New release 2.73

• FDE: do not save incomplete FDE state when resealing was skipped
• FDE: warn of inconsistent primary or policy counter
• Confdb: document confdb in snapctl help messages
• Confdb: only confdb hooks wait if snaps are disabled
• Confdb: relax confdb change conflict checks
• Confdb: remove empty parent when removing last leaf
• Confdb: support parsing field filters
• Confdb: wrap confdb write values under "values" key
• dm-verity for essential snaps: add new naming convention for verity files
• dm-verity for essential snaps: add snap integrity discovery
• dm-verity for essential snaps: fix verity salt calculation
• Assertions: add hardware identity assertion
• Assertions: add integrity stanza in snap resources revisions
• Assertions: add request message assertion required for remote device management
• Assertions: add response-message assertion for secure remote device management
• Assertions: expose WithStackedBackstore in RODatabase
• Packaging: cross-distro | install upstream NEWS file into relevant snapd package doc directory
• Packaging: cross-distro | tweak how the blocks injecting $SNAP_MOUNT_DIR/bin are generated as required for openSUSE
• Packaging: remove deprecated snap-gdb-shim and all references now that snap run --gdb is unsupported and replaced by --gdbserver
• Preseed: call systemd-tmpfiles instead handle-writable-paths on uc26
• Preseed: do not remove the /snap dir but rather all its contents during reset
• snap-confine: attach name derived from security tag to BPF maps and programs
• snap-confine: ensure permitted capabilities match expectation
• snap-confine: fix cached snap-confine profile cleanup to report the correct error instead of masking backend setup failures
• snap-confine: Improve validation of user controlled paths
• snap-confine: tighten snap cgroup checks to ensure a snap cannot start another snap in the same cgroup, preventing incorrect device-filter installation
• core-initrd: add 26.04 ubuntu-core-initramfs package
• core-initrd: add missing order dependency for setting default system files
• core-initrd: avoid scanning loop and mmc boot partitions as the boot disk won't be any of these
• core-initrd: make cpio a Depends and remove from Build-Depends
• core-initrd: start plymouth sooner and reload when gadget is available
• Cross-distro: modify syscheck to account for differences in openSUSE 16.0+
• Validation sets: use in-flight validation sets when calling 'snapctl install' from hook
• Prompting: enable prompting for the camera interface
• Prompting: remove polkit authentication when modifying/deleting prompting rules
• LP: #2127189 Prompting: do not record notices for unchanged rules on snapd startup
• AppArmor: add free and pidof to the template
• AppArmor: adjust interfaces/profiles to cope with coreutils paths
• Interfaces: add support for compatibility expressions
• Interfaces: checkbox-support | complete overhaul
• Interfaces: define vulkan-driver-libs, cuda-driver-libs, egl-driver-libs, gbm-driver-libs, opengl-driver-libs, and opengles-driver-libs
• Interfaces: allow snaps on classic access to nvidia graphics libraries exported by *-driver-libs interfaces
• Interfaces: fwupd | broaden access to /boot/efi/EFI
• Interfaces: gsettings | set dconf-service as profile for ca.desrt.dconf.Writer
• Interfaces: iscsi-initiator, dm-multipath, nvme-control | add new interfaces
• Interfaces: opengl | grant read/write permission to /run/nvidia-persistenced/socket
• interfaces: ros-snapd-support | add access to /v2/changes/
• Interfaces: system-observe | read access to btrfs/ext4/zfs filesystem information
• Interfaces: system-trace | allow /sys/kernel/tracing/** rw
• Interfaces: usb-gadget | add support for ffs mounts in attributes
• Add autocompletion to run command
• Introduce option for disallowing auto-connection of a specific interface
• Only log errors for user service operations performed as a part of snap removal
• Patch snap names in service requests for parallel installed snaps
• Simplify traits for eMMC special partitions
• Strip apparmor_parser from debug symbols shrinking snapd size by ~3MB
• Fix InstallPathMany skipping refresh control
• Fix waiting for GDB helper to stop before attaching gdbserver
• Protect the per-snap tmp directory against being reaped by age
• Prevent disabling base snaps to ensure dependent snaps can be removed
• Modify API endpoint /v2/logs to reject n <= 0 (except for special case -1 meaning all)
• Avoid potential deadlock when task is injected after the change was aborted
• Avoid race between store download stream and cache cleanup executing in parallel when invoked by snap download task
• LP: #1851490 Use "current" instead of revision number for icons
• LP: #2121853 Add snapctl version command
• LP: #2127214 Ensure no more than one partition on disk can match a gadget partition
• LP: #2127244 snap-confine: update AppArmor profile to allow read/write to journal as workaround for snap-confine fd inheritance prevented by newer AppArmor

New release 2.72

• FDE: support replacing TPM protected keys at runtime via the
  /v2/system-volumes endpoint
• FDE: support secboot preinstall check fix actions for 25.10+
  hybrid installs via the /v2/system/{label} endpoint
• FDE: tweak polkit message to remove jargon
• FDE: ensure proper sealing with kernel command line defaults
• FDE: provide generic reseal function
• FDE: support using OPTEE for protecting keys, as an alternative to
  existing fde-setup hooks (Ubuntu Core only)
• Confdb: 'snapctl get --view' supports passing default values
• Confdb: content sub-rules in confdb-schemas inherit their parent
  rule's "access"
• Confdb: make confdb error kinds used in API more generic
• Confdb: fully support lists and indexed paths (including unset)
• Prompting: add notice backend for prompting types (unused for now)
• Prompting: include request cgroup in prompt
• Prompting: handle unsupported xattrs
• Prompting: add permission mapping for the camera interface
• Notices: read notices from state without state lock
• Notices: add methods to get notice fields and create, reoccur, and
  deepcopy notice
• Notices: add notice manager to coordinate separate notice backends
• Notices: support draining notices from state when notice backend
  registered as producer of a particular notice type
• Notices: query notice manager from daemon instead of querying
  state for notices directly
• Packaging: Ubuntu | ignore .git directory
• Packaging: FIPS | bump deb Go FIPS to 1.23
• Packaging: snap | bump FIPS toolchain to 1.23
• Packaging: debian | sync most upstream changes
• Packaging: debian-sid | depends on libcap2-bin for postint
• Packaging: Fedora | drop fakeroot
• Packaging: snap | modify snapd.mk to pass build tags when running
  unit tests
• Packaging: snap | modify snapd.mk to pass nooptee build tag
• Packaging: modify Makefile.am to fix snap-confine install profile
  with 'make hack'
• Packaging: modify Makefile.am to fix out-of-tree use of 'make
  hack'
• LP: #2122054 Snap installation: skip snap icon download when
  running in a cloud or using a proxy store
• Snap installation: add timeout to http client when downloading
  snap icon
• Snap installation: use http(s) proxy for icon downloads
• LP: #2117558 snap-confine: fix error message with /root/snap not
  accessible
• snap-confine: fix non-suid limitation by switching to root:root to
  operate v1 freezer
• core-initrd: do not use writable-paths when not available
• core-initrd: remove debian folder
• LP: #1916244 Interfaces: gpio-chardev | re-enable the gpio-chardev
  interface now with the more robust gpio-aggregator configfs kernel
  interface
• Interfaces: gpio-chardev | exclusive snap connections, raise a
  conflict when both gpio-chardev and gpio are connected
• Interfaces: gpio-chardev | fix gpio-aggregator module load order
• Interfaces: ros-snapd-support | grant access to /v2/changes
• Interfaces: uda-driver-libs, egl-driver-libs, gbm-driver-libs,
  opengl-driver-libs, opengles-driver-libs | new interfaces to
  support nvidia driver components
• Interfaces: microstack-support | allow DPDK (hugepage related
  permissions)
• Interfaces: system-observe | allow reading additional files in
  /proc, needed by node-exporter
• Interfaces: u2f | add Cano Key, Thesis FIDO2 BioFP+ Security Key
  and Kensington VeriMark DT Fingerprint Key to device list
• Interfaces: snap-interfaces-requests-control | allow shell API
  control
• Interfaces: fwupd | allow access to Intel CVS sysfs
• Interfaces: hardware-observe | allow read access to Kernel
  Samepage Merging (KSM)
• Interfaces: xilinx-dma | support Multi Queue DMA (QDMA) IP
• Interfaces: spi | relax sysfs permission rules to allow access to
  SPI device node attributes
• Interfaces: content | introduce compatibility label
• LP: #2121238 Interfaces: do not expose Kerberos tickets for
  classic snaps
• Interfaces: ssh-public-keys | allow ro access to public host keys
  with ssh-key
• Interfaces: Modify AppArmor template to allow listing systemd
  credentials and invoking systemd-creds
• Interfaces: modify AppArmor template with workarounds for Go 1.35
  cgroup aware GOMAXPROCS
• Interfaces: modify seccomp template to allow landlock_*
• Prevent snap hooks from running while relevant snaps are unlinked
• Make refreshes wait before unlinking snaps if running hooks can be
  affected
• Fix systemd unit generation by moving "WantedBy=" from section
  "unit" to "install"
• Add opt-in logging support for snap-update-ns
• Unhide 'snap help' sign and export-key under Development category
• LP: #2117121 Cleanly support socket activation for classic snap
• Add architecture to 'snap version' output
• Add 'snap debug api' option to disable authentication through
  auth.json
• Show grade in notes for 'snap info --verbose'
• Fix preseeding failure due to scan-disk issue on RPi
• Support 'snap debug api' queries to user session agents
• LP: #2112626 Improve progress reporting for snap install/refresh
• Drop legacy BAMF_DESKTOP_FILE_HINT in desktop files
• Fix /v2/apps error for root user when user services are present
• LP: #2114704 Extend output to indicate when snap data snapshot was
  created during remove
• Improve how we handle emmc volumes
• Improve handling of system-user extra assertions

New release 2.71

• FDE: auto-repair when recovery key is used
• FDE: revoke keys on shim update
• FDE: revoke old TPM keys when dbx has been updated
• FDE: do not reseal FDE hook keys every time
• FDE: store keys in the kernel keyring when installing from initrd
• FDE: allow disabled DMA on Core
• FDE: snap-bootstrap: do not check for partition in scan-disk on CVM
• FDE: support secboot preinstall check for 25.10+ hybrid installs via the /v2/system/{label} endpoint
• FDE: support generating recovery key at install time via the /v2/systems/{label} endpoint
• FDE: update passphrase quality check at install time via the /v2/systems/{label} endpoint
• FDE: support replacing recovery key at runtime via the new /v2/system-volumes endpoint
• FDE: support checking recovery keys at runtime via the /v2/system-volumes endpoint
• FDE: support enumerating keyslots at runtime via the /v2/system-volumes endpoint
• FDE: support changing passphrase at runtime via the /v2/system-volumes endpoint
• FDE: support passphrase quality check at runtime via the /v2/system-volumes endpoint
• FDE: update secboot to revision 3e181c8edf0f
• Confdb: support lists and indexed paths on read and write
• Confdb: alias references must be wrapped in brackets
• Confdb: support indexed paths in confdb-schema assertion
• Confdb: make API errors consistent with options
• Confdb: fetch confdb-schema assertion on access
• Confdb: prevent --previous from being used in read-side hooks
• Components: fix snap command with multiple components
• Components: set revision of seed components to x1
• Components: unmount extra kernel-modules components mounts
• AppArmor Prompting: add lifespan "session" for prompting rules
• AppArmor Prompting: support restoring prompts after snapd restart
• AppArmor Prompting: limit the extra information included in probed AppArmor features and system key
• Notices: refactor notice state internals
• SELinux: look for restorecon/matchpathcon at all known locations rather than current PATH
• SELinux: update policy to allow watching cgroups (for RAA), and talking to user session agents (service mgmt/refresh)
• Refresh App Awareness: Fix unexpected inotify file descriptor cleanup
• snap-confine: workaround for glibc fchmodat() fallback and handle ENOSYS
• snap-confine: add support for host policy for limiting users able to run snaps
• LP: #2114923 Reject system key mismatch advise when not yet seeded
• Use separate lanes for essential and non-essential snaps during seeding and allow non-essential installs to retry
• Fix bug preventing remodel from core18 to core18 when snapd snap is unchanged
• LP: #2112551 Make removal of last active revision of a snap equal to snap remove
• LP: #2114779 Allow non-gpt in fallback mode to support RPi
• Switch from using systemd LogNamespace to manually controlled journal quotas
• Change snap command trace logging to only log the command names
• Grant desktop-launch access to /v2/snaps
• Update code for creating the snap journal stream
• Switch from using core to snapd snap for snap debug connectivity
• Fix offline remodel case where we switched to a channel without an actual refresh
• LP: #2112544 Fix snap debug connectivity check for RISC-V
• LP: #2112332 Exclude snap/snapd/preseeding when generating preseed tarball
• LP: #1952500 Fix snap command progress reporting
• LP: #1849346 Interfaces: kerberos-tickets | add new interface
• Interfaces: u2f | add support for Thetis Pro
• Interfaces: u2f | add OneSpan device and fix older device
• Interfaces: pipewire, audio-playback | support pipewire as system daemon
• Interfaces: gpg-keys | allow access to GPG agent sockets
• Interfaces: usb-gadget | add new interface
• Interfaces: snap-fde-control, firmware-updater-support | add new interfaces to support FDE
• Interfaces: timezone-control | extend to support timedatectl varlink
• Interfaces: cpu-control | fix rules for accessing IRQ sysfs and procfs directories
• Interfaces: microstack-support | allow SR-IOV attachments
• Interfaces: modify AppArmor template to allow snaps to read their own systemd credentials
• Interfaces: posix-mq | allow stat on /dev/mqueue
• LP: #2098780 Interfaces: log-observe | add capability dac_read_search
• Interfaces: block-devices | allow access to ZFS pools and datasets
• LP: #2033883 Interfaces: block-devices | opt-in access to individual partitions
• Interfaces: accel | add new interface to support accel kernel subsystem
• Interfaces: shutdown | allow client to bind on its side of dbus socket
• Interfaces: modify seccomp template to allow pwritev2
• Interfaces: modify AppArmor template to allow reading /proc/sys/fs/nr_open
• Packaging: drop snap.failure service for openSUSE
• Packaging: add SELinux support for openSUSE
• Packaging: disable optee when using nooptee build tag
• Packaging: add support for static PIE builds in snapd.mk, drop pie.patch from openSUSE
• Packaging: add libcap2-bin runtime dependency for ubuntu-16.04
• Packaging: use snapd.mk for packaging on Fedora
• Packaging: exclude .git directory
• Packaging: fix DPKG_PARSECHANGELOG assignment
• Packaging: fix building on Fedora with dpkg installed

New release 2.70

• FDE: fix reseal with v1 hook key format
• FDE: set role in TPM keys
• AppArmor prompting (experimental): add handling for expired
  requests or listener in the kernel
• AppArmor prompting: log the notification protocol version
  negotiated with the kernel
• AppArmor prompting: implement notification protocol v5 (manually
  disabled for now)
• AppArmor prompting: register listener ID with the kernel and
  resend notifications after snapd restart (requires protocol v5+)
• AppArmor prompting: select interface from metadata tags and set
  request interface accordingly (requires protocol v5+)
• AppArmor prompting: include request PID in prompt
• AppArmor prompting: move the max prompt ID file to a subdirectory
  of the snap run directory
• AppArmor prompting: avoid race between closing/reading socket fd
• Confdb (experimental): make save/load hooks mandatory if affecting
  ephemeral
• Confdb: clear tx state on failed load
• Confdb: modify 'snap sign' formats JSON in assertion bodies (e.g.
  confdb-schema)
• Confdb: add NestedEphemeral to confdb schemas
• Confdb: add early concurrency checks
• Simplify building Arch package
• Enable snapd.apparmor on Fedora
• Build snapd snap with libselinux
• Emit snapd.apparmor warning only when using apparmor backend
• When running snap, on system key mismatch e.g. due to network
  attached HOME, trigger and wait for a security profiles
  regeneration
• Avoid requiring state lock to get user, warnings, or pending
  restarts when handling API requests
• Start/stop ssh.socket for core24+ when enabling/disabling the ssh
  service
• Allow providing a different base when overriding snap
• Modify snap-bootstrap to mount snapd snap directly to /snap
• Modify snap-bootstrap to mount /lib/{modules,firmware} from snap
  as fallback
• Modify core-initrd to use systemctl reboot instead of /sbin/reboot
• Copy the initramfs 'manifest-initramfs.yaml' to initramfs file
  creation directory so it can be copied to the kernel snap
• Build the early initrd from installed ucode packages
• Create drivers tree when remodeling from UC20/22 to UC24
• Load gpio-aggregator module before the helper-service needs it
• Run 'systemctl start' for mount units to ensure they are run also
  when unchanged
• Update godbus version to 'v5 v5.1.0'
• Add support for POST to /v2/system-info with system-key-mismatch
  indication from the client
• Add 'snap sign --update-timestamp' flag to update timestamp before
  signing
• Add vfs support for snap-update-ns to use to simulate and evaluate
  mount sequences
• Add refresh app awareness debug logging
• Add snap-bootstrap scan-disk subcommand to be called from udev
• Add feature to inject proxy store assertions in build image
• Add OP-TEE bindings, enable by default in ARM and ARM64 builds
• Fix systemd dependency options target to go under 'unit' section
• Fix snap-bootstrap reading kernel snap instead of base resulting
  in bad modeenv
• Fix a regression during seeding when using early-config
• LP: #2107443 reset SHELL to /bin/bash in non-classic snaps
• Make Azure kernels reboot upon panic
• Fix snap-confine to not drop capabilities if the original user is
  already root
• Fix data race when stopping services
• Fix task dependency issue by temporarily disable re-refresh on
  prerequisite updates
• Fix compiling against op-tee on armhf
• Fix dbx update when not using FDE
• Fix potential validation set deadlock due to bases waiting on
  snaps
• LP: #2104066 Only cancel notices requests on stop/shutdown
• Interfaces: bool-file | fix gpio glob pattern as required for
  '[XXXX]*' format
• Interfaces: system-packages-doc | allow access to
  /usr/local/share/doc
• Interfaces: ros-snapd-support | added new interface
• Interfaces: udisks2 | allow chown capability
• Interfaces: system-observe | allow reading cpu.max
• Interfaces: serial-port | add ttyMAXX to allowed list
• Interfaces: modified seccomp template to disallow
  'O_NOTIFICATION_PIPE'
• Interfaces: fwupd | add support for modem-manager plugin
• Interfaces: gpio-chardev | make unsupported and remove
  experimental flag to hide this feature until gpio-aggregator is
  available
• Interfaces: hardware-random | fix udev match rule
• Interfaces: timeserver-control | extend to allow timedatectl
  timesync commands
• Interfaces: add symlinks backend
• Interfaces: system key mismatch handling

New release 2.68.5

• LP: #2109843 1 fix missing preseed files when running in a container

New release 2.69

• FDE: re-factor listing of the disks based on run mode model and model to correctly resolve paths
• FDE: run snapd from snap-failure with the correct keyring mode
• Snap components: allow remodeling back to an old snap revision that includes components
• Snap components: fix remodel to a kernel snap that is already installed on the system, but not the current kernel due to a previous remodel.
• Snap components: fix for snapctl inputs that can crash snapd
• Confdb (experimental): load ephemeral data when reading data via snapctl get
• Confdb (experimental): load ephemeral data when reading data via snap get
• Confdb (experimental): rename {plug}-view-changed hook to observe-view-{plug}
• Confdb (experimental): rename confdb assertion to confdb-schema
• Confdb (experimental): change operator grouping in confdb-control assertion
• Confdb (experimental): add confdb-control API
• AppArmor: extend the probed features to include the presence of files, as well as directories
• AppArmor prompting (experimental): simplify the listener
• AppArmor metadata tagging (disabled): probe parser support for tags
• AppArmor metadata tagging (disabled): implement notification protocol v5
• Confidential VMs: sysroot.mount is now dynamically created by snap-bootstrap instead of being a static file in the initramfs
• Confidential VMs: Add new implementation of snap integrity API
• Non-suid snap-confine: first phase to replace snap-confine suid with capabilities to achieve the required permissions
• Initial changes for dynamic security profiles updates
• Provide snap icon fallback for /v2/icons without requiring network access at runtime
• Add eMMC gadget update support
• Support reexec when using /usr/libexec/snapd on the host (Arch Linux, openSUSE)
• Auto detect snap mount dir location on unknown distributions
• Modify snap-confine AppArmor template to allow all glibc HWCAPS subdirectories to prevent launch errors
• LP: #2102456 update secboot to bf2f40ea35c4 and modify snap-bootstrap to remove usage of go templates to reduce size by 4MB
• Fix snap-bootstrap to mount kernel snap from /sysroot/writable/system-data
• LP: #2106121 fix snap-bootstrap busy loop
• Fix encoding of time.Time by using omitzero instead of omitempty (on go 1.24+)
• Fix setting snapd permissions through permctl for openSUSE
• Fix snap struct json tags typo
• Fix snap pack configure hook permissions check incorrect file mode
• Fix gadget snap reinstall to honor existing sizes of partitions
• Fix to update command line when re-executing a snapd tool
• Fix 'snap validate' of specific missing newline and add error on missed case of 'snap validate --refresh' without another action
• Workaround for snapd-confine time_t size differences between architectures
• Disallow pack and install of snapd, base and os with specific configure hooks
• Drop udev build dependency that is no longer required and add missing systemd-dev dependency
• Build snap-bootstrap with nomanagers tag to decrease size by 1MB
• Interfaces: polkit | support custom polkit rules
• Interfaces: opengl | LP: #2088456 fix GLX on nvidia when xorg is confined by AppArmor
• Interfaces: log-observe | add missing udev rule
• Interfaces: hostname-control | fix call to hostnamectl in core24
• Interfaces: network-control | allow removing created network namespaces
• Interfaces: scsi-generic | re-enable base declaration for scsi-generic plug
• Interfaces: u2f | add support for Arculus AuthentiKey

New release 2.68.4

• Snap components: LP: #2104933 workaround for classic 24.04/24.10 models that incorrectly specify core22 instead of core24
• Update build dependencies

New release 2.68.3

• FDE: LP: #2101834 snapd 2.68+ and snap-bootstrap <2.68 fallback to old keyring path
• Fix Plucky snapd deb build issue related to /var/lib/snapd/void permissions
• Fix snapd deb build complaint about ifneq with extra bracket

New release 2.68.2

• FDE: use boot mode for FDE hooks
• FDE: add snap-bootstrap compatibility check to prevent image creation with incompatible snapd and kernel snap
• FDE: add argon2 out-of-process KDF support
• FDE: have separate mutex for the sections writing a fresh modeenv
• FDE: LP: #2099709 update secboot to e07f4ae48e98
• Confdb: support pruning ephemeral data and process alternative types in order
• core-initrd: look at env to mount directly to /sysroot
• core-initrd: prepare for Plucky build and split out 24.10 (Oracular)
• Fix missing primed packages in snapd snap manifest
• Fix snap-confine type specifier type mismatch on armhf
• Interfaces: posix-mq | fix incorrect clobbering of global variable and make interface more precise
• Interfaces: opengl | add more kernel fusion driver files

New release 2.68

• FDE: add support for new and more extensible key format that is unified between TPM and FDE hook
• FDE: add support for adding passphrases during installation
• FDE: update secboot to 30317622bbbc
• Snap components: make kernel components available on firstboot after either initramfs or ephemeral rootfs style install
• Snap components: mount drivers tree from initramfs so kernel modules are available in early boot stages
• Snap components: support remodeling to models that contain components
• Snap components: support offline remodeling to models that contain components
• Snap components: support creating new recovery systems with components
• Snap components: support downloading components with 'snap download' command
• Snap components: support sideloading asserted components
• AppArmor Prompting(experimental): improve version checks and handling of listener notification protocol for communication with kernel AppArmor
• AppArmor Prompting(experimental): make prompt replies idempotent, and have at most one rule for any given path pattern, with potentially mixed outcomes and lifespans
• AppArmor Prompting(experimental): timeout unresolved prompts after a period of client inactivity
• AppArmor Prompting(experimental): return an error if a patch request to the API would result in a rule without any permissions
• AppArmor Prompting(experimental): warn if there is no prompting client present but prompting is enabled, or if a prompting-related error occurs during snapd startup
• AppArmor Prompting(experimental): do not log error when converting empty permissions to AppArmor permissions
• Confdb(experimental): rename registries to confdbs (including API /v2/registries => /v2/confdb)
• Confdb(experimental): support marking confdb schemas as ephemeral
• Confdb(experimental): add confdb-control assertion and feature flag
• Refresh App Awareness(experimental): LP: #2089195 prevent possibility of incorrect notification that snap will quit and update
• Confidential VMs: snap-bootstrap support for loading partition information from a manifest file for cloudimg-rootfs mode
• Confidential VMs: snap-bootstrap support for setting up cloudimg-rootfs as an overlayfs with integrity protection
• dm-verity for essential snaps: add support for snap-integrity assertion
• Interfaces: modify AppArmor template to allow owner read on @{PROC}/@{pid}/fdinfo/*
• Interfaces: LP: #2072987 modify AppArmor template to allow using setpriv to run daemon as non-root user
• Interfaces: add configfiles backend that ensures the state of configuration files in the filesystem
• Interfaces: add ldconfig backend that exposes libraries coming from snaps to either the rootfs or to other snaps
• Interfaces: LP: #1712808 LP: 1865503 disable udev backend when inside a container
• Interfaces: add auditd-support interface that grants audit_control capability and required paths for auditd to function
• Interfaces: add checkbox-support interface that allows unrestricted access to all devices
• Interfaces: fwupd | allow access to dell bios recovery
• Interfaces: fwupd | allow access to shim and fallback shim
• Interfaces: mount-control | add mount option validator to detect mount option conflicts early
• Interfaces: cpu-control | add read access to /sys/kernel/irq/
• Interfaces: locale-control | changed to be implicit on Ubuntu Core Desktop
• Interfaces: microstack-support | support for utilizing of AMD SEV capabilities
• Interfaces: u2f | added missing OneSpan device product IDs
• Interfaces: auditd-support | grant seccomp setpriority
• Interfaces: opengl interface | enable parsing of nvidia driver information files
• Interfaces: LP: #2095009 mount-control interface | add CIFS support
• Allow mksquashfs 'xattrs' when packing snap types os, core, base and snapd as part of work to support non-root snap-confine
• Upstream/downstream packaging changes and build updates
• Improve error logs for malformed desktop files to also show which desktop file is at fault
• Provide more precise error message when overriding channels with grade during seed creation
• Expose 'snap prepare-image' validation parameter
• Add snap-seccomp 'dump' command that dumps the filter rules from a compiled profile
• Add fallback release info location /etc/initrd-release
• Added core-initrd to snapd repo and fixed issues with ubuntu-core-initramfs deb builds
• Remove stale robust-mount-namespace-updates experimental feature flag
• Remove snapd-snap experimental feature (rejected) and it's feature flag
• Changed snap-bootstrap to mount base directly on /sysroot
• Mount ubuntu-seed mounted as no-{suid,exec,dev}
• Mapping volumes to disks: add support for volume-assignments in gadget
• Fix silently broken binaries produced by distro patchelf 0.14.3 by using locally build patchelf 0.18
• Fix mismatch between listed refresh candidates and actual refresh due to outdated validation sets
• Fix 'snap get' to produce compact listing for tty
• Fix missing store-url by keeping it as part of auxiliary store info
• Fix snap-confine attempting to retrieve device cgroup setup inside container where it is not available
• Fix 'snap set' and 'snap get' panic on empty strings with early error checking
• Fix logger debug entries to show correct caller and file information
• Fix issue preventing hybrid systems from being seeded on first boot
• LP: #1966203 remove auto-import udev rules not required by deb package to avoid unwanted syslog errors
• LP: #1886414 fix progress reporting when stdout is on a tty, but stdin is not