What's Changed

• feat(packaging): add automated AUR package publishing (#917) by @sarovin in #1083

Full Changelog: v0.61.2...v0.62.0

Contributors

• @sarovin

What's Changed

• chore(deps): bump docker/setup-qemu-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #1066
• chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #1067
• chore(deps): bump jsonschema from 0.46.4 to 0.46.5 by @dependabot[bot] in #1069
• chore(deps): bump rustls-native-certs from 0.8.3 to 0.8.4 by @dependabot[bot] in #1072
• fix(proxy): deny-by-default when network.block is set by @caiocdcs in #1082

Full Changelog: v0.61.1...v0.61.2

Contributors

• @caiocdcs
• @dependabot

What's Changed

• feat(profile): allow registry refs in profile extends by @lukehinds in #1061

Full Changelog: v0.61.0...v0.61.1

Contributors

• @lukehinds

What's Changed

• refactor(network-policy): do not enable credentials by default in profiles by @lukehinds in #1057
• feat(diagnostic): add profile option to suppress system service diagnostics by @lukehinds in #1059

Full Changelog: v0.60.0...v0.61.0

Contributors

• @lukehinds

What's Changed

• chore(deps): bump shlex from 1.3.0 to 2.0.1 by @dependabot[bot] in #963
• fix: correct Quick Start profile reference in README by @guzalv in #1020
• refactor(profile): extract opencode profile from built-ins by @lukehinds in #1024
• feat: annotate suppressed denials and style save prompt paths by @AnnaXH in #985
• feat(cli): centralize timeout constants and make user-facing timeouts configurable by @SequeI in #981
• feat: support fine-grained method+path restrictions in allow_domain by @panga in #997
• feat(wiring): support jsonc in wiring directives by @lukehinds in #1029
• feat: add --trust-proxy-ca for macos system trust store integration by @panga in #978
• build(rpm): add rpm release artifacts by @Doooooo0o in #1039
• feat(cli): introduce interactive denied path selector by @lukehinds in #1038
• docs(cli): update credential injection with bitwarden and custom keyring by @lukehinds in #1032
• feat: remove libdbus dependency on linux by @lukehinds in #1049
• fix(cli): accept cap file under any known temp root for why --self by @panga in #1055

New Contributors

• @guzalv made their first contribution in #1020
• @Doooooo0o made their first contribution in #1039

Full Changelog: v0.58.0...v0.60.0

Contributors

• @panga
• @Doooooo0o
• @lukehinds
• @guzalv
• @dependabot
• @AnnaXH
• @SequeI

What's Changed

• chore(deps): bump shlex from 1.3.0 to 2.0.1 by @dependabot[bot] in #963
• fix: correct Quick Start profile reference in README by @guzalv in #1020
• refactor(profile): extract opencode profile from built-ins by @lukehinds in #1024
• feat: annotate suppressed denials and style save prompt paths by @AnnaXH in #985
• feat(cli): centralize timeout constants and make user-facing timeouts configurable by @SequeI in #981
• feat: support fine-grained method+path restrictions in allow_domain by @panga in #997

New Contributors

• @guzalv made their first contribution in #1020

Full Changelog: v0.58.0...v0.59.0

Contributors

• @panga
• @lukehinds
• @guzalv
• @dependabot
• @AnnaXH
• @SequeI

What's Changed

• feat(profile): add JSONC support for profile files by @SequeI in #974
• fix(macos): emit platform rules after user write allows by @kipz in #971
• docs(readme): refine project description and quick start by @lukehinds in #988
• feat(profile): allow profiles to specify a target binary by @SequeI in #975
• ci(pr-summary): add pull request summary workflow by @lukehinds in #980
• chore(deps): update sigstore crates to 0.8.0 by @lukehinds in #992
• feat: add Bitwarden credential source (bw:// URI scheme) by @caiocdcs in #990
• ci(release): enable github attesations workflow for releases (current and future) by @lukehinds in #1006
• chore(deps): bump similar from 3.1.0 to 3.1.1 by @dependabot[bot] in #1013
• chore(deps): bump docker/build-push-action from 7.1.0 to 7.2.0 by @dependabot[bot] in #1009
• chore(deps): bump actions/attest-build-provenance from 96b4a1ef7235a096b17240c259729fdd70c83d45 to e8998f949152b193b063cb0ec769d69d929409be by @dependabot[bot] in #1010
• chore(deps): bump docker/login-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #1011
• chore(deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #1012
• chore(deps): bump serde_json from 1.0.149 to 1.0.150 by @dependabot[bot] in #1015
• chore(deps): bump landlock from 0.4.4 to 0.4.5 by @dependabot[bot] in #1014
• feat(policy): add java_runtime group and java-dev profile by @panga in #995
• chore(deps): bump rcgen from 0.13.2 to 0.14.8 by @dependabot[bot] in #900
• feat: session lifecycle hooks (#954) by @caiocdcs in #976
• refactor(pack-hints): refresh in detached process to avoid threads by @lukehinds in #1005
• fix(sandbox): preserve symlink path when adding CWD capability on macOS by @advaithsujith in #680
• fix(proxy): return 502 with audit entry on upstream connect failure by @attila in #1000
• fix: replace fd-based IPC with named socket for URL open helpers by @panga in #1007

New Contributors

• @attila made their first contribution in #1000

Full Changelog: v0.57.0...v0.58.0

Contributors

• @panga
• @attila
• @kipz
• @lukehinds
• @caiocdcs
• @dependabot
• @advaithsujith
• @SequeI

What's Changed

• feat(profiles): expand shadowing checks to include pack profiles by @lukehinds in #961
• chore(deps): bump aws-lc-rs from 1.16.3 to 1.17.0 by @dependabot[bot] in #962

Full Changelog: v0.56.0...v0.57.0

Contributors

• @lukehinds
• @dependabot

What's Changed

• feat(cli): add option to configure process startup timeout by @lukehinds in #955

Full Changelog: v0.55.0...v0.56.0

Contributors

• @lukehinds

What's Changed

• chore(deps): bump clap_complete from 4.6.3 to 4.6.5 by @dependabot[bot] in #902
• fix: preserve child output without trailing newline (#881) by @AnnaXH in #911
• feat(landlock): add landlock v6 signal and abstract unix socket scoping by @lukehinds in #912
• feat(cli): add recursive unix socket directory grants by @lukehinds in #913
• feat(sandbox): add explicit allowlist for pathname af_unix sockets by @lukehinds in #915
• feat(profiles): verify pack signer identities and allow use of org/repo pull format by @lukehinds in #916
• feat(linux): implement af_unix pathname mediation by @lukehinds in #918
• fix(proxy): honor explicit credential_format on custom inject headers by @SequeI in #921
• Change warning to note about API changes by @lukehinds in #933
• docs(installation): add Arch Linux (AUR) section by @sarovin in #926
• refactor(package): base installs on package manifest by @lukehinds in #928
• docs(cli-security): add isolation scope and deployment model by @lukehinds in #937
• feat(macos): treat open_port 0 as localhost:* outbound by @SequeI in #931
• fix(musl): fix libc::Ioctl type mismatches for x86_64-unknown-linux-musl target by @sahuguet in #935
• test(integration-tests): use CARGO_TARGET_DIR in runner by @lukehinds in #939
• fix(pty): forward bare ESC immediately in filter_client_input by @caiocdcs in #948
• fix(cli): preserve macOS future-file grants in why --self by @panga in #949
• fix: quiet Landlock deny-overlap diagnostics on Linux by @SequeI in #950

New Contributors

• @sarovin made their first contribution in #926
• @caiocdcs made their first contribution in #948
• @panga made their first contribution in #949

Full Changelog: v0.54.0...v0.55.0

What's Changed

• chore(deps): bump clap_complete from 4.6.3 to 4.6.5 by @dependabot[bot] in #902
• fix: preserve child output without trailing newline (#881) by @AnnaXH in #911
• feat(landlock): add landlock v6 signal and abstract unix socket scoping by @lukehinds in #912
• feat(cli): add recursive unix socket directory grants by @lukehinds in #913
• feat(sandbox): add explicit allowlist for pathname af_unix sockets by @lukehinds in #915
• feat(profiles): verify pack signer identities and allow use of org/repo pull format by @lukehinds in #916
• feat(linux): implement af_unix pathname mediation by @lukehinds in #918
• fix(proxy): honor explicit credential_format on custom inject headers by @SequeI in #921
• Change warning to note about API changes by @lukehinds in #933
• docs(installation): add Arch Linux (AUR) section by @sarovin in #926
• refactor(package): base installs on package manifest by @lukehinds in #928
• docs(cli-security): add isolation scope and deployment model by @lukehinds in #937
• feat(macos): treat open_port 0 as localhost:* outbound by @SequeI in #931
• fix(musl): fix libc::Ioctl type mismatches for x86_64-unknown-linux-musl target by @sahuguet in #935
• test(integration-tests): use CARGO_TARGET_DIR in runner by @lukehinds in #939
• fix(pty): forward bare ESC immediately in filter_client_input by @caiocdcs in #948
• fix(cli): preserve macOS future-file grants in why --self by @panga in #949
• fix: quiet Landlock deny-overlap diagnostics on Linux by @SequeI in #950

New Contributors

• @sarovin made their first contribution in #926
• @caiocdcs made their first contribution in #948
• @panga made their first contribution in #949

Full Changelog: v0.54.0...v0.55.0

Contributors

• @panga
• @sahuguet
• @sarovin
• @lukehinds
• @caiocdcs
• @dependabot
• @AnnaXH
• @SequeI