for stream operations and fast batch publishing (#8807)
• Filestore scans with single or multiple subject filters now avoid copying messages that do not match (#8854, #8855)
• Consumer redelivery queues no longer copy all remaining entries on each dequeue, reducing delays to delivery and acknowledgement processing with large redelivery backlogs (#8635, contributed by @as-clearview)

Fixed

General

• Lame duck mode is no longer skipped when SIGTERM follows SIGUSR2 immediately, and servers continue to deliver their own replies after the lame duck event (#8750)
• Configuration reloads no longer disconnect clients authorized by auth callout when their permissions have not changed (#8759)
• Auth callout user JWT names and tags are now propagated to client information (#8720, contributed by @steve-weiland)
• Configuration reloads now wait for server startup to finish (#8728, contributed by @edelmanjm)
• Connz totals now correctly reflect user, MQTT client and subject filters (#8753, contributed by @NitinKumar004)
• Connz and Subsz pagination no longer repeats or skips entries, including connections with equal sort values (#8770)
• Windows PDH queries are now released if performance counter initialization fails (#8777, contributed by @cvas22)
• Auth callout requests are now rejected safely when system account eventing has already shut down (#8804, contributed by @davidfarah2003)
• Wildcard characters inside a subject token are no longer treated as wildcard tokens or allowed to cause subject matching collisions (#8765)
• Account updates no longer unnecessarily recheck importers when export revocations have not changed (#8851)
• Duplicate non-queue subscriptions received over routes no longer leak interest to leafnodes and gateways (#8846)
• Gateway accounts in interest-only mode no longer stop receiving messages when an in-flight message races with removal of the last subscription (#8853, contributed by @paulwe)

JetStream

• Consumer info requests no longer report success for assignments that have not been committed (#8741)
• Push consumers with a RateLimit no longer stall indefinitely when a message exceeds the rate limiter burst size (#8748)
• Stalled stream restores now report failure through the restore completion advisory, consistently with other failed restores (#8691, contributed by @akarazhev)
• JetStream no longer shuts down prematurely during server shutdown or lame duck mode (#8708, contributed by @yousefissa)
• Raft meta-group setup failures now stop the write-ahead log instead of leaking it (#8722, contributed by @clwluvw)
• Leader transfers now retry promptly when the selected successor is slow, prefer caught-up peers and avoid persisting the same term and vote twice (#8751)
• Interest retention cleanup no longer purges a stream when a consumer has a zero check floor, and compaction is bounded by the stream's last sequence (#8757, contributed by @tsite)
• Filestore MultiLastSeqs no longer skips matching subjects (#8769)
• Fixed a directory creation race when enabling account storage concurrently with stream creation (#8767, contributed by @ansh0014)
• Deleting a stream no longer races with account directory cleanup (#8774, contributed by @ansh0014)
• Sources no longer discard the remainder of a batch when one sourced message is rejected (#8772)
• Pull requests made through service imports are now removed when the requester loses interest, even while response wildcard interest remains (#8797)
• Consumers no longer deliver while a reset is in flight or report later deliveries in reset responses, and durable mirrors and sources no longer skip messages after a reset or stale delivery (#8802)
• Memory store purge and last-sequence scans are now bounded by the possible sequence range (#8815)
• Raft health checks now wait for the leader's initial data to be applied, remain stable between heartbeats and during leader changes, and allow newly assigned replicated streams and consumers time to start (#8817)
• Resuming a paused consumer now wakes its delivery loop immediately, allowing pending pull requests and push deliveries to proceed (#8791)
• AckAll acknowledgements are no longer ignored after acknowledging a redelivered message (#8839)
• Filestore recovery failures now return the original error instead of panicking, preserve existing stream data and avoid incorrect storage accounting (#8844, contributed by @rleungx)
• Streams and consumers with unsupported configuration values are now correctly marked offline, updates are rejected by meta leaders that cannot support them, and internal proposals preserve their stored configurations (#8843)
• Paused Raft followers can now request newer snapshots and compact their logs while catching up, preventing unbounded log growth and excessive memory use when replay resumes (#8842)
• Filestore recovery scans now persist per-message state indexes even if no new messages are published, and backward subject scans skip irrelevant blocks (#8849)
• Clustered health checks now report write errors on R1 streams (#8850)

Leafnodes

• Leafnode interest is now withdrawn correctly when an outbound gateway connection closes (#8758)
• Leafnode deny_imports no longer drops replies to hub requests, and account JWT or default permission updates no longer lose leafnode interest or reset permissions incorrectly (#8800)
• Leafnode connections no longer become stale when a hub sends many subscriptions during connection setup (#8811)
• Leafnode connections closed during acceptance are now removed from the server's connection list, preventing inflated leafnode counts and stale Leafz entries (#8838, contributed by @rnikhori)

Routes

• Routes without pooling now validate the route pool index correctly (#8782)

Complete Changes

v2.14.9...v2.14.10

Changelog

Refer to the 2.15 Upgrade Guide for backwards compatibility notes with 2.14.x.

Go Version

• 1.27.4

Dependencies

• github.com/nats-io/jwt/v2 v2.8.3 (#8861)
• github.com/nats-io/nkeys v0.4.17 (#8861)
• github.com/antithesishq/antithesis-sdk-go v0.9.0-default-no-op (#8885)
• github.com/klauspost/compress v1.20.4 (#8885)
• golang.org/x/sys v0.50.0 (#8885)

Added

General

• Account subject mappings, imports, exports and leafnode remote permissions now support the {{account-hash()}}, {{account-hash-import()}} and {{account-hash-leaf-remote()}} subject mapping functions (#8670)
• TLS configuration now supports verify: optional, and the command line supports --tlsverify=optional, verifying client certificates when provided while allowing clients without certificates (#8812, contributed by @macphersonjamie)
• Leafnode connections now support a configurable ping_interval (#8718, contributed by @stackedbyaradhya)
• Gateway connections now support a configurable ping_interval (#8717, contributed by @stackedbyaradhya)
• The command line now supports -t --test_reload <file> to check whether a configuration change can be reloaded or requires a restart, returning exit code 3 when a restart is required; embedded servers can use CheckReload and CheckReloadOptions (#8829)

Monitoring

• Healthz now supports leaf-remotes-connected=true, returning an unavailable status until every enabled solicited leafnode remote is connected (#8735, contributed by @edjeffreys)

Improved

General

• Route, gateway and leafnode connection logs now include remote destinations (#8755)
• Account import failures now log their reasons at error level (#8771)
• Gateway connections now validate protocol operations consistently with route connections (#8780)

JetStream

• Filestore subject matching and pending message calculations now avoid unnecessary scans and stop earlier when matches are found (#8784, #8803, #8806, #8808, #8813)
• Looking up the last sequence for a subject no longer requires loading the message, reducing work for stream operations and fast batch publishing (#8807)
• Filestore scans with single or multiple subject filters now avoid copying messages that do not match (#8854, #8855)
• Consumer redelivery queues no longer copy all remaining entries on each dequeue, reducing delays to delivery and acknowledgement processing with large redelivery backlogs (#8635, contributed by @as-clearview)
• Filestore scans with multiple subject filters now handle message blocks with many deleted messages more efficiently (#8864)
• Filestore subject scans and filtered pending-message counts now skip contiguous ranges of deleted messages (#8875, #8877)
• Loading filestore message blocks now avoids fully parsing messages when checking for Nats-TTL and Nats-Schedule headers (#8870, contributed by @adios-404)

Fixed

General

• Lame duck mode is no longer skipped when SIGTERM follows SIGUSR2 immediately, and servers continue to deliver their own replies after the lame duck event (#8750)
• Configuration reloads no longer disconnect clients authorized by auth callout when their permissions have not changed (#8759)
• Auth callout user JWT names and tags are now propagated to client information (#8720, contributed by @steve-weiland)
• Configuration reloads now wait for server startup to finish (#8728, contributed by @edelmanjm)
• Connz totals now correctly reflect user, MQTT client and subject filters (#8753, contributed by @NitinKumar004)
• Connz and Subsz pagination no longer repeats or skips entries, including connections with equal sort values (#8770)
• Windows PDH queries are now released if performance counter initialization fails (#8777, contributed by @cvas22)
• Auth callout requests are now rejected safely when system account eventing has already shut down (#8804, contributed by @davidfarah2003)
• Wildcard characters inside a subject token are no longer treated as wildcard tokens or allowed to cause subject matching collisions (#8765)
• Account updates no longer unnecessarily recheck importers when export revocations have not changed (#8851)
• Configuration checks with -t now apply command line flags and validate options consistently with server startup (#8829)
• Duplicate non-queue subscriptions received over routes no longer leak interest to leafnodes and gateways (#8846)
• Gateway accounts in interest-only mode no longer stop receiving messages when an in-flight message races with removal of the last subscription (#8853, contributed by @paulwe)
• Encrypted auth callouts are now rejected when the server has no XKey available (#8878)

JetStream

• Consumer info requests no longer report success for assignments that have not been committed (#8741)
• Push consumers with a RateLimit no longer stall indefinitely when a message exceeds the rate limiter burst size (#8748)
• Stream scale-up from R1 can now make progress under continuous writes, and scale-down no longer stalls on peers that were never added as members (#8762)
• Stalled stream restores now report failure through the restore completion advisory, consistently with other failed restores (#8691, contributed by @akarazhev)
• JetStream no longer shuts down prematurely during server shutdown or lame duck mode (#8708, contributed by @yousefissa)
• Raft meta-group setup failures now stop the write-ahead log instead of leaking it (#8722, contributed by @clwluvw)
• Leader transfers now retry promptly when the selected successor is slow, prefer caught-up peers and avoid persisting the same term and vote twice (#8751)
• Interest retention cleanup no longer purges a stream when a consumer has a zero check floor, and compaction is bounded by the stream's last sequence (#8757, contributed by @tsite)
• Filestore MultiLastSeqs no longer skips matching subjects (#8769)
• Fixed a directory creation race when enabling account storage concurrently with stream creation (#8767, contributed by @ansh0014)
• Deleting a stream no longer races with account directory cleanup (#8774, contributed by @ansh0014)
• Sources no longer discard the remainder of a batch when one sourced message is rejected (#8772)
• Pull requests made through service imports are now removed when the requester loses interest, even while response wildcard interest remains (#8797)
• Consumers no longer deliver while a reset is in flight or report later deliveries in reset responses, and durable mirrors and sources no longer skip messages after a reset or stale delivery (#8802)
• Memory store purge and last-sequence scans are now bounded by the possible sequence range (#8815)
• Raft health checks now wait for the leader's initial data to be applied, remain stable between heartbeats and during leader changes, and allow newly assigned replicated streams and consumers time to start (#8817)
• Resuming a paused consumer now wakes its delivery loop immediately, allowing pending pull requests and push deliveries to proceed (#8791)
• AckAll acknowledgements are no longer ignored after acknowledging a redelivered message (#8839)
• Filestore recovery failures now return the original error instead of panicking, preserve existing stream data and avoid incorrect storage accounting (#8844, contributed by @rleungx)
• Streams and consumers with unsupported configuration values are now correctly marked offline, updates are rejected by meta leaders that cannot support them, and internal proposals preserve their stored configurations (#8843)
• Paused Raft followers can now request newer snapshots and compact their logs while catching up, preventing unbounded log growth and excessive memory use when replay resumes (#8842)
• Filestore recovery scans now persist per-message state indexes even if no new messages are published, and backward subject scans skip irrelevant blocks (#8849)
• Clustered health checks now report write errors on R1 streams (#8850)
• Removed peers in unmanaged Raft groups can no longer rejoin as leader (#8847)
• Scaling streams and consumers to or from R1 no longer loses writes or acknowledgements during the transition or violates atomic batch guarantees (#8766)
• Resetting consumers with the last_per_subject delivery policy now rebuilds the last-message-per-subject selection, preserves the correct delivery position after leader changes, and reports lookup errors instead of ignoring them (#8862)
• Filestore encryption key creation failures no longer leak file descriptors (#8873)
• The filestore access-time worker now shuts down reliably when the last store closes, preventing worker leaks or stopped timestamp updates when stores are reopened (#8794, contributed by @ajaykr0905)
• Rebuilding message deduplication state now skips deleted messages and expires restored entries at the end of their original duplicate window (#8874)
• Restoring a stream from a V2 snapshot now rebuilds message deduplication state, restoring duplicate detection and Nats-Expected-Last-Msg-Id checks without a server restart (#8871, contributed by @muhadyan)

Leafnodes

• Isolated spoke leafnodes no longer forward downstream leafnode interest to their hubs, and avoid collecting interest that cannot be forwarded (#8749)
• Leafnode interest is now withdrawn correctly when an outbound gateway connection closes (#8758)
• Fixed a data race when reading route leafnode origin support (#8779)
• Leafnode deny_imports no longer drops replies to hub requests, and account JWT or default permission updates no longer lose leafnode interest or reset permissions incorrectly (#8800)
• Leafnode connections no longer become stale when a hub sends many subscriptions during connection setup (#8811)
• Leafnode connections closed during acceptance are now removed from the server's connection list, preventing inflated leafnode counts and stale Leafz entries (#8838, contributed by @rnikhori)
• Enforcing account leafnode connection limits no longer risks a deadlock when processing remote connection counts (#8873)

Routes

• Routes without pooling now validate the route pool index correctly (#8782)

Complete Changes

v2.15.2...v2.15.3

Rolling build of main at commit 1334434.

Changelog

Bug Fixes

• 0a744fd fix(e2e): poll seed client task content instead of sleeping one second (#5097)
• 0615401 fix(job): encode Redis credentials using URL userinfo (#5065)
• 89333b3 fix(scheduler): reclaim persistent hosts that can not be loaded and tolerate fields added in v2.5.0 (#5049)

Dependency updates

• e48b7cc chore(deps): bump d7y.io/hashring from v0.2.0 to v0.3.0 (#5100)
• cbbe27d chore(deps): bump docker/login-action from 4.7.0 to 4.8.0 (#5103)
• f3d2960 chore(deps): bump github.com/avast/retry-go/v5 from 5.0.0 to 5.1.1 (#5111)
• 8172ef3 chore(deps): bump github.com/onsi/ginkgo/v2 from 2.33.1 to 2.34.0 (#5110)
• 1af1d67 chore(deps): bump github/codeql-action/upload-sarif from 4.39.1 to 4.39.3 (#5106)
• d398efa chore(deps): bump kentaro-m/auto-assign-action from c8e3c55d4a048066a8f4fca0070c2f2db65a20a5 to f0f2d0c11ed2677e95f2408d27493b215ddd57b0 (#5096)

Chores

• d73d3cc Enhance multi-platform image preheat and deduplication process (#5112)
• afb8bc2 chore(e2e): bump proxy download test file size to 100MiB (#5099)
• f41d35c set HttpOnly on the manager jwt auth cookie (#5038)

Contributors

Thanks to all the contributors! ❤️

fix(backport): batch for release-1.7, 2026-11-09 (#5246)

## What this PR does

Backports to `release-1.7` from `main`, picked by the rules of the
[backport
policy](https://github.com/cozystack/cozystack/blob/main/docs/release/backports.md)
in merge order. A merged pull request comes as its own commits, picked
with `git cherry-pick -x` so each keeps its author, message and
sign-offs, and a merge commit that carries the original's merge message
with a `Backported-from:` trailer naming it; a squash-merged one comes
as one pick. `backport-batch verify` checks that shape. A pick listed as
changed differs from the commit it came from; `git range-diff
<merge>^1..<merge>^2 <batch merge>^1..<batch merge>^2` shows how. A
conflict or a failing check here is a [backport
task](https://github.com/cozystack/cozystack/blob/main/docs/release/backport-tasks/README.md).

- [#4756](#4756)
`fix(backupstrategy-controller): run backup clients on a package-owned
image`, 2 commits, changed in the pick: `48d0cb2958a5`
- [#4867](#4867) `fix(e2e):
keep chainsaw asserts polling through transient API errors`, 1 commit
- [#4888](#4888) `fix(ci):
dispatch frozen-line builds with GITHUB_TOKEN`, 1 commit
- [#4985](#4985) `fix(etcd):
stop counting canceled watch streams as failed gRPC requests`, 1 commit
- [#5005](#5005)
`fix(tcp-balancer): cap HAProxy fds and threads by the pod's own
limits`, 1 commit
- [#4917](#4917)
`fix(kubernetes): run Proxmox CCM v0.16.1 and pin the Proxmox images by
digest`, 2 commits
- [#4974](#4974)
`fix(kubernetes-nodes): plan autoscaler capacity on the cores the VM
actually gets`, 1 commit
- [#4971](#4971) `fix(e2e):
keep the Proxmox tenant kubeconfig per run and remove it`, 2 commits
- [#4970](#4970) `fix(e2e):
read the KubernetesNodes pool release in the HelmRelease guard`, 3
commits
- [#4972](#4972) `fix(e2e):
validate the leak allowlist against every suite layout`, 3 commits
- [#5082](#5082)
`fix(marketplace): pin a tapped repository to a digest instead of a
mutable tag`, 15 commits, changed in the pick: `a31ae9090928`,
`b326e0badd62`, `a3d883b4bf5b`, `f8509450f7ca`
- [#4004](#4004)
`fix(dashboard): link a tenant row to its detail page`, 2 commits
- [#5212](#5212)
`fix(cilium): pass the CiliumNode list to jq on stdin in the IPAM hook`,
1 commit
- [#5213](#5213)
`fix(kubernetes): move the OIDC users out of the bootstrap Job's
script`, 1 commit
- [#5208](#5208)
`fix(clickhouse): restore the archive a Backup was taken as`, 3 commits
- [#5230](#5230)
`fix(backups): re-render the default backup objects when the S3 endpoint
changes`, 8 commits
- [#5133](#5133)
`fix(securitygroups): project a membership-only group to a policy Cilium
accepts`, 1 commit
- [#5091](#5091)
`fix(postgres): render the declared databases in a stable order`, 1
commit
- [#5123](#5123)
`fix(mariadb-operator): derive the cluster name from the platform
domain`, 2 commits
- [#5151](#5151) `fix(redis):
run one Sentinel when Redis runs a single pod`, 5 commits
- [#5124](#5124)
`fix(lineage, kubernetes): resolve CAPK node VMs to their cluster`, 2
commits
- [#5184](#5184) `fix(api):
read pool usage under the quota key the controller counts`, 1 commit
- [#5190](#5190)
`fix(platform): remove the dead registries value and patch-containerd
Secret`, 2 commits
- [#5211](#5211)
`fix(postgres): fail a backup job as soon as its cnpg Backup fails`, 1
commit
- [#5155](#5155)
`fix(postgres): refuse system databases and never drop them`, 1 commit
- [#5207](#5207)
`fix(mariadb): fail backup and restore jobs whose operator Job failed`,
5 commits
- [#5024](#5024)
`fix(kubernetes, monitoring): send tenant cluster metrics to the
tenant's vminsert`, 1 commit

### Maintainer overrides

- [#5083](#5083)
`fix(workloadmonitor): stop doubling the bucket- prefix in bucket
Workload names`: `backport/skip`, left out
- [#4973](#4973)
`fix(kubernetes-nodes): refuse a partial resources spec on every pool`:
`backport/skip`, left out
- [#5180](#5180) `fix(tests):
keep two unit tests green after the release image restamp`:
`backport/skip`, left out

### Skipped

- Rule 1, already on `release-1.7`: 19
- Rule 2, the title type is not `fix` or `security`, or the scope is
`deps`: 26
- Rule 3, a breaking change: 5
- Rule 4, touches platform migrations, `targetVersion` or a CRD, or
makes a sizeable API change: 2

<details><summary>Rule 1, already on `release-1.7`</summary>

- [#4815](#4815)
`fix(vm-disk): name the importer error in the disk's WorkloadsReady
message`, `its 2 commits picked, the last in 4323363`
- [#4293](#4293)
`fix(fluxcd): keep Helm uninstall working during flux-plunger recovery`,
`its 1 commit picked, the last in 0210407`
- [#4791](#4791)
`fix(kubernetes): keep NFS publish from hanging on a dead server`, `its
1 commit picked, the last in fa88bd1`
- [#4830](#4830)
`fix(multus): drop the CPU limit and make resources configurable`, `its
2 commits picked, the last in 363c842`
- [#4865](#4865) `fix(kafka):
pass the container limits to the Kafka JVMs`, `its 3 commits picked, the
last in fc38a54`
- [#4866](#4866)
`fix(linstor): mark volumes restored from a snapshot DRBD-initialized`,
`its 1 commit picked, the last in f9550b7`
- [#4819](#4819)
`fix(seaweedfs): build SeaweedFS in-tree with a bounded S3 read-ahead`,
`its 5 commits picked, the last in 7f4c346`
- [#3427](#3427)
`fix(backups): prepare standalone VMDisk restore targets and add VM
backup/restore e2e round-trips`, `its 3 commits picked, the last in
4ac0cd5`
- [#4889](#4889)
`fix(monitoring): send alerts to every Alertmanager replica`, `its 1
commit picked, the last in 5033d53`
- [#4929](#4929)
`fix(backups): gate every default Strategy CR on its CRD`, `its 2
commits picked, the last in dee1eef`
- [#4914](#4914)
`fix(fluxcd): close the flux-plunger review follow-ups for the hook,
drain and Warnings`, `its 7 commits picked, the last in a8e4916`
- [#4939](#4939)
`fix(cluster-api): resync capi-operator every minute`, `its 1 commit
picked, the last in cc8d6a4`
- [#5027](#5027) `fix(hack):
keep the backup stack in the vminstance selective install`, `its 1
commit picked, the last in 8ba8386`
- [#4955](#4955)
`fix(vm-disk): let CDI adopt the PVC a Velero restore recreates`, `its 2
commits picked, the last in 691d7bc`
- [#5071](#5071)
`fix(marketplace): do not install a connected repository's components on
connect`, `its 2 commits picked, the last in 25f8f11`
- [#5086](#5086)
`fix(tenant): stop the gateway release waiting on TenantGateway
listeners and certificates`, `its 1 commit picked, the last in
18b2249`
- [#5087](#5087)
`fix(controller): carry healthCheckExprs and waitStrategy to existing
releases`, `its 1 commit picked, the last in d2a452e`
- [#5088](#5088)
`fix(ingress-nginx): drop the admission-webhook policy a rebase brought
back`, `its 1 commit picked, the last in cf00b41`
- [#5142](#5142)
`fix(release): keep release bodies within GitHub's size limit`, `its 1
commit picked, the last in c740515`

</details>

<details><summary>Rule 2, the title type is not `fix` or `security`, or
the scope is `deps`</summary>

- [#4845](#4845)
`docs(governance): welcome new contributors and link LF sanctions
guidance`, `type docs`
- [#4881](#4881)
`feat(bucket): add a ui flag to skip the s3manager web UI`, `type feat`
- [#4899](#4899) `chore: link
the FOSSA license scan for CLOMonitor`, `type chore`
- [#4898](#4898)
`feat(backups): back up Valkey with the Redis strategy`, `type feat`
- [#4940](#4940)
`docs(release): add changelog for v1.6.5`, `type docs`
- [#4861](#4861)
`feat(release): sign the release assets and attach a source SBOM`, `type
feat`
- [#3780](#3780) `docs: move
the operator guides out of docs/ to where readers find them`, `type
docs`
- [#4936](#4936)
`docs(release): check changelog claims against the code`, `type docs`
- [#4959](#4959)
`docs(release): point changelog check B at the Talos installer profile`,
`type docs`
- [#3777](#3777)
`docs(agents): define where a new document belongs`, `type docs`
- [#5025](#5025)
`test(harbor): pin the resources of the nginx proxy and the portal`,
`type test`
- [#5039](#5039)
`feat(keycloak): load additional CA files from Secret or ConfigMap
keys`, `type feat`
- [#4860](#4860)
`feat(kubernetes-nodes): trust a factory CA in the Proxmox template
script`, `type feat`
- [#5090](#5090) `ci(e2e):
end the Proxmox lane's SSH key with a newline`, `type ci`
- [#4969](#4969)
`test(kubernetes): pin RetryOnFailure on the Proxmox csi release`, `type
test`
- [#5000](#5000)
`test(kubernetes): name the Proxmox fixture's node pool
<cluster>-<pool>`, `type test`
- [#5168](#5168)
`docs(agents): steer agents away from Helm lookup`, `type docs`
- [#4997](#4997)
`feat(release): attach an SBOM to every release image`, `type feat`
- [#3440](#3440)
`ci(api-review-gate): publish the gate as a commit status`, `type ci`
- [#5034](#5034) `docs: move
the repo-only guides onto the website`, `type docs`
- [#5215](#5215)
`feat(monitoring-agents): export PVC labels from kube-state-metrics`,
`type feat`
- [#5217](#5217)
`feat(monitoring-agents): keep application identity in container log
streams`, `type feat`
- [#5171](#5171) `feat(api):
expose HelmRelease failure state on Application status`, `type feat`
- [#5237](#5237)
`feat(operator): let the platform source trust a private registry CA`,
`type feat`
- [#5106](#5106)
`feat(release): make backports automatic with backport-batch`, `type
feat`
- [#4983](#4983) `feat(api):
add the reservation evaluator for tenant quotas`, `type feat`

</details>

<details><summary>Rule 3, a breaking change</summary>

- [#4790](#4790)
`fix(platform)!: refuse a networking variant change on a live cluster`,
`! in the title`
- [#4796](#4796)
`fix(vm-disk)!: refuse a golden-image clone CDI would leave unbound`, `!
in the title`
- [#5085](#5085)
`fix(kubernetes, opensearch, foundationdb)!: restrict managed
application images`, `! in the title`
- [#4818](#4818)
`fix(keycloak)!: make the KMS proxy keep its keys across restarts`, `!
in the title`
- [#5167](#5167)
`fix(monitoring-agents)!: isolate merged log payload under
log_processed`, `! in the title`

</details>

<details><summary>Rule 4, touches platform migrations, `targetVersion`
or a CRD, or makes a sizeable API change</summary>

- [#4941](#4941)
`fix(backups): keep the backupstrategy-controller Helm release under the
Secret size limit`, `a sizeable API change (breaking-change: [v1alpha1]
spec.spec.template: field "metadata" was removed, and 5 more), a CRD`
- [#5223](#5223)
`fix(backups): report sizeBytes for MariaDB and CNPG backup artifacts`,
`a CRD`

</details>

```backport-batch
{"line":"release-1.7","deferred":[]}
```

### Screenshots

See the original pull requests.

### Downstream repositories

- [ ] No downstream repository is affected by this change
- [ ] [cozystack/website](https://github.com/cozystack/website) -
follow-up:
- [ ]
[cozystack/terraform-provider-cozystack](https://github.com/cozystack/terraform-provider-cozystack)
- follow-up:
- [ ]
[cozystack/ansible-cozystack](https://github.com/cozystack/ansible-cozystack)
- follow-up:
- [ ] [cozystack/ccp](https://github.com/cozystack/ccp) - follow-up:
- [ ] [cozystack/talm](https://github.com/cozystack/talm) - follow-up:
- [ ] [cozystack/cozyhr](https://github.com/cozystack/cozyhr) -
follow-up:
- [ ] [cozystack/cozy-proxy](https://github.com/cozystack/cozy-proxy) -
follow-up:
- [ ]
[cozystack/cozystack-telemetry-server](https://github.com/cozystack/cozystack-telemetry-server)
- follow-up:
- [ ]
[cozystack/external-apps-example](https://github.com/cozystack/external-apps-example)
- follow-up:
- [ ] [cozystack/examples](https://github.com/cozystack/examples) -
follow-up:
- [ ] [cozystack/community](https://github.com/cozystack/community) -
follow-up:

### Release note

```release-note
fix(backupstrategy-controller): the ClickHouse (Altinity) and RabbitMQ backup strategy Pods now run a dedicated `backup-http-client` image (alpine + curl + jq + ca-certificates, non-root, ~7 MB) instead of the 349 MB `platform-migrations` image. Air-gapped mirrors need the new `ghcr.io/cozystack/cozystack/backup-http-client` repository.

fix(e2e): a chainsaw assert in the e2e suites keeps polling through a transient API error such as an etcd leader change, instead of failing the suite long before its timeout.

fix(ci): use GITHUB_TOKEN to start the initial packages build when freezing a release line

fix(etcd): the tenant etcd alert etcdHighNumberOfFailedGRPCRequests now counts only the gRPC codes that the etcd mixin and the platform copy of the alert count, so the Canceled watch streams of a Kubernetes API server that stops no longer fire it on every etcd member.

fix(tcp-balancer): HAProxy now takes its fd and thread caps from the replica's memory and CPU limits instead of the node, so a t1.nano balancer is no longer OOMKilled on nodes with many CPUs. maxconn follows the memory limit at about 16 connections per MiB, 2035 on t1.nano, and the pods roll once on upgrade.

fix(kubernetes): the Proxmox cloud-controller-manager now runs v0.16.1, and the Proxmox CCM and CSI driver images are pinned by digest. The v0.15.0 tag referenced before was re-pushed upstream to a build that panics on start, which left every new Proxmox worker with the uninitialized taint.

fix(marketplace): a tapped repository is pinned to a digest instead of following a mutable tag, so moving the tag upstream no longer changes what runs in the cluster; connect accepts oci://...＠sha256:... and an optional keyless cosign verify policy (anchored to an exact identity and preserved across re-connects), and with verify flags the CLI verifies the signature and pins the verified digest at tap time.

fix(dashboard): tenant name in the tenant list links to its detail page now (where Delete is), and top level tenants get their Edit button back.

fix(cilium): the IPAM migration hook no longer fails with "Argument list too long" on clusters with more than a few nodes, which blocked the cilium upgrade and every package that depends on networking.

fix(kubernetes): the OIDC bootstrap Job no longer fails to start for a tenant cluster with about 240 or more oidc.users, the bindings now come from a ConfigMap the Job mounts.

fix(clickhouse): a RestoreJob now restores the archive its Backup was taken as, not the newest one. New Backups record the archive name, Backups taken before this release are restored best effort from the newest archive stamped no later than their takenAt, with a warning in the restore pod log. A ClickHouse BackupJob created again under a name whose Backup still exists now fails instead of reporting that Backup as its result.

fix(backups): the backup controller now re-renders the Velero BSL, the default backup strategies and the platform bucket's credentials Secret when their S3 endpoint is stale, so after the platform bucket's BucketAccess is re-granted for a new publishing.host, backups move to the new endpoint without forcing releases by hand.

fix(securitygroups): a SecurityGroup with attachments and no rules no longer leaves an invalid CiliumNetworkPolicy behind; its backing policy is now accepted by Cilium and still allows or denies nothing.

fix(postgres): the init script renders the declared databases in a stable order, so an upgrade that leaves the databases unchanged no longer rewrites the init-script Secret.

fix(mariadb-operator): the MariaDB operator now uses the platform's networking.clusterDomain instead of a hard-coded cozy.local, so replication and User/Database/Grant reconciliation work on clusters with a non-default cluster domain.

fix(redis): an instance with `replicas: 1` now runs one Sentinel instead of three, without a Sentinel PodDisruptionBudget; on upgrade, the PDB the operator created earlier is deleted. Instances with two replicas or more are unchanged.

fix(lineage, kubernetes): the virt-launcher pods of Kubernetes worker nodes are now resolved to their Kubernetes application and marked as managed by Cozystack, so a SecurityGroup attached to a Kubernetes cluster now applies to its worker nodes, not only to its control plane.

fix(api): tenant quota admission now counts the parent pool's usage of extended resources and hugepages, so a child tenant can no longer get a share the parent has already used. After upgrading, updates to existing tenants may be rejected if their quota for these resources exceeds the parent's remaining budget. This includes updates that leave the quota unchanged.

fix(postgres): a Postgres BackupJob now fails as soon as its CloudNativePG Backup fails, with the recorded error, instead of after 30 minutes, and a BackupJob waiting on a CloudNativePG Backup reports a WaitingForCNPGBackup condition with the Backup's phase.

fix(postgres): databases now refuses the PostgreSQL system databases postgres, template0 and template1, and the init job never runs DROP DATABASE on them. A system database a previous version took over is handed back to the superuser on the next upgrade (event trigger removed, ownership and public schema restored, its <db>_admin and <db>_readonly roles dropped). A release that declares one of them must remove the entry before upgrading.

fix(mariadb): a MariaDB BackupJob or RestoreJob whose operator Job failed now ends Failed instead of Succeeded, and a failed backup no longer creates a Ready Backup without an archive. Backups created by failed runs before this fix are not removed; restoring from one can fail or select another dump from the shared prefix.

fix(kubernetes, monitoring): the vmagent of tenant Kubernetes clusters now writes to the tenant's vminsert and labels series with the owning tenant instead of `cozy-monitoring`. Previously no tenant cluster metric reached the tenant's Monitoring.
```

fix(SCIM): Correcting SCIM NPE

resolves #55058

Signed-off-by: Martin Reinhardt <martin@m13t.de>

See docs/releases/v1.57.0-next.2-changelog.md for more information.

This is a "canary" release of the most recent commits on our main branch. Canary is not stable.
It is only intended for developers wishing to try out the latest features in Spin, some of which may not be fully implemented.

Signed-off-by: Sebastian (Tiedtke) Huckleberry sebastiantiedtke@gmail.com

Security

• Addresses CVE-2026-121885, untrusted image labels could be used to trick podman auto-update into restarting incorrect systemd units GHSA-55rm-rwr7-q2wr.
• Addresses CVE-2026-111361, malicious containers images could be able to bypass Digest and Signature validation GHSA-pggw-qqjf-6cxw.
• Addresses CVE-2026-123876, default seccomp profile socket deny rule could be bypass by a malicious container.

Features

• The podman push command now supports a new option, --platform, which selects and pushes a single platform-specific manifest instead of the entire list.
• The podman kube play command now supports a new option, --validate, which determines how unrecognized YAML fields are handled (#18332).
• The podman kube play command now supports a new option, --label, to set labels on created containers, pods, volumes, and secrets (#26450).
• The podman kube play command can now create multiple pods if more than 1 replica is requested by a deployment using the new --multiple-pods option (#26769).
• The podman kube play --build command now supports building images from subdirectories of the main context directory (#28148).
• Quadlet .container files now support a new key, Umask, to set the default umask for the created container (#25278).
• All Quadlet files now support a new key, SetMountsDependency, configuring whether the generated unit will use RequiresMountsFor, WantsMountsFor, or no dependency at all on required source paths (#29946).
• The podman farm list command now supports two new options, --quiet, which will print only the names of active farms, and --noheading, which omits column headers from the output.
• The podman artifact ls command now supports two new options, --format=json, which will output machine-readable JSON, and --quiet, which prints only artifact digests.
• The podman create command now supports a new option, --passwd, to add entries to /etc/passwd in the container (this has previously been available with podman run).
• The podman info command now includes detailed information on the features supported by OCI runtimes.
• The podman events --filter command now supports a new filter, network=, to filter to events pertaining to a specific network (#29387).
• The podman auto-update command has been enabled on the remote Podman client.
• The StartInterval field in image healthcheck configuration is now respected, allowing images to configure startup healthchecks (#27724).
• The podman image scp command now supports two new options, --compression-format and --compression-level, to compress data during transfer (#23192).
• The podman auto-update command now supports a new option, --filter, to selectively update only containers that match the given filters.
• The podman ps --sort command now allows sorting by pod.
• The podman ps --filter command now supports a new filter, status!, which matches containers not in the given state (#21398).

Changes

• Podman now requires Go v1.26 or higher to build.
• The Podman machine WSL provider now has native systemd support, existing machines continue to be supported for now with our old custom systemd setup. We require at least WSL version 2.5.1 now, although we recommend using at least 2.7.5 for proper nftables networking support.
• The podman kube play command now uses the securityContext.seccompProfile fields in Kubernetes YAML for Seccomp configuration. Support for the existing annotation-based configuration of Seccomp is now deprecated, and will be removed with Podman 7.0.
• The podman inspect command on containers now includes three new fields, DNSNames (containing all names the container can be accessed via), IsInitCtr (whether the container is an init container), and InitContainerType (what type of init container this is, if it is one) (#29811).
• The podman inspect command on containers now only includes user-added DNS aliases in the Aliases field, which previously displayed all DNS aliases, improving Docker compatibility.
• The podman inspect command on containers now properly populates the ConsoleSize field for running containers (#28368).
• Systemd units created by Podman healthchecks are now named much more clearly (libpod-healthcheck-$CONTAINERID-$randsuffix.service) (#29373).
• Signal proxying is now enabled for attached podman exec commands. As such, killing a podman exec command with Control-C or similar should now also kill the processes started in the container (similar to how podman run already works) (#19486).
• The deprecated --cpu-rt-period and --cpu-rt-runtime options for podman create, podman run, podman update, and podman container clone are now hidden and undocumented. They have not been functional since the removal of cgroups v1 support and will be removed entirely in Podman v7.
• The --health-startup-interval option to podman create, podman run, and podman update has a new alias, --health-start-interval.
• When a startup healthcheck interval is specified, but no startup healthcheck command, the standard healthcheck command will be used instead.
• When using the journald event driver, timestamps are no longer included in logged events, as journald includes a timestamp already (#29835).
• Quadlet can now create template instances from instance-specific drop-in directories without requiring an explicit instance file or symlink (#27636).

Bugfixes

• Fixed a bug where passing an empty file to the --ignorefile option to podman build would cause the .dockerignore or .containerignore file in the context directory to be used, instead of not using an ignorefile at all (#25147).
• Fixed a bug where the Pod= key in Quadlet .container files did not expand the %N specifier (#29108).
• Fixed a bug where containers created with --userns=auto would report having a private user namespace in podman inspect after they started, but not when they were first created.
• Fixed a bug where logging was configured too late in the Podman init process to print errors from parsing configuration files (#25362).
• Fixed a bug where the podman system prune --build command could fail if a build container was removed while it was running.
• Fixed a bug where copy events from podman machine cp were not properly displayed by the remote Podman client.
• Fixed a bug where the podman farm build --tag command would fail if given a tag including a colon (#25039).
• Fixed a bug where the podman machine init --image command would fail when given a read-only disk image.
• Fixed a bug where the podman machine start and podman machine init --now commands could hang on Windows systems using the Hyper-V provider if the VM failed to start (#29455).
• Fixed a bug where the podman machine start command on Windows (both Hyper-V and WSL providers) would sometimes fail due to leftover processes from previous machines (#29474).
• Fixed a bug where the podman machine start command could hang indefinitely if the VM failed to start properly (#29880).
• Fixed a bug where the podman machine start command could create a VM that cannot be connected to on Windows if the host was shut down or restarted when the VM was running (#29971).
• Fixed a bug where the podman machine init command on Windows when using the Hyper-V provider did not correctly detach the file server process, causing VMs to lose access to host shares when the console that ran podman machine init closed (#29573).
• Fixed a bug where the podman kube play command incorrectly handled emptyDir volumes with medium: Memory, causing them to not be shared between containers in the pod and to ignore the sizeLimit parameter (#29555).
• Fixed a bug where the remote Podman client's podman kube play command incorrectly handled authentication credentials in API requests.
• Fixed a bug where volumes created by the podman volume import command would not adjust their permissions on being mounted into a container (#25442).
• Fixed a bug where the podman build command could leak temporary directories if a build failed (#22642).
• Fixed a bug where containers created with --userns=keep-id would use an image-specified user instead of forcing the same UID/GID in use on the host (#29600).
• Fixed a bug where the remote Podman client could not function when connecting over SSH to a server which does not support the direct-streamlocal channel type (#27814).
• Fixed a bug where the remote Podman client's podman push, podman artifact push, and podman manifest push commands would push an unsigned image instead of failing when the --sign-by or --sign-by-sigstore-private-key options were used.
• Fixed a bug where creating a container with --userns=auto that had overlay volume mounts would fail (#28758).
• Fixed a bug where volume subpaths including a = character in the path were handled incorrectly.
• Fixed a bug where the remote Podman client was unable to add subjects to artifacts with the podman manifest annotate --subject and podman manifest add --artifact subject commands.
• Fixed a bug where the remote Podman client's podman manifest add --artifact command could hang under some circumstances.
• Fixed a bug where the podman manifest annotate --os-features command did not properly save the OS features in the manifest.
• Fixed a bug where the remote Podman client's podman image prune --filter did not correctly handle filters with values including the = character.
• Fixed a bug where Quadlet .volume units did not recreate the volume if it was removed in Podman (#27862).
• Fixed a bug where containers with a failing startup healthcheck would not immediately transition to unhealthy when the startup period ended.
• Fixed a bug where containers started with --sdnotify=healthy and a HealthStartPeriod longer than the unit's TimeoutStartSec could be automatically killed by systemd if the healthcheck took an extended period to become healthy (#27290).
• Fixed a bug where the --pids-limit=0 argument to podman run and podman create was incorrectly setting a process limit, instead of removing the limit, when the runc OCI runtime was in use (#29826).
• Fixed a bug where Quadlet did not search the parent directory of symlinked unit files for drop-in configuration files, which broke using Quadlets defined by root as a rootless user if drop-in overrides were in use (#29821).
• Fixed a bug where the podman ps and podman pod ps commands would fail when the --format argument was used with a format string including .Label (#29831).
• Fixed a bug where the podman cp command did not respect volume subpaths when copying into a mounted named or image volumes in a container that is not running (#29840 and #29857).
• Fixed a bug where volume plugins were initialized when they were not required, which could cause early-boot containers started by Quadlet to error on missing plugins that the container was not actually using (#28110).
• Fixed a bug where the podman export command, when run by a rootless user on a container created with --userns=keep-id, would create an archive with incorrect UIDs and GIDs (#29856).
• Fixed a bug where the podman system service command would fail to start when run as a systemd unit and autostarted at the same time as other Podman units (#29964).
• Fixed a bug where the podman events command would return incomplete output when using the file events backend and --until specified with a time in the past (#29579).
• Fixed a bug where the podman update command allowed setting a startup healthcheck on a container without a normal healthcheck.
• Fixed a bug where the remote Podman client's podman secret rm command would fail when given an ambiguous name that could match multiple possible secrets.
• Fixed a bug where the podman machine info command would report the default VM type and config/image directories, not those used by the current machine.
• Fixed a bug where the podman inspect command on containers did not include CheckpointLog after a failed container checkpoint (#25154).

API

• The Libpod API now features a new endpoint, POST /libpod/autoupdate, which automatically updates containers with the io.containers.autoupdate label.
• The Compat API now features a new endpoint, GET /distribution/{name}/json, which inspects an image on a registry (#17726).
• The Compat Create endpoint for Containers now supports a new field, HostConfig.Mounts.TmpfsOptions.Options, to set additional options for tmpfs mounts.
• The Compat Create endpoint for Containers now allows a full Seccomp profile to be passed in the HostConfig.SecurityOpt field (instead of a path to a file containing a profile), improving Docker compatibility (#27710).
• The Compat Push endpoint for Images now supports a new query parameter, platform, to push only a single platform-specific manifest instead of the entire list.
• The Compat Info endpoint now includes the status of active OCI runtimes.
• Fixed a bug where the Libpod Create endpoint for Containers required that the auto userns mode also specify full UID/GID mappings for the created container.
• Fixed a bug where the Compat Create endpoint for Containers would incorrectly adjust mode when setting tmpfs size.
• Fixed a bug where the Compat Create endpoint for Containers would incorrectly treat a healthcheck of {} as the user explicitly requesting no healthcheck, instead of using the image's healthcheck as Docker does (#29467).
• Fixed a bug where the Compat Inspect endpoint for Secrets allowed the showsecret query parameter, which should be restricted to Libpod API requests only (#29570).
• Fixed a bug where the Compat Inspect endpoint for Images included the Created field even when it was empty.
• Fixed a bug where the Compat List and Inspect endpoints for Networks did not include IPRange in the returned IPAMConfig (#28378).
• Fixed a bug where the Compat List endpoint for Containers would error when passed a filter including container statuses supported by Docker but not Podman (dead and restarting) (#28904).
• Fixed a bug where the Compat Stats endpoint for Containers could panic on containers with a memory reservation, but no memory limit, set (#29627).
• Fixed a bug where the Compat Stats endpoint for Containers incorrectly populated system_cpu_usage and percpu_stats when not streaming (#28761, #24730, #25709, #29912).
• Fixed a bug where the Compat Info endpoint reported an incorrect cgroup manager when running rootless with the cgroupfs cgroup manager (#27824).
• Fixed a bug where the Compat and Libpod Attach endpoints for Containers would, when doing a logs-only (stream=0 and logs=1) attach, incorrectly reinitialize the container, changing its exit code and status (#29664).
• Fixed a bug where the Compat and Libpod Update endpoints would incorrectly clear a container's restart policy when it was omitted from the request (#29790).
• Fixed a bug where the Compat and Libpod Start endpoints for Exec sessions would return an error when trying to start an exec session with no standard streams attached without specifying Detach=true.
• Fixed a bug where the Libpod Generate Kube endpoint returned the wrong content type (#29674).
• Numerous fixes to the API's Swagger documentation have been made to ensure it accurately documents the REST API.

Misc

• Fixed a number of low-level resource leaks in various parts of Podman.
• Waiting for gvproxy to start when starting a podman machine VM now uses a notification socket, instead of polling, improving reliability and startup time.
• Updated documentation for the --image-volume option to podman create and podman run to remove the deprecated bind option and add the new default, anonymous, which was not shown as a valid option. Using the deprecated bind option now prints a warning.
• Updated Buildah to v1.46.0
• Updated Common to v0.70.0
• Updated Image to v5.42.1
• Updated Storage to v1.64.2

Security

• Addresses CVE-2026-121885, untrusted image labels could be used to trick podman auto-update into restarting incorrect systemd units GHSA-55rm-rwr7-q2wr.
• Addresses CVE-2026-111361, malicious containers images could be able to bypass Digest and Signature validation GHSA-pggw-qqjf-6cxw.
• Addresses CVE-2026-123876, default seccomp profile socket deny rule could be bypass by a malicious container.

All mandatory release validation and remote verification completed for cc47289fd60468f1d902a6fdd045acfec76c400e.
Charts: {"kyverno": "3.10.0-rc.4", "kyverno-policies": "3.10.0-rc.4"}.
Full matrix and diagnostics: https://github.com/kyverno/kyverno/actions/runs/42849925864.

Release OpenCost v1.121.4

Release OpenCost v1.121.4

No content.

Signed-off-by: younsl cysl@kakao.com