---
title: "Orbit 0.4: Dry-Run Diffs by Default"
description: "Deploys now start with the diff: what 0.4 changes, why, and the one-flag migration."
date: "2026-07-21"
tags: ["release"]
canonical: "https://orbit-handbook.sitesmojo.com/blog/orbit-04-dry-run-diffs-by-default/"
---

Orbit
0.4 is out. The headline: **`orbit deploy` now shows the full diff and waits
for a yes.** What used to be `--dry-run` is simply how deploys start.

```text
$ orbit deploy --env production
Release #7 -> production
  ~ service hello-api      image sha256:9f2c... -> sha256:4e11...
  ~ env DATABASE_POOL      10 -> 25
  - route /v1/legacy
Apply? [y/N]
```

## Why we flipped it

We watched how people actually used 0.3. The teams with the fewest incidents
had all built the same habit by hand: `--dry-run`, read, then deploy "for
real". The default punished exactly the careful behavior we hoped for - so
the careful path is now the only path. (One of our own fat-fingered applies
helped the argument along; that story is in
[the dogfooding post](/blog/dogfooding-orbit-on-orbit/).)

CI keeps its ergonomics: `--yes` applies without prompting, and the diff
still prints into the job log, so every pipeline now keeps a record of what
each deploy changed.

## Also in 0.4

- `orbit plan` exits **2** when there is nothing to do - a cheap CI gate
  against empty redeploys.
- Verify polls health endpoints 4x faster, shaving ~20s off a typical
  blue-green switch.
- `orbit doctor` now recognizes expired registry credentials and prints the
  one-line fix.

## Upgrading

```bash
orbit self-update
```

Scripts that relied on `deploy` applying without confirmation need `--yes` -
that is the whole migration. Full details live in the
[CLI reference](/docs/cli-reference/).