<!-- ⚠ GENERATED by nornir from .nornir/CHANGELOG.md — DO NOT EDIT this file -->
# Changelog
All notable changes to Gunnar are listed here, one section per version published on
crates.io. Each entry names the merge commit on `master` it comes from. The format
follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and Gunnar uses
[Semantic Versioning](https://semver.org/).
Each fixed vulnerability is listed under **Security** with its RUSTSEC, CVE or GHSA id.
To report a vulnerability, see [SECURITY.md](SECURITY.md).
## Unreleased
Changes on `master` after 1.5.1 (up to 72b99016, 2026-10-29).
### Security
- The root lock and every detached lock that carried them take the fixed releases
(3d9aaf24): pulldown-cmark 0.13.5 (RUSTSEC-2026-0414), rustls-webpki 0.103.16
(RUSTSEC-2026-0382), tokio 1.54.1 (RUSTSEC-2026-0386), wasmtime 49.0.4
(RUSTSEC-2026-0378, RUSTSEC-2026-0379), webpki-roots and webpki-root-certs 1.0.11
(RUSTSEC-2026-0381, RUSTSEC-2026-0383), and in the bench h2 0.4.20 (RUSTSEC-2026-0258).
The `Cargo.lock` packaged with 1.5.1 still holds tokio 1.53.1, rustls-webpki 0.103.15,
pulldown-cmark 0.13.4 and webpki-roots 1.0.9. A `cargo install gunnar` without
`--locked` already resolves the fixed versions.
- The gunnar-front and gunnar-monetize-guest locks move to skidbladnir 0.2.3, with zstd
0.14 and zbus 6 (RUSTSEC-2026-0370 to RUSTSEC-2026-0372, RUSTSEC-2026-0391,
RUSTSEC-2026-0398, RUSTSEC-2026-0403, RUSTSEC-2026-0410) (3d9aaf24).
- The bench, installtest and gunnar-growbench locks take zstd 0.14.3 (RUSTSEC-2026-0391,
RUSTSEC-2026-0398, RUSTSEC-2026-0403, RUSTSEC-2026-0410) and replace the yanked
chacha20 0.10.1 with 0.10.2 (776554a1).
- basic-toml (RUSTSEC-2026-0374, unmaintained, no fixed release) is ignored in
`deny.toml` with its reason: it is only a compile-time dependency of age's i18n
macros and links into no binary (3d9aaf24).
### Added
- The release signing key in `slsa/`: the owner's YubiKey key (PIV slot 9c, P-256, PIN
once, touch always), key id `d24d3785e8281bcd37e8f2c40a3a85e8152d3ce2200a5c929a1a5ca636e8249e`,
with the YubiKey's attestation of it and the attestation CA (f62cf899).
- SLSA Build L3 release provenance: `docs/SLSA.md`, the release key in `slsa/`, and the
attestations in `attestations/` (72b99016).
- `docs/FEATURES.md`: Gunnar's features with status, date, source path and commit
(9b7d1d85).
- `Repos.ListDeleted` answers the default retention days (d0fb62cf).
- Company SSO: domains are proven by DNS, and `GUNNAR_SSO_DNS_RESOLVER` names the
resolver for that proof (96bdc862, d6a76a69).
### Changed
- Gunnar runs on edda's shared identity core, `nornir-identity` 0.2 (70ab1c7a, 43fae822).
- Company SSO is gunnar-server's own default-off feature `sso` (c237f47e).
- An import is held to the memory this server may really use (216447e5).
- gunnar-server stays generic: a console setting fed again is stored as an opaque
setting (ff52a93b).
### Fixed
- git protocol v0: `deepen-relative` and the ACK that closes the haves (5dd1c40a).
- A shallow fetch with a filter sends a named want (ee5f7f9b).
- A person's browser approval of a forge event works again: Gunnar attests the event
from a stepped-up passkey session (a12df55f).
- A soft delete reaches the twin and a restored box, so the repository stays deleted
there (0ac13ea0).
- The main stores the public-site switch it is fed, so the public site of gunnar.rs can
be switched on (39d41950).
- A laid main keeps the mail relay it is fed (0ecda8af, fef22e02).
- SAML: a save without metadata keeps the stored entity id, sign-on URL and
certificates (688d27f0).
## [1.5.1] - 2026-10-27
Published from 6eedc2d6. Changes since 1.5.0.
### Security
- The CLI pins each person's encryption public key per forge host and account, and
refuses a forge answer that differs. Changes to unlock methods over the SSH door are in
the account audit, and the CLI zeroizes its secrets (b0fea9a8, review rows RA4-1 high,
RA4-3, RA4-15).
- A provisioned SCIM or CSV employee is claimed only on the admin's binding or on an
e-mail address the identity provider asserts is verified (264c56e9, review row A34-2
high).
- The CLI's gRPC path through the front keeps the console's rules and never carries
`Bootstrap.Enroll`, so an unenrolled box cannot be claimed through it (a68c3df9).
- A server setting change goes to the hash-chained audit trail before it is applied,
and is refused when the audit record cannot be written (c27902d7, 13b84581).
- SSO administration calls need a fresh, user-verified passkey touch (9f607d80).
- A refused SSO claim names nobody in the answer or the logs (16627e47).
- crypto-bigint 0.7.5 (yanked) is replaced by 0.7.10 in the root lock and seven detached
locks (197f5a6a).
### Added
- One encryption key per person for encrypted repositories, with YubiKey and security
key unlock (FIDO2 hmac-secret or WebAuthn PRF) (513ca0fc). This removes
`gunnar unlock` and `upgrade-pq`; there is no reader for the old format.
- Background work runs as named jera jobs (f3a94013).
- `gunnar control --at https://<site>` reaches the control plane through the front's
port 443, with the caller's own credential (bfbb8483).
- `cargo xtask idp` tests company SSO against a real Keycloak in a container (d05729ff).
- An `mcp` feature on gunnar-front, off by default (f730eb5e).
### Changed
- Default builds are airgap builds: no outbound connection unless configured
(efda2e01, 253498b3).
- One version of each dependency where Gunnar chooses, and the plain default build
leaves out company SSO (bcfaba7c).
- WebAuthn and step-up come from edda's `nornir-auth-webauthn` and
`nornir-identity-session` crates (3b409609, 873ec53b).
- Gunnar moves to the shared monetize 0.3.0 crates, and gunnar-monetize-guest 2.0.0
speaks the six-operation product contract (fee665e2, 21435f46).
### Fixed
- An import is DONE only when its references are present; otherwise it FAILS with the
reason (e95cc71a).
- A panic in a pump call is caught and the puller is rebuilt (57ae54fe).
- The job ledger closes rows that a stopped or crashed run left running (13143ba7).
- The front's update re-admits boxes that were left at their install listener
(2cd07aed, c8857a5c).
### Known advisories
- RUSTSEC-2023-0071 (`rsa`, no fixed release) is ignored with its reason: Gunnar's SSH
host key is ed25519 only.
- The packaged `Cargo.lock` holds the four versions listed under Unreleased; they are
fixed on `master`.
## [1.5.0] - 2026-10-22
Published from 3aa3acdb. The git tag `v1.5.0` marks the earlier release cut of
2026-10-12 (fe49c32f). Changes since the tag `v1.4.0` (2026-09-10), which was not
published on crates.io.
### Security
- Fixes from the security review of 2026-09-11, each with a test: a revoked key loses
the session it already opened (1d62d861); a deleted principal's tokens do not come back
with its name (d6b93161); a remote cannot choose the contents of `.git/HEAD`
(e0621e77); the forge cannot choose where a token is sent (995d68ec); a mirror may only
point where its caller could go (25b2a783), and its reference batch passes the same
gate as a push (57b7b8b5); the HTTP listener has a time limit and a size limit
(ac4b6b6e); a sealed slot no longer reads whatever is put in it (9184f9ac); an upload
path no longer prints a secret (ffd644df); bootstrap writes a private key only where
there was none (915eb0a7); a missing want is refused like a forbidden one (833732eb).
- rustls 0.23.45 and then 0.23.46 (RUSTSEC-2026-0285, RUSTSEC-2026-0346,
RUSTSEC-2026-0348, RUSTSEC-2026-0349) (9d8fe5fa, 07a3b79a).
- wasmtime 49 replaces wasmtime 45 (RUSTSEC-2026-0222, RUSTSEC-2026-0269,
RUSTSEC-2026-0316) (0ad8e16e), and wasmtime 49.0.3 follows (RUSTSEC-2026-0353 to
RUSTSEC-2026-0364) (07a3b79a).
- proc-macro-error2 (RUSTSEC-2026-0173, unmaintained, compile-time only) is ignored in
`deny.toml` with its reason (061a536d).
### Added
- `cargo install gunnar` installs a server that starts with no configuration: SSH and
smart HTTP on loopback, and `/healthz` (df52a9d2).
- A lone clone builds the server with a plain `cargo build --release` (3aa3acdb).
- Runtime growth of the data set: `gunnar control grow start|status|resume` (4008f65b,
2b5251e6).
- Repository import from GitHub and Codeberg (623cc236).
- `gunnar create`, and a first push in sha256 creates a sha256 repository (ef4ec6f6).
- `gunnar settings` (visibility, default branch) over the forge's SSH door (ba0822e7).
- History shows all branches (`Refs.Log all_refs`) (3f0f4d61).
- The admin's list of principals shows each person's last sign-in and last operation
(cd07bc2f, c240b2e2).
### Changed
- The twin only stores: it applies the control plane and keeps the data frames as
bytes (954c74d6).
- The appliance's PID 1, DHCP and clock come from edda's `appliance-pid1` and
`estate-clock` crates (7e33c0f7, 20cb318f).
- The pairing door runs the estate's WireGuard hub (3fa5c9ad).
- gix 0.88, ureq 3, and the toml and base64 majors (0ad8e16e, c3616f31).
- The licence files name the joint 50/50 ownership by Vetra Automation AB and
Ignalina ApS (0242b074).
## Earlier versions
The tag `v1.4.0` (2026-09-10) marks a git release only. No version of the `gunnar`
crate before 1.5.0 was published on crates.io.
[1.5.1]: https://crates.io/crates/gunnar/1.5.1
[1.5.0]: https://crates.io/crates/gunnar/1.5.0