release: 1.0.0-rc.5

[lee-reinhardt]

What

Cut 1.0.0-rc.5: the [Unreleased] changelog section becomes ## [1.0.0-rc.5] - 2026-09-17, and the crate version moves from 1.0.0-rc.4 to 1.0.0-rc.5 in Cargo.toml and Cargo.lock.

Release notes

The rc.5 section of CHANGELOG.md is the release notes. It covers the nine PRs merged since rc.4, grouped Changed / Fixed / Security. This is a bug-fix release for regressions found in the rc.4 phase:

• Changed: avocado install runs the SDK phase in parallel without --force, with one parallelism rule shared by the install DAG, the build DAG and the SDK phase (install: one parallelism rule for the DAGs and the SDK phase #275).
• Fixed: the bare-config Failed to walk crash in ext build (Fix project-relative path resolution for a bare config filename #274), the compile-script failure for package-sourced extensions (Skip the compile script for a source the host cannot see #271), the --dnf-arg install stamp deletion that made a project unbuildable (ext install: keep the install stamp after a --dnf-arg transaction #272), a stamp path that was not one shell word (ext install: keep the install stamp after a --dnf-arg transaction #272), ext build skipping an extension whose content comes from a post_build hook (ext build: rebuild an extension whose post_build inputs are undeclared #279), the i.MX bootloader deleted by the re-key cleanup glob plus multi-path stone_include_paths (runtime build: re-key into a directory the build owns, not the dnf install root #281), and the build-time kernel cmdline export deleted by a merge, now covered by the runtime build stamp (fix(kernel): restore the build-time kernel cmdline export #277).
• Security: cryptoki 0.12.1 for RUSTSEC-2026-0286 (build(deps): cryptoki 0.12.1 for RUSTSEC-2026-0286 #278), and the extension source symlink guard re-armed on the default config path (Fix project-relative path resolution for a bare config filename #274).

Every bullet that was under [Unreleased] on main is present; the two ### Fixed headings that had accumulated there are merged into one, and entries were added for the PRs that landed without a changelog line (#271, #274, #275, #277, #278). An empty [Unreleased] heading remains for the next cycle.

After merge

Tag the squash commit 1.0.0-rc.5 to run the release workflow. The Bump Homebrew tap formula job will fail as it did for rc.4: homebrew-tap main now requires a pull request, so the formula bump has to be opened by hand from the SHA256SUMS asset (rc.4's is still open as homebrew-tap#1).

Verification

fmt, clippy (-D warnings) and the version guard test pass on this branch; the version guard reads 1.0.0-rc.5. cargo metadata --locked agrees with the lockfile.

Smoke test of this exact commit against the jetson-orin-nano-devkit reference project, 2024/edge feed:

• macOS (studio, through the avocado-vm): avocado clean -f, avocado install -f, avocado build from a fresh volume, all exit 0; rootfs, initramfs, stone validate/create and the OS bundle produced.
• Linux (atlas, native Docker): avocado install -f, avocado build, avocado provision -r dev --profile tegraflash, all exit 0; the flash ran hands-off in under four minutes and the board booted with the built image's AVOCADO_OS_BUILD_ID, all four extensions merged, sshd up.

[Copilot]

🟢 Approval recommended

The changes are limited to a consistent version bump and changelog promotion with no functional code modifications.

Pull request overview

Cuts the 1.0.0-rc.5 release by promoting the changelog’s [Unreleased] notes into a dated release section and aligning the crate version across the Rust manifest and lockfile.

Changes:

• Promoted [Unreleased] entries to ## [1.0.0-rc.5] - 2026-09-17 in CHANGELOG.md (leaving an empty [Unreleased] section for the next cycle).
• Bumped avocado-cli version from 1.0.0-rc.4 to 1.0.0-rc.5 in Cargo.toml.
• Updated the avocado-cli package entry in Cargo.lock to 1.0.0-rc.5.

File summaries

File	Description
CHANGELOG.md	Moves release notes from [Unreleased] into the 1.0.0-rc.5 section with the release date and consolidated headings.
Cargo.toml	Bumps the crate version to 1.0.0-rc.5.
Cargo.lock	Updates the locked avocado-cli package version to 1.0.0-rc.5.

Review details

• Files reviewed: 2/3 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.