v0.11.2

0.11.2 (2026-10-22)

Bug Fixes

• go: update module github.com/azure/azure-sdk-for-go/sdk/azidentity (v1.14.1 → v1.15.0) (#188) (8c328a2)
• go: update module github.com/ebitengine/purego (v0.11.1 → v0.11.2) (#202) (70a8120)
• go: update module github.com/google/go-github/v92 (40091e2 → e754d2c) (#175) (0266fdc)
• go: update module github.com/google/go-github/v92 (70b9759 → c273cd8) (#184) (14df5da)
• go: update module github.com/google/go-github/v92 (e754d2c → 70b9759) (#182) (3f47caa)
• go: update module github.com/google/go-github/v92 (v92.0.1-0.20261013233148-c273cd8137bd → v93.0.0) (#199) (4a0bb40)
• go: update module github.com/microsoft/kiota-abstractions-go (v1.11.1 → v1.11.2) (#190) (9d8c057)
• go: update module github.com/microsoft/kiota-abstractions-go (v1.11.2 → v1.11.3) (#204) (1e6416b)
• go: update module github.com/microsoft/kiota-abstractions-go (v1.11.3 → v1.11.4) (#215) (17b07f9)
• go: update module github.com/microsoft/kiota-http-go (v1.5.7 → v1.5.8) (#191) (b16a8e3)
• go: update module github.com/microsoft/kiota-http-go (v1.5.8 → v1.5.9) (#207) (59a005e)
• go: update module github.com/microsoft/kiota-serialization-form-go (v1.1.3 → v1.1.4) (#187) (5e5e83d)
• go: update module github.com/microsoft/kiota-serialization-form-go (v1.1.4 → v1.1.5) (#216) (fc240f2)
• go: update module github.com/microsoft/kiota-serialization-json-go (v1.1.4 → v1.1.5) (#192) (34e800d)
• go: update module github.com/microsoft/kiota-serialization-multipart-go (v1.1.2 → v1.1.3) (#210) (b2e6d4b)
• go: update module github.com/microsoft/kiota-serialization-multipart-go (v1.1.3 → v1.1.4) (#217) (4cf2b17)
• go: update module github.com/microsoft/kiota-serialization-text-go (v1.1.3 → v1.1.4) (#193) (a6f1908)
• go: update module github.com/microsoft/kiota-serialization-text-go (v1.1.4 → v1.1.5) (#211) (161600a)
• go: update module github.com/modelcontextprotocol/go-sdk (12c67a6 → d1a225e) (#172) (50ba1a9)
• go: update module github.com/modelcontextprotocol/go-sdk (25f4880 → 3ebc6d1) (#209) (3bedbea)
• go: update module github.com/modelcontextprotocol/go-sdk (3e9d812 → 25f4880) (#208) (dba6cd1)
• go: update module github.com/modelcontextprotocol/go-sdk (3ebc6d1 → 12e768b) (#213) (bfb4ecb)
• go: update module github.com/modelcontextprotocol/go-sdk (452ac5a → 12c67a6) (#170) (0dfab75)
• go: update module github.com/modelcontextprotocol/go-sdk (7cdd99f → 3e9d812) (#183) (67d94fa)
• go: update module github.com/modelcontextprotocol/go-sdk (8c761a2 → d1a225e) (#173) (0152570)
• go: update module github.com/modelcontextprotocol/go-sdk (b04b49e → 7cdd99f) (#178) (2acf644)
• go: update module github.com/modelcontextprotocol/go-sdk (b5d319b → b04b49e) (#177) (eadeaef)
• go: update module github.com/modelcontextprotocol/go-sdk (d1a225e → b5d319b) (#174) (7952523)
• go: update module github.com/oras-project/oras-go/v3 (v3.0.0-rc.1.0.20260925203640-cb6d6dc79f83 → v3.0.0-rc.2) (#186) (293ab4f)
• npm: update react runtime (19.3.0 → 19.3.1) (#194) (b26c82c)

v0.11.1

0.11.1 (2026-10-12)

Bug Fixes

• git: disable signing for managed commits (71aaaa0)
• go: update module github.com/bmatcuk/doublestar/v4 (v4.10.2 → v4.10.3) (#166) (c287ba7)
• go: update module github.com/klauspost/compress (v1.20.1 → v1.20.3) (#169) (2d02722)
• go: update module github.com/modelcontextprotocol/go-sdk (944ac19 → 452ac5a) (#168) (6f86395)
• plugin: lease the icon for every apply (9f9fe1f)

v0.11.0

0.11.0 (2026-10-11)

⚠ BREAKING CHANGES

• plugin: lease reconciliation content on demand
• report: use artifact versions or native metadata instead of destination.version.
• lockfile: reviewed source locks use the stemma.lock directory.
• plugin: reconciliation operations use interface version 2.
• inspect: resource operations use interface version 3.

Features

• cli: group pipeline progress by phase (b58d096)
• icon: select an application in the prepared installer (b82ebc6)
• inspect: read files directly from artifacts (4ee1dbe)
• inspect: report application executable architectures (9619302)
• intune: accept inspected subjects in included apps (dea0ce1)
• jamf: allow an explicit patch version (531b5b3)
• lockfile: store reviewed inputs by resource (debdd81)
• munki: derive detection from inspected applications (a519013)
• plugin: lease reconciliation content on demand (0f2b998)
• plugin: preview managed publication metadata (5e52c82)
• plugin: select package subjects by identifier (a80d5dd)
• software: retain source version provenance (4fd6d74)
• source: authenticate GitHub lookups from the environment (974a57f)
• source: select the highest captured download version (c2795b4)
• validate: compare declarations with reviewed inputs (9a6228c)

Bug Fixes

• go: update module github.com/modelcontextprotocol/go-sdk (218aedd → 944ac19) (#164) (42628f5)
• go: update module github.com/modelcontextprotocol/go-sdk (3c08147 → 218aedd) (#159) (c4327bf)
• go: update module golang.org/x/image (v0.46.0 → v0.47.0) (#152) (5bd1215)
• go: update module golang.org/x/net (v0.60.0 → v0.61.0) (#144) (176de2d)
• go: update module golang.org/x/sync (v0.23.0 → v0.24.0) (#148) (36fc2fc)
• go: update module golang.org/x/term (v0.46.0 → v0.47.0) (#153) (23ae862)
• go: update module golang.org/x/text (v0.42.0 → v0.43.0) (#154) (ca304be)
• intune: derive publication previews before Graph translation (f475760)
• jamf: preview locally derived publication metadata (7180a1c)
• report: separate artifact and publication versions (d64d544)

v0.10.4

0.10.4 (2026-10-10)

Features

• icon: take artwork from a local application or file (883adb3)

Bug Fixes

• go: update module github.com/google/go-github/v92 (4dbe048 → 40091e2) (#151) (d3379dc)
• go: update module github.com/modelcontextprotocol/go-sdk (71fd646 → da6ad80) (#146) (60d41b3)
• go: update module github.com/modelcontextprotocol/go-sdk (da6ad80 → 3c08147) (#150) (3d5401f)
• treefs: use current metadata during traversal (3b7a096)

Performance Improvements

• apple: retain scoped handles while reading bundles (871e92c)
• engine: prepare applications from canonical tree leases (f82b466)
• storage: stream canonical trees through verified copies (67ebd43)

v0.10.3

0.10.3 (2026-10-09)

Bug Fixes

• apple: accept empty XAR contents without checksums (f8ffb59)
• apple: verify frameworks with direct root links and several versions (893c83e)
• build: unify Go toolchain and license tool versions (9711802)
• go: update module github.com/google/go-github/v92 (d61c874 → 4dbe048) (#145) (275198a)
• go: update module github.com/modelcontextprotocol/go-sdk (8dd5d6a → 71fd646) (#141) (a7c3639)

v0.10.2

0.10.2 (2026-10-08)

Features

• intune: publish PKG install scripts (9bcfde2)
• macsoftware: publish an application in a package (ed7b29b)
• reconcile: group same-content lock refreshes (32cd4e3)

Bug Fixes

• apple: recognize unsigned generic bundle executables (657ab00)
• apple: tolerate duplicate unselected payload entries (3d76ad1)
• cli: make progress and outcomes consistent (875d723)
• diskimage: adopt upstream name and compression semantics (950e9ea)
• go: update module github.com/azure/azure-sdk-for-go/sdk/azcore (v1.23.2 → v1.23.3) (#128) (53443d1)
• go: update module github.com/deploymenttheory/go-apfs-v2 (v0.17.2 → v0.18.0) (#137) (684aa72)
• go: update module github.com/google/go-github/v92 (2d16356 → b1a37cf) (#132) (8ef7f32)
• go: update module github.com/google/go-github/v92 (9962577 → 2d16356) (#127) (5dff816)
• go: update module github.com/google/go-github/v92 (b1a37cf → d61c874) (#135) (65e181f)
• go: update module github.com/mattn/go-runewidth (v0.0.30 → v0.0.31) (#138) (cb648d9)
• go: update module github.com/microsoft/kiota-http-go (v1.5.6 → v1.5.7) (#129) (46fd324)
• go: update module github.com/modelcontextprotocol/go-sdk (0f18bc7 → 172aebf) (#123) (e18b113)
• go: update module github.com/modelcontextprotocol/go-sdk (172aebf → 6737e73) (#126) (8d3f74e)
• go: update module github.com/modelcontextprotocol/go-sdk (6737e73 → 8dd5d6a) (#131) (07b207b)
• intune: name the app whose type cannot change (2e034d1)
• macpkg: include a payload in every package (096f939)
• macsoftware: avoid copying extracted packages twice (82db508)
• macsoftware: default packages to receipt detection (07e9e58)
• macsoftware: prepare nested disk images consistently (5e7e613)
• source: allow HTTP mirrors for pinned Homebrew casks (cd4990e)
• source: identify blocked redirect endpoints (a45ce5e)

v0.10.1

0.10.1 (2026-10-06)

Features

• cli: recommend missing signature expectations (67cbbde)
• select resources by profile (edc641d)
• signature: cover the only signing subject and skip built packages (ae9767e)
• signature: recommend expectations for unverified inputs and setups (6b8a8f8)
• signature: verify Mac App Store signatures (00a1433)
• signature: warn when a Developer ID signature has no timestamp (3350df2)

Bug Fixes

• apple: accept backslashes in sealed resource names (d02b1d8)
• engine: retain invalid dependencies in changed runs (baa17f5)
• go: update module github.com/modelcontextprotocol/go-sdk (c1ed348 → 0f18bc7) (#121) (1b78ac5)

v0.10.0

0.10.0 (2026-10-05)

⚠ BREAKING CHANGES

• cli: plugins list reads declarations; plugins inspect loads capabilities. JSON reports include unchanged outcomes independently of --all.

Features

• cli: refine publication review output (18d4ba9)
• cli: separate activity from command results (5a80ac8)
• plugins: reuse cached installations (51feb86)

Bug Fixes

• go: update module github.com/deploymenttheory/go-apfs-v2 (v0.17.0 → v0.17.1) (#94) (747a33f)
• go: update module github.com/deploymenttheory/go-apfs-v2 (v0.17.1 → v0.17.2) (#120) (2ca396d)
• go: update module github.com/deploymenttheory/go-macos-pkg (v0.7.2 → v0.7.3) (#108) (447ca6d)
• go: update module github.com/go-git/go-git/v6 (v6.0.0-alpha.5 → v6.0.0-beta.1) (#115) (92bff47)
• go: update module github.com/google/go-github/v92 (4a73e54 → 52908e2) (#107) (48d2e2d)
• go: update module github.com/google/go-github/v92 (52908e2 → 9962577) (#118) (902d0d3)
• go: update module github.com/modelcontextprotocol/go-sdk (25a53e3 → b7d283d) (#114) (efd239f)
• go: update module github.com/modelcontextprotocol/go-sdk (b7d283d → c1ed348) (#116) (a088f3c)
• npm: update dependency docusaurus-plugin-llms (0.6.0 → 0.6.1) (#113) (b5d3204)
• source: identify endpoints in HTTP failures (98184d0)

v0.9.1

0.9.1 (2026-10-03)

Features

• extract icons from resource inputs (bcb0939)
• inspect resource inputs before building (b36e7bd)

Bug Fixes

• decode native icon artwork across platforms (1dd25fe)
• preserve artwork and report observed input changes (a2bc1a5)
• preserve inspection identity and icon outcomes (ffacdc6)
• read artwork through declared resource inputs (0ba75d8)

v0.9.0

0.9.0 (2026-10-03)

⚠ BREAKING CHANGES

• unify source resolver contracts

Features

• cache: maintain retained content automatically (272921a)
• go: update module github.com/caarlos0/env/v11 (v11.3.1 → v11.4.1) (#96) (80d4f20)
• go: update module github.com/deploymenttheory/go-apfs-v2 (v0.13.0 → v0.15.1) (#85) (f4ffcba)
• go: update module github.com/deploymenttheory/go-apfs-v2 (v0.15.1 → v0.17.0) (#97) (85ce03b)
• macpkg: declare command links in package layouts (a0b6ee5)
• npm: update dependency oxlint (1.85.0 → 1.86.0) (#74) (915c2d0)
• preserve archive metadata in application disk images (2a47d06)
• source: expose resolved input versions and content roots (cbfb60f)
• source: resolve Homebrew casks and standalone bottles (ae7bc86)
• source: resolve reviewed content from metadata (862828c)
• source: resolve WinGet installers from the community catalog (1710154)

Bug Fixes

• archive: require archive suffixes for filename hints (b01f21a)
• build: exclude MIT-0 sqlite module from license export (7690f36)
• contents: recognize containers behind opaque download URLs (129e15d)
• go: update module github.com/azure/azure-sdk-for-go/sdk/storage/azblob (v1.8.1 → v1.8.2) (#90) (cb1db6a)
• go: update module github.com/go-git/go-billy/v6 (v6.0.0-alpha.2 → v6.0.0-beta.1) (#101) (7f44466)
• go: update module github.com/google/go-github/v92 (48d0a66 → e741894) (#89) (fc9e5a8)
• go: update module github.com/google/go-github/v92 (93344bc → 9a9d77c) (#95) (881042f)
• go: update module github.com/google/go-github/v92 (9a9d77c → a3ddb8e) (#102) (6799d55)
• go: update module github.com/google/go-github/v92 (a3ddb8e → 4a73e54) (#103) (f7948de)
• go: update module github.com/google/go-github/v92 (c674c93 → 93344bc) (#92) (434d53a)
• go: update module github.com/google/go-github/v92 (e741894 → c674c93) (#91) (0553446)
• go: update module github.com/modelcontextprotocol/go-sdk (1bfbc5c → 9ceba26) (#80) (55fb900)
• go: update module github.com/modelcontextprotocol/go-sdk (28ff432 → d04a013) (#73) (52f8848)
• go: update module github.com/modelcontextprotocol/go-sdk (463c760 → 591c5fd) (#70) (4811bd3)
• go: update module github.com/modelcontextprotocol/go-sdk (53effc0 → 25a53e3) (#99) (c0075de)
• go: update module github.com/modelcontextprotocol/go-sdk (591c5fd → 28ff432) (#72) (36f7c2f)
• go: update module github.com/modelcontextprotocol/go-sdk (9ceba26 → f4850f5) (#86) (99d5873)
• go: update module github.com/modelcontextprotocol/go-sdk (bab4bf1 → e2ad683) (#78) (c6c4da0)
• go: update module github.com/modelcontextprotocol/go-sdk (d04a013 → bab4bf1) (#75) (7bfc6e6)
• go: update module github.com/modelcontextprotocol/go-sdk (e2ad683 → 1bfbc5c) (#79) (26c77f3)
• go: update module github.com/modelcontextprotocol/go-sdk (f4850f5 → 53effc0) (#87) (df156db)
• honor resolved filenames and application roots (0bc3619)
• plugin: version resolved content contracts (c5f8f5d)
• report: distinguish resolved inputs from prepared resources (cf2db42)
• source: clarify registry selections and installer names (90f3c37)
• source: preserve discovery response semantics (76c47ff)

Performance Improvements

• source: share and revalidate discovery responses (5b8556e)

Code Refactoring

• unify source resolver contracts (4a9ac8b)

Tests

• diskimage: adapt native symlink targets at fixture boundary (e526343)
• establish runner-owned HTTPS trust (74f01f0)
• source: open WinGet fixtures with native SQLite paths (c5a1747)

Continuous Integration

• run Linux tests on Ubuntu 26.04 (cbd5a1d)
• start renovate and release please runs in .github (43627b7)

Miscellaneous Chores

• mise: lock file maintenance tool (mise) (#81) (59ba316)
• mise: lock file maintenance tool (mise) (#83) (0a98918)
• mise: update tool lefthook (2.1.14 → 2.1.15) (#100) (21f4249)
• mise: update tool oxfmt (0.70.0 → 0.71.0) (#88) ([4309001](4309001...