v21.0.0

Merge pull request #2921 from balena-io/major-21-second-attempt
Major 21
2025-06-24 10:35:39 +00:00 · 2025-03-11 14:42:31 +00:00 · 2025-03-11 10:41:28 -04:00 · 2025-03-11 08:19:10 -04:00 · 2025-03-11 08:19:10 -04:00 · 2025-03-11 08:19:10 -04:00
197 changed files with 10198 additions and 6766 deletions
--- a/.eslintignore
+++ b/.eslintignore
@ -1,2 +0,0 @@
-/completion/*
-/bin/*
--- a/.eslintrc.js
+++ b/.eslintrc.js
@ -1,21 +0,0 @@
-module.exports = {
-	extends: ['./node_modules/@balena/lint/config/.eslintrc.js'],
-	parserOptions: {
-		project: 'tsconfig.dev.json',
-	},
-	root: true,
-	rules: {
-		ignoreDefinitionFiles: 0,
-		// to avoid the `warning  Forbidden non-null assertion  @typescript-eslint/no-non-null-assertion`
-		'@typescript-eslint/no-non-null-assertion': 'off',
-		'@typescript-eslint/no-shadow': 'off',
-		'@typescript-eslint/no-var-requires': 'off',
-		'no-restricted-imports': [
-			'error',
-			{
-				paths: ['resin-cli-visuals', 'chalk', 'common-tags', 'resin-cli-form'],
-			},
-		],
-		'@typescript-eslint/no-unused-vars': ['error', { argsIgnorePattern: '^_' }],
-	},
-};
--- a/.github/actions/publish/action.yml
+++ b/.github/actions/publish/action.yml
@ -39,7 +39,7 @@ runs:
      run: tar -xf ${{ runner.temp }}/custom.tgz

    - name: Setup Node.js
-      uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4
+      uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4
      with:
        node-version: ${{ inputs.NODE_VERSION }}
        cache: npm
@ -135,7 +135,7 @@ runs:
        XCODE_APP_LOADER_TEAM_ID: ${{ inputs.XCODE_APP_LOADER_TEAM_ID }}

    - name: Upload artifacts
-      uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4
+      uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
      with:
        name: gh-release-${{ github.event.pull_request.head.sha || github.event.head_commit.id }}-${{ strategy.job-index }}
        path: dist
--- a/.github/actions/test/action.yml
+++ b/.github/actions/test/action.yml
@ -26,7 +26,7 @@ runs:
  steps:
    # https://github.com/actions/setup-node#caching-global-packages-data
    - name: Setup Node.js
-      uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4
+      uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4
      with:
        node-version: ${{ inputs.NODE_VERSION }}
        cache: npm
@ -58,7 +58,7 @@ runs:
      run: tar --exclude-vcs -acf ${{ runner.temp }}/custom.tgz .

    - name: Upload custom artifact
-      uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4
+      uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
      with:
        name: custom-${{ github.event.pull_request.head.sha || github.event.head_commit.id }}-${{ runner.os }}-${{ runner.arch }}
        path: ${{ runner.temp }}/custom.tgz
--- a/.github/workflows/flowzone.yml
+++ b/.github/workflows/flowzone.yml
@ -26,7 +26,7 @@ jobs:
          "os": [
            ["self-hosted", "X64"],
            ["self-hosted", "ARM64"],
-            ["macos-12"],
+            ["macos-13"],
            ["windows-2019"],
            ["macos-latest-xlarge"]
          ]
@ -36,7 +36,7 @@ jobs:
          "os": [
            ["self-hosted", "X64"],
            ["self-hosted", "ARM64"],
-            ["macos-12"],
+            ["macos-13"],
            ["windows-2019"],
            ["macos-latest-xlarge"]
          ]
--- a/.versionbot/CHANGELOG.yml
+++ b/.versionbot/CHANGELOG.yml
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@ -4,6 +4,354 @@ All notable changes to this project will be documented in this file
 automatically by Versionist. DO NOT EDIT THIS FILE MANUALLY!
 This project adheres to [Semantic Versioning](http://semver.org/).

+## 21.0.0 - 2025-03-11
+
+* Drop support for OS versions <2.14.0 [myarmolinsky]
+* api-key generate: Add required argument `expiryDate` [myarmolinsky]
+* Update `balena-preload` to 18.0.1 [myarmolinsky]
+* Add dependency `date-fns` [myarmolinsky]
+* Update `balena-sdk` to 21.2.1 [myarmolinsky]
+
+## 20.2.10 - 2025-03-10
+
+* Update TypeScript to 5.8.2 [Thodoris Greasidis]
+
+## 20.2.9 - 2025-02-26
+
+* Fix CORS issue with X-Balena-Client header [Thodoris Greasidis]
+
+## 20.2.8 - 2025-02-26
+
+* Update balena-config-json dependency and fix test [Ken Bannister]
+
+## 20.2.7 - 2025-02-25
+
+* Use the CLI version in the X-Balena-Client header [Thodoris Greasidis]
+
+## 20.2.6 - 2025-02-25
+
+* Update actions/upload-artifact digest to 4cec3d8 [balena-renovate[bot]]
+
+## 20.2.5 - 2025-02-25
+
+* Update actions/setup-node digest to 1d0ff46 [balena-renovate[bot]]
+
+## 20.2.4 - 2025-02-25
+
+* Pin docker-modem and dockerode to avoid regression [Ken Bannister]
+
+## 20.2.3 - 2025-01-15
+
+* Remove unused old eslint version files [Otavio Jacobi]
+
+## 20.2.2 - 2025-01-12
+
+* Use the promises namespace of balena-image-fs [Thodoris Greasidis]
+
+<details>
+<summary> Update balena-device-init to 8.1.3 & balena-image-fs to 7.3.0 [Thodoris Greasidis] </summary>
+
+> ### balena-image-fs-7.3.0 - 2025-01-06
+> 
+> * Drop Bluebird from devDependencies [Thodoris Greasidis]
+> * flowzone: Remove empty with clause [Thodoris Greasidis]
+> * Add the promises namespace as part of the exposed fs [Thodoris Greasidis]
+> 
+> ### balena-image-fs-7.2.2 - 2024-01-02
+> 
+> * Update dependency @types/node to v20 [Self-hosted Renovate Bot]
+> 
+> ### balena-image-fs-7.2.1 - 2023-12-19
+> 
+> * Remove repo config from flowzone.yml [Kyle Harding]
+> 
+> ### balena-image-fs-7.2.0 - 2023-01-20
+> 
+> * Add support for Node 18 [Akis Kesoglou]
+> 
+> ### balena-image-fs-7.1.2 - 2023-01-05
+> 
+> * Update dependencies [ab77]
+> 
+> ### balena-image-fs-7.1.1 - 2022-12-20
+> 
+> * Update dependency jsdoc-to-markdown to 8.0.0 [Renovate Bot]
+> 
+> ### balena-image-fs-7.1.0 - 2022-12-13
+> 
+> * update dependencies [Zane Hitchcox]
+> 
+> ### balena-device-init-8.1.3 - 2025-01-09
+> 
+> * README: Remove the travisci badge [Thodoris Greasidis]
+> 
+> ### balena-device-init-8.1.2 - 2025-01-09
+> 
+> 
+> <details>
+> <summary> Use the promises namespace of balena-image-fs [Thodoris Greasidis] </summary>
+> 
+>> #### balena-image-fs-7.3.0 - 2025-01-06
+>> 
+>> * Drop Bluebird from devDependencies [Thodoris Greasidis]
+>> * flowzone: Remove empty with clause [Thodoris Greasidis]
+>> * Add the promises namespace as part of the exposed fs [Thodoris Greasidis]
+>> 
+>> #### balena-image-fs-7.2.2 - 2024-01-02
+>> 
+>> * Update dependency @types/node to v20 [Self-hosted Renovate Bot]
+>> 
+>> #### balena-image-fs-7.2.1 - 2023-12-19
+>> 
+>> * Remove repo config from flowzone.yml [Kyle Harding]
+>> 
+>> #### balena-image-fs-7.2.0 - 2023-01-20
+>> 
+>> * Add support for Node 18 [Akis Kesoglou]
+>> 
+>> #### balena-image-fs-7.1.2 - 2023-01-05
+>> 
+>> * Update dependencies [ab77]
+>> 
+>> #### balena-image-fs-7.1.1 - 2022-12-20
+>> 
+>> * Update dependency jsdoc-to-markdown to 8.0.0 [Renovate Bot]
+>> 
+>> #### balena-image-fs-7.1.0 - 2022-12-13
+>> 
+>> * update dependencies [Zane Hitchcox]
+>> 
+> 
+> </details>
+> 
+> 
+> ### balena-device-init-8.1.1 - 2025-01-06
+> 
+> * Convert some parts to async await and simplify [Thodoris Greasidis]
+> * Avoid unnecessary destructuring [Thodoris Greasidis]
+> 
+
+</details>
+
+## 20.2.1 - 2025-01-01
+
+
+<details>
+<summary> Update balena-preload to 17.0.0 [Thodoris Greasidis] </summary>
+
+> ### balena-preload-17.0.0 - 2024-10-21
+> 
+> * Improve typings [Thodoris Greasidis]
+> * Stop returning Bluebird promises & drop it from the dependencies [Thodoris Greasidis]
+> 
+
+</details>
+
+## 20.2.0 - 2024-12-31
+
+
+<details>
+<summary> os configure: Give precedence to the boot partition located in the image over the device-type.json contents [Thodoris Greasidis] </summary>
+
+> ### balena-device-init-8.1.0 - Invalid date
+> 
+> * Try to find the boot partition by inspecting the image [Thodoris Greasidis]
+> 
+> ### balena-device-init-8.0.1 - 2024-12-19
+> 
+> * Drop the unnecessary eslint.config.js [Thodoris Greasidis]
+> * packacke.json: Explicitly set type commonjs [Thodoris Greasidis]
+> 
+
+</details>
+
+## 20.1.6 - 2024-12-30
+
+* Add more realistic os configure tests [Thodoris Greasidis]
+
+## 20.1.5 - 2024-12-20
+
+* Update shrinkwrapped express to v4.21.2 [Oskar Williams]
+
+## 20.1.4 - 2024-12-20
+
+
+<details>
+<summary> Update balena-device-init to 8.0.0 [Thodoris Greasidis] </summary>
+
+> ### balena-device-init-8.0.0 - 2024-12-18
+> 
+> * Avoid running linting in the custom tests [Thodoris Greasidis]
+> * Stop returning Bluebird promises [Thodoris Greasidis]
+> * package: Publish only the build & typings folders [Thodoris Greasidis]
+> * Convert to TypeScript with es6 module notation [Thodoris Greasidis]
+> * Replace gulp, coffeelint & mochainon with tsc, @balena/lint, mocha, chai & sinon [Thodoris Greasidis]
+> * Drop support for node <20.6.0 [Thodoris Greasidis]
+> 
+> ### balena-device-init-7.0.2 - 2024-12-17
+> 
+> * flowzone: Update runner versions [Thodoris Greasidis]
+> * Pin etcher-sdk to 9.0.8 to match resin-device-operations and fix tests [Thodoris Greasidis]
+> 
+
+</details>
+
+## 20.1.3 - 2024-12-20
+
+* Update oclif to 4.17.0 and @oclif/core 4.1.0 [Otavio Jacobi]
+
+## 20.1.2 - 2024-12-17
+
+* Remove unnecessary `Promise.resolve` and `Promise.reject` [Pagan Gazzard]
+
+## 20.1.1 - 2024-12-16
+
+* Update @balena/lint to v9.1.3 [Otavio Jacobi]
+
+## 20.1.0 - 2024-12-12
+
+* `device os-update`: Add handling for updates that require takeover [myarmolinsky]
+* Update `balena-sdk` [myarmolinsky]
+* Update `@balena/compose` [myarmolinsky]
+
+## 20.0.9 - 2024-12-05
+
+* Update shrinkwrapped express to v4.21.1 [Oskar Williams]
+
+## 20.0.8 - 2024-12-04
+
+* Run test and publish with macos-13 [Otavio Jacobi]
+
+## 20.0.7 - 2024-11-23
+
+* Update TypeScript to 5.7.2 [Thodoris Greasidis]
+
+## 20.0.6 - 2024-11-08
+
+* Refactor balena build for clarity [Thodoris Greasidis]
+
+## 20.0.5 - 2024-11-05
+
+* Update actions/upload-artifact digest to b4b15b8 [balena-renovate[bot]]
+
+## 20.0.4 - 2024-11-05
+
+* Update actions/setup-node digest to 39370e3 [balena-renovate[bot]]
+
+## 20.0.3 - 2024-11-05
+
+* api-key generate: Display a descriptive error when the generation fails due to a stale JWT [Thodoris Greasidis]
+
+## 20.0.2 - 2024-10-29
+
+* Restore ability to cat key into `ssh-key add` [myarmolinsky]
+
+## 20.0.1 - 2024-10-29
+
+* Fix sending input to some aliases not working [myarmolinsky]
+
+## 20.0.0 - 2024-10-25
+
+* `device update`: Use detached HUP for os updates [jaomaloy]
+* Drop `-h` flag for help and stop manually adding `help` per command in favor of oclif automatically adding it [myarmolinsky]
+* Stop checking for very old, long-removed commands [myarmolinsky]
+* Deprecate `devices supported` command in favor of `device-type list` [myarmolinsky]
+* Deprecate `notes` command in favor of `device note` [myarmolinsky]
+* Deprecate `tunnel` command in favor of `device tunnel` [myarmolinsky]
+* Deprecate `env add` in favor of `env set` [myarmolinsky]
+* Deprecate `ssh` command in favor of `device ssh` [myarmolinsky]
+* Deprecate `logs` command in favor of `device logs` [myarmolinsky]
+* Deprecate `scan` command in favor of `device detect` [myarmolinsky]
+* Deprecate `orgs` command in favor of `organization list` [myarmolinsky]
+* Deprecate `tags` command in favor of `tag list` [myarmolinsky]
+* Deprecate `envs` command in favor of `env list` [myarmolinsky]
+* Deprecate `key` commands in favor of `ssh-key` [myarmolinsky]
+* Deprecate `keys` command in favor of `key list` [myarmolinsky]
+* Deprecate `releases` command in favor of `release list` [myarmolinsky]
+* Deprecate `fleets` command in favor of `fleet list` [myarmolinsky]
+* Deprecate `api-keys` command in favor of `api-key list` [myarmolinsky]
+* Deprecate `devices` command in favor of `device list` [myarmolinsky]
+* Docs: Show whether an alias is deprecated [myarmolinsky]
+* Update `balena-preload` to 16.0.0 [myarmolinsky]
+* Tests: Drop unused `my_application` resource mock [myarmolinsky]
+* Rename `device.overall_status` values: `IDLE` to `OPERATIONAL`, `OFFLINE` to `DISCONNECTED`; add `REDUCED_FUNCTIONALITY` [myarmolinsky]
+* Update `@balena/compose` to 5.0.0 [myarmolinsky]
+* Bump balena-sdk to 20.3.0 [myarmolinsky]
+
+## 19.16.0 - 2024-10-23
+
+* device-type list: Add `--all` flag for including no longer supported device types in the list [myarmolinsky]
+* Add alias `device-type list` for command `devices supported` [myarmolinsky]
+
+## 19.15.0 - 2024-10-23
+
+* Add alias `device note` for command `notes` [myarmolinsky]
+
+## 19.14.0 - 2024-10-22
+
+* Add alias `device tunnel` for command `tunnel` [myarmolinsky]
+
+## 19.13.1 - 2024-10-21
+
+* Update dependency chalk to v4 [Self-hosted Renovate Bot]
+
+## 19.13.0 - 2024-10-21
+
+* Add alias `env set` for command `env add` [myarmolinsky]
+
+## 19.12.1 - 2024-10-21
+
+* Update `@oclif/core` [myarmolinsky]
+
+## 19.12.0 - 2024-10-21
+
+* Add alias `device ssh` for `ssh` command [myarmolinsky]
+
+## 19.11.1 - 2024-10-21
+
+* Update dependency sinon to v19 [Self-hosted Renovate Bot]
+
+## 19.11.0 - 2024-10-21
+
+* Add alias `device logs` for `logs` [myarmolinsky]
+* git mv `logs/index` to `device/logs` [myarmolinsky]
+
+## 19.10.0 - 2024-10-21
+
+* Add alias `device detect` for `scan` [myarmolinsky]
+
+## 19.9.0 - 2024-10-18
+
+* Add alias `organization list` for `orgs` command [myarmolinsky]
+
+## 19.8.0 - 2024-10-18
+
+* Add alias `tag list` for `tags` command [myarmolinsky]
+
+## 19.7.0 - 2024-10-18
+
+* Add alias `env list` for command `envs` [myarmolinsky]
+
+## 19.6.0 - 2024-10-18
+
+* Add `ssh-key` as aliases for all `key` commands [myarmolinsky]
+
+## 19.5.0 - 2024-10-17
+
+* Add `key list` alias for `keys` command [myarmolinsky]
+
+## 19.4.0 - 2024-10-16
+
+* Add `release list` alias for `releases` command [myarmolinsky]
+
+## 19.3.0 - 2024-10-16
+
+* Add alias `fleet list` for `fleets` command [myarmolinsky]
+
+## 19.2.0 - 2024-10-16
+
+* Add alias `api-key list` for command `api-keys` [myarmolinsky]
+
 ## 19.1.3 - 2024-10-16

 * Remove custom sorting of OS commands in docs in favor of alphabetizing [myarmolinsky]
--- a/INSTALL-ADVANCED.md
+++ b/INSTALL-ADVANCED.md
@ -145,7 +145,7 @@ container) in order to allow npm scripts like `postinstall` to be executed.

 ## Additional Dependencies

-The `balena ssh`, `scan`, `build`, `deploy` and `preload` commands may require
+The `balena device ssh`, `device detect`, `build`, `deploy` and `preload` commands may require
 additional software to be installed. Check the Additional Dependencies sections for each operating
 system:

--- a/INSTALL-LINUX.md
+++ b/INSTALL-LINUX.md
@ -33,7 +33,7 @@ as described above.

 ## sudo configuration

-A few CLI commands require execution through sudo, e.g. `sudo balena scan`.  
+A few CLI commands require execution through sudo, e.g. `sudo balena device detect`.  
 If your Linux distribution has an `/etc/sudoers` file that defines a `secure_path`
 setting, run `sudo visudo` to edit it and add the balena CLI's installation folder to
 the ***pre-existing*** `secure_path` setting, for example:
@ -61,19 +61,19 @@ instructions](https://docs.docker.com/install/overview/) to install Docker on th
 workstation as the balena CLI. The [advanced installation
 options](./INSTALL-ADVANCED.md#additional-dependencies) document describes other possibilities.

-### balena ssh
+### balena device ssh

-The `balena ssh` command requires the `ssh` command-line tool to be available. Most Linux
+The `balena device ssh` command requires the `ssh` command-line tool to be available. Most Linux
 distributions will already have it installed. Otherwise, `sudo apt-get install openssh-client`
 should do the trick on Debian or Ubuntu.

-The `balena ssh` command also requires an SSH key to be added to your balena account: see [SSH
+The `balena device ssh` command also requires an SSH key to be added to your balena account: see [SSH
 Access documentation](https://www.balena.io/docs/learn/manage/ssh-access/). The `balena key*`
 command set can also be used to list and manage SSH keys: see `balena help -v`.

-### balena scan
+### balena device detect

-The `balena scan` command requires a multicast DNS (mDNS) service like
+The `balena device detect` command requires a multicast DNS (mDNS) service like
 [Avahi](https://en.wikipedia.org/wiki/Avahi_(software)), which is installed by default on most
 desktop Linux distributions. Otherwise, on Debian or Ubuntu, the installation command would be
 `sudo apt-get install avahi-daemon`.
--- a/INSTALL-MAC.md
+++ b/INSTALL-MAC.md
@ -19,7 +19,7 @@ Selected operating system: **macOS**
   - On the terminal prompt, type `balena version` and hit Enter. It should display
     the version of the balena CLI that you have installed.

-No further steps are required to run most CLI commands. The `balena ssh`, `build`, `deploy`
+No further steps are required to run most CLI commands. The `balena device ssh`, `build`, `deploy`
 and `preload` commands may require additional software to be installed, as described
 in the next section.

@ -41,9 +41,9 @@ instructions](https://docs.docker.com/install/overview/) to install Docker on th
 workstation as the balena CLI. The [advanced installation
 options](./INSTALL-ADVANCED.md#additional-dependencies) document describes other possibilities.

-### balena ssh
+### balena device ssh

-The `balena ssh` command requires the `ssh` command-line tool to be available. To check whether
+The `balena device ssh` command requires the `ssh` command-line tool to be available. To check whether
 it is already installed, run `ssh` on a Terminal window. If it is not yet installed, the options
 include:

@ -52,7 +52,7 @@ include:
  Components → Command Line Tools → Install.
 * Or, install [Homebrew](https://brew.sh/), then `brew install openssh`

-The `balena ssh` command also requires an SSH key to be added to your balena account: see [SSH
+The `balena device ssh` command also requires an SSH key to be added to your balena account: see [SSH
 Access documentation](https://www.balena.io/docs/learn/manage/ssh-access/). The `balena key*`
 command set can also be used to list and manage SSH keys: see `balena help -v`.

--- a/INSTALL-WINDOWS.md
+++ b/INSTALL-WINDOWS.md
@ -19,7 +19,7 @@ Selected operating system: **Windows**
   - On the command prompt, type `balena version` and hit Enter. It should display
     the version of the balena CLI that you have installed.

-No further steps are required to run most CLI commands. The `balena ssh`, `scan`, `build`,
+No further steps are required to run most CLI commands. The `balena device ssh`, `device detect`, `build`,
 `deploy` and `preload` commands may require additional software to be installed, as
 described below.

@ -34,9 +34,9 @@ instructions](https://docs.docker.com/install/overview/) to install Docker on th
 workstation as the balena CLI. The [advanced installation
 options](./INSTALL-ADVANCED.md#additional-dependencies) document describes other possibilities.

-### balena ssh
+### balena device ssh

-The `balena ssh` command requires the `ssh` command-line tool to be available. Microsoft started
+The `balena device ssh` command requires the `ssh` command-line tool to be available. Microsoft started
 distributing an SSH client with Windows 10, which is automatically installed through Windows
 Update. To check whether it is installed, run `ssh` on a Windows Command Prompt or PowerShell. It
 can also be [manually
@ -44,13 +44,13 @@ installed](https://docs.microsoft.com/en-us/windows-server/administration/openss
 if needed. For older versions of Windows, there are several ssh/OpenSSH clients provided by 3rd
 parties.

-The `balena ssh` command also requires an SSH key to be added to your balena account: see [SSH
+The `balena device ssh` command also requires an SSH key to be added to your balena account: see [SSH
 Access documentation](https://www.balena.io/docs/learn/manage/ssh-access/). The `balena key*`
 command set can also be used to list and manage SSH keys: see `balena help -v`.

-### balena scan
+### balena device detect

-The `balena scan` command requires a multicast DNS (mDNS) service like Apple's Bonjour.
+The `balena device detect` command requires a multicast DNS (mDNS) service like Apple's Bonjour.
 Many Windows machines will already have this service installed, as it is bundled in popular
 applications such as Skype (Wikipedia lists [several others](https://en.wikipedia.org/wiki/Bonjour_(software))).
 Otherwise, Bonjour for Windows can be downloaded and installed from: https://support.apple.com/kb/DL999
--- a/README.md
+++ b/README.md
@ -88,9 +88,9 @@ HTTP(S) proxies can be configured through any of the following methods, in prece
 * The `HTTPS_PROXY` and/or `HTTP_PROXY` environment variables, in the same URL format as
  `BALENARC_PROXY`.

-### Proxy setup for balena ssh
+### Proxy setup for balena device ssh

-In order to work behind a proxy server, the `balena ssh` command requires the
+In order to work behind a proxy server, the `balena device ssh` command requires the
 [`proxytunnel`](http://proxytunnel.sourceforge.net/) package (command-line tool) to be installed.
 `proxytunnel` is available for Linux distributions like Ubuntu/Debian (`apt install proxytunnel`),
 and for macOS through [Homebrew](https://brew.sh/). Windows support is limited to the [Windows
@ -110,7 +110,7 @@ The `BALENARC_NO_PROXY` variable may be used to exclude specified destinations f
 > * This feature requires CLI version 11.30.8 or later. In the case of the npm [installation
 >   option](https://github.com/balena-io/balena-cli/blob/master/INSTALL.md), it also requires
 >   Node.js version 10.16.0 or later.
-> * To exclude a `balena ssh` target from proxying (IP address or `.local` hostname), the
+> * To exclude a `balena device ssh` target from proxying (IP address or `.local` hostname), the
 >   `--noproxy` option should be specified in addition to the `BALENARC_NO_PROXY` variable.

 By default (if `BALENARC_NO_PROXY` is not defined), all [private IPv4
--- a/TROUBLESHOOTING.md
+++ b/TROUBLESHOOTING.md
@ -31,7 +31,7 @@ command again.

 Check whether the SD card is locked (a physical switch on the side of the card).

-## I get `connect ETIMEDOUT` with `balena tunnel`
+## I get `connect ETIMEDOUT` with `balena device tunnel`

 Please update the CLI to the latest version. This issue was fixed in v12.38.5.
 For more details, see: https://github.com/balena-io/balena-cli/issues/2172
@ -79,10 +79,10 @@ Try resetting the ownership by running:
 $ sudo chown -R <user> $HOME/.balena
 ```

-## Broken line wrapping / cursor behavior with `balena ssh`
+## Broken line wrapping / cursor behavior with `balena device ssh`

 Users sometimes come across broken line wrapping or cursor behavior in text terminals, for example
-when long command lines are typed in a `balena ssh` session, or when using text editors like `vim`
+when long command lines are typed in a `balena device ssh` session, or when using text editors like `vim`
 or `nano`. This is not something specific to the balena CLI, being also a commonly reported issue
 with standard remote terminal tools like `ssh` or `telnet`.  It is often a remote shell
 configuration issue (files like `/etc/profile`, `~/.bash_profile`, `~/.bash_login`, `~/.profile`
--- a/automation/build-bin.ts
+++ b/automation/build-bin.ts
@ -305,7 +305,7 @@ async function zipPkg() {
 		);
 	}
 	await fs.mkdirp(path.dirname(outputFile));
-	await new Promise((resolve, reject) => {
+	await new Promise<void>((resolve, reject) => {
 		console.log(`Zipping standalone package to "${outputFile}"...`);

 		const archive = archiver('zip', {
--- a/automation/capitanodoc/capitanodoc.ts
+++ b/automation/capitanodoc/capitanodoc.ts
@ -52,21 +52,15 @@ interface Documentation {
 // Mapping folders names to custom headings in the docs
 const commandHeadings: { [key: string]: string } = {
 	'api-key': 'API Keys',
-	'api-keys': 'API Keys',
 	login: 'Authentication',
 	whoami: 'Authentication',
 	logout: 'Authentication',
 	env: 'Environment Variables',
-	envs: 'Environment Variables',
 	help: 'Help and Version',
-	key: 'SSH Keys',
-	keys: 'SSH Keys',
-	orgs: 'Organizations',
+	'ssh-key': 'SSH Keys',
+	organization: 'Organizations',
 	os: 'OS',
 	util: 'Utilities',
-	ssh: 'Network',
-	scan: 'Network',
-	tunnel: 'Network',
 	build: 'Deploy',
 	join: 'Platform',
 	leave: 'Platform',
@ -151,7 +145,7 @@ export async function getCapitanoDoc(): Promise<typeof capitanoDoc> {
 				throw new Error(`Error parsing section title`);
 			}
 			// match[1] has the title, match[2] has the rest
-			return match && match[2];
+			return match?.[2];
 		}),
 		mdParser.getSectionOfTitle('Installation'),
 		mdParser.getSectionOfTitle('Choosing a shell (command prompt/terminal)'),
--- a/automation/capitanodoc/markdown.ts
+++ b/automation/capitanodoc/markdown.ts
@ -25,7 +25,14 @@ function renderOclifCommand(command: Category['commands'][0]): string[] {
 	const result = [`## ${ent.encode(command.name || '')}`];
 	if (command.aliases?.length) {
 		result.push('### Aliases');
-		result.push(command.aliases.map((alias) => `- \`${alias}\``).join('\n'));
+		result.push(
+			command.aliases
+				.map(
+					(alias) =>
+						`- \`${alias}\`${command.deprecateAliases ? ' *(deprecated)*' : ''}`,
+				)
+				.join('\n'),
+		);
 		result.push(
 			`\nTo use one of the aliases, replace \`${command.name}\` with the alias.`,
 		);
--- a/automation/update-module.ts
+++ b/automation/update-module.ts
@ -3,7 +3,7 @@ import * as semver from 'semver';

 const changeTypes = ['major', 'minor', 'patch'] as const;

-const validateChangeType = (maybeChangeType: string = 'minor') => {
+const validateChangeType = (maybeChangeType = 'minor') => {
 	maybeChangeType = maybeChangeType.toLowerCase();
 	switch (maybeChangeType) {
 		case 'patch':
@ -136,5 +136,4 @@ async function main() {
 	}
 }

-// eslint-disable-next-line @typescript-eslint/no-floating-promises
-main();
+void main();
--- a/automation/utils.ts
+++ b/automation/utils.ts
@ -19,6 +19,7 @@ import { spawn } from 'child_process';
 import * as path from 'path';
 import * as fs from 'fs';
 import { diffTrimmedLines } from 'diff';
+import * as whichMod from 'which';

 export const ROOT = path.join(__dirname, '..');

@ -101,7 +102,6 @@ export function loadPackageJson() {
 * @returns The program's full path, e.g. 'C:\WINDOWS\System32\OpenSSH\ssh.EXE'
 */
 export async function which(program: string): Promise<string> {
-	const whichMod = await import('which');
 	let programPath: string;
 	try {
 		programPath = await whichMod(program);
@ -132,7 +132,7 @@ export async function whichSpawn(
 					.on('error', reject)
 					.on('close', resolve);
 			} catch (err) {
-				reject(err);
+				reject(err as Error);
 			}
 		});
 	} catch (err) {
--- a/bin/dev.js
+++ b/bin/dev.js
@ -57,7 +57,10 @@ require('ts-node').register({
 	project: path.join(rootDir, 'tsconfig.json'),
 	transpileOnly: true,
 });
-require('../src/app').run(undefined, { dir: __dirname, development: true });
+void require('../src/app').run(undefined, {
+	dir: __dirname,
+	development: true,
+});

 // Modify package.json oclif paths from build/ -> src/, or vice versa
 function modifyOclifPaths(revert) {
--- a/bin/run.js
+++ b/bin/run.js
@ -5,7 +5,7 @@
 process.env.UV_THREADPOOL_SIZE = '64';

 // Disable oclif registering ts-node
-process.env.OCLIF_TS_NODE = 0;
+process.env.OCLIF_TS_NODE = '0';

 async function run() {
 	// Use fast-boot to cache require lookups, speeding up startup
@ -18,4 +18,4 @@ async function run() {
 	await require('../build/app').run(undefined, { dir: __dirname });
 }

-run();
+void run();
--- a/completion/_balena
+++ b/completion/_balena
@ -8,27 +8,28 @@ _balena() {
  local context state line curcontext="$curcontext"

  # Valid top-level completions
-  main_commands=( api-key api-keys app block build config deploy device devices env envs fleet fleets internal join key keys leave local login logout logs notes orgs os preload push release releases scan settings ssh support tag tags tunnel util version whoami )
+  main_commands=( api-key app block build config deploy device device-type env fleet internal join leave local login logout organization os preload push release settings ssh-key support tag util version whoami )
  # Sub-completions
-  api_key_cmds=( generate revoke )
+  api_key_cmds=( generate list revoke )
  app_cmds=( create )
  block_cmds=( create )
  config_cmds=( generate inject read reconfigure write )
-  device_cmds=( deactivate identify init list local-mode move os-update pin public-url purge reboot register rename restart rm shutdown start-service stop-service track-fleet )
-  devices_cmds=( supported )
-  env_cmds=( add rename rm )
-  fleet_cmds=( create pin purge rename restart rm track-latest )
+  device_type_cmds=( list )
+  device_cmds=( deactivate detect identify init list local-mode logs move note os-update pin public-url purge reboot register rename restart rm shutdown ssh start-service stop-service track-fleet tunnel )
+  env_cmds=( list rename rm set )
+  fleet_cmds=( create list pin purge rename restart rm track-latest )
  internal_cmds=( osinit )
-  key_cmds=( add rm )
  local_cmds=( configure flash )
+  organization_cmds=( list )
  os_cmds=( build-config configure download initialize versions )
-  release_cmds=( finalize invalidate validate )
-  tag_cmds=( rm set )
+  release_cmds=( finalize invalidate list validate )
+  ssh_key_cmds=( add list rm )
+  tag_cmds=( list rm set )


  _arguments -C \
    '(- 1 *)--version[show version and exit]' \
-    '(- 1 *)'{-h,--help}'[show help options and exit]' \
+    '(- 1 *)--help[show help options and exit]' \
    '1:first command:_balena_main_cmds' \
    '2:second command:_balena_sec_cmds' \
  && ret=0
@ -54,12 +55,12 @@ _balena_sec_cmds() {
      "config")
        _describe -t config_cmds 'config_cmd' config_cmds "$@" && ret=0
      ;;
+      "device-type")
+        _describe -t device_type_cmds 'device-type_cmd' device_type_cmds "$@" && ret=0
+      ;;
      "device")
        _describe -t device_cmds 'device_cmd' device_cmds "$@" && ret=0
      ;;
-      "devices")
-        _describe -t devices_cmds 'devices_cmd' devices_cmds "$@" && ret=0
-      ;;
      "env")
        _describe -t env_cmds 'env_cmd' env_cmds "$@" && ret=0
      ;;
@ -69,18 +70,21 @@ _balena_sec_cmds() {
      "internal")
        _describe -t internal_cmds 'internal_cmd' internal_cmds "$@" && ret=0
      ;;
-      "key")
-        _describe -t key_cmds 'key_cmd' key_cmds "$@" && ret=0
-      ;;
      "local")
        _describe -t local_cmds 'local_cmd' local_cmds "$@" && ret=0
      ;;
+      "organization")
+        _describe -t organization_cmds 'organization_cmd' organization_cmds "$@" && ret=0
+      ;;
      "os")
        _describe -t os_cmds 'os_cmd' os_cmds "$@" && ret=0
      ;;
      "release")
        _describe -t release_cmds 'release_cmd' release_cmds "$@" && ret=0
      ;;
+      "ssh-key")
+        _describe -t ssh_key_cmds 'ssh-key_cmd' ssh_key_cmds "$@" && ret=0
+      ;;
      "tag")
        _describe -t tag_cmds 'tag_cmd' tag_cmds "$@" && ret=0
      ;;
--- a/completion/balena-completion.bash
+++ b/completion/balena-completion.bash
@ -7,22 +7,23 @@ _balena_complete()
  local cur prev

  # Valid top-level completions
-  main_commands="api-key api-keys app block build config deploy device devices env envs fleet fleets internal join key keys leave local login logout logs notes orgs os preload push release releases scan settings ssh support tag tags tunnel util version whoami"
+  main_commands="api-key app block build config deploy device device-type env fleet internal join leave local login logout organization os preload push release settings ssh-key support tag util version whoami"
  # Sub-completions
-  api_key_cmds="generate revoke"
+  api_key_cmds="generate list revoke"
  app_cmds="create"
  block_cmds="create"
  config_cmds="generate inject read reconfigure write"
-  device_cmds="deactivate identify init list local-mode move os-update pin public-url purge reboot register rename restart rm shutdown start-service stop-service track-fleet"
-  devices_cmds="supported"
-  env_cmds="add rename rm"
-  fleet_cmds="create pin purge rename restart rm track-latest"
+  device_type_cmds="list"
+  device_cmds="deactivate detect identify init list local-mode logs move note os-update pin public-url purge reboot register rename restart rm shutdown ssh start-service stop-service track-fleet tunnel"
+  env_cmds="list rename rm set"
+  fleet_cmds="create list pin purge rename restart rm track-latest"
  internal_cmds="osinit"
-  key_cmds="add rm"
  local_cmds="configure flash"
+  organization_cmds="list"
  os_cmds="build-config configure download initialize versions"
-  release_cmds="finalize invalidate validate"
-  tag_cmds="rm set"
+  release_cmds="finalize invalidate list validate"
+  ssh_key_cmds="add list rm"
+  tag_cmds="list rm set"



@ -48,12 +49,12 @@ _balena_complete()
      config)
        COMPREPLY=( $(compgen -W "$config_cmds" -- $cur) )
        ;;
+      device-type)
+        COMPREPLY=( $(compgen -W "$device_type_cmds" -- $cur) )
+        ;;
      device)
        COMPREPLY=( $(compgen -W "$device_cmds" -- $cur) )
        ;;
-      devices)
-        COMPREPLY=( $(compgen -W "$devices_cmds" -- $cur) )
-        ;;
      env)
        COMPREPLY=( $(compgen -W "$env_cmds" -- $cur) )
        ;;
@ -63,18 +64,21 @@ _balena_complete()
      internal)
        COMPREPLY=( $(compgen -W "$internal_cmds" -- $cur) )
        ;;
-      key)
-        COMPREPLY=( $(compgen -W "$key_cmds" -- $cur) )
-        ;;
      local)
        COMPREPLY=( $(compgen -W "$local_cmds" -- $cur) )
        ;;
+      organization)
+        COMPREPLY=( $(compgen -W "$organization_cmds" -- $cur) )
+        ;;
      os)
        COMPREPLY=( $(compgen -W "$os_cmds" -- $cur) )
        ;;
      release)
        COMPREPLY=( $(compgen -W "$release_cmds" -- $cur) )
        ;;
+      ssh-key)
+        COMPREPLY=( $(compgen -W "$ssh_key_cmds" -- $cur) )
+        ;;
      tag)
        COMPREPLY=( $(compgen -W "$tag_cmds" -- $cur) )
        ;;
--- a/completion/templates/zsh.template
+++ b/completion/templates/zsh.template
@ -14,7 +14,7 @@ $sub_cmds$

  _arguments -C \
    '(- 1 *)--version[show version and exit]' \
-    '(- 1 *)'{-h,--help}'[show help options and exit]' \
+    '(- 1 *)--help[show help options and exit]' \
    '1:first command:_balena_main_cmds' \
    '2:second command:_balena_sec_cmds' \
  && ret=0
--- a/docs/balena-cli.md
+++ b/docs/balena-cli.md
--- a/eslint.config.js
+++ b/eslint.config.js
@ -0,0 +1,32 @@
+const { FlatCompat } = require('@eslint/eslintrc');
+
+const compat = new FlatCompat({
+	baseDirectory: __dirname,
+});
+module.exports = [
+	...require('@balena/lint/config/eslint.config'),
+	...compat.config({
+		parserOptions: {
+			project: 'tsconfig.dev.json',
+		},
+		ignorePatterns: ['**/generate-completion.js', '**/bin/**/*'],
+		rules: {
+			ignoreDefinitionFiles: 0,
+			'@typescript-eslint/no-non-null-assertion': 'off',
+			'@typescript-eslint/no-shadow': 'off',
+			'@typescript-eslint/no-var-requires': 'off',
+			'@typescript-eslint/no-require-imports': 'off',
+			'@typescript-eslint/no-unnecessary-type-assertion': 'off',
+			'@typescript-eslint/prefer-nullish-coalescing': 'warn',
+
+			'no-restricted-imports': ['error', {
+				paths: ['resin-cli-visuals', 'chalk', 'common-tags', 'resin-cli-form'],
+			}],
+
+			'@typescript-eslint/no-unused-vars': ['error', {
+				argsIgnorePattern: '^_',
+				caughtErrorsIgnorePattern: '^_',
+			}],
+		},
+	}),
+];
--- a/npm-shrinkwrap.json
+++ b/npm-shrinkwrap.json
--- a/package.json
+++ b/package.json
@ -1,6 +1,6 @@
 {
  "name": "balena-cli",
-  "version": "19.1.3",
+  "version": "21.0.0",
  "description": "The official balena Command Line Interface",
  "main": "./build/app.js",
  "homepage": "https://github.com/balena-io/balena-cli",
@ -58,6 +58,7 @@
    "build:completion": "node completion/generate-completion.js",
    "build:standalone": "ts-node --transpile-only automation/run.ts build:standalone",
    "build:installer": "ts-node --transpile-only automation/run.ts build:installer",
+    "deduplicate-dependencies": "npm dd && git add npm-shrinkwrap.json && git commit --message \"Deduplicate dependencies\"",
    "package": "npm run build:fast && npm run build:standalone && npm run build:installer",
    "pretest": "npm run build",
    "test": "npm run test:shrinkwrap && npm run test:core",
@ -111,7 +112,7 @@
    }
  },
  "devDependencies": {
-    "@balena/lint": "^8.0.0",
+    "@balena/lint": "^9.1.3",
    "@electron/notarize": "^2.0.0",
    "@types/archiver": "^6.0.2",
    "@types/bluebird": "^3.5.36",
@ -180,41 +181,42 @@
    "mock-fs": "^5.2.0",
    "mock-require": "^3.0.3",
    "nock": "^13.2.1",
-    "oclif": "^4.14.0",
+    "oclif": "^4.17.0",
    "rewire": "^7.0.0",
    "simple-git": "^3.14.1",
-    "sinon": "^18.0.0",
+    "sinon": "^19.0.0",
    "string-to-stream": "^3.0.1",
    "ts-node": "^10.4.0",
-    "typescript": "^5.6.2"
+    "typescript": "^5.8.2"
  },
  "dependencies": {
-    "@balena/compose": "^4.0.1",
+    "@balena/compose": "^6.0.0",
    "@balena/dockerignore": "^1.0.2",
    "@balena/env-parsing": "^1.1.8",
    "@balena/es-version": "^1.0.1",
-    "@oclif/core": "^4.0.8",
+    "@oclif/core": "^4.1.0",
    "@sentry/node": "^6.16.1",
-    "balena-config-json": "^4.2.0",
-    "balena-device-init": "^7.0.1",
+    "balena-config-json": "^4.2.2",
+    "balena-device-init": "^8.1.3",
    "balena-errors": "^4.7.3",
-    "balena-image-fs": "^7.0.6",
-    "balena-preload": "^15.0.6",
-    "balena-sdk": "^19.7.3",
+    "balena-image-fs": "^7.3.0",
+    "balena-preload": "^18.0.1",
+    "balena-sdk": "^21.2.1",
    "balena-semver": "^2.3.0",
    "balena-settings-client": "^5.0.2",
    "balena-settings-storage": "^8.1.0",
    "body-parser": "^1.19.1",
    "bonjour-service": "^1.2.1",
-    "chalk": "^3.0.0",
+    "chalk": "^4.0.0",
    "chokidar": "^3.5.2",
    "cli-truncate": "^2.1.0",
    "color-hash": "^1.1.1",
    "common-tags": "^1.7.2",
+    "date-fns": "^4.1.0",
    "denymount": "^2.3.0",
-    "docker-modem": "^5.0.3",
+    "docker-modem": "5.0.5",
    "docker-progress": "^5.1.3",
-    "dockerode": "^4.0.2",
+    "dockerode": "4.0.3",
    "ejs": "^3.1.6",
    "etcher-sdk": "9.1.0",
    "express": "^4.17.2",
@ -231,6 +233,7 @@
    "is-root": "^2.1.0",
    "js-yaml": "^4.1.0",
    "JSONStream": "^1.0.3",
+    "jwt-decode": "^3.1.2",
    "livepush": "^3.5.1",
    "lodash": "^4.17.21",
    "mime": "^2.4.6",
@ -273,6 +276,6 @@
    }
  },
  "versionist": {
-    "publishedAt": "2024-10-16T14:39:25.494Z"
+    "publishedAt": "2025-03-11T14:42:29.446Z"
  }
 }
--- a/patches/all/@oclif+core+4.0.18.patch
+++ b/patches/all/@oclif+core+4.0.18.patch
@ -1,5 +1,5 @@
 diff --git a/node_modules/@oclif/core/lib/help/command.js b/node_modules/@oclif/core/lib/help/command.js
-index 90922c8..6b7f417 100644
+index 33105a0..0436982 100644
 --- a/node_modules/@oclif/core/lib/help/command.js
 +++ b/node_modules/@oclif/core/lib/help/command.js
@@ -58,7 +58,8 @@ class CommandHelp extends formatter_1.HelpFormatter {
@ -13,10 +13,10 @@ index 90922c8..6b7f417 100644
             if (a.default)
                 description = `${(0, theme_1.colorize)(this.config?.theme?.flagDefaultValue, `[default: ${a.default}]`)} ${description}`;
 diff --git a/node_modules/@oclif/core/lib/help/index.js b/node_modules/@oclif/core/lib/help/index.js
-index 4a34b89..d7eb6ac 100644
+index 0b48c0e..ff4fed4 100644
 --- a/node_modules/@oclif/core/lib/help/index.js
 +++ b/node_modules/@oclif/core/lib/help/index.js
-@@ -172,11 +172,12 @@ class Help extends HelpBase {
+@@ -173,11 +173,12 @@ class Help extends HelpBase {
         }
         this.log(this.formatCommand(command));
         this.log('');
--- a/patches/all/oclif+4.17.0.dev.patch
+++ b/patches/all/oclif+4.17.0.dev.patch
@ -1,8 +1,8 @@
 diff --git a/node_modules/oclif/lib/commands/pack/win.js b/node_modules/oclif/lib/commands/pack/win.js
-index ef7f90e..8264b7c 100644
+index bfe9205..482519e 100644
 --- a/node_modules/oclif/lib/commands/pack/win.js
 +++ b/node_modules/oclif/lib/commands/pack/win.js
-@@ -76,6 +76,12 @@ InstallDir "\$PROGRAMFILES${arch === 'x64' ? '64' : ''}\\${config.dirname}"
+@@ -86,6 +86,12 @@ InstallDir "\$PROGRAMFILES${arch === 'x64' ? '64' : ''}\\${config.dirname}"
 ${customization}
 
 Section "${config.name} CLI \${VERSION}"
@ -16,20 +16,18 @@ index ef7f90e..8264b7c 100644
   File /r bin
   File /r client
 diff --git a/node_modules/oclif/lib/tarballs/build.js b/node_modules/oclif/lib/tarballs/build.js
-index 14d5a6e..7b42a6f 100644
+index f0c8d95..a72400e 100644
 --- a/node_modules/oclif/lib/tarballs/build.js
 +++ b/node_modules/oclif/lib/tarballs/build.js
-@@ -200,6 +200,13 @@ const extractCLI = async (tarball, c) => {
+@@ -218,6 +218,11 @@ const extractCLI = async (tarball, c) => {
         (0, promises_1.rm)(path.join(workspace, path.basename(tarball)), { recursive: true }),
         (0, fs_extra_1.remove)(path.join(workspace, 'bin', 'run.cmd')),
     ]);
-+
 +    // The oclif installers are a production installation, while the source
 +    // `bin` folder may contain a `.fast-boot.json` file of a dev installation.
 +    // This has previously led to issues preventing the CLI from starting, so
 +    // delete `.fast-boot.json` (if any) from the destination folder.
 +    await (0, fs_extra_1.remove)(path.join(workspace, 'bin', '.fast-boot.json'));
-+
 };
 const buildTarget = async (target, c, options) => {
-     const workspace = c.workspace(target);
+     if (target.platform === 'win32' && target.arch === 'arm64' && (0, semver_1.lt)(c.nodeVersion, '20.0.0')) {
--- a/repo.yml
+++ b/repo.yml
@ -6,6 +6,10 @@ upstream:
    url: 'https://github.com/balena-io/balena-sdk'
  - repo: 'balena-config-json'
    url: 'https://github.com/balena-io-modules/balena-config-json'
+  - repo: 'balena-image-fs'
+    url: 'https://github.com/balena-io-modules/balena-image-fs'
+  - repo: 'balena-device-init'
+    url: 'https://github.com/balena-io-modules/balena-device-init'
  - repo: 'balena-image-manager'
    url: 'https://github.com/balena-io-modules/balena-image-manager'
  - repo: 'balena-preload'
--- a/src/app.ts
+++ b/src/app.ts
@ -101,11 +101,9 @@ async function init() {

 /** Execute the oclif parser and the CLI command. */
 async function oclifRun(command: string[], options: AppOptions) {
-	let deprecationPromise: Promise<void>;
+	let deprecationPromise: Promise<void> | undefined;
 	// check and enforce the CLI's deprecation policy
-	if (unsupportedFlag || process.env.BALENARC_UNSUPPORTED) {
-		deprecationPromise = Promise.resolve();
-	} else {
+	if (!(unsupportedFlag || process.env.BALENARC_UNSUPPORTED)) {
 		const { DeprecationChecker } = await import('./deprecation');
 		const deprecationChecker = new DeprecationChecker(packageJSON.version);
 		// warnAndAbortIfDeprecated uses previously cached data only
--- a/src/commands/api-key/generate.ts
+++ b/src/commands/api-key/generate.ts
@ -17,8 +17,28 @@

 import { Args, Command } from '@oclif/core';
 import { ExpectedError } from '../../errors';
-import * as cf from '../../utils/common-flags';
-import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+import { getBalenaSdk, getCliForm, stripIndent } from '../../utils/lazy';
+import {
+	formatDuration,
+	intervalToDuration,
+	isValid,
+	parseISO,
+} from 'date-fns';
+
+// In days
+const durations = [1, 7, 30, 90];
+
+async function isLoggedInWithJwt() {
+	const balena = getBalenaSdk();
+	try {
+		const token = await balena.auth.getToken();
+		const { default: jwtDecode } = await import('jwt-decode');
+		jwtDecode(token);
+		return true;
+	} catch {
+		return false;
+	}
+}

 export default class GenerateCmd extends Command {
 	public static description = stripIndent`
@ -30,17 +50,21 @@ export default class GenerateCmd extends Command {
 		This key can be used to log into the CLI using 'balena login --token <key>',
 		or to authenticate requests to the API with an 'Authorization: Bearer <key>' header.
 `;
-	public static examples = ['$ balena api-key generate "Jenkins Key"'];
+	public static examples = [
+		'$ balena api-key generate "Jenkins Key"',
+		'$ balena api-key generate "Jenkins Key" 2025-10-30',
+		'$ balena api-key generate "Jenkins Key" never',
+	];

 	public static args = {
 		name: Args.string({
 			description: 'the API key name',
 			required: true,
 		}),
-	};
-
-	public static flags = {
-		help: cf.help,
+		expiryDate: Args.string({
+			description:
+				'the expiry date of the API key as an ISO date string, or "never" for no expiry',
+		}),
 	};

 	public static authenticated = true;
@ -48,11 +72,70 @@ export default class GenerateCmd extends Command {
 	public async run() {
 		const { args: params } = await this.parse(GenerateCmd);

+		let expiryDateResponse: string | number | undefined = params.expiryDate;
 		let key;
 		try {
-			key = await getBalenaSdk().models.apiKey.create(params.name);
+			if (!expiryDateResponse) {
+				expiryDateResponse = await getCliForm().ask({
+					message: 'Please pick an expiry date for the API key',
+					type: 'list',
+					choices: [...durations, 'custom', 'never'].map((duration) => ({
+						name:
+							duration === 'never'
+								? 'No expiration'
+								: typeof duration === 'number'
+									? formatDuration(
+											intervalToDuration({
+												start: 0,
+												end: duration * 24 * 60 * 60 * 1000,
+											}),
+										)
+									: 'Custom expiration',
+						value: duration,
+					})),
+				});
+			}
+			let expiryDate: Date | null;
+			if (expiryDateResponse === 'never') {
+				expiryDate = null;
+			} else if (expiryDateResponse === 'custom') {
+				do {
+					expiryDate = parseISO(
+						await getCliForm().ask({
+							message:
+								'Please enter an expiry date for the API key as an ISO date string',
+							type: 'input',
+						}),
+					);
+					if (!isValid(expiryDate)) {
+						console.error('Invalid date format');
+					}
+				} while (!isValid(expiryDate));
+			} else if (typeof expiryDateResponse === 'string') {
+				expiryDate = parseISO(expiryDateResponse);
+				if (!isValid(expiryDate)) {
+					throw new Error(
+						'Invalid date format, please use a valid ISO date string',
+					);
+				}
+			} else {
+				expiryDate = new Date(
+					Date.now() + expiryDateResponse * 24 * 60 * 60 * 1000,
+				);
+			}
+			key = await getBalenaSdk().models.apiKey.create({
+				name: params.name,
+				expiryDate: expiryDate === null ? null : expiryDate.toISOString(),
+			});
 		} catch (e) {
 			if (e.name === 'BalenaNotLoggedIn') {
+				if (await isLoggedInWithJwt()) {
+					throw new ExpectedError(stripIndent`
+						This command requires you to have been recently authenticated.
+						Please login again with 'balena login'.
+						In case you are using the Web authorization method, you need to logout and re-login to the dashboard first.
+					`);
+				}
 				throw new ExpectedError(stripIndent`
 					This command cannot be run when logged in with an API key.
 					Please login again with 'balena login' and select an alternative method.
--- a/src/commands/api-keys/index.ts
+++ b/src/commands/api-keys/index.ts
@ -19,7 +19,10 @@ import { Flags, Command } from '@oclif/core';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, getVisuals, stripIndent } from '../../utils/lazy';

-export default class ApiKeysCmd extends Command {
+export default class APIKeyListCmd extends Command {
+	public static aliases = ['api-keys'];
+	public static deprecateAliases = true;
+
 	public static description = stripIndent`
 		Print a list of balenaCloud API keys.

@ -27,10 +30,9 @@ export default class ApiKeysCmd extends Command {

 		Print a list of balenaCloud API keys for the current user or for a specific fleet with the \`--fleet\` option.
 `;
-	public static examples = ['$ balena api-keys'];
+	public static examples = ['$ balena api-key list'];

 	public static flags = {
-		help: cf.help,
 		user: Flags.boolean({
 			char: 'u',
 			description: 'show API keys for your user',
@ -41,7 +43,7 @@ export default class ApiKeysCmd extends Command {
 	public static authenticated = true;

 	public async run() {
-		const { flags: options } = await this.parse(ApiKeysCmd);
+		const { flags: options } = await this.parse(APIKeyListCmd);

 		const { getApplication } = await import('../../utils/sdk');
 		const actorId = options.fleet
@ -49,7 +51,7 @@ export default class ApiKeysCmd extends Command {
 					await getApplication(getBalenaSdk(), options.fleet, {
 						$select: 'actor',
 					})
-				).actor
+				).actor.__id
 			: await getBalenaSdk().auth.getActorId();
 		const keys = await getBalenaSdk().pine.get({
 			resource: 'api_key',
--- a/src/commands/api-key/revoke.ts
+++ b/src/commands/api-key/revoke.ts
@ -16,7 +16,6 @@
 */

 import { Args, Command } from '@oclif/core';
-import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';

 export default class RevokeCmd extends Command {
@ -40,10 +39,6 @@ export default class RevokeCmd extends Command {
 		}),
 	};

-	public static flags = {
-		help: cf.help,
-	};
-
 	public static authenticated = true;

 	public async run() {
@ -55,9 +50,9 @@ export default class RevokeCmd extends Command {
 			return;
 		}
 		await Promise.all(
-			apiKeyIds.map(
-				async (id) => await getBalenaSdk().models.apiKey.revoke(Number(id)),
-			),
+			apiKeyIds.map(async (id) => {
+				await getBalenaSdk().models.apiKey.revoke(Number(id));
+			}),
 		);
 		console.log('Successfully revoked the given API keys');
 	}
--- a/src/commands/app/create.ts
+++ b/src/commands/app/create.ts
@ -16,7 +16,6 @@
 */

 import { Flags, Args, Command } from '@oclif/core';
-import * as cf from '../../utils/common-flags';
 import { stripIndent } from '../../utils/lazy';

 export default class AppCreateCmd extends Command {
@ -28,10 +27,10 @@ export default class AppCreateCmd extends Command {
 		You can specify the organization the app should belong to using
 		the \`--organization\` option. The organization's handle, not its name,
 		should be provided. Organization handles can be listed with the
-		\`balena orgs\` command.
+		\`balena organization list\` command.

 		The app's default device type is specified with the \`--type\` option.
-		The \`balena devices supported\` command can be used to list the available
+		The \`balena device-type list\` command can be used to list the available
 		device types.

 		Interactive dropdowns will be shown for selection if no device type or
@ -62,9 +61,8 @@ export default class AppCreateCmd extends Command {
 		type: Flags.string({
 			char: 't',
 			description:
-				'app device type (Check available types with `balena devices supported`)',
+				'app device type (Check available types with `balena device-type list`)',
 		}),
-		help: cf.help,
 	};

 	public static authenticated = true;
--- a/src/commands/block/create.ts
+++ b/src/commands/block/create.ts
@ -16,7 +16,6 @@
 */

 import { Flags, Args, Command } from '@oclif/core';
-import * as cf from '../../utils/common-flags';
 import { stripIndent } from '../../utils/lazy';

 export default class BlockCreateCmd extends Command {
@ -28,10 +27,10 @@ export default class BlockCreateCmd extends Command {
 		You can specify the organization the block should belong to using
 		the \`--organization\` option. The organization's handle, not its name,
 		should be provided. Organization handles can be listed with the
-		\`balena orgs\` command.
+		\`balena organization list\` command.

 		The block's default device type is specified with the \`--type\` option.
-		The \`balena devices supported\` command can be used to list the available
+		The \`balena device-type list\` command can be used to list the available
 		device types.

 		Interactive dropdowns will be shown for selection if no device type or
@ -62,9 +61,8 @@ export default class BlockCreateCmd extends Command {
 		type: Flags.string({
 			char: 't',
 			description:
-				'block device type (Check available types with `balena devices supported`)',
+				'block device type (Check available types with `balena device-type list`)',
 		}),
-		help: cf.help,
 	};

 	public static authenticated = true;
--- a/src/commands/build/index.ts
+++ b/src/commands/build/index.ts
@ -36,15 +36,16 @@ import { buildProject, composeCliFlags } from '../../utils/compose_ts';
 import type { BuildOpts, DockerCliFlags } from '../../utils/docker';
 import { dockerCliFlags } from '../../utils/docker';

-// TODO: For this special one we can't use Interfaces.InferredFlags/InferredArgs
-// because of the 'registry-secrets' type which is defined in the actual code
-// as a path (string | undefined) but then the cli turns it into an object
-interface FlagsDef extends ComposeCliFlags, DockerCliFlags {
+type ComposeGenerateOptsParam = Parameters<typeof compose.generateOpts>[0];
+
+interface PrepareBuildOpts
+	extends ComposeCliFlags,
+		DockerCliFlags,
+		ComposeGenerateOptsParam {
 	arch?: string;
 	deviceType?: string;
 	fleet?: string;
-	source?: string; // Not part of command profile - source param copied here.
-	help: void;
+	source?: string;
 }

 export default class BuildCmd extends Command {
@ -95,9 +96,6 @@ ${dockerignoreHelp}
 		fleet: cf.fleet,
 		...composeCliFlags,
 		...dockerCliFlags,
-		// NOTE: Not supporting -h for help, because of clash with -h in DockerCliFlags
-		// Revisit this in future release.
-		help: Flags.help({}),
 	};

 	public static primary = true;
@ -117,29 +115,31 @@ ${dockerignoreHelp}
 		const logger = Logger.getLogger();
 		logger.logDebug('Parsing input...');

-		// `build` accepts `source` as a parameter, but compose expects it as an option
-		options.source = params.source;
-		delete params.source;
+		const prepareBuildOpts = {
+			...options,
+			source: params.source,
+		};

-		await this.resolveArchFromDeviceType(sdk, options);
+		await this.resolveArchFromDeviceType(sdk, prepareBuildOpts);

-		await this.validateOptions(options, sdk);
+		await this.validateOptions(prepareBuildOpts, sdk);

 		// Build args are under consideration for removal - warn user
-		if (options.buildArg) {
+		if (prepareBuildOpts.buildArg) {
 			console.log(buildArgDeprecation);
 		}

-		const app = await this.getAppAndResolveArch(options);
+		const app = await this.getAppAndResolveArch(prepareBuildOpts);

-		const { docker, buildOpts, composeOpts } = await this.prepareBuild(options);
+		const { docker, buildOpts, composeOpts } =
+			await this.prepareBuild(prepareBuildOpts);

 		try {
 			await this.buildProject(docker, logger, composeOpts, {
 				appType: app?.application_type?.[0],
-				arch: options.arch!,
-				deviceType: options.deviceType!,
-				buildEmulated: options.emulated,
+				arch: prepareBuildOpts.arch!,
+				deviceType: prepareBuildOpts.deviceType!,
+				buildEmulated: prepareBuildOpts.emulated,
 				buildOpts,
 			});
 		} catch (err) {
@ -151,7 +151,7 @@ ${dockerignoreHelp}
 		logger.logSuccess('Build succeeded!');
 	}

-	protected async validateOptions(opts: FlagsDef, sdk: BalenaSDK) {
+	protected async validateOptions(opts: PrepareBuildOpts, sdk: BalenaSDK) {
 		// Validate option combinations
 		if (
 			(opts.fleet == null && (opts.arch == null || opts.deviceType == null)) ||
@ -179,7 +179,10 @@ ${dockerignoreHelp}
 		opts['registry-secrets'] = registrySecrets;
 	}

-	protected async resolveArchFromDeviceType(sdk: BalenaSDK, opts: FlagsDef) {
+	protected async resolveArchFromDeviceType(
+		sdk: BalenaSDK,
+		opts: PrepareBuildOpts,
+	) {
 		if (opts.deviceType != null && opts.arch == null) {
 			try {
 				const deviceTypeOpts = {
@ -212,7 +215,7 @@ ${dockerignoreHelp}
 		}
 	}

-	protected async getAppAndResolveArch(opts: FlagsDef) {
+	protected async getAppAndResolveArch(opts: PrepareBuildOpts) {
 		if (opts.fleet) {
 			const { getAppWithArch } = await import('../../utils/helpers');
 			const app = await getAppWithArch(opts.fleet);
@ -222,7 +225,7 @@ ${dockerignoreHelp}
 		}
 	}

-	protected async prepareBuild(options: FlagsDef) {
+	protected async prepareBuild(options: PrepareBuildOpts) {
 		const { getDocker, generateBuildOpts } = await import('../../utils/docker');
 		const [docker, buildOpts, composeOpts] = await Promise.all([
 			getDocker(options),
--- a/src/commands/config/generate.ts
+++ b/src/commands/config/generate.ts
@ -82,7 +82,7 @@ export default class ConfigGenerateCmd extends Command {
 		}),
 		deviceType: Flags.string({
 			description:
-				"device type slug (run 'balena devices supported' for possible values)",
+				"device type slug (run 'balena device-type list' for possible values)",
 		}),
 		'generate-device-api-key': Flags.boolean({
 			description: 'generate a fresh device key for the device',
@ -117,7 +117,6 @@ export default class ConfigGenerateCmd extends Command {
 				'expiry date assigned to generated provisioning api key (format: YYYY-MM-DD)',
 			exclusive: ['device'],
 		}),
-		help: cf.help,
 	};

 	public static authenticated = true;
--- a/src/commands/config/inject.ts
+++ b/src/commands/config/inject.ts
@ -44,7 +44,6 @@ export default class ConfigInjectCmd extends Command {

 	public static flags = {
 		drive: cf.driveOrImg,
-		help: cf.help,
 	};

 	public static root = true;
--- a/src/commands/config/read.ts
+++ b/src/commands/config/read.ts
@ -38,7 +38,6 @@ export default class ConfigReadCmd extends Command {

 	public static flags = {
 		drive: cf.driveOrImg,
-		help: cf.help,
 		json: cf.json,
 	};

--- a/src/commands/config/reconfigure.ts
+++ b/src/commands/config/reconfigure.ts
@ -44,7 +44,6 @@ export default class ConfigReconfigureCmd extends Command {
 			description: 'show advanced commands',
 			char: 'v',
 		}),
-		help: cf.help,
 		version: Flags.string({
 			description: 'balenaOS version, for example "2.32.0" or "2.44.0+rev1"',
 		}),
--- a/src/commands/config/write.ts
+++ b/src/commands/config/write.ts
@ -49,7 +49,6 @@ export default class ConfigWriteCmd extends Command {

 	public static flags = {
 		drive: cf.driveOrImg,
-		help: cf.help,
 	};

 	public static root = true;
--- a/src/commands/deploy/index.ts
+++ b/src/commands/deploy/index.ts
@ -60,7 +60,6 @@ interface FlagsDef extends ComposeCliFlags, DockerCliFlags {
 	'release-tag'?: string[];
 	draft: boolean;
 	note?: string;
-	help: void;
 }

 export default class DeployCmd extends Command {
@ -139,9 +138,6 @@ ${dockerignoreHelp}
 		note: Flags.string({ description: 'The notes for this release' }),
 		...composeCliFlags,
 		...dockerCliFlags,
-		// NOTE: Not supporting -h for help, because of clash with -h in DockerCliFlags
-		// Revisit this in future release.
-		help: Flags.help({}),
 	};

 	public static authenticated = true;
--- a/src/commands/devices/supported.ts
+++ b/src/commands/devices/supported.ts
@ -17,14 +17,20 @@
 import { Flags, Command } from '@oclif/core';
 import type * as BalenaSdk from 'balena-sdk';
 import * as _ from 'lodash';
-import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, getVisuals, stripIndent } from '../../utils/lazy';

-export default class DevicesSupportedCmd extends Command {
-	public static description = stripIndent`
-		List the supported device types (like 'raspberrypi3' or 'intel-nuc').
+export default class DeviceTypeListCmd extends Command {
+	public static aliases = ['devices supported'];
+	public static deprecateAliases = true;

-		List the supported device types (like 'raspberrypi3' or 'intel-nuc').
+	public static description = stripIndent`
+		List the device types supported by balena (like 'raspberrypi3' or 'intel-nuc').
+
+		List the device types supported by balena (like 'raspberrypi3' or 'intel-nuc').
+
+		By default, only actively supported device types are listed.
+		The --all option can be used to list all device types, including those that are
+		no longer supported by balena.

 		The --json option is recommended when scripting the output of this command,
 		because the JSON format is less likely to change and it better represents data
@ -33,20 +39,24 @@ export default class DevicesSupportedCmd extends Command {
 		(https://stedolan.github.io/jq/manual/).
 `;
 	public static examples = [
-		'$ balena devices supported',
-		'$ balena devices supported --json',
+		'$ balena device-type list',
+		'$ balena device-type list --all',
+		'$ balena device-type list --json',
 	];

 	public static flags = {
-		help: cf.help,
 		json: Flags.boolean({
 			char: 'j',
 			description: 'produce JSON output instead of tabular output',
 		}),
+		all: Flags.boolean({
+			description: 'include device types no longer supported by balena',
+			default: false,
+		}),
 	};

 	public async run() {
-		const { flags: options } = await this.parse(DevicesSupportedCmd);
+		const { flags: options } = await this.parse(DeviceTypeListCmd);
 		const pineOptions = {
 			$select: ['slug', 'name'],
 			$expand: {
@ -57,9 +67,11 @@ export default class DevicesSupportedCmd extends Command {
 				},
 			},
 		} satisfies BalenaSdk.PineOptions<BalenaSdk.DeviceType>;
-		const dts = (await getBalenaSdk().models.deviceType.getAllSupported(
-			pineOptions,
-		)) as Array<
+		const dts = (
+			options.all
+				? await getBalenaSdk().models.deviceType.getAll(pineOptions)
+				: await getBalenaSdk().models.deviceType.getAllSupported(pineOptions)
+		) as Array<
 			BalenaSdk.PineTypedResult<BalenaSdk.DeviceType, typeof pineOptions>
 		>;
 		interface DT {
--- a/src/commands/device/deactivate.ts
+++ b/src/commands/device/deactivate.ts
@ -42,7 +42,6 @@ export default class DeviceDeactivateCmd extends Command {

 	public static flags = {
 		yes: cf.yes,
-		help: cf.help,
 	};

 	public static authenticated = true;
--- a/src/commands/device/detect.ts
+++ b/src/commands/device/detect.ts
@ -16,10 +16,12 @@
 */

 import { Flags, Command } from '@oclif/core';
-import * as cf from '../../utils/common-flags';
 import { getCliUx, stripIndent } from '../../utils/lazy';

-export default class ScanCmd extends Command {
+export default class DeviceDetectCmd extends Command {
+	public static aliases = ['scan'];
+	public static deprecateAliases = true;
+
 	public static description = stripIndent`
 		Scan for balenaOS devices on your local network.

@ -32,9 +34,9 @@ export default class ScanCmd extends Command {
 `;

 	public static examples = [
-		'$ balena scan',
-		'$ balena scan --timeout 120',
-		'$ balena scan --verbose',
+		'$ balena device detect',
+		'$ balena device detect --timeout 120',
+		'$ balena device detect --verbose',
 	];

 	public static flags = {
@ -47,7 +49,6 @@ export default class ScanCmd extends Command {
 			char: 't',
 			description: 'scan timeout in seconds',
 		}),
-		help: cf.help,
 		json: Flags.boolean({
 			default: false,
 			char: 'j',
@ -70,7 +71,7 @@ export default class ScanCmd extends Command {
 		const dockerPort = 2375;
 		const dockerTimeout = 2000;

-		const { flags: options } = await this.parse(ScanCmd);
+		const { flags: options } = await this.parse(DeviceDetectCmd);

 		const discoverTimeout =
 			options.timeout != null ? options.timeout * 1000 : undefined;
@ -90,7 +91,7 @@ export default class ScanCmd extends Command {
 				try {
 					await docker.ping();
 					return true;
-				} catch (err) {
+				} catch {
 					return false;
 				}
 			}),
@ -144,10 +145,10 @@ export default class ScanCmd extends Command {
 		if (!options.verbose) {
 			devicesInfo.forEach((d: any) => {
 				d.dockerInfo = _.isObject(d.dockerInfo)
-					? _.pick(d.dockerInfo, ScanCmd.dockerInfoProperties)
+					? _.pick(d.dockerInfo, DeviceDetectCmd.dockerInfoProperties)
 					: d.dockerInfo;
 				d.dockerVersion = _.isObject(d.dockerVersion)
-					? _.pick(d.dockerVersion, ScanCmd.dockerVersionProperties)
+					? _.pick(d.dockerVersion, DeviceDetectCmd.dockerVersionProperties)
 					: d.dockerVersion;
 			});
 		}
@ -164,8 +165,9 @@ export default class ScanCmd extends Command {
 		if (!options.json && cmdOutput.length === 0) {
 			console.error(
 				process.platform === 'win32'
-					? ScanCmd.noDevicesFoundMessage + ScanCmd.windowsTipMessage
-					: ScanCmd.noDevicesFoundMessage,
+					? DeviceDetectCmd.noDevicesFoundMessage +
+							DeviceDetectCmd.windowsTipMessage
+					: DeviceDetectCmd.noDevicesFoundMessage,
 			);
 			return;
 		}
@ -197,11 +199,11 @@ export default class ScanCmd extends Command {
 	protected static windowsTipMessage = `

 Note for Windows users:
-  The 'scan' command relies on the Bonjour service. Check whether Bonjour is
+  The 'device detect' command relies on the Bonjour service. Check whether Bonjour is
  installed (Control Panel > Programs and Features). If not, you can download
  Bonjour for Windows (included with Bonjour Print Services) from here:
  https://support.apple.com/kb/DL999

-  After installing Bonjour, restart your PC and run the 'balena scan' command
+  After installing Bonjour, restart your PC and run the 'balena device detect' command
  again.`;
 }
--- a/src/commands/device/identify.ts
+++ b/src/commands/device/identify.ts
@ -16,7 +16,6 @@
 */

 import { Args, Command } from '@oclif/core';
-import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 import { ExpectedError } from '../../errors';

@ -35,10 +34,6 @@ export default class DeviceIdentifyCmd extends Command {
 		}),
 	};

-	public static flags = {
-		help: cf.help,
-	};
-
 	public static authenticated = true;

 	public async run() {
--- a/src/commands/device/index.ts
+++ b/src/commands/device/index.ts
@ -63,7 +63,6 @@ export default class DeviceCmd extends Command {

 	public static flags = {
 		json: cf.json,
-		help: cf.help,
 		view: Flags.boolean({
 			default: false,
 			description: 'open device dashboard page',
--- a/src/commands/device/init.ts
+++ b/src/commands/device/init.ts
@ -28,7 +28,6 @@ interface FlagsDef {
 	'os-version'?: string;
 	drive?: string;
 	config?: string;
-	help: void;
 	'provisioning-key-name'?: string;
 	'provisioning-key-expiry-date'?: string;
 }
@ -42,17 +41,17 @@ export default class DeviceInitCmd extends Command {
 		This command effectively combines several other balena CLI commands in one,
 		namely:

-		'balena device register'  
-		'balena os download'  
-		'balena os build-config' or 'balena config generate'  
-		'balena os configure'  
+		'balena device register'
+		'balena os download'
+		'balena os build-config' or 'balena config generate'
+		'balena os configure'
 		'balena os local flash'

 		Possible arguments for the '--fleet', '--os-version' and '--drive' options can
 		be listed respectively with the commands:

-		'balena fleets'  
-		'balena os versions'  
+		'balena fleet list'
+		'balena os versions'
 		'balena util available-drives'

 		If the '--fleet' or '--drive' options are omitted, interactive menus will be
@ -100,7 +99,6 @@ export default class DeviceInitCmd extends Command {
 			description:
 				'expiry date assigned to generated provisioning api key (format: YYYY-MM-DD)',
 		}),
-		help: cf.help,
 	};

 	public static authenticated = true;
@ -157,7 +155,7 @@ export default class DeviceInitCmd extends Command {
 			try {
 				logger.logDebug(`Process failed, removing device ${device.uuid}`);
 				await balena.models.device.remove(device.uuid);
-			} catch (e) {
+			} catch {
 				// Ignore removal failures, and throw original error
 			}
 			throw e;
--- a/src/commands/device/list.ts
+++ b/src/commands/device/list.ts
@ -37,6 +37,7 @@ const devicesSelectFields = {

 export default class DeviceListCmd extends Command {
 	public static aliases = ['devices'];
+	public static deprecateAliases = true;

 	public static description = stripIndent`
 		List all devices.
@ -58,7 +59,6 @@ export default class DeviceListCmd extends Command {
 	public static flags = {
 		fleet: cf.fleet,
 		json: cf.json,
-		help: cf.help,
 	};

 	public static primary = true;
--- a/src/commands/device/local-mode.ts
+++ b/src/commands/device/local-mode.ts
@ -16,7 +16,6 @@
 */

 import { Flags, Args, Command } from '@oclif/core';
-import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';

 export default class DeviceLocalModeCmd extends Command {
@ -54,7 +53,6 @@ export default class DeviceLocalModeCmd extends Command {
 			description: 'output boolean indicating local mode status',
 			exclusive: ['enable', 'disable'],
 		}),
-		help: cf.help,
 	};

 	public static authenticated = true;
--- a/src/commands/device/logs.ts
+++ b/src/commands/device/logs.ts
@ -16,13 +16,15 @@
 */

 import { Flags, Args, Command } from '@oclif/core';
-import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 import type { LogMessage } from 'balena-sdk';

 const MAX_RETRY = 1000;

-export default class LogsCmd extends Command {
+export default class DeviceLogsCmd extends Command {
+	public static aliases = ['logs'];
+	public static deprecateAliases = true;
+
 	public static description = stripIndent`
 		Show device logs.

@ -42,15 +44,15 @@ export default class LogsCmd extends Command {
 		Note: --service and --system flags must come after the device parameter, as per examples.
 `;
 	public static examples = [
-		'$ balena logs 23c73a1',
-		'$ balena logs 23c73a1 --tail',
+		'$ balena device logs 23c73a1',
+		'$ balena device logs 23c73a1 --tail',
 		'',
-		'$ balena logs 192.168.0.31',
-		'$ balena logs 192.168.0.31 --service my-service',
-		'$ balena logs 192.168.0.31 --service my-service-1 --service my-service-2',
+		'$ balena device logs 192.168.0.31',
+		'$ balena device logs 192.168.0.31 --service my-service',
+		'$ balena device logs 192.168.0.31 --service my-service-1 --service my-service-2',
 		'',
-		'$ balena logs 23c73a1.local --system',
-		'$ balena logs 23c73a1.local --system --service my-service',
+		'$ balena device logs 23c73a1.local --system',
+		'$ balena device logs 23c73a1.local --system --service my-service',
 	];

 	public static args = {
@ -84,13 +86,12 @@ export default class LogsCmd extends Command {
 				'Only show system logs. This can be used in combination with --service.',
 			char: 'S',
 		}),
-		help: cf.help,
 	};

 	public static primary = true;

 	public async run() {
-		const { args: params, flags: options } = await this.parse(LogsCmd);
+		const { args: params, flags: options } = await this.parse(DeviceLogsCmd);

 		const balena = getBalenaSdk();
 		const { serviceIdToName } = await import('../../utils/cloud');
@ -134,7 +135,7 @@ export default class LogsCmd extends Command {
 			logger.logDebug('Checking we can access device');
 			try {
 				await deviceApi.ping();
-			} catch (e) {
+			} catch {
 				const { ExpectedError } = await import('../../errors');
 				throw new ExpectedError(
 					`Cannot access device at address ${params.device}.  Device may not be in local mode.`,
--- a/src/commands/device/move.ts
+++ b/src/commands/device/move.ts
@ -55,7 +55,6 @@ export default class DeviceMoveCmd extends Command {

 	public static flags = {
 		fleet: cf.fleet,
-		help: cf.help,
 	};

 	public static authenticated = true;
--- a/src/commands/device/note.ts
+++ b/src/commands/device/note.ts
@ -20,7 +20,10 @@ import { ExpectedError } from '../../errors';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';

-export default class NoteCmd extends Command {
+export default class DeviceNoteCmd extends Command {
+	public static aliases = ['notes'];
+	public static deprecateAliases = true;
+
 	public static description = stripIndent`
 		Set a device note.

@ -31,8 +34,8 @@ export default class NoteCmd extends Command {
 	`;

 	public static examples = [
-		'$ balena note "My useful note" --device 7cf02a6',
-		'$ cat note.txt | balena note --device 7cf02a6',
+		'$ balena device note "My useful note" --device 7cf02a6',
+		'$ cat note.txt | balena device note --device 7cf02a6',
 	];

 	public static args = {
@ -47,13 +50,12 @@ export default class NoteCmd extends Command {
 			exclusive: ['device'],
 			hidden: true,
 		}),
-		help: cf.help,
 	};

 	public static authenticated = true;

 	public async run() {
-		const { args: params, flags: options } = await this.parse(NoteCmd);
+		const { args: params, flags: options } = await this.parse(DeviceNoteCmd);

 		if (params.note?.length === 0) {
 			throw new ExpectedError('Missing note content');
--- a/src/commands/device/os-update.ts
+++ b/src/commands/device/os-update.ts
@ -20,6 +20,7 @@ import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent, getCliForm } from '../../utils/lazy';
 import type { Device } from 'balena-sdk';
 import { ExpectedError } from '../../errors';
+import { getExpandedProp } from '../../utils/pine';

 export default class DeviceOsUpdateCmd extends Command {
 	public static description = stripIndent`
@ -57,7 +58,6 @@ export default class DeviceOsUpdateCmd extends Command {
 			exclusive: ['version'],
 		}),
 		yes: cf.yes,
-		help: cf.help,
 	};

 	public static authenticated = true;
@ -127,27 +127,64 @@ export default class DeviceOsUpdateCmd extends Command {
 				);
 			}
 		} else {
+			const choices = await Promise.all(
+				hupVersionInfo.versions.map(async (version) => {
+					const takeoverRequired =
+						(await sdk.models.os.getOsUpdateType(
+							getExpandedProp(is_of__device_type, 'slug')!,
+							currentOsVersion,
+							version,
+						)) === 'takeover';
+
+					return {
+						name: `${version}${hupVersionInfo.recommended === version ? ' (recommended)' : ''}${takeoverRequired ? ' ADVANCED UPDATE: Requires disk re-partitioning with no rollback option' : ''}`,
+						value: version,
+					};
+				}),
+			);
 			targetOsVersion = await getCliForm().ask({
 				message: 'Target OS version',
 				type: 'list',
-				choices: hupVersionInfo.versions.map((version) => ({
-					name:
-						hupVersionInfo.recommended === version
-							? `${version} (recommended)`
-							: version,
-					value: version,
-				})),
+				choices,
 			});
 		}

+		const takeoverRequired =
+			(await sdk.models.os.getOsUpdateType(
+				getExpandedProp(is_of__device_type, 'slug')!,
+				currentOsVersion,
+				targetOsVersion,
+			)) === 'takeover';
 		const patterns = await import('../../utils/patterns');
+		// Warn the user if the update requires a takeover
+		if (takeoverRequired) {
+			await patterns.confirm(
+				options.yes || false,
+				stripIndent`Before you proceed, note that this update process is different from a regular HostOS Update:
+DATA LOSS: This update requires disk re-partitioning, which will erase all data stored on the device.
+NO ROLLBACK: Unlike our HostOS update mechanism, this process does not allow reverting to a previous version in case of failure.
+Make sure to back up all important data before continuing. For more details, check our documentation: https://docs.balena.io/reference/OS/updates/update-process/
+`,
+			);
+		}
 		// Confirm and start update
 		await patterns.confirm(
 			options.yes || false,
 			'Host OS updates require a device restart when they complete. Are you sure you want to proceed?',
 		);

-		await sdk.models.device.startOsUpdate(uuid, targetOsVersion);
-		await patterns.awaitDeviceOsUpdate(uuid, targetOsVersion);
+		await sdk.models.device
+			.startOsUpdate(uuid, targetOsVersion, {
+				runDetached: true,
+			})
+			.then(() => {
+				console.log(
+					`The balena OS update has started. You can keep track of the progress via the dashboard.\n` +
+						`To open the dashboard page related to a device via the CLI, you can use \`balena device UUID --view\``,
+				);
+			})
+			.catch((error) => {
+				console.error(`Failed to start OS update for device ${uuid}:`, error);
+			});
 	}
 }
--- a/src/commands/device/pin.ts
+++ b/src/commands/device/pin.ts
@ -16,7 +16,6 @@
 */

 import { Args, Command } from '@oclif/core';
-import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 import { getExpandedProp } from '../../utils/pine';

@ -43,10 +42,6 @@ export default class DevicePinCmd extends Command {
 		}),
 	};

-	public static flags = {
-		help: cf.help,
-	};
-
 	public static authenticated = true;

 	public async run() {
@ -56,7 +51,7 @@ export default class DevicePinCmd extends Command {

 		const device = await balena.models.device.get(params.uuid, {
 			$expand: {
-				should_be_running__release: {
+				is_pinned_on__release: {
 					$select: 'commit',
 				},
 				belongs_to__application: {
@ -66,7 +61,7 @@ export default class DevicePinCmd extends Command {
 		});

 		const pinnedRelease = getExpandedProp(
-			device.should_be_running__release,
+			device.is_pinned_on__release,
 			'commit',
 		);
 		const appSlug = getExpandedProp(device.belongs_to__application, 'slug');
@ -79,7 +74,7 @@ export default class DevicePinCmd extends Command {
 					pinnedRelease
 						? `This device is currently pinned to ${pinnedRelease}.`
 						: 'This device is not currently pinned to any release.'
-				} \n\nTo see a list of all releases this device can be pinned to, run \`balena releases ${appSlug}\`.`,
+				} \n\nTo see a list of all releases this device can be pinned to, run \`balena release list ${appSlug}\`.`,
 			);
 		} else {
 			await balena.models.device.pinToRelease(params.uuid, releaseToPinTo);
--- a/src/commands/device/public-url.ts
+++ b/src/commands/device/public-url.ts
@ -17,7 +17,6 @@

 import { Flags, Args, Command } from '@oclif/core';
 import { ExpectedError } from '../../errors';
-import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';

 export default class DevicePublicUrlCmd extends Command {
@ -56,7 +55,6 @@ export default class DevicePublicUrlCmd extends Command {
 			description: 'determine if public URL is enabled',
 			exclusive: ['enable', 'disable'],
 		}),
-		help: cf.help,
 	};

 	public static authenticated = true;
--- a/src/commands/device/purge.ts
+++ b/src/commands/device/purge.ts
@ -16,7 +16,6 @@
 */

 import { Args, Command } from '@oclif/core';
-import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, getCliUx, stripIndent } from '../../utils/lazy';

 export default class DevicePurgeCmd extends Command {
@ -41,10 +40,6 @@ export default class DevicePurgeCmd extends Command {
 		}),
 	};

-	public static flags = {
-		help: cf.help,
-	};
-
 	public static authenticated = true;

 	public async run() {
--- a/src/commands/device/reboot.ts
+++ b/src/commands/device/reboot.ts
@ -36,7 +36,6 @@ export default class DeviceRebootCmd extends Command {

 	public static flags = {
 		force: cf.force,
-		help: cf.help,
 	};

 	public static authenticated = true;
--- a/src/commands/device/register.ts
+++ b/src/commands/device/register.ts
@ -16,7 +16,6 @@
 */

 import { Flags, Command } from '@oclif/core';
-import * as cf from '../../utils/common-flags';
 import * as ca from '../../utils/common-args';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 import { applicationIdInfo } from '../../utils/messages';
@ -50,9 +49,8 @@ export default class DeviceRegisterCmd extends Command {
 		}),
 		deviceType: Flags.string({
 			description:
-				"device type slug (run 'balena devices supported' for possible values)",
+				"device type slug (run 'balena device-type list' for possible values)",
 		}),
-		help: cf.help,
 	};

 	public static authenticated = true;
@ -78,6 +76,6 @@ export default class DeviceRegisterCmd extends Command {
 			options.deviceType,
 		);

-		return result && result.uuid;
+		return result.uuid;
 	}
 }
--- a/src/commands/device/rename.ts
+++ b/src/commands/device/rename.ts
@ -16,7 +16,6 @@
 */

 import { Args, Command } from '@oclif/core';
-import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent, getCliForm } from '../../utils/lazy';

 export default class DeviceRenameCmd extends Command {
@ -42,10 +41,6 @@ export default class DeviceRenameCmd extends Command {
 		}),
 	};

-	public static flags = {
-		help: cf.help,
-	};
-
 	public static authenticated = true;

 	public async run() {
--- a/src/commands/device/restart.ts
+++ b/src/commands/device/restart.ts
@ -16,7 +16,6 @@
 */

 import { Flags, Args, Command } from '@oclif/core';
-import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, getCliUx, stripIndent } from '../../utils/lazy';
 import type {
 	BalenaSDK,
@ -58,7 +57,6 @@ export default class DeviceRestartCmd extends Command {
 				'comma-separated list (no blank spaces) of service names to restart',
 			char: 's',
 		}),
-		help: cf.help,
 	};

 	public static authenticated = true;
@ -156,7 +154,7 @@ export default class DeviceRestartCmd extends Command {

 	async restartAllServices(balena: BalenaSDK, deviceUuid: string) {
 		// Note: device.restartApplication throws `BalenaDeviceNotFound: Device not found` if device not online.
-		// Need to use device.get first to distinguish between non-existant and offline devices.
+		// Need to use device.get first to distinguish between non-existant and disconnected devices.
 		// Remove this workaround when SDK issue resolved: https://github.com/balena-io/balena-sdk/issues/649
 		const { instanceOf, ExpectedError } = await import('../../errors');
 		try {
--- a/src/commands/device/rm.ts
+++ b/src/commands/device/rm.ts
@ -44,7 +44,6 @@ export default class DeviceRmCmd extends Command {

 	public static flags = {
 		yes: cf.yes,
-		help: cf.help,
 	};

 	public static authenticated = true;
--- a/src/commands/device/shutdown.ts
+++ b/src/commands/device/shutdown.ts
@ -37,7 +37,6 @@ export default class DeviceShutdownCmd extends Command {

 	public static flags = {
 		force: cf.force,
-		help: cf.help,
 	};

 	public static authenticated = true;
--- a/src/commands/device/ssh.ts
+++ b/src/commands/device/ssh.ts
@ -16,14 +16,16 @@
 */

 import { Flags, Args, Command } from '@oclif/core';
-import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 import {
 	parseAsInteger,
 	validateLocalHostnameOrIp,
 } from '../../utils/validation';

-export default class SshCmd extends Command {
+export default class DeviceSSHCmd extends Command {
+	public static aliases = ['ssh'];
+	public static deprecateAliases = true;
+
 	public static description = stripIndent`
 		Open a SSH prompt on a device's host OS or service container.

@ -52,14 +54,14 @@ export default class SshCmd extends Command {
 	`;

 	public static examples = [
-		'$ balena ssh MyFleet',
-		'$ balena ssh f49cefd',
-		'$ balena ssh f49cefd my-service',
-		'$ balena ssh f49cefd --port <port>',
-		'$ balena ssh 192.168.0.1 --verbose',
-		'$ balena ssh f49cefd.local my-service',
-		'$ echo "uptime; exit;" | balena ssh f49cefd',
-		'$ echo "uptime; exit;" | balena ssh 192.168.0.1 myService',
+		'$ balena device ssh MyFleet',
+		'$ balena device ssh f49cefd',
+		'$ balena device ssh f49cefd my-service',
+		'$ balena device ssh f49cefd --port <port>',
+		'$ balena device ssh 192.168.0.1 --verbose',
+		'$ balena device ssh f49cefd.local my-service',
+		'$ echo "uptime; exit;" | balena device ssh f49cefd',
+		'$ echo "uptime; exit;" | balena device ssh 192.168.0.1 myService',
 	];

 	public static args = {
@ -80,7 +82,7 @@ export default class SshCmd extends Command {
 				SSH server port number (default 22222) if the target is an IP address or .local
 				hostname. Otherwise, port number for the balenaCloud gateway (default 22).`,
 			char: 'p',
-			parse: async (p) => parseAsInteger(p, 'port'),
+			parse: (p) => parseAsInteger(p, 'port'),
 		}),
 		tty: Flags.boolean({
 			default: false,
@ -97,25 +99,25 @@ export default class SshCmd extends Command {
 			default: false,
 			description: 'bypass global proxy configuration for the ssh connection',
 		}),
-		help: cf.help,
 	};

 	public static primary = true;
 	public static offlineCompatible = true;

 	public async run() {
-		const { args: params, flags: options } = await this.parse(SshCmd);
+		const { args: params, flags: options } = await this.parse(DeviceSSHCmd);

 		// Local connection
 		if (validateLocalHostnameOrIp(params.fleetOrDevice)) {
 			const { performLocalDeviceSSH } = await import('../../utils/device/ssh');
-			return await performLocalDeviceSSH({
+			await performLocalDeviceSSH({
 				hostname: params.fleetOrDevice,
 				port: options.port || 'local',
 				forceTTY: options.tty,
 				verbose: options.verbose,
 				service: params.service,
 			});
+			return;
 		}

 		// Remote connection
@ -131,7 +133,7 @@ export default class SshCmd extends Command {
 		const useProxy = !!proxyConfig && !options.noproxy;

 		// this will be a tunnelled SSH connection...
-		await checkNotUsingOfflineMode();
+		checkNotUsingOfflineMode();
 		await checkLoggedIn();
 		const deviceUuid = await getOnlineTargetDeviceUuid(
 			sdk,
--- a/src/commands/device/start-service.ts
+++ b/src/commands/device/start-service.ts
@ -16,7 +16,6 @@
 */

 import { Args, Command } from '@oclif/core';
-import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, getCliUx, stripIndent } from '../../utils/lazy';
 import type { BalenaSDK } from 'balena-sdk';

@ -45,10 +44,6 @@ export default class DeviceStartServiceCmd extends Command {
 		}),
 	};

-	public static flags = {
-		help: cf.help,
-	};
-
 	public static authenticated = true;

 	public async run() {
--- a/src/commands/device/stop-service.ts
+++ b/src/commands/device/stop-service.ts
@ -16,7 +16,6 @@
 */

 import { Args, Command } from '@oclif/core';
-import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, getCliUx, stripIndent } from '../../utils/lazy';
 import type { BalenaSDK } from 'balena-sdk';

@ -45,10 +44,6 @@ export default class DeviceStopServiceCmd extends Command {
 		}),
 	};

-	public static flags = {
-		help: cf.help,
-	};
-
 	public static authenticated = true;

 	public async run() {
--- a/src/commands/device/track-fleet.ts
+++ b/src/commands/device/track-fleet.ts
@ -16,7 +16,6 @@
 */

 import { Args, Command } from '@oclif/core';
-import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';

 export default class DeviceTrackFleetCmd extends Command {
@ -34,10 +33,6 @@ export default class DeviceTrackFleetCmd extends Command {
 		}),
 	};

-	public static flags = {
-		help: cf.help,
-	};
-
 	public static authenticated = true;

 	public async run() {
--- a/src/commands/device/tunnel.ts
+++ b/src/commands/device/tunnel.ts
@ -21,13 +21,15 @@ import {
 	InvalidPortMappingError,
 	ExpectedError,
 } from '../../errors';
-import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 import { lowercaseIfSlug } from '../../utils/normalization';

 import type { Server, Socket } from 'net';

-export default class TunnelCmd extends Command {
+export default class DeviceTunnelCmd extends Command {
+	public static aliases = ['tunnel'];
+	public static deprecateAliases = true;
+
 	public static description = stripIndent`
 		Tunnel local ports to your balenaOS device.

@ -54,19 +56,19 @@ export default class TunnelCmd extends Command {

 	public static examples = [
 		'# map remote port 22222 to localhost:22222',
-		'$ balena tunnel myFleet -p 22222',
+		'$ balena device tunnel myFleet -p 22222',
 		'',
 		'# map remote port 22222 to localhost:222',
-		'$ balena tunnel 2ead211 -p 22222:222',
+		'$ balena device tunnel 2ead211 -p 22222:222',
 		'',
 		'# map remote port 22222 to any address on your host machine, port 22222',
-		'$ balena tunnel 1546690 -p 22222:0.0.0.0',
+		'$ balena device tunnel 1546690 -p 22222:0.0.0.0',
 		'',
 		'# map remote port 22222 to any address on your host machine, port 222',
-		'$ balena tunnel myFleet -p 22222:0.0.0.0:222',
+		'$ balena device tunnel myFleet -p 22222:0.0.0.0:222',
 		'',
 		'# multiple port tunnels can be specified at any one time',
-		'$ balena tunnel myFleet -p 8080:3000 -p 8081:9000',
+		'$ balena device tunnel myFleet -p 8080:3000 -p 8081:9000',
 	];

 	public static args = {
@ -84,14 +86,13 @@ export default class TunnelCmd extends Command {
 			char: 'p',
 			multiple: true,
 		}),
-		help: cf.help,
 	};

 	public static primary = true;
 	public static authenticated = true;

 	public async run() {
-		const { args: params, flags: options } = await this.parse(TunnelCmd);
+		const { args: params, flags: options } = await this.parse(DeviceTunnelCmd);

 		const Logger = await import('../../utils/logger');

--- a/src/commands/envs/index.ts
+++ b/src/commands/envs/index.ts
@ -23,7 +23,7 @@ import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, getVisuals, stripIndent } from '../../utils/lazy';
 import { applicationIdInfo } from '../../utils/messages';

-type FlagsDef = Interfaces.InferredFlags<typeof EnvsCmd.flags>;
+type FlagsDef = Interfaces.InferredFlags<typeof EnvListCmd.flags>;

 interface EnvironmentVariableInfo extends SDK.EnvironmentVariableBase {
 	fleet?: string | null; // fleet slug
@ -45,7 +45,10 @@ interface ServiceEnvironmentVariableInfo
 	serviceName?: string; // service name
 }

-export default class EnvsCmd extends Command {
+export default class EnvListCmd extends Command {
+	public static aliases = ['envs'];
+	public static deprecateAliases = true;
+
 	public static description = stripIndent`
 		List the environment or config variables of a fleet, device or service.

@ -83,14 +86,14 @@ export default class EnvsCmd extends Command {
 	`;

 	public static examples = [
-		'$ balena envs --fleet myorg/myfleet',
-		'$ balena envs --fleet MyFleet --json',
-		'$ balena envs --fleet MyFleet --service MyService',
-		'$ balena envs --fleet MyFleet --config',
-		'$ balena envs --device 7cf02a6',
-		'$ balena envs --device 7cf02a6 --json',
-		'$ balena envs --device 7cf02a6 --config --json',
-		'$ balena envs --device 7cf02a6 --service MyService',
+		'$ balena env list --fleet myorg/myfleet',
+		'$ balena env list --fleet MyFleet --json',
+		'$ balena env list --fleet MyFleet --service MyService',
+		'$ balena env list --fleet MyFleet --config',
+		'$ balena env list --device 7cf02a6',
+		'$ balena env list --device 7cf02a6 --json',
+		'$ balena env list --device 7cf02a6 --config --json',
+		'$ balena env list --device 7cf02a6 --service MyService',
 	];

 	public static flags = {
@ -102,13 +105,12 @@ export default class EnvsCmd extends Command {
 			exclusive: ['service'],
 		}),
 		device: { ...cf.device, exclusive: ['fleet'] },
-		help: cf.help,
 		json: cf.json,
 		service: { ...cf.service, exclusive: ['config'] },
 	};

 	public async run() {
-		const { flags: options } = await this.parse(EnvsCmd);
+		const { flags: options } = await this.parse(EnvListCmd);

 		const variables: EnvironmentVariableInfo[] = [];

--- a/src/commands/env/rename.ts
+++ b/src/commands/env/rename.ts
@ -15,7 +15,6 @@
 * limitations under the License.
 */
 import { Args, Command } from '@oclif/core';
-import * as cf from '../../utils/common-flags';
 import * as ec from '../../utils/env-common';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 import { parseAsInteger } from '../../utils/validation';
@ -42,7 +41,7 @@ export default class EnvRenameCmd extends Command {
 		id: Args.integer({
 			required: true,
 			description: "variable's numeric database ID",
-			parse: async (input) => parseAsInteger(input, 'id'),
+			parse: (input) => parseAsInteger(input, 'id'),
 		}),
 		value: Args.string({
 			required: true,
@ -55,7 +54,6 @@ export default class EnvRenameCmd extends Command {
 		config: ec.booleanConfig,
 		device: ec.booleanDevice,
 		service: ec.booleanService,
-		help: cf.help,
 	};

 	public async run() {
--- a/src/commands/env/rm.ts
+++ b/src/commands/env/rm.ts
@ -46,7 +46,7 @@ export default class EnvRmCmd extends Command {
 		id: Args.integer({
 			required: true,
 			description: "variable's numeric database ID",
-			parse: async (input) => parseAsInteger(input, 'id'),
+			parse: (input) => parseAsInteger(input, 'id'),
 		}),
 	};

--- a/src/commands/env/set.ts
+++ b/src/commands/env/set.ts
@ -25,7 +25,6 @@ import { applicationIdInfo } from '../../utils/messages';
 interface FlagsDef {
 	fleet?: string;
 	device?: string; // device UUID
-	help: void;
 	quiet: boolean;
 	service?: string; // service name
 }
@ -35,11 +34,14 @@ interface ArgsDef {
 	value?: string;
 }

-export default class EnvAddCmd extends Command {
-	public static description = stripIndent`
-		Add env or config variable to fleets, devices or services.
+export default class EnvSetCmd extends Command {
+	public static aliases = ['env add'];
+	public static deprecateAliases = true;

-		Add an environment or config variable to one or more fleets, devices or
+	public static description = stripIndent`
+		Add or update env or config variable to fleets, devices or services.
+
+		Add or update an environment or config variable to one or more fleets, devices or
 		services, as selected by the respective command-line options. Either the
 		--fleet or the --device option must be provided,  and either may be be
 		used alongside the --service option to define a service-specific variable.
@ -66,15 +68,15 @@ export default class EnvAddCmd extends Command {
 	`;

 	public static examples = [
-		'$ balena env add TERM --fleet MyFleet',
-		'$ balena env add EDITOR vim -f myorg/myfleet',
-		'$ balena env add EDITOR vim --fleet MyFleet,MyFleet2',
-		'$ balena env add EDITOR vim --fleet MyFleet --service MyService',
-		'$ balena env add EDITOR vim --fleet MyFleet,MyFleet2 --service MyService,MyService2',
-		'$ balena env add EDITOR vim --device 7cf02a6',
-		'$ balena env add EDITOR vim --device 7cf02a6,d6f1433',
-		'$ balena env add EDITOR vim --device 7cf02a6 --service MyService',
-		'$ balena env add EDITOR vim --device 7cf02a6,d6f1433 --service MyService,MyService2',
+		'$ balena env set TERM --fleet MyFleet',
+		'$ balena env set EDITOR vim -f myorg/myfleet',
+		'$ balena env set EDITOR vim --fleet MyFleet,MyFleet2',
+		'$ balena env set EDITOR vim --fleet MyFleet --service MyService',
+		'$ balena env set EDITOR vim --fleet MyFleet,MyFleet2 --service MyService,MyService2',
+		'$ balena env set EDITOR vim --device 7cf02a6',
+		'$ balena env set EDITOR vim --device 7cf02a6,d6f1433',
+		'$ balena env set EDITOR vim --device 7cf02a6 --service MyService',
+		'$ balena env set EDITOR vim --device 7cf02a6,d6f1433 --service MyService,MyService2',
 	];

 	public static args = {
@ -95,13 +97,12 @@ export default class EnvAddCmd extends Command {
 	public static flags = {
 		fleet: { ...cf.fleet, exclusive: ['device'] },
 		device: { ...cf.device, exclusive: ['fleet'] },
-		help: cf.help,
 		quiet: cf.quiet,
 		service: cf.service,
 	};

 	public async run() {
-		const { args: params, flags: options } = await this.parse(EnvAddCmd);
+		const { args: params, flags: options } = await this.parse(EnvSetCmd);
 		const cmd = this;

 		if (!options.fleet && !options.device) {
--- a/src/commands/fleet/create.ts
+++ b/src/commands/fleet/create.ts
@ -16,7 +16,6 @@
 */

 import { Flags, Args, Command } from '@oclif/core';
-import * as cf from '../../utils/common-flags';
 import { stripIndent } from '../../utils/lazy';

 export default class FleetCreateCmd extends Command {
@ -28,10 +27,10 @@ export default class FleetCreateCmd extends Command {
 		You can specify the organization the fleet should belong to using
 		the \`--organization\` option. The organization's handle, not its name,
 		should be provided. Organization handles can be listed with the
-		\`balena orgs\` command.
+		\`balena organization list\` command.

 		The fleet's default device type is specified with the \`--type\` option.
-		The \`balena devices supported\` command can be used to list the available
+		The \`balena device-type list\` command can be used to list the available
 		device types.

 		Interactive dropdowns will be shown for selection if no device type or
@ -62,9 +61,8 @@ export default class FleetCreateCmd extends Command {
 		type: Flags.string({
 			char: 't',
 			description:
-				'fleet device type (Check available types with `balena devices supported`)',
+				'fleet device type (Check available types with `balena device-type list`)',
 		}),
-		help: cf.help,
 	};

 	public static authenticated = true;
--- a/src/commands/fleet/index.ts
+++ b/src/commands/fleet/index.ts
@ -40,7 +40,6 @@ export default class FleetCmd extends Command {
 	};

 	public static flags = {
-		help: cf.help,
 		view: Flags.boolean({
 			default: false,
 			description: 'open fleet dashboard page',
--- a/src/commands/fleets/index.ts
+++ b/src/commands/fleets/index.ts
@ -26,7 +26,10 @@ interface ExtendedApplication extends ApplicationWithDeviceTypeSlug {
 	device_type?: string;
 }

-export default class FleetsCmd extends Command {
+export default class FleetListCmd extends Command {
+	public static aliases = ['fleets'];
+	public static deprecateAliases = true;
+
 	public static description = stripIndent`
 		List all fleets.

@ -36,10 +39,9 @@ export default class FleetsCmd extends Command {
 		\`balena fleet <fleet>\`
 	`;

-	public static examples = ['$ balena fleets'];
+	public static examples = ['$ balena fleet list'];

 	public static flags = {
-		help: cf.help,
 		json: cf.json,
 	};

@ -47,7 +49,7 @@ export default class FleetsCmd extends Command {
 	public static primary = true;

 	public async run() {
-		const { flags: options } = await this.parse(FleetsCmd);
+		const { flags: options } = await this.parse(FleetListCmd);

 		const balena = getBalenaSdk();

--- a/src/commands/fleet/pin.ts
+++ b/src/commands/fleet/pin.ts
@ -16,7 +16,6 @@
 */

 import { Args, Command } from '@oclif/core';
-import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 import { getExpandedProp } from '../../utils/pine';

@ -43,10 +42,6 @@ export default class FleetPinCmd extends Command {
 		}),
 	};

-	public static flags = {
-		help: cf.help,
-	};
-
 	public static authenticated = true;

 	public async run() {
@ -76,7 +71,7 @@ export default class FleetPinCmd extends Command {
 					pinnedRelease
 						? `This fleet is currently pinned to ${pinnedRelease}.`
 						: 'This fleet is not currently pinned to any release.'
-				} \n\nTo see a list of all releases this fleet can be pinned to, run \`balena releases ${slug}\`.`,
+				} \n\nTo see a list of all releases this fleet can be pinned to, run \`balena release list ${slug}\`.`,
 			);
 		} else {
 			await balena.models.application.pinToRelease(slug, releaseToPinTo);
--- a/src/commands/fleet/purge.ts
+++ b/src/commands/fleet/purge.ts
@ -16,7 +16,6 @@
 */

 import { Command } from '@oclif/core';
-import * as cf from '../../utils/common-flags';
 import * as ca from '../../utils/common-args';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 import { applicationIdInfo } from '../../utils/messages';
@ -40,10 +39,6 @@ export default class FleetPurgeCmd extends Command {
 		fleet: ca.fleetRequired,
 	};

-	public static flags = {
-		help: cf.help,
-	};
-
 	public static authenticated = true;

 	public async run() {
--- a/src/commands/fleet/rename.ts
+++ b/src/commands/fleet/rename.ts
@ -16,7 +16,6 @@
 */

 import { Args, Command } from '@oclif/core';
-import * as cf from '../../utils/common-flags';
 import * as ca from '../../utils/common-args';
 import { getBalenaSdk, stripIndent, getCliForm } from '../../utils/lazy';
 import { applicationIdInfo } from '../../utils/messages';
@ -46,10 +45,6 @@ export default class FleetRenameCmd extends Command {
 		}),
 	};

-	public static flags = {
-		help: cf.help,
-	};
-
 	public static authenticated = true;

 	public async run() {
--- a/src/commands/fleet/restart.ts
+++ b/src/commands/fleet/restart.ts
@ -16,7 +16,6 @@
 */

 import { Command } from '@oclif/core';
-import * as cf from '../../utils/common-flags';
 import * as ca from '../../utils/common-args';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 import { applicationIdInfo } from '../../utils/messages';
@ -39,10 +38,6 @@ export default class FleetRestartCmd extends Command {
 		fleet: ca.fleetRequired,
 	};

-	public static flags = {
-		help: cf.help,
-	};
-
 	public static authenticated = true;

 	public async run() {
--- a/src/commands/fleet/rm.ts
+++ b/src/commands/fleet/rm.ts
@ -44,7 +44,6 @@ export default class FleetRmCmd extends Command {

 	public static flags = {
 		yes: cf.yes,
-		help: cf.help,
 	};

 	public static authenticated = true;
--- a/src/commands/fleet/track-latest.ts
+++ b/src/commands/fleet/track-latest.ts
@ -16,7 +16,6 @@
 */

 import { Args, Command } from '@oclif/core';
-import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';

 export default class FleetTrackLatestCmd extends Command {
@ -37,10 +36,6 @@ export default class FleetTrackLatestCmd extends Command {
 		}),
 	};

-	public static flags = {
-		help: cf.help,
-	};
-
 	public static authenticated = true;

 	public async run() {
--- a/src/commands/join/index.ts
+++ b/src/commands/join/index.ts
@ -65,7 +65,6 @@ export default class JoinCmd extends Command {
 			description: 'the interval in minutes to check for updates',
 			char: 'i',
 		}),
-		help: cf.help,
 	};

 	public static authenticated = true;
--- a/src/commands/leave/index.ts
+++ b/src/commands/leave/index.ts
@ -16,7 +16,6 @@
 */

 import { Args, Command } from '@oclif/core';
-import * as cf from '../../utils/common-flags';
 import { stripIndent } from '../../utils/lazy';
 import { parseAsLocalHostnameOrIp } from '../../utils/validation';

@ -49,10 +48,6 @@ export default class LeaveCmd extends Command {
 		}),
 	};

-	public static flags = {
-		help: cf.help,
-	};
-
 	public static authenticated = true;
 	public static primary = true;

--- a/src/commands/local/configure.ts
+++ b/src/commands/local/configure.ts
@ -16,8 +16,6 @@
 */

 import { Args, Command } from '@oclif/core';
-import { promisify } from 'util';
-import * as cf from '../../utils/common-flags';
 import { stripIndent } from '../../utils/lazy';

 export default class LocalConfigureCmd extends Command {
@ -39,10 +37,6 @@ export default class LocalConfigureCmd extends Command {
 		}),
 	};

-	public static flags = {
-		help: cf.help,
-	};
-
 	public static root = true;
 	public static offlineCompatible = true;

@ -242,7 +236,7 @@ export default class LocalConfigureCmd extends Command {
 		const bootPartition = await getBootPartition(target);

 		const files = await imagefs.interact(target, bootPartition, async (_fs) => {
-			return await promisify(_fs.readdir)(this.CONNECTIONS_FOLDER);
+			return await _fs.promises.readdir(this.CONNECTIONS_FOLDER);
 		});

 		let connectionFileName;
@ -251,13 +245,11 @@ export default class LocalConfigureCmd extends Command {
 		} else if (_.includes(files, 'resin-sample.ignore')) {
 			// Fresh image, new mode, accoding to https://github.com/balena-os/meta-balena/pull/770/files
 			await imagefs.interact(target, bootPartition, async (_fs) => {
-				const readFileAsync = promisify(_fs.readFile);
-				const writeFileAsync = promisify(_fs.writeFile);
-				const contents = await readFileAsync(
+				const contents = await _fs.promises.readFile(
 					`${this.CONNECTIONS_FOLDER}/resin-sample.ignore`,
 					{ encoding: 'utf8' },
 				);
-				return await writeFileAsync(
+				await _fs.promises.writeFile(
 					`${this.CONNECTIONS_FOLDER}/resin-wifi`,
 					contents,
 				);
@ -274,13 +266,13 @@ export default class LocalConfigureCmd extends Command {
 		} else {
 			// In case there's no file at all (shouldn't happen normally, but the file might have been removed)
 			await imagefs.interact(target, bootPartition, async (_fs) => {
-				return await promisify(_fs.writeFile)(
+				await _fs.promises.writeFile(
 					`${this.CONNECTIONS_FOLDER}/resin-wifi`,
 					this.CONNECTION_FILE,
 				);
 			});
 		}
-		return await this.getConfigurationSchema(bootPartition, connectionFileName);
+		return this.getConfigurationSchema(bootPartition, connectionFileName);
 	}

 	async removeHostname(schema: any) {
--- a/src/commands/local/flash.ts
+++ b/src/commands/local/flash.ts
@ -48,7 +48,6 @@ export default class LocalFlashCmd extends Command {
 	public static flags = {
 		drive: cf.drive,
 		yes: cf.yes,
-		help: cf.help,
 	};

 	public static offlineCompatible = true;
--- a/src/commands/login/index.ts
+++ b/src/commands/login/index.ts
@ -16,7 +16,6 @@
 */

 import { Flags, Args, Command } from '@oclif/core';
-import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent, getCliForm } from '../../utils/lazy';
 import { ExpectedError } from '../../errors';
 import type { WhoamiResult } from 'balena-sdk';
@ -29,7 +28,6 @@ interface FlagsDef {
 	user?: string;
 	password?: string;
 	port?: number;
-	help: void;
 	hideExperimentalWarning: boolean;
 }

@ -111,7 +109,6 @@ export default class LoginCmd extends Command {
 			default: false,
 			description: 'Hides warning for experimental features',
 		}),
-		help: cf.help,
 	};

 	public static primary = true;
@ -135,7 +132,7 @@ export default class LoginCmd extends Command {
 		// We can safely assume this won't be undefined as doLogin will throw if this call fails
 		// We also don't need to worry too much about the amount of calls to whoami
 		// as these are cached by the SDK
-		const whoamiResult = (await balena.auth.whoami()) as WhoamiResult;
+		const whoamiResult = (await balena.auth.whoami())!;

 		if (whoamiResult.actorType !== 'user' && !options.hideExperimentalWarning) {
 			console.info(stripIndent`
@ -171,7 +168,7 @@ ${messages.reachingOut}`);

 	async doLogin(
 		loginOptions: FlagsDef,
-		balenaUrl: string = 'balena-cloud.com',
+		balenaUrl = 'balena-cloud.com',
 		token?: string,
 	): Promise<void> {
 		// Token
--- a/src/commands/organization/list.ts
+++ b/src/commands/organization/list.ts
@ -16,25 +16,23 @@
 */

 import { Command } from '@oclif/core';
-import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, getVisuals, stripIndent } from '../../utils/lazy';

-export default class OrgsCmd extends Command {
+export default class OrganizationListCmd extends Command {
+	public static aliases = ['orgs'];
+	public static deprecateAliases = true;
+
 	public static description = stripIndent`
 		List all organizations.

 		list all the organizations that you are a member of.
 `;
-	public static examples = ['$ balena orgs'];
-
-	public static flags = {
-		help: cf.help,
-	};
+	public static examples = ['$ balena organization list'];

 	public static authenticated = true;

 	public async run() {
-		await this.parse(OrgsCmd);
+		await this.parse(OrganizationListCmd);

 		const { getOwnOrganizations } = await import('../../utils/sdk');

--- a/src/commands/os/build-config.ts
+++ b/src/commands/os/build-config.ts
@ -16,7 +16,6 @@
 */

 import { Flags, Args, Command } from '@oclif/core';
-import * as cf from '../../utils/common-flags';
 import { getCliForm, stripIndent } from '../../utils/lazy';
 import * as _ from 'lodash';
 import type { DeviceTypeJson } from 'balena-sdk';
@ -55,7 +54,6 @@ export default class OsBuildConfigCmd extends Command {
 			char: 'o',
 			required: true,
 		}),
-		help: cf.help,
 	};

 	public static authenticated = true;
--- a/src/commands/os/configure.ts
+++ b/src/commands/os/configure.ts
@ -18,7 +18,6 @@
 import { Flags, Args, Command } from '@oclif/core';
 import type { Interfaces } from '@oclif/core';
 import type * as BalenaSdk from 'balena-sdk';
-import { promisify } from 'util';
 import * as _ from 'lodash';
 import { ExpectedError } from '../../errors';
 import * as cf from '../../utils/common-flags';
@ -154,7 +153,6 @@ export default class OsConfigureCmd extends Command {
 				'expiry date assigned to generated provisioning api key (format: YYYY-MM-DD)',
 			exclusive: ['config', 'device'],
 		}),
-		help: cf.help,
 	};

 	public static authenticated = true;
@ -293,7 +291,7 @@ export default class OsConfigureCmd extends Command {

 			for (const { name, content } of files) {
 				await imagefs.interact(image, bootPartition, async (_fs) => {
-					return await promisify(_fs.writeFile)(
+					await _fs.promises.writeFile(
 						path.join(CONNECTIONS_FOLDER, name),
 						content,
 					);
--- a/src/commands/os/download.ts
+++ b/src/commands/os/download.ts
@ -16,7 +16,6 @@
 */

 import { Flags, Args, Command } from '@oclif/core';
-import * as cf from '../../utils/common-flags';
 import { stripIndent } from '../../utils/lazy';

 export default class OsDownloadCmd extends Command {
@ -24,7 +23,7 @@ export default class OsDownloadCmd extends Command {
 		Download an unconfigured OS image.

 		Download an unconfigured OS image for the specified device type.
-		Check available device types with 'balena devices supported'.
+		Check available device types with 'balena device-type list'.

 		Note: Currently this command only works with balenaCloud, not openBalena.
 		If using openBalena, please download the OS from: https://www.balena.io/os/
@ -78,7 +77,6 @@ export default class OsDownloadCmd extends Command {
 				or 'menu-esr' (interactive menu, ESR versions)
 				`,
 		}),
-		help: cf.help,
 	};

 	public async run() {
--- a/src/commands/os/initialize.ts
+++ b/src/commands/os/initialize.ts
@ -51,7 +51,6 @@ export default class OsInitializeCmd extends Command {
 		type: cf.deviceType,
 		drive: cf.drive,
 		yes: cf.yes,
-		help: cf.help,
 	};

 	public static authenticated = true;
--- a/src/commands/os/versions.ts
+++ b/src/commands/os/versions.ts
@ -16,7 +16,6 @@
 */

 import { Flags, Args, Command } from '@oclif/core';
-import * as cf from '../../utils/common-flags';
 import { stripIndent } from '../../utils/lazy';

 export default class OsVersionsCmd extends Command {
@ -24,7 +23,7 @@ export default class OsVersionsCmd extends Command {
 		Show available balenaOS versions for the given device type.

 		Show the available balenaOS versions for the given device type.
-		Check available types with \`balena devices supported\`.
+		Check available types with \`balena device-type list\`.

 		balenaOS ESR versions can be listed with the '--esr' option. See also:
 		https://www.balena.io/docs/reference/OS/extended-support-release/
@ -40,7 +39,6 @@ export default class OsVersionsCmd extends Command {
 	};

 	public static flags = {
-		help: cf.help,
 		esr: Flags.boolean({
 			description: 'select balenaOS ESR versions',
 			default: false,
--- a/src/commands/preload/index.ts
+++ b/src/commands/preload/index.ts
@ -84,9 +84,9 @@ export default class PreloadCmd extends Command {
 			description: `\
 The commit hash of the release to preload. Use "current" to specify the current
 release (ignored if no appId is given). The current release is usually also the
-latest, but can be pinned to a specific release. See:  
-https://www.balena.io/docs/learn/deploy/release-strategy/release-policy/  
-https://www.balena.io/docs/learn/more/masterclasses/fleet-management/#63-pin-using-the-api  
+latest, but can be pinned to a specific release. See:
+https://www.balena.io/docs/learn/deploy/release-strategy/release-policy/
+https://www.balena.io/docs/learn/more/masterclasses/fleet-management/#63-pin-using-the-api
 https://github.com/balena-io-examples/staged-releases\
 `,
 			char: 'c',
@ -109,7 +109,7 @@ https://github.com/balena-io-examples/staged-releases\
 		'additional-space': Flags.integer({
 			description:
 				'expand the image by this amount of bytes instead of automatically estimating the required amount',
-			parse: async (x) => parseAsInteger(x, 'additional-space'),
+			parse: (x) => parseAsInteger(x, 'additional-space'),
 		}),
 		'add-certificate': Flags.string({
 			description: `\
@ -126,11 +126,8 @@ Can be repeated to add multiple certificates.\
 		dockerPort: Flags.integer({
 			description:
 				'Docker daemon TCP port number (hint: 2375 for balena devices)',
-			parse: async (p) => parseAsInteger(p, 'dockerPort'),
+			parse: (p) => parseAsInteger(p, 'dockerPort'),
 		}),
-		// Not supporting -h for help, because of clash with -h in DockerCliFlags
-		// Revisit this in future release.
-		help: Flags.help({}),
 	};

 	public static authenticated = true;
@ -158,7 +155,7 @@ Can be repeated to add multiple certificates.\
 					------------------------------------------------------------------------------
 					`);
 			}
-		} catch (error) {
+		} catch {
 			throw new ExpectedError(
 				`The provided image path does not exist: ${params.image}`,
 			);
@ -195,11 +192,11 @@ Can be repeated to add multiple certificates.\
 				event.name,
 			));
 			if (event.action === 'start') {
-				return spinner.start();
-			} else {
-				console.log();
-				return spinner.stop();
+				spinner.start();
+				return;
 			}
+			console.log();
+			spinner.stop();
 		};

 		const commit = this.isCurrentCommit(options.commit || '')
@ -298,7 +295,7 @@ Can be repeated to add multiple certificates.\
 		owns__release: {
 			$select: ['id', 'commit', 'end_timestamp', 'composition'],
 			$expand: {
-				contains__image: {
+				release_image: {
 					$select: ['image'],
 					$expand: {
 						image: {
@ -413,6 +410,8 @@ Can be repeated to add multiple certificates.\
 		const DEFAULT_CHOICE = { name: 'current', value: 'current' };
 		const choices = [DEFAULT_CHOICE].concat(
 			releases.map((release) => ({
+				// TODO: [next-major] consider changing this to use the release semver
+				// and maybe the commit as well
 				name: `${release.end_timestamp} - ${release.commit}`,
 				value: release.commit,
 			})),
--- a/src/commands/push/index.ts
+++ b/src/commands/push/index.ts
@ -17,7 +17,6 @@

 import { Flags, Args, Command } from '@oclif/core';
 import type { Interfaces } from '@oclif/core';
-import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 import { dockerignoreHelp, registrySecretsHelp } from '../../utils/messages';
 import type { BalenaSDK } from 'balena-sdk';
@ -218,7 +217,6 @@ export default class PushCmd extends Command {
 			default: false,
 		}),
 		note: Flags.string({ description: 'The notes for this release' }),
-		help: cf.help,
 	};

 	public static primary = true;
--- a/src/commands/release/finalize.ts
+++ b/src/commands/release/finalize.ts
@ -17,7 +17,6 @@

 import { Command } from '@oclif/core';
 import { commitOrIdArg } from '.';
-import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';

 export default class ReleaseFinalizeCmd extends Command {
@ -40,10 +39,6 @@ export default class ReleaseFinalizeCmd extends Command {
 		'$ balena release finalize 1234567',
 	];

-	public static flags = {
-		help: cf.help,
-	};
-
 	public static args = {
 		commitOrId: commitOrIdArg({
 			description: 'the commit or ID of the release to finalize',
--- a/src/commands/release/index.ts
+++ b/src/commands/release/index.ts
@ -24,7 +24,7 @@ import { tryAsInteger } from '../../utils/validation';
 import { jsonInfo } from '../../utils/messages';

 export const commitOrIdArg = Args.custom({
-	parse: async (commitOrId: string) => tryAsInteger(commitOrId),
+	parse: tryAsInteger,
 });

 type FlagsDef = Interfaces.InferredFlags<typeof ReleaseCmd.flags>;
@ -43,7 +43,6 @@ export default class ReleaseCmd extends Command {

 	public static flags = {
 		json: cf.json,
-		help: cf.help,
 		composition: Flags.boolean({
 			default: false,
 			char: 'c',
@ -87,7 +86,7 @@ export default class ReleaseCmd extends Command {
 		balena: BalenaSdk.BalenaSDK,
 		options: FlagsDef,
 	) {
-		const fields: Array<keyof BalenaSdk.Release> = [
+		const fields = [
 			'id',
 			'commit',
 			'created_at',
@ -97,7 +96,7 @@ export default class ReleaseCmd extends Command {
 			'build_log',
 			'start_timestamp',
 			'end_timestamp',
-		];
+		] satisfies BalenaSdk.PineOptions<BalenaSdk.Release>['$select'];

 		const release = await balena.models.release.get(commitOrId, {
 			...(!options.json && { $select: fields }),
--- a/src/commands/release/invalidate.ts
+++ b/src/commands/release/invalidate.ts
@ -17,7 +17,6 @@

 import { Command } from '@oclif/core';
 import { commitOrIdArg } from '.';
-import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';

 export default class ReleaseInvalidateCmd extends Command {
@ -35,10 +34,6 @@ export default class ReleaseInvalidateCmd extends Command {
 		'$ balena release invalidate 1234567',
 	];

-	public static flags = {
-		help: cf.help,
-	};
-
 	public static args = {
 		commitOrId: commitOrIdArg({
 			description: 'the commit or ID of the release to invalidate',
--- a/src/commands/releases/index.ts
+++ b/src/commands/releases/index.ts
@ -22,7 +22,10 @@ import { applicationNameNote } from '../../utils/messages';
 import type * as BalenaSdk from 'balena-sdk';
 import { jsonInfo } from '../../utils/messages';

-export default class ReleasesCmd extends Command {
+export default class ReleaseListCmd extends Command {
+	public static aliases = ['releases'];
+	public static deprecateAliases = true;
+
 	public static description = stripIndent`
 		List all releases of a fleet.

@ -33,13 +36,12 @@ export default class ReleasesCmd extends Command {
 		${jsonInfo.split('\n').join('\n\t\t')}
 `;
 	public static examples = [
-		'$ balena releases myorg/myfleet',
-		'$ balena releases myorg/myfleet --json',
+		'$ balena release list myorg/myfleet',
+		'$ balena release list myorg/myfleet --json',
 	];

 	public static flags = {
 		json: cf.json,
-		help: cf.help,
 	};

 	public static args = {
@ -52,16 +54,16 @@ export default class ReleasesCmd extends Command {
 	public static authenticated = true;

 	public async run() {
-		const { args: params, flags: options } = await this.parse(ReleasesCmd);
+		const { args: params, flags: options } = await this.parse(ReleaseListCmd);

-		const fields: Array<keyof BalenaSdk.Release> = [
+		const fields = [
 			'id',
 			'commit',
 			'created_at',
 			'status',
 			'semver',
 			'is_final',
-		];
+		] satisfies BalenaSdk.PineOptions<BalenaSdk.Release>['$select'];

 		const balena = getBalenaSdk();
 		const { getFleetSlug } = await import('../../utils/sdk');
--- a/src/commands/release/validate.ts
+++ b/src/commands/release/validate.ts
@ -17,7 +17,6 @@

 import { Command } from '@oclif/core';
 import { commitOrIdArg } from '.';
-import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';

 export default class ReleaseValidateCmd extends Command {
@ -34,10 +33,6 @@ export default class ReleaseValidateCmd extends Command {
 		'$ balena release validate 1234567',
 	];

-	public static flags = {
-		help: cf.help,
-	};
-
 	public static args = {
 		commitOrId: commitOrIdArg({
 			description: 'the commit or ID of the release to validate',
--- a/Show More
+++ b/Show More