Just finished an in-place upgrade to Qubes OS 4.3.0 and overall—this release is fantastic. Everything feels tighter, cleaner, and more refined. Huge props to the Qubes team. One important cleanup caveat from the upgrade process that’s easy to miss. Before running the full dom0 upgrade, I upgraded all my templates first (Fedora 41 → 42, Debian 12 → 13). After everything completed, I went to clean up and delete the old fedora-41-xfce template. Even though all AppVMs and child templates had already been migrated, Qubes refused to let me delete it, saying it was still in use. So I dug in. From dom0, I ran: qvm-ls | grep dvm That’s when I found the issue—default-mgmt-dvm was still using fedora-41-xfce as its template. What’s worth calling out here is that everything looked fine in the GUI. I had already switched templates over, checked Qube Manager, and nothing obvious was flagging Fedora 41 as still being in use. The dependency that was blocking deletion didn’t really surface until I checked it directly from the dom0 command line. I confirmed it with: qvm-prefs default-mgmt-dvm template Sure enough, it was still pointing at Fedora 41—despite everything else being migrated. The fix was straightforward and in dom0: qvm-prefs default-mgmt-dvm template fedora-42-xfce After that, I rebooted (important), then rechecked: qvm-ls | grep dvm qvm-ls | egrep 'fedora-41|debian-12' Everything was clean. At that point, the old Fedora 41 and Debian 12 templates deleted without any issues. Final sanity checks: cat /etc/qubes-release qvm-check --all Fully on Qubes OS 4.3.0, no dangling dependencies, no hidden blockers. Not a bug—just a very Qubes-specific edge case that’s easy to miss if you don’t explicitly inspect DVM template bindings from dom0. Hope this helps someone else avoid a “why the hell won’t this old template delete?” moment. And yeah—dear god, this upgrade is glorious. Absolute banger of a release. On to the Whonix 17 → 18 upgrade now, then she's ready to rock! View quoted note →
@npub1ytx8...ek79 girl surfacing at 4:30 AM for food, snuggles, and morning meditation 💜 image #IKITAO #Moxie #Sphynx #Cat
This 👇🏻 View quoted note →
Qubes OS 4.3.0 has officially landed—and it looks awesome. Big step forward for privacy and security through isolation and compartmentalization. Time to upgrade. Release notes: Main improvements (from the 4.3 release notes): Core upgrades • dom0 upgraded to Fedora 41 • Xen upgraded to 4.19 • Default templates upgraded: Fedora 42, Debian 13, Whonix 18 (with older minimum-supported versions enforced) • Preloaded disposables for faster DisposableVM startup • New Devices API (“self-identity oriented” device assignment) • Qubes Windows Tools (QWT) reintroduced with improved features UI/UX polish • New device workflow built around the new Devices API, plus a dedicated Device Assignments page and a redesigned Devices widget • New/improved flat icons across GUI tools • Qube Manager cleanup (far-left icons removed) • Application icons now show in VM Settings • Option to add the Qubes video companion to the AppMenu • Better AppMenu keyboard navigation • Clearer updater wording/settings • Centralized tray notifications • Quick-launch root terminal or console terminal from the Domains widget • Global Config improvements (deep-link to sections, plus a “Saving changes...” dialog) GUI daemon/agent improvements • Configurable GUI daemon background color (nice for dark themes) • Audio daemon won’t connect to recording streams unless recording is explicitly enabled • Legacy X11 app icons display properly • Virtual pointing device labeled as absolute (not relative) • Better global clipboard notifications, plus configurable clipboard size • Better support for Windows qubes on systems using sys-gui* Hardware support improvements • Better support for Advanced Format (4K sector) drives • Device assignments use full PCI paths instead of bus/slot/function • Filter input devices with udev rules • Fixes for graceful reboot on some buggy (U)EFI firmware • Better Bluetooth + hot-pluggable audio support with dynamic AudioVM switching Security features • Templates can request custom kernel cmdline parameters (currently used for Kicksecure/Whonix user-sysmaint-split) • VMs can specify boot modes intended only for AppVMs or templates • GRUB2 from Fedora shipped with security patches + Bootloader Specification support • SSL client cert + GPG key support for private template repositories • Prevent unsafe third-party template installs via rpm/dnf • Ability to prohibit start of specific qubes • UUID support for qubes, including using UUIDs in policies • “Custom persist” feature to reduce unwanted persistence Anonymity improvements • Whonix-Workstation qubes can’t open files/URLs/apps in non-Whonix disposables • Prevent changing Whonix Workstation netvm to sys-firewall (or other clearnet netvms) to reduce IP leak risk • kloak: keystroke-level online anonymization kernel Performance optimizations • Option to use volumes directly without snapshots • Retire qubes-rpc-multiplexer and execute commands directly from C • Cache “system info” for qrexec policy evaluation • Minimal state qubes to reduce RAM usage for NetVM/USBVM Updating & upgrading • Always hide specific templates/standalones from update tools • pacman hook to notify dom0 after successful manual Archlinux upgrades • Improved 4.2→4.3 upgrade tool (including using lvmdevices instead of device filter) New/improved experimental features • Ansible support • Qubes Air support • qrexec protocol extension to send source info to destination • Better GUIVM support (GUI/Admin split, auto-remove nomodeset when GPU attached) • Initial steps toward Wayland session-only support in GUIVM (not full GUI agent/daemon Wayland yet) Other quality-of-life • Free-form notes on qubes (descriptions/reminders/etc.) • Auto-clean QubesIncoming if empty • vm-config.* features to pass external config into a qube • Admin API to read/write the denied device-interface list • New Devices API support for salt Dropped/replaced • Default screen locker switched from XScreenSaver to xfce4-screensaver • “Create Qubes VM” retired in favor of “Create New Qube” • Windows 7 support dropped from QWT Overall, this feels like a more mature, refined release—better usability and device handling, real performance wins, and tighter guardrails where it matters. #IKITAO #OPSEC #QubesOS