chore(deps): update dependency fnox to v1.35.2 #11

Merged

rosa merged 1 commit from renovate/fnox-1.x into main

2026-09-20 12:06:05 +00:00

rosa commented

2026-09-14 00:05:30 +00:00

Owner

This PR contains the following updates:

Package	Type	Update	Change
fnox	tools	patch	`1.35.0` → `1.35.2`

Release Notes

jdx/fnox (fnox)

`v1.35.2`: : Shell hook retries incomplete secret loads, global config imports, Azure Key Vault provider test fix

Compare Source

Fixes for the shell hook and daemon when a provider is temporarily unavailable, correct handling of import in the global config, a fix for fnox provider test against Azure Key Vault, and shell completion scripts published with each release.

Fixed

Shell hook retries incomplete secret loads (#839) -- @jdx. When the shell hook loaded a credential but a dependent secret failed to resolve (for example, op exiting unsuccessfully during shell startup), the partial result was recorded as an unchanged session and later prompts skipped resolution entirely, even after the provider came back; fnox exec would succeed while the shell stayed incomplete. The hook now records incomplete loads and retries on the next invocation, resuming the normal early exit once everything resolves. The daemon also no longer caches missing values, so a recovered secret is resolved and cached normally instead of leaving a stale miss behind. Note that secrets which are persistently unavailable (including optional ones) are now retried on every prompt, which can add latency and repeat warnings until they resolve; secrets excluded from shell injection (env = false) do not trigger retries. The daemon socket compatibility tag was bumped, so upgraded clients start a fresh daemon rather than reusing an old one that still caches misses.
Daemon cache hits keep provider dependencies available (#838) -- @jdx. With the daemon enabled, a secret whose provider depends on another secret (such as a 1Password provider needing a cached OP_SERVICE_ACCOUNT_TOKEN) could fail to resolve when the credential was a cache hit but the dependent secret was not (e.g. daemon_cache = false). Cached values are now passed through when resolving misses so dependency ordering still works, and only provider-declared environment dependencies are exposed during resolution, so unrelated cached secrets are not leaked into the environment.
Global config import entries are now loaded (#818) -- @JoacoEsteban. fnox get and other commands ignored the import field in ~/.config/fnox/config.toml, so secrets and providers from imported files were only available when passing --config explicitly. Imports are now expanded when the global config is loaded (imports form the base, with the global file merged on top), and fnox config-files lists the imported files as well. A missing global import is reported as an error.
fnox provider test succeeds for Azure Key Vault vaults without the probe secret (#829) -- @any-victor. The azure-sm connection test reads a hard-coded fnox-test-secret, and a valid, accessible vault that did not contain it was reported as a failed connection. A 404 with the SecretNotFound service code is now treated as a successful probe, while 401/403 still report authentication failures and other 404s (including a missing vault) and transport errors still report API failures.

Added

Shell completion scripts shipped with releases (#814) -- @jdx. Native Bash, Zsh, Fish, and PowerShell completion scripts are now generated from the release binary, uploaded as release assets alongside fnox.usage.kdl, and declared as completion resources in the signed packslip so installers such as mise can register completions automatically. The scripts call fnox itself and do not require a separate usage executable.

Changed

Documentation overhaul (#817) -- @jdx. The docs site has been redesigned with task-based navigation, a new landing page, and light/dark themes. Guides for onboarding, providers, configuration, authentication, caching, and migration were rewritten and corrected (for example, the JSON migration example now extracts .secrets before import, and profile examples place if_missing on individual secrets), with new troubleshooting and Passwordstate guides and examples plus related links for every CLI command.

New Contributors

@any-victor made their first contribution in #829
@JoacoEsteban made their first contribution in #818

Full Changelog: https://github.com/jdx/fnox/compare/v1.35.1...v1.35.2

fnox is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If fnox handles secrets or config for you or your team, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep fnox secure, free, and independent.

`v1.35.1`: : Signed release provenance

Compare Source

A small release with no changes to fnox's runtime behavior. The one user-facing improvement is that release downloads can now be verified against a signed provenance manifest; the rest is documentation and internal tooling.

Changed

Signed packslip published with each release (#807) -- @jdx. Every release now ships a keyless-signed packslip.sigstore.json beside the archives, listing each artifact's sha256/sha512, the bundled executable, host shared-library requirements, and build-provenance attestations, all tied to the github.com/jdx/fnox OIDC identity. Installers can verify a download against that identity rather than a signing key the project would have to hold and rotate. A fnox.usage.kdl CLI spec is also published so consumers can generate completions, man pages, and docs without executing fnox locally.

Full Changelog: https://github.com/jdx/fnox/compare/v1.35.0...v1.35.1

fnox is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [fnox](https://github.com/jdx/fnox) | tools | patch | `1.35.0` → `1.35.2` | --- ### Release Notes <details> <summary>jdx/fnox (fnox)</summary> ### [`v1.35.2`](https://github.com/jdx/fnox/releases/tag/v1.35.2): : Shell hook retries incomplete secret loads, global config imports, Azure Key Vault provider test fix [Compare Source](https://github.com/jdx/fnox/compare/v1.35.1...v1.35.2) Fixes for the shell hook and daemon when a provider is temporarily unavailable, correct handling of `import` in the global config, a fix for `fnox provider test` against Azure Key Vault, and shell completion scripts published with each release. #### Fixed - **Shell hook retries incomplete secret loads** ([#839](https://github.com/jdx/fnox/pull/839)) -- [@jdx](https://github.com/jdx). When the shell hook loaded a credential but a dependent secret failed to resolve (for example, `op` exiting unsuccessfully during shell startup), the partial result was recorded as an unchanged session and later prompts skipped resolution entirely, even after the provider came back; `fnox exec` would succeed while the shell stayed incomplete. The hook now records incomplete loads and retries on the next invocation, resuming the normal early exit once everything resolves. The daemon also no longer caches missing values, so a recovered secret is resolved and cached normally instead of leaving a stale miss behind. Note that secrets which are persistently unavailable (including optional ones) are now retried on every prompt, which can add latency and repeat warnings until they resolve; secrets excluded from shell injection (`env = false`) do not trigger retries. The daemon socket compatibility tag was bumped, so upgraded clients start a fresh daemon rather than reusing an old one that still caches misses. - **Daemon cache hits keep provider dependencies available** ([#838](https://github.com/jdx/fnox/pull/838)) -- [@jdx](https://github.com/jdx). With the daemon enabled, a secret whose provider depends on another secret (such as a 1Password provider needing a cached `OP_SERVICE_ACCOUNT_TOKEN`) could fail to resolve when the credential was a cache hit but the dependent secret was not (e.g. `daemon_cache = false`). Cached values are now passed through when resolving misses so dependency ordering still works, and only provider-declared environment dependencies are exposed during resolution, so unrelated cached secrets are not leaked into the environment. - **Global config `import` entries are now loaded** ([#818](https://github.com/jdx/fnox/pull/818)) -- [@JoacoEsteban](https://github.com/JoacoEsteban). `fnox get` and other commands ignored the `import` field in `~/.config/fnox/config.toml`, so secrets and providers from imported files were only available when passing `--config` explicitly. Imports are now expanded when the global config is loaded (imports form the base, with the global file merged on top), and `fnox config-files` lists the imported files as well. A missing global import is reported as an error. - **`fnox provider test` succeeds for Azure Key Vault vaults without the probe secret** ([#829](https://github.com/jdx/fnox/pull/829)) -- [@any-victor](https://github.com/any-victor). The `azure-sm` connection test reads a hard-coded `fnox-test-secret`, and a valid, accessible vault that did not contain it was reported as a failed connection. A `404` with the `SecretNotFound` service code is now treated as a successful probe, while `401`/`403` still report authentication failures and other `404`s (including a missing vault) and transport errors still report API failures. #### Added - **Shell completion scripts shipped with releases** ([#814](https://github.com/jdx/fnox/pull/814)) -- [@jdx](https://github.com/jdx). Native Bash, Zsh, Fish, and PowerShell completion scripts are now generated from the release binary, uploaded as release assets alongside `fnox.usage.kdl`, and declared as completion resources in the signed packslip so installers such as mise can register completions automatically. The scripts call `fnox` itself and do not require a separate `usage` executable. #### Changed - **Documentation overhaul** ([#817](https://github.com/jdx/fnox/pull/817)) -- [@jdx](https://github.com/jdx). The docs site has been redesigned with task-based navigation, a new landing page, and light/dark themes. Guides for onboarding, providers, configuration, authentication, caching, and migration were rewritten and corrected (for example, the JSON migration example now extracts `.secrets` before import, and profile examples place `if_missing` on individual secrets), with new troubleshooting and Passwordstate guides and examples plus related links for every CLI command. #### New Contributors - [@any-victor](https://github.com/any-victor) made their first contribution in [#829](https://github.com/jdx/fnox/pull/829) - [@JoacoEsteban](https://github.com/JoacoEsteban) made their first contribution in [#818](https://github.com/jdx/fnox/pull/818) **Full Changelog**: <https://github.com/jdx/fnox/compare/v1.35.1...v1.35.2> #### 💚 Sponsor fnox fnox is built and maintained by [@jdx](https://github.com/jdx), an open source developer at [**entire.io**](https://entire.io/), the title sponsor of his open source work. If fnox handles secrets or config for you or your team, please consider becoming an [individual or company sponsor](https://jdx.dev/sponsors.html). Your support funds ongoing development and helps keep fnox secure, free, and independent. ### [`v1.35.1`](https://github.com/jdx/fnox/releases/tag/v1.35.1): : Signed release provenance [Compare Source](https://github.com/jdx/fnox/compare/v1.35.0...v1.35.1) A small release with no changes to fnox's runtime behavior. The one user-facing improvement is that release downloads can now be verified against a signed provenance manifest; the rest is documentation and internal tooling. #### Changed - **Signed packslip published with each release** ([#807](https://github.com/jdx/fnox/pull/807)) -- [@jdx](https://github.com/jdx). Every release now ships a keyless-signed `packslip.sigstore.json` beside the archives, listing each artifact's sha256/sha512, the bundled executable, host shared-library requirements, and build-provenance attestations, all tied to the `github.com/jdx/fnox` OIDC identity. Installers can verify a download against that identity rather than a signing key the project would have to hold and rotate. A `fnox.usage.kdl` CLI spec is also published so consumers can generate completions, man pages, and docs without executing fnox locally. **Full Changelog**: <https://github.com/jdx/fnox/compare/v1.35.0...v1.35.1> #### 💚 Sponsor fnox fnox is built and maintained by [@jdx](https://github.com/jdx), an open source developer at [**entire.io**](https://entire.io/), the title sponsor of his open source work. If fnox handles secrets or config for you or your team, please consider becoming an [individual or company sponsor](https://jdx.dev/sponsors.html). Your support funds ongoing development and helps keep fnox secure, free, and independent. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

rosa added 1 commit

2026-09-14 00:05:30 +00:00