Go modules · #970 by repository stars

github.com/zarf-dev/zarf

v0.87.0zarf-dev/zarf ↗New releases in your daily digest, changelog included.

Last release today
07 Oct 2026
Ships on a steady schedule
a new release about every 8 days
Some releases are documented
notes for 23 of the last 60 stable releases
Nothing withdrawn
no release was ever pulled
5 years old
6880 releases · first in 2021

Release timeline

6880 releases since 2021

202120222023202420252026

20212026

One column per quarter.

Releases

v0.87.1-0.20261007035200-5fff40f065cf7 Oct 2026pre-release
Nothing published for this version
v0.87.1-0.20261005211707-0e61e0edf2095 Oct 2026pre-release
Nothing published for this version
v0.87.1-0.20261004012708-2e7e7e7d8a314 Oct 2026pre-release
Nothing published for this version
v0.87.1-0.20261002143712-1f4b42a35df02 Oct 2026

v0.87.01 Oct 20262 sources agree

remove images and repositories from package secret during connected deploys

0.87.0 (2026-09-30)

⚠ BREAKING CHANGES

remove images and repositories from package secret during connected deploys (#5402)
helm: only label pod templates of built-in workload kinds (#5360)
disable artifact server by default (#5417)
migrate SignBlobOptions to a pointer (#5411)
package: move signing out of publish (#5387)
switch to api.Package from v1alpha1.ZarfPackage throughout repository (#5379)
public operational type (#5345)

Features

add explicit git server mode to state (#5395) (a8e695d)
add validation for api package (#5393) (cebc6ee)
component sign and verify (#5358) (9c58f59)
component: sign published manifests (#5386) (0c61d2f)
dev: add --components flag to dev inspect values-files (#5413) (13b7af6)
disable artifact server by default (#5417) (720f29e)
migrate SignBlobOptions to a pointer (#5411) (b94f06b)
package: move signing out of publish (#5387) (438b6c5)
public operational type (#5345) (6c9d7ce)
remove migrated fields on api.Package (#5390) (ed97710)
signing: unify signing option handling (#5385) (4ee0d5c)
v1beta1: componet import validation (#5384) (ce0abd9)
v1beta1: store multiple API versions in Deployed packages (#5250) (bcfbc65)

Bug Fixes

assemble: cleanup temporary directory on error (#5407) (d07690e)
create: run OnSuccess and OnFailure actions during create (#5406) (dd7301b)
helm: handle charts that render resources inside list kinds (#5344) (1f7bbc9)
helm: only label pod templates of built-in workload kinds (#5360) (7be076a)
init: propagate secret updates on init mode changes (#5398) (c18603a)
remove images and repositories from package secret during connected deploys (#5402) (1653ca2)
replace github.com/defenseunicorns/pkg with local versions (#5324) (379379a)
values: preserve inferred types across null overlays (#5412) (9213afd)

Refactoring

switch to api.Package from v1alpha1.ZarfPackage throughout repository (#5379) (9ce36bb)

What's Changed

🚀 Updates

chore(main): release 0.87.0 by @zarf-release-please[bot] in #5374

Full Changelog: v0.87.0-rc1...v0.87.0

Verifying Init Packages

The init packages in this release are signed with keyless Sigstore signing. Verify with:

amd64:

zarf package verify zarf-init-amd64-v0.87.0.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.87.0" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

arm64:

zarf package verify zarf-init-arm64-v0.87.0.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.87.0" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

See RELEASES.md for details.

Open source →

Additional notes

v0.87.0 Latest

Latest

Compare

Choose a tag to compare

Open source →

v0.87.0-rc130 Sept 2026pre-release

fix(helm): handle charts that render resources inside list kinds by @idebeijer in #5344

What's Changed

🚀 Updates

fix(helm): handle charts that render resources inside list kinds by @idebeijer in #5344
feat!: public operational type by @AustinAbro321 in #5345
feat: component sign and verify by @AustinAbro321 in #5358
chore: typo in README header from Packager to Package by @nick-adkins in #5389
refactor!: switch to api.Package from v1alpha1.ZarfPackage throughout repository by @AustinAbro321 in #5379
docs: fix tagline by @AustinAbro321 in #5392
feat: remove migrated fields on api.Package by @AustinAbro321 in #5390
fix(init): propagate secret updates on init mode changes by @brandtkeller in #5398
feat: add explicit git server mode to state by @AustinAbro321 in #5395
fix(create): run OnSuccess and OnFailure actions during create by @AustinAbro321 in #5406
feat(signing): unify signing option handling by @brandtkeller in #5385
feat(component): sign published manifests by @brandtkeller in #5386
feat(package)!: move signing out of publish by @brandtkeller in #5387
fix(assemble): cleanup temporary directory on error by @brandtkeller in #5407
docs: remove sbom viewer by @AustinAbro321 in #5409
feat!: migrate SignBlobOptions to a pointer by @brandtkeller in #5411
feat!: disable artifact server by default by @AustinAbro321 in #5417
feat(v1beta1): store multiple API versions in Deployed packages by @AustinAbro321 in #5250
feat(dev): add --components flag to dev inspect values-files by @dalehenries in #5413
fix: replace github.com/defenseunicorns/pkg with local versions by @soltysh in #5324
fix(helm)!: only label pod templates of built-in workload kinds by @idebeijer in #5360
fix!: remove images and repositories from package secret during connected deploys by @AustinAbro321 in #5402
feat: add validation for api package by @AustinAbro321 in #5393
fix(values): preserve inferred types across null overlays by @ntwkninja in #5412
feat(v1beta1): componet import validation by @AustinAbro321 in #5384

📦 Dependencies

chore(deps): bump the codeql group with 3 updates by @dependabot[bot] in #5378
chore(deps): bump aws-actions/configure-aws-credentials from 6.2.4 to 6.3.0 by @dependabot[bot] in #5405
chore(deps): bump codecov/codecov-action from 7.0.0 to 7.1.1 by @dependabot[bot] in #5404
chore(deps): bump the codeql group with 3 updates by @dependabot[bot] in #5403
chore(deps-dev): bump undici from 7.29.0 to 7.30.0 in /site by @dependabot[bot] in #5420

New Contributors

@idebeijer made their first contribution in #5344
@dalehenries made their first contribution in #5413

Full Changelog: v0.86.0...v0.87.0-rc1

Verifying Init Packages

The init packages in this release are signed with keyless Sigstore signing. Verify with:

amd64:

zarf package verify zarf-init-amd64-v0.87.0-rc1.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.87.0-rc1" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

arm64:

zarf package verify zarf-init-arm64-v0.87.0-rc1.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.87.0-rc1" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

See RELEASES.md for details.

Open source →

Additional notes

v0.87.0-rc1 Pre-release

Pre-release

Compare

Choose a tag to compare

Open source →

v0.86.017 Sept 20262 sources agree

move sbom viewer behind disabled feature flag

0.86.0 (2026-09-17)

⚠ BREAKING CHANGES

move sbom viewer behind disabled feature flag (#5368)

Features

cluster: support random registry pod selection (#5317) (fb3a53b)
debug log container runtime for diagnostics - warn on cri-o (#5333) (4e34f0e)
migrate zarf tools registry ls from crane to oras-go (#5199) (da37c2a)
reject extra arguments to destroy (#5311) (2a03baf)
support listing a deployed package by name (#5310) (5fda9ff)

Bug Fixes

differing Windows files basenames on Linux and Windows (#5359) (22bbb45)
interactive template prompts on create (#5362) (9545b01)
introduce more randomization in the fuzzers (#5275) (46018cf)
move sbom viewer behind disabled feature flag (#5368) (9a1699a)
values: infer integer and unknown schema types (#5334) (221c4f6)

What's Changed

🚀 Updates

chore(main): release 0.86.0 by @zarf-release-please[bot] in #5318

Full Changelog: v0.86.0-rc1...v0.86.0

Verifying Init Packages

The init packages in this release are signed with keyless Sigstore signing. Verify with:

amd64:

zarf package verify zarf-init-amd64-v0.86.0.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.86.0" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

arm64:

zarf package verify zarf-init-arm64-v0.86.0.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.86.0" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

See RELEASES.md for details.

Open source →

Additional notes

v0.86.0

Compare

Choose a tag to compare

Open source →

v0.86.0-rc117 Sept 2026pre-release

feat: reject extra arguments to destroy by @jasonwashburn in #5311

What's Changed

🚀 Updates

feat: reject extra arguments to destroy by @jasonwashburn in #5311
feat(cluster): support random registry pod selection by @brandtkeller in #5317
chore(deps): bump golang.org/x/crypto from 0.55.0 to 0.56.0 by @soltysh in #5322
feat: migrate zarf tools registry ls from crane to oras-go by @abhishekgit03 in #5199
feat: debug log container runtime for diagnostics - warn on cri-o by @brandtkeller in #5333
fix: introduce more randomization in the fuzzers by @soltysh in #5275
docs: fix typo in airgap git URL rewrite sentence by @ageisen2000 in #5342
chore(ci): update brew name for zarf rc candidates by @brandtkeller in #5357
fix: differing Windows files basenames on Linux and Windows by @Racer159 in #5359
fix: interactive template prompts on create by @AustinAbro321 in #5362
fix(values): infer integer and unknown schema types by @ntwkninja in #5334
feat: support listing a deployed package by name by @acald-creator in #5310
fix!: move sbom viewer behind disabled feature flag by @brandtkeller in #5368

📦 Dependencies

chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 by @dependabot[bot] in #5306
chore(deps): bump fast-uri from 3.1.5 to 3.1.7 in /site by @dependabot[bot] in #5307
chore(deps): bump anchore/scan-action/download-grype from 7.4.0 to 7.4.2 by @dependabot[bot] in #5320
chore(deps): bump github.com/anchore/syft from 1.51.0 to 1.51.1 by @dependabot[bot] in #5316
chore(deps): bump the k8s group across 1 directory with 5 updates by @dependabot[bot] in #5308
chore(deps): bump github.com/fluxcd/source-controller/api from 1.9.4 to 1.9.5 by @dependabot[bot] in #5323
chore(deps): bump golang.org/x/sync from 0.22.0 to 0.23.0 in the golang group across 1 directory by @dependabot[bot] in #5326
chore(deps): bump the codeql group with 3 updates by @dependabot[bot] in #5319
chore(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 by @dependabot[bot] in #5327
chore(deps): bump github.com/moby/moby/client from 0.5.1 to 0.6.0 by @dependabot[bot] in #5341
chore(deps): bump sharp from 0.35.3 to 0.35.4 in /site by @dependabot[bot] in #5329
chore(deps): bump svgo from 4.0.2 to 4.1.0 in /site by @dependabot[bot] in #5328
chore(deps): bump aws-actions/configure-aws-credentials from 6.2.3 to 6.2.4 by @dependabot[bot] in #5354
chore(deps): bump nanoid from 3.3.16 to 3.3.19 in /site by @dependabot[bot] in #5355
chore(deps): bump js-yaml from 4.3.1 to 4.3.2 in /site by @dependabot[bot] in #5331
chore(deps): bump github.com/docker/cli from 29.7.2+incompatible to 29.8.0+incompatible by @dependabot[bot] in #5339
chore(deps): bump golang.org/x/crypto from 0.56.0 to 0.57.0 in the golang group across 1 directory by @dependabot[bot] in #5365
chore(deps): bump github.com/google/go-containerregistry from 0.22.0 to 0.22.1 by @dependabot[bot] in #5340

New Contributors

@ageisen2000 made their first contribution in #5342

Full Changelog: v0.85.0...v0.86.0-rc1

Verifying Init Packages

The init packages in this release are signed with keyless Sigstore signing. Verify with:

amd64:

zarf package verify zarf-init-amd64-v0.86.0-rc1.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.86.0-rc1" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

arm64:

zarf package verify zarf-init-arm64-v0.86.0-rc1.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.86.0-rc1" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

See RELEASES.md for details.

Open source →

Additional notes

v0.86.0-rc1 Pre-release

Pre-release

Compare

Choose a tag to compare

Open source →

v0.85.03 Sept 20262 sources agree

publish v1beta1 component configs

0.85.0 (2026-09-03)

⚠ BREAKING CHANGES

publish v1beta1 component configs (#5219)

Features

add index and count to deploy (#4170) (ba50b87)
add oci source auto-prefixing (#5273) (9a41b0d)
helm: support allowable errors for helm chart retries (#5287) (cdb212b)
publish v1beta1 component configs (#5219) (abd07dd)
warn on image push failure (#5268) (258fa9e)
zoci: add transport parameter to NewRemoteWithOptions (#5260) (97a1b4d)

Bug Fixes

helm: ensure retrieval of latest release (#5295) (5977f2d)
pass remote options when loading OCI init packages (#5265) (4e14f8b)
support platform flag entries for crane copy (#5280) (81fedb2)

Refactoring

state: move agent information into a sub-struct (#5269) (e702d1c)

What's Changed

🚀 Updates

chore(main): release 0.85.0 by @zarf-release-please[bot] in #5263

Full Changelog: v0.85.0-rc1...v0.85.0

Verifying Init Packages

The init packages in this release are signed with keyless Sigstore signing. Verify with:

amd64:

zarf package verify zarf-init-amd64-v0.85.0.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.85.0" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

arm64:

zarf package verify zarf-init-arm64-v0.85.0.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.85.0" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

See RELEASES.md for details.

Open source →

Additional notes

v0.85.0

Compare

Choose a tag to compare

Open source →

v0.85.0-rc13 Sept 2026pre-release

feat(zoci): add transport parameter to NewRemoteWithOptions by @AustinAbro321 in #5260

What's Changed

🚀 Updates

feat(zoci): add transport parameter to NewRemoteWithOptions by @AustinAbro321 in #5260
fix: pass remote options when loading OCI init packages by @fabian1heinrich in #5265
feat: warn on image push failure by @AustinAbro321 in #5268
test: v1beta1 to v1alpha1 roundtrip fuzzing by @AustinAbro321 in #5249
chore: add missing tests for URL and Commit format by @soltysh in #5277
refactor(state): move agent information into a sub-struct by @AustinAbro321 in #5269
feat!: publish v1beta1 component configs by @AustinAbro321 in #5219
fix: support platform flag entries for crane copy by @brandtkeller in #5280
feat: add oci source auto-prefixing by @mjnagel in #5273
feat(helm): support allowable errors for helm chart retries by @brandtkeller in #5287
fix(helm): ensure retrieval of latest release by @brandtkeller in #5295
test: fix typos in image discovery fixtures and test text by @luojiyin1987 in #4945
feat: add index and count to deploy by @a1994sc in #4170
chore: update gitea chart to 12.7.0 by @NAME-ASHWANIYADAV in #5302

📦 Dependencies

chore(deps): bump k8s.io/streaming from 0.36.3 to 0.36.4 in the k8s group across 1 directory by @dependabot[bot] in #5256
chore(deps): bump the codeql group with 3 updates by @dependabot[bot] in #5264
chore(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 by @dependabot[bot] in #5270
chore(deps): bump helm.sh/helm/v4 from 4.2.3 to 4.2.4 by @dependabot[bot] in #5258
chore(deps): bump the k8s group across 1 directory with 2 updates by @dependabot[bot] in #5288
chore(deps): bump github.com/mikefarah/yq/v4 from 4.53.3 to 4.53.6 by @dependabot[bot] in #5292
chore(deps): bump github.com/google/go-containerregistry from 0.21.9 to 0.22.0 by @dependabot[bot] in #5297
chore(deps): bump the k8s group across 1 directory with 6 updates by @dependabot[bot] in #5291
chore(deps): bump the codeql group with 3 updates by @dependabot[bot] in #5296
chore(deps): bump github.com/sirupsen/logrus from 1.9.4 to 1.10.2 by @dependabot[bot] in #5305

New Contributors

@fabian1heinrich made their first contribution in #5265
@luojiyin1987 made their first contribution in #4945
@NAME-ASHWANIYADAV made their first contribution in #5302

Full Changelog: v0.84.0...v0.85.0-rc1

Verifying Init Packages

The init packages in this release are signed with keyless Sigstore signing. Verify with:

amd64:

zarf package verify zarf-init-amd64-v0.85.0-rc1.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.85.0-rc1" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

arm64:

zarf package verify zarf-init-arm64-v0.85.0-rc1.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.85.0-rc1" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

See RELEASES.md for details.

Open source →

Additional notes

v0.85.0-rc1 Pre-release

Pre-release

Compare

Choose a tag to compare

Open source →

v0.84.020 Aug 20262 sources agree

v1beta1: use package definition across public packager functionality

0.84.0 (2026-08-20)

⚠ BREAKING CHANGES

v1beta1: use package definition across public packager functionality (#5173)

Features

agent: add variable for mutating webhook annotations (#5243) (1de2f08)
allow excluding ArgoCD and Flux resources from Zarf Agent mutation (#5224) (804b22b)
dev: evaluate helm chart schemas in dev generate-schema (#5176) (e1ca156)
injector image flag (#5214) (86d732a)
introduce zarf dev template (#5206) (826d2a0)
v1beta1: load v1beta1 packages (#5048) (f82e001)
v1beta1: use package definition across public packager functionality (#5173) (7a33a42)

Bug Fixes

add values flags to dev deploy and init (#5234) (fc9226f)
deprecated schema fields (#5195) (f21f80a)
negotiate oci scheme for allowing plain http oci endpoints (#5197) (b5fbffa)
packager.Remove() uses ZarfDefaultTimeout as default timeout (#5253) (11f82f3)
registry mode not handled properly in update-creds (#5230) (b2a4132)
replace mimetype with archives (#5228) (a4bfd8a)

Refactoring

move template out of internal (#5212) (15e05ba)

What's Changed

🚀 Updates

chore(main): release 0.84.0 by @zarf-release-please[bot] in #5196

Full Changelog: v0.84.0-rc1...v0.84.0

Verifying Init Packages

The init packages in this release are signed with keyless Sigstore signing. Verify with:

amd64:

zarf package verify zarf-init-amd64-v0.84.0.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.84.0" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

arm64:

zarf package verify zarf-init-arm64-v0.84.0.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.84.0" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

See RELEASES.md for details.

Open source →

Additional notes

v0.84.0

Compare

Choose a tag to compare

Open source →

v0.84.0-rc120 Aug 2026pre-releaseDeprecated

fix: deprecated schema fields by @brandtkeller in #5195

What's Changed

🚀 Updates

fix: deprecated schema fields by @brandtkeller in #5195
docs(examples): improve longhorn health checks and registry docs by @abhishekgit03 in #5175
ci: switch from shallow checkout by @brandtkeller in #5198
feat(v1beta1): load v1beta1 packages by @AustinAbro321 in #5048
chore(deps): bump astro from 7.0.7 to 7.2.0 in /site by @soltysh in #5209
feat: injector image flag by @AustinAbro321 in #5214
feat: introduce zarf dev template by @AustinAbro321 in #5206
feat(v1beta1)!: use package definition across public packager functionality by @AustinAbro321 in #5173
chore: bump go version by @brandtkeller in #5229
fix: add values flags to dev deploy and init by @AustinAbro321 in #5234
test: add unit coverage for generated SBOM contents by @gangadhar-res in #5222
fix: replace mimetype with archives by @brandtkeller in #5228
refactor: move template out of internal by @a1994sc in #5212
fix: negotiate oci scheme for allowing plain http oci endpoints by @brandtkeller in #5197
feat: allow excluding ArgoCD and Flux resources from Zarf Agent mutation by @colinlodter in #5224
feat(dev): evaluate helm chart schemas in dev generate-schema by @mjnagel in #5176
chore: update mention of values to beta by @brandtkeller in #5246
chore: update contributing ladder for approval guidance by @brandtkeller in #5245
feat(agent): add variable for mutating webhook annotations by @AustinAbro321 in #5243
fix: packager.Remove() uses ZarfDefaultTimeout as default timeout by @curtis-nichols in #5253
chore: update and lint vex before release by @brandtkeller in #5251
fix: registry mode not handled properly in update-creds by @Racer159 in #5230

📦 Dependencies

chore(deps): bump github.com/docker/cli from 29.6.2+incompatible to 29.7.0+incompatible by @dependabot[bot] in #5185
chore(deps): bump fast-uri from 3.1.4 to 3.1.5 in /site by @dependabot[bot] in #5171
chore(deps): bump the codeql group with 3 updates by @dependabot[bot] in #5200
chore(deps): bump docker/login-action from 4.5.1 to 4.6.0 by @dependabot[bot] in #5201
chore(deps): bump github.com/google/go-containerregistry from 0.21.7 to 0.21.8 by @dependabot[bot] in #5204
chore(deps): bump github.com/sigstore/sigstore-go from 1.2.2 to 1.3.0 by @dependabot[bot] in #5186
chore(deps): bump github.com/docker/cli from 29.7.0+incompatible to 29.7.1+incompatible in the docker group across 1 directory by @dependabot[bot] in #5203
chore(deps): bump mermaid from 10.9.6 to 10.9.8 in /site by @dependabot[bot] in #5187
chore(deps): bump postcss from 8.5.19 to 8.5.25 in /site by @dependabot[bot] in #5170
chore(deps): bump js-yaml from 4.2.0 to 4.3.1 in /site by @dependabot[bot] in #5188
chore(deps): bump dompurify from 3.4.12 to 3.4.13 in /site by @dependabot[bot] in #5194
chore(deps): bump the cosign-providers group across 1 directory with 4 updates by @dependabot[bot] in #5202
chore(deps): bump github.com/docker/cli from 29.7.1+incompatible to 29.7.2+incompatible by @dependabot[bot] in #5215
chore(deps): bump github.com/fairwindsops/pluto/v5 from 5.24.1 to 5.24.3 by @dependabot[bot] in #5221
chore(deps): bump github.com/google/go-containerregistry from 0.21.8 to 0.21.9 by @dependabot[bot] in #5216
chore(deps): bump the codeql group with 3 updates by @dependabot[bot] in #5232
chore(deps): bump github.com/fluxcd/source-controller/api from 1.9.3 to 1.9.4 by @dependabot[bot] in #5233
chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 by @dependabot[bot] in #5237
chore(deps): bump github.com/defenseunicorns/pkg/oci from 1.31.1 to 1.32.0 by @AustinAbro321 in #5239
chore(deps): bump github.com/anchore/syft from 1.50.0 to 1.51.0 by @dependabot[bot] in #5236
chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 in the golang group across 1 directory by @dependabot[bot] in #5248

New Contributors

@abhishekgit03 made their first contribution in #5175
@gangadhar-res made their first contribution in #5222
@colinlodter made their first contribution in #5224
@curtis-nichols made their first contribution in #5253

Full Changelog: v0.83.0...v0.84.0-rc1

Verifying Init Packages

The init packages in this release are signed with keyless Sigstore signing. Verify with:

amd64:

zarf package verify zarf-init-amd64-v0.84.0-rc1.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.84.0-rc1" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

arm64:

zarf package verify zarf-init-arm64-v0.84.0-rc1.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.84.0-rc1" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

See RELEASES.md for details.

Open source →

Additional notes

v0.84.0-rc1 Pre-release

Pre-release

Compare

Choose a tag to compare

Open source →