v0.3.2

Compatibility and security notes

• GitHub JavaScript actions run on GitHub's Node 24 engine. A real Vectis job verified that a legacy using: node20 action runs on Node 24, while actions/setup-node can still select Node 20 for workflow commands.
• Node 20.20.2 accepted a known-compromised eMudhra certificate chain in our TLS test. Node 20 workflow compatibility is not a guarantee of TLS protection; use a runtime with verified trust fixes for TLS-sensitive work.
• Updating the app/service does not rewrite existing prepared VM images. Refresh their runner and guest trust configuration separately. Existing full-Xcode macOS environments should be preserved until a replacement is validated.
• Experimental Windows guests require separately installed QEMU, qemu-img, swtpm, ARM64 UEFI firmware, and the required Windows and driver installation media. These release assets do not bundle the optional Windows runtime.

What's Changed

Other changes

• fix(convex): cap connected Macs per account and expire stale jobs by @kerdofficial in #120
• fix(security): reject compromised eMudhra chains and default macOS guests to 27 by @kerdofficial in #118
• test(server): gate the macOS sync delay instead of comparing wall clocks by @kerdofficial in #126
• chore(deps): update dependencies with security fixes by @kerdofficial in #124
• chore(release): v0.3.2 by @kerdofficial in #127
• test(server): settle the provision helper deterministically under short deadlines by @kerdofficial in #128
• fix(security): tighten account CSP and update tooling dependencies by @kerdofficial in #129
• fix(deps): remove unused CLI and AsyncAPI dependencies by @kerdofficial in #130

Full Changelog: v0.3.1...v0.3.2