Tags

v0.13.0

v0.12.1

v0.12.0

v0.11.2

v0.11.2 — docs link in the console, ONYX_PUBLIC_DOCS removed

- The console sidebar links the documentation (/docs, signed-in users)
- ONYX_PUBLIC_DOCS / Helm web.publicDocs removed: the docs are always on
  for signed-in users (drop the setting from existing values / .env files)

v0.11.1

v0.11.1 — webpki advisories, tag-only pipeline

- Fix: rustls-webpki 0.103.16, webpki-roots / webpki-root-certs 1.0.10
  (RUSTSEC-2026-0381, -0382, -0383; the v0.11.0 pipeline failed cargo-audit)
- CI runs only on protected tags

v0.11.0

v0.11.0 — docs behind login, releases from gitlab.com, compile-once CI

- /docs (guides, API reference, openapi.json) now requires a signed-in
  user; the web tier no longer serves CLI archives (/downloads) or a Helm
  repository (/helm). The docs link to the running server's release on
  gitlab.com/nubevia-dev/onyx-vault instead.
- Images, Helm chart and CLI releases: registry.gitlab.com/nubevia-dev/
  onyx-vault (chart: oci://registry.gitlab.com/nubevia-dev/onyx-vault/helm/
  onyx-vault). The chart's default images point there.
- CI compiles every binary once (build-binaries); the images copy them.

v0.10.2

v0.10.2 — public docs portal, operator API-token auth

- Every instance serves, without authentication: /docs (guides + API
  reference from docs/openapi.json), CLI downloads at /downloads, and a
  Helm chart repository at /helm (ONYX_PUBLIC_DOCS=false turns it off)
- Operator: tokenSecretRef — authenticate with a machine API token from a
  Secret, for clusters the vault cannot reach for a TokenReview
- Fix: the web image ships its runtime dependencies (v0.8.0–v0.9.0 web
  images exited at startup)
- Fix: Cloudflare Rocket Loader no longer breaks the web UI's CSP

v0.9.0

v0.9.0 — CLI parity with the web UI

onyx manages project members, access rules, global machines (and their
permissions and credentials), credential updates, user permissions and
secret formats, naming users and machines by email/name or UUID. onyx-sh
lists members and rules and sets secret formats.

Also bumps rustls to 0.23.46 and documents the zip build-time advisories,
which failed cargo-audit on v0.8.1; v0.9.0 supersedes it.

v0.8.1

v0.8.1 — CLI SSO login

Supersedes v0.8.0, whose release builds would have refused Cargo.lock (the
new onyx-vault-telemetry crate was not version-stamped). Since v0.8.0:
onyx auth login --sso (saved per-server session, auto-refresh, auth logout,
--print-token for the stateless form) and onyx-sh login --sso.

v0.8.0

v0.8.0 — OpenTelemetry

Traces, metrics and logs over OTLP/HTTP from the server, the operator and the
web client, off unless OTEL_EXPORTER_OTLP_ENDPOINT is set (Helm: otel.enabled
and otel.endpoint). Spans carry route templates only; exported logs mirror
stdout. The server now shuts down gracefully on SIGTERM.

v0.7.2

v0.7.2 — security audit remediation

Supersedes v0.7.0 and v0.7.1, whose release pipelines failed in the new
verify stage before publishing anything. Since v0.7.1: Argon2 password
hashing and passphrase key derivation run on blocking threads instead of
stalling the async runtime, and the test request timeout is widened for
slow CI runners.

Fixes every finding of the 2026-10-07 security audit: K8s auth routed
by token identity with a required audience, operator vault URLs pinned,
system-admin machine escalation closed, rule-less OIDC bindings refused,
JWT secret strength enforced, trusted-proxy rate limiting, atomic key
operations, per-request permission reload with session invalidation,
audit log client IPs, web path traversal closed, operator Secret
ownership, CLI secrets off argv, CI verify stage, no CORS and no Swagger
by default, dependency advisories cleared.

Breaking: K8s pods need a projected token with audience onyx-vault;
the operator requires ONYX_VAULT_URLS; OIDC bindings need a claim rule;
short JWT secrets and http:// issuers are refused; CLI --password /
--passphrase / --share flags are replaced by --*-stdin, env or prompt;
the web tier requires ONYX_OIDC_SESSION_SECRET with OIDC; CORS and API
docs are off unless enabled; the Compose API port binds to loopback.

v0.7.1

v0.7.1 — security audit remediation

Supersedes v0.7.0, whose release pipeline failed in the new verify stage
before publishing anything (the rust:slim image lacked curl for the
Swagger UI build script). No code changes since v0.7.0.

Fixes every finding of the 2026-10-07 security audit: K8s auth routed
by token identity with a required audience, operator vault URLs pinned,
system-admin machine escalation closed, rule-less OIDC bindings refused,
JWT secret strength enforced, trusted-proxy rate limiting, atomic key
operations, per-request permission reload with session invalidation,
audit log client IPs, web path traversal closed, operator Secret
ownership, CLI secrets off argv, CI verify stage, no CORS and no Swagger
by default, dependency advisories cleared.

Breaking: K8s pods need a projected token with audience onyx-vault;
the operator requires ONYX_VAULT_URLS; OIDC bindings need a claim rule;
short JWT secrets and http:// issuers are refused; CLI --password /
--passphrase / --share flags are replaced by --*-stdin, env or prompt;
the web tier requires ONYX_OIDC_SESSION_SECRET with OIDC; CORS and API
docs are off unless enabled; the Compose API port binds to loopback.

v0.7.0

v0.7.0 — security audit remediation

Fixes every finding of the 2026-10-07 security audit: K8s auth routed
by token identity with a required audience, operator vault URLs pinned,
system-admin machine escalation closed, rule-less OIDC bindings refused,
JWT secret strength enforced, trusted-proxy rate limiting, atomic key
operations, per-request permission reload with session invalidation,
audit log client IPs, web path traversal closed, operator Secret
ownership, CLI secrets off argv, CI verify stage, no CORS and no Swagger
by default, dependency advisories cleared.

Breaking: K8s pods need a projected token with audience onyx-vault;
the operator requires ONYX_VAULT_URLS; OIDC bindings need a claim rule;
short JWT secrets and http:// issuers are refused; CLI --password /
--passphrase / --share flags are replaced by --*-stdin, env or prompt;
the web tier requires ONYX_OIDC_SESSION_SECRET with OIDC; CORS and API
docs are off unless enabled; the Compose API port binds to loopback.

v0.6.0

v0.5.0

v0.4.3

v0.4.2

v0.4.1

v0.4.0

v0.3.1