rosa/gtt
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

chore(deps): update dependency fnox to v1.28.0 #4

Merged
rosa merged 1 commit from renovate/fnox-1.x into main 2026-07-02 00:03:28 +00:00
Conversation 0 Commits 1 Files changed 1 +1 -1
rosa commented 2026-06-26 08:03:08 +00:00
Owner
Copy link

This PR contains the following updates:

Package Update Change Pending
fnox minor 1.26.0 → 1.28.0 v1.29.0

Release Notes

jdx/fnox (fnox)

v1.28.0: : Non-interactive exec

Compare Source

A small feature release that adds a global --non-interactive mode for fnox exec and other resolve paths, so CI and scripted runs can rely on cached credentials and fail fast instead of hanging on auth prompts or device flows.

Added

Global --non-interactive / FNOX_NON_INTERACTIVE (#​565) -- @​jdx

A new top-level flag (and matching env var) disables prompts and browser-based auth flows for the entire invocation. It is propagated through the daemon protocol, so daemon-backed resolution behaves the same way as direct resolution -- including when fnox auto-starts daemon serve to handle the request.

fnox --non-interactive exec -- ./run-tests.sh

# or
FNOX_NON_INTERACTIVE=1 fnox exec -- ./run-tests.sh

In non-interactive mode:

  • should_prompt_auth no longer prompts, regardless of TTY or prompt_auth config.
  • The github-oauth lease backend still happily reuses cached and refreshable tokens, but fails immediately with a clear interactive auth required for GitHub OAuth device authorization error instead of printing a user code and polling. The error hint points you at running fnox lease create <lease-name> from an interactive terminal first.

This is intended for CI jobs, cron tasks, and other scripted runs where a hung prompt is worse than a fast failure.

Fixed

  • CI now installs Vault as the qualified hashicorp/tap/vault formula on macOS so Homebrew treats it as an explicitly chosen tap formula under current tap-trust rules (#​567) -- @​jdx

Full Changelog: https://github.com/jdx/fnox/compare/v1.27.1...v1.28.0

💚 Sponsor fnox

fnox is maintained by @​jdx under en.dev — a small independent studio building developer tooling like mise, aube, hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors.

If fnox is handling secrets or config for you or your team, please consider sponsoring at en.dev. Sponsorships are what let fnox stay independent and the project keep moving.

v1.27.1: : dotenv exports and a Windows build fix

Compare Source

A small patch release that makes fnox export actually produce dotenv files, adds a separate shell format for sourceable output, and unbreaks the Windows build introduced by the v1.27.0 daemon.

Fixed

fnox export --format env now emits real dotenv (#​554) -- @​jdx

The env format was documented as .env/KEY=value but was actually emitting shell export KEY='value' lines, which broke consumers that expect bare assignments. It now produces proper dotenv output:

$ fnox export --format env
NORMAL_SECRET=normal-value
SPECIAL_SECRET="secret$value`tick`"
QUOTED_SECRET="quoted \"value\" with \\ backslash"

Simple values are left unquoted; values containing whitespace or special characters are double-quoted with \n, \r, \t, ", and \ escaped. $ and backticks are deliberately left literal so the file round-trips through dotenv parsers.

fnox import was updated to match: double-quoted .env values now have \n, \t, \", and \\ unescaped on the way in, so an export/import round-trip preserves multi-line and quoted secrets.

Windows builds fixed (#​555) -- @​jdx

The v1.27.0 daemon imported std::os::fd::AsRawFd and tokio::net::Unix{Listener,Stream} at module scope, which broke cargo check on Windows even though the daemon runtime is Unix-only. Those imports and the connection handler are now gated behind #[cfg(unix)], and a cargo check job on windows-latest was added to CI so this can't regress silently.

Added

fnox export --format shell (#​554) -- @​jdx

A new shell format emits sourceable POSIX export KEY=value statements with proper shell quoting -- this is the behavior the old env format had, now under its correct name:

fnox export --format shell > secrets.sh
source secrets.sh

Documentation

  • Added Doppler to the cloud secret manager list in the README (#​552) -- @​bowenc

Breaking Changes

fnox export --format env output changed from export KEY='value' to KEY=value. If you were sourcing that output in a shell, switch to fnox export --format shell to get the old behavior.

New Contributors

Full Changelog: https://github.com/jdx/fnox/compare/v1.27.0...v1.27.1

💚 Sponsor fnox

fnox is maintained by @​jdx under en.dev — a small independent studio building developer tooling like mise, aube, hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors.

If fnox is handling secrets or config for you or your team, please consider sponsoring at en.dev. Sponsorships are what let fnox stay independent and the project keep moving.

v1.27.0: : Daemon, Secret Scanning, and Config Defaults

Compare Source

This release adds three pieces aimed at making fnox faster, safer, and easier to compose: an opt-in per-user daemon for cached secret resolution, a new fnox scan command for finding plaintext secrets before they leak, and ${VAR} interpolation for secret defaults. It also includes a small documentation pass and CI housekeeping.

Added

Per-user secret resolver daemon (#​550) -- @​jdx

fnox now has an opt-in daemon that keeps resolved secrets in memory for your user session and serves repeated read-oriented resolutions over a same-user Unix socket. It is intended for configs backed by remote providers such as 1Password, Bitwarden, AWS Secrets Manager, or Vault where repeated fnox get, fnox exec, shell hooks, TUI refreshes, or MCP calls can otherwise feel slow.

Enable it with a top-level config block:

[daemon]
enabled = true
idle_timeout = "8h"

New lifecycle commands are available under fnox daemon:

fnox daemon start
fnox daemon status
fnox daemon clear
fnox daemon stop

Implementation details worth knowing:

  • Daemon-backed resolution is used by read-oriented commands such as get, exec, export, hook-env, list --values, check, tui, mcp, and ci-redact.
  • Mutation and admin flows still resolve directly, including set, remove, sync, reencrypt, edit, provider, and lease create.
  • The cache is memory-only and is invalidated when relevant config files, profile settings, provider references, post-processing options, or provider environment variables change.
  • fnox check can connect through the daemon, but still bypasses cached values so it validates current provider state.
  • Use --no-daemon, FNOX_DAEMON=off, or daemon_cache = false on a provider or secret when you need direct resolution.
  • The daemon is Unix-first: it uses a Unix domain socket, strict runtime-directory permissions, and same-user peer verification rather than TCP.

fnox scan secret detection (#​548) -- @​jdx

fnox scan [DIR] is now implemented as a read-only repository scanner for common plaintext secrets. It walks the target tree with gitignore-aware traversal, skips common VCS/build/vendor directories and large or binary files, and reports high-signal patterns with redacted evidence.

Supported output modes include human-readable output, JSON, and quiet file-list output:

fnox scan
fnox scan --format json
fnox scan --quiet src
fnox scan --ignore 'fixtures/**'

The scanner reports line and column, detector name, severity, and a redacted snippet. Findings return a scan-specific non-zero error so the command can be used in automation.

Secret default interpolation (#​549) -- @​jdx

Secret default strings can now reference other secrets with ${SECRET_NAME} syntax. This makes fallback-only configs easier to compose without duplicating literals, for example when building a local connection URL from sibling defaults.

Provider-backed values still win over defaults, and interpolation only runs when the default value is actually used. Batch resolution now includes default references in dependency ordering, so composed defaults are resolved order-independently. fnox also reports config errors for undefined references, empty ${} placeholders, and interpolation cycles.

Documentation

  • Sponsor links (#​543) -- @​jdx: Documentation now links to the full sponsor list.
  • Contribution guidance (#​545) -- @​jdx: The contribution docs now clarify what kinds of changes are a good fit for the project.

Other Changes

  • Shared CodeRabbit config (#​546) -- @​jdx: CI now uses the shared repository review configuration.

Full Changelog: https://github.com/jdx/fnox/compare/v1.26.0...v1.27.0

💚 Sponsor fnox

fnox is maintained by @​jdx under en.dev — a small independent studio building developer tooling like mise, aube, hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors.

If fnox is handling secrets or config for you or your team, please consider sponsoring at en.dev. Sponsorships are what let fnox stay independent and the project keep moving.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Update | Change | Pending | |---|---|---|---| | [fnox](https://github.com/jdx/fnox) | minor | `1.26.0` → `1.28.0` | `v1.29.0` | --- ### Release Notes <details> <summary>jdx/fnox (fnox)</summary> ### [`v1.28.0`](https://github.com/jdx/fnox/releases/tag/v1.28.0): : Non-interactive exec [Compare Source](https://github.com/jdx/fnox/compare/v1.27.1...v1.28.0) A small feature release that adds a global `--non-interactive` mode for `fnox exec` and other resolve paths, so CI and scripted runs can rely on cached credentials and fail fast instead of hanging on auth prompts or device flows. #### Added **Global `--non-interactive` / `FNOX_NON_INTERACTIVE`** ([#&#8203;565](https://github.com/jdx/fnox/pull/565)) -- [@&#8203;jdx](https://github.com/jdx) A new top-level flag (and matching env var) disables prompts and browser-based auth flows for the entire invocation. It is propagated through the daemon protocol, so daemon-backed resolution behaves the same way as direct resolution -- including when fnox auto-starts `daemon serve` to handle the request. ```bash fnox --non-interactive exec -- ./run-tests.sh # or FNOX_NON_INTERACTIVE=1 fnox exec -- ./run-tests.sh ``` In non-interactive mode: - `should_prompt_auth` no longer prompts, regardless of TTY or `prompt_auth` config. - The `github-oauth` lease backend still happily reuses cached and refreshable tokens, but fails immediately with a clear `interactive auth required for GitHub OAuth device authorization` error instead of printing a user code and polling. The error hint points you at running `fnox lease create <lease-name>` from an interactive terminal first. This is intended for CI jobs, cron tasks, and other scripted runs where a hung prompt is worse than a fast failure. #### Fixed - CI now installs Vault as the qualified `hashicorp/tap/vault` formula on macOS so Homebrew treats it as an explicitly chosen tap formula under current tap-trust rules ([#&#8203;567](https://github.com/jdx/fnox/pull/567)) -- [@&#8203;jdx](https://github.com/jdx) **Full Changelog**: <https://github.com/jdx/fnox/compare/v1.27.1...v1.28.0> #### 💚 Sponsor fnox fnox is maintained by [@&#8203;jdx](https://github.com/jdx) under [**en.dev**](https://en.dev) — a small independent studio building developer tooling like [mise](https://mise.jdx.dev/), [aube](https://aube.en.dev/), hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors. If fnox is handling secrets or config for you or your team, please consider [sponsoring at en.dev](https://en.dev). Sponsorships are what let fnox stay independent and the project keep moving. ### [`v1.27.1`](https://github.com/jdx/fnox/releases/tag/v1.27.1): : dotenv exports and a Windows build fix [Compare Source](https://github.com/jdx/fnox/compare/v1.27.0...v1.27.1) A small patch release that makes `fnox export` actually produce dotenv files, adds a separate `shell` format for sourceable output, and unbreaks the Windows build introduced by the v1.27.0 daemon. #### Fixed **`fnox export --format env` now emits real dotenv** ([#&#8203;554](https://github.com/jdx/fnox/pull/554)) -- [@&#8203;jdx](https://github.com/jdx) The `env` format was documented as `.env`/`KEY=value` but was actually emitting shell `export KEY='value'` lines, which broke consumers that expect bare assignments. It now produces proper dotenv output: ```bash $ fnox export --format env NORMAL_SECRET=normal-value SPECIAL_SECRET="secret$value`tick`" QUOTED_SECRET="quoted \"value\" with \\ backslash" ``` Simple values are left unquoted; values containing whitespace or special characters are double-quoted with `\n`, `\r`, `\t`, `"`, and `\` escaped. `$` and backticks are deliberately left literal so the file round-trips through dotenv parsers. `fnox import` was updated to match: double-quoted `.env` values now have `\n`, `\t`, `\"`, and `\\` unescaped on the way in, so an export/import round-trip preserves multi-line and quoted secrets. **Windows builds fixed** ([#&#8203;555](https://github.com/jdx/fnox/pull/555)) -- [@&#8203;jdx](https://github.com/jdx) The v1.27.0 daemon imported `std::os::fd::AsRawFd` and `tokio::net::Unix{Listener,Stream}` at module scope, which broke `cargo check` on Windows even though the daemon runtime is Unix-only. Those imports and the connection handler are now gated behind `#[cfg(unix)]`, and a `cargo check` job on `windows-latest` was added to CI so this can't regress silently. #### Added **`fnox export --format shell`** ([#&#8203;554](https://github.com/jdx/fnox/pull/554)) -- [@&#8203;jdx](https://github.com/jdx) A new `shell` format emits sourceable POSIX `export KEY=value` statements with proper shell quoting -- this is the behavior the old `env` format had, now under its correct name: ```bash fnox export --format shell > secrets.sh source secrets.sh ``` #### Documentation - Added Doppler to the cloud secret manager list in the README ([#&#8203;552](https://github.com/jdx/fnox/pull/552)) -- [@&#8203;bowenc](https://github.com/bowenc) #### Breaking Changes `fnox export --format env` output changed from `export KEY='value'` to `KEY=value`. If you were sourcing that output in a shell, switch to `fnox export --format shell` to get the old behavior. #### New Contributors - [@&#8203;bowenc](https://github.com/bowenc) made their first contribution in [#&#8203;552](https://github.com/jdx/fnox/pull/552) **Full Changelog**: <https://github.com/jdx/fnox/compare/v1.27.0...v1.27.1> #### 💚 Sponsor fnox fnox is maintained by [@&#8203;jdx](https://github.com/jdx) under [**en.dev**](https://en.dev) — a small independent studio building developer tooling like [mise](https://mise.jdx.dev/), [aube](https://aube.en.dev/), hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors. If fnox is handling secrets or config for you or your team, please consider [sponsoring at en.dev](https://en.dev). Sponsorships are what let fnox stay independent and the project keep moving. ### [`v1.27.0`](https://github.com/jdx/fnox/releases/tag/v1.27.0): : Daemon, Secret Scanning, and Config Defaults [Compare Source](https://github.com/jdx/fnox/compare/v1.26.0...v1.27.0) This release adds three pieces aimed at making fnox faster, safer, and easier to compose: an opt-in per-user daemon for cached secret resolution, a new `fnox scan` command for finding plaintext secrets before they leak, and `${VAR}` interpolation for secret defaults. It also includes a small documentation pass and CI housekeeping. #### Added **Per-user secret resolver daemon** ([#&#8203;550](https://github.com/jdx/fnox/pull/550)) -- [@&#8203;jdx](https://github.com/jdx) fnox now has an opt-in daemon that keeps resolved secrets in memory for your user session and serves repeated read-oriented resolutions over a same-user Unix socket. It is intended for configs backed by remote providers such as 1Password, Bitwarden, AWS Secrets Manager, or Vault where repeated `fnox get`, `fnox exec`, shell hooks, TUI refreshes, or MCP calls can otherwise feel slow. Enable it with a top-level config block: ```toml [daemon] enabled = true idle_timeout = "8h" ``` New lifecycle commands are available under `fnox daemon`: ```bash fnox daemon start fnox daemon status fnox daemon clear fnox daemon stop ``` Implementation details worth knowing: - Daemon-backed resolution is used by read-oriented commands such as `get`, `exec`, `export`, `hook-env`, `list --values`, `check`, `tui`, `mcp`, and `ci-redact`. - Mutation and admin flows still resolve directly, including `set`, `remove`, `sync`, `reencrypt`, `edit`, `provider`, and `lease create`. - The cache is memory-only and is invalidated when relevant config files, profile settings, provider references, post-processing options, or provider environment variables change. - `fnox check` can connect through the daemon, but still bypasses cached values so it validates current provider state. - Use `--no-daemon`, `FNOX_DAEMON=off`, or `daemon_cache = false` on a provider or secret when you need direct resolution. - The daemon is Unix-first: it uses a Unix domain socket, strict runtime-directory permissions, and same-user peer verification rather than TCP. **`fnox scan` secret detection** ([#&#8203;548](https://github.com/jdx/fnox/pull/548)) -- [@&#8203;jdx](https://github.com/jdx) `fnox scan [DIR]` is now implemented as a read-only repository scanner for common plaintext secrets. It walks the target tree with gitignore-aware traversal, skips common VCS/build/vendor directories and large or binary files, and reports high-signal patterns with redacted evidence. Supported output modes include human-readable output, JSON, and quiet file-list output: ```bash fnox scan fnox scan --format json fnox scan --quiet src fnox scan --ignore 'fixtures/**' ``` The scanner reports line and column, detector name, severity, and a redacted snippet. Findings return a scan-specific non-zero error so the command can be used in automation. **Secret default interpolation** ([#&#8203;549](https://github.com/jdx/fnox/pull/549)) -- [@&#8203;jdx](https://github.com/jdx) Secret `default` strings can now reference other secrets with `${SECRET_NAME}` syntax. This makes fallback-only configs easier to compose without duplicating literals, for example when building a local connection URL from sibling defaults. Provider-backed values still win over defaults, and interpolation only runs when the default value is actually used. Batch resolution now includes default references in dependency ordering, so composed defaults are resolved order-independently. fnox also reports config errors for undefined references, empty `${}` placeholders, and interpolation cycles. #### Documentation - **Sponsor links** ([#&#8203;543](https://github.com/jdx/fnox/pull/543)) -- [@&#8203;jdx](https://github.com/jdx): Documentation now links to the full sponsor list. - **Contribution guidance** ([#&#8203;545](https://github.com/jdx/fnox/pull/545)) -- [@&#8203;jdx](https://github.com/jdx): The contribution docs now clarify what kinds of changes are a good fit for the project. #### Other Changes - **Shared CodeRabbit config** ([#&#8203;546](https://github.com/jdx/fnox/pull/546)) -- [@&#8203;jdx](https://github.com/jdx): CI now uses the shared repository review configuration. **Full Changelog**: <https://github.com/jdx/fnox/compare/v1.26.0...v1.27.0> #### 💚 Sponsor fnox fnox is maintained by [@&#8203;jdx](https://github.com/jdx) under [**en.dev**](https://en.dev) — a small independent studio building developer tooling like [mise](https://mise.jdx.dev/), [aube](https://aube.en.dev/), hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors. If fnox is handling secrets or config for you or your team, please consider [sponsoring at en.dev](https://en.dev). Sponsorships are what let fnox stay independent and the project keep moving. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNDMuMiIsInVwZGF0ZWRJblZlciI6IjQzLjI0OS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==-->
chore(deps): update dependency fnox to v1.27.1
All checks were successful
renovate/stability-days Updates have met minimum release age requirement
Details
205a7da9e7
rosa scheduled this pull request to auto merge when all checks succeed 2026-06-26 08:03:08 +00:00
rosa force-pushed renovate/fnox-1.x from 205a7da9e7
All checks were successful
renovate/stability-days Updates have met minimum release age requirement
Details
to 8140e82778
All checks were successful
renovate/stability-days Updates have met minimum release age requirement
Details
2026-07-02 00:03:24 +00:00 Compare
rosa changed title from chore(deps): update dependency fnox to v1.27.1 to chore(deps): update dependency fnox to v1.28.0 2026-07-02 00:03:26 +00:00
rosa merged commit 8140e82778 into main 2026-07-02 00:03:28 +00:00
rosa deleted branch renovate/fnox-1.x 2026-07-02 00:03:28 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
rosa/gtt!4
No description provided.