v0.5.1

things-cli v0.5.1 — cancel projects, honest empty JSON

Patch release: two bug fixes with a supply-chain hardening pass riding underneath.

Fixes

• things cancel now works on projects. It previously routed every reference through the task-only AppleScript path, so cancelling a project failed with a raw osascript error. Projects now cancel properly, behind the same interactive confirmation complete uses — cancelling a project cascades to its tasks. (#125)
• Empty --json results emit [], not null. All list-shaped commands (list, search, projects, areas, tags) returned null for an empty result, which breaks jq '.[]' pipelines — including the ones documented in the bundled agent skill. (#124)
• Date filters on someday are rejected instead of silently matching nothing. Someday items have no start date, so --on/--from/--to could never match; the CLI now says so instead of returning empty output, and the README no longer advertises the impossible combination. (#124)

Small improvements

• show, complete, and cancel help text now documents the numeric-index reference form (things list today; things complete 3) — it always worked, but only edit admitted it. (#125)
• things projects gains the -a short flag for --area, matching list and open. (#125)

Supply chain

• Release artifacts now carry build provenance attestations. install.sh verifies them automatically when the GitHub CLI is present (and refuses to install on a failed verification); check any artifact yourself with gh attestation verify things_<version>_darwin_arm64.tar.gz -R ryanlewis/things-cli. (#122, #123)
• CI hardening: govulncheck (gating + weekly Security-tab scan), CodeQL, dependency review, and a locked-down release pipeline. (#122)

Requirements

macOS with Things3 installed. Binaries for Apple Silicon (darwin_arm64) and Intel (darwin_amd64).

---

What's Changed

📦 Dependencies

• fix(deps): update all non-major dependencies by @renovate[bot] in #113
• chore(deps): update actions/setup-go action to v7 by @renovate[bot] in #117
• chore(deps): update actions/checkout digest to 3d3c42e by @renovate[bot] in #116
• chore(deps): update golangci/golangci-lint-action digest to ba0d7d2 by @renovate[bot] in #114
• chore(deps): update goreleaser/goreleaser-action digest to f06c13b by @renovate[bot] in #115

Other Changes

• docs: fix staleness in README and GitHub Pages site by @ryanlewis in #111
• chore: adopt the shared Renovate config by @ryanlewis in #119
• chore: pin actions to SHAs, default token to read-only by @ryanlewis in #120
• chore(ci): harden-runner egress audit on the release job by @ryanlewis in #121
• ci(security): hardening — provenance, scanning, workflow lockdown by @ryanlewis in #122
• feat(install): verify build provenance via gh attestation by @ryanlewis in #123
• fix(output): emit [] instead of null for empty --json results by @ryanlewis in #124
• fix(cancel): route projects through project-capable AppleScript by @ryanlewis in #125
• docs(release): add v0.5.1 release notes header by @ryanlewis in #126

Full Changelog: v0.5.0...v0.5.1