Skip to content

v1.3.6

Choose a tag to compare

View all tags
@github-actions github-actions released this 12 Sep 15:09
· 18 commits to main since this release
v1.3.6
3b34670
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

nSelf CLI v1.3.6

Channel: stable

Changelog

[1.3.6] — 2026-09-12

Ships work that had merged to main but sat unreleased, including a doctor
false-positive and three server/compose gap-closure features.

Fixed

  • nself doctor --deep's SEC-HARDENING-06 check fired a false CRITICAL against
    nginx configs that do rate-limit their auth/API routes.     It only ever grepped
    for the literal strings /auth/login and /api/, so nSelf's default one-
    server-block-per-service layout always failed the check. It now also matches
    by service identity (a server block's server_name against known auth/API
    route names) and falls back to the original literal-path match for hand-
    written gateway configs.

Added

  • nself server provision / list / resize / destroy: manage a
    Hetzner server's lifecycle directly from the CLI.
  • Custom services gain CS_N_IMAGE, CS_N_ENV_FILE, and CS_N_VOLUMES,
    extending the CS_N_* slots beyond image name to full env-file and volume-
    mount configuration.
  • nself build/nself start detect orphaned containers (with a
    --remove-orphans flag to clean them up) and flag a compose healthcheck
    that references a command the image doesn't have    , instead of failing
    silently at runtime.

Commits since previous release

  • Merge pull request #413 from nself-org/release/v1.3.6 (3b34670)
  • fix(backup): close hollow-gate path where RestoreDrill.Success ignored zero rows (#414) (faa6cff)
  • chore(release): 1.3.6 (26ea41a)
  • feat(runner): add nself runner provision/verify for CI runner hosts (G-012) (#411) (d46255d)
  • fix(secrets): reject placeholder/reference values before they reach the store (#412) (c4443ce)
  • feat(cli): add nself server for Hetzner server lifecycle (G-011) (#410) (2a68bcb)
  • fix(cli): detect orphaned containers on build, flag unusable healthchecks (G-014) (#409) (ba588b4)
  • feat(compose): extend CS_N custom services with image, env-file, and volume mounts (#408) (20c018b)
  • fix(sdk): tag the Go module at its /v2 path so it can be resolved (#407) (9b61e93)
  • fix(plugin): verify install checksums against the artifact actually downloaded (#406) (829cb67)
  • fix(maintenance): make disk-cleanup CI-aware and stack-safe (#405) (0036b91)
  • fix(license): unify offline grace ladder to one canonical source (#404) (2296259)
  • fix(counts): re-vendor counts.json and guard it against drift (#403) (43afe2b)
  • feat(plugin): add offline nself plugin count, retire duplicate counting script (#401) (60d97b8)
  • fix(license): implement 30-day post-expiry grace, matching commercial promise (#402) (0471738)
  • fix(ci): measure registry search against warm cache, not cold network (#400) (129b61d)
  • chore(deps)(deps): bump github.com/jackc/pgx/v5 from 5.10.0 to 5.11.0 (#399) (f662a9f)
  • fix(installer,ci): stop orphaned curl/zstd from hanging cmd/commands tests (#398) (4a7cb3c)
  • chore(deps)(deps-dev): bump @typescript-eslint/parser in /sdk/ts (#397) (b9b7980)
  • fix(db): refuse migrate up when an ALTER TABLE target is not yet created (#396) (27a481c)
  • fix(license): grant grace period on bundle-entitled network errors (#395) (3c15db0)
  • fix(install): distinguish rate-limit/network/API failures in version lookup (#394) (07878cd)
  • docs: link the self-hosting boundary page from production deployment (#391) (45965e6)
  • docs(readme): drop retired ɳTV, add missing ɳSentry, use canon bundle order (#393) (5922240)
  • fix(nginx): emit 443 blocks for certs already on disk, refuse mismatched output dir (#390) (b79aabd)
  • feat(db): add migrate baseline/--detect/lint for populated-DB adoption (#392) (825d37e)
  • fix(compose): stop nself build from swapping a running pgvector image (#389) (be77e71)
  • docs: correct stale README claims for P6 ship (v1.1.9 to v1.3.5, counts, $1.99, k8s wording) (#388) (11d1760)
  • fix(doctor): audit the served nginx dir for SEC-HARDENING-06 on fronted stacks (#387) (6f29144)
  • fix(plugin): absent registry status means stable — enforce checksum/signature (#382) (335ec06)
  • docs(wiki): fill the 8 TODO(docs) command pages (#381) (9480187)
  • fix(doctor): SEC-HARDENING-06 detects rate limiting by service identity (#380) (097cbf5)
  • fix(compose): honor CS_N_HEALTHCHECK, add CS_N_ENV_PASSTHROUGH allowlist (#377) (c0ad90c)
  • fix(bundle): actionable error when a bundle is not installable as a unit (#376) (84cdc39)
  • test(db): live-verify migration ledger same-day fix + dry-run validator against real Postgres (#375) (0c95f46)
  • fix(nginx): emit path-scoped rate limits for /auth/login and /api/ (#371) (6db4a2d)
  • fix(deps): clear high-severity Dependabot advisories in TS SDKs (#374) (73f0712)
  • fix(cli): apply Hasura metadata on start and deploy (FIX-CLI-3) (#370) (3423ff5)
  • nginx: drop stale LazyResolve comment in nginx.conf.tmpl (#373) (5e4ec09)
  • fix(nginx): fail the build on a duplicate server_name, naming both files (#372) (3cd811b)
  • fix(plugin): resolve a slug served twice by entitlement, not first-match (#369) (f0367de)
  • feat(nginx): NGINX_FRONTED_BY for a stack served by another stack's nginx (#366) (23e1ca8)
  • fix(compose,start): forward HASURA_GRAPHQL_/AUTH_ namespace, idempotent postgres start (#368) (5ed3f4c)
  • fix: refuse placeholder/example secrets in non-dev environments (#367) (b04e58f)
  • fix(plugin,build,license): correct install-path nesting, network-alias corruption, and Plus-key bundle union (#365) (a5c2b3c)
  • chore(deps)(deps-dev): bump ts-jest in /sdk/ts-sdk (#360) (35fdc0d)
  • chore(deps)(deps-dev): bump ts-jest from 29.4.9 to 29.4.12 in /sdk/ts (#355) (06e7438)
  • fix(nginx): resolve every proxy target at request time, with exactly one scheme (#364) (9c22e8a)
  • feat(ci): wire nself ci build (local Android artifact-build lane) (#361) (c10e5a3)
  • feat(scripts): add --origin mode to plugin-counts.sh (#363) (7eaa5d1)
  • fix(nginx): propagate HasTrustedChain in the real generateAllRoutes build path (#362) (3bb2c25)
  • fix: close 6 P4 deferred-backlog LOW rows (P6-E11-W2-S3-T16) (#354) (6f1b6b7)
  • ci(P6-E11-T18): RLS pentest smoke job with real diagnostics (#350) (4a9626b)
  • fix(build): a profile switch must invalidate the compose cache (#353) (43fa4f0)
  • fix(backup): refuse to write an unencrypted backup by accident (#352) (c6386f4)
  • feat(db): reject IF NOT EXISTS forms Postgres does not support (#351) (74558bd)
  • fix(init): sanitize hyphenated project names into valid POSTGRES_DB (#349) (c0b85ea)
  • ci: CI-masking sweep fixes + rls-pentest smoke workflow (T15, T18) (#343) (30ba2af)
  • ci: add concurrency groups to 8 non-release workflows (#348) (2920b96)
  • P6-E2 CLI Thin-Core: close reconciled tickets + critical-tables config (#346) (b703f58)
  • fix(db): dry-run migration validator + E11 gap reconciliation (#347) (d33274c)
  • fix(license): honour revocation on the fail-open path (P6-E10-W5-S1-T06) (#345) (35a975a)
  • ci: consolidate trivial gates, add paths filters and concurrency groups (#344) (2b70047)
  • fix(security): validate Server.RemotePath and make nself ci serve fail closed (#341) (da57e3f)
  • chore(ci): add generated-file gate + normalize gitignore patterns (#342) (27ba63f)
  • chore(deps)(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc (#310) (3d4784a)
  • fix(ci): correct broken invocations in registry-perf benchmark (#339) (17b3a92)
  • db drift --metadata / db reconcile / db verify --role (T-P6-E11-W2-S1-T3, T4) (#333) (7fe6809)
  • chore(deps)(deps): bump go.opentelemetry.io/otel/sdk (#311) (82005d2)
  • P6-E11-W2-S3-T18: security command test floor (secrets/ssl split-files, db_rls, oauth_refresh) (#334) (a0f68b4)
  • docs: add the 1.3.4 and 1.3.5 changelog entries (#338) (d3cdb65)
  • fix(scripts): plugin-counts double-counted the dual-registry slugs (#337) (963ffbd)
  • fix(embedded): replace wasmtime DefineWasi with host-memory WASI shim (P6-E11-T5) (#336) (4f55cbc)
  • cli: resolve bundle membership from bundles.json (ADR-P6-03) (#332) (c3476ee)
  • fix: get main green — Windows permission assertion + golangci-lint to zero (#335) (1814985)
  • chore(deps)(deps): bump go.opentelemetry.io/otel/trace (#309) (38538c1)
  • chore(deps)(deps): bump go.opentelemetry.io/otel from 1.45.0 to 1.46.0 (#308) (07e123d)
  • ci(deps): bump hadolint/hadolint-action from 3.4.0 to 3.5.0 (#306) (41a91b8)
  • ci(deps): bump actions/upload-artifact from 4 to 7 (#307) (dbe956a)
  • File-size compliance: split the 7 files >300 lines (T-P6-E2-W1-S1-T3) (#323) (09b356f)
  • fix(lint): ineffassign, govet, dead helpers, and two real bugs behind them (#326) (1233048)
  • fix(ssl,config): install renewed certs before reload; show config set's real write path (#331) (47b7c71)
  • feat(ci): add --filesystem opt-in flag to nself ci (#314) (ba41d5a)
  • fix(lint): clear the staticcheck backlog (157 -> 10) (#330) (5b690dd)
  • fix(ssl): correct documented cert path, add ssl install regression coverage (#316) (e81dd07)
  • fix(build): close secret-templating command/healthcheck gap; verify plugin-manifest injection (P6-E2-W2-S3-T9/T10) (#327) (7201bb3)
  • P6-E2 verify batch: deprecation embed, wiki/hint, ci bootstrap, release-status (T2/T5/T7/T14/T17) (#329) (7bbc992)
  • fix(plugin): nself plugin install addressed a container that does not exist (#328) (b986a53)
  • fix(backup): drill smoke gate asserts real data was restored (#325) (bddfc1c)
  • fix(plugin): route paid plugins by registry tier, not the static name map (#315) (16f6956)
  • fix(security): replace remaining http.DefaultClient sites + verify pgx/lockstep + E2E golden-path (#322) (01b2f2e)
  • fix(license): wire IsRecordRevoked into the fail-open validation path (#318) (e52bcd5)
  • fix(db): nself db audit panicked on every invocation (#317) (3a8c2f5)
  • fix(lint): check every previously-ignored error return (608 sites) (#320) (c18ca66)
  • docs(wiki): regenerate llms.txt for the nself ci --filesystem flag (#319) (8c27261)
  • ci: golangci-lint gate + gofmt inversion proof (T04) (#313) (45fa83f)
  • fix(sdk): bump ts-sdk package.json to 1.3.5 to close version lockstep drift (#312) (9e53ea5)

Install

brew install nself-org/nself/nself
# or download a tarball below for your platform

Verify (Sigstore keyless)

cosign verify-blob \
  --bundle <tarball>.tar.gz.sig \
  --certificate-identity-regexp '^https://github.com/nself-org/cli/\.github/workflows/release\.yml@refs/tags/v1.3.6$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  <tarball>.tar.gz

Full signing + verification details: release-signing.md

Artifacts

  • Platform tarballs (linux/darwin × amd64/arm64) + Windows zips (amd64/arm64)
  • checksums.txt — SHA-256 of all tarballs
  • sbom.spdx.json + per-tarball SBOMs — SPDX software bill of materials
  • provenance.intoto.jsonl — SLSA v1.0 provenance attestation
  • *.sig — Sigstore cosign signature bundles for every artifact above
Assets 23
Loading