Release history#

One version number covers the whole product: the agent, the web UI, the installer, the packaging and the OS image are built and released together from one tag. Sixteen versions have been tagged, from 0.3.0 on 2026-09-01 to 0.6.2 on 2026-09-03. Each release publishes its own changelog section as its notes. This page is the index to those, plus where a release lands and how to check what you downloaded.

Where a release lives#

What	Where
A tag's files	`/v<version>/` on the download host
The newest stable release	`/latest/`, a symlink that only ever moves forward — a pre-release tag does not move it, and re-running the pipeline for an older tag does not hand customers last month's image
Checksums	`SHA256SUMS`, one file covering every artefact published for that tag
Signature	`SHA256SUMS.asc`, when a release key is configured
The channel index	`stable.json`, or `beta.json` for a pre-release tag

Both release jobs — the one that builds the packages and the one that builds the image — publish through the same step, and it rescans the whole tag directory, so whichever finishes last leaves a complete set rather than two half-indexes.

The channel index#

A small JSON document, rewritten on every publish, naming the newest version in that channel and everything published for it:

Field	What it holds
`channel`	`stable` for a plain `vX.Y.Z` tag, `beta` for a tag with a pre-release suffix
`version`, `tag`, `released`	The version, its tag, and the publish time in UTC
`base`	The directory URL every artefact hangs off
`notes`	The changelog file published beside the artefacts, when there is one
`checksums`, `signature`, `signed`	`SHA256SUMS`, its detached signature, and whether one was actually written
`artifacts`	Every published file with its `kind` (`iso`, `deb`, `sources`, `patch`, `notes`), its architecture, its size and its SHA-256

The agent reads that index. Forty-five seconds after it starts and every 24 hours after that, it fetches the channel index for the channel it is set to and the System page says whether a newer version exists — with that release's notes, checked against the SHA256SUMS published beside them first. Reading the index sends nothing about the router; fetching a newer release's checksums and notes sends the licence key, which the download host requires. It installs nothing, and turning off Check daily on the System page stops it making any request at all — Privacy. The index is still a plain static file, so a person or a script can watch it in exactly the same way.

Every tagged version#

Each line is the shape of a release, not its full contents. That version's own notes are published beside its files.

Version	Date	What it was
0.6.2	2026-09-03	First boot never wrote the agent's API key, so every fresh install of 0.6.0 and 0.6.1 came up with no credential for the router it manages. Also `tools/image-smoke.sh`, which boots a built image in a VM and asserts the six things no unit test can see
0.6.1	2026-09-03	Two defects found by booting the 0.6.0 image and watching it: the console banner deadlocked the boot by waiting on the login prompts it was ordered before, so a serial console never appeared; and the installer's colours went back to something a monochrome terminal can render
0.6.0	2026-09-03	Wheelhouse becomes its own operating system, and gets a public face. Its own `/etc/os-release`, default configuration and login banner; the corresponding-source record on the box; a pinned `vyos-build` with the GPL build-tooling patch published beside each image; the two public websites; redaction below the admin role; the audit log's move into its own file; a default-deny firewall for both address families whenever there is a WAN; System → About; and a dependency scan in CI
0.5.1	2026-09-02	Migration corners: the importer refuses to guess a LAN, `--check-against` compares words rather than text, and the seed finder stops handing back two paths
0.5.0	2026-09-02	Install without a keyboard, and arrive from OPNsense with your configuration. The seed-driven unattended install, `opnsense-import.py` shipped in the package, and `wheelhouse-seed.py` to build the medium
0.4.5	2026-09-02	Password length limits removed everywhere, the installer asks for the WAN and the LAN together, and an upgrade restarts the agent instead of running the old binary until the next reboot
0.4.4	2026-09-02	The console banner no longer restarts the console it is running on. On a live boot that console is the installer
0.4.3	2026-09-02	Every API call forks a shell on the router, so the agent budgets them: one counters read per sample for all interfaces, and no timed op-mode priming. Idle load fell from a load average of 15 to about a dozen calls a minute
0.4.2	2026-09-02	The installer becomes the `tty1` getty through a systemd generator instead of competing with it, and `dialog`'s screens are no longer drawn into the journal
0.4.1	2026-09-02	Boot like an appliance: `wheelhouse-install`, the console banner on `/etc/issue`, the first-boot password file, and an ISO workflow that publishes each tag to the public download host
0.4.0	2026-09-02	The rest of the router. Multi-WAN, IPsec and OpenVPN pages, reboot, power and boot images, DHCP relay, router advertisements and DHCPv6, mDNS, LLDP and ARP, SNMP, remote syslog, flow export, tunnels, VRRP, ACME, dynamic DNS — and one place for high availability. The 1:1 NAT editor was switched off here, with the reason on the page
0.3.4	2026-09-01	First boot enables the router's REST API, and the agent reports a non-2xx from it as a 502 naming the node to set
0.3.3	2026-09-01	First boot and the agent wait for VyOS to finish loading its configuration, rather than starting in the window where `/config` is not yet mounted
0.3.2	2026-09-01	First boot survives a failing command instead of leaving the image with no API key and an agent restarting forever. Upstream also renamed the rolling branch
0.3.1	2026-09-01	The OS image is built in CI and attached to the release: the `vyos-build` flavor, the build script, and a corresponding-source record
0.3.0	2026-09-01	The first tagged release — everything built before the project started tagging: the agent, the web UI, the app store, desired state, fleet, licensing, single sign-on and the packaging, with real accounts, roles, sessions, API tokens and an attributed audit log

In the tree, not yet tagged#

Work sitting above 0.6.2 under Unreleased, which is not in any release yet:

The unattended install works again — the fix above, with a test that runs the shipped wrapper under VyOS' own aliases, and tools/install-smoke.sh, which installs a machine from a built image and asserts that the one that comes back is the one the seed asked for.
A support bundle: wheelhouse-agent support-bundle, wheelhouse-support at the console, and a Support page in the web UI — Support.
A tamper-evident audit log, and a copy that can leave the box: a sequence number and a hash chain on every entry, GET /api/audit/verify, GET /api/audit/export, and a syslog collector configured in the agent's settings.
Two-factor recovery: ten single-use codes at enrolment, an administrator reset from Admin → Users, and wheelhouse-rescue totp at the console.
Rescue mode: Rescue an installed Wheelhouse system in both of the medium's bootloaders, landing on wheelhouse-rescue.
An update notification and an OpenAPI document: the router reads the release channel and says when a newer version exists, and GET /api/openapi.json describes every route from the agent's own route table.
The Companions page works on every router. It asked the base about a service upnp node the base does not have, and turned that answer into a 502 for the whole page.

If you script against a router: GET /health reports the agent's version, and it is the only version answer available before a login. Support has the authenticated ways to ask the same question.

Release notes per version#

This wiki does not publish a page per version. Each release carries its own changelog section as its notes, and the channel index links the notes file published beside the artefacts.

Upgrading#

The upgrade path is VyOS' own image mechanism: add system image, with the previous image still bootable. The procedure is in Upgrade the image.

What survives an upgrade is /config, which is where the agent keeps everything it remembers: accounts, the audit log, the API key, the certificate and the licence — Privacy.