Skip to content

v1.4.14

Choose a tag to compare

View all tags
@github-actions github-actions released this 12 Oct 15:49
· 188 commits to main since this release
v1.4.14
af53c45
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

nSelf CLI v1.4.14

Channel: stable

Commits since previous release

  • chore(release): bump to v1.4.14 (#728) (af53c45)
  • fix(config): mask encoded/fragment URL credentials, redact manifest scalars, promote shared secret rule (D-0430, D-0415) (#724) (7b8a55a)
  • test(json): bind envelope command to its data schema and validate live output (D-0243) (#727) (97e9cd1)
  • fix(sdk/ts): scope pnpm workspace to the package and pin pnpm 9 for Dependabot (#725) (a20e3bc)
  • fix(remove): v1.5 keeps plugin data unless --delete-data, project plugin dir first (D-0330 D-0504 D-0546) (#726) (4c84bc0)
  • feat(importer): portable Postgres import engine (P7-ADOPT-10) (#708) (2e0d397)
  • ci(deps): bump actions/setup-go from 5.5.0 to 7.0.0 (#720) (bec805c)
  • fix(mcp,config): Host check on mcp sse/http, config set round trip, decrypt-on-deploy opt-in (D-0327 D-0403 D-0216) (#715) (6c0e473)
  • fix(backup): bare stream path works on v1.4, refused under V15 (D-0676); hermetic doctor tests (D-0678) (#721) (397b018)
  • ci(deps): bump actions/checkout from 4.2.2 to 7.0.1 (#719) (8056556)
  • ci(deps): bump peter-evans/create-pull-request from 7.0.8 to 8.1.1 (#716) (9426e2d)
  • feat(release): tokenless release chain script (P7-HYG-15) (#714) (1b9ed52)
  • ci(deps): bump actions/download-artifact from 8.0.1 to 8.0.2 (#717) (e36a327)
  • feat(db): nself db export writes a scrubbed portable bundle (P7-ADOPT-17) (#711) (0921442)
  • ci(deps): bump actions/upload-artifact from 4.6.2 to 7.0.2 (#718) (f5c0b32)
  • feat(deploy): NDJSON progress for deploy and env promotion behind --stream (P7-DEPL-17) (#712) (efdd0be)
  • fix(build): SecretEnvMap carries PLUGIN_INTERNAL_SECRET and NOTIFY_INTERNAL_SECRET (D-0647) (#713) (5a7f633)
  • feat(update): nself update stack, resumable stack upgrades (P7-PLUG-31) (#706) (5b0a42c)
  • feat(compose): Hasura v2.51 as the v1.5 default with upgrade smoke (P7-LIVE-23) (#707) (6aa6bf8)
  • fix(build,db): persist generated Postgres/Hasura credentials; forward --plugin to remote db (D-0506, D-0232) (#710) (e12e61f)
  • fix(remote): pin store ancestor walk warns once on v1.4, refuses under V15 (D-0675, D-0677, D-0637) (#709) (85a3fe4)
  • feat(deploy): env promotion on the control plane, deploy promote (P7-DEPL-15) (#680) (c996c4d)
  • feat(compose): SeaweedFS core object store in v1.5, MinIO moves to a plugin (P7-PLUG-60) (#704) (4da239a)
  • fix(deploy): v1.5 scratch artifacts: generated-only nginx, conf.d, tar retention, fronted staging (D-0423 D-0424 D-0421 D-0425) (#705) (b04f0be)
  • feat(compose): auth on nhost/auth, current release as the v1.5 default (P7-LIVE-20) (#702) (58bd840)
  • feat(update): update --plan pin diff and --yes apply over a shared step model (P7-LIVE-10) (#670) (f2366b8)
  • fix(plugin): reserve status, test name guards, cached catalog fallback, one semver compare (#703) (8e75288)
  • fix(build): one resolved value per secret when a password holds $ (D-0635) (#697) (ca3e8d4)
  • fix(build): gate default plugin dir expansion behind compat.V15 (D-0634) (#696) (e3af7b2)
  • fix(invoke): honour NSELF_MCP_EXEC_OVERRIDE only in test binaries (D-0288) (#701) (92e0a0c)
  • fix(bundle): durable remove intent and keep members a kept plugin needs (D-0368, D-0325) (#699) (940145b)
  • refactor(cmdlog): use the config secret-name and URL-credential rules (D-0473 follow-up) (#700) (828748b)
  • fix(invoke,cmdlog,secrets): secrets off child argv and out of the command log (D-0473 D-0468 D-0367) (#677) (480b896)
  • feat(compose): Valkey as the default cache behind REDIS_ENGINE (P7-LIVE-19) (#669) (c144e9b)
  • fix(images): verify mirror platforms as a subset of the index (D-0350) (#698) (9c3ca0a)
  • fix(reconcile): map @plugins/ paths under the build's plugin dir (D-0607) (#695) (7330de4)
  • fix(doctor,init): tracked ssl key check + ci.yaml negation order (D-0459 D-0537) (#685) (a9ab21c)
  • fix(plugin): refuse cliCommands that collide with core verbs or another plugin (D-0259) (#688) (138c959)
  • fix(remote,admin): pin store ancestor checks + bounded lock wait; admin connect honours user@host:port (D-0484, D-0465) (#687) (c0e74ed)
  • fix(backup): route stream, schedule and heartbeat through destinations (D-0257, D-0467) (#693) (883a5d0)
  • fix(canon): confirm row for remove and bundle remove --delete-data (D-0331) (#692) (8cfe788)
  • fix(routemodel,config): api-docs route and upstream path/query in routes.json, parse API_DOCS_* (D-0310 D-0455) (#679) (93f14a4)
  • test(perfbench): cover scenario definitions and probe runner (D-0234) (#691) (47f7c51)
  • ci: env-var doc rule on name changes, loud PCI skip, contract-check wiki gates (D-0246, D-0159, D-0254) (#683) (41fa0f2)
  • fix(db): key --migration-dir applies on the migration key, not up.sql (D-0613) (#694) (64cc359)
  • ci(license): full-package mutation gate, prune stale allowlist, wiki wording (D-0511) (#684) (e69ed4a)
  • fix(sdk/go): bump klauspost/compress to v1.18.7 (GO-2026-5841, D-0584) (#689) (ac57aa6)
  • fix(ssl): disable the certbot nself-ssl-renew.timer when ACME takes over (D-0411) (#646) (c879965)
  • fix(reconcile,config): redact secrets in every artifact diff; escape dotenv values (D-0321 D-0404) (#663) (8fdad93)
  • fix(build): plugin core env targets its own service, nginx site-file collisions, plugin-scoped network names (D-0319, D-0287, D-0335) (#659) (9e49a20)
  • fix: repair red main (registry/OpenAPI regen, deploy parser HealthTimeout) (#686) (a160cd0)
  • fix(deploy): one ssh argv builder, pinned host keys for secret shipping (P7-DEPL-28, D-0248) (#668) (e685786)
  • feat(secrets): config secrets resolve and recipients (P7-TRUST-03) (#650) (f223548)
  • fix(deploy): sh -c wrap the last v1.5 remote commands, put moved image tags back on a refused apply (#682) (bef57e5)
  • fix(plugin): validate plugin names before any path join (P7-PLUG-20 post-merge) (#643) (e4ef738)
  • fix(license): kill legacy licence mutants, clock refusal text, 24 h reply cap (D-0226, D-0233) (#662) (de2b401)
  • test(admin): pin v1.4 and v1.5 admin ssh argv and hostile-input rejection (D-0271) (#652) (790a8f5)
  • fix(backup): keep the db password off argv; schedule project check and env selector (D-0352, D-0244, D-0245, D-0277) (#653) (ac1f62d)
  • fix(docker): -- before compose service names, bounded state reads, stricter Regressed (D-0314, D-0428, D-0373) (#657) (eace721)
  • fix(compose): quote compose.env values; keep secrets off generated argv (D-0333, D-0282) (#666) (de21376)
  • fix(reconcile,database): prune removed plugins from the state record; keep nself metadata layout off the Hasura CLI (#681) (fd18ee8)
  • feat(httpapi): HTTP API served by nself admin serve (P7-SURF-02) (#647) (520f160)
  • test(build,reconcile): replace synthetic REDIS_PASSWORD fixture (GitGuardian false positive) (#678) (c2598bc)
  • ci: gate vendored sdk drift, sdk/go/remote mutation gate, require age (D-0482 D-0483 D-0413 D-0516) (#675) (67f06eb)
  • docs(wiki): plugin route injection as the build does it (cli#673 follow-up) (#676) (e2026d9)
  • fix(build,reconcile,routemodel): render ${SSL_DIR} in plugin snippets, list new services as create (D-0478 D-0505) (#673) (cc3ed52)
  • fix(deploy,server,oplock): state read errors, nil snapshot action, stale oplock holder (D-0144 D-0262 D-0241) (#674) (0ab74fc)
  • fix(ci,docs): BSD-safe affected-pkgs, Docker-required fixture, stale hints (#671) (d6974e8)
  • fix(database): source-aware plugin table tracking, retry after concurrent metadata write, one Hasura metadata layout (D-0388 D-0389 D-0272) (#672) (71b6367)
  • fix(doctor,vector-search): virtual drift keys, unrecorded plugins, shape + live permission checks (D-0382 D-0323 D-0369 D-0339) (#665) (8ab9fca)
  • feat(manifestv2): accept json envelope on plugin commands (D-0342) (#667) (a6c7006)
  • fix(ci): probe default images by digest, not tag@digest (D-0264) (#664) (83c21de)
  • feat(lock): project lock nself.lock.yaml, honoured by build, enforced by start --frozen (P7-LIVE-09) (#616) (d93d957)
  • feat(doctor): doctor report, a redacted support bundle (P7-LIVE-14) (#635) (9504f35)
  • fix(remote): known_hosts pin lock + foreign-line/mode refusal, kill sdk/go/remote mutants (D-0249, D-0253) (#654) (a0e13e6)
  • feat(deploy): v1.5 remote apply ships the artifact set, previews recreates, backs up first (P7-DEPL-24) (#629) (9a18be2)
  • fix(init): ignore /ssl/ in new projects; anchor endpoint-auth-checker ignore (D-0163, D-0217) (#649) (9908e2a)
  • fix(database): read-only migrate status; statement-timeout directive on --migration-dir (D-0378, D-0281) (#655) (a19dc54)
  • test: env target tests on fresh command copies; controlplane tests pass under NSELF_V15=1 (D-0237, D-0275) (#660) (0f7928d)
  • fix(cmd): opt-in AI install, db --env names, ops arch preflight, honest reset/uninstall (D-0221 D-0165 D-0276 D-0375) (#658) (091fbb7)
  • fix(sdk/httpx): resend the request body on retry, honour MaxRetries 0 (D-0152) (#661) (cbda22b)
  • fix(test): honest-green main: hint race, tree-order and lock flakes, docker skips (D-0309 D-0361 D-0431 D-0286) (#648) (6dd4ebd)
  • fix(bundle): skipped members not app-ready, tier-aware licence preflight, ledger hardening (D-0372, D-0338, D-0374) (#656) (576f8fd)
  • docs(config): name the widened secret rule and URL masking in cmd-config and MCP-Server (P7-SURF-12 follow-up) (#645) (166cf3a)
  • feat(config): v1 envelopes for the config fragment, secrets names only, reveal cli_only (P7-SURF-12) (#642) (019f785)
  • feat(bundle): track plugin manifest tables in Hasura on install (P7-PLUG-78) (#644) (3db57ef)
  • test(reconcile): cascade integration suite and live-safety smoke (P7-LIVE-08) (#641) (0a3cce2)
  • docs(security): secrets value checks and rotate limits, doctor findings (P7-PLUG-19/59, P7-PROD-08, #412) (#638) (a8edb42)
  • feat(ssl): v1.5 TLS cut-over, ACME default and OCSP stapling removed (P7-LIVE-22) (#607) (1830f68)
  • ci(images): regenerate the dev golden and gate the pin bump on go test (#640) (eefc82d)
  • feat(plugin): resolution and update correctness, fragment checks (P7-PLUG-17) (#608) (594368f)
  • docs: wiki sweep for STALE docs after merged P7 Tickets (nginx, sdk-go, perf, backup, plugin mount, licensing) (#637) (10cf3c0)
  • feat(config): config set plans, previews and applies the regeneration (P7-LIVE-05) (#619) (2e25595)

Install

brew install nself-org/nself/nself
# or download a tarball below for your platform

Verify (Sigstore keyless)

cosign verify-blob \
  --bundle <tarball>.tar.gz.sig \
  --certificate-identity-regexp '^https://github.com/nself-org/cli/\.github/workflows/release\.yml@refs/tags/v1.4.14$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  <tarball>.tar.gz

Full signing + verification details: release-signing.md

Artifacts

  • Platform tarballs (linux/darwin × amd64/arm64) + Windows zips (amd64/arm64)
  • checksums.txt — SHA-256 of all tarballs
  • sbom.spdx.json + per-tarball SBOMs — SPDX software bill of materials
  • provenance.intoto.jsonl — SLSA v1.0 provenance attestation
  • *.sig — Sigstore cosign signature bundles for every artifact above
Assets 24
Loading