UnENVerse changelog

UnENVerse 0.60.0 (2026-10-22)

2026-10-22T00:00:00Z

A node grant names a project, and a user with any write permission could add a project whose id equalled that name, so the hub rendered the attacker's project for the node. The hub now resolves a grant to exactly one project and refuses an ambiguous one.

UnENVerse 0.59.0 (2026-10-22)

2026-10-22T00:00:00Z

A command reference page in the book, written from unv describe: a test fails when a command is added, renamed or re-described until the page is regenerated, so the page cannot drift from the code.

UnENVerse 0.58.0 (2026-10-22)

2026-10-22T00:00:00Z

Import from Git stores through your own tools: unv import-vault sops, pass and gopass. sops decrypt, gpg --decrypt and gopass show run with a cleared environment, a deadline, an output cap and scrubbed error text; a SOPS file becomes an entry of dotted key-path variables, a pass or gopass secret keeps its first line as the password and its whole body as the description, and SOPS metadata is archi…

UnENVerse 0.57.0 (2026-10-22)

2026-10-22T00:00:00Z

Release builds for arm64: Linux desktop bundles and unv/unv-server for linux-aarch64, the desktop installer and unv/unv-server for windows-aarch64, and a multi-arch unv-server image. Static musl archives (linux-x86_64-musl, linux-aarch64-musl) run on Alpine and any other distribution. unv update picks the musl archive on a musl build.

UnENVerse 0.56.1 (2026-10-18)

2026-10-18T00:00:00Z

Rust tests build the key-derivation and hashing crates optimised, so a test that unlocks a vault no longer pays for a debug-build Argon2id. A slow contract file went from 111 s to 9 s.

UnENVerse 0.56.0 (2026-10-18)

2026-10-18T00:00:00Z

Behaviour tests for the whole command line, the hub and node flows, the desktop IPC commands and the TypeScript interface. The command line tests run the real unv, a real hub and agent, a KeePass file and an SFTP server; the desktop commands are called on Tauri's mock runtime without a window.

UnENVerse 0.55.1 (2026-10-17)

2026-10-17T00:00:00Z

Public trust signals: an OpenSSF Scorecard workflow, build provenance attestations and CycloneDX software bills of materials for every release asset, a Vitest coverage floor enforced in CI, contributor guide, code of conduct, issue forms and a pull request template.

UnENVerse 0.55.0 (2026-10-17)

2026-10-17T00:00:00Z

unv update installs a newer standalone release only after the signed manifest, the archive checksum and a version probe all pass. The manifest is signed separately from the release assets, so a compromised download host cannot push an update.

UnENVerse 0.54.1 (2026-10-16)

2026-10-16T00:00:00Z

Vaults written by SQLCipher 3 now open by migrating in place, with a backup kept first. A wrong password is still rejected.

UnENVerse 0.54.0 (2026-10-15)

2026-10-15T00:00:00Z

R09 full-fidelity password-manager source migration: unv import-vault bitwarden|onepassword|keepass now plans and atomically records source identities, encrypted source archives and attachments alongside vault entries. Bitwarden JSON and ZIP attachments, 1Password JSON and .1pux, and KeePass KDBX3/KDBX4 password/key-file sources retain histories, TOTP where present, and report unsupported or miss…

UnENVerse 0.44.x (2026-10-11 to 2026-10-12)

2026-10-11T00:00:00Z

The application layer moves into a shared unv-app crate used by the CLI, the server and the desktop app (ADR on the application-layer boundary).

UnENVerse 0.43.0 (2026-10-11)

2026-10-11T00:00:00Z

Dependency modernisation across crypto, backup, TOTP, node and server transport code, with a reviewed OpenAPI snapshot added to catch API drift.

UnENVerse 0.42.7 (2026-10-11)

2026-10-11T00:00:00Z

Concurrency: audit appends are atomic, pool state is written under an exclusive lock, TOTP replay marks are compare-and-swap, sessions end when a user, token, password or permission changes, and stale saves answer 409.

UnENVerse 2026-10-09 (0.42.x)

2026-10-09T00:00:00Z

The product is now UnENVerse everywhere: the crates and folders are unv-cli and unv-server, the desktop package is unenverse, release archives are named unv--, the data directory is io.unenverse, the per-directory context file is .unv.json, browser-storage keys start with unenverse-, and calendar event ids end in @unenverse. The ENVV_ environment variables are no longer read; u…

UnENVerse 2026-10-09

2026-10-09T00:00:00Z

Licence: LICENSE replaced by the official Apache-2.0 text (curl from apache.org), NOTICE added, license fields in package.json, vscode-extension, tauri.conf, 4 Cargo.toml, image label.

UnENVerse 2026-10-08

2026-10-08T00:00:00Z

Bulk uid register in the pane; --fix in the app's doctor; strict-write on the CLI against a remote; the archive/WAL caveat above.

UnENVerse 2026-09-21

2026-09-21T00:00:00Z

Phase 24 A4 now queries Caps Lock through a Tauri command (GDK on Linux,

UnENVerse 2026-09-14

2026-09-14T00:00:00Z

B.1 — npx eslint --prune-suppressions. npm run lint now exits 0

UnENVerse 2026-09-13

2026-09-13T00:00:00Z

### Handoff 30 — 2026-09-13

UnENVerse 2026-09-11

2026-09-11T00:00:00Z

### Handoff 29 — 2026-09-11

UnENVerse 2026-09-10

2026-09-10T00:00:00Z

No envv totp add/set. envv entry set X --totp … is the write path;

UnENVerse 2026-09-04

2026-09-04T00:00:00Z

All six answered. Verification:

UnENVerse 2026-08-31

2026-08-31T00:00:00Z

Phase 26 grows a third deliverable, 30c: the parity audit becomes a

UnENVerse 2026-08-27

2026-08-27T00:00:00Z

triggered by a version bump, and this work is not released yet).

UnENVerse 2026-08-25

2026-08-25T00:00:00Z

so the release pipeline has now cut releases end to end. That was an open item in

UnENVerse 2026-08-24

2026-08-24T00:00:00Z

src/css/cards.css now derives every card dimension from --cs- tokens

UnENVerse 2026-08-23

2026-08-23T00:00:00Z

cargo test --workspace — 16 agent tests, 6 parity, 7 server, 76 vault-core, all passing

UnENVerse 2026-08-08

2026-08-08T00:00:00Z

UnENVerse 2026-08-07

2026-08-07T00:00:00Z

UnENVerse 2026-06-13

2026-06-13T00:00:00Z

### Remote RBAC, Discord-style hierarchy, sidebar/cert UX