Fast-Follow Fixes

This is mostly for a collection of security fixes that was validated and examined by the new Omarchy Security team. If you ever find security issues with Omarchy, please follow the responsible disclosure procedure on omarchy.org/security 🙏

You can upgrade existing machines with Update > Omarchy.

Install on new machines with the ISO:

• Download: https://iso.omarchy.org/omarchy-4.0.1.iso
• SHA256: 69cbb4e10d98ad831c3c9f245b5757a9d1fedfd0c9592780e977d6f950dea8c3

Security

• Launch claude and codex agents with auto-review instead of full bypass by @dhh in #7001
• Stop a video title from becoming the Download Video play command by @acrogenesis in #7847
• Stop an installed theme from running code by @omarchybot in #7884
• Stop the FIDO2 setup staging its authfile at a predictable /tmp path by @mdisec in #7904
• Run notification click actions as safe argv by @ryanrhughes in #7926
• Remove the sudo lockout reset command by @omarchybot in #8046
• Don't put the user in the docker group; make it opt-in by @omarchybot in #8056
• Guard plugin-add against git transport-helper URLs by @bastidotnet in #8067
• Stop USB device names from being executed as Hyprland Lua by @acrogenesis in #8129
• Pin trusted PATH in privileged DNS helper by @mdisec in #8172
• Refuse the git transports Omarchy does not clone from by @omarchybot in #8174

Fixes

• Fix Windows VM launch never opening an RDP window by @DataDave-Dev in #6893
• Fix o.shell_succeeds() always returning false inside Hyprland by @dhh in #6939
• Repair foot.ini configs holding a literal \n[text-bindings] line by @dhh in #6938
• Keep mise wrappers from writing to stdout by @dhh in #6940
• Stop the bar sticking in move mode after a press-and-hold on a widget by @dhh in #6943
• Fix Clone Plugin failing with "unknown clone option" by @dhh in #6942
• Keep the calendar's day names in English by @dhh in #6988
• Format the whole speed test dial for the locale by @dhh in #6994
• Fix passwordless OWE Wi-Fi handling by @dhh in #7238
• Decode UTF-16 text in clipboard history by @dhh in #7249
• Decode mixed UTF-16 clipboard text by @dhh in #7466
• Show a theme's webp background instead of a blank desktop and lock screen by @omarchybot in #7477
• Switch DNS providers without a password prompt by @omarchybot in #7472
• Fall back to polkit when the DNS sudoers grant is missing by @dhh in #7492
• Leave an auto-scaled internal panel alone in clamshell recovery by @fuchsblau in #7581
• Only offer Update > Extra Themes when there is one by @omarchybot in #7775
• Stop a psmouse quirk from failing every install by @omarchybot in #7236
• Wait for the keypress ourselves instead of asking gum to by @dhh in #8082
• Offer to reboot when toggling sudoless Docker; show only the relevant menu entry by @omarchybot in #8098
• Let a received Taildrop file wait to be answered by @omarchybot in #7953

New Contributors

• @fuchsblau made their first contribution in #7581
• @bastidotnet made their first contribution in #8067
• @mdisec made their first contribution in #8172

Full Changelog: v4.0.0...v4.0.1