This release of the Device Update agent reference implementation focuses on cancellation reliability, connection/auth stability, and dependency/build hardening. It is a minor release (1.4.0) because it includes customer-affecting behavior changes — most notably the default content downloader changing to curl and the cancellation behavior change for script-handler updates (see below).

✨ Highlights ✨

• Cancelling a running update now reliably cancels it — including invoking CancelUpdate() in script-handler scripts
• More resilient IoT Hub connectivity and update-workflow stability
• Updated transport stack and build defaults (curl is now the default content downloader)

Improvements

Update cancellation

• Cancelling an in-progress deployment now actually cancels the running update. Previously a service-issued cancel could be ignored, so a running step handler never observed the cancellation request. (#777)

• Script-handler scripts now have their CancelUpdate() function invoked on cancellation, allowing a long-running download/install script to be interrupted. (#776)

  Note (behavior change): If your update uses the script handler, your script's CancelUpdate() function is now actually called on cancellation. Ensure it is idempotent, returns success when there is nothing to cancel, and is safe to run while the in-progress action is still executing. See the CHANGELOG migration guidance.

Reliability and stability

• Fixed an agent restart loop on transient IoT Hub disconnects. (#879)
• Fixed a SIGABRT during workflow step transitions caused by a re-entrant worker. (#883)
• Hardened Linux platform async worker thread and timer lifecycle management. (#862, #880)
• In-progress downloads now survive an agent/service restart and resume instead of starting over. (#811)
• Fixed logical bugs in adu-shell script execution. (#766)

Authentication

• Fixed edgegatewayCertPath overwriting X.509 / EIS-x509 auth state, and an AIS + EIS-x509 (no Edge gateway) regression that could cause the mTLS handshake to fail and the agent to restart-loop. (#874)

Dependencies and build

• Upgraded azure-iot-sdk-c from LTS_08_2023 to LTS_03_2025. (#882)
• Delivery Optimization is no longer enabled by default; curl is now the default content downloader. To keep using Delivery Optimization, build with -DADUC_BUILD_WITH_DELIVERY_OPTIMIZATION=ON. (#893)
• Build/CI hardening: pinned vcpkg baseline, pinned delta-build GCC on Ubuntu 20.04 arm64, and transient apt-mirror retry. (#891, #881, #885)

Documentation

• Clarified custom-handler IsInstalled authoring guidance, documented retry-update for proxy-update re-evaluation, and added an engineer-facing deep-dive. (#896, #888, #886)

For the full per-change list, see CHANGELOG.md.

This release updates the Device Update agent reference implementation with expanded delta-based update support and new device-side coordination capabilities.

✨ Highlights ✨

• Expanded delta-based update support to reduce payload size
• New device-side status API for coordinating updates with local workloads
• Expanded Linux platform support (Ubuntu 24.04, Debian 13)

Improvements

Delta Updates and download enhancements

• Delta updates enable devices to transfer only what changed between versions, reducing update payload size and bandwidth usage. Learn more.
• Added Microsoft Delta Download Handler with component-based packaging.
• Improved caching behavior and download reliability.

Device coordination and update control

• A new device-side status API (Cross-process Query API) lets local processes coordinate with active updates, helping avoid conflicts and improve update reliability. Learn more.
• Workflow data can now be passed to script handlers, enabling more flexible update scenarios.
• Improved restart coordination ensures reporting and cache operations complete before reboot.

Update visibility and diagnostics

• More detailed failure reporting for update workflows.
• Extended result codes now surface in IoT Hub for deeper troubleshooting.

Platform and environment support

• Added support for Ubuntu 24.04 LTS (GCC 13 compatible).
• Added support for Debian 13 (Trixie).
• Curl handler is now the default content download handler.

Security and authentication

• Added support for X.509 client certificate authentication.

  Note: X.509 authentication support in the Device Update agent uses standard Azure IoT Hub identity configuration.
  This capability isn't integrated with Azure Device Registry (ADR) certificate management (preview).

Reliability

• Improved agent logging, error handling, and overall workflow stability.

Bug Fixes

• Fixed memory leaks across multiple agent components.
• Resolved thread-safety issues in communication and logging subsystems.
• Fixed ARM32 segmentation faults and extension registration issues.
• Addressed stability issues on Raspberry Pi environments.
• Improved inter-process communication and timeout handling.
• Resolved logging initialization issues affecting process-wide behavior.

What's Changed

• Fix issue in example scripts where CancelUpdate is not invoked by @Nox-MSFT in #743
• Fix documentation links by @AndreRicardo-Zoetis in #756
• Fix #737 wrong pointer. by @AndreRicardo-Zoetis in #754
• Add devcontainer with Debian 11. by @AndreRicardo-Zoetis in #753
• Support for authentication with client certificates by @D-r-P-3-p-p-3-r in #656
• Fix warnings and add test for ADUC_HashUtils_GetIndexStrongestValidHash by @AndreRicardo-Zoetis in #761
• Fix line commented by mistake and remove unneeded imports by @AndreRicardo-Zoetis in #760
• Disable fail-fast so we can see result of build in other OS by @AndreRicardo-Zoetis in #758
• Remove broken Debian 10 build, reached end of life in June 30, 2024 by @AndreRicardo-Zoetis in #757
• Fix #749 - Add build steps in CI for Ubuntu 24.04 (noble) by @emibcn in #769
• Delete azurepipelines/build directory by @Nox-MSFT in #773
• Disabled ubuntu:24.04 build in docker-build.yml by @Nox-MSFT in #774
• Fix util function logging error when file does not exist. by @AndreRicardo-Zoetis in #782
• Fix missing logging Uninit by @AndreRicardo-Zoetis in #786
• Fix log message to show text for cancel. by @AndreRicardo-Zoetis in #787
• Fix leaks by @AndreRicardo-Zoetis in #783
• Fix memory leaks reported by Valgrind by @AndreRicardo-Zoetis in #785
• Fix memory leak in WorkflowHandle. by @AndreRicardo-Zoetis in #788
• Fix leak in root_key_util.c by @AndreRicardo-Zoetis in #789
• Fix leaks in steps_handler.cpp by @AndreRicardo-Zoetis in #790
• Fix leaks in steps_handler.cpp by @AndreRicardo-Zoetis in #791
• Fix leaks in jws_utils.c by @AndreRicardo-Zoetis in #792
• Fix leak in script_handler.cpp by @AndreRicardo-Zoetis in #793
• Fix leaks in workflow_utils.c by @AndreRicardo-Zoetis in #794
• Thread safe client address by @AndreRicardo-Zoetis in #784
• Allow build.sh to disable logging. by @AndreRicardo-Zoetis in #796
• Fix log level being defaulted to INFO on extensions. by @AndreRicardo-Zoetis in #797
• Return cached version of content handler if already existing. by @AndreRicardo-Zoetis in #798
• Fix leak in linux_adu_core_impl.cpp by adding destructor that cleans up ExtensionManager by @AndreRicardo-Zoetis in #799
• Fix memory leaks and run unit test with ValGrind on Ubuntu 20.04, and newer, build hosts by @Nox-MSFT in #800
• feat(build): Support custom work folder for dependency installation and build by @Nox-MSFT in #803
• Fix wrong documentation, -1 will read outside array. by @AndreRicardo-Zoetis in #808
• Fix leak when initializing zlog multiple times. by @MartinRieva-Zoetis in #801
• Report detailed error result for failed workflows by @AndreRicardo-Zoetis in #804
• Show ExtendedResultCode in IoTHub for "Last Attempted Update" in "Details" by @AndreRicardo-Zoetis in #805
• Extra catch section to get details logged. by @AndreRicardo-Zoetis in #807
• Enable Ubuntu 24.04 LTS support with GCC 13 compatibility by @Nox-MSFT in #802
• Add support for Debian 13 (Trixie) by @Nox-MSFT in #819
• feat: Use curl handler as the default content handler by @nonsocode in #810
• Bump azure-core from 1.23.0 to 1.38.0 in /azurepipelines/e2e_test/scenarios/testingtoolkit by @dependabot[bot] in #809
• Pass workflowData to PrepareScriptArguments by @AndreRicardo-Zoetis in #806
• cherrypick: chore: add run_coverage.sh script to generate code coverage report by @whereiseva in #822
• Several Unit Test Improvements by @hmmorales in #823
• Cherrypick: Merge pull request #818 from Azure/henrymorales/unit-test-updates-1 by @hmmorales in #821
• chore(script): exclude example code from code coverage report by @whereiseva in #825
• chore (unit tests): add unit tests to src/utils by @whereiseva in #824
• Python Script to Generate Code Coverage & Commit Hook Fix by @hmmorales in #826
• Unit Test Coverage for adu_types by @hmmorales in #827
• More unit test code coverage for diagnostics_component & agent by @hmmorales in #832
• chore(unit tests): add unit test to src/adu-shell by @whereiseva in #833
• adu agent documentation by @hmmorales in #831
• Adding unit tests for extensions by @mfsmoot in #829
• adu_workflow unit test improvements by @hmmorales in #830
• Additional unit tests for logging, rootkey_workflow and extensions by @mfsmoot in #834
• Unit tests for communication_abstraction, communication_manager, agent, and platform_layers by @mfsmoot in #836
• Rootkey Validator Tool by @hmmorales in #838
• Overall Agent Logging Improvements by @hmmorales in #837
• fix: Fix CMAKE in rootkey workflow by @nonsocode in #842
• fix: Fix segmentation fault by @nonsocode in #844
• fix: Fix double-free in logging library by @nonsocode in #843
• feat: ARM 32 compatibilty fixes by @nonsocode in #841
• fix: Fix Curl downloader default by @nonsocode in #839
• fix: Fix coverage issues by @nonsocode in #848
• fix: Make DO recommended when built with DO support by @nonsocode in #847
• Fix path for CMake in vscode with latest build.sh changes and enable test integration by @AndreRicardo-Zoetis in #849

Full Changelog: 1.2.0...1.2.6

Security-Related Bug Fixes

• Fix incorrect format specifier in extension_utils.c (5911351)
• Fix segmentation fault in OnShutdownSignal (26087a6)
• Fix double-free issue in FileInfoUtils (fd69e82)
• Fix buffer overrun and other UB when format-specifier-like string exists in script handler script (1e9d62a)
• Fix quoting issue leading to 0 args for format string with one format specifier in rootkey_workflow (7e91646)
• Fix 15 instances of "cmp narrow with wide in loop condition issues" across 11 files (305bb64)
• Fix Non-const fmt str in script_handler.cpp (a5be7c1)
• Fix possible buffer overrun by using strncmp in command_helper.c and operation_id_utils.c (f8cc65d)
• Cast ssize_t to size_t after >0 check (4b43aff)

Other Bug Fixes:

• Ensure downloaded script handler script has correction ownership/permissions and improve adu-shell errors (add4369)
• Fix restart race by adding signal handler in adu-shell (b1d4187)
• Handle nodeployment workflowid case (370da99)
• Fix message processing context init, usage, cleanup in d2c_messaging (86ff8fb)
• Fix memleak in url_utils and other rootkey util and rootkeypackage download fixes (d226c1e)

Usage Enhancements:

• Fix incorrectly mapped errno in how-to-troubleshoot-guide.md (b96895b)
• Add public github actions
  • builds Debian11 & 12, Ubuntu20.04 and 22.04) x (x86_64, arm64)
  • commits: d83ea71, 2b5e00c, 7d673c3
• Fix setup_container.sh health check permissions for docker (a3c2a82)
• Fix daemon CMakeLists.txt and install.sh (9d68eb4)
• Fix aziot* unix user/group and aziot services restart in debian cpack postrm (2b57d17)
• Add support for building Debian 12 in install-deps.sh (a5ff0b0)
• Update documents and scripts for multi component update examples (34bb35c)
• Fix shellcheck error in demo script (d623317)

Code Enhancements:

• Report InProgress only once processing update deployment (3897553(
• Add more rootkey logging and handle SignatureToJsonValue failure (bc94fc3)
• Upgrade Catch2 version from v2 to v3.8.0 (8f0a6d2)
• Allow use of curl to download rootkey package (99ab06f, 4b43aff)

Debian Packages Device Update agent for Ubuntu 20.04, Ubuntu 22.04 and Debian 11

New Features:

• Adding support to handle the service driven management of our certificate root keys which establish the trust relationship to our ADU services. (2c264e4 )
• Build pipeline changes to add support for Ubuntu 22.04 (x64, ARM64), Debian 11 (x64, ARM64, ARM32)(8a7e65e, 09fcc4a)

Security Bug Fixes:

• Updating to the C-SDK version 0.8.2023 and added support for OpenSSL 3.0. (d707681 )

Usage Enhancements:

• Adding facilitating scripts to help produce deltas of docker images, to support preparing a delta update.(e976950 )
• Simplified how SW Update handler interop with the underlying script driving the SW Update process. (8278552)
• Deprecated swupdate v1 handler support which has been replaced by v2 which exposes more swupdate functionality.
• Made the /tmp directory compile time configurable. (4794e82 )
• Providing compile and runtime overrides for default paths of agent config file and data folder locations. (ac1dd22)
• Configuration file updates. (8120130)
• Adding ability to conditionally build multi-step handlers (--step-handlers). (5713d86)
• Cross process communication fixes (shell and main process) for handling failures. (e0d67ec )
• Documentation updates (including doxygen and readme files), enhancements and corrections.

Code Enhancements:

• Memory allocation and safe usage fixes. (9b088ad, b18cdd4)
• Adding compiler failure upon usage of unsafe string copy method. (0fb456a )
• Updated to use C++17. (ead5b99)
• Reducing zlog logger in memory buffer usage to 41KB. (abdb981 )
• Merged in several community contributions. ( #385, #388 , #390, #386 )

Debian Packages Device Update agent for Ubuntu 20.04, Ubuntu 22.04, Debian 10 and Debian 11

Bug Fixes

• Corrected the shared object dependency of libdeliveryoptimization.so.0 in DU agent .deb package and AducIotAgent binary (#344 )
• Improved IoTHub_CommunicationManager_Init and DeInit (#363)
• Improved Simulator Update Handler Doc (#359)
• Corrected result code and extended result code when agent is missing required handlers (#343)
• Improvements for SWUpdate V2 handler and script handler for installed criteria (#366)
• Improvements to script handler and SWUpdate V2 handler docs (#366)
• Corrected unit tests for SWUpdate V2 handler (#366)

Bug Fixes

• Fixed an issue for image-based update scenario where the device doesn't reboot after the new image is installed (fd969fa)
• Fixed deadlock in zlog flush deinit (20840dc)
• Fixed regression in ADUC Logging init to allow agent to start (2ad13d8)
• Fixed memory leaks (73029e1)
• Fixed GetConnectionInfoFromConnectionString to handle failures (df3e5e7)
• Fixed overwrite of contract maj ver in downloaders and comp enumerator (12b51c9)
• Enabled error handling when download handler plugin symbol missing (a38dc5e)
• DO bootstrap.sh fixed to run on on Hyper V Ubuntu 20.04 LTS (a36a879)
• Fixed install dependencies (b36cd3d)
• Corrected the cached workfolder used when processing replacement workflow (8596498)

Enhancements

• Updated contributor guide, and enabled GitHub ideas and discussion (9c95d84)
• Remove curl dependency in https_proxy_utils (f17fcd8)
• Agent will try to reconnect reconnect to IoT Hub on bad credential or expired SAS token (c5dbd65)

New Features

• Updated swupdate handler. Learn More about SWUpdate Handler V2
• New delta download handler.(Preview feature) Learn more about delta downloads

Notable Bug fixes

• For non adu user/group, remove read and execute permissions for adu conf dir and remove read permissions for config files for least privilege
• Allow Retry/Replacement to process workflow after a failure
• Fixed OTA DU Agent Upgrade failure due to mismatched DO Agent version
• Fixed cancel flow in steps handler
• Fixed an issue where 'retry-update' command is no-op if previous attempt was succeeded
• Cleanup current workflow sandbox before processing deferred, replacement workflow
• Replaced 0 erc in script handler script result file for discoverability
• Fixed off by one error in file info utils of diagnostics component
• Fixed segfault in swupdate handler when installed criteria property is missing

Enhancements

• Improved Device to Cloud Message Reliability
• Support both Update Manifest v4 and v5 to improve PPR to GA upgrade
• Added shellcheck and clangformat pre-commit git hooks
• MCU: Implement '--command' support for the Agent to allow other processes to send 'retry-update' request to the main Agent process
• Added Download Handler Extensibility Point and microsoft delta download handler
• Added EIS SAS Token Refresh
• Replaced 'interfaceId' with 'contractModelId' and change value to 'dtmi:azure:iot:deviceUpdateContractModel;2'
• Moved to Delivery Optimization v1.0.0
• Added extension contract version support
• Allow setting mqtt or mqtt over websockets transport protocol from du config
• Allow custom compat properties to be set from du config
• Added result.h generation from result
• Rearranged dir structure and change dir names to be more consistent
• E2E Test Pipeline Changes
• Build Pipeline Changes

Bug Fixes

• Fixed reboot and restart logics regression(12669d9)
• Fixed supply chain warnings (7613ddf)

Notable Enhancements

• Added build pipeline support for Debian 10 amd64 (b2d4121)

Bug Fixes

• Added fix to ignore dup workflow id after it last succeeded (8a13a99)
• Fixed installed criteria error in example proxy updates (ebf7b8c)
• Added missing goto done when APT pkg install fails (1001645)
• Addede ADUC_Logging_Init() to Script Content Handler (ce8070d)
• Fixed memory leak (#80) (e06e313)
• Fixed incorrect root key modulus for 200703.R.T (d4f30cc)
• Fixed memory leak in GetReportingJsonValue() - free root JSON_Value when done (#157) (eb61368)
• Fixed postrm failed-upgrade healthcheck, 0.8.0 to 0.8.x (a6073d5)
• Added visibility into resultDetails from content handler if content is already installed(dcc8512)

Notable enhancements

• Added build pipeline support for Ubuntu 20.04 (a0e7fe8)
• Disabled automatic component detection (7d2895a)
• Added new Script Handler documentation (85df567)
• Improved multi-component update example, improve Steps Handler, Script Handler (e6face5)