Security Advisories
What's Changed
- ci: stop notifying retired downstream repos by @SequeI in #2110
- chore(nix): update prebuilt hashes for v0.80.0 by @github-actions[bot] in #2109
- chore(deps): bump ureq from 3.4.1 to 3.4.2 by @dependabot[bot] in #2113
- chore(deps): bump uuid from 1.26.1 to 1.28.0 by @dependabot[bot] in #2114
- chore(deps): bump tokio from 1.53.1 to 1.53.2 by @dependabot[bot] in #2116
- chore(deps): bump hyper from 1.11.1 to 1.12.0 by @dependabot[bot] in #2117
- chore(deps): bump hyper-util from 0.1.20 to 0.1.21 by @dependabot[bot] in #2115
- fix(proxy): use HTTP/1.1 for AWS intercept routes by @kurtisc in #2111
- feat(cli): skip approval requests for ungrantable procfs paths by @lukehinds in #2054
- chore(deps): group routine Dependabot updates by @SequeI in #2119
- chore(deps): bump the routine-rust group with 6 updates by @dependabot[bot] in #2122
- feat(profiles): require fully qualified package profile names by @SequeI in #2118
- fix(ci): update cargo audit failures by @kurtisc in #2127
- Update maintainers list by @lukehinds in #2137
- docs(readme): remove references to archived TypeScript and Go bindings by @kipz in #2138
- docs(readme): rewrite introduction and feature breakdown by @lukehinds in #2139
- docs(neps): add NEP 0007 for remote supervisor decisions over vsock by @lukehinds in #2150
- feat(linux): opt-in namespace isolation (NEP-0004) by @lukehinds in #2145
- docs(cli): document network.listen_port_range in profiles-groups by @LuckVd in #2153
- fix(policy): enable Nix runtime and cache/channel access by @jpds in #2151
- fix(policy): grant system_read_linux_core access to /var/lib/ca-certificates by @bharathvemula in #2149
- chore(release): automate NEP roadmap generation script and workflow by @lukehinds in #2144
- fix(proxy): resolve the Authorization phantom on token endpoint requests by @kipz in #2136
- fix(proxy): tolerate skew in certificates by @kurtisc in #2126
- chore(deps): bump dirs from 6.0.0 to 7.0.0 by @dependabot[bot] in #2124
- chore(deps): bump jsonschema from 0.56.0 to 0.58.6 by @dependabot[bot] in #2123
- fix(cli): keep --log-file output under --silent by @sreyas-endor in #2159
- chore(deps): bump the routine-rust group with 5 updates by @dependabot[bot] in #2162
- chore(deps): bump cachix/install-nix-action from 31.11.1 to 31.11.2 in the routine-actions group by @dependabot[bot] in #2161
- chore(deps): bump the sigstore group across 1 directory with 2 updates by @dependabot[bot] in #2160
- feat(policy): add
rtk_stategroup by @jpds in #2155 - refactor(headers): consolidate the HTTP token check by @jpds in #2168
- fix(cli): resolve wrapper exec after env assignments by @LuckVd in #2165
- feat(proxy): include denial_category in proxy deny log lines by @sreyas-endor in #2173
- chore(deps): update Rust TLS dependencies by @SequeI in #2175
- fix(proxy): retain ownership of credential command children by @Frankie-Xu in #2073
- fix(proxy): redact proxy audit paths, reasons, and upstream URLs by @jpds in #2181
- fix(profiles): simplify package profile listing for fully qualified names by @SequeI in #2166
- fix(proxy): honor connect ports in supervised mode by @LuckVd in #2189
- fix(proxy): answer 407 when an unauthenticated CONNECT arrives with an upstream proxy by @kipz in #2133
- chore(deps): bump ctutils to 0.4.4 by @SequeI in #2192
- chore: clean up workspace dependencies and build configuration by @SequeI in #2210
- perf(linux): read only the ELF regions the exec gate parses by @jeremy in #2195
- chore(deps): bump the routine-actions group with 2 updates by @dependabot[bot] in #2203
- chore(deps): bump the routine-rust group across 1 directory with 9 updates by @dependabot[bot] in #2212
- chore(deps): bump the sigstore group across 1 directory with 2 updates by @dependabot[bot] in #2202
- chore(deps): bump jsonschema from 0.58.6 to 0.60.1 by @dependabot[bot] in #2205
- chore(deps): bump vt100 from 0.16.2 to 0.18.1 by @dependabot[bot] in #2206
- fix(oauth-capture): rewrite form-urlencoded OAuth token responses by @kipz in #1836
- fix(sandbox): deny io_uring during AF_UNIX mediation by @SequeI in #2215
- fix(proxy): prevent UTF-8 nonce parsing panic by @SequeI in #2216
- feat(sandbox): detect Landlock ABI up to V9, keep enforcement at V6 by @lukehinds in #2217
- feat(proxy): network approval backends by @panga in #1781
- docs(claude): clarify packaged macOS keychain access by @SequeI in #2219
- fix(why): add pathname Unix socket policy diagnostics by @SequeI in #2220
- docs(neps): add nep-0008 session flight recorder proposal by @lukehinds in #2223
- fix(proxy): redeem phantoms inside Basic credentials on token endpoints by @kipz in #2225
- docs: document safe Codex app server isolation by @SequeI in #2227
- chore: release v0.81.0 by @SequeI in #2229
New Contributors
- @LuckVd made their first contribution in #2153
- @jpds made their first contribution in #2151
- @bharathvemula made their first contribution in #2149
- @sreyas-endor made their first contribution in #2159
- @jeremy made their first contribution in #2195
Full Changelog: v0.80.0...v0.81.0