What's Changed
- chore(deps): bump actions/attest from 4.2.1 to 4.2.2 by @dependabot[bot] in #1613
- chore(deps): bump base64 from 0.22.1 to 0.23.0 by @dependabot[bot] in #1609
- chore(deps): bump http from 1.4.2 to 1.5.0 by @dependabot[bot] in #1611
- chore(deps): bump rustls from 0.23.42 to 0.23.43 by @dependabot[bot] in #1612
- chore(deps): bump time from 0.3.53 to 0.3.55 by @dependabot[bot] in #1614
- chore(deps): bump regex from 1.13.0 to 1.13.1 by @dependabot[bot] in #1615
- refactor(test): share integration harness by @kurtisc in #1597
- fix(audit): propogate errors after unparseable ledger by @kurtisc in #1596
- feat(tool-sandbox): caller-declared env pass-through via export_env by @kipz in #1440
- fix(sandbox): enforce proxy-only destination check on Landlock V4+ kernels by @SequeI in #1631
- fix(sandbox): allow hex-suffixed atomic-write temp files on macOS by @SequeI in #1637
- fix(cli): union separate read and write grants for
nono why --op readwriteby @SequeI in #1638 - fix(supervisor): enforce peer-UID check in SupervisorSocket::bind() by @SequeI in #1639
- refactor(seccomp): ensure all filters include arch guard by @lukehinds in #1636
- feat(policy): allow unlink for atomic write temp files by @lukehinds in #1657
- feat(remote): add remote session connect and ps by @lukehinds in #1656
- chore(deps): bump jsonc-parser from 0.32.4 to 0.33.1 by @dependabot[bot] in #1658
- chore(deps): bump clap_complete from 4.6.7 to 4.6.9 by @dependabot[bot] in #1659
- chore(deps): bump http-body-util from 0.1.4 to 0.1.5 by @dependabot[bot] in #1661
- chore(deps): bump libc from 0.2.186 to 0.2.189 by @dependabot[bot] in #1662
- chore(deps): bump webpki-roots from 1.0.8 to 1.0.9 by @dependabot[bot] in #1660
- docs: correct outdated/inaccurate sections across 4 doc pages by @SequeI in #1668
- feat(audit): surface subtool audit by @kurtisc in #1641
- fix(cli): preserve terminal output during capability approval by @wswsmao in #1527
- chore(deps): bump h2 to 0.4.16 by @SequeI in #1670
- fix(proxy): honor profiles network.tls_intercept in
nono proxyby @SequeI in #1672 - fix(proxy): honour require_auth on the plain-HTTP forward path by @panga in #1673
- fix(proxy): bound per-line reads of the WebSocket upgrade response by @kipz in #1617
- fix(proxy): check hostname allowlist before DNS resolution by @SequeI in #1675
- fix(cli): stop leaking orphaned proxy CA Keychain items by @kipz in #1674
- fix(net_filter): normalize hostnames before deny/allow-list matching by @SequeI in #1676
- fix(fs): validate unix socket nodes and normalize landlock by @lukehinds in #1654
- feat(profile): configurable approval backend for supervised-mode prompts by @connrg in #1677
- chore: release v0.74.0 by @SequeI in #1680
Full Changelog: v0.73.0...v0.74.0