v0.16.2

v0.16.2 — The authored GitHub Release body now completes the coordinated release instead of stopping it on provider newline normalization

Released 2026-07-30.

What changed

Release-body verification accepts only GitHub's terminal newline normalization

fix · normal impact

v0.16.1 successfully published the 38 Go release assets and the complete authored release body, then its new post-publish assertion rejected one extra terminal newline added by GoReleaser. The intentional fail-closed dependency stopped the macOS, VS Code, and coordinated-cohort jobs before they could upload their eight remaining assets. The verifier now compares every content byte while normalizing only trailing CR/LF bytes, reads the published body through a one-megabyte bounded stdin, and still rejects any changed heading, sentence, command, or link. v0.16.2 reruns the complete release cohort from the same product behavior.

Affects: GitHub Releases, release workflow, macOS notifications, VS Code notifications

What to do (local): Use v0.16.2 rather than the incomplete v0.16.1 cohort, especially when installing the macOS or VS Code notification companion.

Check: a2a version

a2a update --yes

Known issues

The macOS companion remains ad-hoc signed and may require manual approval

known issue · normal impact

The release cohort authenticates the exact macOS app and ad-hoc signing protects its bundle integrity, but the app is not identified or notarized through a paid Apple Developer account. A quarantined download may require one explicit System Settings → Privacy & Security → Open Anyway decision. Interactive Notification Center, Focus, Login Items, VS Code trust/profile, and remote-window checks remain release-environment evidence rather than claims inferred from hermetic tests.

Affects: macOS notifications, VS Code notifications

Current guidance: Keep Gatekeeper enabled and approve only the A2A Notifier version obtained through the verified a2a release cohort.

Install or update

macOS and Linux:

curl -fsSL https://raw.githubusercontent.com/ydnikolaev/a2ahub/main/scripts/install.sh | sh

Already installed? Run a2a update --yes. Windows archives and manual downloads are in the assets below.

Release artifacts include checksums, per-asset Sigstore bundles, SBOMs, and SLSA provenance. See SECURITY.md for verification commands.