What's Changed

🚀 Updates

• feat(site): add Word List back into style-guide.mdx by @mkcp in #3992
• docs: update Zarfs tagline by @AustinAbro321 in #3996
• chore(docs): update open-source to open source and clean up style-guide.mdx by @mkcp in #3993
• feat: create helm chart for zarf-agent by @JeffResc in #3678
• fix: avoid injector and registry randomly landing on same nodeport by @AustinAbro321 in #4004
• feat: add checking in remote repo if manifest is a chart by @a1994sc in #3811
• feat: add logic to add image to possible list when auth is needed by @a1994sc in #4011
• feat!(connect): support for listen address on zarf connect by @brandtkeller in #3914

📦 Dependencies

• chore(deps): bump helm.sh/helm/v3 from 3.17.3 to 3.18.4 by @dependabot[bot] in #3976
• chore(deps): bump the golang group across 1 directory with 3 updates by @dependabot[bot] in #3987
• chore(deps): bump github.com/golang-cz/devslog from 0.0.13 to 0.0.15 by @dependabot[bot] in #3966
• chore(deps): bump github.com/derailed/k9s from 0.50.6 to 0.50.7 by @dependabot[bot] in #3972
• chore(deps): bump github.com/fluxcd/source-controller/api from 1.6.1 to 1.6.2 by @dependabot[bot] in #3990
• chore(deps): bump github.com/anchore/syft from 1.27.1 to 1.28.0 by @dependabot[bot] in #3973
• chore(deps): bump github.com/fluxcd/pkg/apis/meta from 1.13.0 to 1.18.0 by @dependabot[bot] in #3995
• chore(deps): bump github.com/spf13/pflag from 1.0.6 to 1.0.7 by @dependabot[bot] in #4000
• chore(deps): bump the k8s group across 1 directory with 5 updates by @dependabot[bot] in #3997
• chore(deps): bump github.com/mikefarah/yq/v4 from 4.45.4 to 4.46.1 by @dependabot[bot] in #3999
• chore(deps): bump github/codeql-action from 3.29.2 to 3.29.3 by @dependabot[bot] in #4013
• chore(deps): bump github.com/anchore/syft from 1.28.0 to 1.29.0 by @dependabot[bot] in #4014
• chore(deps): bump github.com/docker/docker from 28.3.0+incompatible to 28.3.2+incompatible by @dependabot[bot] in #4009
• chore(deps): bump github.com/fairwindsops/pluto/v5 from 5.22.0 to 5.22.1 by @dependabot[bot] in #4015
• chore(deps): bump sigs.k8s.io/kustomize/kyaml from 0.20.0 to 0.20.1 by @dependabot[bot] in #4020
• chore(deps): bump github/codeql-action from 3.29.3 to 3.29.4 by @dependabot[bot] in #4017
• chore(deps): bump sigs.k8s.io/kustomize/api from 0.20.0 to 0.20.1 by @dependabot[bot] in #4019

New Contributors

• @JeffResc made their first contribution in #3678

Full Changelog: v0.58.0-rc1...v0.59.0

What's Changed

🚀 Updates

• chore: wrap mutex around appending to failed repository updates by @joonas in #3934
• release: fix RC release process by @AustinAbro321 in #3919
• fix(deps): resolve High OPA CVE by @brandtkeller in #3781
• fix: exempt packages from revive var-naming linter by @mkcp in #3953
• feat: track progress on image pull/push by @AustinAbro321 in #3904
• feat: optimize package OCI pulls by @AustinAbro321 in #3961
• fix!: allow creation of differential package from OCI source by @AustinAbro321 in #3963
• add webhook for argocd appprojects by @sepauli in #3962
• fix: identify file type using filename instead of mholt/archives auto detection by @AustinAbro321 in #3977
• feat!(deploy): support return of package VariableConfig by @brandtkeller in #3978
• fix(mirror): separate artifact upload by component by @AustinAbro321 in #3980
• fix(release): correct GitHub environment variable syntax for GoReleaser version by @AustinAbro321 in #3981

📦 Dependencies

• chore(deps): bump github.com/anchore/syft from 1.26.1 to 1.27.1 by @dependabot[bot] in #3941
• chore(deps): bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 by @dependabot[bot] in #3949
• chore(deps): bump github/codeql-action from 3.29.0 to 3.29.2 by @dependabot[bot] in #3955
• chore(deps): bump github.com/mholt/archives from 0.1.2 to 0.1.3 by @dependabot[bot] in #3950
• chore(deps): bump github.com/Masterminds/semver/v3 from 3.3.1 to 3.4.0 by @dependabot[bot] in #3958
• chore(deps): bump sigs.k8s.io/kustomize/api from 0.19.0 to 0.20.0 by @dependabot[bot] in #3957
• chore(deps): bump github.com/docker/cli from 28.2.2+incompatible to 28.3.1+incompatible by @dependabot[bot] in #3965

New Contributors

• @sepauli made their first contribution in #3962

Full Changelog: v0.57.0...v0.58.0

What's Changed

🚀 Updates

• chore: wrap mutex around appending to failed repository updates by @joonas in #3934
• release: fix RC release process by @AustinAbro321 in #3919
• fix(deps): resolve High OPA CVE by @brandtkeller in #3781
• fix: exempt packages from revive var-naming linter by @mkcp in #3953
• feat: track progress on image pull/push by @AustinAbro321 in #3904
• feat: optimize package OCI pulls by @AustinAbro321 in #3961
• fix!: allow creation of differential package from OCI source by @AustinAbro321 in #3963
• add webhook for argocd appprojects by @sepauli in #3962
• fix: identify file type using filename instead of mholt/archives auto detection by @AustinAbro321 in #3977
• feat!(deploy): support return of package VariableConfig by @brandtkeller in #3978
• fix(mirror): separate artifact upload by component by @AustinAbro321 in #3980
• fix(release): correct GitHub environment variable syntax for GoReleaser version by @AustinAbro321 in #3981

📦 Dependencies

• chore(deps): bump github.com/anchore/syft from 1.26.1 to 1.27.1 by @dependabot[bot] in #3941
• chore(deps): bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 by @dependabot[bot] in #3949
• chore(deps): bump github/codeql-action from 3.29.0 to 3.29.2 by @dependabot[bot] in #3955
• chore(deps): bump github.com/mholt/archives from 0.1.2 to 0.1.3 by @dependabot[bot] in #3950
• chore(deps): bump github.com/Masterminds/semver/v3 from 3.3.1 to 3.4.0 by @dependabot[bot] in #3958
• chore(deps): bump sigs.k8s.io/kustomize/api from 0.19.0 to 0.20.0 by @dependabot[bot] in #3957
• chore(deps): bump github.com/docker/cli from 28.2.2+incompatible to 28.3.1+incompatible by @dependabot[bot] in #3965

New Contributors

• @sepauli made their first contribution in #3962

Full Changelog: v0.57.0...v0.58.0-rc1

What's Changed

🚀 Updates

• feat(deploy): support for package namespace override flag by @brandtkeller in #3889
• fix: properly create push auth credentials when registry address includes a repo path by @AustinAbro321 in #3943

📦 Dependencies

• chore(deps): bump github.com/sergi/go-diff from 1.3.2-0.20230802210424-5b0b94c5c0d3 to 1.4.0 by @dependabot in #3899
• chore(deps): bump the cosign-providers group across 1 directory with 3 updates by @dependabot in #3931
• chore(deps): bump the k8s group across 1 directory with 5 updates by @dependabot in #3933
• chore(deps): bump github.com/fluxcd/pkg/apis/meta from 1.12.0 to 1.13.0 by @dependabot in #3936
• chore(deps): bump github.com/derailed/k9s from 0.40.5 to 0.50.6 by @dependabot in #3820
• chore(deps): bump github.com/fluxcd/source-controller/api from 1.6.0 to 1.6.1 by @dependabot in #3939

Full Changelog: v0.56.0...v0.57.0

What's Changed

🚀 Updates

• docs: roadmap updates by @AustinAbro321 in #3875
• chore: lint packager2 by @AustinAbro321 in #3874
• refactor: remove packager1 references by @AustinAbro321 in #3855
• fix(archive): cleanup the archive package by @brandtkeller in #3822
• chore(docs): add community meeting documentation to project/website by @brandtkeller in #3884
• refactor: separate out create / layout to avoid cyclic dependency with zoci by @AustinAbro321 in #3872
• refactor: packager2 api cleanup by @AustinAbro321 in #3888
• fix: sign package during publish by @AustinAbro321 in #3892
• refactor: move zarf state structs from src/types -> src/pkg/state by @AustinAbro321 in #3897
• refactor: move split file logic to it's own package by @AustinAbro321 in #3898
• refactor: standardize packager2 API and decouple CLI from SDK by @AustinAbro321 in #3894
• docs: tip to use inspect manifest command by @AustinAbro321 in #3903
• feat: live output action command logs by @AustinAbro321 in #3901
• chore!: delete packager and related dead code by @AustinAbro321 in #3902
• fix(monitor): mimic k9s init to silence klog errors by @brandtkeller in #3905
• feat: expose packager(2) as public package by @AustinAbro321 in #3906
• refactor: pass cachepath through packager functions by @AustinAbro321 in #3907
• feat: improve usability and defaults of packager SDK by @AustinAbro321 in #3908
• feat(sdk): intuitive default path when using ./zarf actions by @AustinAbro321 in #3910
• feat(sdk): return final package ref after publish by @AustinAbro321 in #3911

📦 Dependencies

• chore(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by @dependabot in #3878
• chore(deps): bump github.com/fluxcd/source-controller/api from 1.5.0 to 1.6.0 by @dependabot in #3865
• chore(deps): bump github.com/goccy/go-yaml from 1.17.1 to 1.18.0 by @dependabot in #3886
• chore(deps): bump github/codeql-action from 3.28.18 to 3.28.19 by @dependabot in #3890
• chore(deps): bump github.com/go-git/go-git/v5 from 5.16.0 to 5.16.1 by @dependabot in #3891
• chore(deps): bump the golang group across 1 directory with 2 updates by @dependabot in #3895
• chore(deps): bump github/codeql-action from 3.28.19 to 3.29.0 by @dependabot in #3909

Full Changelog: v0.55.6...v0.56.0

What's Changed

🚀 Updates

• refactor: combine and output split files in LoadPackage by @AustinAbro321 in #3796
• chore: lint src/internal/packager by @AustinAbro321 in #3854
• refactor: deploy by @AustinAbro321 in #3738
• fix: concurrent registry auth issue by @AustinAbro321 in #3850
• fix: segfault during destroy w/o state by @Racer159 in #3864
• fix: Replace all vars and consts in actionCmdMutation by @koendelaat in #3799
• feat: expand subcommands from crane to registry command by @a1994sc in #3856
• refactor: dev deploy by @AustinAbro321 in #3847
• fix: unchecked err when populating variables for deploy by @AustinAbro321 in #3873
• fix(create): ensure that when given an output directory Archive creates the directory for the user by @mkcp in #3869
• fix(archive): sbom directory regression fix by @brandtkeller in #3877

📦 Dependencies

• chore(deps): bump sigs.k8s.io/controller-runtime from 0.20.4 to 0.21.0 by @dependabot in #3852
• chore(deps): bump github.com/google/go-containerregistry from 0.20.4 to 0.20.5 by @dependabot in #3853
• chore(deps): bump github.com/anchore/syft from 1.26.0 to 1.26.1 by @dependabot in #3857
• chore(deps): bump github.com/fairwindsops/pluto/v5 from 5.21.6 to 5.21.7 by @dependabot in #3866

New Contributors

• @koendelaat made their first contribution in #3799

Full Changelog: v0.55.5...v0.55.6

What's Changed

🚀 Updates

• feat(utils): support user interrupts in utils.ExecuteWait and add debug logging by @mkcp in #3846
• feat(utils): add user interrupts to wait-for on network protocols by @mkcp in #3848
• Revert "chore(deps): bump helm.sh/helm/v3 from 3.17.3 to 3.18.0" by @AustinAbro321 in #3851

📦 Dependencies

• chore(deps): bump github.com/anchore/syft from 1.23.1 to 1.26.0 by @dependabot in #3841

Full Changelog: v0.55.4...v0.55.5

What's Changed

🚀 Updates

• chore(sustainability): document the release process by @brandtkeller in #3823
• fix(archive): replace virtualfilesystem with sequential streaming by @brandtkeller in #3831
• docs: Update 0-creating-a-zarf-package.mdx by @nevinaragam in #3832
• fix(archive): skip format autodetection for tar format by @brandtkeller in #3836
• fix(mirror-resources): add cluster nil check before loading state by @brandtkeller in #3838
• fix(release): remove grype cve report from release by @brandtkeller in #3840

📦 Dependencies

• chore(deps): bump codecov/codecov-action from 5.4.2 to 5.4.3 by @dependabot in #3812
• chore(deps): bump github.com/defenseunicorns/pkg/helpers/v2 from 2.0.1 to 2.0.4 by @dependabot in #3803
• chore(deps): bump github.com/mholt/archives from 0.1.1 to 0.1.2 by @dependabot in #3801
• chore(deps): bump github/codeql-action from 3.28.17 to 3.28.18 by @dependabot in #3818
• chore(deps): bump github.com/fairwindsops/pluto/v5 from 5.21.3 to 5.21.6 by @dependabot in #3802
• chore(deps): bump the k8s group across 1 directory with 5 updates by @dependabot in #3819
• chore(deps): bump github.com/fluxcd/pkg/apis/meta from 1.10.0 to 1.12.0 by @dependabot in #3827
• chore(deps): bump helm.sh/helm/v3 from 3.17.3 to 3.18.0 by @dependabot in #3826
• chore(deps): bump github.com/google/go-containerregistry from 0.20.4-0.20250225234217-098045d5e61f to 0.20.4 by @dependabot in #3834
• chore(deps): bump github.com/defenseunicorns/pkg/oci from 1.2.0 to 1.3.0 by @dependabot in #3833

New Contributors

• @nevinaragam made their first contribution in #3832

Full Changelog: v0.55.2...v0.55.4

Release v0.55.2

This release includes improvements to the Zarf SDK and continuing iteration on the packager refactor - most of which are consumed by the CLI to-date. In the CLI you will see a few changes:

• Caching OCI layers: Improving package creation time when layers are present in the cache (while hard to represent given all conditions, our package creation of the examples/longhorn package saw a %62 improvement on subsequent creations.
• zarf package mirror-resources will now default to zarf state if available and other targets are not defined. Additionally --images/--repos flags were introduced to mirror a type of artifact in isolation.
• zarf package inspect operations targeting packages in a registry now only pull the required layers needed for inspect to occur. This fixes inspect previously pulling the full package just to view the definition/sboms/images etc

Release Demo Video for those who want to watch these updates in action.

Note: We ran into an issue with our release process and identified a bug which resulted in releasing v0.54.0 -> v0.55.2 and have since identified improvements to testing and release to work towards more resilient zarf releases.

What's Changed

🚀 Updates

• fix: template variables in values file in zarf package inspect value-files by @AustinAbro321 in #3760
• feat(mirror-resources): support for State fallback without flags by @brandtkeller in #3757
• chore(docs): 2025 roadmap proposal by @brandtkeller in #3670
• feat: cache OCI packages by @AustinAbro321 in #3767
• feat: avoid using a cache in zarf package pull is cachepath is not set by @AustinAbro321 in #3775
• fix(wait-for): return early on connection refused by @brandtkeller in #3772
• fix(docs): update mirror resources docs to include examples by @brandtkeller in #3778
• feat(packager): make packager2.Pull public by @mkcp in #3773
• refactor: lint by @AustinAbro321 in #3776
• Log out available disk space on create-release failure by @mkcp in #3698
• fix(inspect): only pull required layers for inspecting OCI packages by @brandtkeller in #3679
• fix: avoid panic during wait-for HTTP server by @AustinAbro321 in #3797
• test: run unit tests on arm64 by @AustinAbro321 in #3805
• fix: respect .metadata.architecture on package create output to registry by @AustinAbro321 in #3806
• fix(archiver): archiver migration to archives by @brandtkeller in #3788
• fix(archiver): remaining cleanup and variables swap in #3809
• fix(CLI): migrate to Packager2 for init package downloads by @brandtkeller in #3810

📦 Dependencies

• chore(deps): bump actions/create-github-app-token from 2.0.2 to 2.0.3 by @dependabot in #3758
• chore(deps): bump vite from 6.3.3 to 6.3.4 in /site by @dependabot in #3753
• chore(deps): bump golangci/golangci-lint-action from 7.0.0 to 8.0.0 by @dependabot in #3764
• chore(deps): bump github/codeql-action from 3.28.16 to 3.28.17 by @dependabot in #3765
• chore(deps): bump actions/create-github-app-token from 2.0.3 to 2.0.6 by @dependabot in #3763
• chore(deps): bump aws-actions/configure-aws-credentials from 4.1.0 to 4.2.0 by @dependabot in #3770
• chore(dependencies): update crane by @AustinAbro321 in #3771
• chore(deps): bump actions/dependency-review-action from 4.6.0 to 4.7.0 by @dependabot in #3779
• chore(deps): bump actions/setup-go from 5.4.0 to 5.5.0 by @dependabot in #3780
• chore(deps): bump github.com/anchore/syft from 1.19.0 to 1.23.1 by @dependabot in #3740
• chore(deps): bump github.com/golang-cz/devslog from 0.0.12 to 0.0.13 by @dependabot in #3785
• chore(deps): bump the golang group across 1 directory with 3 updates by @dependabot in #3784
• chore(deps): bump oras.land/oras-go/v2 from 2.5.0 to 2.6.0 by @dependabot in #3786
• chore(deps): bump github.com/mikefarah/yq/v4 from 4.45.1 to 4.45.4 by @dependabot in #3792
• chore(deps): bump sigs.k8s.io/controller-runtime from 0.20.2 to 0.20.4 by @dependabot in #3791
• chore(deps): bump actions/dependency-review-action from 4.7.0 to 4.7.1 by @dependabot in #3795
• chore(deps): bump aws-actions/configure-aws-credentials from 4.2.0 to 4.2.1 by @dependabot in #3804

Full Changelog: v0.54.0...v0.55.2

What's Changed

🚀 Updates

• refactor(cluster,state,types)!: migrate types.ZarfState to state.State by @mkcp in #3682
• fix(images): support for insecure skip tls verify on image push/pull by @brandtkeller in #3725
• feat: add timeout to image operations by @AustinAbro321 in #3731
• feat: remove user submitted digest from OCI pull log by @AustinAbro321 in #3743
• chore: remove invopop/jsonschema dependency from root go.mod by @AustinAbro321 in #3744
• test: avoid dockerhub flake in agent ignore test by @AustinAbro321 in #3742
• test: improve archive test by @Noxsios in #3739
• fix: retry on images and components by @Noxsios in #3746
• feat: respect context during HTTP file downloads by @AustinAbro321 in #3751
• test: improve http pull test by @Noxsios in #3748
• fix: set default user for git and registry state during zarf package deploy by @AustinAbro321 in #3754

📦 Dependencies

• chore(deps): bump github/codeql-action from 3.28.15 to 3.28.16 by @dependabot in #3727
• chore(deps): bump the k8s group across 1 directory with 5 updates by @dependabot in #3728
• chore(deps): bump actions/download-artifact from 4.2.1 to 4.3.0 by @dependabot in #3735
• chore(deps): bump the cosign-providers group across 1 directory with 3 updates by @dependabot in #3733
• chore(deps): bump vite from 5.4.14 to 5.4.18 in /site by @dependabot in #3692
• chore(deps): bump prismjs from 1.29.0 to 1.30.0 in /site by @dependabot in #3695
• chore(deps): bump @babel/helpers from 7.26.0 to 7.27.0 in /site by @dependabot in #3694
• chore(deps): bump esbuild, @astrojs/starlight and astro in /site by @dependabot in #3697
• fix: resolve CVE-2025-3445 in cmd/archiver with pkg/archive by @mkcp in #3732

Full Changelog: v0.53.0...v0.54.0