nono Files

What's Changed

• fix(sandbox): allow exec in writable grant-dirs under command policies by @kipz in https://github.com/nolabs-ai/nono/pull/1391
• docs(profiles): fix codeblock by @Stef16Robbe in https://github.com/nolabs-ai/nono/pull/1426
• fix(exec): ignore OS workqueue threads in pre-fork thread check by @kipz in https://github.com/nolabs-ai/nono/pull/1424
• feat(proxy): add SPIFFE/SPIRE workload identity auth for upstream routes by @SequeI in https://github.com/nolabs-ai/nono/pull/1272
• fix(tool-sandbox): attribute daemonized callers to their command (cgroup on linux, verified daemon-pid on macos) by @kipz in https://github.com/nolabs-ai/nono/pull/1417
• feat: add profile-declared no_proxy bypass support by @anugrahsinghal in https://github.com/nolabs-ai/nono/pull/1415
• fix: sigV4 URI generation errors for uri's that have encoded characters by @intentionally-left-nil in https://github.com/nolabs-ai/nono/pull/1430
• fix(proxy): don't cross-deny sibling routes sharing an upstream by @zbleness in https://github.com/nolabs-ai/nono/pull/1437
• chore: release v0.69.0 by @lukehinds in https://github.com/nolabs-ai/nono/pull/1449
• chore(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2 by @dependabot[bot] in https://github.com/nolabs-ai/nono/pull/1459
• chore(deps): bump actions/attest from 4.1.1 to 4.2.0 by @dependabot[bot] in https://github.com/nolabs-ai/nono/pull/1456
• chore(deps): bump actions/cache from 5.0.5 to 6.1.0 by @dependabot[bot] in https://github.com/nolabs-ai/nono/pull/1457
• chore(deps): bump ignore from 0.4.29 to 0.4.30 by @dependabot[bot] in https://github.com/nolabs-ai/nono/pull/1458
• test(nono-cli): hermetic git test commit.gpgsign by @kurtisc in https://github.com/nolabs-ai/nono/pull/1470
• fix(tool-sandbox): drop trailing newline from captured credential phantoms by @kipz in https://github.com/nolabs-ai/nono/pull/1475
• fix(session): route attach socket through symlink by @kurtisc in https://github.com/nolabs-ai/nono/pull/1477
• fix(cli): reject upstream proxy with block net by @dpersek in https://github.com/nolabs-ai/nono/pull/1392
• fix(tool-sandbox): skip missing fs_write_file grants instead of denying by @kipz in https://github.com/nolabs-ai/nono/pull/1452
• fix(policy): survive atomic replacement of resolv.conf; report stale … by @maufl in https://github.com/nolabs-ai/nono/pull/1448
• fix(tool-sandbox): let allow_launch_services reach the open shim on macOS by @kipz in https://github.com/nolabs-ai/nono/pull/1464
• feat(tool-sandbox): add jwt-shaped nonce option for capture intercepts by @kipz in https://github.com/nolabs-ai/nono/pull/1453
• ci(release): add macos code signing and notarization by @lukehinds in https://github.com/nolabs-ai/nono/pull/1483
• fix(pr-template): redundant release note check-box by @kurtisc in https://github.com/nolabs-ai/nono/pull/1499
• feat(proxy): add per-route request rate limiting (RouteRateLimiter) by @zbleness in https://github.com/nolabs-ai/nono/pull/1428
• fix(tool-sandbox): grant command interpreter read of its script by @kipz in https://github.com/nolabs-ai/nono/pull/1467
• fix(sandbox): grant metadata read on $PATH dirs for command resolution by @kipz in https://github.com/nolabs-ai/nono/pull/1455
• chore(deps): bump clap from 4.6.1 to 4.6.2 by @dependabot[bot] in https://github.com/nolabs-ai/nono/pull/1461
• fix(cli): support SOCKS proxies from environment by @YewFence in https://github.com/nolabs-ai/nono/pull/1474
• chore(deps): bump jsonschema from 0.46.10 to 0.48.0 by @dependabot[bot] in https://github.com/nolabs-ai/nono/pull/1460
• fix(proxy): prevent credential from enabling host filter by @lukehinds in https://github.com/nolabs-ai/nono/pull/1497
• fix(tool-sandbox): clean up runtime dir with sealed shims by @kipz in https://github.com/nolabs-ai/nono/pull/1492
• fix(pty): capability-elevation approval prompt PTY handoff by @lukehinds in https://github.com/nolabs-ai/nono/pull/1254
• fix(cli): add explicit intercept match predicates by @dpersek in https://github.com/nolabs-ai/nono/pull/1364
• feat(cli): offer to save denied open-url origins on exit by @caiocdcs in https://github.com/nolabs-ai/nono/pull/1222
• fix(registry): suppress X-Nono-UUID when update check is opted out by @scp7 in https://github.com/nolabs-ai/nono/pull/1508
• fix(undo): skip symlinks when walking snapshots by @kurtisc in https://github.com/nolabs-ai/nono/pull/1493
• feat: mediate vault login -method=oidc (custom inject header + per-command open_port) by @kipz in https://github.com/nolabs-ai/nono/pull/1476
• chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in https://github.com/nolabs-ai/nono/pull/1509
• chore(deps): bump docker/login-action from 4.4.0 to 4.5.1 by @dependabot[bot] in https://github.com/nolabs-ai/nono/pull/1511
• chore(deps): bump clap from 4.6.2 to 4.6.4 by @dependabot[bot] in https://github.com/nolabs-ai/nono/pull/1510
• chore(deps): bump base64 from 0.22.1 to 0.23.0 by @dependabot[bot] in https://github.com/nolabs-ai/nono/pull/1512
• chore(deps): bump hyper from 1.10.1 to 1.11.0 by @dependabot[bot] in https://github.com/nolabs-ai/nono/pull/1513
• chore: release v0.70.0 by @SequeI in https://github.com/nolabs-ai/nono/pull/1514

New Contributors

• @Stef16Robbe made their first contribution in https://github.com/nolabs-ai/nono/pull/1426
• @zbleness made their first contribution in https://github.com/nolabs-ai/nono/pull/1437

Full Changelog: https://github.com/nolabs-ai/nono/compare/v0.68.0...v0.70.0