v0.75.0

What's Changed

Security

• fix(auth): refresh rejected tunnel sessions by @tolgaergin in #553
• fix(auth): route tarball credentials by source by @tolgaergin in #589

Fixes

• fix(auth): initialize device fingerprint atomically by @tolgaergin in #586
• fix(auth): surface corrupt metadata before requests by @tolgaergin in #587

Other changes

• Improve publication and metadata freshness UX by @tolgaergin in #500
• Preserve env keys and support publish OTP by @tolgaergin in #501
• Harden dependency graph identity and lockfile replay by @tolgaergin in #502
• Integrate install pipeline audit fixes by @tolgaergin in #508
• Improve install readiness comparisons by @tolgaergin in #510
• Harden virtual store and linker convergence by @tolgaergin in #509
• Harden dev and run runtime execution by @tolgaergin in #511
• fix: unify lpm.json contract and mutations by @tolgaergin in #512
• Harden dev services, proxy, certificates, and tunnels by @tolgaergin in #513
• Retry transient Windows certificate cleanup by @tolgaergin in #514
• fix(env): enforce regex and validation contracts by @tolgaergin in #515
• fix(run): validate workspace task graphs before execution by @tolgaergin in #517
• fix(run): make task caches complete, transactional, and scalable by @tolgaergin in #518
• fix(global): preserve referenced install roots by @tolgaergin in #521
• fix(global): bound WAL recovery memory by @tolgaergin in #520
• test(common): accept either serialized lock order by @tolgaergin in #524
• ci(release): bind stable releases to source tags by @tolgaergin in #533
• fix(release): validate recovery artifact provenance by @tolgaergin in #534
• Verify npm release packages before OIDC publication by @tolgaergin in #537
• ci(windows): isolate filesystem stress tests by @tolgaergin in #539
• fix(release): verify existing npm publications by @tolgaergin in #538
• fix(dlx): preserve cross-platform command paths by @tolgaergin in #522
• fix(auth): enable standalone native keyrings by @tolgaergin in #525
• fix(tunnel): honor LPM_HOME for relay state by @tolgaergin in #526
• fix(global): enforce portable command identities by @tolgaergin in #527
• fix(ci): lock the fuzz dependency graph by @tolgaergin in #529
• ci: compile the experimental HTTP/3 graph by @tolgaergin in #530
• build: encode the Rust 1.94 contract by @tolgaergin in #531
• fix(store): silence non-Unix metadata warning by @tolgaergin in #536
• test(store): stabilize lock contention watchdog by @tolgaergin in #535
• fix(release): isolate privileged workflow jobs by @tolgaergin in #528
• ci(release): enforce policy gates before publishing by @tolgaergin in #532
• Prevent CLI session loss during refresh rotation by @tolgaergin in #542
• fix(security): confine registry and release credentials by @tolgaergin in #547
• fix(security): bound update and publish responses by @tolgaergin in #549
• fix(update): make upgrade results truthful by @tolgaergin in #551
• Harden audit cache writes and reuse by @tolgaergin in #552
• Bound secret scanning across installed package graphs by @tolgaergin in #554
• fix(publish): honor npm package file selection by @tolgaergin in #555
• fix(publish): fail terminal publication states by @tolgaergin in #556
• fix(publish): validate publication preflight by @tolgaergin in #558
• test(runner): wait for populated service pid by @tolgaergin in #559
• fix(audit): fail incomplete remediation by @tolgaergin in #560
• fix(release): make manifest apply transactional by @tolgaergin in #561
• fix(publish): keep implicit latest monotonic by @tolgaergin in #563
• ci(deps): monitor dashboard dependencies by @tolgaergin in #564
• fix(publish): bound README metadata reads by @tolgaergin in #565
• fix(release): recover interrupted transactions by @tolgaergin in #567
• fix(release): bound transaction memory by @tolgaergin in #568
• fix(self-update): bind releases to verified source by @tolgaergin in #570
• perf(self-update): stream standalone downloads by @tolgaergin in #571
• fix(self-update): verify package-manager updates by @tolgaergin in #572
• fix(self-update): detect buffered probe overflow by @tolgaergin in #588
• ci: bound APT retries and timeouts by @tolgaergin in #590
• Bound silent refresh response bodies by @tolgaergin in #544
• Preserve stored credentials on unrelated auth failures by @tolgaergin in #543
• Make credential backend authority durable by @tolgaergin in #546
• fix(auth): serialize session invalidation by @tolgaergin in #566
• Use session refresh during login preflight by @tolgaergin in #545
• Recover refreshable sessions in safe authenticated POSTs by @tolgaergin in #548
• fix(env): refresh stored sessions before direct API calls by @tolgaergin in #550
• fix(auth): reuse sessions for external client setup by @tolgaergin in #562
• Fail when SwiftPM rejects registry authentication by @tolgaergin in #580
• fix(auth): refresh private tarball downloads by @tolgaergin in #582
• fix(auth): make session metadata transactional by @tolgaergin in #583
• fix(auth): report logout presence failures by @tolgaergin in #584
• fix(auth): make rejected-token cleanup atomic by @tolgaergin in #585
• fix(auth): refresh remote cache sessions by @tolgaergin in #591
• fix(auth): refresh Worker metadata sessions by @tolgaergin in #592
• fix(auth): make custom registry tracking transactional by @tolgaergin in #593
• fix(auth): validate rotated session lifetime by @tolgaergin in #594
• fix(auth): upgrade access-only logins by @tolgaergin in #595
• fix(auth): retry stale fallback cleanup by @tolgaergin in #596
• fix(auth): clear rejected session cache by @tolgaergin in #597
• fix(auth): preserve step-up credential errors by @tolgaergin in #598
• fix(auth): recover SwiftPM session login by @tolgaergin in #599
• fix(swift): secure SwiftPM session handoff by @tolgaergin in #600
• ci: fail over from stalled APT mirrors by @tolgaergin in #605
• Release 0.75.0 by @tolgaergin in #606

Full Changelog: v0.74.1...v0.75.0