Changelog

All notable changes to dotsecenv are documented here. Each version includes changes from the previous release.

Upcoming

Unreleased

Other

The changelog and cli-reference-drift maintainer skills now live in .agents/skills/, with .claude/skills a single directory symlink to it, so both Claude Code and Codex load one copy of each skill (#358)

v0.10.0

September 11, 2026

Bug Fixes

Two documentation links printed by the CLI returned 404: the https://dotsecenv.com/docs/concepts/behavior-settings comment written into every generated config, and the gpg-agent link in the vault doctor error path. Both now point at live pages (#356)

Other

Drop Windows from the release. .goreleaser.yaml no longer builds windows binaries, the disabled test-windows CI job is gone, and the installation, GitHub Action, policy, and reference pages say the platform is unsupported rather than in progress. Releases from this version on ship macOS and Linux archives only (#356)
Rewrite the README as an introduction rather than a manual: 1012 lines to 134, with installation flags, the command reference, the policy specification, the vault format, the FAQ, and the development setup deferred to dotsecenv.com and CONTRIBUTING.md. Windows is documented as unsupported and unplanned (#356)
Remove the FormatVersion alias from pkg/dotsecenv/vault. LatestFormatVersion is the single name for the version new vaults are written with. This drops an exported symbol, so a Go program importing that package directly may need a change (#354)
Point the README status badges at workflows that exist: the renamed e2e-action-post-release.yml and e2e-hermetic.yml, and ci-plugin.yml and deploy-website.yml in this repository rather than in the plugin and website repositories. The Contrib E2E badge is gone, because that workflow folded into CI (#355)
The release workflow tells a missing release apart from an API error. An expired token, a rate limit, or a network failure used to read as “no release for this tag” and let the run publish over an existing one; the pre-flight now uses github::assert_release_absent (#353)

v0.9.1

September 10, 2026

Other

Disable Renovate on the packages satellite. That repo is artifact-only, so a dependency PR merged there is overwritten by the next publish; the updates land here instead, where the monorepo’s Renovate already covers the satellite’s publish workflow (#323)
Let Codex discover the changelog and cli-reference-drift maintainer skills by directory-symlinking .agents/skills/* to their .claude/skills/ originals (#344)
Install the technical-docs plugin from its author’s danielrosehill marketplace, dropping the project-local marketplace that only existed to wrap the plugin’s bare repo (#346)
Update the website dependencies: astro, starlight-blog, sharp, canvaskit-wasm, astro-og-canvas, eslint, typescript-eslint. @astrojs/starlight stays on 0.41.x, because 0.42 renders markdown through satteri 0.10 and starlight-blog still pins satteri 0.9 (#350)
Update GitHub Actions: harden-runner, setup-uv, releasetools/actions, pnpm/action-setup, sbom-action, deploy-pages (#324, #326, #328, #339, #343, #347, #348)
Update the Go toolchain to 1.27.1, Bubble Tea to v2.0.9, and golang.org/x/sys and golang.org/x/term, and drop the deprecated url.verified from the Homebrew cask (#345)
Update pnpm to v12 and uv (#325, #327, #337, #349)

v0.9.0

August 17, 2026

Features

Add contrib/git-credential-dotsecenv, an experimental git credential helper that stores HTTPS credentials encrypted in your vault and preserves OAuth oauth_refresh_token/password_expiry_utc fields so it can back a generator like git-credential-oauth (no stored PAT); the deb/rpm/Arch packages and install.sh install it to a PATH directory, and jq is a package Recommends since store needs it. Point git at it with git config --global --replace-all credential.helper "" && git config --global --add credential.helper dotsecenv, which keeps the macOS keychain out of the chain. Needs git 2.41+ for the OAuth workflow (#255, #301, #304, #305)

Bug Fixes

install.sh no longer reports a Terraform or git credential helper it skipped: both are absent from release archives older than the one that added them, and the summary now names only what it wrote. Installing the git credential helper also warns when git predates 2.41, where the OAuth workflow’s oauth_refresh_token starts round-tripping (#302)
Update Lipgloss to v2.0.6 (#295)

Other

Document --[no-]install-git-credentials-helper and INSTALL_GIT_CREDENTIALS_HELPER in the installation tutorial (#302)
New Experimental website component carries one standard notice for features whose behavior can still change; the git credential helper guide is the first to use it (#304)
Update the Astro ecosystem for the website build (#288, #308)
Update lint and JS tooling: eslint, typescript-eslint, pnpm (#287, #291, #294)
Update GitHub Actions: checkout, setup-go, pnpm/action-setup, harden-runner, attest-build-provenance, setup-uv (#283, #290, #292, #293, #296, #299, #300)
Update the Go toolchain to 1.26.6 and uv (#284, #289, #298, #306)
Backfill the changelog for the dependency updates merged since v0.8.1 (#315)
Remove unreachable helpers from the internal CLI packages, along with a test that could never run (#311)
Remove the version-specific vault header marker constants and HeaderMarkerForVersion. None matched what a vault file actually contains; legacy markers are still recognised by prefix and v1 vaults still upgrade. This drops exported symbols from pkg/dotsecenv/vault, so a Go program importing that package directly may need a change (#312)
Remove the unused InstallTabs website component (#313)
Correct a release.yml comment that described the satellite publish jobs as best-effort when they gate on the release chain, and the Go version and mise files listed in AGENTS.md (#314)
Tidy stale checksums out of go.sum (#321)

v0.8.1

August 3, 2026

Features

Add first-class Codex plugin packaging alongside Claude Code, backed by one shared set of agent skills (#282)

Other

Update the Astro ecosystem dependencies (#279)
Update pnpm to v11.18.0 (#280)

v0.8.0

July 31, 2026

Features

secret store now warns when the secret being overwritten is shared, lists who keeps access, and asks for confirmation when a terminal is attached; new --share and --no-share flags skip the prompt and keep the recipient set or encrypt to your identity only (#277)
The Homebrew cask now installs the zsh/bash/fish shell plugins to $(brew --prefix)/share/dotsecenv/plugin/, matching the Linux packages (#253)

Bug Fixes

secret store on an existing secret now keeps the current recipient set: the new value is encrypted to everyone on the latest entry’s available_to, so rotating a shared secret no longer silently locks out CI and teammates (#277)
secret get now tells apart a secret that does not exist (“not found in any vault”) from one that exists but your identity cannot read (“access denied”, with the share command to request access) (#253)
The shell plugin prints a fetch error once per secret; other keys mapped to the same failed secret get a one-line notice instead of a repeated error (#253)
Update Starlight Blog to v0.28.x (#256)
Update Bubble Tea to v2.0.8 (#245)
Update golang.org/x/term to v0.45.0 (#252)

Other

Homebrew install docs now include the brew trust dotsecenv/tap step that Homebrew 6.0 requires for third-party taps (#253)
The Homebrew tap’s README is now maintained in the monorepo and synced to the tap on release (#253)
Pin pnpm to 11.11.0 in the website CI workflows; pnpm 11.12.0 breaks the setup action’s self-update (#254)
The repo now tracks its Claude Code plugin config in .claude/, so contributors get the claude-blog and technical-docs plugins without wiring them up by hand (#270)
Update Astro to v7.1.4 (#274)
Update ESLint to v10.8.0 (#276)
Update Starlight to v0.41.4 (#271)
Update pnpm to v11.17.0 (#272)
Group Astro ecosystem dependency updates into one Renovate PR (#273)
Update Fontsource packages to v5.3.0 (#269)
Update Astro to v7.1.3 (#259)
Update pnpm to v11.15.1 (#267)
Update typescript-eslint to v8.65.0 (#268)
Apply the Astro v7.1.0 security update (#265)
Update actions/checkout to v7.0.1 (#266)
Update ESLint to v10.7.0 (#257)
Update pnpm to v11.13.1 (#258)
Update typescript-eslint to v8.64.0 (#260)
Update actions/setup-node to v7 (#262)
Update markdownlint-cli to v0.49.1 (#263)
Update actions/setup-go to v7 (#264)
Update Starlight to v0.41.3 (#246)
Update typescript-eslint to v8.63.0 (#248)
Update step-security/harden-runner to v2.20.0 (#249)
Update Go to v1.26.5 (#250)
Update Astro to v7.0.7 (#251)

v0.7.2

July 4, 2026

Other

Maintenance release; no functional changes since v0.7.1

v0.7.1

July 4, 2026

Other

The homebrew tap’s post-release CI is now sourced from the monorepo and pushed to the tap on release, so all release automation lives in one place (#241)
Update starlight-llms-txt for the website build (#242)

v0.7.0

July 4, 2026

Features

vault compact drops superseded secret-value versions and removes deleted secrets, shrinking a vault without decrypting anything; a new vault skill drives it (#223)
dotsecenv doctor is now a top-level alias for vault doctor (#223)
init secenv bootstraps a .secenv file from your existing vaults (#183)

Bug Fixes

Shell plugins (fish, bash, zsh): stay silent in non-interactive shells, so fish -c and scripts no longer leak dotsecenv: diagnostics into captured command output (fixes Emacs/Magit “invalid object name” errors) (plugin#29, #237)
vault doctor -v N now targets the Nth configured vault instead of erroring for any index above 1 (#223)
Shell plugin: reload secrets on directory re-entry, fix the {dotsecenv/} literal regression, and fail fast when the store is unavailable (#190)
Shell plugin reports plain env vars and secrets on separate lines (#192)

Other

Add a CLI reference drift check, gated before release, so the website reference stays in sync with the binary (#211)
Release notes now build up continuously under “Upcoming”: a new changelog skill adds a one-line entry per PR and stamps the section at release time (#212)
The changelog and cli-reference-drift maintainer skills moved to .claude/skills/, so the published plugin now ships only the secenv and secrets skills to installers (#213)
Backfill the changelog for the v0.6.2 through v0.6.16 releases and the unreleased PRs since (#214)
Standardize CI keypair naming and document key scope (#208)
Document the squash-merge commit message and PR description conventions (#194, #195)
Scope the agent vendoring rule to atomic major upgrades in their own PR (#186, #188)
Add a blog post on signed monorepo releases with GitHub Workflows (#173, #174)
Fix the fish plugin test suite and run it in CI on fish 3.x and 4.x (#193)
Unify Expressive Code frame corners and border color on the website (#191)
Update Astro and Starlight for the website build, plus astro-og-canvas and asciinema-player (#175, #179, #200, #201, #202, #206, #207, #209, #217, #224, #226, #228, #230, #233, #236)
Update lint tooling: eslint, typescript-eslint, eslint-plugin-mdx, markdownlint-cli (#172, #176, #181, #182, #196, #198, #205, #216, #219, #220, #227, #232)
Update Go modules: x/crypto (security), x/term, and bubbletea/lipgloss v2 (#178, #187, #197, #204, #215, #235)
Update GitHub Actions and the Go toolchain: checkout, harden-runner, setup-go, goreleaser-action, pnpm/action-setup, attest-build-provenance, Go 1.26.4 (#177, #180, #199, #218, #221, #229, #231, #234)
Update the sharp image library (#210, #225)
Fix a duplicated semver key in the website pnpm lockfile that broke pnpm install (#238)
Renovate lock file maintenance (#171)

v0.6.16

May 18, 2026

Covers releases v0.6.2 through v0.6.16, most of which moved packaging into the monorepo and hardened the release pipeline.

Features

Distribution packages now live in the monorepo and publish on release (#136, #152)
Smoke-test brew install right after the homebrew-tap push (#135)

Bug Fixes

Fix website rendering and performance (#165)
Harden release verification: import key.asc before verifying historical assets, wait on homebrew-tap CI and the CDN, and fix the Linux arm64 checksum (#148, #168)

Other

Retract v0.6.10 and v0.6.11, and add retraction tooling (#151)
Sign release pushes via releasetools/actions/signed-push, commit the homebrew-tap cask over GraphQL, and tag the tap at the release version (#160, #161, #163)
SHA-pin every third-party action, set least-privilege GITHUB_TOKEN permissions, and drop unused scopes across workflows (#147, #167, #169)
Add a single required ci-merge-gate status check and verify drift in satellite repos (#153, #156, #159, #166)
Prune packages by keeping the last patch of the last N minors, and link get.dotsecenv.com on publish (#162, #170)
Restructure CI workflows, add a release pre-flight check, and ignore .claude/settings.local.json (#142, #146, #149, #150, #158)
Close docs gaps in the GPG agent, offboarding, and multi-env FIPS guidance (#157)
Update dependencies: astro, @astrojs/starlight, starlight-llms-txt, typescript-eslint, harden-runner, x/term (#138, #139, #140, #141, #143, #144, #145)

v0.6.1

May 7, 2026

Features

Reject backdated and far-future appends at write time. A new entry’s added_at must not predate the most recent existing entry, and must not be more than 5 minutes in the future. This blocks trivial backdating and prevents a single forward-dated write from DoS-ing every subsequent append until wall-clock catches up (#134)
login filters out sign-only keys when matching candidates, and adds a blank line before the login summary for cleaner output (#133)
secret get --all --json now exposes available_to and signed_by for each entry (#130)

Bug Fixes

make demo now produces a working asciinema recording, written to a path that survives sandbox cleanup (#124, #125)

Other

Breaking: gpg.program now defaults to resolving gpg via PATH, and the --no-gpg-program flag is removed. Set gpg.program explicitly to an absolute path if you need to pin a specific binary (#119)
Drop the deprecated fingerprint migration warning and dead output/compat.go (#132)
Add examples/ directory with self-contained scenarios, plus recipes/ for Context7 retrieval coverage (#117, #122, #123)
Claim Context7 library ownership via context7.json for documentation indexing (#121, #127, #128)
Add AGENTS.md for AI coding agents (#118)
Require PRs and tests for all changes to main (#131)
Fix broken cross-refs and link examples to site tutorials (#120)
Align example-05/ debugging table with real plugin messages (#129)

v0.6.0

May 4, 2026

Features

Trusted policy directory at /etc/dotsecenv/policy.d/ for system-wide admin rules. Fragments can pin allow-lists (approved_algorithms, approved_vault_paths) and scalars (behavior.*, gpg.program). Allow-lists intersect with user config; scalars override the user. Two new commands ship with it: dotsecenv policy list and dotsecenv policy validate, both with --json. Policy loads fail-closed, with a distinct exit code per error category. Full design at Security Policies. (#114, #115, #116)

Bug Fixes

Update github.com/protonmail/gopenpgp/v3 to v3.4.1 (#112)

Other

Breaking: SUID mode is gone. Installation no longer needs root to set up SUID bits. To enforce admin policy across users, use the new /etc/dotsecenv/policy.d/ instead. (#110)
Breaking: The deprecated Config.Fingerprint YAML field and DOTSECENV_FINGERPRINT environment variable are removed. Use dotsecenv login <FP> to populate the signed login: block. (#109)
Drop /var/lib/dotsecenv/vault from the default vault path list (#111)
Update step-security/harden-runner action to v2.19.1 (#107, #108, #113)

v0.5.2

April 14, 2026

Features

Claude Code plugin with two new skills: /dotsecenv:secrets for CLI operations and /dotsecenv:secenv for .secenv file interpretation (#98)

Bug Fixes

init vault -v INDEX now resolves numeric indices to config vault paths instead of creating a file named after the index (#100)
secret get no longer gates on AvailableTo metadata; GPG agent determines decryptability, allowing secrets encrypted by non-logged-in keys to be decrypted (#104)

Other

Update FIPS 140-3 cryptographic module from GOFIPS140=v1.0.0 to GOFIPS140=v1.26.0 (#105)
Update golang.org/x/sys to v0.43.0, golang.org/x/term to v0.42.0 (#101, #102)
Update step-security/harden-runner action to v2.17.0 (#99, #103)

v0.5.1

March 30, 2026

Features

Re-add identity add command for explicitly adding GPG identities to vaults by fingerprint, useful for onboarding new team members and pre-authorizing keys (#97)
Make dse reload clear the secret stack and re-fetch all secrets (plugin#26)

Bug Fixes

Other

Defined a global Renovate configuration for the dotsecenv GitHub org

v0.5.0

March 28, 2026

Features

Add dse up command to load ancestor .secenv files when jumping directly into a subdirectory (plugin#23)

Bug Fixes

Fix false non-interactive terminal warning when secrets are accessed via shell plugin command substitution (#90)
Fix zsh local declaration leaking secret values on re-entry (plugin#15)
Fix unnecessary vault calls when navigating back to parent directory (plugin#17)

Other

Add test coverage for secret forget --ignore-not-found, smart JSON marshaling, and secret get --json
Update Go to 1.26.1 and upgrade dependencies (go-crypto v1.4.1, gopenpgp v3.4.0, x/sys v0.42.0, x/term v0.41.0)
Update actions/create-github-app-token to v3 and step-security/harden-runner to v2.16.0

v0.4.8

March 6, 2026

Features

Add universal install script (install.sh) as the primary installation method, with full CLI flags and environment variable support, checksum/GPG verification, and automatic shell plugin and completions setup
Add contrib/terraform-credentials-dotsecenv wrapper script implementing Terraform’s credentials helper protocol (get/store/forget verbs)
Add --json flag to secret store for JSON validation
Add --json flag to secret get for structured JSON output with smart marshaling
Add --ignore-not-found flag to secret forget for idempotent deletes
Add explicit --fix flag to vault doctor for auto-fixing without interactive prompts

Other

Remove deprecated strict mode
Add community standards (CODE_OF_CONDUCT, CONTRIBUTING, SECURITY)

v0.4.6

February 1, 2026

Features

Warn when decrypting secrets in non-interactive terminals
Rename subcommand: secret put to secret store

Other

Update actions/download-artifact to v7
GitHub workflow and documentation updates

v0.4.5

January 30, 2026

Other

Prove ‘no call home’ with hermetic E2E testing

v0.4.4

January 25, 2026

Bug Fixes

Remove extra newline from secret get output
Allow Claude Code reviews for bots

Other

Remove extraneous data structures, print helpful errors, reduce complexity

v0.4.3

January 12, 2026

Features

Add list mode to secret get command

Bug Fixes

Consolidate hash computation to prevent signing/validation mismatch (breaking change)
Allow secret put to accept piped input

v0.4.2

January 12, 2026

Bug Fixes

Update homebrew-tap with post-notarization checksums

v0.4.1

January 12, 2026

Bug Fixes

Remove quarantine hook for notarized Homebrew binaries

v0.4.0

January 12, 2026

Features

Add macOS notarization for Darwin builds
Add identity create command and signed login proof
Simplify vault subcommands and add doctor health checks
Refactor strict mode option and simplify commands, warnings, and errors
Support multiple vault versions
Add identity add -v with clearer output and strict error behavior

Bug Fixes

Include .sig files in checksums regeneration
Attest Darwin archives after notarization
Detect GPG program before login handling
Add checkout step for verifying notarization
Consistent errors on identity add with missing/unreadable vaults
identity add should always prompt on multiple options
Uniform error messages in strict mode
Secrets are typed without echoing to terminal

Other

Add Claude Code Security Review workflow
Add Claude Code GitHub workflow
Sandbox helper for GPG e2e testing
Update dependencies (golang.org/x/term, golang.org/x/sys, actions/checkout)

v0.3.3

January 4, 2026

Bug Fixes

Release automation fixes

v0.3.2

January 4, 2026

Features

Add init config flags
Add GitHub Action support for init config with flags

Other

Update tagline
Suggest correct namespace separator if invalid one provided
Allow releases to trigger website redeploys

v0.3.1

January 3, 2026

Features

Secret keys now support dots (.)

Other

E2E test runs no longer pollute user’s home directory
Only offer vaults that exist for prompt selection
Trigger website update on release

v0.3.0

January 2, 2026

Features

FIPS 140-3 compliance via crypto/fips140
Additional secret subcommands: store, forget
Configurable GPG program path

Other

Update dependencies (peter-evans/repository-dispatch, mlugg/setup-zig, actions/attest-build-provenance, actions/setup-go)
Add renovate.json for automated dependency updates

v0.2.1

December 31, 2025

Features

Configurable GPG program
Fail if GPG not found on init

Bug Fixes

Fix gpg_program logic

Other

Improve command error handling
Command suggestions for identity/vault check and login
Pre-commit hooks and CI improvements
Started working on Windows arm64/amd64 support

v0.2.0

December 27, 2025

Features

Use FIPS 140-3 validated boringcrypto for Linux builds
Default to FIPS 186-5 compliant algorithms and AES-256-GCM/AEAD encryption (RFC 9580)

Bug Fixes

Fix arm/amd compilation with CGO
Migrate away from deprecated mise ubi backend

v0.1.0

December 25, 2025

Features

Define namespace::secret naming convention

Other

Expanded FAQ and shell plugin references
Improved identity error messages

v0.0.11

January 12, 2026

Bug Fixes

Attest Darwin archives after notarization
Detect GPG program before login handling

v0.0.10

January 12, 2026

Bug Fixes

Add checkout step for verifying notarization

v0.0.9

January 12, 2026

Features

Add macOS notarization for Darwin builds
Add identity create command and signed login proof
Simplify vault subcommands and add doctor health checks
Refactor strict mode option and simplify commands
Support multiple vault versions
Additional secret subcommands: store, forget
Init config flags
Secret keys support dots
FIPS 140-3 via crypto/fips140
Configurable GPG program path
FIPS 186-5 compliant algorithms and AES-256-GCM/AEAD encryption

Bug Fixes

Consistent errors on identity add with missing/unreadable vaults
Identity add prompts on multiple options
Uniform error messages in strict mode
Secrets typed without echoing to terminal
Release automation fixes
Arm/amd compilation with CGO

Other

Claude Code Security Review and GitHub workflows
Sandbox helper for GPG e2e testing
Dependency updates
Pre-commit hooks and test improvements

v0.0.8

December 22, 2025

Other

Remove initial macOS call from tests

v0.0.7

December 22, 2025

Bug Fixes

Fix macOS quarantine prompt

Other

Cache artifacts in tests

v0.0.6

December 22, 2025

Bug Fixes

Homebrew man pages are correctly included

v0.0.5

December 22, 2025

Bug Fixes

Fix GitHub Action GPG signature verification

v0.0.4

December 22, 2025

Features

Generate SBOMs and trigger e2e tests after release

v0.0.3

December 22, 2025

Features

Trigger e2e tests after release

Bug Fixes

Fix SBOM generation
Fix GitHub Action build-from-source

v0.0.2

December 21, 2025

Features

Add GitHub Action

Other

Fix release tag format

v0.0.1

December 20, 2025

Initial release.

Features

Core secret management CLI
GPG-based encryption at rest
Vault format for organizing secrets
Identity management commands
Shell integration support