# mvirt 0.29.8

migrations: no
wire: unchanged
rev: de60bdcb20367ae925e635385ba6cddee1b28fa3

mvirt 0.29.8 — SECURITY

The host edge's Envoy gets its HTTP/2 security fixes, a routed public IPv6 on
a vNIC is reachable, and a Task's retries neither burn out in seconds against
a rate-limited registry nor count one failure twice. Roll out of cadence (§A2: unauthenticated DoS on the
front door).

- edge: envoy-static 1.39.0 → 1.39.1 on the control-plane host edge
  (:80/:443) — CVE-2026-73550 (Host-header OOM), CVE-2026-73513 (trailer
  abort), CVE-2026-73548 (upgrade smuggling); in step with the fleet image
  (refs #405).
- net: a reserved public IPv6 attached as a vNIC's address reaches the
  datapath on an existing vNIC, is announced north-south when the ledger
  vouches for it, and the guest gets an RA (+ default route) even on a
  network without a v6 prefix (refs #416). The guest must re-solicit (network
  reconfigure/reboot inside the VM) to pick it up.
- cplane: a Task attempt that failed on an image pull waits out the pull
  backoff (5–15 min on a recognised rate limit) instead of re-running at once;
  a held-back pod says why in status.message; mvirt-one reports non-OCI 4xx /
  5xx registry answers readably (refs #288).
- cplane: a Task failure costs one attempt, not two — the Task pass no longer
  re-reads a rescheduled pod's leftover Failed phase (seen on prod: import
  Tasks jumping attempt 1→2 within ~1 s) (closes #417).


## Upgrading

Point your flake's `mvirt` input at this release and redeploy the control-plane
host first, then each node in turn:

```
nix run .#colmena -- apply boot --reboot --on <control-plane host>
nix run .#colmena -- apply boot --reboot --on <node>   # one at a time
```

This release adds no migrations, so the control-plane host rolls back the same way
a node does: boot the previous NixOS generation.