This is an additional set of security fixes that were validated and examined by the Omarchy Security team. If you ever find security issues with Omarchy, please follow the responsible disclosure procedure on omarchy.org/security. 🙏

You can upgrade existing machines with Update > Omarchy.

Install on new machines with the ISO:

• Download: https://iso.omarchy.org/omarchy-4.0.2.iso
• SHA256: 2ef8e624aa1bec7e277e28056b8535a6c9373ba48d7ede3f1a01cb6d2373cfb8

Improvements

• Repair legacy paths and privileged files from retired installers by @acrogenesis
• Skip Chromium's new first-run EULA by @hjanuschka
• Improve Apple display brightness detection reliability by @bastidotnet
• Point the RC channel to the dedicated release candidate repository by @ryanrhughes
• Prevent the desktop bar visibility toggle from becoming unresponsive by @ryanrhughes
• Improve automated test suite reliability by @ryanrhughes, @Skeptomenos

Fixes

• Fix shell injection in theme and application installers by @mdisec, @Adolanium
• Fix Codex usage collection on version 0.149 by @orienw
• Fix migration failures on Bash 5.3 by @ryanrhughes
• Fix SSH hardening verification failing on OpenSSH 10.x by @ryanrhughes
• Prevent web app installers from creating nested directories via the app name by @Chessing234

Security

• Require signed packages from the Omarchy repository by @ryanrhughes
• Harden CUPS printer discovery and administration by @mdisec
• Secure Plymouth and SDDM asset publication by @AFOliveira, @ErikMelton, @itz4blitz
• Secure Windows VM host mounts in Codex by @AFOliveira
• Prevent remote image injection in shell text elements by @ErikMelton
• Harden browser policy directory permissions by @acrogenesis
• Restrict sudoers rule for timezone updates by @omarchybot
• Validate web app URLs and escape desktop entry values by @bastidotnet, @Chessing234
• Harden existing SSH installations and disable password authentication by default by @acrogenesis, @ryanrhughes
• Close unprivileged input and SSH escalation paths by @acrogenesis, @fuchsblau, @ryanrhughes

Deprecations

• Temporarily remove automatic printer discovery by @omarchybot