v0.10.6

What's Changed

• chore: ignore local agent instruction files by @mamamiyear in #1817
• feat(vmm): expose x86 entry register configuration by @DorianZheng in #1710
• feat(vmm): expose host CPUID and checked MSR configuration by @DorianZheng in #1711
• feat(copy): accept docker's SRC/. spelling for a directory's contents by @ltstriker in #1826
• feat(copy)!: remove include_parent by @ltstriker in #1827
• fix(deps): clear the high advisories and type the generated clients by @DefeatMan in #1840
• fix(proxy): require public tunnel for all service previews by @zombee0 in #1758
• feat(cli): add boxlite update --inbound for existing boxes by @ltstriker in #1777
• feat(runtime): add BoxOptions.mounts, refused until a runtime takes it by @Monsteer714 in #1755
• fix(runner): resolve the BoxLite home once in the BoxLite client by @ltstriker in #1849
• fix(runner): report disk metrics for the BoxLite home filesystem by @ltstriker in #1877
• fix(cli): honor discovered device authorization endpoints by @silverzki in #1836
• docs: align PR size limits with agent-tooling by @DefeatMan in #1894
• Update README.md by @DorianZheng in #1899
• feat(infra): give each new GCP runner a Hyperdisk data disk by @ltstriker in #1896
• fix(cli): bind boxlite serve to loopback by default by @zombee0 in #1900
• build(vmm): build the pinned x86_64 vmlinux with Linux host tools by @ltstriker in #1879
• feat(infra): mount the GCP runner data disk at /var/lib/boxlite by @ltstriker in #1897
• feat(infra): configure ClickHouse retention by @zombee0 in #1883
• feat: merge logins that share a verified address into one account by @DefeatMan in #1914
• feat(auth0): retitle the sign-in screens for new accounts by @DefeatMan in #1734
• feat(plugins): add shared BoxLite setup and deployment skills by @silverzki in #1886
• ci(infra): publish release images automatically by @DefeatMan in #1607
• build(plugins): validate and package the BoxLite skills plugin by @silverzki in #1887
• fix(ssh): allocate a PTY when the terminal type is empty by @ltstriker in #1928
• feat(plugins): support BoxLite skills in Claude Code by @silverzki in #1888
• feat(image-service): add a registry proxy for byte-for-byte pulls by @silverzki in #1605
• fix(guest): report a missing main command as InvalidArgument by @ltstriker in #1925
• chore(release): bump version to 0.10.6 by @ltstriker in #1913
• chore(cli): revert boxlite update --inbound (#1777) by @ltstriker in #1931

Full Changelog: v0.10.5...v0.10.6

Security

This release fixes one Critical vulnerability, and repeats a reminder for a Critical vulnerability fixed in 0.10.1. If you are running boxlite < 0.10.6, upgrade.

GHSA-3vqm-q287-vj2j ](https://github.com/boxlite-ai/boxlite/security/advisories/GHSA-3vqm-q287-vj2j)— boxlite serve bound to all interfaces (0.0.0.0:8100) with authentication disabled by default, so
  anyone who could reach the port could create boxes, run commands in them, and read or write their files. Affects boxlite-cli 0.7.0 – 0.10.5; fixed in this release.

GHSA-7pxx-6hq6-x3jj — ](https://github.com/boxlite-ai/boxlite/security/advisories/GHSA-7pxx-6hq6-x3jj)a malicious OCI image could overwrite arbitrary host files through a cross-layer symlink during rootfs
  build, leading to RCE. Affects all SDKs < 0.10.1; fixed in 0.10.1.
  Behavior change in boxlite serve: it now binds to 127.0.0.1 by default, and refuses to start on any non-loopback address (e.g. --host 0.0.0.0, common inside containers) unless an API key is set with
  --api-key or BOXLITE_SERVE_API_KEY.
  Surfacing this here is intended for users not covered by Dependabot — curl | sh installer, prebuilt C SDK / native library, vendored source, cargo audit (uses RustSec, not the GitHub Advisory Database). See
  SECURITY.md.