v0.4.0

Minder v0.4.0 includes a number of client improvements alongside minder ruletest improvements and a large push on test coverage from a wave of new contributors, thank you!

Client Changes

This client release aims to standardize the routing of minder CLI output: structured output (tables, JSON, YAML, etc) will be printed to stdout, while other output and prompts will be printed to stderr. This is intended to make it simpler to incorporate minder into shell pipelines.

New Features

The CLI’s parsing of various YAML resources has been standardized and tightened, to flag typos and incorrect key locations, which affected a few rules in https://github.com/mindersec/minder-rules-and-profiles. In addition, the content available for ruletest output has been improved by separating the message, error details, and printed output fields for separate comparison.

• Fix #6727: switch RuleType encode/decode to protojson by @shreyaabaranwal in #6809
• Strict-unmarshal RuleType by deleting rego decoder's leftover keys by @shreyaabaranwal in #6827
• fix(gitlab): paginate project listing by @NAME-ASHWANIYADAV in #6751
• feat: add --name flag to profile delete command by @drona-gyawali in #6843
• feat: make parse format configurable in datasource generate by @drona-gyawali in #6864
• fix(cli): route structured output to stdout across commands (#6879) by @ravindra-RKB in #6883
• fix(cli): enforce exact args on minder set-project by @ravindra-RKB in #6932
• refactor(cli): modernize offline-token commands and add unit tests by @ravindra-RKB in #6998
• feat(cli): warn that invitation codes are one-time bearer tokens (#6984) by @vishnums2k5 in #6989
• Separate error message and error details into separate fields by @evankanderson in #6806
• feat(ruletest): capture print() output per test result by @drona-gyawali in #6882

Bug Fixes

• Preserve line breaks in CLI table cells by @maxi-maxima in #6860
• fix(cli): route auth token errors and prompts to stderr by @ravindra-RKB in #6947
• fix(cli): route version info to stdout and silence usage on errors by @ravindra-RKB in #6953
• feat: implement cd to project name in set-project command by @drona-gyawali in #6927
• fix(cli): standardize auth commands prompt and status output to stderr by @ravindra-RKB in #6990
• fix(cli): route mutation success and status notices to stderr across CLI commands by @ravindra-RKB in #6991
• fix(cli): route resource mutation notices to stderr by @ravindra-RKB in #7016
• fix(cli): standardize quickstart command prompts and notices to stderr by @ravindra-RKB in #7018
• fix(cli): standardize repo register and reconcile output to stderr by @ravindra-RKB in #7017
• refactor(cli): modernize provider enroll command and add unit tests by @ravindra-RKB in #7010

Server changes

Note that the Minder server is available on a rolling basis from the container and Helm chart releases. These notes cover server-side and test and CI changes which should not directly affect users of the minder CLI.

New Features

Work was done on improving support for addition OCI providers, which will be finished in a later release. Additionally, groundwork was laid for rule exceptions, which provide a way to silence rule evaluation errors for a scheduled timeframe. There were also a number of smaller bugfixes and ease-of-use changes around reducing the number of required arguments, preferring reasonable defaults instead.

• Expose raw OCI manifest/index via GetRawManifest by @shreyaabaranwal in #6776
• Fix permit empty schemas for endpoints in REST datasource handler by @th3Gli4ch in #6780
• Implement provifv1.OCI on GitHub provider by @shreyaabaranwal in #6791
• Add artifact-entity support for DockerHub and Quay providers by @shreyaabaranwal in #6808
• Add accepted risk foundation by @codejasleen in #6726
• Validate exception resources against project by @codejasleen in #6844
• feat: validate bundle name, namespace and semver version by @drona-gyawali in #6851
• fix: wire GitConfig into GitLab provider to enforce clone limits by @drona-gyawali in #6856
• Return the tag's index digest from OCI GetDigest by @shreyaabaranwal in #6862
• Make executor timeout configurable by @nym01 in #6878
• feat(db): add ListEntitiesOriginatedFrom query by @krrish175-byte in #6881
• Gate trusty evaluator behind trusty_evaluator flag by @drona-gyawali in #6867
• feat: capture feature flag evaluations in telemetry records by @drona-gyawali in #6919
• Add the OCI repository name as an artifact property by @shreyaabaranwal in #6929

Bug Fixes

The NATS event configuration was tested much more thoroughly, and should now be considered production-ready. As part of this change, the prefixes used by the Minder server have changed, and the Minder server no longer deletes consumers or queues on shutdown.

• Fix GetArtifactByName ignoring owner and repo in name lookup by @th3Gli4ch in #6773
• Bind NATS subscribers to an explicitly created consumer by @shreyaabaranwal in #6871
• Reuse a NATS consumer created between lookup and create by @shreyaabaranwal in #6928
• Use default page size for history cursor without size by @nym01 in #6951
• Fix request body not being resent on REST datasource retries by @nym01 in #6926
• Handle SIGTERM during server shutdown by @ajaykr0905 in #6959
• Mark cfg.Nats.Queue as deprecated by @shreyaabaranwal in #6961
• fix(oci): include tag name and underlying error when digest fetch fails by @drona-gyawali in #6979
• fix(oci): skip tags deleted after listing in GetArtifactVersions by @drona-gyawali in #6980
• fix(api): handle nil pointer safely in RuleTypeReleasePhase.EnsureDefault by @vishnums2k5 in #6967
• Fix concurrent first use of dynamic JWT validator by @nym01 in #6987
• fix(artifact): allow colon in artifact names for Docker Hub/Quay lookup by @shreyaabaranwal in #7043
• fix(controlplane): make ArtifactPk consistently the entity UUID by @shreyaabaranwal in #7055

Documentation

• docs(cli): document stdout vs stderr stream conventions in developer guide by @ravindra-RKB in #6923
• Update roadmap for 2026 (and possibly beyond) by @evankanderson in #6253

Testing and CI Changes

• Fix/GitHub webhook dead code by @th3Gli4ch in #6781
• Fix race condition in TestAggregator/TestFlushAll by @shreyaabaranwal in #6796
• Fix nil pointer cases in handling package events by @evankanderson in #6807
• Add tests for rule methods by @ravindra-RKB in #6825
• Add tests for reminder processor by @ravindra-RKB in #6830
• Add tests for datasource service options builder by @ravindra-RKB in #6831
• Add tests for db adapters by @ravindra-RKB in #6828
• Add tests for crypto algorithm helpers by @ravindra-RKB in #6841
• Add tests for metrics meters factory by @ravindra-RKB in #6820
• Bump Go to 1.26.9 and x/net to v0.61.0 (CVE-2026-78669) by @intelligent-ears in #6858
• refactor(gitlab): pass context.Context to gitlab.New constructor by @drona-gyawali in #6833
• refactor: remove unused pkg/querier module by @ravindra-RKB in #6854
• fix(rego): replace types.A with precise OPA return type in file.deps and base_file.deps by @drona-gyawali in #6857
• Refactor to remove redundant MeterFactory by @ravindra-RKB in #6863
• Test that known resource types reach the ReadResource switch by @shreyaabaranwal in #6866
• test(cli): add unit tests for provider commands by @ravindra-RKB in #6869
• refactor: add GetAllRules helper to Profile and simplify exportRuleTypes by @drona-gyawali in #6868
• test(cli): add unit tests for auth helpers by @ravindra-RKB in #6870
• refactor(cli): use GetCLIClient and add golden-file tests for auth whoami by @ravindra-RKB in #6872
• refactor(cli): use GetCLIClient and add golden-file tests for artifact list by @ravindra-RKB in #6873
• refactor(cli): use GetProjectsClient and add golden-file tests for project list by @ravindra-RKB in #6874
• refactor(profiles): replace ParseYAML with fileconvert.ReadResourceTyped by @drona-gyawali in #6884
• refactor(profiles): remove ParseYAML and update all call sites to use fileconvert.ReadResourceTyped directly by @drona-gyawali in #6896
• refactor(cli): use GetCLIClient and add golden-file tests for datasource list by @ravindra-RKB in #6897
• refactor(cli): use GetCLIClient and add golden-file tests for datasource get by @ravindra-RKB in #6900
• refactor(cli): use GetCLIClient and add golden-file tests for datasource delete by @ravindra-RKB in #6901
• refactor(cli): use GetCLIClient and add golden-file tests for project delete by @ravindra-RKB in #6902
• refactor(cli): use GetCLIClient and add golden-file tests for project create by @ravindra-RKB in #6904
• Bump kin-openapi to v0.149.0 in tools by @intelligent-ears in #6908
• refactor(cli): use GetCLIClient and add golden-file tests for auth invite list by @ravindra-RKB in #6906
• refactor(cli): use GetCLIClient and add golden-file tests for auth invite get by @ravindra-RKB in #6912
• Guard nil GitHub responses on API errors by @nym01 in #6922
• fix(eea): handle queued releases in FlushAll by @nym01 in #6911
• test(cli): add unit tests for minder set-project command by @ravindra-RKB in #6924
• refactor(cli): use GetCLIClient and add tests for auth invite accept and decline by @ravindra-RKB in #6909
• test(cli): split stdout and stderr capture in RunCmdTests by @ravindra-RKB in #6918
• Cancel superseded PR workflow runs by @intelligent-ears in #6933
• test: add unit tests for pure helper functions by @drona-gyawali in #6949
• feat: implement version check in PropertiesFromJSON by @drona-gyawali in #6930
• refactor(cli): migrate history list to GetCLIClient and add command-level tests by @drona-gyawali in #6958
• test(cli): add unit tests for minder auth logout command by @ravindra-RKB in #6948
• refactor: IsOutputFormatSupported should return error instead of bool by @drona-gyawali in #6963
• refactor(cli): migrate provider list, get, and delete to GetCLIClient by @drona-gyawali in #6966
• Remove duplicate TODO in OCI getDigestFromRef by @shreyaabaranwal in #6971
• Link the auth TODO in getDigestFromRef to #6972 by @shreyaabaranwal in #6973
• test(cli): add golden-file and validation tests for provider get by @ravindra-RKB in #6969
• test(cli): add validation tests and exact argument assertions for provider delete by @ravindra-RKB in #6981
• refactor: migrate datasource apply and create to GetCLIClient by @drona-gyawali in #6968
• refactor(cli): use GetCLIClient and add tests for provider update by @ravindra-RKB in #6983
• refactor(cli): use GetCLIClient and add golden-file tests for project role list and grant list by @ravindra-RKB in #6962
• refactor(cli): use GetCLIClient and add tests for auth delete by @ravindra-RKB in #6986
• refactor(cli): use GetCLIClient and add tests for project role grant, deny, and update by @ravindra-RKB in #6988
• ci: show Trivy findings and alert link when security scan fails by @intelligent-ears in #7030
• fix(cli): correct docs package declaration, close configHelpFile, and add unit tests by @ravindra-RKB in #7011
• test(engine): fix mock git repo worktree setup in PR remediator tests by @vishnums2k5 in #6964
• test(cli): add comprehensive unit tests for repo register command by @ravindra-RKB in #7036
• test(sendgrid): add tests for New, SendEmail, Register and integration event flow by @drona-gyawali in #7034
• test(dockerhub): add unit tests for Docker Hub provider and manager methods by @ravindra-RKB in #7047
• test(quay): add unit tests for Quay provider and manager methods by @ravindra-RKB in #7049

Dependency and Automated Changes

• build(deps): bump chainguard-dev/actions/boilerplate from 1.6.34 to 1.6.35 by @dependabot[bot] in #6789
• build(deps): bump github.com/golang-migrate/migrate/v4 from 4.19.1 to 4.20.1 by @dependabot[bot] in #6783
• build(deps): bump github.com/open-policy-agent/opa from 1.18.2 to 1.20.2 by @dependabot[bot] in #6785
• build(deps): bump github.com/google/go-containerregistry from 0.21.9 to 0.22.1 by @dependabot[bot] in #6784
• build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.43.3 to 1.47.0 by @dependabot[bot] in #6786
• build(deps): bump the codeql group with 3 updates by @dependabot[bot] in #6787
• build(deps): bump nanoid from 3.3.16 to 3.3.19 in /docs by @dependabot[bot] in #6790
• build(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.32.31 to 1.33.4 by @dependabot[bot] in #6788
• build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.44.0 to 1.45.0 in /tools by @dependabot[bot] in #6793
• build(deps): bump the codeql group with 3 updates by @dependabot[bot] in #6803
• build(deps): bump github.com/ThreeDotsLabs/watermill from 1.5.2 to 1.5.3 by @dependabot[bot] in #6800
• build(deps): bump the react group across 1 directory with 2 updates by @dependabot[bot] in #6797
• build(deps): bump github.com/sigstore/protobuf-specs from 0.5.1 to 0.5.2 by @dependabot[bot] in #6798
• build(deps): bump github.com/dustin/go-humanize from 1.0.1 to 1.1.0 by @dependabot[bot] in #6799
• build(deps): bump github.com/protobom/protobom from 0.5.8 to 0.6.2 by @dependabot[bot] in #6801
• build(deps): bump chainguard-dev/actions/boilerplate from 1.6.35 to 1.6.37 by @dependabot[bot] in #6804
• build(deps): bump image-size from 2.0.2 to 2.0.4 in /docs by @dependabot[bot] in #6805
• build(deps-dev): bump markdownlint-cli2 from 0.23.2 to 0.23.3 in /docs by @dependabot[bot] in #6810
• build(deps): bump mobx from 7.0.3 to 7.0.4 in /docs by @dependabot[bot] in #6811
• build(deps): bump github.com/nats-io/nats.go from 1.53.1 to 1.54.0 by @dependabot[bot] in #6812
• build(deps): bump github.com/openfga/go-sdk from 0.8.2 to 0.8.3 by @dependabot[bot] in #6815
• build(deps): bump bufbuild/buf-action from 1.5.0 to 1.6.0 by @dependabot[bot] in #6818
• build(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.33.4 to 1.33.6 by @dependabot[bot] in #6819
• build(deps): bump github.com/aws/aws-sdk-go-v2/service/sesv2 from 1.59.2 to 1.76.0 by @dependabot[bot] in #6814
• build(deps): bump brace-expansion in /docs by @dependabot[bot] in #6824
• build(deps): bump fast-uri from 3.1.7 to 3.1.8 in /docs by @dependabot[bot] in #6823
• build(deps): bump dompurify from 3.4.13 to 3.4.16 in /docs by @dependabot[bot] in #6822
• build(deps): bump the codeql group with 3 updates by @dependabot[bot] in #6817
• build(deps-dev): bump prettier from 3.9.6 to 3.9.9 in /docs by @dependabot[bot] in #6813
• build(deps): bump mobx from 7.0.4 to 7.0.5 in /docs by @dependabot[bot] in #6834
• build(deps): bump the otel group with 9 updates by @dependabot[bot] in #6835
• build(deps): bump k8s.io/client-go from 0.36.3 to 0.37.1 by @dependabot[bot] in #6837
• build(deps): bump github.com/openfga/openfga from 1.18.3 to 1.21.0 by @dependabot[bot] in #6836
• build(deps): bump chainguard-dev/actions/boilerplate from 1.6.37 to 1.6.40 by @dependabot[bot] in #6839
• build(deps): bump anchore/sbom-action/download-syft from 0.24.2 to 0.24.3 by @dependabot[bot] in #6840
• build(deps): bump joi from 17.13.7 to 17.13.8 in /docs by @dependabot[bot] in #6849
• build(deps): bump compression from 1.8.1 to 1.8.2 in /docs by @dependabot[bot] in #6848
• build(deps): bump proxy-addr from 2.0.7 to 2.0.8 in /docs by @dependabot[bot] in #6847
• build(deps): bump shell-quote from 1.10.0 to 1.12.0 in /docs by @dependabot[bot] in #6846
• build(deps): bump source-map-js from 1.2.1 to 1.2.2 in /docs by @dependabot[bot] in #6845
• Auto-generated cli documentation update - 2026-10-08 06:27:37 by @github-actions[bot] in #6852
• build(deps): bump actions/setup-node from 7.0.0 to 7.1.0 by @dependabot[bot] in #6894
• build(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0 by @dependabot[bot] in #6893
• build(deps): bump the codeql group with 3 updates by @dependabot[bot] in #6892
• build(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 by @dependabot[bot] in #6891
• build(deps-dev): bump globals from 17.12.0 to 17.13.0 in /docs by @dependabot[bot] in #6890
• build(deps): bump google.golang.org/grpc from 1.83.2 to 1.84.0 by @dependabot[bot] in #6889
• build(deps): bump github.com/zitadel/oidc/v3 from 3.49.2 to 3.51.14 by @dependabot[bot] in #6888
• build(deps): bump the otel group with 2 updates by @dependabot[bot] in #6886
• build(deps): bump mobx from 7.0.5 to 7.0.6 in /docs by @dependabot[bot] in #6887
• build(deps): bump github.com/goccy/go-json from 0.10.6 to 0.11.2 by @dependabot[bot] in #6885
• Auto-generated cli documentation update - 2026-10-15 17:05:26 by @github-actions[bot] in #6905
• Auto-generated cli documentation update - 2026-10-23 13:51:34 by @github-actions[bot] in #6965
• build(deps): bump launch-editor from 2.14.1 to 2.14.2 in /docs by @dependabot[bot] in #6935
• build(deps): bump follow-redirects from 1.16.0 to 1.16.1 in /docs by @dependabot[bot] in #6934
• build(deps): bump github.com/grpc-ecosystem/grpc-gateway/v2 from 2.30.0 to 2.32.0 by @dependabot[bot] in #6941
• build(deps): bump goreleaser/goreleaser-action from 7.2.3 to 7.3.0 by @dependabot[bot] in #6944
• build(deps): bump github.com/nats-io/nats-server/v2 from 2.14.6 to 2.15.1 by @dependabot[bot] in #6942
• build(deps): bump styled-components from 6.5.3 to 6.6.0 in /docs by @dependabot[bot] in #6936
• build(deps-dev): bump prettier from 3.9.9 to 3.9.10 in /docs by @dependabot[bot] in #6937
• build(deps): bump github.com/prometheus/client_golang from 1.24.1 to 1.25.0 by @dependabot[bot] in #6938
• build(deps): bump the codeql group with 3 updates by @dependabot[bot] in #6943
• build(deps): bump chainguard-dev/actions/boilerplate from 1.6.40 to 1.6.41 by @dependabot[bot] in #6945
• build(deps): bump markdown-it and markdownlint-cli2 in /docs by @dependabot[bot] in #6946
• Auto-generated cli documentation update - 2026-10-22 17:30:26 by @github-actions[bot] in #6960
• build(deps): bump go-jose/go-jose/v4 to v4.1.6 (CVE-2026-116587) by @intelligent-ears in #7012
• build(deps): bump postcss-selector-parser in /docs by @dependabot[bot] in #7019
• build(deps): bump fast-uri from 3.1.8 to 3.1.9 in /docs by @dependabot[bot] in #7022
• build(deps): bump qs from 6.15.2 to 6.15.4 in /docs by @dependabot[bot] in #7020
• build(deps): bump github.com/go-chi/chi/v5 from 5.3.2 to 5.4.0 by @dependabot[bot] in #7023
• build(deps): bump body-parser from 1.20.6 to 1.20.9 in /docs by @dependabot[bot] in #7021
• build(deps): bump dompurify from 3.4.16 to 3.4.17 in /docs by @dependabot[bot] in #7024
• build(deps): bump github.com/aws/aws-sdk-go-v2/service/sesv2 from 1.76.0 to 1.79.3 by @dependabot[bot] in #7003
• build(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.33.6 to 1.33.10 by @dependabot[bot] in #7006
• build(deps): bump github.com/go-playground/validator/v10 from 10.30.3 to 10.30.5 by @dependabot[bot] in #7007
• build(deps): bump chainguard-dev/actions/boilerplate from 1.6.41 to 1.7.1 by @dependabot[bot] in #7008
• build(deps): bump @babel/core from 7.26.0 to 7.29.7 in /docs by @dependabot[bot] in #7029
• Auto-generated cli documentation update - 2026-10-28 15:33:05 by @github-actions[bot] in #7031
• build(deps): bump http-proxy-middleware from 2.0.9 to 2.0.11 in /docs by @dependabot[bot] in #7028
• build(deps): bump mobx from 7.0.6 to 7.1.0 in /docs by @dependabot[bot] in #7002
• build(deps): bump the react group across 1 directory with 2 updates by @dependabot[bot] in #7001
• build(deps): bump github.com/mikefarah/yq/v4 from 4.53.6 to 4.54.1 by @dependabot[bot] in #7004

New Contributors

• @ravindra-RKB made their first contribution in #6825
• @drona-gyawali made their first contribution in #6843
• @nym01 made their first contribution in #6878
• @ajaykr0905 made their first contribution in #6959
• @vishnums2k5 made their first contribution in #6967

Full Changelog: v0.3.2...v0.4.0