Ofelia v0.28.0 was published on July 27, 2026. The release replaces the frozen Docker client module with the maintained moby/moby SDK, removing all four outstanding govulncheck findings while setting Docker Engine 19.03 and API v1.40 as the minimum.
The full release notes and downloads are on the GitHub release page.
Maintained SDK closes the dependency gap ¶
Ofelia previously imported github.com/docker/docker v28.5.2+incompatible, an old path that no longer receives releases. That left four Moby advisories visible to dependency scanning with no fixed version available on the old import path. Two concern races in docker cp, one concerns an AuthZ plugin bypass, and one concerns a plugin privilege boundary error.
The release moves the client and API imports to github.com/moby/moby/client and github.com/moby/moby/api. The release notes say the affected code was reachable only through init() chains and was not exploitable in the way Ofelia is deployed. Even so, remaining on an abandoned module would leave scanners noisy and future fixes unavailable. After the migration, govulncheck reports zero findings instead of four.
Docker API negotiation now has a floor ¶
The new client requires Docker Engine 19.03 or later, with API v1.40 or later. It refuses to negotiate below that floor. The previous client accepted whatever API version the daemon reported, even though several Ofelia features already needed API v1.42 in practice.
Version configuration also fails earlier. Values from DOCKER_API_VERSION and [docker] version are checked while the client is built, so a malformed value now stops startup with invalid API version (...) instead of becoming a request failure later. A leading v, as in v1.44, is accepted. This makes a bad pin visible before scheduled jobs begin running.
The migration was checked for behavior drift ¶
Changing the SDK required every Docker client call to be rewritten. The project reviewed those calls for changes that could compile and pass tests while behaving differently at run time. That review found and corrected two cases before the release.
The fixes preserve console dimensions for job-exec jobs that set console-height or console-width. They also preserve behavior when the daemon API version is pinned. Network listing has one deliberate type level change: Network.Containers is no longer populated by a list request because the Docker list endpoint does not return those endpoints. Inspecting one network still returns them, and no Ofelia feature reads that field from list results.
Release artifacts include verification data ¶
Release assets include Sigstore bundles for individual files and the checksum manifest. Operators can use cosign verify-blob for those files. Build provenance is available through gh attestation verify, but the command needs --signer-workflow because a reusable workflow signs the release rather than a workflow in the Ofelia repository.
The container image is published as ghcr.io/netresearch/ofelia:0.28.0, with 0.28 and 0 aliases also listed in the notes. The image supports both cosign verify and GitHub attestation verification using the documented reusable workflow identity.
Upgrade notes ¶
No configuration migration is required. Check the Docker daemon before deploying: systems older than Engine 19.03 cannot run this version and should remain on v0.27.1 until the daemon is upgraded. Environments that pin DOCKER_API_VERSION should also treat startup validation as part of the rollout check, since invalid values now stop the process immediately.