v1.9.0

1.9.0 (2026-08-26)

Features

• api: Add residency flag and deprecate geography (#136) (e460582)

Bug Fixes

• Add provenance-aware untrusted stdin mode (#137) (a133707)
• build CLI releases with patched Go toolchains (#93) (a58f1cc)
• discard fish completion diagnostics (#109) (4f35fc0)
• escape raw output controls on interactive terminals (#112) (7601afb)
• fail closed when bootstrapping Go dependencies (#94) (4ebe610)
• lock and verify Steady mock tooling (#95) (681d595)
• prepare release artifacts before publishing (#111) (4193619)
• redact sensitive response headers in debug logs (#106) (4931572)
• reject invalid multipart MIME header controls (#105) (fad98b4)
• restrict downloaded file permissions (#107) (7a3a7d1)
• safely construct bash file completions (#110) (b3e0946)
• stream binary download responses (#108) (1f3ba6c)
• stream multipart uploads without buffering (#65) (bcf0ecd)
• verify GoReleaser before privileged release execution (#96) (b3729ea)

Chores

• api: clarify image background and audio delta docs (#124) (056f306)
• api: No customer-visible SDK or public API changes (#128) (12e0d28)
• api: refresh image model API reference (#115) (a771913)
• api: Refresh the bundled OpenAPI reference (#66) (d14387a)
• api: Report no customer-visible SDK or public API changes (#113) (8da2d53)
• api: update generation metadata only (#138) (4244a62)
• configure Dependabot for Go and GitHub Actions (#69) (f495366)
• deps: bump actions/attest-build-provenance from 4.1.0 to 4.2.2 (#102) (6594c73)
• deps: bump actions/checkout from 6.0.2 to 7.0.1 (#103) (ce6a6d0)
• deps: bump actions/checkout from 6.0.2 to 7.0.1 (#134) (f40d5f2)
• deps: bump actions/download-artifact from 4.3.0 to 8.0.1 (#133) (98ed029)
• deps: bump actions/github-script from 7.1.0 to 9.0.0 (#132) (978ce47)
• deps: bump actions/setup-go in / (#101) (5564982)
• deps: bump actions/upload-artifact from 4.6.2 to 7.0.1 (#104) (b3ac15a)
• deps: bump github.com/charmbracelet/bubbles from 0.21.0 to 1.0.0 (#99) (7ac7035)
• deps: bump github.com/urfave/cli/v3 from 3.4.1 to 3.10.1 in the go-minor-and-patch group across 1 directory (#130) (ddc612e)
• deps: bump the charmbracelet group across 1 directory with 2 updates (#97) (2137b80)
• deps: bump the codeql group across 1 directory with 2 updates (#100) (c95ac0a)
• deps: bump the codeql group across 1 directory with 2 updates (#131) (58e3bdd)
• deps: bump the go-minor-and-patch group across 1 directory with 5 updates (#98) (74822be)
• deps: update openai-go to v3.51.0 (#63) (68e3e70)
• deps: update openai-go to v3.52.0 (#67) (7d87ee2)
• set a 1,000-line custom-code budget (#126) (016bfb2)

Documentation

• add secure CLI agent and contributor guidance (#72) (09ec087)
• standardize CLI vulnerability disclosure policy (#71) (d082a01)