1.2.0

mahimailabs/voicegateway1.2.0Jul 29, 2026by github-actions[bot]

AI Summary

Security-focused release that fixes multiple CVEs related to environment variable inheritance, unbounded port forwarding, and symlink disclosure. It also introduces the core features of the Kubernetes plugin, container export, and SSH support.

Key Highlights

Fixes multiple security vulnerabilities (CVE-2026-64786, CVE-2026-64773, etc.)
Introduces Kubernetes plugin
Introduces container export
Introduces SSH build option
Introduces filesystem masking options

New Features

k8s plugin for turnkey local Kubernetes cluster
container export for live containers
--ssh option for container build
--read-only-path and --masked-path for container run

Full Release Notes

## Highlights 

⌨️ denotes breaking CLI changes.

👩‍💻 denotes breaking API changes.

- SECURITY FIXES
  - [GHSA-xwgf-4rc5-p4m4](https://github.com/apple/container/security/advisories/GHSA-xwgf-4rc5-p4m4) - CVE-2026-64786 - bare-name image `Config.Env` entries should not inherit values from the launching process's environment
  - [GHSA-wg28-286f-56v6](https://github.com/apple/container/security/advisories/GHSA-wg28-286f-56v6) - CVE-2026-64773 - TCP port forwarder buffers unbounded pre-connect data from published container ports
  - [GHSA-2v2q-4q35-h585](https://github.com/apple/container/security/advisories/GHSA-2v2q-4q35-h585) - CVE-2026-64777 - Build filesystem sync discloses host files outside the build context via symlinks
  - [GHSA-g57j-434g-5xj2](https://github.com/apple/container/security/advisories/GHSA-g57j-434g-5xj2) - `BuildFSSync.walk()`'s JSON response mode reports the resolved host path of build-context symlinks that point outside the context.
  - [GHSA-5h49-6pr7-9mv4](https://github.com/apple/containerization/security/advisories/GHSA-5h49-6pr7-9mv4) - reset special permission bits when extracting archives onto the host.
- Core
  - [`k8s` plugin for turnkey local Kubernetes cluster](https://github.com/apple/container/issues/2043)
  - [`container export` for live containers](https://github.com/apple/container/issues/1400).
  - [`--ssh` option for `container build`](https://github.com/apple/container/issues/1472).
  - [`--read-only-path` and `--masked-path` for `container run` for Kubernetes, Docker, and similar containers](https://github.com/apple/container/issues/2041).

## What's Changed
* Add TestCLISystemLogs and TestCLITermIO integration tests in new integration test suite by @katiewasnothere in https://github.com/apple/container/pull/1879
* Restore reverted migrations, migrate last tests. by @jglogan in https://github.com/apple/container/pull/1880
* Removes obsolete CLITests directory. by @jglogan in https://github.com/apple/container/pull/1886
* Integration coverage xpc helpers by @noah-thor in https://github.com/apple/container/pull/1551
* Upgrade grpc-swift-nio-transport to 2.9.0 and remove HTTP2ConnectBuff… by @adityabagchi24 in https://github.com/apple/container/pull/1790
* Updates containerization to 0.36.0. by @jglogan in https://github.com/apple/container/pull/1912
* Use containerization version 0.37.0 by @adityaramani in https://github.com/apple/container/pull/1932
* Verify kernel archive integrity by @haoruilee in https://github.com/apple/container/pull/1703
* Add commit/issue alert to PR template. by @jglogan in https://github.com/apple/container/pull/1945
* Remove `--skip-build` from test Makefile target. by @jglogan in https://github.com/apple/container/pull/1951
* Restore `--skip-build`, enable `import testable` for release builds. by @jglogan in https://github.com/apple/container/pull/1955
* [package]: bump container-builder-shim to 0.13.0 by @saehejkang in https://github.com/apple/container/pull/1953
* Validate container ID from XPC requests by @katiewasnothere in https://github.com/apple/container/pull/1956
* Remove force unwraps on XPC error set/get by @katiewasnothere in https://github.com/apple/container/pull/1958
* Do not follow destination symlink when copying user configuration by @katiewasnothere in https://github.com/apple/container/pull/1957
* Fix machine ID length test. by @jglogan in https://github.com/apple/container/pull/1971
* Address flaky TestCLIKernelSetSerial suite. by @jglogan in https://github.com/apple/container/pull/1976
* [gitignore]: ignore vscode workspace files by @saehejkang in https://github.com/apple/container/pull/1966
* Update containerization dependency with new EXT4Unpacker func definition by @katiewasnothere in https://github.com/apple/container/pull/1973
* Periodic dependency updates. by @jglogan in https://github.com/apple/container/pull/1981
* Use ordered journal mode for unpacked images. by @jglogan in https://github.com/apple/container/pull/1974
* Reword DNS container name resolution doc information by @katiewasnothere in https://github.com/apple/container/pull/1960
* ci: bump the github-actions group across 1 directory with 3 updates by @dependabot[bot] in https://github.com/apple/container/pull/1983
* Pass build config in when building protoc dependencies by @katiewasnothere in https://github.com/apple/container/pull/1972
* Container test fixture package by @katiewasnothere in https://github.com/apple/container/pull/1887
* Downgrade swift-collections to 1.5.1. by @jglogan in https://github.com/apple/container/pull/1984
* Use `enum` for warmup images. by @jglogan in https://github.com/apple/container/pull/1990
* Add missing dependencies to new ContainerTestSupport package by @katiewasnothere in https://github.com/apple/container/pull/1994
* Add OCI maskedPaths and readonlyPaths support to Container API. by @jglogan in https://github.com/apple/container/pull/1996
* Integration test - miscellaneous fixture and test refinements. by @jglogan in https://github.com/apple/container/pull/1993
* Use log instead of print for system start status messages by @adityabagchi24 in https://github.com/apple/container/pull/1889
* Fix BuilderStart race, parallelize `container build` tests. by @jglogan in https://github.com/apple/container/pull/2002
* Allow custom kernel boot args via --kernel-arg by @arirubinstein in https://github.com/apple/container/pull/1744
* fix: Increase XPC timeout for Machine API operations by @dev-kvt in https://github.com/apple/container/pull/2006
* Update containerization import to latest 0.40.0 by @katiewasnothere in https://github.com/apple/container/pull/2028
* Fix image env vars, build context checks, TCP/UDP port forward buffer, and validate plugin name by @katiewasnothere in https://github.com/apple/container/pull/2027
* Update containerization import to 0.40.1 by @katiewasnothere in https://github.com/apple/container/pull/2038

## New Contributors
* @haoruilee made their first contribution in https://github.com/apple/container/pull/1703
* @arirubinstein made their first contribution in https://github.com/apple/container/pull/1744
* @dev-kvt made their first contribution in https://github.com/apple/container/pull/2006

**Full Changelog**: https://github.com/apple/container/compare/1.1.0...1.2.0