Skip to content

v2.4.0

Choose a tag to compare

View all tags
@leggetter leggetter released this 07 Aug 16:00
· 6 commits to main since this release
v2.4.0
77581d4
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Summary

v2.4.0 makes --cli-key a documented flag on hookdeck listen, saves the key on machines that have no login yet, and fixes it failing when you already have one. It also updates the dependency set and the toolchain used to build releases.

New features

--cli-key is now a documented flag on listen (#329)

hookdeck listen --cli-key <key> authenticates a single run with a user-scoped CLI key, such as the one shown in the Hookdeck Console. The flag now appears in help output:

$ hookdeck listen --help
      --cli-key string   Hookdeck CLI key used to authenticate this command, e.g. the key shown in the Hookdeck Console

Anything that reads the CLI's help — your shell's completion, scripts, tooling — can now see it.

listen remembers the key when you have no login (#329)

Copy a command from the Hookdeck Console:

npx hookdeck-cli listen 3000 my-source --cli-key <key>

If the machine has no stored credential, the key is validated and saved, and later runs no longer need the flag:

Saved CLI key for Sandbox. Future runs won't need --cli-key.

If you already have a login, nothing is written. The key applies to that run only, so a few minutes of forwarding a Console source will not replace the account you were signed in to.

Fixes

  • --cli-key no longer fails when you already have a login (#329). The supplied key was sent alongside the project id from your previous login. They belong to different projects, so every call failed with your API key is invalid or expired, with nothing to indicate why. The key's own project is now resolved and used for that run.
  • An empty --cli-key fails immediately (#329). --cli-key= reached the API and came back as an authentication error, which described neither the problem nor the fix. It now fails locally: --cli-key needs a value.

Security

  • golang.org/x/crypto updated to v0.52.0 (#330) — resolves 13 advisories (7 critical, 2 high, 4 moderate). The package is an indirect dependency that the CLI does not import directly, so exposure was limited.
  • Release binaries now build with Go 1.26.5 (#330), up from 1.24.9. The previous toolchain carried standard library advisories reachable from this code in crypto/x509, crypto/tls, net/http and net/textproto. Scanning the same tree under both: 10 findings before, 1 after.

Internal

  • Releases are gated on the acceptance suite via a reusable workflow (#328)
  • Unit tests and builds now run on push to main (#325)
  • Fixed a telemetry test flake caused by proxy state carrying across 502 retries (#327)
  • Added KNOWN_ISSUES.md, starting with listen session expiry (#324)

Full Changelog: v2.3.2...v2.4.0

Assets 13
Loading