* systemd-logind's integration with the UAPI.1 Boot Loader
      Specification (which allows the systemctl reboot --boot-loader-entry=
      switch to work) so far has supported a special directory
      /run/boot-loader-entries/ which allowed defining boot loader entries
      outside of the ESP/XBOOTLDR partition for compatibility with legacy
      systems that do not natively implement UAPI.1. However, it appears
      that (to our knowledge) it is not actually being used by any project
      (quite unlike UAPI.1 itself, which found adoption far beyond
      systemd), and its implementation is incomplete. With the future 262
      release we intend to remove support for /run/boot-loader-entries/ and
      related interfaces, in order to simplify our codebase. Support for
      UAPI.1 is – of course – kept in place.

    * The experimental "systemd-sysupdated" D-Bus API is going to be
      removed in the next release. The plan is that in its place
      clients should directly talk to systemd-sysupdate (i.e. the backend
      of "systemd-sysupdated") via Varlink IPC. The "updatectl" tool will
      be reworked along these lines.

    * systemd-nspawn's --user= option has been renamed to --uid=. The -u
      short option continues to work. The old --user NAME and --user=NAME
      forms (with and without "=") are still accepted but deprecated; a
      warning is emitted suggesting --uid=NAME. The --user option (without
      an argument) has been repurposed as a standalone switch to select
      the user service manager scope, matching --system.

    * Several configuration fields in the io.systemd.Unit varlink interface
      that were previously exposed as plain strings have been converted to
      proper enum types. This adds type safety and IDL-level validation.
      The output wire format now uses underscores instead of dashes and
      plus signs in enum values (e.g. "tty-force" becomes "tty_force",
      "kmsg+console" becomes "kmsg_console"). The previous use of plain
      strings for these well-defined enumerations is considered a bug.
      Affected enum types: ExecInputType, ExecOutputType, ProtectHome,
      CGroupController, CollectMode, EmergencyAction, JobMode.

    * It was discovered that some of the events systemd-stub measures to
      the TPM were not also measured to the hardware CC registers (e.g.
      Intel TDX RTMRs) via EFI_CC_MEASUREMENT_PROTOCOL. In particular,
      devicetree, initrd, ucode addons and the UKI profile were only
      measured to the TPM. The missing measurements for CC have now been
      added; however, this changes the expected register values. This
      may need to be reflected in the attestation environments which use
      hardware CC registers (in place of TPM quotes).

    * systemd-nspawn gained a new --restrict-address-families= option (and
      corresponding RestrictAddressFamilies= setting in .nspawn files) to
      restrict which socket address families may be used in the container.
      This is currently opt-in. In a future version, the default will be
      changed to restrict socket address families to AF_INET, AF_INET6 and
      AF_UNIX.

    * A new service unit "systemd-pcrosseparator.service" will now measure
      a new separator measurement during early userspace into PCRs 0-7, 9,
      12-14, in order to isolate firmware/pre-boot measurements from host
      measurements. This is a safety concept to protect firmware
      measurements on systems where the regular firmware separator
      measurement is missing. It's also useful in environments where a
      software TPM is used, i.e. where TPM functionality is only available
      starting with the OS, but not before. Note that this new measurement
      has an effect on all indicated PCRs, hence might affect relevant TPM
      policies.

    * Support for udev's old database version 0 has been removed. This
      effectively means live upgrades from versions older than v247 are not
      supported anymore.

    * systemd-networkd gained a new sd-dhcp-relay backend for DHCP relay
      agent support. As part of this change, the following [DHCPServer]
      settings are deprecated:
      - BindToInterface=
      - RelayTarget=
      - RelayAgentCircuitId=
      - RelayAgentRemoteId=
      They are replaced by DHCPRelay= in [Network], along with new
      [DHCPRelay] section settings in .network files:
      - AgentAddress=
      - GatewayAddress=
      - CircuitId=
      - VirtualSubnetSelection=
      - ExtraOption=
      - InterfacePriority=
      and in networkd.conf:
      - ServerAddress=
      - OverrideServerIdentifier=
      - RemoteId=
      - ExtraOption=

    * Required version of musl (when built with -Dlibc=musl) has been raised
      from 1.2.5 to 1.2.6.

    * libsystemd is no longer guaranteed to be linked against libm. Whether
      the dependency is recorded depends on whether the compiler chooses to
      emit builtins for all calls to libm symbols. Consumers that rely on
      libsystemd transitively pulling in libm should link against it
      themselves. There is at least one known case that is still unsolved:
      rsyslog crashes on launch due to libfastjson using libm without linking
      to it, which was previously masked because libsystemd linked to it. If
      forcing a link against libm is required as a workaround,
      '-Wl,--push-state,--no-as-needed,-lm,--pop-state' can be added to the
      link flags, or passed to systemd's meson build options via
      '-Dc_link_args=-Wl,--push-state,--no-as-needed,-lm,--pop-state'.

    * PID1 now supports the kernel's Live Update Orchestration (LUO) /
      Kexec Handover (KHO) systems when present and enabled. System units'
      FD Stores are now preserved through kexec, and units will get back
      stashed (named) file descriptors after kexec, if the kernel supports
      the FD type (at the time of writing only memfds are supported).
      Units can also create their own LUO Sessions by talking to the kernel
      directly, and store them in their FD Stores, and those will also be
      preserved and passed down to the unit after kexec. Units must set
      'FileDescriptorStorePreserve=yes' in order to enable this feature.

    * User session managers now support persisting user units' FD Stores
      by receiving FDs via the notify socket, and passing them down via
      $LISTEN_FDS when the user session is restarted, if the
      'FileDescriptorStorePreserve=yes' and 'FileDescriptorStoreMax='
      options are set in the user@.service unit. Combined with the LUO
      support, this lets user units persist state (e.g.: memfds) across
      not only user session restarts, but also kexec reboots.

    * The manager exposes a new ReloadCount property on its D-Bus and
      Varlink interfaces (org.freedesktop.systemd1.Manager and
      io.systemd.Manager respectively). The counter increments after
      each successfully completed daemon-reload, and it is reset on
      daemon-reexec.

    * A new unit setting CPUSetPartition= has been added that allows
      configuring the cpuset cgroup partition type (e.g. "root",
      "isolated", "member") for a service.

    * A new RestrictFileSystemAccess= setting has been added that uses a
      BPF LSM program to restrict execution to only binaries that are
      stored on a signed and verified dm-verity-protected filesystem.

    * The io.systemd.Unit.StartTransient() Varlink method has been added
      for invoking service units transiently.

    * A new set of Varlink methods has been added to the
      io.systemd.Manager interface to request system shutdown:
      PowerOff(), Reboot(), SoftReboot(), Halt() and Kexec(). These
      complement the existing D-Bus interfaces.

    * The io.systemd.Manager.ListUnitsByNames() Varlink method allows
      querying multiple units in one call and supports a result limit.

    * A new DefaultMemoryZSwapWriteback= manager setting has been added
      that provides a system-wide default for the existing
      MemoryZSwapWriteback= per-unit setting.

    * A new io.systemd.Job Varlink interface exposes information about
      pending and running manager jobs.

    * The service manager knows two new global knobs
      EventLoopRateLimitIntervalSec=/EventLoopRateLimitBurst= to configure
      PID1's event loop ratelimit logic. This permits fine-tuning the
      safety logic in PID 1 that slows down operation in case PID 1 starts
      to busy loop.

    * The service manager gained new per-unit settings
      CPUPressureWatch=/CPUPressureThresholdSec=/IOPressureWatch=/IOPressureThresholdSec=
      which enable services to get generic notifications on CPU or IO
      pressure events.

    * A new global service manager knob MinimumUptimeSec= has been added
      that defines a minimum uptime for the system. It defaults to 15s. If
      the system is shut down more quickly than the specified time a delay
      is inserted in the last part of shutdown, in order to avoid tight
 ...

    * systemd-logind's integration with the UAPI.1 Boot Loader
      Specification (which allows the systemctl reboot --boot-loader-entry=
      switch to work) so far has supported a special directory
      /run/boot-loader-entries/ which allowed defining boot loader entries
      outside of the ESP/XBOOTLDR partition for compatibility with legacy
      systems that do not natively implement UAPI.1. However, it appears
      that (to our knowledge) it is not actually being used by any project
      (quite unlike UAPI.1 itself, which found adoption far beyond
      systemd), and its implementation is incomplete. With the future 262
      release we intend to remove support for /run/boot-loader-entries/ and
      related interfaces, in order to simplify our codebase. Support for
      UAPI.1 is – of course – kept in place.

    * The experimental "systemd-sysupdated" D-Bus API is going to be
      removed in the next release. The plan is that in its place
      clients should directly talk to systemd-sysupdate (i.e. the backend
      of "systemd-sysupdated") via Varlink IPC. The "updatectl" tool will
      be reworked along these lines.

    * systemd-nspawn's --user= option has been renamed to --uid=. The -u
      short option continues to work. The old --user NAME and --user=NAME
      forms (with and without "=") are still accepted but deprecated; a
      warning is emitted suggesting --uid=NAME. The --user option (without
      an argument) has been repurposed as a standalone switch to select
      the user service manager scope, matching --system.

    * Several configuration fields in the io.systemd.Unit varlink interface
      that were previously exposed as plain strings have been converted to
      proper enum types. This adds type safety and IDL-level validation.
      The output wire format now uses underscores instead of dashes and
      plus signs in enum values (e.g. "tty-force" becomes "tty_force",
      "kmsg+console" becomes "kmsg_console"). The previous use of plain
      strings for these well-defined enumerations is considered a bug.
      Affected enum types: ExecInputType, ExecOutputType, ProtectHome,
      CGroupController, CollectMode, EmergencyAction, JobMode.

    * It was discovered that some of the events systemd-stub measures to
      the TPM were not also measured to the hardware CC registers (e.g.
      Intel TDX RTMRs) via EFI_CC_MEASUREMENT_PROTOCOL. In particular,
      devicetree, initrd, ucode addons and the UKI profile were only
      measured to the TPM. The missing measurements for CC have now been
      added; however, this changes the expected register values. This
      may need to be reflected in the attestation environments which use
      hardware CC registers (in place of TPM quotes).

    * systemd-nspawn gained a new --restrict-address-families= option (and
      corresponding RestrictAddressFamilies= setting in .nspawn files) to
      restrict which socket address families may be used in the container.
      This is currently opt-in. In a future version, the default will be
      changed to restrict socket address families to AF_INET, AF_INET6 and
      AF_UNIX.

    * A new service unit "systemd-pcrosseparator.service" will now measure
      a new separator measurement during early userspace into PCRs 0-7, 9,
      12-14, in order to isolate firmware/pre-boot measurements from host
      measurements. This is a safety concept to protect firmware
      measurements on systems where the regular firmware separator
      measurement is missing. It's also useful in environments where a
      software TPM is used, i.e. where TPM functionality is only available
      starting with the OS, but not before. Note that this new measurement
      has an effect on all indicated PCRs, hence might affect relevant TPM
      policies.

    * Support for udev's old database version 0 has been removed. This
      effectively means live upgrades from versions older than v247 are not
      supported anymore.

    * systemd-networkd gained a new sd-dhcp-relay backend for DHCP relay
      agent support. As part of this change, the following [DHCPServer]
      settings are deprecated:
      - BindToInterface=
      - RelayTarget=
      - RelayAgentCircuitId=
      - RelayAgentRemoteId=
      They are replaced by DHCPRelay= in [Network], along with new
      [DHCPRelay] section settings in .network files:
      - AgentAddress=
      - GatewayAddress=
      - CircuitId=
      - VirtualSubnetSelection=
      - ExtraOption=
      - InterfacePriority=
      and in networkd.conf:
      - ServerAddress=
      - OverrideServerIdentifier=
      - RemoteId=
      - ExtraOption=

    * Required version of musl (when built with -Dlibc=musl) has been raised
      from 1.2.5 to 1.2.6.

    * libsystemd is no longer guaranteed to be linked against libm. Whether
      the dependency is recorded depends on whether the compiler chooses to
      emit builtins for all calls to libm symbols. Consumers that rely on
      libsystemd transitively pulling in libm should link against it
      themselves. There is at least one known case that is still unsolved:
      rsyslog crashes on launch due to libfastjson using libm without linking
      to it, which was previously masked because libsystemd linked to it. If
      forcing a link against libm is required as a workaround,
      '-Wl,--push-state,--no-as-needed,-lm,--pop-state' can be added to the
      link flags, or passed to systemd's meson build options via
      '-Dc_link_args=-Wl,--push-state,--no-as-needed,-lm,--pop-state'.

    * PID1 now supports the kernel's Live Update Orchestration (LUO) /
      Kexec Handover (KHO) systems when present and enabled. System units'
      FD Stores are now preserved through kexec, and units will get back
      stashed (named) file descriptors after kexec, if the kernel supports
      the FD type (at the time of writing only memfds are supported).
      Units can also create their own LUO Sessions by talking to the kernel
      directly, and store them in their FD Stores, and those will also be
      preserved and passed down to the unit after kexec. Units must set
      'FileDescriptorStorePreserve=yes' in order to enable this feature.

    * User session managers now support persisting user units' FD Stores
      by receiving FDs via the notify socket, and passing them down via
      $LISTEN_FDS when the user session is restarted, if the
      'FileDescriptorStorePreserve=yes' and 'FileDescriptorStoreMax='
      options are set in the user@.service unit. Combined with the LUO
      support, this lets user units persist state (e.g.: memfds) across
      not only user session restarts, but also kexec reboots.

    * The manager exposes a new ReloadCount property on its D-Bus and
      Varlink interfaces (org.freedesktop.systemd1.Manager and
      io.systemd.Manager respectively). The counter increments after
      each successfully completed daemon-reload, and it is reset on
      daemon-reexec.

    * A new unit setting CPUSetPartition= has been added that allows
      configuring the cpuset cgroup partition type (e.g. "root",
      "isolated", "member") for a service.

    * A new RestrictFileSystemAccess= setting has been added that uses a
      BPF LSM program to restrict execution to only binaries that are
      stored on a signed and verified dm-verity-protected filesystem.

    * The io.systemd.Unit.StartTransient() Varlink method has been added
      for invoking service units transiently.

    * A new set of Varlink methods has been added to the
      io.systemd.Manager interface to request system shutdown:
      PowerOff(), Reboot(), SoftReboot(), Halt() and Kexec(). These
      complement the existing D-Bus interfaces.

    * The io.systemd.Manager.ListUnitsByNames() Varlink method allows
      querying multiple units in one call and supports a result limit.

    * A new DefaultMemoryZSwapWriteback= manager setting has been added
      that provides a system-wide default for the existing
      MemoryZSwapWriteback= per-unit setting.

    * A new io.systemd.Job Varlink interface exposes information about
      pending and running manager jobs.

    * The service manager knows two new global knobs
      EventLoopRateLimitIntervalSec=/EventLoopRateLimitBurst= to configure
      PID1's event loop ratelimit logic. This permits fine-tuning the
      safety logic in PID 1 that slows down operation in case PID 1 starts
      to busy loop.

    * The service manager gained new per-unit settings
      CPUPressureWatch=/CPUPressureThresholdSec=/IOPressureWatch=/IOPressureThresholdSec=
      which enable services to get generic notifications on CPU or IO
      pressure events.

    * A new global service manager knob MinimumUptimeSec= has been added
      that defines a minimum uptime for the system. It defaults to 15s. If
      the system is shut down more quickly than the specified time a delay
      is inserted in the last part of shutdown, in order to avoid tight...