chore(deps): update dependency fnox to v1.26.0 #3

Merged

rosa merged 1 commit from renovate/fnox-1.x into main

2026-06-22 18:58:30 +00:00

rosa commented

2026-06-21 00:03:13 +00:00

Owner

This PR contains the following updates:

Package	Update	Change	Pending
fnox	minor	`1.25.1` → `1.26.0`	`v1.27.1` (+1)

Release Notes

jdx/fnox (fnox)

`v1.26.0`: : Provider-Backed Age Identities & Vault Credential Commands

Compare Source

A feature release centered on more flexible authentication: the age provider can now bootstrap its identity from another provider (for example, the OS keychain), and the Vault provider and lease backend can obtain tokens from a user-defined shell command. Also includes a real put_secret_value for GCP Secret Manager and two fixes that make fnox export and hook-env better citizens in shell pipelines.

Added

Provider-backed age identities (#515) -- @k35o

The age provider now accepts an identity reference that resolves through any other configured provider. This makes the keychain-bootstrap pattern from v1.25.1 actually work end-to-end:

[providers]
keychain = { type = "keychain", service = "fnox" }
age      = { type = "age", recipients = ["age1..."], identity = { provider = "keychain", value = "age-key" } }

Implementation details worth knowing:

Identities are resolved lazily during decryption, so fnox set and other encryption-only paths don't require access to the backing identity provider.
Resolution order is FNOX_AGE_KEY -> identity provider ref -> key_file -> deprecated CLI setting -> default ~/.config/fnox/age.txt.
Cycle detection catches both direct self-references (age -> age) and mutual cycles between two age providers, producing a clear Circular dependency detected in provider configuration: age-a -> age-b -> age-a error.
Nested age identities are supported: a bootstrap age provider can decrypt the identity used by a second age provider.
Identity providers that require interactive auth are rejected in non-interactive mode with a hint to use fnox exec.

credential_command for Vault provider and lease backend (#526) -- @jdx

Vault and OpenBao users can now resolve tokens through a configured shell command when no static token is provided, removing the need to share or pre-stage a VAULT_TOKEN:

[providers.vault_team_a]
type    = "vault"
address = "$VAULT_ADDR"
namespace = "team-a"
path = "secret/team-a"
credential_command = "vault login -method=oidc -token-only"

The same field is available on the Vault lease backend:

[leases.vault-db]
type = "vault"
address = "$VAULT_ADDR"
credential_command = "vault login -method=oidc -token-only"
secret_path = "database/creds/readonly"
method = "post"

Commands run through the platform shell (sh -c / cmd /C), so pipes and redirects work.
The string is rendered as a Tera template with address, path/secret_path, and namespace available as variables, and fnox injects VAULT_ADDR and VAULT_NAMESPACE into the environment.
Output is cached for ~5 minutes per process so resolving many secrets from the same provider doesn't repeat the login.
401/403 responses from Vault invalidate the cache so a stale token is refetched on the next call.
Static config/env tokens still take precedence; credential_command is only consulted when no token is configured.
FNOX_VAULT_NAMESPACE is now recognized alongside VAULT_NAMESPACE.

put_secret_value for GCP Secret Manager (#530) -- @nils-degroot

The GCP Secret Manager provider's write path was previously a stub that returned put_secret not yet implemented. fnox set --provider gcp now actually writes: it adds a new secret version, and on 404 NOT_FOUND it creates the secret with automatic replication and retries the write. PERMISSION_DENIED responses surface as ProviderAuthFailed with the relevant IAM permission name (secretmanager.versions.add / secretmanager.secrets.create).

Fixed

FIDO2 keep-alive messages no longer corrupt fnox export (#506, resolves #465) -- @baprx

ctap-hid-fido2's "touch your key" prompts were being written to stdout, which broke eval "$(fnox export)" and similar shell-sourcing workflows. fnox now configures the FIDO2 client with with_keep_alive_msg_to_stderr(true) for both secret retrieval and setup, so stdout stays clean for the exported assignments.

hook-env respects $COLUMNS when stderr is not a TTY (#523) -- @davidolrik

Shell hooks capture stderr, so console::Term::size() could return a useless width when rendering the env-change summary. fnox now uses the TTY width when available, then $COLUMNS, and falls back to 80 columns — restoring the previous default and producing readable truncation in shell hooks.

Documentation

AWS Secrets Manager IAM requirements (#513) -- @gaffneyc: The docs now make clear that BatchGetSecretValue (introduced for batched lookups) must be granted alongside ListSecrets with a wildcard resource — neither action accepts a resource ARN scope.

New Contributors

@nils-degroot made their first contribution in #530
@k35o made their first contribution in #515
@gaffneyc made their first contribution in #513
@baprx made their first contribution in #506

Full Changelog: https://github.com/jdx/fnox/compare/v1.25.1...v1.26.0

fnox is maintained by @jdx under en.dev — a small independent studio building developer tooling like mise, aube, hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors.

If fnox is handling secrets or config for you or your team, please consider sponsoring at en.dev. Sponsorships are what let fnox stay independent and the project keep moving.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Update | Change | Pending | |---|---|---|---| | [fnox](https://github.com/jdx/fnox) | minor | `1.25.1` → `1.26.0` | `v1.27.1` (+1) | --- ### Release Notes <details> <summary>jdx/fnox (fnox)</summary> ### [`v1.26.0`](https://github.com/jdx/fnox/releases/tag/v1.26.0): : Provider-Backed Age Identities & Vault Credential Commands [Compare Source](https://github.com/jdx/fnox/compare/v1.25.1...v1.26.0) A feature release centered on more flexible authentication: the `age` provider can now bootstrap its identity from another provider (for example, the OS keychain), and the Vault provider and lease backend can obtain tokens from a user-defined shell command. Also includes a real `put_secret_value` for GCP Secret Manager and two fixes that make `fnox export` and `hook-env` better citizens in shell pipelines. #### Added **Provider-backed age identities** ([#515](https://github.com/jdx/fnox/pull/515)) -- [@k35o](https://github.com/k35o) The `age` provider now accepts an `identity` reference that resolves through any other configured provider. This makes the keychain-bootstrap pattern from v1.25.1 actually work end-to-end: ```toml [providers] keychain = { type = "keychain", service = "fnox" } age = { type = "age", recipients = ["age1..."], identity = { provider = "keychain", value = "age-key" } } ``` Implementation details worth knowing: - Identities are resolved **lazily during decryption**, so `fnox set` and other encryption-only paths don't require access to the backing identity provider. - Resolution order is `FNOX_AGE_KEY` -> `identity` provider ref -> `key_file` -> deprecated CLI setting -> default `~/.config/fnox/age.txt`. - Cycle detection catches both direct self-references (`age` -> `age`) and mutual cycles between two age providers, producing a clear `Circular dependency detected in provider configuration: age-a -> age-b -> age-a` error. - Nested age identities are supported: a bootstrap age provider can decrypt the identity used by a second age provider. - Identity providers that require interactive auth are rejected in non-interactive mode with a hint to use `fnox exec`. **`credential_command` for Vault provider and lease backend** ([#526](https://github.com/jdx/fnox/pull/526)) -- [@jdx](https://github.com/jdx) Vault and OpenBao users can now resolve tokens through a configured shell command when no static token is provided, removing the need to share or pre-stage a `VAULT_TOKEN`: ```toml [providers.vault_team_a] type = "vault" address = "$VAULT_ADDR" namespace = "team-a" path = "secret/team-a" credential_command = "vault login -method=oidc -token-only" ``` The same field is available on the Vault lease backend: ```toml [leases.vault-db] type = "vault" address = "$VAULT_ADDR" credential_command = "vault login -method=oidc -token-only" secret_path = "database/creds/readonly" method = "post" ``` - Commands run through the platform shell (`sh -c` / `cmd /C`), so pipes and redirects work. - The string is rendered as a Tera template with `address`, `path`/`secret_path`, and `namespace` available as variables, and fnox injects `VAULT_ADDR` and `VAULT_NAMESPACE` into the environment. - Output is cached for \~5 minutes per process so resolving many secrets from the same provider doesn't repeat the login. - 401/403 responses from Vault invalidate the cache so a stale token is refetched on the next call. - Static config/env tokens still take precedence; `credential_command` is only consulted when no token is configured. - `FNOX_VAULT_NAMESPACE` is now recognized alongside `VAULT_NAMESPACE`. **`put_secret_value` for GCP Secret Manager** ([#530](https://github.com/jdx/fnox/pull/530)) -- [@nils-degroot](https://github.com/nils-degroot) The GCP Secret Manager provider's write path was previously a stub that returned `put_secret not yet implemented`. `fnox set --provider gcp` now actually writes: it adds a new secret version, and on `404 NOT_FOUND` it creates the secret with automatic replication and retries the write. `PERMISSION_DENIED` responses surface as `ProviderAuthFailed` with the relevant IAM permission name (`secretmanager.versions.add` / `secretmanager.secrets.create`). #### Fixed **FIDO2 keep-alive messages no longer corrupt `fnox export`** ([#506](https://github.com/jdx/fnox/pull/506), resolves [#465](https://github.com/jdx/fnox/issues/465)) -- [@baprx](https://github.com/baprx) `ctap-hid-fido2`'s "touch your key" prompts were being written to stdout, which broke `eval "$(fnox export)"` and similar shell-sourcing workflows. fnox now configures the FIDO2 client with `with_keep_alive_msg_to_stderr(true)` for both secret retrieval and setup, so stdout stays clean for the exported assignments. **`hook-env` respects `$COLUMNS` when stderr is not a TTY** ([#523](https://github.com/jdx/fnox/pull/523)) -- [@davidolrik](https://github.com/davidolrik) Shell hooks capture stderr, so `console::Term::size()` could return a useless width when rendering the env-change summary. fnox now uses the TTY width when available, then `$COLUMNS`, and falls back to 80 columns — restoring the previous default and producing readable truncation in shell hooks. #### Documentation - **AWS Secrets Manager IAM requirements** ([#513](https://github.com/jdx/fnox/pull/513)) -- [@gaffneyc](https://github.com/gaffneyc): The docs now make clear that `BatchGetSecretValue` (introduced for batched lookups) must be granted alongside `ListSecrets` with a wildcard resource — neither action accepts a resource ARN scope. #### New Contributors - [@nils-degroot](https://github.com/nils-degroot) made their first contribution in [#530](https://github.com/jdx/fnox/pull/530) - [@k35o](https://github.com/k35o) made their first contribution in [#515](https://github.com/jdx/fnox/pull/515) - [@gaffneyc](https://github.com/gaffneyc) made their first contribution in [#513](https://github.com/jdx/fnox/pull/513) - [@baprx](https://github.com/baprx) made their first contribution in [#506](https://github.com/jdx/fnox/pull/506) **Full Changelog**: <https://github.com/jdx/fnox/compare/v1.25.1...v1.26.0> #### 💚 Sponsor fnox fnox is maintained by [@jdx](https://github.com/jdx) under [**en.dev**](https://en.dev) — a small independent studio building developer tooling like [mise](https://mise.jdx.dev/), [aube](https://aube.en.dev/), hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors. If fnox is handling secrets or config for you or your team, please consider [sponsoring at en.dev](https://en.dev). Sponsorships are what let fnox stay independent and the project keep moving. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

rosa added 1 commit

2026-06-21 00:03:13 +00:00