v0.68.0

What's Changed

• chore(deps): bump docker/build-push-action from 7.2.0 to 7.3.0 by @dependabot[bot] in #1356
• chore(deps): bump docker/setup-qemu-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #1354
• chore(deps): bump nolabs-ai/agent-sign from 0.0.11 to 0.1.0 by @dependabot[bot] in #1355
• chore(deps): bump docker/login-action from 4.2.0 to 4.4.0 by @dependabot[bot] in #1357
• chore(deps): bump docker/setup-buildx-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #1359
• chore(deps): bump sigstore-sign from 0.8.0 to 0.10.0 by @dependabot[bot] in #1361
• chore(deps): bump rand from 0.10.1 to 0.10.2 by @dependabot[bot] in #1362
• chore(deps): bump time from 0.3.52 to 0.3.53 by @dependabot[bot] in #1358
• chore(deps): bump ignore from 0.4.26 to 0.4.27 by @dependabot[bot] in #1363
• chore(deps): bump clap_complete from 4.6.5 to 4.6.7 by @dependabot[bot] in #1360
• chore(deps): bump crossbeam-epoch from 0.9.18 to 0.9.20 by @SequeI in #1369
• fix(proxy): skip credential_capture entries with missing helper binaries by @kipz in #1368
• fix(why): respect proxy domain filter in --profile and --self host queries by @SequeI in #1372
• feat(profile): add platform_overrides field for per-OS profile patches by @SequeI in #1371
• feat(proxy): add deny_domain to block domains through the proxy by @SequeI in #1374
• fix(command-policy): resolve command_policies binaries once, in parallel, with caching by @kipz in #1373
• fix(profile): preserve platform_overrides through extends resolution by @kipz in #1380
• docs(codex): clarify codex docs around the optional login-shell hardening by @jsynowiec in #1381
• feat(tool-sandbox): add per-command exec_paths for multi-call binaries by @kipz in #1384
• feat(proxy): support plain HTTP forward-proxying via HTTP_PROXY by @panga in #1335
• fix(registry): add X-Nono-Pull-Reason header to distinguish pull triggers (#1383) by @scp7 in #1386
• feat(policy): add bun runtime preset by @rlex in #1305
• feat(policy): mise policy by @rlex in #1387
• fix(tool-sandbox): grant env-shebang scripts their re-exec interpreter by @kipz in #1394
• fix: missing ~/.cache on macOS by @subbyte in #1378
• fix(sandbox): grant Refer in execute-restriction layer on Linux by @kipz in #1397
• fix(profile): omit inheritable Option fields when None on save (#1400) by @dselivanov in #1402
• fix: keep orphaned descendants in supervisor ancestry by @maufl in #1401
• chore: migrate registry namespace references from always-further to nolabs-ai by @SequeI in #1405
• chore(deps): bump sigstore-sign from 0.10.0 to 0.11.0 by @dependabot[bot] in #1407
• chore(deps): bump regex from 1.12.4 to 1.13.0 by @dependabot[bot] in #1406
• chore(deps): bump bytes from 1.12.0 to 1.12.1 by @dependabot[bot] in #1408
• chore(deps): bump sigstore-trust-root from 0.9.0 to 0.11.0 by @dependabot[bot] in #1410
• fix(tool-sandbox): preserve argv[0] for symlink-dispatched commands by @kipz in #1413
• feat: add port range support to sandbox profiles by @SequeI in #1398
• feat(resources): cap sandbox process count with --max-processes (cgroup v2 pids.max) by @connrg in #1403
• chore: release v0.68.0 by @SequeI in #1418

New Contributors

• @jsynowiec made their first contribution in #1381
• @rlex made their first contribution in #1305
• @subbyte made their first contribution in #1378
• @dselivanov made their first contribution in #1402
• @maufl made their first contribution in #1401

Full Changelog: v0.67.1...v0.68.0