OverviewFilesCommitsIssuesDocsReleasesPeers

P2P-Hiverelay commits / 206f4df

chore(fleet): promote canary to v0.25.0-rc.7 (security) (#206)
rc.7 ships the fix for a security regression that is currently live on every relay running services: config/default.js shipped serviceDefaultPeerRole: 'authenticated-user', so anonymous swarm peers were granted the authenticated-user role and the service router opened arbitration.submit — whose pending Map is uncapped — to the whole swarm. Commit 9125f3c fixed three files and missed the one the CLI loads. Also carries the runtime preflight, agent self-update and watchdog drain whitelist, so a failed update rolls back instead of stranding a box. stable stays on v0.24.3. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
206f4df7d7f8b1b5548b657c851264c001131af9
by bigdestiny2 <33146784+bigdestiny2@users.noreply.github.com> · 2026-07-28T15:56:31.000Z

Changed files (1) +1 -1

fleet/channels.json +1 -1
……@@ -2,6 +2,6 @@
22 "_doc": "Declarative release channels for the raw systemd fleet. Each box runs hiverelay-updater on a timer; it reads its channel here and checks out the matching tag (health-gated, auto-rollback). Promote a release by editing the target tag and committing \u2014 canary boxes pick it up first, stable boxes when you bump stable. Holding a box = point its channel at the version it already runs.",
33 "_hold_doc": "`hold` exists so an individual box can be excluded from a channel promotion without inventing a bespoke channel per release. Point a box at it with `CHANNEL=hold` in /etc/hiverelay-updater.conf. Currently used to keep the Track B blind public-test hosts off Track A rollouts.",
44 "stable": "v0.24.3",
5 "canary": "v0.25.0-rc.6",
5 "canary": "v0.25.0-rc.7",
66 "hold": "v0.24.3"
77}