Qubes OS warns Fedora 43 templates face end-of-life on December 9

The Qubes OS project has issued an end-of-life notice for Fedora 43, which will stop receiving security updates on December 9, 2026. Users running Fedora-based templates or standalone VMs in Qubes must migrate to a newer Fedora release before that date to avoid running unsupported software. The project outlines two upgrade paths: installing a fresh template (recommended for most users) or performing an in-place upgrade (preserves modifications but is more complex). Notably, no action is required for dom0, Qubes' privileged management domain, which follows a separate lifecycle policy.

This announcement affects all Qubes OS installations using Fedora 43 as a template for application qubes. The recommended fresh-install approach requires users to document and recreate any custom modifications, while the dnf history command can help reconstruct past package changes. Standalone VMs, which function as independent full systems rather than template-based qubes, are equally subject to this EOL deadline.

Upgrade paths and Qubes architecture considerations

• Template vs. standalone scope: The EOL applies to both Fedora 43 templates (shared base images for multiple qubes) and standalone VMs (independent Fedora installations), requiring user action across both deployment patterns.
• Fresh template installation: The recommended method installs a clean Fedora template from Qubes repositories, which simplifies the process but discards custom packages, configurations, and modifications made to the existing template.
• In-place upgrade option: Advanced users can upgrade existing templates while preserving modifications, though this path carries higher complexity and potential for configuration drift or upgrade failures.
• dnf history for reconstruction: Users opting for fresh installs can query past package manager transactions via dnf history in the old template to help rebuild their environment.
• dom0 exclusion: The Qubes management domain (dom0) operates on a separate lifecycle and does not require Fedora version upgrades, reflecting Qubes' architectural isolation of the control plane from user-facing VMs.

Why it matters

This notice highlights the maintenance burden of template-based virtualization in Qubes OS, where each supported guest distribution requires independent lifecycle tracking and user migration effort. For security-conscious users and organizations relying on Qubes' isolation model, timely template upgrades are critical since EOL templates will no longer receive patches for kernel or userland vulnerabilities. The dual-path upgrade documentation also serves as a reference for other Fedora-based container or VM workflows facing similar transitions.