Repository navigation

Releases

v0.3.2 Pre-release

Pre-release

github-actions released this 11 Nov 02:57

v0.3.2

ff5a86b

nitrovin v0.3.2 with NHTSA vPIC data month 2026_10 embedded.

brew install joshuasprow/tap/nitrovin
scoop bucket add joshuasprow https://github.com/joshuasprow/scoop-bucket && scoop install nitrovin
go install github.com/joshuasprow/nitrovin/cmd/nitrovin@v0.3.2
docker run --rm -p 8080:8080 ghcr.io/joshuasprow/nitrovin:v0.3.2

Linux packages, for amd64 and arm64 (put arm64 for amd64):

sudo apt install ./nitrovin_0.3.2_linux_amd64.deb                # Debian, Ubuntu
sudo dnf install ./nitrovin_0.3.2_linux_amd64.rpm                # Fedora, RHEL
sudo apk add --allow-untrusted ./nitrovin_0.3.2_linux_amd64.apk  # Alpine

MCP clients that read the MCP Registry find the
server as io.github.joshuasprow/nitrovin (this image, run with mcp; server.json here).

Every asset has a cosign keyless bundle. To verify the release, then one
asset directly:

cosign verify-blob --bundle checksums.txt.sigstore.json \
  --certificate-identity https://github.com/joshuasprow/nitrovin/.github/workflows/release.yml@refs/tags/v0.3.2 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com checksums.txt
sha256sum --check --ignore-missing checksums.txt
cosign verify-blob --bundle nitrovin_0.3.2_linux_amd64.deb.sigstore.json \
  --certificate-identity https://github.com/joshuasprow/nitrovin/.github/workflows/release.yml@refs/tags/v0.3.2 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com nitrovin_0.3.2_linux_amd64.deb
cosign verify ghcr.io/joshuasprow/nitrovin:v0.3.2 \
  --certificate-identity https://github.com/joshuasprow/nitrovin/.github/workflows/release.yml@refs/tags/v0.3.2 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Changelog

426dbda adr 0014: published identities after the move to marcy-cloud (#185) (#201)
886e111 ci: run contract tests when README.md changes (TestFormREADME) (#199)
72f3d67 deploy: turn Cloudflare Web Analytics off for nitrovin.app (#192) (#204)
ddd9574 release: submit to winget only when WINGET_SUBMIT is true (#116) (#203)
f76a3d8 tests: the vocabulary fixture runs on any data month, required to pass in contract.yml (#196) (#205)
2e13208 ui: /vocab offers part vocabularies as targets, a form from an entry per spine (#198) (#202)
86e4804 ui: one Vocabularies page, plain intro, slim list with Details (demo) (#215)
ff5a86b ui: the Ram example VIN with a valid check digit (demo) (#219)
ae8b5a1 ui: top nav, plain decode page and a vehicle summary (demo) (#217)
3dd5318 ui: translate shows names first, result on top, default targets (demo) (#216)

Benchmarks

bench/vocab on AMD EPYC 9V74 80-Core Processor, linux/amd64, go1.27.3. Requests run on one core: p50 / p99, then throughput. The budgets are stated for the reference machine (Apple M5 Pro class); a CI runner measures about 2× slower, so these numbers are reported beside them, not held to them. To reproduce them: CONTRIBUTING.md.

Decode alone (1HGCM82633A004352): 40 / 123 µs · 19k/s. Budget: ≥ 20k VIN/s and < 1 ms.

	fixture, 13 entries	EPA, 5,747 entries	MVL-1M (synthetic), 1,000,000 entries	budget
load, 1 core	23 ms, 43 MB peak	28 ms, 47 MB peak	2.65 s, 693 MB peak	< 100 ms up to EPA scale; < 2 s and < 1 GB peak at 1M
load, 4 cores	23 ms, 37 MB peak	23 ms, 41 MB peak	1.90 s, 710 MB peak	< 100 ms up to EPA scale; < 2 s and < 1 GB peak at 1M
translate VIN (decode + translate)	47 / 176 µs · 15k/s	40 / 152 µs · 18k/s	52 / 211 µs · 13k/s	p99 < 1 ms
translate name	1.7 / 21 µs · 380k/s	1.9 / 20 µs · 349k/s	2.1 / 12 µs · 289k/s	p99 < 1 ms
translate spine id (vPIC model → vocabulary)	1.6 / 19 µs · 414k/s	2.4 / 27 µs · 279k/s	6.0 / 63 µs · 100k/s	p99 < 1 ms
list, first page	2.6 / 51 µs · 203k/s	26 / 180 µs · 19k/s	24 / 143 µs · 24k/s	p99 < 1 ms at 1M
list, next page (cursor)	—	28 / 205 µs · 17k/s	25 / 162 µs · 22k/s	p99 < 1 ms at 1M
list, where first field	0.6 / 3.9 µs · 856k/s	27 / 197 µs · 18k/s	8.8 / 88 µs · 63k/s	p99 < 1 ms at 1M
list `vpic` where make	16 / 154 µs · 26k/s	16 / 162 µs · 25k/s	16 / 154 µs · 26k/s	p99 < 1 ms at 1M

Assets 42

v0.3.1 Pre-release

Pre-release

github-actions released this 11 Nov 01:24

v0.3.1

0bf54fa

nitrovin v0.3.1 with NHTSA vPIC data month 2026_10 embedded.

brew install joshuasprow/tap/nitrovin
scoop bucket add joshuasprow https://github.com/joshuasprow/scoop-bucket && scoop install nitrovin
go install github.com/joshuasprow/nitrovin/cmd/nitrovin@v0.3.1
docker run --rm -p 8080:8080 ghcr.io/joshuasprow/nitrovin:v0.3.1

Linux packages, for amd64 and arm64 (put arm64 for amd64):

sudo apt install ./nitrovin_0.3.1_linux_amd64.deb                # Debian, Ubuntu
sudo dnf install ./nitrovin_0.3.1_linux_amd64.rpm                # Fedora, RHEL
sudo apk add --allow-untrusted ./nitrovin_0.3.1_linux_amd64.apk  # Alpine

MCP clients that read the MCP Registry find the
server as io.github.joshuasprow/nitrovin (this image, run with mcp; server.json here).

Every asset has a cosign keyless bundle. To verify the release, then one
asset directly:

cosign verify-blob --bundle checksums.txt.sigstore.json \
  --certificate-identity https://github.com/joshuasprow/nitrovin/.github/workflows/release.yml@refs/tags/v0.3.1 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com checksums.txt
sha256sum --check --ignore-missing checksums.txt
cosign verify-blob --bundle nitrovin_0.3.1_linux_amd64.deb.sigstore.json \
  --certificate-identity https://github.com/joshuasprow/nitrovin/.github/workflows/release.yml@refs/tags/v0.3.1 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com nitrovin_0.3.1_linux_amd64.deb
cosign verify ghcr.io/joshuasprow/nitrovin:v0.3.1 \
  --certificate-identity https://github.com/joshuasprow/nitrovin/.github/workflows/release.yml@refs/tags/v0.3.1 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Changelog

835c8ba Benchmarks: every README row re-measured on one machine, nitrovin added (#162) (#191)
3e7b0f8 docs: compatibility and interoperability are the goals (#193)
0bf54fa ui: /vocab's translate forms with examples, and a target selection that follows the visitor (#194) (#195)

Benchmarks

bench/vocab on AMD EPYC 9V45 96-Core Processor, linux/amd64, go1.27.3. Requests run on one core: p50 / p99, then throughput. The budgets are stated for the reference machine (Apple M5 Pro class); a CI runner measures about 2× slower, so these numbers are reported beside them, not held to them. To reproduce them: CONTRIBUTING.md.

Decode alone (1HGCM82633A004352): 30 / 129 µs · 25k/s. Budget: ≥ 20k VIN/s and < 1 ms.

	fixture, 13 entries	EPA, 5,747 entries	MVL-1M (synthetic), 1,000,000 entries	budget
load, 1 core	19 ms, 45 MB peak	23 ms, 49 MB peak	2.06 s, 693 MB peak	< 100 ms up to EPA scale; < 2 s and < 1 GB peak at 1M
load, 4 cores	19 ms, 37 MB peak	19 ms, 43 MB peak	1.43 s, 711 MB peak	< 100 ms up to EPA scale; < 2 s and < 1 GB peak at 1M
translate VIN (decode + translate)	32 / 109 µs · 22k/s	28 / 102 µs · 25k/s	48 / 166 µs · 15k/s	p99 < 1 ms
translate name	1.2 / 16 µs · 525k/s	1.4 / 17 µs · 466k/s	1.7 / 10 µs · 364k/s	p99 < 1 ms
translate spine id (vPIC model → vocabulary)	1.2 / 16 µs · 523k/s	1.8 / 26 µs · 358k/s	4.5 / 45 µs · 139k/s	p99 < 1 ms
list, first page	2.2 / 37 µs · 267k/s	21 / 116 µs · 26k/s	18 / 116 µs · 30k/s	p99 < 1 ms at 1M
list, next page (cursor)	—	23 / 143 µs · 23k/s	19 / 133 µs · 27k/s	p99 < 1 ms at 1M
list, where first field	0.5 / 2.0 µs · 1.2M/s	23 / 126 µs · 24k/s	6.8 / 60 µs · 85k/s	p99 < 1 ms at 1M
list `vpic` where make	13 / 103 µs · 32k/s	12 / 122 µs · 32k/s	12 / 104 µs · 34k/s	p99 < 1 ms at 1M

Assets 42

v0.3.0 Pre-release

Pre-release

github-actions released this 11 Nov 00:21

v0.3.0

5aea377

Pages for browsers, and your vocabularies in your own browser

nitrovin serve, and nitrovin.app, now serve pages under /ui beside the API, built on ADR 0013: htmx over server-rendered Go templates, so everything works without JavaScript except the vocabularies kept in your browser, which say so. /v1 is unchanged.

New

/ui pages (#176, #188): one layout and error page, htmx vendored and served with the stylesheet under release-versioned URLs (/ui/r/<release>/…, immutable). /ui/translate translates a VIN or an entry, and /ui/vocabularies lists the server's catalog and pages through a vocabulary's entries.
The decode form moves to /ui/decode (#178). / stays the entry page; old /?vin=… links redirect (301) to /ui/decode?vin=….
/vocab (#189): one catalog of vPIC, the server's files and this browser's, each marked by where it lives, with its drift. Pick or drop your own JSON Lines files to load them; refused removes name the files that depend on the one removed. Without JavaScript the page lists the server's catalog and says your own files need it.
Browser vocabularies (#188): your files are kept in this browser (IndexedDB, with a parsed index for a cold start under 1 s) and translated there by the same Go handlers built to WebAssembly in a Service Worker (/sw.js). They are never uploaded: only a VIN's /v1/decode goes to the server.
EPA in one click: /vocab offers EPA's vocabulary of the release's data month (epa-vehicles, embedded from nitrovin-data's signed release) to load into your browser.
Spine bundle (#177): each release publishes the data month's vPIC makes and models (/ui/r/<release>/spine.json) and the server's loaded files, which the Service Worker links to.
nitrovin.app (#175): the Worker caches /ui/r/… under the release key, keeps /sw.js no-cache, and the deploy smoke checks /vocab without JavaScript, a /ui/decode fragment, /sw.js and the release's sw.wasm.

nitrovin v0.3.0 with NHTSA vPIC data month 2026_10 embedded.

brew install joshuasprow/tap/nitrovin
scoop bucket add joshuasprow https://github.com/joshuasprow/scoop-bucket && scoop install nitrovin
go install github.com/joshuasprow/nitrovin/cmd/nitrovin@v0.3.0
docker run --rm -p 8080:8080 ghcr.io/joshuasprow/nitrovin:v0.3.0

Linux packages, for amd64 and arm64 (put arm64 for amd64):

sudo apt install ./nitrovin_0.3.0_linux_amd64.deb                # Debian, Ubuntu
sudo dnf install ./nitrovin_0.3.0_linux_amd64.rpm                # Fedora, RHEL
sudo apk add --allow-untrusted ./nitrovin_0.3.0_linux_amd64.apk  # Alpine

MCP clients that read the MCP Registry find the
server as io.github.joshuasprow/nitrovin (this image, run with mcp; server.json here).

Every asset has a cosign keyless bundle. To verify the release, then one
asset directly:

cosign verify-blob --bundle checksums.txt.sigstore.json \
  --certificate-identity https://github.com/joshuasprow/nitrovin/.github/workflows/release.yml@refs/tags/v0.3.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com checksums.txt
sha256sum --check --ignore-missing checksums.txt
cosign verify-blob --bundle nitrovin_0.3.0_linux_amd64.deb.sigstore.json \
  --certificate-identity https://github.com/joshuasprow/nitrovin/.github/workflows/release.yml@refs/tags/v0.3.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com nitrovin_0.3.0_linux_amd64.deb
cosign verify ghcr.io/joshuasprow/nitrovin:v0.3.0 \
  --certificate-identity https://github.com/joshuasprow/nitrovin/.github/workflows/release.yml@refs/tags/v0.3.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Changelog

5aea377 deploy: cache /ui/r/ under the release, /sw.js no-cache, smoke /vocab and /ui/decode (#175) (#190)
9fa9c50 ui: /ui foundation, routing, vendored htmx, error template, release assets, decoder-free translation core (#170) (#176)
ba7c3db ui: /vocab storage management, one-click EPA, drift (#174) (#189)
1939ae6 ui: the browser's Service Worker, its IndexedDB store, stored indexes and lifecycle (#173) (#188)
1091b73 ui: the decode form on /ui/decode, progressively enhanced (#171) (#178)
47e9f6d ui: the spine bundle and the loaded files under /ui/r// (#172) (#177)

Benchmarks

bench/vocab on AMD EPYC 7763 64-Core Processor, linux/amd64, go1.27.3. Requests run on one core: p50 / p99, then throughput. The budgets are stated for the reference machine (Apple M5 Pro class); a CI runner measures about 2× slower, so these numbers are reported beside them, not held to them. To reproduce them: CONTRIBUTING.md.

Decode alone (1HGCM82633A004352): 58 / 203 µs · 13k/s. Budget: ≥ 20k VIN/s and < 1 ms.

	fixture, 13 entries	EPA, 5,747 entries	MVL-1M (synthetic), 1,000,000 entries	budget
load, 1 core	31 ms, 43 MB peak	37 ms, 49 MB peak	3.41 s, 764 MB peak	< 100 ms up to EPA scale; < 2 s and < 1 GB peak at 1M
load, 4 cores	30 ms, 36 MB peak	29 ms, 40 MB peak	2.30 s, 734 MB peak	< 100 ms up to EPA scale; < 2 s and < 1 GB peak at 1M
translate VIN (decode + translate)	62 / 223 µs · 11k/s	55 / 209 µs · 13k/s	75 / 283 µs · 9.0k/s	p99 < 1 ms
translate name	2.0 / 27 µs · 311k/s	2.3 / 26 µs · 278k/s	2.8 / 16 µs · 210k/s	p99 < 1 ms
translate spine id (vPIC model → vocabulary)	2.0 / 25 µs · 308k/s	2.8 / 33 µs · 224k/s	7.0 / 78 µs · 90k/s	p99 < 1 ms
list, first page	3.1 / 67 µs · 159k/s	28 / 231 µs · 17k/s	26 / 188 µs · 18k/s	p99 < 1 ms at 1M
list, next page (cursor)	—	32 / 244 µs · 16k/s	28 / 197 µs · 16k/s	p99 < 1 ms at 1M
list, where first field	0.8 / 2.9 µs · 755k/s	31 / 236 µs · 16k/s	9.9 / 108 µs · 54k/s	p99 < 1 ms at 1M
list `vpic` where make	18 / 219 µs · 18k/s	19 / 195 µs · 19k/s	18 / 205 µs · 19k/s	p99 < 1 ms at 1M

Assets 42

v0.2.0 Pre-release

Pre-release

github-actions released this 10 Nov 21:43

v0.2.0

53e51bc

Vocabularies: translate and list

nitrovin now loads your own vocabularies (a yard's make/model names, a parts catalogue's part types) and translates between them, vPIC and VINs, on every surface. All of it is additive under /v1: decode's request, answer and defaults are unchanged.

Decisions

ADR 0009: a mapping names exactly one spine entry (vPIC make, vPIC model, or extension id) with an optional inclusive model-year range; an entry carries as many mappings as it resolves to.
ADR 0010: part types translate through a spine their author declares; nitrovin ships none.
ADR 0011: vocabularies, extension sets and spines are JSON Lines (docs/api/vocabulary.schema.json) loaded once at start; faults refuse to load, drift against the data month warns and serves.
ADR 0012: translate and list are requests beside decode, the same object on every surface.
ADR 0013: browser vocabularies run the same Go handlers in a Service Worker behind htmx (decision recorded; the UI ships separately).

New

HTTP: GET/POST /v1/translate, GET /v1/vocabularies, GET /v1/vocabularies/{name}/entries; /v1/info lists loaded vocabularies.
CLI: nitrovin translate, nitrovin list, nitrovin vocab check.
Loading: --vocab (repeatable) and NITROVIN_VOCAB.
MCP: translate and list tools beside decode_vin.
stdio: an op field (decode, translate, list); C: nitrovin_open_vocab.
EPA vocabulary: epa-vehicles.jsonl (signed) on the data release nitrovin-data v1.202610.2, built by the monthly refresh and gated on vocab check.
Performance: 1M entries load in about 0.6 s / 0.7 GB; list pages under 1 ms (#157, #158). Benchmarks below (#159).

Fixed

Decode: VINs where Vehicle Specs repeats a pattern element (e.g. Mustang Mach-E) no longer fail with internal error "element 1 has several items"; Other Battery Info is multi-valued (#165).

nitrovin v0.2.0 with NHTSA vPIC data month 2026_10 embedded.

brew install joshuasprow/tap/nitrovin
scoop bucket add joshuasprow https://github.com/joshuasprow/scoop-bucket && scoop install nitrovin
go install github.com/joshuasprow/nitrovin/cmd/nitrovin@v0.2.0
docker run --rm -p 8080:8080 ghcr.io/joshuasprow/nitrovin:v0.2.0

Linux packages, for amd64 and arm64 (put arm64 for amd64):

sudo apt install ./nitrovin_0.2.0_linux_amd64.deb                # Debian, Ubuntu
sudo dnf install ./nitrovin_0.2.0_linux_amd64.rpm                # Fedora, RHEL
sudo apk add --allow-untrusted ./nitrovin_0.2.0_linux_amd64.apk  # Alpine

MCP clients that read the MCP Registry find the
server as io.github.joshuasprow/nitrovin (this image, run with mcp; server.json here).

Every asset has a cosign keyless bundle. To verify the release, then one
asset directly:

cosign verify-blob --bundle checksums.txt.sigstore.json \
  --certificate-identity https://github.com/joshuasprow/nitrovin/.github/workflows/release.yml@refs/tags/v0.2.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com checksums.txt
sha256sum --check --ignore-missing checksums.txt
cosign verify-blob --bundle nitrovin_0.2.0_linux_amd64.deb.sigstore.json \
  --certificate-identity https://github.com/joshuasprow/nitrovin/.github/workflows/release.yml@refs/tags/v0.2.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com nitrovin_0.2.0_linux_amd64.deb
cosign verify ghcr.io/joshuasprow/nitrovin:v0.2.0 \
  --certificate-identity https://github.com/joshuasprow/nitrovin/.github/workflows/release.yml@refs/tags/v0.2.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Changelog

53e51bc adr 0013: browser vocabularies, the same Go handlers in a Service Worker behind htmx (#148) (#169)
e4d6dae bench/vocab: vocabulary benchmarks, reported in the release notes (#159) (#166)
91e7612 contract: Other Battery Info is multi-valued (#165) (#167)
417a091 docs: vocabularies, a README section and docs/vocabularies.md (#141) (#168)
6205ac3 mcp: fix the clock in TestMCPVocabSession (#140) (#164)
c430e17 serve: GET and POST /v1/translate, GET /v1/vocabularies and /v1/vocabularies/{name}/entries (#137) (#156)
a0f5c2e stdio, C: op field (decode, translate, list) and nitrovin_open_vocab (#138) (#155)
4563d36 vocab: load 1M entries in 0.6 s and 0.7 GB: streaming, map-free, parallel parsing (#158) (#163)

Benchmarks

Decode alone (1HGCM82633A004352): 40 / 124 µs · 19k/s. Budget: ≥ 20k VIN/s and < 1 ms.

	fixture, 13 entries	EPA, 5,747 entries	MVL-1M (synthetic), 1,000,000 entries	budget
load, 1 core	16 ms, 46 MB peak	22 ms, 49 MB peak	2.56 s, 693 MB peak	< 100 ms up to EPA scale; < 2 s and < 1 GB peak at 1M
load, 4 cores	15 ms, 37 MB peak	19 ms, 43 MB peak	1.73 s, 711 MB peak	< 100 ms up to EPA scale; < 2 s and < 1 GB peak at 1M
translate VIN (decode + translate)	46 / 160 µs · 15k/s	44 / 158 µs · 17k/s	65 / 266 µs · 12k/s	p99 < 1 ms
translate name	1.8 / 21 µs · 366k/s	2.0 / 22 µs · 333k/s	2.1 / 13 µs · 280k/s	p99 < 1 ms
translate spine id (vPIC model → vocabulary)	1.7 / 20 µs · 389k/s	2.4 / 28 µs · 269k/s	6.0 / 59 µs · 101k/s	p99 < 1 ms
list, first page	2.8 / 51 µs · 190k/s	25 / 221 µs · 21k/s	24 / 143 µs · 22k/s	p99 < 1 ms at 1M
list, next page (cursor)	—	27 / 231 µs · 19k/s	25 / 145 µs · 20k/s	p99 < 1 ms at 1M
list, where first field	0.6 / 2.3 µs · 997k/s	26 / 236 µs · 19k/s	8.7 / 85 µs · 65k/s	p99 < 1 ms at 1M
list `vpic` where make	16 / 207 µs · 22k/s	16 / 176 µs · 23k/s	16 / 168 µs · 23k/s	p99 < 1 ms at 1M

Assets 42

v0.1.8 Pre-release

Pre-release

github-actions released this 10 Nov 20:33

v0.1.8

4834e5c

nitrovin v0.1.8 with NHTSA vPIC data month 2026_10 embedded.

brew install joshuasprow/tap/nitrovin
scoop bucket add joshuasprow https://github.com/joshuasprow/scoop-bucket && scoop install nitrovin
go install github.com/joshuasprow/nitrovin/cmd/nitrovin@v0.1.8
docker run --rm -p 8080:8080 ghcr.io/joshuasprow/nitrovin:v0.1.8

Linux packages, for amd64 and arm64 (put arm64 for amd64):

sudo apt install ./nitrovin_0.1.8_linux_amd64.deb                # Debian, Ubuntu
sudo dnf install ./nitrovin_0.1.8_linux_amd64.rpm                # Fedora, RHEL
sudo apk add --allow-untrusted ./nitrovin_0.1.8_linux_amd64.apk  # Alpine

MCP clients that read the MCP Registry find the
server as io.github.joshuasprow/nitrovin (this image, run with mcp; server.json here).

Every asset has a cosign keyless bundle. To verify the release, then one
asset directly:

cosign verify-blob --bundle checksums.txt.sigstore.json \
  --certificate-identity https://github.com/joshuasprow/nitrovin/.github/workflows/release.yml@refs/tags/v0.1.8 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com checksums.txt
sha256sum --check --ignore-missing checksums.txt
cosign verify-blob --bundle nitrovin_0.1.8_linux_amd64.deb.sigstore.json \
  --certificate-identity https://github.com/joshuasprow/nitrovin/.github/workflows/release.yml@refs/tags/v0.1.8 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com nitrovin_0.1.8_linux_amd64.deb
cosign verify ghcr.io/joshuasprow/nitrovin:v0.1.8 \
  --certificate-identity https://github.com/joshuasprow/nitrovin/.github/workflows/release.yml@refs/tags/v0.1.8 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Changelog

ee2b870 ADR 0011: vocabularies are JSON Lines loaded once, drift warns; vocabulary.schema.json (#122) (#133)
a8297f3 MCP: translate and list tools (#140) (#153)
4834e5c Refresh: data month 2026_10 (nitrovin-data v1.202610.2) (#160)
29372c7 adr 0009: what a vocabulary mapping says; GLOSSARY gains Translation (#120) (#130)
e742325 adr 0010: part types translate through a declared spine; GLOSSARY gains Declared spine (#121) (#132)
1214931 adr 0012: translation and listing are requests beside decode; vpic is a reserved vocabulary name (#123) (#134)
129c755 cli: nitrovin translate and nitrovin list (#139) (#154)
faef48f deploy.yml: smoke waits for the container rollout (#127) (#129)
ba38ac2 epa: build the epa-vehicles vocabulary from vehicles.csv plus curated overrides (#145) (#150)
b105822 refresh: build the EPA vocabulary against each month, gate it on vocab check, publish it with the data release (#152)
cfe3899 translate: Translator.Translate and List, the contract types and schema defs (#136) (#151)
3ccd7f0 vocab: load vocabularies with --vocab and NITROVIN_VOCAB, faults, drift, /v1/info, vocab check (#135) (#149)
287e06a vocab: page lists off the sorted index, narrow where by leading fields, cache vPIC models per make (#157) (#161)
2bc564e worker: place the container in the US, ENAM and WNAM (#124) (#125)
3c5104c worker: the Durable Object in ENAM, one container trip per miss (#126) (#128)

Assets 42

v0.1.7 Pre-release

Pre-release

github-actions released this 10 Nov 16:23

v0.1.7

f32dd54

nitrovin v0.1.7 with NHTSA vPIC data month 2026_10 embedded.

brew install joshuasprow/tap/nitrovin
scoop bucket add joshuasprow https://github.com/joshuasprow/scoop-bucket && scoop install nitrovin
go install github.com/joshuasprow/nitrovin/cmd/nitrovin@v0.1.7
docker run --rm -p 8080:8080 ghcr.io/joshuasprow/nitrovin:v0.1.7

Linux packages, for amd64 and arm64 (put arm64 for amd64):

sudo apt install ./nitrovin_0.1.7_linux_amd64.deb                # Debian, Ubuntu
sudo dnf install ./nitrovin_0.1.7_linux_amd64.rpm                # Fedora, RHEL
sudo apk add --allow-untrusted ./nitrovin_0.1.7_linux_amd64.apk  # Alpine

MCP clients that read the MCP Registry find the
server as io.github.joshuasprow/nitrovin (this image, run with mcp; server.json here).

Every asset has a cosign keyless bundle. To verify the release, then one
asset directly:

cosign verify-blob --bundle checksums.txt.sigstore.json \
  --certificate-identity https://github.com/joshuasprow/nitrovin/.github/workflows/release.yml@refs/tags/v0.1.7 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com checksums.txt
sha256sum --check --ignore-missing checksums.txt
cosign verify-blob --bundle nitrovin_0.1.7_linux_amd64.deb.sigstore.json \
  --certificate-identity https://github.com/joshuasprow/nitrovin/.github/workflows/release.yml@refs/tags/v0.1.7 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com nitrovin_0.1.7_linux_amd64.deb
cosign verify ghcr.io/joshuasprow/nitrovin:v0.1.7 \
  --certificate-identity https://github.com/joshuasprow/nitrovin/.github/workflows/release.yml@refs/tags/v0.1.7 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Changelog

1d6482b Pin every tool with mise: mise.toml + mise.lock, one mise step in every workflow (#106) (#110)
02a8f37 deploy/cloudflare: nitrovin.app on a Worker + warm lite container; Terraform (R2 state) + wrangler; deploy.yml (#104) (#108)
f32dd54 goreleaser: winget commits authored by Josh so the Microsoft CLA attaches (the bot author kept every PR at Needs-CLA) (#115)
4e7fc00 smoke.sh waits for the host to answer; README names nitrovin.app (#104) (#113)
9d6d32f terraform/token: create the state bucket and its R2 token too (#109)
85d81f8 terraform/token: the containers permission is "Workers Containers Write" (#111)
4d946cf worker: a cache hit never reaches the container (#104) (#114)

Assets 42

v0.1.6 Pre-release

Pre-release

github-actions released this 10 Nov 15:28

v0.1.6

be569e7

nitrovin v0.1.6 with NHTSA vPIC data month 2026_10 embedded.

brew install joshuasprow/tap/nitrovin
scoop bucket add joshuasprow https://github.com/joshuasprow/scoop-bucket && scoop install nitrovin
go install github.com/joshuasprow/nitrovin/cmd/nitrovin@v0.1.6
docker run --rm -p 8080:8080 ghcr.io/joshuasprow/nitrovin:v0.1.6

Linux packages, for amd64 and arm64 (put arm64 for amd64):

sudo apt install ./nitrovin_0.1.6_linux_amd64.deb                # Debian, Ubuntu
sudo dnf install ./nitrovin_0.1.6_linux_amd64.rpm                # Fedora, RHEL
sudo apk add --allow-untrusted ./nitrovin_0.1.6_linux_amd64.apk  # Alpine

MCP clients that read the MCP Registry find the
server as io.github.joshuasprow/nitrovin (this image, run with mcp; server.json here).

Every asset has a cosign keyless bundle. To verify the release, then one
asset directly:

cosign verify-blob --bundle checksums.txt.sigstore.json \
  --certificate-identity https://github.com/joshuasprow/nitrovin/.github/workflows/release.yml@refs/tags/v0.1.6 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com checksums.txt
sha256sum --check --ignore-missing checksums.txt
cosign verify-blob --bundle nitrovin_0.1.6_linux_amd64.deb.sigstore.json \
  --certificate-identity https://github.com/joshuasprow/nitrovin/.github/workflows/release.yml@refs/tags/v0.1.6 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com nitrovin_0.1.6_linux_amd64.deb
cosign verify ghcr.io/joshuasprow/nitrovin:v0.1.6 \
  --certificate-identity https://github.com/joshuasprow/nitrovin/.github/workflows/release.yml@refs/tags/v0.1.6 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Changelog

be569e7 serve: MCP over Streamable HTTP at /mcp, and --cors for /v1 and /mcp (#104) (#105)

Assets 42

v0.1.5 Pre-release

Pre-release

github-actions released this 10 Nov 01:47

v0.1.5

7895cbd

nitrovin v0.1.5 with NHTSA vPIC data month 2026_10 embedded.

brew install joshuasprow/tap/nitrovin
scoop bucket add joshuasprow https://github.com/joshuasprow/scoop-bucket && scoop install nitrovin
go install github.com/joshuasprow/nitrovin/cmd/nitrovin@v0.1.5
docker run --rm -p 8080:8080 ghcr.io/joshuasprow/nitrovin:v0.1.5

Linux packages, for amd64 and arm64 (put arm64 for amd64):

sudo apt install ./nitrovin_0.1.5_linux_amd64.deb                # Debian, Ubuntu
sudo dnf install ./nitrovin_0.1.5_linux_amd64.rpm                # Fedora, RHEL
sudo apk add --allow-untrusted ./nitrovin_0.1.5_linux_amd64.apk  # Alpine

MCP clients that read the MCP Registry find the
server as io.github.joshuasprow/nitrovin (this image, run with mcp; server.json here).

Every asset has a cosign keyless bundle. To verify the release, then one
asset directly:

cosign verify-blob --bundle checksums.txt.sigstore.json \
  --certificate-identity https://github.com/joshuasprow/nitrovin/.github/workflows/release.yml@refs/tags/v0.1.5 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com checksums.txt
sha256sum --check --ignore-missing checksums.txt
cosign verify-blob --bundle nitrovin_0.1.5_linux_amd64.deb.sigstore.json \
  --certificate-identity https://github.com/joshuasprow/nitrovin/.github/workflows/release.yml@refs/tags/v0.1.5 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com nitrovin_0.1.5_linux_amd64.deb
cosign verify ghcr.io/joshuasprow/nitrovin:v0.1.5 \
  --certificate-identity https://github.com/joshuasprow/nitrovin/.github/workflows/release.yml@refs/tags/v0.1.5 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Changelog

ace4bbc CI runs what a change can affect (#92) (#93)
8727f74 Decode form: orientation, grouped results, error-code text, suggested VIN, copy buttons (#91) (#94)
7895cbd Release: Linux packages (deb/rpm/apk via nfpm) and the MCP Registry entry (#102) (#103)

Assets 42

v0.1.4 Pre-release

Pre-release

github-actions released this 09 Nov 21:06

v0.1.4

5855b6e

nitrovin v0.1.4 with NHTSA vPIC data month 2026_10 embedded.

brew install joshuasprow/tap/nitrovin
scoop bucket add joshuasprow https://github.com/joshuasprow/scoop-bucket && scoop install nitrovin
go install github.com/joshuasprow/nitrovin/cmd/nitrovin@v0.1.4
docker run --rm -p 8080:8080 ghcr.io/joshuasprow/nitrovin:v0.1.4

Every asset has a cosign keyless bundle. To verify one:

cosign verify-blob --bundle checksums.txt.sigstore.json \
  --certificate-identity https://github.com/joshuasprow/nitrovin/.github/workflows/release.yml@refs/tags/v0.1.4 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com checksums.txt
sha256sum --check --ignore-missing checksums.txt
cosign verify ghcr.io/joshuasprow/nitrovin:v0.1.4 \
  --certificate-identity https://github.com/joshuasprow/nitrovin/.github/workflows/release.yml@refs/tags/v0.1.4 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Changelog

5855b6e goreleaser: winget token must be exactly {{ .Env.VAR }} (v0.1.3 release failed at the winget step after publishing everything else) (#89)

Assets 28

v0.1.3 Pre-release

Pre-release

github-actions released this 09 Nov 20:51

v0.1.3

52a3e2b

nitrovin v0.1.3 with NHTSA vPIC data month 2026_10 embedded.

brew install joshuasprow/tap/nitrovin
scoop bucket add joshuasprow https://github.com/joshuasprow/scoop-bucket && scoop install nitrovin
go install github.com/joshuasprow/nitrovin/cmd/nitrovin@v0.1.3
docker run --rm -p 8080:8080 ghcr.io/joshuasprow/nitrovin:v0.1.3

Every asset has a cosign keyless bundle. To verify one:

cosign verify-blob --bundle checksums.txt.sigstore.json \
  --certificate-identity https://github.com/joshuasprow/nitrovin/.github/workflows/release.yml@refs/tags/v0.1.3 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com checksums.txt
sha256sum --check --ignore-missing checksums.txt
cosign verify ghcr.io/joshuasprow/nitrovin:v0.1.3 \
  --certificate-identity https://github.com/joshuasprow/nitrovin/.github/workflows/release.yml@refs/tags/v0.1.3 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Changelog

080b2b6 Public docs: README per surface, verify, data, parity, limits (#83) (#85)
5991ba5 refresh.yml: notify counts any result but success or skipped as red (#69) (#81)
52a3e2b serve: decode form at GET / for browsers (#87) (#88)

Assets 28

v0.3.2

Changelog

Benchmarks

Uh oh!

v0.3.1

Changelog

Benchmarks

Uh oh!

v0.3.0

Pages for browsers, and your vocabularies in your own browser

New

Changelog

Benchmarks

Uh oh!

v0.2.0

Vocabularies: translate and list

Decisions

New

Fixed

Changelog

Benchmarks

Uh oh!

v0.1.8

Changelog

Uh oh!

v0.1.7

Changelog

Uh oh!

v0.1.6

Changelog

Uh oh!

v0.1.5

Changelog

Uh oh!

v0.1.4

Changelog

Uh oh!

v0.1.3

Changelog

Uh oh!