[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
ghcr.io/zarf-dev/packages/init		minor	v0.87.0 → v0.88.0
github.com/zarf-dev/zarf	require	minor	v0.87.0 → v0.88.0
zarf-dev/zarf		minor	0.87.0 → 0.88.0
zarf-dev/zarf		minor	v0.87.0 → v0.88.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

zarf-dev/zarf (github.com/zarf-dev/zarf)

v0.88.0

Compare Source

⚠ BREAKING CHANGES

• layout: materialize symlinks on package creation (#​5462)
• create: isolate and enforce filepaths to layout directory (#​5446)
• make component services an object (#​5471)
• cleanup v1beta1 edge cases and add e2e test (#​5443)
• implement find images for v1beta1 package and component config (#​5428)

Features

• add ability to skip arch check on package deploy (#​5451) (16461d4)
• add init chart values schemas (#​5347) (4c238cc)
• cleanup v1beta1 edge cases and add e2e test (#​5443) (02264d6)
• get-creds: only print credentials for configured services (#​5418) (1f4b42a)
• implement find images for v1beta1 package and component config (#​5428) (a12d5ab)
• implement zarf dev generate-schema for v1beta1 packages and component configs (#​5442) (562f5c0)
• implement zarf dev lint for v1beta1 packages and component configs (#​5431) (c3c98c1)
• introduce v1beta1 init config (#​5427) (9ce3715)
• layout: materialize symlinks on package creation (#​5462) (1cc76b0)
• make component services an object (#​5471) (16f1a7c)
• unhide v1beta1 commands and add feature flag (#​5460) (7387b24)
• v1beta1 and component config zarf dev inspect implementations (#​5438) (2430007)
• v1beta1: honor image sources (#​5394) (5062461)
• v1beta1: sha256/sha512 verification checksum verification (#​5399) (0e61e0e)

Bug Fixes

• create: isolate and enforce filepaths to layout directory (#​5446) (b3f2f8e)
• preserve healthcheck result during watcher cancellation (#​5437) (5222087)
• prevent cache race from causing errors in concurrent zarf process OCI package loads (#​5439) (ef88af0)

What's Changed

🚀 Updates

• chore(main): release 0.88.0 by @​zarf-release-please[bot] in #​5429

Full Changelog: zarf-dev/zarf@v0.88.0-rc1...v0.88.0

Verifying Init Packages

The init packages in this release are signed with keyless Sigstore signing. Verify with:

amd64:

zarf package verify zarf-init-amd64-v0.88.0.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.88.0" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

arm64:

zarf package verify zarf-init-arm64-v0.88.0.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.88.0" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

See RELEASES.md for details.

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

BEGIN_COMMIT_OVERRIDE
chore(deps)!: update zarf to v0.88.0

BREAKING CHANGE: Zarf package creation now packages symlink target contents, including files outside the source tree, and fails on dangling links. Review symlinks before rebuilding packages. Additionally, UDS CLI library users who access Zarf package definitions through deployment hooks or custom loaders may need to update their code for Zarf v0.88’s public API changes.
END_COMMIT_OVERRIDE

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 7 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.26.6 -> 1.26.9
github.com/containerd/containerd/v2	v2.3.4 -> v2.3.6
github.com/docker/cli	v29.8.0+incompatible -> v29.8.2+incompatible
k8s.io/cli-runtime	v0.37.0 -> v0.37.1
k8s.io/component-base	v0.37.0 -> v0.37.1
k8s.io/component-helpers	v0.37.0 -> v0.37.1
k8s.io/kubectl	v0.37.0 -> v0.37.1
k8s.io/metrics	v0.37.0 -> v0.37.1

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[joelmccoy]

@greptileai review

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; the legacy checksum gap is fixed and no new blocking issues were found.

Summary

Updates Zarf to v0.88.0, refreshes package references and schemas, and adds checksum checks.

• Package files with a checksum algorithm but no digest are rejected.
• Zarf package and component workflows use the v0.88.0 release.

_{Reviews (2) · Last reviewed commit: "fix: check checksum on legacy deploy" · Reviewed by Greptile}