cli/v0.6.0

Keyway CLI 0.6.0: security release

Upgrading is recommended for everyone.

0.6.0 is built with Go 1.26.10. 0.5.3 was built with Go 1.24.0, and govulncheck reports 67 known vulnerabilities in the 0.5.3 binary against none in 0.6.0. The fixes come from the Go standard library, golang.org/x/net and golang.org/x/text. The ones that matter most for a CLI that talks to the Keyway API over HTTPS:

• TLS certificate verification (crypto/x509): distrust of compromised intermediate certificates (GO-2026-6809), name-constraint and policy validation fixes (GO-2025-4175, GO-2025-3749), and chain-building denial-of-service fixes (GO-2026-4946, GO-2026-4947).
• TLS (crypto/tls): unexpected session resumption (GO-2026-4337), handshake messages processed at the wrong encryption level (GO-2026-4340), and post-handshake / KeyUpdate denial of service (GO-2026-4870, GO-2026-6090).
• HTTP and URL parsing: 12 net/http and 4 net/url fixes, plus an HTTP/2 infinite loop in golang.org/x/net (GO-2026-4918).

There are no functional changes to the commands.

Upgrade

brew upgrade keyway                      # Homebrew (keywaysh/tap)
npm install -g @keywaysh/cli@latest      # npm
curl -fsSL https://keyway.sh/install.sh | sh

With npm 12 or later, install scripts are blocked by default, and the npm package downloads its binary from one. Use npm install -g --allow-scripts=@keywaysh/cli @keywaysh/cli@latest, or Homebrew / the install script.

Check your version with keyway --version.

Release pipeline

CLI releases now ship from this monorepo under cli/v* tags. The npm package is published with provenance from this workflow, and checksums.txt lists the SHA-256 of every archive. The old keywaysh/cli repository is archived.

macOS binaries are not code-signed or notarized yet.