3.9.0

Changed

• Node-based presets, creation commands, and npm/Yarn helpers now default to Node.js 24 LTS instead of end-of-life Node.js 20. Updated examples and added generated-configuration regression tests across nine presets. Bun runtime choices are unchanged. #547, fixes #545.

Security and fixes

• Build with Go 1.26.11 and update dependencies to address reachable vulnerability findings. Replace the old self-update dependency chain that pulled in x/crypto/openpgp. #546.
• Harden self-update: validate release versions before installation, avoid equal-version reinstalls and downgrades, validate SHA-256 checksums, select compatible ARMv6/ARMv7 assets, bound HTTP requests, and report rollback failures.
• Restore documentation-generator dependencies and retain them across go mod tidy so the release-guide docs command works. #548.

Existing projects: Node migration

Upgrading the CLI does not rewrite existing project files. To migrate, change Node images in docker-compose.yml and every kool docker helper in kool.yml to kooldev/node:24, reinstall dependencies (rebuilding native modules where needed), and test your application. Review generated-file changes before reapplying a preset.

Node 20 image tags are not removed by this release, but Node.js 20 no longer receives upstream security fixes. See the migration guidance.

Validation and downloads

• Release-guide documentation generation, formatting, lint, and race-enabled tests passed; govulncheck reported no reachable vulnerabilities.
• Linux/macOS tests, CodeQL, and configured Grype checks passed on the release preparation PRs. This is not a claim that all transitive or container-package advisories are eliminated.
• Six standalone binaries for macOS (amd64/arm64) and Linux (amd64/arm64/ARMv6/ARMv7), each with a SHA-256 checksum, are attached below. Built with Go 1.26.11.
• Upgrade with kool self-update or download the matching binary below.

Thanks to @FelipeEstevanatto for the security/updater upgrade.

Full changelog: 3.8.1...3.9.0