# LXD 5.21.6 release notes This is a [LTS release](https://canonical.com/lxd/docs/default/reference/releases-snap/index.html.md#ref-releases-lts) and is recommended for production use. This is a maintenance release for the 5.21 LTS series. It includes security hardening, cluster connectivity improvements, updated build requirements, and bug fixes backported from the main development branch. ## Highlights This section highlights new and improved features in this release. ### Internal cluster connections bypass configured HTTP proxies Internal cluster traffic now bypasses configured HTTP proxies for certificate retrieval, cluster join, and image replication between members. This avoids proxy interference for member-to-member operations and improves cluster reliability in proxied environments. - Documentation: [Clustering](https://canonical.com/lxd/docs/default/clustering/index.html.md#clustering) ### Expanded ACME integration test coverage A new lightweight ACME test server (`mini-acme`) has been added to the integration test suite, and new standalone and clustering ACME test scenarios are now covered. - Documentation: [Remote API authentication](https://canonical.com/lxd/docs/default/authentication/index.html.md#authentication) ## Bug fixes The following bug fixes are included in this release. - [Arbitrary file read and write via image metadata.yaml symlink (GHSA-j825-cg34-5fr5)](https://github.com/canonical/lxd/security/advisories/GHSA-j825-cg34-5fr5) - [Root command execution via image backup.yaml symlink (GHSA-fv82-v4fj-mm4m)](https://github.com/canonical/lxd/security/advisories/GHSA-fv82-v4fj-mm4m) - [NVIDIA configuration validation bypass for nvidia.driver.capabilities (GHSA-vfh7-q59q-54v2)](https://github.com/canonical/lxd/security/advisories/GHSA-vfh7-q59q-54v2) - [Restricted project bypass for security.idmap.isolated defaults (GHSA-7vp9-3vmp-c5jm)](https://github.com/canonical/lxd/security/advisories/GHSA-7vp9-3vmp-c5jm) - [Project restriction bypass via instance migration config override (GHSA-gcr9-5q6r-w625)](https://github.com/canonical/lxd/security/advisories/GHSA-gcr9-5q6r-w625) - [Cross-project instance copy bypass via config merge timing (GHSA-v989-qw7w-xvg4)](https://github.com/canonical/lxd/security/advisories/GHSA-v989-qw7w-xvg4) - [Storage volume cross-project move and restore bypass project disk limits (GHSA-5h78-p252-989h)](https://github.com/canonical/lxd/security/advisories/GHSA-5h78-p252-989h) - [Cross-project cluster migration bypasses project restrictions (GHSA-v9wr-9r7q-fh4g)](https://github.com/canonical/lxd/security/advisories/GHSA-v9wr-9r7q-fh4g) - [Cross-project instance move bypasses project restrictions (GHSA-5g5r-wh97-qcq2)](https://github.com/canonical/lxd/security/advisories/GHSA-5g5r-wh97-qcq2) - [Fix listing images with --all-projects and shared fingerprints](https://github.com/canonical/lxd/pull/18668) - [Fix bcache device detection in resources](https://github.com/canonical/lxd/pull/18704) - [Fix nil http.Request handling on updateClusterCertificate](https://github.com/canonical/lxd/pull/18697) - [Fix unprotected concurrent write to operation metadata](https://github.com/canonical/lxd/pull/18717) - [Fix infinite loop in network error log writer](https://github.com/canonical/lxd/pull/18734) - [Fix case-insensitive detection of .ISO files for disk devices](https://github.com/canonical/lxd/pull/18736) - [Fix booting Windows VMs in BIOS mode by disabling hv_passthrough](https://github.com/canonical/lxd/pull/18740) - [Fix ceph cluster_name handling for QEMU disks](https://github.com/canonical/lxd/pull/18760) ## Backwards-incompatible changes These changes are not compatible with older versions of LXD or its clients. ### Minimum system requirement changes The minimum supported version of some components has changed: - The minimum required version of Go to build LXD is now 1.26.5 (see [Updated minimum Go version]()). ## Updated minimum Go version If you are building LXD from source instead of using a package manager, the minimum version of Go required to build LXD is now 1.26.5 (previously 1.26.4). ## Snap packaging changes - EDK2/OVMF was bumped to `2024.02-2ubuntu0.9` (MS 2023 keys). - Snap wrappers now detect the AppArmor user namespace restriction. - QEMU snap build logic now fails early on `amd64` when `/dev/kvm` is unavailable. ## Change log View the [complete list of all changes in this release](https://github.com/canonical/lxd/compare/lxd-5.21.5...lxd-5.21.6). ## Downloads The source tarballs and binary clients can be found on our [download page](https://github.com/canonical/lxd/releases/tag/lxd-5.21.6). Binary packages are also available for: - **Linux:** `snap install lxd --channel=5.21/stable` - **MacOS client:** `brew install lxc` - **Windows client:** `choco install lxc`