v5.15.2

Behavior changes

• The API token is no longer passed to the legacy CLI's environment, so processes it starts, such as Git hooks, don't inherit UPSUN_CLI_TOKEN, *_API_TOKEN or *_API_ACCESS_TOKEN. This applies only when the CLI itself runs Git (e.g. push, environment:checkout) with a token set via the environment, and not on Windows. A hook that runs the CLI must then set the token itself (#271)
• Credentials set via config now take precedence over stored ones. The order is: an API token (e.g. UPSUN_CLI_TOKEN or api.token_file), then an access token, then an API token saved by auth:api-token-login, then the session (#270, #271)
• Dates are shown in your timezone, from TZ or the system, instead of always in UTC. Set TZ=UTC to keep the previous output (#280)

Fixes

• user:add, user:update, team:create, team:update: an empty role (e.g. -r production:) is now rejected. It used to grant admin (#280)
• org:user:update: --permission is required in non-interactive mode. Without it, all the user's permissions were removed (#280)
• environment:synchronize --yes no longer rebases unless --rebase is given (#280)
• operation:list and operation:run read operations from all apps unless --app or --worker is given. They used to fail non-interactively on environments with several apps (#273)
• session:switch validates the session ID. An invalid one made every command fail (#270)
• Commands now exit 1 when (#280):
  • an awaited activity fails, in the domain:*, certificate:*, integration:update, integration:delete, backup:delete and user:delete commands
  • environment:activate is given an environment that doesn't exist
  • environment:deploy:type can't set manual
• Variables (#280):
  • variable:update --json false converts a JSON variable to a plain one
  • variable:disable and variable:enable act on the environment-level variable
  • variable:create --level environment asks for the environment if none is selected
• Activities (#280):
  • Log lines are no longer repeated when the log stream reconnects
  • --exclude-type no longer hides activity types the CLI doesn't know
  • Integration activities no longer show as an "unknown result"
• Tables and CSV (#280):
  • Multibyte text wraps by display width and is no longer cut mid-character
  • Tables with --no-header no longer overflow the terminal
  • CSV and TSV cells containing any line break are quoted
  • Deprecated --columns names are matched case-insensitively
• Inside an Upsun container, --project <other> no longer uses the container's branch and app (#280)
• Revoked project access now clears the cached project and environments (#280)
• integration:add/integration:update: a repository given as a URL is sent as owner/repo (#280)
• backup:create shows the "must be an administrator" message to non-admins, not admins (#280)
• Windows: reading a session file while another process replaces it no longer fails (#275)

Other

• Node.js 24 is moved to the legacy versions in the image registry (#265)
• Embedded PHP 8.5.12 rebuilt (build 4) (#261)
• Updated dependencies: guzzle 7.16.0, composer/ca-bundle 1.6.0, kin-openapi 0.152.0, pkg/sftp 1.13.12 (#277, #278)

Full Changelog: v5.15.1...v5.15.2