chore(deps): update dependency fnox to v1.34.0 #9

Merged

rosa merged 1 commit from renovate/fnox-1.x into main

2026-08-30 04:04:19 +00:00

rosa commented

2026-08-25 16:05:14 +00:00

Owner

This PR contains the following updates:

Package	Type	Update	Change	Pending
fnox	tools	minor	`1.33.0` → `1.34.0`	`v1.34.1`

Release Notes

jdx/fnox (fnox)

`v1.34.0`: : Keeper Secrets Manager & sturdier file secrets

Compare Source

This release adds a read-only Keeper Secrets Manager provider and delivers a batch of fixes to file-backed secrets, FIDO2 prompting, and shell integration.

Added

Keeper Secrets Manager provider (#720) -- @jdx. A new read-only keeper-sm provider backed by Keeper's official Rust SDK. Secret values use Keeper notation such as RECORD_UID/field/password. Authentication works from a JSON config file (KSM_CONFIG / FNOX_KEEPER_CONFIG, or the default ~/.keeper/ksm-config.json), with optional one-time-token bootstrap via KSM_TOKEN / FNOX_KEEPER_TOKEN (which must persist to a file-backed config). Batch reads redeem the token once and fetch concurrently, and Keeper environment variables are scrubbed from the proxy's ambient credentials.
```
DB_PASSWORD = { provider = "keeper-sm", value = "RECORD_UID/field/password" }
```
fnox set --from-file <path> (#730) -- @jdx. Reads a secret value verbatim from a UTF-8 file without trimming, preserving trailing newlines. This fixes SSH private keys and similar as_file secrets losing their required final newline, which happened because fnox set trims stdin values and shell command substitution strips trailing newlines. The existing echo "x" | fnox set KEY behavior is unchanged; --from-file cannot be combined with a positional value.
```
fnox set SSH_KEY --from-file ~/.ssh/id_ed25519
```

Fixed

as_file secrets are cleaned up on shell exit (#724) -- @jdx. Decrypted temp files created for as_file secrets previously lingered because cleanup only ran on a later hook-env refresh. fnox deactivate now removes session-recorded temp files, and a new zsh zshexit hook cleans them up when you close the terminal. Cleanup is scoped to paths under the session's hook temp dir (surviving TMPDIR changes), and nested zsh sessions no longer delete files owned by their parent.
FIDO2 prompts only once per batch (#732) -- @jdx. Resolving multiple FIDO2-protected secrets no longer triggers repeated and delayed PIN/touch prompts. The provider now acquires the hardware HMAC secret once and decrypts all values with it, and device discovery runs before the PIN prompt so missing or multiple-device errors surface without an unusable prompt. Per-secret results and errors are preserved without negatively caching transient hardware failures.
Auth output kept off hook-env stdout (#713) -- @halms. fnox hook-env stdout is evaluated as shell code, so an expired session that triggered reauthentication could cause login progress output to be executed as commands. Auth-command stdout is now routed to stderr while remaining live for interactive logins.
MCP tool list works with strict clients (#727) -- @jdx. tools/list now includes the ttlMs: 0 and cacheScope: "private" cache hints required by the MCP 2026-07-28 schema, so strict clients such as Claude Code can fetch fnox tools again. The existing no-cache behavior is preserved.

Documentation

Documented ${SECRET_NAME} interpolation in default values (#733) -- @arthurfiorette. Explains resolution order across providers, interpolated defaults, literal defaults, and environment variables, plus errors for undefined references and dependency cycles.

New Contributors

@arthurfiorette made their first contribution in #733

Full Changelog: https://github.com/jdx/fnox/compare/v1.33.1...v1.34.0

fnox is maintained by @jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise, aube, hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors.

If fnox is handling secrets or config for you or your team, please consider sponsoring at jdx.dev. Sponsorships are what let fnox stay independent and the project keep moving.

`v1.33.1`: : Preserve remote key names on set

Compare Source

A small patch release centered on a fix to fnox set so updates no longer clobber a secret's custom remote key name. The rest is routine dependency and CI maintenance.

Fixed

fnox set preserves an existing remote key name (#712) -- @jdx. When updating a remote-backed secret, fnox set previously resolved the remote key only from --key-name or the environment variable name, overwriting any custom value in your config and writing to the wrong backend object. Now it reuses the existing provider key when one is configured for the same provider, while --key-name still takes highest precedence and the environment key is used as a fallback when creating a secret or switching providers. Inherited parent-config secrets no longer steer a child override.

As part of this fix, the HashiCorp Vault provider's put_secret was reworked to update individual fields via kv patch (preserving sibling fields), pass values through piped stdin so @ and - are treated literally, and correctly handle missing paths, concurrent writers, and soft-deleted KV v2 metadata.

Full Changelog: https://github.com/jdx/fnox/compare/v1.33.0...v1.33.1

If fnox is handling secrets or config for you or your team, please consider sponsoring at jdx.dev. Sponsorships are what let fnox stay independent and the project keep moving.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Type | Update | Change | Pending | |---|---|---|---|---| | [fnox](https://github.com/jdx/fnox) | tools | minor | `1.33.0` → `1.34.0` | `v1.34.1` | --- ### Release Notes <details> <summary>jdx/fnox (fnox)</summary> ### [`v1.34.0`](https://github.com/jdx/fnox/releases/tag/v1.34.0): : Keeper Secrets Manager & sturdier file secrets [Compare Source](https://github.com/jdx/fnox/compare/v1.33.1...v1.34.0) This release adds a read-only Keeper Secrets Manager provider and delivers a batch of fixes to file-backed secrets, FIDO2 prompting, and shell integration. #### Added - **Keeper Secrets Manager provider** ([#720](https://github.com/jdx/fnox/pull/720)) -- [@jdx](https://github.com/jdx). A new read-only `keeper-sm` provider backed by Keeper's official Rust SDK. Secret values use Keeper notation such as `RECORD_UID/field/password`. Authentication works from a JSON config file (`KSM_CONFIG` / `FNOX_KEEPER_CONFIG`, or the default `~/.keeper/ksm-config.json`), with optional one-time-token bootstrap via `KSM_TOKEN` / `FNOX_KEEPER_TOKEN` (which must persist to a file-backed config). Batch reads redeem the token once and fetch concurrently, and Keeper environment variables are scrubbed from the proxy's ambient credentials. ```toml DB_PASSWORD = { provider = "keeper-sm", value = "RECORD_UID/field/password" } ``` - **`fnox set --from-file <path>`** ([#730](https://github.com/jdx/fnox/pull/730)) -- [@jdx](https://github.com/jdx). Reads a secret value verbatim from a UTF-8 file without trimming, preserving trailing newlines. This fixes SSH private keys and similar `as_file` secrets losing their required final newline, which happened because `fnox set` trims stdin values and shell command substitution strips trailing newlines. The existing `echo "x" | fnox set KEY` behavior is unchanged; `--from-file` cannot be combined with a positional value. ```bash fnox set SSH_KEY --from-file ~/.ssh/id_ed25519 ``` #### Fixed - **`as_file` secrets are cleaned up on shell exit** ([#724](https://github.com/jdx/fnox/pull/724)) -- [@jdx](https://github.com/jdx). Decrypted temp files created for `as_file` secrets previously lingered because cleanup only ran on a later `hook-env` refresh. `fnox deactivate` now removes session-recorded temp files, and a new zsh `zshexit` hook cleans them up when you close the terminal. Cleanup is scoped to paths under the session's hook temp dir (surviving `TMPDIR` changes), and nested zsh sessions no longer delete files owned by their parent. - **FIDO2 prompts only once per batch** ([#732](https://github.com/jdx/fnox/pull/732)) -- [@jdx](https://github.com/jdx). Resolving multiple FIDO2-protected secrets no longer triggers repeated and delayed PIN/touch prompts. The provider now acquires the hardware HMAC secret once and decrypts all values with it, and device discovery runs before the PIN prompt so missing or multiple-device errors surface without an unusable prompt. Per-secret results and errors are preserved without negatively caching transient hardware failures. - **Auth output kept off `hook-env` stdout** ([#713](https://github.com/jdx/fnox/pull/713)) -- [@halms](https://github.com/halms). `fnox hook-env` stdout is evaluated as shell code, so an expired session that triggered reauthentication could cause login progress output to be executed as commands. Auth-command stdout is now routed to stderr while remaining live for interactive logins. - **MCP tool list works with strict clients** ([#727](https://github.com/jdx/fnox/pull/727)) -- [@jdx](https://github.com/jdx). `tools/list` now includes the `ttlMs: 0` and `cacheScope: "private"` cache hints required by the MCP `2026-07-28` schema, so strict clients such as Claude Code can fetch fnox tools again. The existing no-cache behavior is preserved. #### Documentation - **Documented `${SECRET_NAME}` interpolation in default values** ([#733](https://github.com/jdx/fnox/pull/733)) -- [@arthurfiorette](https://github.com/arthurfiorette). Explains resolution order across providers, interpolated defaults, literal defaults, and environment variables, plus errors for undefined references and dependency cycles. #### New Contributors - [@arthurfiorette](https://github.com/arthurfiorette) made their first contribution in [#733](https://github.com/jdx/fnox/pull/733) **Full Changelog**: <https://github.com/jdx/fnox/compare/v1.33.1...v1.34.0> #### 💚 Sponsor fnox fnox is maintained by [@jdx](https://github.com/jdx), an open source developer for [**entire.io**](https://entire.io), the title sponsor of the [jdx.dev](https://jdx.dev) open source tools including [mise](https://mise.jdx.dev/), [aube](https://aube.jdx.dev/), hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors. If fnox is handling secrets or config for you or your team, please consider [sponsoring at jdx.dev](https://jdx.dev/sponsors.html). Sponsorships are what let fnox stay independent and the project keep moving. ### [`v1.33.1`](https://github.com/jdx/fnox/releases/tag/v1.33.1): : Preserve remote key names on set [Compare Source](https://github.com/jdx/fnox/compare/v1.33.0...v1.33.1) A small patch release centered on a fix to `fnox set` so updates no longer clobber a secret's custom remote key name. The rest is routine dependency and CI maintenance. #### Fixed - **`fnox set` preserves an existing remote key name** ([#712](https://github.com/jdx/fnox/pull/712)) -- [@jdx](https://github.com/jdx). When updating a remote-backed secret, `fnox set` previously resolved the remote key only from `--key-name` or the environment variable name, overwriting any custom `value` in your config and writing to the wrong backend object. Now it reuses the existing provider key when one is configured for the same provider, while `--key-name` still takes highest precedence and the environment key is used as a fallback when creating a secret or switching providers. Inherited parent-config secrets no longer steer a child override. As part of this fix, the HashiCorp Vault provider's `put_secret` was reworked to update individual fields via `kv patch` (preserving sibling fields), pass values through piped stdin so `@` and `-` are treated literally, and correctly handle missing paths, concurrent writers, and soft-deleted KV v2 metadata. **Full Changelog**: <https://github.com/jdx/fnox/compare/v1.33.0...v1.33.1> #### 💚 Sponsor fnox fnox is maintained by [@jdx](https://github.com/jdx), an open source developer for [**entire.io**](https://entire.io), the title sponsor of the [jdx.dev](https://jdx.dev) open source tools including [mise](https://mise.jdx.dev/), [aube](https://aube.jdx.dev/), hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors. If fnox is handling secrets or config for you or your team, please consider [sponsoring at jdx.dev](https://jdx.dev/sponsors.html). Sponsorships are what let fnox stay independent and the project keep moving. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

rosa added 1 commit

2026-08-25 16:05:14 +00:00