v0.78.0

What's Changed

Fixes

• Fix native workflows and add explicit Windows sandbox setup by @tolgaergin in #723

Internal

• chore: prepare release 0.78.0 by @tolgaergin in #734

Other changes

• Fix local archive installs and frozen dependency replay by @tolgaergin in #721
• Enforce lifecycle capabilities and cancellation by @tolgaergin in #722
• Fix registry credential isolation in URLs redirects and errors by @tolgaergin in #724
• Fix incomplete source audits and behavioral false positives by @tolgaergin in #725
• Remove private ledgers from repository by @tolgaergin in #726
• Keep Linux Swift compiler spawning inside the supervised process group by @tolgaergin in #727
• fix(env): verify isolated acceptance responses in release builds by @tolgaergin in #728
• Support anonymous Free package installs by @tolgaergin in #730
• Put minimum release age first and use a one-day Cautious preset by @tolgaergin in #732
• Fix install security settings and improve firewall output by @tolgaergin in #733

Full Changelog: v0.77.0...v0.78.0

macOS standalone upgrades from 0.76.5

The standalone updater in 0.76.5 rejects newer signed app bundles with an icon. If it reports an unexpected Contents/Resources/ entry, rerun the installer once:

curl -fsSL https://cli.lpm.dev/install | sh

For the latest nightly release:

curl -fsSL https://cli.lpm.dev/install | LPM_INSTALL_CHANNEL=nightly sh

The installer preserves saved credentials and configuration. It checks the release checksum and macOS signing and notarization. If cosign is installed, it also verifies the checksum manifest's Sigstore identity. Do not disable verification or delete your credentials. npm and Homebrew installations should continue using their package manager.