Juju 4.0.12

🗓️ 28 Jun 2026

This is a bug fix release for Juju 4.0, covering changes from 4.0.11 to 4.0.12.

🎯 Highlights

• Migration and upgrade paths are more predictable: fixes cover migration precheck authentication, external controller data, missing subnets, storage directives, ModelUpgrader compatibility, and upgrade-controller workflows.

• Secret handling is more consistent under hooks: secret create, update, delete, grant, revoke, and track-latest operations are now handled more atomically with hook commits.

• Kubernetes, LXD, MAAS, and resource lifecycle behavior improves: fixes restore Kubernetes status and constraints, LXD space-aware container NICs, MAAS VM provisioning, OCI registry handling, and network-get output.

• Controller and agent stability is tighter: fixes address Dqlite client closure, reboot handling, deployer startup ordering, log forwarding during upgrades, transaction retry behavior, and dependency vulnerabilities.

Full list of changes: https://github.com/juju/juju/compare/v4.0.11…v4.0.12

🛠️ Fixes

🔒 Security, access, and authentication

This release tightens authentication and credential validation paths, improves SSH support in the snap, and updates dependencies to resolve known vulnerabilities.

• chore: update deps for vuln GO-2026-5224

• fix(deps): bump Go 1.26.4 to resolve govulncheck failures

• fix(deps): eliminate github.com/juju/utils/v3 indirect dependency (GO-2025-3798)

• fix(credential): validate auth type against cloud on CheckCredentialModels

• fix: add model tag to JWT AuthInfo

• fix: token transport for bearer token auth had a typo

• fix(apiclient proxy): fix apiclient http transport proxy

• fix(snap): add FIDO/U2F security key support for juju ssh

🔁 Migration, upgrade, and CMR correctness

Migration and upgrade fixes make the 4.0 transition path safer. Juju now handles target authentication, unsupported same-version migrations, missing network data, external controller addresses, storage directives, and upgrade facade compatibility more explicitly.

• feat(migration): exchange admin password for macaroon during prechecks

• feat: prevent 4.0 -> 4.0 migrations

• feat: migration export/import ddl

• feat(migration): add serialized model v2 export contract

• feat(modelmigration): add controller export helpers

• feat(modelmigration): wire SourceControllerInfo through domain service

• refactor: wire the migration master worker with the modelmigration domain

• feat(modelmigration): implement source-side domain service and state

• feat(modelmigration): implement model migration domain watchers

• feat: re-enable migrate check

• fix: 3.6 → 4.0 migration fails due to missing subnet (JUJU-9647)

• fix(migration): import application storage directives

• fix: ensure external controller addresses are always migrated

• feat: compatibility shim for ModelUpgrader facade

• fix: upgrade-controller with –build-agent

• fix: when upgrading, allow for the controller app to be missing

• feat: consistently show offer connections

• fix(cmr): offerer relations watcher initial query

• fix(relation): return remote-app units in ApplicationRelationsInfo for non-peer relations

🔐 Secrets and transaction consistency

Secret operations triggered by hooks are now better aligned with the CommitHookChanges transaction. The fixes reduce partial-update states for secret deletion, grant, revoke, tracking, update, and backend reference handling.

• feat(uniter): move secret deletions into CommitHookChanges transaction

• JUJU-9033: Move secret grant/revoke into CommitHookChanges txn

• feat(uniter): move track-latest-secret into CommitHookChanges transaction

• feat: move secret updates into CommitHookChanges transaction

• fix: correct JOIN condition in secret content deletion queries

• fix(unitstate): prevent panic when charm state is empty at commit time

• feat: limit size of charm config and relation settings

• fix: transaction retry issues

🗃️ Kubernetes, LXD, MAAS, networking, and resources

Provider and resource fixes improve day-2 behavior for Kubernetes applications, LXD containers, MAAS-provisioned VMs, OCI-backed charm resources, and hook-tool network output.

• fix(status): restore k8s application address in status

• fix: change how k8s unit churn is detected to avoid incorrect status

• fix: properly handle legacy k8s modeloperator labels

• fix: preserve app constraints without model defaults

• fix: network-get returning empty placeholder device

• fix(lxd): resolve container NIC bridges from ProviderNetworkId so space subnets are attached again

• perf(add-model): add-model in lxd

• feat(maas): support explicit VM provisioning via virtual-machine virt-type

• fix: do not drop root disk constraints when custom networking

• fix: handle slow upload of k8s oci image metadata

• fix: include trailing / in oci repo paths when needed

🧱 Controller, API, worker, and observability stability

Controller and agent paths handle more edge cases without leaking clients, restarting unnecessarily, blocking upgrades, or losing operational visibility. The fixes also improve metrics, status history, schema performance, and workflow reliability.

• fix: ensure Dqlite clients are closed

• fix(deployer): gate deployer on controlleragentconfig socket readiness

• fix: use errors.Is to detect reboot/shutdown sentinels in machine agent

• fix: guard against cloud init overwriting agent.conf on reboot

• feat: handle logsink 503 failure

• feat: include workload version in history logging

• feat: httpclient metrics

• fix: db repl

• fix: wait for workerpool to become idle

• fix(externalcontrollerupdater): close watcher client on shutdown race

• feat: add missing indexes and PKs

• fix(unmanaged): implement Schema() to satisfy ModelConfigProvider interface

📘 Summary

4.0.12 is a broad reliability patch release. It strengthens migration and upgrade behavior, makes hook-driven secret changes more atomic, improves Kubernetes, LXD, MAAS, networking, and resource workflows, and hardens controller, worker, authentication, and dependency paths found after 4.0.11.