build: Release v50.1

This release contains security fixes. Details can be found in the
release notes.

Signed-off-by: Bo Chen <bchen@crusoe.ai>

Cargo.lock

@@ -417,7 +417,7 @@ checksum = "a1d728cc89cf3aee9ff92b05e62b19ee65a02b5702cff7d5a377e32c6ae29d8d"
 
 [[package]]
 name = "cloud-hypervisor"
-version = "50.0.0"
+version = "50.1.0"
 dependencies = [
  "anyhow",
  "api_client",

cloud-hypervisor/Cargo.toml

@@ -7,7 +7,7 @@ edition = "2024"
 homepage = "https://github.com/cloud-hypervisor/cloud-hypervisor"
 license = "Apache-2.0 AND BSD-3-Clause"
 name = "cloud-hypervisor"
-version = "50.0.0"
+version = "50.1.0"
 # Minimum buildable version:
 # Keep in sync with version in .github/workflows/build.yaml
 # Policy on MSRV (see #4318):

release-notes.md

@@ -1,3 +1,4 @@
+- [v50.1](#v501)
 - [v50.0](#v500)
     - [Configurable Nested Virtualization Option on x86_64](#configurable-nested-virtualization-option-on-x86_64)
     - [Compression Support for QCOW2](#compression-support-for-qcow2)
@@ -409,6 +410,31 @@
     - [Unit testing](#unit-testing)
     - [Integration tests parallelization](#integration-tests-parallelization)
 
+# v50.1
+
+This is a point release containing security fixes and bug fixes.
+
+### Security Fixes
+
+This release fixes a security vulnerability in disk image handling.
+Details can be found in
+[GHSA-jmr4-g2hv-mjj6](https://github.com/cloud-hypervisor/cloud-hypervisor/security/advisories/GHSA-jmr4-g2hv-mjj6).
+
+* A new `backing_files=on|off` option has been added to `--disk` to
+  explicitly control whether QCOW2 backing files are permitted. This
+  defaults to `off` to prevent the loading of backing files entirely.
+  (#7685)
+* Explicit image type specification via the user interface, removing
+  reliance on format autodetection (#7728).
+* Prevent sector-zero writes for autodetected raw images (#7728).
+
+### Bug Fixes
+
+* Fix various inconsistencies in our OpenAPI specification file
+  (#7716, #7726)
+* Fix QCOW2 thread safety for multiple virtio queues
+  (`num_queues > 1`) (#7661)
+
 # v50.0
 
 This release has been tracked in [v50.0