Warewulf Pro 1.3.2 (Nov 2026)

Released 2026-11-09.

Highlights

Warewulf upgraded to v4.7.2, a bugfix and security release in the v4.7.x series. warewulfd now serves provisioning files only from within their directories. See Warewulf changes below.
Apptainer upgraded to v1.5.5 (from v1.5.4), a bugfix release. See Apptainer changes below.

Pro v1.3.2 ships Warewulf v4.7.2, which includes:

warewulfd serves provisioning files (kernels, initramfs images, bootloaders, and iPXE and GRUB templates) only from within their directories, so node settings such as image name or ipxe template can no longer select files elsewhere on the server. Symlinks that lead outside these directories, including any absolute symlink, are no longer followed. If a kernel, initramfs, or bootloader in an image is an absolute symlink, make it relative. If you rely on a symlink that points outside an image or template directory to serve one of these files, replace it with a copy or a bind mount.
The Enterprise Linux 8 two-stage (Dracut) boot fix that Warewulf Pro has carried since v1.3.1 is now included upstream.
The chrony overlay now works on Debian and Ubuntu nodes.
wwctl node add and wwctl profile add apply --tagadd, --nettagadd, and --ipmitagadd again.
The deprecated --container, --wwinit, and --runtime flags are applied again.
Node discovery ignores requests whose hardware address is not a valid MAC address.
Dependency updates, including grpc 1.84.0 for CVE-2026-84303 and a move to go.podman.io/image that removes docker/docker from the build.

For the complete upstream changelog, see the Warewulf v4.7.2 release.

Pro v1.3.2 ships Apptainer v1.5.5, which includes:

Built with Go 1.26.10 or later, which blocks the compromised emSign intermediate CA certificates.
Fixed apptainer pull when APPTAINER_PULLDIR is set and the destination is an absolute path. The absolute path now takes precedence.
Fixed file ownership and /etc/passwd and /etc/group mount warnings in suid fakeroot mode when using subuid/subgid mappings with a SIF file.

For the complete upstream changelog, see the Apptainer v1.5.5 release.