This release adds 2 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+1 more
Summary
AI summarystartwrt-cli verify now validates the EEPROM password and the inbound-rule dialog no longer steals focus on mobile.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
`startwrt-cli verify` now checks the EEPROM password. `startwrt-cli verify` now checks the EEPROM password. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Medium |
Inbound-rule dialog no longer steals focus on mobile. Inbound-rule dialog no longer steals focus on mobile. Source: llm_adapter@2026-07-15 Confidence: high |
— |
Full changelog
What's Changed
Added
startwrt-cli verifynow checks the EEPROM password. Verifies
EEPROM tag 0x2F satisfies the password constraints (valid TLV,
12 characters from the non-ambiguous charset). On failure it
reports the specific violation (invalid TLV, missing tag, wrong
length and/or bytes outside the charset).
Changed
- The inbound-rule dialog no longer steals focus when it opens, which on
mobile raised the keyboard the instant the dialog appeared.
Image Downloads
StartWRT Checksums
SHA-256
bdf87c7b0e9a724cb86fa8c301e2055702456dc9de79c02cb483df458f1811a0 startwrt-1.0.1-d26002d_spacemit-k1-sdcard.img.gz
3a5cb1cb3ab2c5e552275139da066021d0da92ca84f396835fe7666eb0028b31 startwrt-1.0.1-d26002d_spacemit-k1-sysupgrade.img.gz
BLAKE-3
9e8fc12b20f58153622117eb24f7b7c1897e7a3a80dbd063fb977f7b7d6e2639 startwrt-1.0.1-d26002d_spacemit-k1-sdcard.img.gz
0df49cfa5ee0d5458605863af9cec132468c18d59ddee997062ba100011f3636 startwrt-1.0.1-d26002d_spacemit-k1-sysupgrade.img.gz
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About StartOS
Browser-based, graphical Operating System (OS) that makes running a personal server as easy as running a personal computer.
Related context
Related tools
Earlier breaking changes
- vstart-sdk/v2.0.4 'setupMain' callback now accepts any DaemonBuildable rather than requiring a Daemons.
- vstart-sdk/v2.0.4 `Daemons.dynamic` now takes `effects` and returns a `DaemonReconciler` instead of replacing `main`.
- v0.4.0-beta.9 Previous backups incompatible with v0.4.0; create fresh backup after updating.
Beta — feedback welcome: [email protected]