v1.11.0
kb v1.11.0
v1.11.0 adds single-colon scoped labels and fixes startup, task-update, and
safety issues found in the readiness audit. Stored label text stays unchanged.
Readiness
The release candidate meets the automated readiness bar on GitHub-hosted
Linux, macOS, and Windows runners. Linux runs the complete Go suite. macOS
and Windows run the store, TUI, CLI, MCP, web, and root package tests with
-short, plus built-binary task and web/MCP startup checks. Existing platform
and short-mode skips remain in effect.
CI evidence for the merged candidate.
Go is pinned to 1.26.8. govulncheck v1.8.0 reported no affected vulnerabilities
and now gates CI and release verification.
Both reproduced audit blockers are fixed:
- SQLite data paths: the
store and TUI watcher share escaped DSN construction for relative, Windows,
and reserved-character paths. - MCP task references:
project-preserving updates resolve sequence numbers and UUID prefixes
through the store and retain the resolved task ID for the write.
Readiness is based on automated CI evidence. Physical-terminal validation
remains tracked in #304.
Remaining audit work is linked in the
readiness backlog.
Labels
- A single colon scopes a label the way a double colon always has.
type:bug
now reads as scopetype, valuebug, alongside GitLab'stype::bug. This
is the shape GitHub-style labels take once they are on a card, so they get
two-tone chips and scope filters without being rewritten. - The double colon is read first, so
a::bis never the value:b. The
reader also accepts one space after a single colon, though a tag cannot
carry whitespace today, sotype: bugis refused at the store as before. - Everything scoped follows: the web board and the TUI render the scope
quietly, every label in a scope shares one hue, the label picker groups by
scope and answerstype:as well astype::, and adding a second label in a
scope replaces the first, as it does for::. - The project scope stays
project::only. The label picker refuses to create
project:labels in either spelling, so a decoy that looks like the project
chip cannot exist.
Dependencies
- google.golang.org/grpc 1.83.1 to 1.83.2 (indirect), closing the xDS server
crash advisory. kb runs no xDS server; the bump only clears the alert. Go
moves to 1.26.8.
Upgrade
Make a cold backup of the data directory first. Then, with Go 1.26.8 or newer:
GOTOOLCHAIN=local go install github.com/RandomCodeSpace/kb@v1.11.0
kb versionThe release provides CGO-free binaries for Linux amd64 and arm64, macOS amd64
and arm64, and Windows amd64. Release binaries are built with Go 1.26.8.