chore: release v0.0.25 (#434)

Co-authored-by: edera-cultivation[bot] <165992271+edera-cultivation[bot]@users.noreply.github.com>

.github/workflows/release-plz.yml

@@ -16,17 +16,22 @@ jobs:
     permissions:
       pull-requests: write
       contents: write
+      id-token: write
     steps:
     - name: harden runner
       uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
       with:
         egress-policy: audit
     - name: generate cultivator token
-      uses: actions/create-github-app-token@21cfef2b496dd8ef5b904c159339626a10ad380e # v1.11.6
+      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
       id: generate-token
       with:
         app-id: "${{ secrets.EDERA_CULTIVATION_APP_ID }}"
         private-key: "${{ secrets.EDERA_CULTIVATION_APP_PRIVATE_KEY }}"
+        # Scope to what release-plz needs: push the release branch and create
+        # tags/releases (contents), open/update the release PR (pull-requests).
+        permission-contents: write
+        permission-pull-requests: write
     - name: checkout repository
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
@@ -40,7 +45,6 @@ jobs:
     - name: install linux dependencies
       run: ./hack/ci/install-linux-deps.sh
     - name: release-plz
-      uses: MarcoIeni/release-plz-action@476794ede164c5137bfc3a1dc6ed3675275690f9 # v0.5.99
+      uses: release-plz/action@f36720ba01927d9927fba665fcdf802e12bc264b # v0.5.147
       env:
         GITHUB_TOKEN: "${{ steps.generate-token.outputs.token }}"
-        CARGO_REGISTRY_TOKEN: "${{ secrets.KRATA_RELEASE_CARGO_TOKEN }}"

CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.0.25](https://github.com/edera-dev/krata/compare/v0.0.24...v0.0.25) - 2026-10-27
+
+### Other
+
+- update Cargo.toml dependencies
+
 ## [0.0.24](https://github.com/edera-dev/krata/compare/v0.0.23...v0.0.24) - 2024-12-14
 
 ### Added

Cargo.lock

@@ -259,7 +259,7 @@ checksum = "7943c866cc5cd64cbc25b2e01621d07fa8eb2a1a23160ee81ce38704e97b8ecf"
 
 [[package]]
 name = "krata-xencall"
-version = "0.0.24"
+version = "0.0.25"
 dependencies = [
  "env_logger",
  "libc",
@@ -271,7 +271,7 @@ dependencies = [
 
 [[package]]
 name = "krata-xenclient"
-version = "0.0.24"
+version = "0.0.25"
 dependencies = [
  "async-trait",
  "bit-vec",
@@ -289,7 +289,7 @@ dependencies = [
 
 [[package]]
 name = "krata-xenevtchn"
-version = "0.0.24"
+version = "0.0.25"
 dependencies = [
  "byteorder",
  "libc",
@@ -301,7 +301,7 @@ dependencies = [
 
 [[package]]
 name = "krata-xengnt"
-version = "0.0.24"
+version = "0.0.25"
 dependencies = [
  "libc",
  "nix",
@@ -310,7 +310,7 @@ dependencies = [
 
 [[package]]
 name = "krata-xenplatform"
-version = "0.0.24"
+version = "0.0.25"
 dependencies = [
  "async-trait",
  "elf",
@@ -330,7 +330,7 @@ dependencies = [
 
 [[package]]
 name = "krata-xenstore"
-version = "0.0.24"
+version = "0.0.25"
 dependencies = [
  "byteorder",
  "env_logger",

Cargo.toml

@@ -10,7 +10,7 @@ members = [
 resolver = "2"
 
 [workspace.package]
-version = "0.0.24"
+version = "0.0.25"
 homepage = "https://krata.dev"
 license = "GPL-2.0-or-later"
 repository = "https://github.com/edera-dev/krata"

crates/xen/xenclient/Cargo.toml

@@ -13,9 +13,9 @@ async-trait = { workspace = true }
 bit-vec = { workspace = true }
 indexmap = { workspace = true }
 log = { workspace = true }
-krata-xencall = { path = "../xencall", version = "^0.0.24" }
+krata-xencall = { path = "../xencall", version = "^0.0.25" }
-krata-xenplatform = { path = "../xenplatform", version = "^0.0.24" }
+krata-xenplatform = { path = "../xenplatform", version = "^0.0.25" }
-krata-xenstore = { path = "../xenstore", version = "^0.0.24" }
+krata-xenstore = { path = "../xenstore", version = "^0.0.25" }
 regex = { workspace = true }
 thiserror = { workspace = true }
 tokio = { workspace = true }

crates/xen/xenplatform/Cargo.toml

@@ -14,7 +14,7 @@ elf = { workspace = true }
 flate2 = { workspace = true }
 libc = { workspace = true }
 log = { workspace = true }
-krata-xencall = { path = "../xencall", version = "^0.0.24" }
+krata-xencall = { path = "../xencall", version = "^0.0.25" }
 memchr = { workspace = true }
 nix = { workspace = true }
 regex = { workspace = true }

technical-overview.md

@@ -10,24 +10,26 @@ And because Edera doesn’t rely on nested virtualization, it runs wherever cont
 
 ## How Edera Works
 
-At its core, Edera uses a custom hypervisor based on Xen, with key components rewritten in Rust for safety, performance, and maintainability. Edera introduces the concept of **zones**—independent, fast-booting virtual machines that serve as security boundaries for container workloads.
+At its core, Edera uses a [custom hypervisor](https://edera.dev/stories/rust-or-bust-our-rewrite-of-the-xen-control-plane) based on [Xen](https://edera.dev/stories/why-edera-built-on-xen-a-secure-container-foundation), with key components rewritten in Rust for safety, performance, and maintainability. Edera introduces the concept of **zones**—independent, fast-booting virtual machines that serve as security boundaries for container workloads.
 
 Each zone runs its own Linux kernel and minimal init system. The kernel and other system components are delivered via OCI images, keeping things composable, cacheable, and consistent.
 
-Zones are paravirtualized using the Xen PV protocol. This keeps them lightweight and fast—no hardware virtualization required. But when hardware support is available (e.g., on x86 with VT-x), Edera uses it to get near bare-metal performance.
+Zones are [paravirtualized](https://docs.edera.dev/concepts/paravirtualization/) using the Xen PV protocol. This keeps them lightweight and fast—no hardware virtualization required. But when hardware support is available (e.g., on x86 with VT-x), Edera uses it to get near bare-metal performance.
 
 ## How Edera Runs & Secures Containers
 
 Edera allows you to compose your infrastructure the same way you compose workloads: using OCI images.
 
 Each zone consumes a small number of OCI images:
+
 - A **kernel image** that provides the zone kernel.
 - One or more **system extension images** that provide init systems, utilities, and kernel modules.
 - Optionally, **driver zones**—zones that provide shared services (like networking) to other zones.
 
-Inside each zone, container workloads run via a minimal OCI runtime called **Styrolite**, written in Rust. Unlike traditional setups (like Kata Containers, which layer containerd and runc as external processes), Styrolite is embedded inside the zone itself.
+Inside each zone, container workloads run via a minimal OCI runtime called [**Styrolite**]((https://github.com/edera-dev/styrolite/)), written in Rust. Unlike traditional setups (like Kata Containers, which layer containerd and runc as external processes), Styrolite is embedded inside the zone itself.
 
 ### Key Benefits of This Design
+
 - No external container runtime processes  
 - Zone init system directly manages containers  
 - Minimal attack surface, optimized for secure execution
@@ -68,19 +70,26 @@ This causes the pod to be scheduled to a node running Edera’s hypervisor. The
 An Edera zone is a minimal VM built from OCI-delivered components. At launch time, the Edera daemon unpacks:
 
 ### Kernel Image
+
 Located under `/kernel` in the OCI image:
+
 - `image`: the Linux kernel (vmlinuz)
 - `metadata`: key-value pairs for boot parameters
 - `addons.squashfs`: includes kernel modules in `/modules`
 - `config.gz`: the kernel configuration file
 
 ### Initramfs Contents
+
 Packaged in a CPIO archive, typically mounted from:
 `usr/lib/edera/protect/zone/initrd`
 
 The initramfs includes:
+
 - `/init`: static Rust binary that initializes the zone
 - `/bin/styrolite`: embedded container runtime
 - `/bin/zone`: control plane for managing containers and services via IDM (inter-domain messaging)
 
 This structure lets Edera launch zones rapidly, with well-defined boundaries and no dependency on the host OS kernel. Everything the workload touches is defined, versioned, and validated.
+
+---
+If you want to know more check out our [docs site](https://docs.edera.dev)