Skip to content

0.6.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 07 Jul 23:07
v0.6.1
51b9568

Release Notes

Changed

  • vallum doctor's hook (codex) line now reminds, on a successful install,
    that Codex requires a one-time hook trust (and codex-cli ≥ 0.141) — Codex
    silently skips untrusted hooks, and that trust state is invisible to Vallum.

Documentation

  • README + SECURITY.md: documented two live-verified Codex CLI findings
    (2026-07-08, codex-cli 0.142.5): an installed-but-untrusted hook is skipped
    without warning (fail-open until the one-time trust step), and hook-trust
    handling in codex exec was only fixed in codex-cli 0.141.0
    (openai/codex#26434) — on 0.139 the hook never fired at all. Enforcement
    (Ask-rule deny, benign pass-through, agent=codex audit lines) verified
    live end-to-end on 0.142.5.

Install vallum 0.6.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/kahramanemir/Vallum/releases/download/v0.6.1/vallum-installer.sh | sh

Install prebuilt binaries via Homebrew

brew install kahramanemir/tap/vallum

Install prebuilt binaries into your npm project

npm install vallum@0.6.1

Download vallum 0.6.1

File Platform Checksum
vallum-aarch64-apple-darwin.tar.xz Apple Silicon macOS checksum
vallum-x86_64-apple-darwin.tar.xz Intel macOS checksum
vallum-aarch64-unknown-linux-musl.tar.xz ARM64 MUSL Linux checksum
vallum-x86_64-unknown-linux-musl.tar.xz x64 MUSL Linux checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo kahramanemir/Vallum

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>
Assets 17
Loading