# Changelog
All notable changes to Holger are listed here, one section per version published on
crates.io. Each entry names the commit on `main` it comes from. The format follows
[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and Holger uses
[Semantic Versioning](https://semver.org/).
Each fixed vulnerability is listed under **Security** with its RUSTSEC, CVE or GHSA id.
To report a vulnerability, see [SECURITY.md](SECURITY.md). The full list of features,
with status, date, source path and commit, is [docs/FEATURES.md](docs/FEATURES.md).
## Unreleased
Changes on `main` after 2.0.0 (up to 73a5e5fb, 2026-10-29).
### Security
- znippy-plugin-maven 0.10.1 moves to quick-xml 0.41, and quick-xml 0.36.2 leaves the
lock (RUSTSEC-2026-0194, RUSTSEC-2026-0195). In Holger, quick-xml 0.36.2 was reached
only through dev-dependencies (tests), not through the shipped server (73a5e5fb,
69bbe575).
- crypto-bigint 0.5.5 (RUSTSEC-2026-0387) is ignored in `deny.toml` with its reason: it
comes only through the PGP verifier (`pgp` 0.21.0, the newest), where Holger uses public
keys only, and no fixed 0.5 release exists. The estate locks follow monetize to
skidbladnir 0.2.3 (f3f3a023).
- The front carries only Holger's own gRPC services on the repository host, so the
identity core is never reached from the internet through the front (48600b3e).
- The scan sidecar bounds each job's processes with a cgroup `pids.max` (2d5dead9,
eabdb3c1).
- An invite needs a fresh step-up (nornir-identity 0.2.2) (5ba2272c).
### Added
- holger.rs's front page names the release key (its key id) under the credit and links
to `slsa/` (ab668791).
- The release signing key in `slsa/`: the owner's YubiKey key (PIV slot 9c, P-256, PIN
once, touch always), key id `d24d3785e8281bcd37e8f2c40a3a85e8152d3ce2200a5c929a1a5ca636e8249e`,
with the YubiKey's attestation of it and the attestation CA (67154e42).
- SLSA Build L3 release provenance: `docs/SLSA.md`, the release key in `slsa/`, the
attestations in `attestations/`, and a test that the provenance scanner verifies such a
release bundle (25e9033b).
- The front's downstream interface logs its relay counters (48ac2fe7).
- Holger's guest declares its front's downstream port (udp/51830), so the ONE box opens
only declared ports (09525b5d).
### Changed
- holger-server-lib and the `holger` binary are clippy clean under `-D warnings` at every
feature set a build uses (f0d43bcf, 2812762c, 0d665955).
- The root takes monetize-proto 0.3.3 and estate-front 0.3.0 from crates.io (10adba30).
- holger-provenance leaves its 11 MB test fixture out of the crates.io package, as the
2.0.0 package already did (7a4f5fce).
### Fixed
- A dead main is rebuilt from its twin again (3df55b53).
- A lean main (no public IPv4) that the ONE box lays again is re-admitted at its utility
address (1bc2d71f).
- The promotion gate refuses over gRPC `PromoteArtifact` (81309576).
- `holger-cli artifacts put` streams a file of any size (63f82f3f).
- holger-server-lib's default build compiles again (27049467).
- An endpoint the admin names wins over the front's own address in a WireGuard invite
(b892cf05).
## [2.0.0] - 2026-10-29
Published from 87e5ada5, which is `main` at 7bebb1e6 plus one packaging commit (the large
test fixture left out of the package). Changes since the 0.6.10 crates (2026-08-23).
Holger 2.0 is a security gateway: every artifact passes an explicit intake chain before
it is served, and the open core builds and installs with plain cargo.
### Security
- The intake chain: each artifact has one state from UNTRUSTED to AVAILABLE, on HTTP PUT,
native uploads and gRPC, and is served only when AVAILABLE (99daae77).
- Separation of duties: Developer, Importer, SecurityApprover, RepositoryAdmin and
Auditor; the importer never approves its own import (17bda3af).
- File and archive inspection on every ingest (zip bombs, nesting, path traversal), and
ClamAV and YARA hooks (b231aa9e).
- Every scan runs in a hardened rootless container, never in the server (1998749a,
babf13c8).
- The offline provenance verifier: DSSE, in-toto, SLSA, and Sigstore keyless (Fulcio
chain and identity), PEP 740, npm attestations and cosign (5eeac4fd).
- Offline vulnerability intelligence: OSV, NVD and KEV as a signed bundle, with Wolfi and
Chainguard advisories (c643b9a7, d605b919).
- One tamper-evident audit trail per artifact (a hash chain with signed checkpoints), and
its SIEM export (2c0d2eca).
- AI models are artifacts, and pickle files are blocked by default (7bb56235).
- The public HTTP door and the gRPC door speak TLS 1.3 only (831a8dee).
- Holger runs on edda's shared identity core, with a `__Host-` HttpOnly session cookie
(d47e5b15).
- The security review of 2026-09-11 found 40 defects, and all 40 are fixed, each with a
test that failed first (5ad190d8; `docs/security-review-2026-09-11.md`).
- Dependency advisories fixed in the lock:
- rustls 0.23.46 (RUSTSEC-2026-0285, RUSTSEC-2026-0346, RUSTSEC-2026-0348,
RUSTSEC-2026-0349) (61954cd6);
- wasmtime 49.0.3 with cranelift 0.136.3 (RUSTSEC-2026-0353 to RUSTSEC-2026-0364)
(61954cd6), then wasmtime 49.0.4 (RUSTSEC-2026-0378, RUSTSEC-2026-0379) (0b829a36);
- the plugin host moves from wasmtime 27 to 48, which clears 15 of the 17 wasmtime
advisories that `deny.toml` had accepted (1bd8c086); the wasmtime 45 copy of a
dev-dependency (RUSTSEC-2026-0222, RUSTSEC-2026-0269) later leaves the graph
(5f9898f9);
- zip 9.0.5 in bench-scenarios and znippy-rust (RUSTSEC-2026-0367, RUSTSEC-2026-0368,
RUSTSEC-2026-0369) (61954cd6);
- rustls-pemfile (RUSTSEC-2025-0134, unmaintained) is gone: PEM is read with
rustls-pki-types (61954cd6);
- h2 0.4.19 (RUSTSEC-2026-0258), and quinn-proto, crossbeam-epoch and webbrowser
(bcdf9b64);
- zbus 6 through skidbladnir 0.2.1, which leaves the unmaintained zbus_names, zvariant
and zvariant_derive behind (a5b97301).
### Added
- `cargo install holger` and a plain `cargo build --release` give a working server, and
a lone clone builds and serves (80ec7d64, 81085f58).
- Tier 1: a plain cargo build carries the intake chain, configured in one RON shape
(sources, steps, rules, gates) (baa48b3a).
- Pull-through through the intake chain for OCI (cgr.dev), Python (PyPI, Chainguard
Libraries), npm, Maven, crates and APK (Alpine, Wolfi) (77477911, ce1d6a13).
- npm through the security gateway (1027710e), and `twine upload` into the intake chain
(513dcac5).
- The airgap: `holger-server export` takes the AVAILABLE set with its evidence and
signed attestations, and the secure side imports and verifies it (297c3efb);
`cargo xtask demo airgap` runs the demo (0c73355d).
- The sync protocol (signed sync manifests with generations), behind a default-off
feature (be9cb743).
- The on-premises downstream gateway: `cargo install holger --features downstream`
(7b1b68fe), and WireGuard downstreams.
- `holger-cli`, the thin gRPC client; every console call is a CLI command (5022717e).
- The estate board, the Security page, buyer pages, and the shared buy flow.
### Changed
- The licence is AGPL-3.0-only plus a commercial licence, owned jointly by Vetra
Automation AB and Ignalina ApS (d936a182). Versions published on or before 2026-10-02
keep the licence they were published with (mostly MIT).
- The root workspace is the open core; the estate parts are a separate `estate/`
workspace (c804ffc9).
- Airgap is the default: with no upstream named, Holger is offline (d72706dd).
- `HOLGER_QUARANTINE_PROPERTY` is retired and refuses the boot (`holger-intake-14`); the
hold is the intake QUARANTINED state (0cb5f11f).
- Everyone registers their passkey again after this release, because sessions move to
the shared identity core (d47e5b15).
### Known advisories
- RUSTSEC-2023-0071 (`rsa`, no fixed release) is ignored with its reason: Holger performs
no RSA decryption on attacker-supplied data.
- The packaged `Cargo.lock` holds crypto-bigint 0.5.5 (RUSTSEC-2026-0387), which is
triaged under Unreleased. It holds no quick-xml.
## Earlier versions
Before 2.0.0, the server was published on crates.io as `holger-server-cli`, beside
`holger-server-lib`, `holger-traits` and the other `holger-*` crates. These versions
are listed by their publication date on crates.io and by the git tags:
- 0.6.10 (2026-08-23): tags `holger-server-cli-v0.6.10` and the other per-crate
`-v0.6.10` tags (86cb764b).
- 0.6.9 (2026-07-17), 0.6.7 (2026-06-26), 0.6.6 (2026-06-19) and 0.6.5 (2026-06-18).
- The git tags `v0.7.1` (2026-06-15, 58fb6a55) and `v0.7.0` (2026-06-13, d674434c)
mark workspace releases; no `holger-server-cli` 0.7 was published.
- 0.6.4 (2026-05-29), 0.6.3 (2026-05-27), the tag `v0.6.2` (2026-05-27, a16277b1), and
0.5.1 (2026-05-25, tag `v0.5.1`, 18cb73f9).
The `holger` crate names 0.0.1 (2025-08-01) and 0.2.1 (2025-08-11) were published from
an earlier repository, whose history is not part of this one.
[2.0.0]: https://crates.io/crates/holger/2.0.0