v0.21

Security Advisory

• GitHub SSH host key pinning is ineffective (keys pinned under names that never match github.com) : GHSA-jh8m-6px3-36vq Credits : @s-celles
• sudo upgrade --securix-branch lets operators build any Sécurix branch or old tag as root, bypassing enableAnyBranch : GHSA-g3gq-73v7-3hg2 credits : @s-celles
• Local Privilege Escalation via path traversal in upgrade --subdir parameter : GHSA-q4vh-9jrc-86m2 Credits @7h30th3r0n3 @s-celles

What's Changed

• feat: use reordered option ipsec dn by @plegrand-dinum in #279
• remove 'sudo -u "$user"' when $user is empty by @royce-c in #284
• chore: add reset yubikey tool community by @plegrand-dinum in #283
• docs(readme): fix typos and typography by @s-celles-bot in #297
• feat(community): implement a basic telemetry reporter by @ldesgouilles-dinum in #281
• Fixes for community/reset-yubikey by @ldesgouilles-dinum in #302
• fix(inventory-generator): enum quotes by @plegrand-dinum in #303
• chore: Uniformise SPDX header for myself by @xmaso-dinum in #308
• tests: drop the sway keybindings test by @QuentinCazier in #274
• lib: make buildNetbootInstaller produce a servable netbootIpxeScript by @T2an in #271
• chore(security): Default to empty permissions on GH Actions by @xmaso-dinum in #306
• modules/tools/browsers: finish the browser abstraction by @RISK-alt in #239
• config: Add @ldesgouilles-dinum as code owner by @jdauphant-dinum in #305

New Contributors

• @royce-c made their first contribution in #284
• @s-celles-bot made their first contribution in #297

Full Changelog: v0.20.2...v0.21