v0.1.2

What's Changed

• Add SKIP(self) verdict for the agent's own startup DNS probe connects by @takihito in #97
• build(deps): Bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.7 by @dependabot[bot] in #89
• build(deps): Bump step-security/harden-runner from 2.20.0 to 2.21.0 by @dependabot[bot] in #88

Full Changelog: v0.1.1...v0.1.2

v0.1.1

What's Changed

• Auto-stop the agent to prevent block-mode jobs from hanging (Phase 1) by @takihito in #95

Full Changelog: v0.1.0...v0.1.1

v0.1.0

What's Changed

• chore: bump version to 0.1.0 by @takihito in #76
• build(deps): Bump actions/setup-go from 6.4.0 to 7.0.0 by @dependabot[bot] in #72
• build(deps): Bump github/codeql-action/analyze from 4.36.2 to 4.37.2 by @dependabot[bot] in #73
• docs: add GitHub Pages site under docs/ by @takihito in #78
• docs: add curl-based install script by @takihito in #84
• docs: add install instructions to README, fix doc/code drift by @takihito in #85
• build(deps): Bump ossf/scorecard-action from 2.4.3 to 2.4.4 by @dependabot[bot] in #83
• build(deps): Bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.3 by @dependabot[bot] in #81
• Add report subcommand + GitHub Actions job summary/annotations by @takihito in #91
• ci: render smoke-test connection log as a job summary by @takihito in #93
• docs: document report follow-up fixes from PR #91 review by @takihito in #92
• docs: note field-cage's monitoring window vs. job-start-wide audit tools by @takihito in #94
• build(deps): Bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #82

Full Changelog: v0.0.8...v0.1.0

v0.0.8

What's Changed

• feat: manage release version via internal/version file by @takihito in #74

Full Changelog: v0.0.7...v0.0.8

v0.0.7

What's Changed

• Bump github/codeql-action from 3.36.2 to 4.36.2 by @dependabot[bot] in #42
• fix: strip port suffix from domain entries in allowlist by @takihito in #52
• fix: remove connect_ms from log output by @takihito in #51
• feat: add IPv4 CIDR subnet support to allowlist by @takihito in #53
• feat: add IPv6 support (monitoring and block-mode enforcement) by @takihito in #57
• feat: restrict port 53 to trusted resolvers (opt-out via allow_all_dns) by @takihito in #58
• fix: harden event loops and unify diagnostics with slog by @takihito in #59
• fix: policy UX — optional mode, reject wildcards, store parsed IPs by @takihito in #60
• docs: sync DNS restriction and IPv6 details across README/CLAUDE.md by @takihito in #61
• refactor: unify resolver discovery, parallelize seed, share IPv4 policy (PR4) by @takihito in #63
• Bump actions/upload-artifact from 4.6.2 to 7.0.1 by @dependabot[bot] in #44
• refactor: parse DNS responses with x/net/dns/dnsmessage (PR5) by @takihito in #64
• Bump ossf/scorecard-action from 2.4.2 to 2.4.3 by @dependabot[bot] in #43
• fix: batch of small eBPF hardening fixes (LRU_HASH, DNS payload zeroing, IPv6 port truncation) by @takihito in #68
• build(deps): Bump github.com/cilium/ebpf from 0.21.0 to 0.22.0 by @dependabot[bot] in #54
• Bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3 by @dependabot[bot] in #55
• build(deps): Bump golang.org/x/sys from 0.46.0 to 0.47.0 by @dependabot[bot] in #65
• Bump step-security/harden-runner from 2.19.4 to 2.20.0 by @dependabot[bot] in #66
• build(deps): Bump golang.org/x/net from 0.48.0 to 0.55.0 by @dependabot[bot] in #69
• build(deps): Bump golang.org/x/net from 0.55.0 to 0.57.0 by @dependabot[bot] in #70
• build(deps): Bump Songmu/tagpr from 1.20.0 to 1.20.1 by @dependabot[bot] in #71

Full Changelog: v0.0.6...v0.0.7

v0.0.6

What's Changed

• fix: remove EXIT trap that deleted binary before agent start by @takihito in #48

Full Changelog: v0.0.5...v0.0.6

v0.0.5

What's Changed

• Fix: install cosign in composite action (do not assume pre-installed) by @takihito in #46

Full Changelog: v0.0.4...v0.0.5

v0.0.4

What's Changed

• Fix cosign: migrate to --bundle format (cosign v3 compatibility) by @takihito in #40
• Bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #41

Full Changelog: v0.0.3...v0.0.4

v0.0.3

What's Changed

• Add SKIP(dns)/SKIP(loopback) verdicts and connect_ms timing by @takihito in #13
• Refactor: extract verdict logic, split DNS files, testable main, cleanup-stack loader by @takihito in #15
• Add SECURITY.md with vulnerability reporting policy by @takihito in #27
• Add dependabot.yml and enable Dependabot security updates by @takihito in #28
• Bump goreleaser/goreleaser-action from 6 to 7 by @dependabot[bot] in #29
• Bump actions/setup-go from 5 to 6 by @dependabot[bot] in #30
• Bump golang.org/x/sys from 0.15.0 to 0.46.0 by @dependabot[bot] in #31
• Fix CI: use go-version-file and bump Dockerfile to Go 1.25 by @takihito in #33
• Bump github.com/cilium/ebpf from 0.14.0 to 0.21.0 by @dependabot[bot] in #32
• Pin GitHub Actions to commit hashes and add explicit permissions by @takihito in #34
• Add dependency-review-action to PR checks by @takihito in #35
• Add CodeQL workflow for Go static analysis by @takihito in #36
• Add step-security/harden-runner to all workflows (#21) by @takihito in #37
• Add OpenSSF Scorecard workflow and README badge (#24) by @takihito in #38
• Add cosign signing and SLSA Level 3 provenance to release workflow by @takihito in #39

New Contributors

• @dependabot[bot] made their first contribution in #29

Full Changelog: v0.0.2...v0.0.3

v0.0.2

What's Changed

• Add inline allowlist input to composite action by @takihito in #11

Full Changelog: v0.0.1...v0.0.2