0.89.0 (2026-10-29)
⚠ BREAKING CHANGES
- explit opt in to kustomize plugins on read only dev commands (#5558)
- zoci: support granular layers from Load api (#5538)
- create: validate package secret size (#5528)
- v1beta1: change differential to an object (#5541)
- v1beta1: rename documentation to attachments (#5518)
- v1beta1: limit annotation size (#5526)
- add id to image object (#5480)
- remove ###ZARF builtins from v1beta1 (#5506)
- v1beta1: make sbom and documentation into granular files and layers (#5421)
- stop duplicating package data in package secret (#5527)
- simplify image layer caching to avoid concurrency issues (#5495)
- required injector image in proxy mode (#5494)
- remove defense unicorn shortcuts from oci package refs (#5504)
- remove global cachepath SDK option (#5473)
Features
- add id to image object (#5480) (4fa3135)
- allow R.C. versions to pass version requirements (#5479) (5644019)
- create: validate package secret size (#5528) (fdf6f98)
- explit opt in to kustomize plugins on read only dev commands (#5558) (d851b21)
- improve v1beta1 component config override import logic (#5474) (ef307ca)
- introduce v1beta1 init package (#5453) (56a4b59)
- oci: support custom credential providers (#5502) (be55273)
- release v1beta1 (#5551) (50d2d5a)
- remove BuildData from output of zarf dev upgrade (#5522) (0af0352)
- remove defense unicorn shortcuts from oci package refs (#5504) (2bb9b35)
- remove global cachepath SDK option (#5473) (65e8152)
- required injector image in proxy mode (#5494) (1f36c1c)
- stop duplicating package data in package secret (#5527) (2904d9e)
- v1beta1: change differential to an object (#5541) (f92de7b)
- v1beta1: limit annotation size (#5526) (cb3315b)
- v1beta1: make sbom and documentation into granular files and layers (#5421) (2df5429)
- v1beta1: rename documentation to attachments (#5518) (24ecf08)
- zoci: support granular layers from Load api (#5538) (918a769)
Bug Fixes
- catch and handle empty digests (#5501) (bf616d6)
- cmd: don't redefine vendored tool flag shorthands (#5496) (d2830dc)
- component publish values schema (#5565) (44b3c04)
- correctly save chart removal progress after subsequent chart removal fails (#5492) (59dc11f)
- ensure chart order is preserved in state (#5477) (efdd6a8)
- initialize cluster state before recording init status (#5566) (0c2b3c8)
- remove ###ZARF builtins from v1beta1 (#5506) (9283799)
- simplify image layer caching to avoid concurrency issues (#5495) (2ec7419)
- use canonical reference for sbom source (#5545) (ac27648)
What's Changed
🚀 Updates
- chore(main): release 0.89.0 by @zarf-release-please[bot] in https://github.com/zarf-dev/zarf/pull/5483
Full Changelog: https://github.com/zarf-dev/zarf/compare/v0.89.0-rc3...v0.89.0
Verifying Init Packages
The init packages in this release are signed with keyless Sigstore signing. Verify with:
amd64:
:::bash
zarf package verify zarf-init-amd64-v0.89.0.tar.zst \
--certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.89.0" \
--certificate-oidc-issuer "https://token.actions.githubusercontent.com"
arm64:
:::bash
zarf package verify zarf-init-arm64-v0.89.0.tar.zst \
--certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.89.0" \
--certificate-oidc-issuer "https://token.actions.githubusercontent.com"
See RELEASES.md (github.com) for details.
