1.0.1 (2026-11-11)

What's Changed

🚀 Updates

• docs: fixed slugs processing for previous versions by @AustinAbro321 in #5642
• fix: update agent mutation policy handling helm schema validation by @dwertent in #5644
• chore(deps): update Go from 1.26.10 to 1.26.11 by @AustinAbro321 in #5645
• chore(main): release 1.0.1 by @zarf-release-please[bot] in #5648

Full Changelog: v1.0.0...v1.0.1

Verifying Init Packages

The init packages in this release are signed with keyless Sigstore signing. Verify with:

amd64:

zarf package verify zarf-init-amd64-v1.0.1.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v1.0.1" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

arm64:

zarf package verify zarf-init-arm64-v1.0.1.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v1.0.1" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

See RELEASES.md for details.

1.0.0 (2026-11-10)

⚠ BREAKING CHANGES

• state: remove storageclass and distro (#5624)
• limit v1beta1 init package values chart inputs (#5631)
• removed deprecated SDK fields and bridges (#5615)
• error when package secret write fails (#5621)
• compress Zarf state (#5619)
• default to v1beta1 init package (#5598)
• removed deprecated k8s api migration (#5613)
• state enhancement updates (#5525)
• error when variables are used with v1beta1 (#5606)
• remove daemon pull through crane (#5568)
• remove zarf tools registry export (#5562)
• remove deprecated commands and flags (#5605)
• replace global architecture state with per-operation options (#5498)
• remove sbom viewer (#5563)
• delete artifact server (#5561)

Features

• compress Zarf state (#5619) (c242327)
• default to v1beta1 init package (#5598) (6c2e879)
• delete artifact server (#5561) (2b51f6c)
• deprecate v1alpha1 packages (#5623) (b0ca5a9)
• dev sha256sum not working with extract-path flag (#5160) (badae8f)
• dev: add --confirm flag to patch-git (#5531) (f0861e2)
• error when package secret write fails (#5621) (b17ad04)
• error when variables are used with v1beta1 (#5606) (8e854f4)
• limit v1beta1 init package values chart inputs (#5631) (24cdbc5)
• oci: added chuncked retryable resumable blob pulls (#5597) (d0d271c)
• remove daemon pull through crane (#5568) (c7fc4d4)
• remove deprecated commands and flags (#5605) (3501866)
• remove sbom viewer (#5563) (f8e60d0)
• remove zarf tools registry export (#5562) (f3961a9)
• removed deprecated k8s api migration (#5613) (dbb02f0)
• removed deprecated SDK fields and bridges (#5615) (0cf9039)
• state enhancement updates (#5525) (517db72)
• state: remove storageclass and distro (#5624) (aa632e0)

Bug Fixes

• deep copy values on merge so a chart mapping can't leak into later components (#5585) (8802592)
• print a valid skeleton import example from the CLI (#5530) (a9d5dd5)

Refactoring

• replace global architecture state with per-operation options (#5498) (049d855)

What's Changed

🚀 Updates

• chore(main): release 1.0.0 by @zarf-release-please[bot] in #5567

Full Changelog: v1.0.0-rc1...v1.0.0

Verifying Init Packages

The init packages in this release are signed with keyless Sigstore signing. Verify with:

amd64:

zarf package verify zarf-init-amd64-v1.0.0.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v1.0.0" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

arm64:

zarf package verify zarf-init-arm64-v1.0.0.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v1.0.0" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

See RELEASES.md for details.

What's Changed

🚀 Updates

• fix: print a valid skeleton import example from the CLI by @idebeijer in #5530
• feat: dev sha256sum not working with extract-path flag by @a1994sc in #5160
• feat(dev): add --confirm flag to patch-git by @shreyaabaranwal in #5531
• feat!: delete artifact server by @AustinAbro321 in #5561
• chore: release please v1 configuration by @brandtkeller in #5571
• feat!: remove sbom viewer by @AustinAbro321 in #5563
• refactor!: replace global architecture state with per-operation options by @jasonwashburn in #5498
• feat!: remove deprecated commands and flags by @AustinAbro321 in #5605
• feat(oci): added chuncked retryable resumable blob pulls by @sgettys in #5597
• feat!: remove zarf tools registry export by @AustinAbro321 in #5562
• feat!: remove daemon pull through crane by @AustinAbro321 in #5568
• feat!: error when variables are used with v1beta1 by @AustinAbro321 in #5606
• fix: deep copy values on merge so a chart mapping can't leak into later components by @a1994sc in #5585
• feat!: state enhancement updates by @brandtkeller in #5525
• feat!: removed deprecated k8s api migration by @AustinAbro321 in #5613
• feat!: default to v1beta1 init package by @AustinAbro321 in #5598
• chore(deps): bump site dependencies CVEs by @dwertent in #5602
• chore(deps): update github.com/andybalholm/brotli from v1.2.0 to v1.2.8 by @dwertent in #5620
• feat!: compress Zarf state by @AustinAbro321 in #5619
• feat!: error when package secret write fails by @AustinAbro321 in #5621
• feat!: removed deprecated SDK fields and bridges by @AustinAbro321 in #5615
• feat: deprecate v1alpha1 packages by @AustinAbro321 in #5623
• chore(deps): update github.com/klauspost/compress from v1.19.2 to v1.20.3 by @dwertent in #5629
• feat!: limit v1beta1 init package values chart inputs by @AustinAbro321 in #5631
• feat(state)!: remove storageclass and distro by @brandtkeller in #5624
• chore(docs): fixed broken links by @dwertent in #5601
• docs: v1.0 announcement page by @AustinAbro321 in #5569
• chore: document deprecation policy and update security.md by @brandtkeller in #5604
• chore: enable posthog metrics on docsite by @jonnyborbs in #5529
• docs: updated examples and reference guide to v1beta1 by @AustinAbro321 in #5635

📦 Dependencies

• chore(deps): bump github.com/distribution/distribution/v3 from 3.1.1 to 3.1.2 by @dependabot[bot] in #5469
• chore(deps): bump github.com/fluxcd/source-controller/api from 1.9.5 to 1.9.6 by @dependabot[bot] in #5468
• chore(deps): bump zod from 4.6.2 to 4.6.7 in /site by @dependabot[bot] in #5537
• chore(deps): bump fast-uri from 3.1.8 to 3.1.9 in /site by @dependabot[bot] in #5536
• chore(deps): bump k8s.io/streaming from 0.37.1 to 0.37.2 in the k8s group across 1 directory by @dependabot[bot] in #5586
• chore(deps): bump the codeql group with 3 updates by @dependabot[bot] in #5578
• chore(deps): bump docker/login-action from 4.6.0 to 4.7.0 by @dependabot[bot] in #5579
• chore(deps): bump github.com/docker/cli from 29.8.2+incompatible to 29.9.2+incompatible by @dependabot[bot] in #5595
• chore(deps): bump the k8s group across 1 directory with 6 updates by @dependabot[bot] in #5611

New Contributors

• @shreyaabaranwal made their first contribution in #5531
• @dwertent made their first contribution in #5602

Full Changelog: v0.89.0...v1.0.0-rc1

Verifying Init Packages

The init packages in this release are signed with keyless Sigstore signing. Verify with:

amd64:

zarf package verify zarf-init-amd64-v1.0.0-rc1.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v1.0.0-rc1" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

arm64:

zarf package verify zarf-init-arm64-v1.0.0-rc1.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v1.0.0-rc1" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

See RELEASES.md for details.

0.89.0 (2026-10-29)

⚠ BREAKING CHANGES

• explit opt in to kustomize plugins on read only dev commands (#5558)
• zoci: support granular layers from Load api (#5538)
• create: validate package secret size (#5528)
• v1beta1: change differential to an object (#5541)
• v1beta1: rename documentation to attachments (#5518)
• v1beta1: limit annotation size (#5526)
• add id to image object (#5480)
• remove ###ZARF builtins from v1beta1 (#5506)
• v1beta1: make sbom and documentation into granular files and layers (#5421)
• stop duplicating package data in package secret (#5527)
• simplify image layer caching to avoid concurrency issues (#5495)
• required injector image in proxy mode (#5494)
• remove defense unicorn shortcuts from oci package refs (#5504)
• remove global cachepath SDK option (#5473)

Features

• add id to image object (#5480) (4fa3135)
• allow R.C. versions to pass version requirements (#5479) (5644019)
• create: validate package secret size (#5528) (fdf6f98)
• explit opt in to kustomize plugins on read only dev commands (#5558) (d851b21)
• improve v1beta1 component config override import logic (#5474) (ef307ca)
• introduce v1beta1 init package (#5453) (56a4b59)
• oci: support custom credential providers (#5502) (be55273)
• release v1beta1 (#5551) (50d2d5a)
• remove BuildData from output of zarf dev upgrade (#5522) (0af0352)
• remove defense unicorn shortcuts from oci package refs (#5504) (2bb9b35)
• remove global cachepath SDK option (#5473) (65e8152)
• required injector image in proxy mode (#5494) (1f36c1c)
• stop duplicating package data in package secret (#5527) (2904d9e)
• v1beta1: change differential to an object (#5541) (f92de7b)
• v1beta1: limit annotation size (#5526) (cb3315b)
• v1beta1: make sbom and documentation into granular files and layers (#5421) (2df5429)
• v1beta1: rename documentation to attachments (#5518) (24ecf08)
• zoci: support granular layers from Load api (#5538) (918a769)

Bug Fixes

• catch and handle empty digests (#5501) (bf616d6)
• cmd: don't redefine vendored tool flag shorthands (#5496) (d2830dc)
• component publish values schema (#5565) (44b3c04)
• correctly save chart removal progress after subsequent chart removal fails (#5492) (59dc11f)
• ensure chart order is preserved in state (#5477) (efdd6a8)
• initialize cluster state before recording init status (#5566) (0c2b3c8)
• remove ###ZARF builtins from v1beta1 (#5506) (9283799)
• simplify image layer caching to avoid concurrency issues (#5495) (2ec7419)
• use canonical reference for sbom source (#5545) (ac27648)

What's Changed

🚀 Updates

• chore(main): release 0.89.0 by @zarf-release-please[bot] in #5483

Full Changelog: v0.89.0-rc3...v0.89.0

Verifying Init Packages

The init packages in this release are signed with keyless Sigstore signing. Verify with:

amd64:

zarf package verify zarf-init-amd64-v0.89.0.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.89.0" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

arm64:

zarf package verify zarf-init-arm64-v0.89.0.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.89.0" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

See RELEASES.md for details.

What's Changed

🚀 Updates

• fix: catch and handle empty digests by @eoghanriley in #5501
• feat(oci): support custom credential providers by @s-urbaniak in #5502
• chore: update go version to 1.26.10 by @brandtkeller in #5509
• docs: remove outdated note from package-signing doc by @jonnyborbs in #5508
• feat!: remove defense unicorn shortcuts from oci package refs by @AustinAbro321 in #5504
• fix: correctly save chart removal progress after subsequent chart removal fails by @AustinAbro321 in #5492
• feat!: required injector image in proxy mode by @AustinAbro321 in #5494
• fix!: simplify image layer caching to avoid concurrency issues by @AustinAbro321 in #5495
• test: cover localhost NodePorts with nftables in kind by @aditya-rai-5 in #5513
• feat!: stop duplicating package data in package secret by @AustinAbro321 in #5527
• feat(v1beta1)!: make sbom and documentation into granular files and layers by @brandtkeller in #5421
• fix!: remove ###ZARF builtins from v1beta1 by @AustinAbro321 in #5506
• feat!: add id to image object by @AustinAbro321 in #5480
• feat: remove BuildData from output of zarf dev upgrade by @AustinAbro321 in #5522
• feat(v1beta1)!: limit annotation size by @AustinAbro321 in #5526
• feat: improve v1beta1 component config override import logic by @AustinAbro321 in #5474
• fix(cmd): don't redefine vendored tool flag shorthands by @a1994sc in #5496
• feat(v1beta1)!: rename documentation to attachments by @AustinAbro321 in #5518
• feat(v1beta1)!: change differential to an object by @AustinAbro321 in #5541
• chore: contributor ladder enhancements by @brandtkeller in #5543
• feat(create)!: validate package secret size by @AustinAbro321 in #5528
• chore(lint): update to golangci-lint v2.15 by @AustinAbro321 in #5540
• fix: use canonical reference for sbom source by @brandtkeller in #5545
• feat(zoci)!: support granular layers from Load api by @brandtkeller in #5538
• feat: introduce v1beta1 init package by @AustinAbro321 in #5453
• feat: release v1beta1 by @AustinAbro321 in #5551
• feat!: explit opt in to kustomize plugins on read only dev commands by @AustinAbro321 in #5558
• fix: component publish values schema by @AustinAbro321 in #5565
• fix: initialize cluster state before recording init status by @AustinAbro321 in #5566

📦 Dependencies

• chore(deps): bump the codeql group with 3 updates by @dependabot[bot] in #5533
• chore(deps): bump actions/create-github-app-token from 3.2.0 to 3.3.0 in the actions-organization group across 1 directory by @dependabot[bot] in #5532
• chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.6 by @dependabot[bot] in #5555

New Contributors

• @eoghanriley made their first contribution in #5501
• @s-urbaniak made their first contribution in #5502
• @aditya-rai-5 made their first contribution in #5513

Full Changelog: v0.89.0-rc2...v0.89.0-rc3

Verifying Init Packages

The init packages in this release are signed with keyless Sigstore signing. Verify with:

amd64:

zarf package verify zarf-init-amd64-v0.89.0-rc3.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.89.0-rc3" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

arm64:

zarf package verify zarf-init-arm64-v0.89.0-rc3.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.89.0-rc3" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

See RELEASES.md for details.

What's Changed

🚀 Updates

• feat: allow R.C. versions to pass version requirements by @AustinAbro321 in #5479
• fix: ensure chart order is preserved in state by @mjnagel in #5477
• test: fix image push unit test flake by @AustinAbro321 in #5481
• chore: goreleaser signed commits and dco bot bypass by @brandtkeller in #5485

📦 Dependencies

• chore(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0 by @dependabot[bot] in #5488
• chore(deps): bump the codeql group with 3 updates by @dependabot[bot] in #5487
• chore(deps): bump the actions-organization group with 3 updates by @dependabot[bot] in #5486

Full Changelog: v0.89.0-rc1...v0.89.0-rc2

Verifying Init Packages

The init packages in this release are signed with keyless Sigstore signing. Verify with:

amd64:

zarf package verify zarf-init-amd64-v0.89.0-rc2.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.89.0-rc2" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

arm64:

zarf package verify zarf-init-arm64-v0.89.0-rc2.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.89.0-rc2" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

See RELEASES.md for details.

What's Changed

🚀 Updates

• feat!: remove global cachepath SDK option by @AustinAbro321 in #5473
• chore: migrate homebrew tap repo target by @brandtkeller in #5482

Full Changelog: v0.88.0...v0.89.0-rc1

Verifying Init Packages

The init packages in this release are signed with keyless Sigstore signing. Verify with:

amd64:

zarf package verify zarf-init-amd64-v0.89.0-rc1.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.89.0-rc1" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

arm64:

zarf package verify zarf-init-arm64-v0.89.0-rc1.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.89.0-rc1" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

See RELEASES.md for details.

0.88.0 (2026-10-15)

⚠ BREAKING CHANGES

• layout: materialize symlinks on package creation (#5462)
• create: isolate and enforce filepaths to layout directory (#5446)
• make component services an object (#5471)
• cleanup v1beta1 edge cases and add e2e test (#5443)
• implement find images for v1beta1 package and component config (#5428)

Features

• add ability to skip arch check on package deploy (#5451) (16461d4)
• add init chart values schemas (#5347) (4c238cc)
• cleanup v1beta1 edge cases and add e2e test (#5443) (02264d6)
• get-creds: only print credentials for configured services (#5418) (1f4b42a)
• implement find images for v1beta1 package and component config (#5428) (a12d5ab)
• implement zarf dev generate-schema for v1beta1 packages and component configs (#5442) (562f5c0)
• implement zarf dev lint for v1beta1 packages and component configs (#5431) (c3c98c1)
• introduce v1beta1 init config (#5427) (9ce3715)
• layout: materialize symlinks on package creation (#5462) (1cc76b0)
• make component services an object (#5471) (16f1a7c)
• unhide v1beta1 commands and add feature flag (#5460) (7387b24)
• v1beta1 and component config zarf dev inspect implementations (#5438) (2430007)
• v1beta1: honor image sources (#5394) (5062461)
• v1beta1: sha256/sha512 verification checksum verification (#5399) (0e61e0e)

Bug Fixes

• create: isolate and enforce filepaths to layout directory (#5446) (b3f2f8e)
• preserve healthcheck result during watcher cancellation (#5437) (5222087)
• prevent cache race from causing errors in concurrent zarf process OCI package loads (#5439) (ef88af0)

What's Changed

🚀 Updates

• chore(main): release 0.88.0 by @zarf-release-please[bot] in #5429

Full Changelog: v0.88.0-rc1...v0.88.0

Verifying Init Packages

The init packages in this release are signed with keyless Sigstore signing. Verify with:

amd64:

zarf package verify zarf-init-amd64-v0.88.0.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.88.0" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

arm64:

zarf package verify zarf-init-arm64-v0.88.0.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.88.0" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

See RELEASES.md for details.

0.87.0 (2026-09-30)

⚠ BREAKING CHANGES

• remove images and repositories from package secret during connected deploys (#5402)
• helm: only label pod templates of built-in workload kinds (#5360)
• disable artifact server by default (#5417)
• migrate SignBlobOptions to a pointer (#5411)
• package: move signing out of publish (#5387)
• switch to api.Package from v1alpha1.ZarfPackage throughout repository (#5379)
• public operational type (#5345)

Features

• add explicit git server mode to state (#5395) (a8e695d)
• add validation for api package (#5393) (cebc6ee)
• component sign and verify (#5358) (9c58f59)
• component: sign published manifests (#5386) (0c61d2f)
• dev: add --components flag to dev inspect values-files (#5413) (13b7af6)
• disable artifact server by default (#5417) (720f29e)
• migrate SignBlobOptions to a pointer (#5411) (b94f06b)
• package: move signing out of publish (#5387) (438b6c5)
• public operational type (#5345) (6c9d7ce)
• remove migrated fields on api.Package (#5390) (ed97710)
• signing: unify signing option handling (#5385) (4ee0d5c)
• v1beta1: componet import validation (#5384) (ce0abd9)
• v1beta1: store multiple API versions in Deployed packages (#5250) (bcfbc65)

Bug Fixes

• assemble: cleanup temporary directory on error (#5407) (d07690e)
• create: run OnSuccess and OnFailure actions during create (#5406) (dd7301b)
• helm: handle charts that render resources inside list kinds (#5344) (1f7bbc9)
• helm: only label pod templates of built-in workload kinds (#5360) (7be076a)
• init: propagate secret updates on init mode changes (#5398) (c18603a)
• remove images and repositories from package secret during connected deploys (#5402) (1653ca2)
• replace github.com/defenseunicorns/pkg with local versions (#5324) (379379a)
• values: preserve inferred types across null overlays (#5412) (9213afd)

Refactoring

• switch to api.Package from v1alpha1.ZarfPackage throughout repository (#5379) (9ce36bb)

What's Changed

🚀 Updates

• chore(main): release 0.87.0 by @zarf-release-please[bot] in #5374

Full Changelog: v0.87.0-rc1...v0.87.0

Verifying Init Packages

The init packages in this release are signed with keyless Sigstore signing. Verify with:

amd64:

zarf package verify zarf-init-amd64-v0.87.0.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.87.0" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

arm64:

zarf package verify zarf-init-arm64-v0.87.0.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.87.0" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

See RELEASES.md for details.

What's Changed

🚀 Updates

• fix(helm): handle charts that render resources inside list kinds by @idebeijer in #5344
• feat!: public operational type by @AustinAbro321 in #5345
• feat: component sign and verify by @AustinAbro321 in #5358
• chore: typo in README header from Packager to Package by @nick-adkins in #5389
• refactor!: switch to api.Package from v1alpha1.ZarfPackage throughout repository by @AustinAbro321 in #5379
• docs: fix tagline by @AustinAbro321 in #5392
• feat: remove migrated fields on api.Package by @AustinAbro321 in #5390
• fix(init): propagate secret updates on init mode changes by @brandtkeller in #5398
• feat: add explicit git server mode to state by @AustinAbro321 in #5395
• fix(create): run OnSuccess and OnFailure actions during create by @AustinAbro321 in #5406
• feat(signing): unify signing option handling by @brandtkeller in #5385
• feat(component): sign published manifests by @brandtkeller in #5386
• feat(package)!: move signing out of publish by @brandtkeller in #5387
• fix(assemble): cleanup temporary directory on error by @brandtkeller in #5407
• docs: remove sbom viewer by @AustinAbro321 in #5409
• feat!: migrate SignBlobOptions to a pointer by @brandtkeller in #5411
• feat!: disable artifact server by default by @AustinAbro321 in #5417
• feat(v1beta1): store multiple API versions in Deployed packages by @AustinAbro321 in #5250
• feat(dev): add --components flag to dev inspect values-files by @dalehenries in #5413
• fix: replace github.com/defenseunicorns/pkg with local versions by @soltysh in #5324
• fix(helm)!: only label pod templates of built-in workload kinds by @idebeijer in #5360
• fix!: remove images and repositories from package secret during connected deploys by @AustinAbro321 in #5402
• feat: add validation for api package by @AustinAbro321 in #5393
• fix(values): preserve inferred types across null overlays by @ntwkninja in #5412
• feat(v1beta1): componet import validation by @AustinAbro321 in #5384

📦 Dependencies

• chore(deps): bump the codeql group with 3 updates by @dependabot[bot] in #5378
• chore(deps): bump aws-actions/configure-aws-credentials from 6.2.4 to 6.3.0 by @dependabot[bot] in #5405
• chore(deps): bump codecov/codecov-action from 7.0.0 to 7.1.1 by @dependabot[bot] in #5404
• chore(deps): bump the codeql group with 3 updates by @dependabot[bot] in #5403
• chore(deps-dev): bump undici from 7.29.0 to 7.30.0 in /site by @dependabot[bot] in #5420

New Contributors

• @idebeijer made their first contribution in #5344
• @dalehenries made their first contribution in #5413

Full Changelog: v0.86.0...v0.87.0-rc1

Verifying Init Packages

The init packages in this release are signed with keyless Sigstore signing. Verify with:

amd64:

zarf package verify zarf-init-amd64-v0.87.0-rc1.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.87.0-rc1" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

arm64:

zarf package verify zarf-init-arm64-v0.87.0-rc1.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.87.0-rc1" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

See RELEASES.md for details.