cli/v0.6.1

What's Changed

• fix(cli): install.sh installs to ~/.local/bin like keyway.sh/install.sh by @NicolasRitouet in #38
• feat(backend): key re-encryption job for ENCRYPTION_KEYS rotation by @NicolasRitouet in #39
• fix(backend): push writes only where access was checked by @NicolasRitouet in #40
• fix(backend): push keeps every overwritten value and guards released clients by @NicolasRitouet in #41
• fix(cli): lossless set, push and pull (0.6.1) by @NicolasRitouet in #42

Full Changelog: cli/v0.6.0...cli/v0.6.1

cli/v0.6.0

Keyway CLI 0.6.0: security release

Upgrading is recommended for everyone.

0.6.0 is built with Go 1.26.10. 0.5.3 was built with Go 1.24.0, and govulncheck reports 67 known vulnerabilities in the 0.5.3 binary against none in 0.6.0. The fixes come from the Go standard library, golang.org/x/net and golang.org/x/text. The ones that matter most for a CLI that talks to the Keyway API over HTTPS:

• TLS certificate verification (crypto/x509): distrust of compromised intermediate certificates (GO-2026-6809), name-constraint and policy validation fixes (GO-2025-4175, GO-2025-3749), and chain-building denial-of-service fixes (GO-2026-4946, GO-2026-4947).
• TLS (crypto/tls): unexpected session resumption (GO-2026-4337), handshake messages processed at the wrong encryption level (GO-2026-4340), and post-handshake / KeyUpdate denial of service (GO-2026-4870, GO-2026-6090).
• HTTP and URL parsing: 12 net/http and 4 net/url fixes, plus an HTTP/2 infinite loop in golang.org/x/net (GO-2026-4918).

There are no functional changes to the commands.

Upgrade

brew upgrade keyway                      # Homebrew (keywaysh/tap)
npm install -g @keywaysh/cli@latest      # npm
curl -fsSL https://keyway.sh/install.sh | sh

With npm 12 or later, install scripts are blocked by default, and the npm package downloads its binary from one. Use npm install -g --allow-scripts=@keywaysh/cli @keywaysh/cli@latest, or Homebrew / the install script.

Check your version with keyway --version.

Release pipeline

CLI releases now ship from this monorepo under cli/v* tags. The npm package is published with provenance from this workflow, and checksums.txt lists the SHA-256 of every archive. The old keywaysh/cli repository is archived.

macOS binaries are not code-signed or notarized yet.

cli/v0.6.0-rc.1

What's Changed

• feat: self-hosting support by @NicolasRitouet in #1
• fix: prevent dashboard crash when vault repo is deleted by @NicolasRitouet in #2
• docs: update MCP server docs with missing tools by @NicolasRitouet in #3
• fix(cli): map .env.local to development environment by @NicolasRitouet in #4
• .github/workflows: Migrate workflows to Blacksmith runners by @blacksmith-sh[bot] in #7
• chore: update and pin all dependencies by @NicolasRitouet in #5
• fix: gracefully handle deleted GitHub repos in vault detail page by @NicolasRitouet in #6
• chore: upgrade to Next.js 16 + React 19 by @NicolasRitouet in #8
• fix(crypto): upgrade Dockerfile to Go 1.25 by @NicolasRitouet in #10
• test(backend): add integration tests with real PostgreSQL by @NicolasRitouet in #9
• feat(backend): handle repo renames via forge repo ID fallback by @NicolasRitouet in #11
• docs: update Go version requirement to 1.25 by @NicolasRitouet in #13
• perf(dashboard): eliminate barrel imports, lazy-load modals, defer analytics by @NicolasRitouet in #12
• feat(crypto): add TLS + shared-secret auth to gRPC service by @NicolasRitouet in #14
• fix(security): audit quick fixes — V2, V3, V13, V14, V15, V16 by @NicolasRitouet in #15
• chore(dashboard): remove Crisp live chat integration by @NicolasRitouet in #16
• feat(orgs): live GitHub member roster + role correctness (+ security-audit fixes) by @NicolasRitouet in #18
• Post-merge follow-ups: org authz hardening, connect UX, local-dev DX by @NicolasRitouet in #19
• fix(orgs): gate owner actions via installation token (prod incident — admins denied) by @NicolasRitouet in #20
• fix(orgs): authoritative member reads via installation token + sync purge guard by @NicolasRitouet in #21
• feat(billing): rename Startup→Business tier, org Team/Business plans, flat pricing by @NicolasRitouet in #22
• fix(dashboard): tolerate pricing API responses without the pro tier by @NicolasRitouet in #23
• feat(backend)!: flat-tier pricing — drop the pro tier, uncap paid private repos by @NicolasRitouet in #24
• fix(docs): SEO hygiene for docs.keyway.sh (robots.txt, titles, descriptions) by @NicolasRitouet in #25
• security(deps): patch P0 vulnerabilities (Snyk) by @NicolasRitouet in #29
• security(docs): accept build/dev-only Snyk findings via .snyk policy by @NicolasRitouet in #30
• security(mcp): accept unreachable SDK HTTP-transport findings by @NicolasRitouet in #31
• security(backend): eliminate axios + patch protobufjs/fastify/grpc at source by @NicolasRitouet in #32
• security(crypto): pin Go toolchain to 1.26.5 for patched stdlib by @NicolasRitouet in #33
• security(cli): pin Go toolchain to 1.26.5 for patched stdlib by @NicolasRitouet in #34
• security(crypto): raise Go toolchain to 1.26.6 for patched stdlib by @NicolasRitouet in #35
• security(cli): raise Go toolchain to 1.26.6 for patched stdlib by @NicolasRitouet in #36
• security(cli): ship Go 1.26.10 CLI via a working release pipeline by @NicolasRitouet in #37

New Contributors

• @NicolasRitouet made their first contribution in #1
• @blacksmith-sh[bot] made their first contribution in #7

Full Changelog: https://github.com/keywaysh/keyway/commits/cli/v0.6.0-rc.1