Release ghaf-25.09.1

This Ghaf release is for x86 platform only and it has been fully tested with Lenovo X1 Carbon Gen11

Release Tag

https://github.com/tiiuae/ghaf/releases/tag/ghaf-25.09.1

Supported Hardware

The following target hardware is supported by this release:

• Lenovo ThinkPad X1 Carbon Gen 10/11/12/13, Gen9 2-in-1
• Dell Latitude 7230, 7330
• Alienware M18
• System76 Darter Pro

What’s Changed

• version: bump for the next release by @brianmcgillion in https://github.com/tiiuae/ghaf/pull/1328
• hardware: Add the System76 Darter Pro by @vunnyso in https://github.com/tiiuae/ghaf/pull/1327
• gha: Add the new system76 target by @brianmcgillion in https://github.com/tiiuae/ghaf/pull/1329
• Fix brightness for System76 and script update by @vunnyso in https://github.com/tiiuae/ghaf/pull/1330
• Lock user account after repeated failed login attempts by @gngram in https://github.com/tiiuae/ghaf/pull/1324
• New features and bug fixes for login user by @gngram in https://github.com/tiiuae/ghaf/pull/1320
• docs: add ghaf-25.08 release note by @clayhill66 in https://github.com/tiiuae/ghaf/pull/1333
• Bump givc, enable xpadneo & Add BT device by @vunnyso in https://github.com/tiiuae/ghaf/pull/1334
• build(deps): bump astral-sh/setup-uv from 6.5.0 to 6.6.0 by @dependabot[bot] in https://github.com/tiiuae/ghaf/pull/1336
• build(deps): bump github/codeql-action from 3.29.10 to 3.29.11 by @dependabot[bot] in https://github.com/tiiuae/ghaf/pull/1337
• Firewall blacklisting mechanism & testing by @enesoztrk in https://github.com/tiiuae/ghaf/pull/1312
• bugfix: add temporary watchdog service for high-CPU processes by @kajusnau in https://github.com/tiiuae/ghaf/pull/1335
• build(deps): bump actions/dependency-review-action from 4.7.2 to 4.7.3 by @dependabot[bot] in https://github.com/tiiuae/ghaf/pull/1341
• Keys: add ssh key for Samuli by @leivos-unikie in https://github.com/tiiuae/ghaf/pull/1342
• build(deps): bump cachix/install-nix-action from 31.5.2 to 31.6.0 by @dependabot[bot] in https://github.com/tiiuae/ghaf/pull/1343
• build(deps): bump github/codeql-action from 3.29.11 to 3.30.0 by @dependabot[bot] in https://github.com/tiiuae/ghaf/pull/1346
• build(deps): bump astral-sh/setup-uv from 6.6.0 to 6.6.1 by @dependabot[bot] in https://github.com/tiiuae/ghaf/pull/1347
• ARP protection by @mbssrc in https://github.com/tiiuae/ghaf/pull/1319
• enable graphical boot, bump ghafpkgs, adjust cosmic config by @kajusnau in https://github.com/tiiuae/ghaf/pull/1339
• feat(ghaf-killswitch): Shell application to list, block and unblock by @vunnyso in https://github.com/tiiuae/ghaf/pull/1340
• bump: including the qemu 10.1 on top of unstable by @brianmcgillion in https://github.com/tiiuae/ghaf/pull/1338
• packages: move some packages to ghafpkgs by @brianmcgillion in https://github.com/tiiuae/ghaf/pull/1345
• [StepSecurity] Apply security best practices by @step-security-bot in https://github.com/tiiuae/ghaf/pull/1350
• gala: disable gala from the mvp profile by @brianmcgillion in https://github.com/tiiuae/ghaf/pull/1349
• Add comprehensive GitHub Copilot instructions for Ghaf development by @Copilot in https://github.com/tiiuae/ghaf/pull/1357
• Add GitHub Action to automatically update npmDepsHash for dependabot npm updates by @Copilot in https://github.com/tiiuae/ghaf/pull/1355
• Fix sign off in automated workflow for DCO compliance by @Copilot in https://github.com/tiiuae/ghaf/pull/1362
• Fix workflow triggers after npm dependency hash updates by @Copilot in https://github.com/tiiuae/ghaf/pull/1364
• Add explicit treefmt formatting instruction to copilot-instructions.md by @Copilot in https://github.com/tiiuae/ghaf/pull/1370
• Bump mk2 by @brianmcgillion in https://github.com/tiiuae/ghaf/pull/1351
• Fix workflow_run triggered builds by checking out latest commit with updated npm hash by @Copilot in https://github.com/tiiuae/ghaf/pull/1368
• dependabot: fix the triggering of updated hash by @brianmcgillion in https://github.com/tiiuae/ghaf/pull/1371
• build(deps): bump astro from 5.9.2 to 5.13.5 in /docs by @dependabot[bot] in https://github.com/tiiuae/ghaf/pull/1352
• build(deps): bump starlight-blog from 0.23.2 to 0.24.1 in /docs by @dependabot[bot] in https://github.com/tiiuae/ghaf/pull/1353
• build(deps): bump @astrojs/starlight from 0.34.3 to 0.35.2 in /docs by @dependabot[bot] in https://github.com/tiiuae/ghaf/pull/1358
• build(deps): bump sharp from 0.32.6 to 0.34.3 in /docs by @dependabot[bot] in https://github.com/tiiuae/ghaf/pull/1359
• build(deps): bump starlight-links-validator from 0.16.0 to 0.17.2 in /docs by @dependabot[bot] in https://github.com/tiiuae/ghaf/pull/1360
• docs: bump the npm packages and all the depends by @brianmcgillion in https://github.com/tiiuae/ghaf/pull/1374
• aic: add gala as PWA by @brianmcgillion in https://github.com/tiiuae/ghaf/pull/1377
• audit: add Nix-specific rules by @everton-dematos in https://github.com/tiiuae/ghaf/pull/1344
• build(deps): bump github/codeql-action from 3.30.0 to 3.30.1 by @dependabot[bot] in https://github.com/tiiuae/ghaf/pull/1381
• bump: early september by @brianmcgillion in https://github.com/tiiuae/ghaf/pull/1383
• build(deps): bump cachix/install-nix-action from 31.6.0 to 31.6.1 by @dependabot[bot] in https://github.com/tiiuae/ghaf/pull/1384

Full Changelog: https://github.com/tiiuae/ghaf/compare/ghaf-25.08...ghaf-25.09.1

Bug fixes

Fixed bugs that were present in the ghaf-25.08 release:

• Saved screenshots are no longer lost
• GALA is supported now as PWA

Known Issues and Limitations

Issue	Status	Comments
Element app is not supported in this version of Ghaf	In Progress	Issue is being worked on
Using audio through USB device may cause instability	In Progress	Workaround: Use either internal speaker or headphones with 3.5mm jack
Downloading large file (10G) crashes the browser	In progress	Issue is under investigation
Unlock with fingerprint doesn’t work	In Progress	Issue is under investigation
GUI not launched if booting with Yubikey	In Progress	Issue is under investigation
Audio control not working after suspension	In Progress	Issue is under investigation

Installation Instructions

Released images are available at https://archive.vedenemo.dev/ghaf-25.09.1

Download the required image and use the following instructions: Build and Run.