Repository navigation

Tags

vfox-v2026.10.19

Release vfox 2026.10.19

Oct 24, 2026
860cdc0
zip
tar.gz

v2026.10.19

- **(config)** expose mise_config_dir to templates by @jdx in [jdx#14886

](jdx#14886)

- **(lsp)** send semantic tokens for tasks, tools, env vars and templates by @jdx in [jdx#14918](jdx#14918)

- **(lock)** rebuild lockfiles completely by default by @jdx in [jdx#14893](jdx#14893)
- **(pipx)** list git+ss
8000
h github.com sources over ssh when GitHub can't see them by @jdx in [jdx#14905](jdx#14905)
- **(python)** stop uv_venv_auto from fork-bombing through python shims by @jdx in [jdx#14927](jdx#14927)
- **(task)** apply extended template usage to file tasks by @jdx in [jdx#14888](jdx#14888)
- **(task)** quote and escape header values written by tasks add --file by @xucian in [jdx#14925](jdx#14925)
- **(uninstall)** remove installs whose directories deny their owner writes by @HengYangDS in [jdx#14883](jdx#14883)
- **(upgrade)** don't downgrade date-versioned tools with leading zeros by @jdx in [jdx#14923](jdx#14923)

- tell agents not to edit the vendored aqua registry by @jdx in [jdx#14910](jdx#14910)

- update e2e expectations after version validation moved earlier by @jdx in [jdx#14920](jdx#14920)
- pin java relock e2e to a fully published Temurin line by @jdx in [jdx#14940](jdx#14940)

- bump ctutils to 0.4.5 by @jdx in [jdx#14887](jdx#14887)
- update aube to v2.8.2 by @renovate[bot] in [jdx#14889](jdx#14889)
- update rust crate clx to v3.0.5 by @renovate[bot] in [jdx#14890](jdx#14890)
- ignore RUSTSEC-2026-0387 in cargo-deny by @jdx in [jdx#14939](jdx#14939)

- retry snapcraft upload on transient store errors by @jdx in [jdx#14909](jdx#14909)

- **(backend)** keep untrusted values out of subprocess arguments and the project directory by @jdx in [jdx#14896](jdx#14896)
- **(backend)** keep archive contents and release asset names inside the install directory by @jdx in [jdx#14895](jdx#14895)
- **(backend)** validate versions and names that become paths or URL segments by @jdx in [jdx#14901](jdx#14901)
- **(backend)** tighten SLSA signer and GitHub attestation checks by @jdx in [jdx#14904](jdx#14904)
- **(backend)** make SLSA, attestation and signed-checksum checks fail closed by @jdx in [jdx#14908](jdx#14908)
- **(backend)** reject SLSA provenance built from another tag by @jdx in [jdx#14924](jdx#14924)
- **(completion)** stop shell completion from running untrusted task code by @jdx in [jdx#14898](jdx#14898)
- **(config)** tie trust to the right files for worktrees, symlinks and config dirs by @jdx in [jdx#14902](jdx#14902)
- **(config)** close safe-mode gaps for lazy tools, deps, S3, bin_path and templates by @jdx in [jdx#14900](jdx#14900)
- **(config)** stop treating help, shims, hooks and config writes as consent to trust by @jdx in [jdx#14903](jdx#14903)
- **(config)** keep untrusted repo content from hanging or crashing hook-env by @jdx in [jdx#14916](jdx#14916)
- **(github)** send forge tokens only to their API host and harden release caches by @jdx in [jdx#14913](jdx#14913)
- **(hooks)** render hook commands once and keep templates out of written versions by @jdx in [jdx#14897](jdx#14897)
- **(http)** bound response, download and archive sizes and slow response bodies by @jdx in [jdx#14915](jdx#14915)
- **(install)** enforce pinned checksums and node signatures instead of falling back by @jdx in [jdx#14899](jdx#14899)
- **(lockfile)** stop lockfiles, tool stubs and the task cache from reaching outside the repo by @jdx in [jdx#14906](jdx#14906)
- **(packslip)** pin signers by repository ID and stop release-age backdating by @jdx in [jdx#14912](jdx#14912)
- **(task)** close sandbox escapes in --allow-write, --deny-net and --deny-write, and OCI whiteouts by @jdx in [jdx#14911](jdx#14911)
- keep credentials out of install paths, lockfiles, logs and redirects by @jdx in [jdx#14917](jdx#14917)

- @xucian made their first contribution in [jdx#14925](jdx#14925)
- @HengYangDS made their first contribution in [jdx#14883](jdx#14883)