v2.5.1

Security and maintenance

No functional changes. The binaries are rebuilt with Go 1.25.11, which patches three Go standard library advisories: GO-2026-5037 (crypto/x509), GO-2026-5038 (mime), and GO-2026-5039 (net/textproto).

hop never calls the affected code, so earlier binaries were not exploitable (govulncheck reports zero reachable vulnerabilities). This rebuild simply keeps the shipped toolchain current. Builds and the weekly vulnerability scan now track the latest 1.25.x patch automatically, so future stdlib fixes land without a manual bump.

Install

brew install philippe-desplats/tap/hop
# or
go install github.com/philippe-desplats/hop/cmd/hop@latest

Prebuilt binaries for macOS and Linux (amd64 and arm64) are attached below, with signed checksums (cosign) and an SBOM per artifact.

Full changelog: v2.5.0...v2.5.1

v2.5.0

Features

• Git worktree awareness (opt-in). Enable [scan] worktrees = true and hop also indexes linked git worktrees that live outside your scan roots, the usual ../project-feature layout, so they become jump targets like any other project. Worktrees that already sit under a root are indexed as before and deduped by path, never listed twice. Discovery runs git worktree list once per repo at scan time, which is why it stays off by default; the cached index keeps every p instant.

Install

brew install philippe-desplats/tap/hop
# or
go install github.com/philippe-desplats/hop/cmd/hop@latest

Prebuilt binaries for macOS and Linux (amd64 and arm64) are attached below, with signed checksums (cosign) and an SBOM per artifact.

Full changelog: v2.4.0...v2.5.0

v2.4.0

Features

• Frecency aging. Ranks no longer grow without bound. Once the total rank mass crosses an internal cap, every rank is scaled down and stale entries are pruned, the way zoxide ages, so a project you leaned on last month stops outranking the one you are on today.
• Import from zoxide with hop import --from zoxide. Already running zoxide? Seed hop from your learned history instead of starting cold. It reads zoxide query --list --score (the stable text interface, never the binary database): a git repository hop does not index yet is added to the search list and ranked, a directory hop already indexes is re-ranked, anything else is skipped. --dry-run previews without writing, and it always reports imported N, tracked M, skipped K.
• hop query for scripting. Print the resolved path as plain text, no cd and no shell sentinel, so you can compose hop with other tools: cd "$(hop query api)", hop query --list | fzf, or code "$(hop query acme web)".
• tmux or zellij session per project. The t action now drives either multiplexer, attaches or creates a session named after the project, and never nests when you are already inside one. Pick it with [actions] multiplexer = "auto" | "tmux" | "zellij" | "off"; it hides itself when the chosen multiplexer is not installed.

Install

brew install philippe-desplats/tap/hop
# or
go install github.com/philippe-desplats/hop/cmd/hop@latest

Prebuilt binaries for macOS and Linux (amd64 and arm64) are attached below, with signed checksums (cosign) and an SBOM per artifact.

Full changelog: v2.3.0...v2.4.0

v2.3.0

Features

• Track any folder in the search list with hop track. Until now hop only indexed folders that held a git repository. hop track ~/Downloads (any path, defaulting to the current directory) adds a folder even without a .git, so p down jumps straight to it. hop untrack removes it, tracked folders survive every hop scan, and hop clean prunes the ones whose directory is gone.

Security and quality

• Bumped golang.org/x/sys to v0.44.0, clearing advisory GO-2026-5024 (a Windows-only issue that was not reachable from hop's code). The minimum Go version is now 1.25.
• Added a CONTRIBUTING guide, a fuzz target on the ranking parser run in CI, and a linked vulnerability-reporting process. hop now carries an OpenSSF Best Practices passing badge.

Install

brew install philippe-desplats/tap/hop
# or
go install github.com/philippe-desplats/hop/cmd/hop@latest

Prebuilt binaries for macOS and Linux (amd64 and arm64) are attached below, with signed checksums (cosign) and an SBOM.

Full changelog: v2.2.0...v2.3.0

v2.2.0

Features

hop setup now finishes first-run setup for you, instead of leaving a manual step at the end.

• Writes the shell integration for you. The wizard offers (default yes) to append the eval "$(hop init ...)" line to your ~/.zshrc, ~/.bashrc or fish config, and skips it when the line is already present. The non-interactive fallback never touches your rc file and just prints the line to add.
• Discovers project folders by content. Root detection no longer relies on a fixed list of folder names: any top-level home folder that actually contains git repositories is proposed and preselected, so a custom ~/Developments or ~/Labs is found, not only ~/Projects. System folders such as ~/Downloads are excluded, and node_modules is ignored when counting repositories.

Install

brew install philippe-desplats/tap/hop
# or
go install github.com/philippe-desplats/hop/cmd/hop@latest

Prebuilt binaries for macOS and Linux (amd64 and arm64) are attached below, with signed checksums (cosign) and an SBOM.

Full changelog: v2.1.1...v2.2.0

v2.1.1

Changelog

• 1217254: fix(actions): make remote and file-manager actions cross-platform (@philippe-desplats)

v2.1.0

Changelog

• 21c2112: feat(install): add curl|sh installer for non-brew/non-go setups (@philippe-desplats)
• bacbc58: feat(setup): add guided first-run wizard with auto-detection (@philippe-desplats)
• 14f7314: fix(homebrew): strip install quarantine and add setup caveats (@philippe-desplats)

v2.0.0

Changelog

• d80b748: build: goreleaser release pipeline, CodeQL and Scorecard workflows (Philippe Desplats philippe@dirupt.com)
• f386003: feat(tui): label the shift pin shortcut P pin / P unpin instead of a star (Philippe Desplats philippe@dirupt.com)
• 1ca883f: feat(tui): pin/unpin via Shift+P and show it in the shift legend (Philippe Desplats philippe@dirupt.com)
• 8fe6e47: feat(tui): toggle pin/unpin from the Hub action menu (Philippe Desplats philippe@dirupt.com)
• a25c302: feat: bash and fish shell integrations with project-name completion (Philippe Desplats philippe@dirupt.com)
• e6f8cbe: feat: configurable AI assistant and custom Hub actions (Philippe Desplats philippe@dirupt.com)
• 6aaa395: feat: favorites, dead-path pruning, and a jump-list (Philippe Desplats philippe@dirupt.com)
• 4e2a282: feat: hop, a fast AI-agnostic project switcher (Philippe Desplats philippe@dirupt.com)
• a6e6bc5: fix(release): migrate cosign signing to the v3 bundle format (Philippe Desplats philippe@dirupt.com)
• 096a2bb: fix(security): reject control characters in the cd/run shell protocol (Philippe Desplats philippe@dirupt.com)