v0.7.0

Changed

• The page the browser shows at the end of hodeishield login is now a styled page with the product mark,
  for success, denied access, a failed or mismatched response and unknown paths. It follows the system
  light or dark preference, needs no script, font or outside request, and uses the language of the
  browser when it is supported.
• SECURITY.md now counts the fix target for medium-severity vulnerabilities from the report, like the
  coordinated disclosure period, so it never runs past it: within 90 days of the report, extendable by
  mutual agreement. Critical and high are still counted from the first assessment.

Fixed

• Behaviour change for scripts: whoami now exits 3, like every other command, when the API
  does not accept the credential, after printing the local details and the warning. It used to exit
  0. An API that cannot be reached or fails on its side still gives exit 0.
• The README now describes the two macOS steps to allow a blocked browser download: Allow Anyway in
  System Settings → Privacy & Security, then Open Anyway in the dialog shown on the next run
  (measured on macOS 27.0.1 with 0.6.1).

Verify the download as described in Verifying releases.

No unaddressed security advisory for this commit (cargo-deny 0.20.2, cargo-audit 0.22.2, RustSec advisory database at 2295466c4e9d); accepted with a written reason in deny.toml: RUSTSEC-2026-0370, RUSTSEC-2026-0371, RUSTSEC-2026-0372.

What's Changed

• Describe the two macOS steps to allow a blocked download by Gorka Gonzalo (@d0ubl3g) in #256
• Count the medium fix target from the report, like the disclosure period by Gorka Gonzalo (@d0ubl3g) in #260
• Show a styled sign-in result page in the browser by Gorka Gonzalo (@d0ubl3g) in #261
• Exit 3 from whoami when the API rejects the stored sign-in by Gorka Gonzalo (@d0ubl3g) in #262
• Prepare 0.7.0: version and changelog by Gorka Gonzalo (@d0ubl3g) in #263
• Release 0.7.0 by Gorka Gonzalo (@d0ubl3g) in #264

Full Changelog: v0.6.1...v0.7.0