chore(deps): update dependency fnox to v1.35.0 #10

Merged

rosa merged 1 commit from renovate/fnox-1.x into main

2026-09-10 12:04:58 +00:00

rosa commented

2026-09-04 04:05:08 +00:00

Owner

This PR contains the following updates:

Package	Type	Update	Change	Pending
fnox	tools	minor	`1.34.0` → `1.35.0`	`v1.35.1`

Release Notes

jdx/fnox (fnox)

`v1.35.0`: : Selective Profile Inheritance

Compare Source

This release introduces selective profile inheritance, letting profiles compose their secrets, providers, and lease backends from other named profiles, alongside a batch of correctness fixes to secret resolution, sync caching, and the background daemon.

Added

Selective profile inheritance (#770) -- @jdx. Named profiles can now declare an ordered inherits list so their configuration is layered from ancestor profiles before the profile itself, with later entries winning on conflicts. Inheritance applies to secrets, providers, lease backends, and default_provider, and supports nested inheritance. Unknown inherited profiles and inheritance cycles are reported as actionable configuration errors, and inherited fnox.<profile>.toml files are discovered automatically.
```
[profiles.openai.secrets]
OPENAI_API_KEY = { provider = "age", value = "encrypted-key..." }

[profiles.database-local.secrets]
DATABASE_PASSWORD = { provider = "age", value = "encrypted-password..." }

[profiles.api-local]
inherits = ["openai", "database-local"]
```
```
fnox -P api-local exec -- ./api
```

Fixed

Sync refreshes from current sources, not stale caches (#774) -- @davdroman. fnox sync --local-file could resolve secrets from its previously generated local cache instead of the current source configuration, so changes to a tracked provider or value were ignored on refresh. Cached sync entries are now excluded when resolving refresh sources, stale entries (including inherited profiles and both local override filenames) are removed during full refreshes, and ordinary local overrides, providers, profile inheritance, and --no-defaults behavior are preserved.
fnox check batches Age secret resolution (#779) -- @davdroman. check previously resolved each secret separately, repeatedly unwrapping the same shared key for batch-encrypted Age values backed by a hardware or plugin identity, which could require one authorization per secret. Eligible Age-backed secrets are now resolved in batches per provider, unwrapping each shared batch key once, while preserving per-secret errors for invalid ciphertexts.
Background daemon detaches from the client working directory (#795) -- @jdx. Background daemons now start from / instead of inheriting the client's working directory, so the daemon keeps serving requests even after the directory that auto-started it is deleted. Per-request resolution is unchanged, since clients still send their cwd on each request.
Intentional default fallbacks stay quiet (#771) -- @jdx. When a secret uses if_missing: ignore and falls back from a failed provider to a default (including interpolated defaults), the fallback message is now logged at debug instead of warn. Interpolated default resolution also no longer re-runs the already-failed root provider, while still surfacing genuine interpolation cycle errors.

Performance

Skip redundant secret reloads on cd (#766) -- @jdx. fnox hook-env no longer forces a full secret reload on every working-directory change. Sessions now refresh only when the effective config hierarchy or relevant FNOX_* environment variables change, so navigating between directories within the same fnox.toml tree preserves the loaded environment.

Documentation

Docs and CLI help audited against actual behavior (#798) -- @jdx. Every docs page and CLI help string was checked against the code and corrected. Notable fixes include the secret resolution order in how-it-works (provider, then default, then environment), the Bitwarden auth hint (FNOX_BW_SESSION, not FNOX_BW_SESSION_TOKEN), FIDO2/YubiKey setup using a positional type instead of a nonexistent --type flag, http_timeout documented as a duration string, import examples that require --provider and --force, corrected keychain/Linux Secret Service requirements, and README additions for the fido2, yubikey, foks, and keeper-sm providers.

Full Changelog: https://github.com/jdx/fnox/compare/v1.34.1...v1.35.0

fnox is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If fnox handles secrets or config for you or your team, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep fnox secure, free, and independent.

`v1.34.1`: : Safer profiles, exports, and macOS binaries

Compare Source

A patch release focused on safety and correctness: unknown profiles now fail loudly instead of silently falling back to defaults, dotenv exports survive Docker Compose interpolation, interactive daemon cache misses regain access to your terminal, and macOS release binaries are now notarized.

Fixed

Unknown profiles are rejected (#741) -- @jdx. An active profile that has neither a [profiles.<name>] table nor a matching fnox.<name>.toml overlay now errors (listing the available profiles) instead of silently falling back to top-level secrets, which could leak defaults on a typo. Shell integration (hook-env) also refuses unknown profiles. Creating new profiles via set, import, and provider add still works.
Dotenv export preserves dollar signs (#746) -- @jdx. Secrets containing $ are now emitted in single quotes so Docker Compose no longer interpolates them, falling back to double quotes with \$ escaping when needed. Dotenv import was aligned to match: it reassembles multiline single-quoted values, unescapes \', and treats \$ in double quotes as a literal dollar sign.
Interactive daemon cache misses resolve in the foreground (#743) -- @jdx. When the daemon misses its cache for an interactive client, the missing keys are now resolved in the foreground so PIN, touch, browser, and auth-command prompts reach the invoking terminal; resolved values are then sent back to the daemon for reuse. Non-interactive callers continue to resolve daemon-side and never prompt.
age batch decryption prompts once (#755) -- @jdx. fnox sync now wraps a single random key with age per batch and encrypts each secret under it, so age (and hardware-backed plugins) only prompt once per sync instead of once per secret. Existing sync caches remain readable, and re-running fnox sync migrates them to the batched format.

Security

Hardened secret injection boundaries (#763) -- @jdx. Secret names must now be valid environment identifiers (^[A-Za-z_][A-Za-z0-9_]*$), enforced when loading, validating, running set, and import, with shell emitters quoting names defensively across Bash, Zsh, Fish, and PowerShell. exec and MCP exec now strip ambient FNOX_AGE_KEY and FNOX_AGE_KEY_FILE before spawning child processes while still injecting explicitly configured secrets.

Changed

macOS release binaries are now notarized (#764) -- @jdx. The signed macOS binary is submitted to Apple's notary service and built with a hardened runtime, so downloads (which carry the quarantine bit) no longer hit the Gatekeeper "cannot be verified" dialog.

Documentation

Generated CLI configuration docs now HTML-encode angle brackets so placeholders like <path> render correctly instead of being parsed as Vue elements (#739) -- @jdx.
Sync docs now call out the golden path and hardware-backed decryption (#748) -- @jdx.

Full Changelog: https://github.com/jdx/fnox/compare/v1.34.0...v1.34.1

fnox is maintained by @jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise, aube, hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors.

If fnox is handling secrets or config for you or your team, please consider sponsoring at jdx.dev. Sponsorships are what let fnox stay independent and the project keep moving.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Type | Update | Change | Pending | |---|---|---|---|---| | [fnox](https://github.com/jdx/fnox) | tools | minor | `1.34.0` → `1.35.0` | `v1.35.1` | --- ### Release Notes <details> <summary>jdx/fnox (fnox)</summary> ### [`v1.35.0`](https://github.com/jdx/fnox/releases/tag/v1.35.0): : Selective Profile Inheritance [Compare Source](https://github.com/jdx/fnox/compare/v1.34.1...v1.35.0) This release introduces selective profile inheritance, letting profiles compose their secrets, providers, and lease backends from other named profiles, alongside a batch of correctness fixes to secret resolution, sync caching, and the background daemon. #### Added - **Selective profile inheritance** ([#770](https://github.com/jdx/fnox/pull/770)) -- [@jdx](https://github.com/jdx). Named profiles can now declare an ordered `inherits` list so their configuration is layered from ancestor profiles before the profile itself, with later entries winning on conflicts. Inheritance applies to secrets, providers, lease backends, and `default_provider`, and supports nested inheritance. Unknown inherited profiles and inheritance cycles are reported as actionable configuration errors, and inherited `fnox.<profile>.toml` files are discovered automatically. ```toml [profiles.openai.secrets] OPENAI_API_KEY = { provider = "age", value = "encrypted-key..." } [profiles.database-local.secrets] DATABASE_PASSWORD = { provider = "age", value = "encrypted-password..." } [profiles.api-local] inherits = ["openai", "database-local"] ``` ```bash fnox -P api-local exec -- ./api ``` #### Fixed - **Sync refreshes from current sources, not stale caches** ([#774](https://github.com/jdx/fnox/pull/774)) -- [@davdroman](https://github.com/davdroman). `fnox sync --local-file` could resolve secrets from its previously generated local cache instead of the current source configuration, so changes to a tracked provider or value were ignored on refresh. Cached sync entries are now excluded when resolving refresh sources, stale entries (including inherited profiles and both local override filenames) are removed during full refreshes, and ordinary local overrides, providers, profile inheritance, and `--no-defaults` behavior are preserved. - **`fnox check` batches Age secret resolution** ([#779](https://github.com/jdx/fnox/pull/779)) -- [@davdroman](https://github.com/davdroman). `check` previously resolved each secret separately, repeatedly unwrapping the same shared key for batch-encrypted Age values backed by a hardware or plugin identity, which could require one authorization per secret. Eligible Age-backed secrets are now resolved in batches per provider, unwrapping each shared batch key once, while preserving per-secret errors for invalid ciphertexts. - **Background daemon detaches from the client working directory** ([#795](https://github.com/jdx/fnox/pull/795)) -- [@jdx](https://github.com/jdx). Background daemons now start from `/` instead of inheriting the client's working directory, so the daemon keeps serving requests even after the directory that auto-started it is deleted. Per-request resolution is unchanged, since clients still send their `cwd` on each request. - **Intentional default fallbacks stay quiet** ([#771](https://github.com/jdx/fnox/pull/771)) -- [@jdx](https://github.com/jdx). When a secret uses `if_missing: ignore` and falls back from a failed provider to a default (including interpolated defaults), the fallback message is now logged at debug instead of warn. Interpolated default resolution also no longer re-runs the already-failed root provider, while still surfacing genuine interpolation cycle errors. #### Performance - **Skip redundant secret reloads on `cd`** ([#766](https://github.com/jdx/fnox/pull/766)) -- [@jdx](https://github.com/jdx). `fnox hook-env` no longer forces a full secret reload on every working-directory change. Sessions now refresh only when the effective config hierarchy or relevant `FNOX_*` environment variables change, so navigating between directories within the same `fnox.toml` tree preserves the loaded environment. #### Documentation - **Docs and CLI help audited against actual behavior** ([#798](https://github.com/jdx/fnox/pull/798)) -- [@jdx](https://github.com/jdx). Every docs page and CLI help string was checked against the code and corrected. Notable fixes include the secret resolution order in how-it-works (provider, then default, then environment), the Bitwarden auth hint (`FNOX_BW_SESSION`, not `FNOX_BW_SESSION_TOKEN`), FIDO2/YubiKey setup using a positional type instead of a nonexistent `--type` flag, `http_timeout` documented as a duration string, import examples that require `--provider` and `--force`, corrected keychain/Linux Secret Service requirements, and README additions for the fido2, yubikey, foks, and keeper-sm providers. **Full Changelog**: <https://github.com/jdx/fnox/compare/v1.34.1...v1.35.0> #### 💚 Sponsor fnox fnox is built and maintained by [@jdx](https://github.com/jdx), an open source developer at [**entire.io**](https://entire.io/), the title sponsor of his open source work. If fnox handles secrets or config for you or your team, please consider becoming an [individual or company sponsor](https://jdx.dev/sponsors.html). Your support funds ongoing development and helps keep fnox secure, free, and independent. ### [`v1.34.1`](https://github.com/jdx/fnox/releases/tag/v1.34.1): : Safer profiles, exports, and macOS binaries [Compare Source](https://github.com/jdx/fnox/compare/v1.34.0...v1.34.1) A patch release focused on safety and correctness: unknown profiles now fail loudly instead of silently falling back to defaults, dotenv exports survive Docker Compose interpolation, interactive daemon cache misses regain access to your terminal, and macOS release binaries are now notarized. #### Fixed - **Unknown profiles are rejected** ([#741](https://github.com/jdx/fnox/pull/741)) -- [@jdx](https://github.com/jdx). An active profile that has neither a `[profiles.<name>]` table nor a matching `fnox.<name>.toml` overlay now errors (listing the available profiles) instead of silently falling back to top-level secrets, which could leak defaults on a typo. Shell integration (`hook-env`) also refuses unknown profiles. Creating new profiles via `set`, `import`, and `provider add` still works. - **Dotenv export preserves dollar signs** ([#746](https://github.com/jdx/fnox/pull/746)) -- [@jdx](https://github.com/jdx). Secrets containing `$` are now emitted in single quotes so Docker Compose no longer interpolates them, falling back to double quotes with `\$` escaping when needed. Dotenv import was aligned to match: it reassembles multiline single-quoted values, unescapes `\'`, and treats `\$` in double quotes as a literal dollar sign. - **Interactive daemon cache misses resolve in the foreground** ([#743](https://github.com/jdx/fnox/pull/743)) -- [@jdx](https://github.com/jdx). When the daemon misses its cache for an interactive client, the missing keys are now resolved in the foreground so PIN, touch, browser, and auth-command prompts reach the invoking terminal; resolved values are then sent back to the daemon for reuse. Non-interactive callers continue to resolve daemon-side and never prompt. - **age batch decryption prompts once** ([#755](https://github.com/jdx/fnox/pull/755)) -- [@jdx](https://github.com/jdx). `fnox sync` now wraps a single random key with age per batch and encrypts each secret under it, so age (and hardware-backed plugins) only prompt once per sync instead of once per secret. Existing sync caches remain readable, and re-running `fnox sync` migrates them to the batched format. #### Security - **Hardened secret injection boundaries** ([#763](https://github.com/jdx/fnox/pull/763)) -- [@jdx](https://github.com/jdx). Secret names must now be valid environment identifiers (`^[A-Za-z_][A-Za-z0-9_]*$`), enforced when loading, validating, running `set`, and `import`, with shell emitters quoting names defensively across Bash, Zsh, Fish, and PowerShell. `exec` and MCP `exec` now strip ambient `FNOX_AGE_KEY` and `FNOX_AGE_KEY_FILE` before spawning child processes while still injecting explicitly configured secrets. #### Changed - **macOS release binaries are now notarized** ([#764](https://github.com/jdx/fnox/pull/764)) -- [@jdx](https://github.com/jdx). The signed macOS binary is submitted to Apple's notary service and built with a hardened runtime, so downloads (which carry the quarantine bit) no longer hit the Gatekeeper "cannot be verified" dialog. #### Documentation - Generated CLI configuration docs now HTML-encode angle brackets so placeholders like `<path>` render correctly instead of being parsed as Vue elements ([#739](https://github.com/jdx/fnox/pull/739)) -- [@jdx](https://github.com/jdx). - Sync docs now call out the golden path and hardware-backed decryption ([#748](https://github.com/jdx/fnox/pull/748)) -- [@jdx](https://github.com/jdx). **Full Changelog**: <https://github.com/jdx/fnox/compare/v1.34.0...v1.34.1> #### 💚 Sponsor fnox fnox is maintained by [@jdx](https://github.com/jdx), an open source developer for [**entire.io**](https://entire.io), the title sponsor of the [jdx.dev](https://jdx.dev) open source tools including [mise](https://mise.jdx.dev/), [aube](https://aube.jdx.dev/), hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors. If fnox is handling secrets or config for you or your team, please consider [sponsoring at jdx.dev](https://jdx.dev/sponsors.html). Sponsorships are what let fnox stay independent and the project keep moving. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

rosa added 1 commit

2026-09-04 04:05:08 +00:00