cachix/secretspec v0.12.1

0.12.1 - 2026-06-15

on GitHub

Release Notes

Fixed

• Windows: a dotenv:// provider URI built from an absolute path (e.g.
  dotenv://C:\path\.env) no longer fails to parse with "invalid port number".
  The drive-letter colon was being read as a host:port separator; such paths
  are now carried through the URL intact.
• Windows: the audit log no longer fails to reset at its size cap. Truncation on
  the append-only handle was denied by the OS; it now truncates through a
  separate write handle.
• Relative dotenv paths (e.g. dotenv:.config/.env) now resolve against the
  directory containing secretspec.toml instead of the current working
  directory. Running secretspec run --file ../secretspec.toml from a
  subdirectory previously failed to find the referenced .env file because it
  was looked up relative to the working directory rather than the project root
  (#59). Absolute dotenv paths are unaffected.
• The protonpass provider now works with Proton Pass CLI pass-cli >= 2.0.3.
  The item list --output json payload changed shape in 2.0.3 (the item title
  moved from a nested content.title to a top-level title, and content was
  dropped from list output), which made secretspec report active secrets as
  missing. Both the old (<= 2.0.2) and new (>= 2.0.3) list shapes are now
  accepted. (#104)

Install secretspec 0.12.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/cachix/secretspec/releases/download/v0.12.1/secretspec-installer.sh | sh

Download secretspec 0.12.1