CHANGELOG.md

# Changelog

## [1.43.0](https://github.com/jdx/fnox/compare/v1.42.1..v1.43.0) - 2026-10-25

### 🚀 Features

- **(audit)** add opt-in local access audit log by [@jdx](https://github.com/jdx) in [#1031](https://github.com/jdx/fnox/pull/1031)
- **(config)** add OAuth2, GitLab, Tailscale and Kubernetes lease backends by [@jdx](https://github.com/jdx) in [#1037](https://github.com/jdx/fnox/pull/1037)
- **(exec)** redact secret values from piped command output by [@jdx](https://github.com/jdx) in [#1028](https://github.com/jdx/fnox/pull/1028)
- **(exec)** add --only and --except to resolve a subset of secrets by [@jdx](https://github.com/jdx) in [#1030](https://github.com/jdx/fnox/pull/1030)
- **(fido2)** match prompts to the key's fingerprint, PIN or touch setup by [@jdx](https://github.com/jdx) in [#1027](https://github.com/jdx/fnox/pull/1027)
- **(keepass)** resolve KeePass field references by [@jdx](https://github.com/jdx) in [#1022](https://github.com/jdx/fnox/pull/1022)
- **(keepass)** read custom entry fields from references by [@jdx](https://github.com/jdx) in [#1025](https://github.com/jdx/fnox/pull/1025)
- **(lease)** revoke by ID prefix, backend or --all and list leases as JSON by [@jdx](https://github.com/jdx) in [#1036](https://github.com/jdx/fnox/pull/1036)
- **(proxy)** inject secrets into query parameters and match wildcard domains by [@jdx](https://github.com/jdx) in [#1026](https://github.com/jdx/fnox/pull/1026)
- **(proxy)** require a session password and refuse private destinations by [@jdx](https://github.com/jdx) in [#1038](https://github.com/jdx/fnox/pull/1038)
- **(proxy)** add --sandbox so the command can only reach the proxy by [@jdx](https://github.com/jdx) in [#1039](https://github.com/jdx/fnox/pull/1039)
- **(scan)** find resolved secret values, scan staged content, install pre-commit hook by [@jdx](https://github.com/jdx) in [#1029](https://github.com/jdx/fnox/pull/1029)
- **(set)** generate random secret values with --generate by [@jdx](https://github.com/jdx) in [#1032](https://github.com/jdx/fnox/pull/1032)

### 🐛 Bug Fixes

- **(daemon)** stop deriving the socket directory from TMPDIR by [@jdx](https://github.com/jdx) in [#1042](https://github.com/jdx/fnox/pull/1042)
- **(edit)** re-encrypt edited secrets with providers from imported configs by [@jdx](https://github.com/jdx) in [#1034](https://github.com/jdx/fnox/pull/1034)
- **(exec)** satisfy clippy unnecessary_fold without short-circuiting by [@jdx](https://github.com/jdx) in [#1035](https://github.com/jdx/fnox/pull/1035)

### 📦️ Dependency Updates

- update rust crate usage-rs to v7.1.2 by [@renovate[bot]](https://github.com/renovate[bot]) in [#1040](https://github.com/jdx/fnox/pull/1040)

## [1.42.1](https://github.com/jdx/fnox/compare/v1.42.0..v1.42.1) - 2026-10-23

### 🐛 Bug Fixes

- **(age)** embed translations in debug builds so CI-built binaries run by [@jdx](https://github.com/jdx) in [#1019](https://github.com/jdx/fnox/pull/1019)
- **(docs)** escape inline Tera delimiters so the docs build passes by [@jdx](https://github.com/jdx) in [#1018](https://github.com/jdx/fnox/pull/1018)
- **(env)** keep shell hooks working after a mise upgrade by [@jdx](https://github.com/jdx) in [#1016](https://github.com/jdx/fnox/pull/1016)
- **(env)** keep pwsh hooks working alongside starship by [@jdx](https://github.com/jdx) in [#1020](https://github.com/jdx/fnox/pull/1020)

### 🛡️ Security

- **(deps)** update communique, hk, mr-boxington in mise.lock by [@jdx](https://github.com/jdx) in [#1006](https://github.com/jdx/fnox/pull/1006)
- use jdx/workflows retry action by [@jdx](https://github.com/jdx) in [#1012](https://github.com/jdx/fnox/pull/1012)

### 📦️ Dependency Updates

- lock file maintenance by [@renovate[bot]](https://github.com/renovate[bot]) in [#1010](https://github.com/jdx/fnox/pull/1010)
- update github actions by [@renovate[bot]](https://github.com/renovate[bot]) in [#1008](https://github.com/jdx/fnox/pull/1008)
- update dependency usage to latest by [@renovate[bot]](https://github.com/renovate[bot]) in [#1009](https://github.com/jdx/fnox/pull/1009)
- lock file maintenance by [@renovate[bot]](https://github.com/renovate[bot]) in [#1011](https://github.com/jdx/fnox/pull/1011)
- update jdx/workflows action to v1.2.1 by [@renovate[bot]](https://github.com/renovate[bot]) in [#1013](https://github.com/jdx/fnox/pull/1013)
- lock file maintenance by [@renovate[bot]](https://github.com/renovate[bot]) in [#1014](https://github.com/jdx/fnox/pull/1014)
- update rust crate usage-rs to v7.1.1 by [@renovate[bot]](https://github.com/renovate[bot]) in [#1017](https://github.com/jdx/fnox/pull/1017)

## [1.42.0](https://github.com/jdx/fnox/compare/v1.41.0..v1.42.0) - 2026-10-20

### 🚀 Features

- **(export)** export only named secrets with positional KEY arguments by [@jdx](https://github.com/jdx) in [#1002](https://github.com/jdx/fnox/pull/1002)
- **(provider)** support managed identity in the azure-token lease by [@jdx](https://github.com/jdx) in [#1003](https://github.com/jdx/fnox/pull/1003)

### 🐛 Bug Fixes

- **(provider)** use the resolved AWS profile in the SSO login prompt by [@balintant](https://github.com/balintant) in [#998](https://github.com/jdx/fnox/pull/998)
- **(sync)** keep personal fnox.local.toml secrets across --local-file syncs by [@jdx](https://github.com/jdx) in [#1004](https://github.com/jdx/fnox/pull/1004)

### 📦️ Dependency Updates

- lock file maintenance by [@renovate[bot]](https://github.com/renovate[bot]) in [#995](https://github.com/jdx/fnox/pull/995)
- update rust crate usage-rs to v7.1.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#997](https://github.com/jdx/fnox/pull/997)
- update webpki-root-certs and rustls-webpki for eMudhra CA revocation by [@jdx](https://github.com/jdx) in [#1005](https://github.com/jdx/fnox/pull/1005)

## [1.41.0](https://github.com/jdx/fnox/compare/v1.40.0..v1.41.0) - 2026-10-19

### 🚀 Features

- **(config)** render Tera templates with the active profile in secret defaults and provider fields by [@jdx](https://github.com/jdx) in [#993](https://github.com/jdx/fnox/pull/993)
- **(gopass)** add gopass provider by [@jdx](https://github.com/jdx) in [#980](https://github.com/jdx/fnox/pull/980)

### 🐛 Bug Fixes

- **(exec)** stop resolving env = false secrets nothing needs by [@andersonkrs](https://github.com/andersonkrs) in [#984](https://github.com/jdx/fnox/pull/984)
- **(provider)** pass the configured profile to the default AWS SSO login prompt by [@balintant](https://github.com/balintant) in [#991](https://github.com/jdx/fnox/pull/991)

### 📚 Documentation

- **(cli)** show full help and examples in --help and rewrite the reference pages by [@jdx](https://github.com/jdx) in [#990](https://github.com/jdx/fnox/pull/990)
- **(provider)** rewrite provider and lease pages on a shared template by [@jdx](https://github.com/jdx) in [#988](https://github.com/jdx/fnox/pull/988)
- **(sync)** document TPM PIN protection and hardware-backed service tokens by [@andersonkrs](https://github.com/andersonkrs) in [#986](https://github.com/jdx/fnox/pull/986)
- reorganize and rewrite the guides, landing page, and README by [@jdx](https://github.com/jdx) in [#987](https://github.com/jdx/fnox/pull/987)

### 🛡️ Security

- **(docs)** make sponsor logos visible in light mode by [@jdx](https://github.com/jdx) in [#994](https://github.com/jdx/fnox/pull/994)

### 🔍 Other Changes

- pin perf-runner image by tag and stop automerging it by [@jdx](https://github.com/jdx) in [#982](https://github.com/jdx/fnox/pull/982)

### 📦️ Dependency Updates

- update rust crate xx to v2.6.3 by [@renovate[bot]](https://github.com/renovate[bot]) in [#983](https://github.com/jdx/fnox/pull/983)
- update jdx crates by [@renovate[bot]](https://github.com/renovate[bot]) in [#985](https://github.com/jdx/fnox/pull/985)

### New Contributors

- @balintant made their first contribution in [#991](https://github.com/jdx/fnox/pull/991)

## [1.40.0](https://github.com/jdx/fnox/compare/v1.39.0..v1.40.0) - 2026-10-16

### 🚀 Features

- **(1password)** read variables from 1Password Environments by [@jdx](https://github.com/jdx) in [#955](https://github.com/jdx/fnox/pull/955)
- **(bitwarden)** scope secrets by Bitwarden folder by [@andersonkrs](https://github.com/andersonkrs) in [#965](https://github.com/jdx/fnox/pull/965)
- **(kubernetes)** read Kubernetes Secrets by [@jdx](https://github.com/jdx) in [#953](https://github.com/jdx/fnox/pull/953)
- **(plain)** read values from a plaintext file by [@joshbode](https://github.com/joshbode) in [#954](https://github.com/jdx/fnox/pull/954)
- **(provider)** support custom providers written as Lua plugins by [@jdx](https://github.com/jdx) in [#968](https://github.com/jdx/fnox/pull/968)

### 🐛 Bug Fixes

- **(age)** prompt for a hardware PIN once per command by [@andersonkrs](https://github.com/andersonkrs) in [#978](https://github.com/jdx/fnox/pull/978)
- **(provider)** honor Azure service principal env vars and add managed identity by [@jdx](https://github.com/jdx) in [#964](https://github.com/jdx/fnox/pull/964)
- **(release)** wait for each crate on crates.io and finish partial publishes by [@jdx](https://github.com/jdx) in [#946](https://github.com/jdx/fnox/pull/946)
- **(set)** read piped stdin when --description is given by [@jdx](https://github.com/jdx) in [#976](https://github.com/jdx/fnox/pull/976)

### 🛡️ Security

- **(daemon)** support Windows via a named-pipe transport by [@jdx](https://github.com/jdx) in [#974](https://github.com/jdx/fnox/pull/974)
- **(deps)** update github actions by [@renovate[bot]](https://github.com/renovate[bot]) in [#970](https://github.com/jdx/fnox/pull/970)
- **(deps)** bump jactionlint to 2.2.0 and mbx to 1.24.0 by [@jdx](https://github.com/jdx) in [#971](https://github.com/jdx/fnox/pull/971)
- require zizmor in final by [@jdx](https://github.com/jdx) in [#961](https://github.com/jdx/fnox/pull/961)
- replace prettier with oxfmt by [@jdx](https://github.com/jdx) in [#977](https://github.com/jdx/fnox/pull/977)

### 🔍 Other Changes

- **(ci)** lint workflows with jactionlint by [@jdx](https://github.com/jdx) in [#957](https://github.com/jdx/fnox/pull/957)
- **(ci)** switch to jactionlint v2 and drop zizmor by [@jdx](https://github.com/jdx) in [#962](https://github.com/jdx/fnox/pull/962)
- **(release)** remove unused Claude Code CLI install from release-plz by [@jdx](https://github.com/jdx) in [#956](https://github.com/jdx/fnox/pull/956)
- **(release)** shorten minimum release age to 2 days by [@jdx](https://github.com/jdx) in [0661aa3](https://github.com/jdx/fnox/commit/0661aa380911993af5317ad5163cbf011a530295)
- use Namespace cache instead of rust-cache on Namespace runners by [@jdx](https://github.com/jdx) in [#947](https://github.com/jdx/fnox/pull/947)
- label release PRs with release by [@jdx](https://github.com/jdx) in [#950](https://github.com/jdx/fnox/pull/950)
- add shared release fix notifications by [@jdx](https://github.com/jdx) in [#958](https://github.com/jdx/fnox/pull/958)

### 📦️ Dependency Updates

- update dependency @anthropic-ai/claude-code to v2.1.285 by [@renovate[bot]](https://github.com/renovate[bot]) in [#949](https://github.com/jdx/fnox/pull/949)
- update rust crate demand to v2.4.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#951](https://github.com/jdx/fnox/pull/951)
- update rust crate usage-rs to v7 by [@jdx](https://github.com/jdx) in [#960](https://github.com/jdx/fnox/pull/960)
- lock file maintenance by [@renovate[bot]](https://github.com/renovate[bot]) in [#966](https://github.com/jdx/fnox/pull/966)
- update dependency hk to latest by [@renovate[bot]](https://github.com/renovate[bot]) in [#969](https://github.com/jdx/fnox/pull/969)
- update rust crate usage-rs to v7.0.1 by [@renovate[bot]](https://github.com/renovate[bot]) in [#972](https://github.com/jdx/fnox/pull/972)

### New Contributors

- @andersonkrs made their first contribution in [#978](https://github.com/jdx/fnox/pull/978)
- @joshbode made their first contribution in [#954](https://github.com/jdx/fnox/pull/954)

## [1.39.0](https://github.com/jdx/fnox/compare/v1.38.1..v1.39.0) - 2026-10-06

### 🚀 Features

- **(daemon)** add the fnox-client crate so other tools can read the daemon cache by [@jdx](https://github.com/jdx) in [#937](https://github.com/jdx/fnox/pull/937)
- **(env)** add fnox env --json to print the environment a command would get by [@jdx](https://github.com/jdx) in [#936](https://github.com/jdx/fnox/pull/936)

### 🔍 Other Changes

- **(ci)** update pr-closer to v1.3.0 by [@jdx](https://github.com/jdx) in [6119823](https://github.com/jdx/fnox/commit/6119823dc0feca2894e23a23a9ac4dbd60b32e64)

### 📦️ Dependency Updates

- lock file maintenance by [@renovate[bot]](https://github.com/renovate[bot]) in [#819](https://github.com/jdx/fnox/pull/819)
- update rust crate rusqlite to 0.40 by [@renovate[bot]](https://github.com/renovate[bot]) in [#941](https://github.com/jdx/fnox/pull/941)
- update dependency @anthropic-ai/claude-code to v2.1.284 by [@renovate[bot]](https://github.com/renovate[bot]) in [#940](https://github.com/jdx/fnox/pull/940)
- update jdx/mise-action action to v5 by [@renovate[bot]](https://github.com/renovate[bot]) in [#942](https://github.com/jdx/fnox/pull/942)
- update jdx/renovate-config action to v1.0.2 by [@renovate[bot]](https://github.com/renovate[bot]) in [#943](https://github.com/jdx/fnox/pull/943)
- update rust crate usage-rs to v6.12.1 by [@renovate[bot]](https://github.com/renovate[bot]) in [#944](https://github.com/jdx/fnox/pull/944)
- update dependency usage to latest by [@renovate[bot]](https://github.com/renovate[bot]) in [#945](https://github.com/jdx/fnox/pull/945)

## [1.38.1](https://github.com/jdx/fnox/compare/v1.38.0..v1.38.1) - 2026-10-05

### 🐛 Bug Fixes

- **(ci)** restore Windows release builds with native Perl by [@jdx](https://github.com/jdx) in [#934](https://github.com/jdx/fnox/pull/934)

## [1.38.0](https://github.com/jdx/fnox/compare/v1.37.0..v1.38.0) - 2026-10-05

### 🚀 Features

- **(daemon)** clear or refresh individual cached secrets by [@jdx](https://github.com/jdx) in [#930](https://github.com/jdx/fnox/pull/930)

### 🐛 Bug Fixes

- **(proton-pass)** use info for connection checks by [@jdx](https://github.com/jdx) in [#932](https://github.com/jdx/fnox/pull/932)

### 🔍 Other Changes

- update pr-closer policy by [@jdx](https://github.com/jdx) in [e6b15ec](https://github.com/jdx/fnox/commit/e6b15ec29b5feca42f0f88badb76a9b3a0a5caf2)
- verify release signing with pinned Packslip v1.6.0 by [@jdx](https://github.com/jdx) in [#933](https://github.com/jdx/fnox/pull/933)

## [1.37.0](https://github.com/jdx/fnox/compare/v1.36.0..v1.37.0) - 2026-10-04

### 🚀 Features

- **(config)** support project .config files by [@jdx](https://github.com/jdx) in [#925](https://github.com/jdx/fnox/pull/925)
- **(keepass)** prompt for database password when unset by [@jdx](https://github.com/jdx) in [#912](https://github.com/jdx/fnox/pull/912)
- **(provider)** add read-only Enpass vault provider by [@jdx](https://github.com/jdx) in [#928](https://github.com/jdx/fnox/pull/928)

### 📚 Documentation

- restrict AI replies on Discussions and Issues and note the instant ban by [@jdx](https://github.com/jdx) in [#923](https://github.com/jdx/fnox/pull/923)

### 🛡️ Security

- **(deps)** update rust crates by [@renovate[bot]](https://github.com/renovate[bot]) in [#918](https://github.com/jdx/fnox/pull/918)

### 🔍 Other Changes

- **(entire)** store checkpoints in a private repository by [@jdx](https://github.com/jdx) in [9876031](https://github.com/jdx/fnox/commit/9876031ac60bf6fd9429acc56899c0924b43df1e)
- **(entire)** commit codex session hooks by [@jdx](https://github.com/jdx) in [eb8f990](https://github.com/jdx/fnox/commit/eb8f9908ba5e9c5bb6aa1055031c1cb50722e1e8)
- **(entire)** commit claude session hooks by [@jdx](https://github.com/jdx) in [77df3e4](https://github.com/jdx/fnox/commit/77df3e4854b03c3dfc68eb9eb327f434f4a05a2f)
- **(entire)** restore lower-cost trail findings by [@jdx](https://github.com/jdx) in [c7b83a8](https://github.com/jdx/fnox/commit/c7b83a8419bcdcda7a5fd778589e1cfb0206a357)
- **(entire)** format trail runner configs with prettier by [@jdx](https://github.com/jdx) in [#920](https://github.com/jdx/fnox/pull/920)
- limit each contributor to one open draft PR by [@jdx](https://github.com/jdx) in [#921](https://github.com/jdx/fnox/pull/921)

### 📦️ Dependency Updates

- update rust crate usage-rs to v6.12.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#914](https://github.com/jdx/fnox/pull/914)
- update jdx/renovate-config action to v1.0.1 by [@renovate[bot]](https://github.com/renovate[bot]) in [#917](https://github.com/jdx/fnox/pull/917)
- update dependency @anthropic-ai/claude-code to v2.1.278 by [@renovate[bot]](https://github.com/renovate[bot]) in [#919](https://github.com/jdx/fnox/pull/919)

## [1.36.0](https://github.com/jdx/fnox/compare/v1.35.3..v1.36.0) - 2026-09-28

### 🚀 Features

- ship a fnox agent skill with packslip by [@jdx](https://github.com/jdx) in [#910](https://github.com/jdx/fnox/pull/910)

### 🐛 Bug Fixes

- **(reencrypt)** batch encryption by provider by [@davdroman](https://github.com/davdroman) in [#880](https://github.com/jdx/fnox/pull/880)
- **(yubikey)** compute HMAC challenge frame CRC over payload only by [@mufasa71](https://github.com/mufasa71) in [#905](https://github.com/jdx/fnox/pull/905)

### ⚡ Performance

- **(hook-env)** make the per-prompt shell hook about 2x faster by [@jdx](https://github.com/jdx) in [#907](https://github.com/jdx/fnox/pull/907)
- **(release)** start fnox about 1 ms faster on Linux by linking non-PIE by [@jdx](https://github.com/jdx) in [#908](https://github.com/jdx/fnox/pull/908)

### 🛡️ Security

- **(deps)** update dependency @anthropic-ai/claude-code to v2.1.272 by [@renovate[bot]](https://github.com/renovate[bot]) in [#889](https://github.com/jdx/fnox/pull/889)
- explain secret providers and development workflows plainly by [@jdx](https://github.com/jdx) in [#899](https://github.com/jdx/fnox/pull/899)
- remove Entire trail runners by [@jdx](https://github.com/jdx) in [#902](https://github.com/jdx/fnox/pull/902)

### 🔍 Other Changes

- **(ci)** comment on a discussion when the PR implementing it merges by [@jdx](https://github.com/jdx) in [#882](https://github.com/jdx/fnox/pull/882)
- float jdx tools and aube on latest without a release-age delay by [@jdx](https://github.com/jdx) in [#903](https://github.com/jdx/fnox/pull/903)
- accept pull request titles whose description starts with an acronym by [@jdx](https://github.com/jdx) in [24d33bf](https://github.com/jdx/fnox/commit/24d33bf030f94ff1b096640e0777f18a16fe374c)

### 📦️ Dependency Updates

- update rust crate usage-rs to v6.9.1 by [@renovate[bot]](https://github.com/renovate[bot]) in [#890](https://github.com/jdx/fnox/pull/890)
- update rust crate console to v0.16.6 by [@renovate[bot]](https://github.com/renovate[bot]) in [#885](https://github.com/jdx/fnox/pull/885)
- update dependency usage to v6.11.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#891](https://github.com/jdx/fnox/pull/891)
- update zizmorcore/zizmor-action action to v0.6.4 by [@renovate[bot]](https://github.com/renovate[bot]) in [#888](https://github.com/jdx/fnox/pull/888)
- update dependency communique to latest by [@renovate[bot]](https://github.com/renovate[bot]) in [#883](https://github.com/jdx/fnox/pull/883)
- update jdx/packslip action to v1.2.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#892](https://github.com/jdx/fnox/pull/892)
- update rust crate rmcp to v3.3.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#894](https://github.com/jdx/fnox/pull/894)
- update dependency github:infisical/cli to latest by [@renovate[bot]](https://github.com/renovate[bot]) in [#884](https://github.com/jdx/fnox/pull/884)
- update rust crate toml_edit to v0.25.15 by [@renovate[bot]](https://github.com/renovate[bot]) in [#887](https://github.com/jdx/fnox/pull/887)
- update rust crate rustls to v0.23.45 by [@renovate[bot]](https://github.com/renovate[bot]) in [#886](https://github.com/jdx/fnox/pull/886)
- update rust crate tera to v2.4.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#895](https://github.com/jdx/fnox/pull/895)
- update rust crate keepass to 0.14 by [@renovate[bot]](https://github.com/renovate[bot]) in [#893](https://github.com/jdx/fnox/pull/893)
- update dependency aube to latest by [@renovate[bot]](https://github.com/renovate[bot]) in [#897](https://github.com/jdx/fnox/pull/897)
- move to keepass 0.15 and rmcp 3.4 so fnox builds again by [@jdx](https://github.com/jdx) in [#898](https://github.com/jdx/fnox/pull/898)
- bump jdx/renovate-config workflows to c736149 by [@jdx](https://github.com/jdx) in [f87b0e5](https://github.com/jdx/fnox/commit/f87b0e5faeb32c7f150e855ece5715e94d8ba381)
- update rust crate usage-rs to v6.11.1 by [@renovate[bot]](https://github.com/renovate[bot]) in [#900](https://github.com/jdx/fnox/pull/900)
- bump jdx/renovate-config workflows to aa49efc by [@jdx](https://github.com/jdx) in [5ff5b72](https://github.com/jdx/fnox/commit/5ff5b72bacbe4c1f6d4e46289aacfd44123b50d8)
- bump jdx/renovate-config workflows to 5b46432 by [@jdx](https://github.com/jdx) in [e2d92df](https://github.com/jdx/fnox/commit/e2d92df801c1b1a6d325b489e05ac737c548c11a)
- pin jdx/renovate-config workflows to v1.0.0 by [@jdx](https://github.com/jdx) in [8c052ae](https://github.com/jdx/fnox/commit/8c052ae3e588757e4163d49ac45f97254fe0e672)
- update communique to 1.4.2 in mise.lock by [@jdx](https://github.com/jdx) in [0f5d166](https://github.com/jdx/fnox/commit/0f5d1664b476838ac7ef009a80dcf0fa7afb5ef2)
- update rust crate demand to v2.2.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#904](https://github.com/jdx/fnox/pull/904)
- update rust crate demand to v2.3.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#906](https://github.com/jdx/fnox/pull/906)
- update jdx/packslip action to v1.4.0 by [@jdx](https://github.com/jdx) in [#909](https://github.com/jdx/fnox/pull/909)

### New Contributors

- @mufasa71 made their first contribution in [#905](https://github.com/jdx/fnox/pull/905)

## [1.35.3](https://github.com/jdx/fnox/compare/v1.35.2..v1.35.3) - 2026-09-21

### 🛡️ Security

- **(deps)** update dependency @anthropic-ai/claude-code to v2.1.263 by [@renovate[bot]](https://github.com/renovate[bot]) in [#852](https://github.com/jdx/fnox/pull/852)
- **(deps)** update dependency aube to latest by [@renovate[bot]](https://github.com/renovate[bot]) in [#860](https://github.com/jdx/fnox/pull/860)
- **(deps)** update node.js to 24 by [@renovate[bot]](https://github.com/renovate[bot]) in [#866](https://github.com/jdx/fnox/pull/866)
- add entire trail runners by [@jdx](https://github.com/jdx) in [#874](https://github.com/jdx/fnox/pull/874)

### 🔍 Other Changes

- remove entire and codex agent hooks by [@jdx](https://github.com/jdx) in [9ed03ee](https://github.com/jdx/fnox/commit/9ed03ee6a3f368e925e131d3b2de7bda042a24b9)
- stop compiling cargo-edit in every CI job by [@jdx](https://github.com/jdx) in [#877](https://github.com/jdx/fnox/pull/877)
- re-pin renovate-config reusable workflows to current main by [@jdx](https://github.com/jdx) in [b52ad4b](https://github.com/jdx/fnox/commit/b52ad4be7d4a063f31359c4d73fad9603e3160ec)

### 📦️ Dependency Updates

- bump mbx to 1.11.1 by [@jdx](https://github.com/jdx) in [6fead09](https://github.com/jdx/fnox/commit/6fead09c613698dc6b51e4ca00e59376d9e34c8d)
- update rust crate indexmap to v2.14.2 by [@renovate[bot]](https://github.com/renovate[bot]) in [#849](https://github.com/jdx/fnox/pull/849)
- update dependency github:jdx/tak to v0.0.10 by [@renovate[bot]](https://github.com/renovate[bot]) in [#848](https://github.com/jdx/fnox/pull/848)
- update rust crate rustls to v0.23.44 by [@renovate[bot]](https://github.com/renovate[bot]) in [#850](https://github.com/jdx/fnox/pull/850)
- update rust crate dirs to v7 by [@renovate[bot]](https://github.com/renovate[bot]) in [#857](https://github.com/jdx/fnox/pull/857)
- update rust crate tokio-rustls to v0.26.5 by [@renovate[bot]](https://github.com/renovate[bot]) in [#851](https://github.com/jdx/fnox/pull/851)
- update rust crate usage-rs to v6.8.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#855](https://github.com/jdx/fnox/pull/855)
- update dependency github:infisical/cli to latest by [@renovate[bot]](https://github.com/renovate[bot]) in [#859](https://github.com/jdx/fnox/pull/859)
- update rust crate ctap-hid-fido2 to v3.6.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#854](https://github.com/jdx/fnox/pull/854)
- update rust crate tabled to 0.22 by [@renovate[bot]](https://github.com/renovate[bot]) in [#856](https://github.com/jdx/fnox/pull/856)
- update dependency age to latest by [@renovate[bot]](https://github.com/renovate[bot]) in [#858](https://github.com/jdx/fnox/pull/858)
- update dependency cargo-binstall to latest by [@renovate[bot]](https://github.com/renovate[bot]) in [#861](https://github.com/jdx/fnox/pull/861)
- update dependency git-cliff to latest by [@renovate[bot]](https://github.com/renovate[bot]) in [#862](https://github.com/jdx/fnox/pull/862)
- update dependency hk to v2 by [@renovate[bot]](https://github.com/renovate[bot]) in [#867](https://github.com/jdx/fnox/pull/867)
- update dependency vault to latest by [@renovate[bot]](https://github.com/renovate[bot]) in [#865](https://github.com/jdx/fnox/pull/865)
- update dependency shfmt to latest by [@renovate[bot]](https://github.com/renovate[bot]) in [#864](https://github.com/jdx/fnox/pull/864)
- update dependency usage to v6.9.1 by [@renovate[bot]](https://github.com/renovate[bot]) in [#853](https://github.com/jdx/fnox/pull/853)
- update rust crate reqwest to v0.13.5 by [@renovate[bot]](https://github.com/renovate[bot]) in [#871](https://github.com/jdx/fnox/pull/871)
- update dependency github:infisical/cli to latest by [@renovate[bot]](https://github.com/renovate[bot]) in [#869](https://github.com/jdx/fnox/pull/869)
- update dependency aube to latest by [@renovate[bot]](https://github.com/renovate[bot]) in [#868](https://github.com/jdx/fnox/pull/868)
- update dependency @anthropic-ai/claude-code to v2.1.266 by [@renovate[bot]](https://github.com/renovate[bot]) in [#872](https://github.com/jdx/fnox/pull/872)
- update dependency hk to latest by [@renovate[bot]](https://github.com/renovate[bot]) in [#870](https://github.com/jdx/fnox/pull/870)
- update rust crate xx to v2.6.2 by [@renovate[bot]](https://github.com/renovate[bot]) in [#875](https://github.com/jdx/fnox/pull/875)
- bump mr-boxington to 1.14.0 and drop the mbx fallback docs by [@jdx](https://github.com/jdx) in [#876](https://github.com/jdx/fnox/pull/876)
- migrate hk.pkl to the hk 2 config format by [@jdx](https://github.com/jdx) in [#878](https://github.com/jdx/fnox/pull/878)
- drop the stale aube macos-x64 row from mise.lock by [@jdx](https://github.com/jdx) in [#879](https://github.com/jdx/fnox/pull/879)

## [1.35.2](https://github.com/jdx/fnox/compare/v1.35.1..v1.35.2) - 2026-09-13

### 🐛 Bug Fixes

- **(azure-sm)** accept missing connection probe by [@any-victor](https://github.com/any-victor) in [#829](https://github.com/jdx/fnox/pull/829)
- **(config)** clarify ci matrix job names by [@jdx](https://github.com/jdx) in [#845](https://github.com/jdx/fnox/pull/845)
- **(config)** expand imports when loading the global config by [@JoacoEsteban](https://github.com/JoacoEsteban) in [#818](https://github.com/jdx/fnox/pull/818)
- **(env)** preserve dependencies across daemon cache hits by [@jdx](https://github.com/jdx) in [#838](https://github.com/jdx/fnox/pull/838)
- **(env)** retry incomplete shell secret loads by [@jdx](https://github.com/jdx) in [#839](https://github.com/jdx/fnox/pull/839)

### 📚 Documentation

- overhaul guides and redesign the documentation site by [@jdx](https://github.com/jdx) in [#817](https://github.com/jdx/fnox/pull/817)
- reserve version and changelog updates for releases by [@jdx](https://github.com/jdx) in [e1f60e3](https://github.com/jdx/fnox/commit/e1f60e30ff0fde14b0dcc8e7c380a8ade6e1d8b6)
- write PR titles and descriptions for release notes by [@jdx](https://github.com/jdx) in [#842](https://github.com/jdx/fnox/pull/842)

### 🛡️ Security

- **(deps)** update dependency @anthropic-ai/claude-code to v2.1.252 by [@renovate[bot]](https://github.com/renovate[bot]) in [#826](https://github.com/jdx/fnox/pull/826)

### 🔍 Other Changes

- **(ci)** isolate mise state in performance jobs by [@jdx](https://github.com/jdx) in [#815](https://github.com/jdx/fnox/pull/815)
- **(ci)** use self-repository workflow references by [@jdx](https://github.com/jdx) in [#840](https://github.com/jdx/fnox/pull/840)
- **(release)** publish native completions in packslip by [@jdx](https://github.com/jdx) in [#814](https://github.com/jdx/fnox/pull/814)

### 📦️ Dependency Updates

- bump mr-boxington to 1.8.3 by [@jdx](https://github.com/jdx) in [#816](https://github.com/jdx/fnox/pull/816)
- update rust crate indexmap to v2.14.1 by [@renovate[bot]](https://github.com/renovate[bot]) in [#821](https://github.com/jdx/fnox/pull/821)
- update zizmorcore/zizmor-action action to v0.6.3 by [@renovate[bot]](https://github.com/renovate[bot]) in [#825](https://github.com/jdx/fnox/pull/825)
- update rust crate which to v8.0.6 by [@renovate[bot]](https://github.com/renovate[bot]) in [#824](https://github.com/jdx/fnox/pull/824)
- update rust crate rmcp to v3.2.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#832](https://github.com/jdx/fnox/pull/832)
- update rust crate rcgen to v0.14.10 by [@renovate[bot]](https://github.com/renovate[bot]) in [#823](https://github.com/jdx/fnox/pull/823)
- update rust crate google-cloud-secretmanager-v1 to v1.13.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#828](https://github.com/jdx/fnox/pull/828)
- update rust crate tera to v2.3.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#833](https://github.com/jdx/fnox/pull/833)
- update jdx/renovate-config digest to 8cabc2e by [@renovate[bot]](https://github.com/renovate[bot]) in [#830](https://github.com/jdx/fnox/pull/830)
- update dependency @anthropic-ai/claude-code to v2.1.258 by [@renovate[bot]](https://github.com/renovate[bot]) in [#834](https://github.com/jdx/fnox/pull/834)
- update rust crate usage-rs to v6.6.1 by [@renovate[bot]](https://github.com/renovate[bot]) in [#835](https://github.com/jdx/fnox/pull/835)
- update dependency usage to v6.8.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#827](https://github.com/jdx/fnox/pull/827)
- update actions/deploy-pages action to v5 by [@renovate[bot]](https://github.com/renovate[bot]) in [#836](https://github.com/jdx/fnox/pull/836)
- ignore aws sdk renovate updates by [@jdx](https://github.com/jdx) in [#843](https://github.com/jdx/fnox/pull/843)
- update communique to v1.4.0 by [@jdx](https://github.com/jdx) in [#844](https://github.com/jdx/fnox/pull/844)

### New Contributors

- @any-victor made their first contribution in [#829](https://github.com/jdx/fnox/pull/829)
- @JoacoEsteban made their first contribution in [#818](https://github.com/jdx/fnox/pull/818)

## [1.35.1](https://github.com/jdx/fnox/compare/v1.35.0..v1.35.1) - 2026-09-05

### 📚 Documentation

- complete social and search metadata by [@jdx](https://github.com/jdx) in [#806](https://github.com/jdx/fnox/pull/806)
- generate page-specific social preview images by [@jdx](https://github.com/jdx) in [#811](https://github.com/jdx/fnox/pull/811)

### 🛡️ Security

- add open graph share image by [@jdx](https://github.com/jdx) in [#803](https://github.com/jdx/fnox/pull/803)
- configure Entire search by [@jdx](https://github.com/jdx) in [#805](https://github.com/jdx/fnox/pull/805)

### 🔍 Other Changes

- **(ci)** bump packslip to v1.1.1 by [@jdx](https://github.com/jdx) in [#812](https://github.com/jdx/fnox/pull/812)
- **(release)** publish a signed packslip with each release by [@jdx](https://github.com/jdx) in [#807](https://github.com/jdx/fnox/pull/807)
- **(release)** bump packslip action to v1.0.0 by [@jdx](https://github.com/jdx) in [#810](https://github.com/jdx/fnox/pull/810)
- enforce conventional commits by [@jdx](https://github.com/jdx) in [#809](https://github.com/jdx/fnox/pull/809)

### 📦️ Dependency Updates

- bump mr-boxington to 1.8.1 by [@jdx](https://github.com/jdx) in [#808](https://github.com/jdx/fnox/pull/808)

## [1.35.0](https://github.com/jdx/fnox/compare/v1.34.1..v1.35.0) - 2026-09-03

### 🚀 Features

- **(config)** add selective profile inheritance by [@jdx](https://github.com/jdx) in [#770](https://github.com/jdx/fnox/pull/770)

### 🐛 Bug Fixes

- **(check)** batch Age secret resolution by [@davdroman](https://github.com/davdroman) in [#779](https://github.com/jdx/fnox/pull/779)
- **(config)** silence intentional default fallbacks by [@jdx](https://github.com/jdx) in [#771](https://github.com/jdx/fnox/pull/771)
- **(daemon)** detach background daemon from client cwd by [@jdx](https://github.com/jdx) in [#795](https://github.com/jdx/fnox/pull/795)
- **(sync)** refresh local caches from current sources by [@davdroman](https://github.com/davdroman) in [#774](https://github.com/jdx/fnox/pull/774)

### 📚 Documentation

- fix prose and stale content in docs and cli help by [@jdx](https://github.com/jdx) in [#798](https://github.com/jdx/fnox/pull/798)

### ⚡ Performance

- **(ci)** reuse appliance-local mbx cache by [@jdx](https://github.com/jdx) in [#799](https://github.com/jdx/fnox/pull/799)
- **(env)** skip redundant secret reloads by [@jdx](https://github.com/jdx) in [#766](https://github.com/jdx/fnox/pull/766)

### 🛡️ Security

- **(ci)** bump mr-boxington action by [@jdx](https://github.com/jdx) in [#777](https://github.com/jdx/fnox/pull/777)

### 🔍 Other Changes

- **(ci)** adopt mbx 0.5.4 by [@jdx](https://github.com/jdx) in [#775](https://github.com/jdx/fnox/pull/775)
- **(ci)** pin mr-boxington-action v1.0.1 by [@jdx](https://github.com/jdx) in [#776](https://github.com/jdx/fnox/pull/776)
- **(ci)** update mbx to 0.6.0 by [@jdx](https://github.com/jdx) in [#778](https://github.com/jdx/fnox/pull/778)
- **(ci)** fail closed without notarization credentials by [@jdx](https://github.com/jdx) in [#781](https://github.com/jdx/fnox/pull/781)
- **(ci)** use mbx server cache for trusted builds by [@jdx](https://github.com/jdx) in [#786](https://github.com/jdx/fnox/pull/786)
- **(ci)** update mbx to 1.3.2 by [@jdx](https://github.com/jdx) in [#791](https://github.com/jdx/fnox/pull/791)
- **(ci)** update mbx to 1.4.1 by [@jdx](https://github.com/jdx) in [#797](https://github.com/jdx/fnox/pull/797)
- **(ci)** update performance runner image by [@jdx](https://github.com/jdx) in [#801](https://github.com/jdx/fnox/pull/801)
- **(perf)** move benchmarks to dedicated runner by [@jdx](https://github.com/jdx) in [#783](https://github.com/jdx/fnox/pull/783)
- **(perf)** bump tak to 0.0.9 by [@jdx](https://github.com/jdx) in [#784](https://github.com/jdx/fnox/pull/784)
- **(release)** improve sponsor message by [@jdx](https://github.com/jdx) in [#787](https://github.com/jdx/fnox/pull/787)
- back mbx with the GitHub Actions cache alone by [@jdx](https://github.com/jdx) in [#780](https://github.com/jdx/fnox/pull/780)
- adopt mr-boxington 1.1 cargo shim by [@jdx](https://github.com/jdx) in [#782](https://github.com/jdx/fnox/pull/782)
- update mr-boxington to 1.3.0 by [@jdx](https://github.com/jdx) in [#785](https://github.com/jdx/fnox/pull/785)
- route mbx caching by runner provider by [@jdx](https://github.com/jdx) in [#800](https://github.com/jdx/fnox/pull/800)
- restore rust-cache by [@jdx](https://github.com/jdx) in [#802](https://github.com/jdx/fnox/pull/802)

### 📦️ Dependency Updates

- bump tak and mbx by [@jdx](https://github.com/jdx) in [#772](https://github.com/jdx/fnox/pull/772)
- update jdx/mise-action action to v4.3.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#790](https://github.com/jdx/fnox/pull/790)
- update dependency usage to v6.6.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#789](https://github.com/jdx/fnox/pull/789)
- update dependency @anthropic-ai/claude-code to v2.1.245 by [@renovate[bot]](https://github.com/renovate[bot]) in [#788](https://github.com/jdx/fnox/pull/788)
- update dependency usage to v6.6.1 by [@renovate[bot]](https://github.com/renovate[bot]) in [#792](https://github.com/jdx/fnox/pull/792)
- update dependency @anthropic-ai/claude-code to v2.1.246 by [@renovate[bot]](https://github.com/renovate[bot]) in [#794](https://github.com/jdx/fnox/pull/794)

## [1.34.1](https://github.com/jdx/fnox/compare/v1.34.0..v1.34.1) - 2026-08-26

### 🐛 Bug Fixes

- **(config)** encode html in generated documentation by [@jdx](https://github.com/jdx) in [#739](https://github.com/jdx/fnox/pull/739)
- **(config)** reject unknown profiles by [@jdx](https://github.com/jdx) in [#741](https://github.com/jdx/fnox/pull/741)
- **(daemon)** resolve interactive cache misses in foreground by [@jdx](https://github.com/jdx) in [#743](https://github.com/jdx/fnox/pull/743)
- **(export)** preserve dollar signs in dotenv output by [@jdx](https://github.com/jdx) in [#746](https://github.com/jdx/fnox/pull/746)
- **(sync)** prompt once for age batch decryption by [@jdx](https://github.com/jdx) in [#755](https://github.com/jdx/fnox/pull/755)

### 📚 Documentation

- **(sync)** call out the golden path and add hardware-backed decryption by [@jdx](https://github.com/jdx) in [#748](https://github.com/jdx/fnox/pull/748)

### 🛡️ Security

- handle unavailable secret providers by [@jdx](https://github.com/jdx) in [#757](https://github.com/jdx/fnox/pull/757)

### 🔍 Other Changes

- **(ci)** adopt mbx for Rust builds by [@jdx](https://github.com/jdx) in [#749](https://github.com/jdx/fnox/pull/749)
- **(ci)** isolate mbx OIDC permissions by [@jdx](https://github.com/jdx) in [#758](https://github.com/jdx/fnox/pull/758)
- **(env)** harden secret injection boundaries by [@jdx](https://github.com/jdx) in [#763](https://github.com/jdx/fnox/pull/763)
- **(sponsors)** replace 37signals with omacom foundation by [@jdx](https://github.com/jdx) in [#754](https://github.com/jdx/fnox/pull/754)
- manage usage cli with mise by [@jdx](https://github.com/jdx) in [#737](https://github.com/jdx/fnox/pull/737)
- generate release notes before publishing by [@jdx](https://github.com/jdx) in [#745](https://github.com/jdx/fnox/pull/745)
- seed mbx cache for fork PRs by [@jdx](https://github.com/jdx) in [#762](https://github.com/jdx/fnox/pull/762)
- notarize the macOS release binary by [@jdx](https://github.com/jdx) in [#764](https://github.com/jdx/fnox/pull/764)

### 📦️ Dependency Updates

- lock file maintenance by [@renovate[bot]](https://github.com/renovate[bot]) in [#744](https://github.com/jdx/fnox/pull/744)
- bump usage to 6.4.0 by [@jdx](https://github.com/jdx) in [#747](https://github.com/jdx/fnox/pull/747)
- update jdx/mise-action action to v4.2.5 by [@renovate[bot]](https://github.com/renovate[bot]) in [#750](https://github.com/jdx/fnox/pull/750)
- update dependency @anthropic-ai/claude-code to v2.1.234 by [@renovate[bot]](https://github.com/renovate[bot]) in [#751](https://github.com/jdx/fnox/pull/751)
- update rust crate demand to v2.1.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#752](https://github.com/jdx/fnox/pull/752)
- update dependency @anthropic-ai/claude-code to v2.1.235 by [@renovate[bot]](https://github.com/renovate[bot]) in [#753](https://github.com/jdx/fnox/pull/753)
- update dependency usage to v6.4.1 by [@renovate[bot]](https://github.com/renovate[bot]) in [#759](https://github.com/jdx/fnox/pull/759)

## [1.34.0](https://github.com/jdx/fnox/compare/v1.33.1..v1.34.0) - 2026-08-23

### 🚀 Features

- **(keeper-sm)** add secrets manager provider by [@jdx](https://github.com/jdx) in [#720](https://github.com/jdx/fnox/pull/720)

### 🐛 Bug Fixes

- **(env)** clean up as_file secrets on zsh exit by [@jdx](https://github.com/jdx) in [#724](https://github.com/jdx/fnox/pull/724)
- **(fido2)** prompt once for batch resolution by [@jdx](https://github.com/jdx) in [#732](https://github.com/jdx/fnox/pull/732)
- **(hook-env)** keep auth output off stdout by [@halms](https://github.com/halms) in [#713](https://github.com/jdx/fnox/pull/713)
- **(mcp)** include cache hints in tool list by [@jdx](https://github.com/jdx) in [#727](https://github.com/jdx/fnox/pull/727)
- **(set)** preserve file secret newlines by [@jdx](https://github.com/jdx) in [#730](https://github.com/jdx/fnox/pull/730)

### 🚜 Refactor

- **(settings)** replace settings.toml codegen with usage-config derive by [@jdx](https://github.com/jdx) in [#734](https://github.com/jdx/fnox/pull/734)
- replace clap with usage by [@jdx](https://github.com/jdx) in [#725](https://github.com/jdx/fnox/pull/725)

### 📚 Documentation

- prevent mobile banner layout shifts by [@jdx](https://github.com/jdx) in [#731](https://github.com/jdx/fnox/pull/731)
- document ${DEFAULT} syntax by [@arthurfiorette](https://github.com/arthurfiorette) in [#733](https://github.com/jdx/fnox/pull/733)

### 📦️ Dependency Updates

- update dependency @anthropic-ai/claude-code to v2.1.227 by [@renovate[bot]](https://github.com/renovate[bot]) in [#717](https://github.com/jdx/fnox/pull/717)
- update swatinem/rust-cache digest to 6323deb by [@renovate[bot]](https://github.com/renovate[bot]) in [#716](https://github.com/jdx/fnox/pull/716)
- update jdx/renovate-config digest to 75abd12 by [@renovate[bot]](https://github.com/renovate[bot]) in [#721](https://github.com/jdx/fnox/pull/721)
- update dependency @anthropic-ai/claude-code to v2.1.228 by [@renovate[bot]](https://github.com/renovate[bot]) in [#722](https://github.com/jdx/fnox/pull/722)

### New Contributors

- @arthurfiorette made their first contribution in [#733](https://github.com/jdx/fnox/pull/733)

## [1.33.1](https://github.com/jdx/fnox/compare/v1.33.0..v1.33.1) - 2026-08-17

### 🐛 Bug Fixes

- **(set)** preserve existing remote key name by [@jdx](https://github.com/jdx) in [#712](https://github.com/jdx/fnox/pull/712)

### 📚 Documentation

- fix sponsor logo sizing by [@jdx](https://github.com/jdx) in [#714](https://github.com/jdx/fnox/pull/714)

### 🛡️ Security

- **(deps)** update dependency @anthropic-ai/claude-code to v2.1.221 by [@renovate[bot]](https://github.com/renovate[bot]) in [#705](https://github.com/jdx/fnox/pull/705)

### 📦️ Dependency Updates

- simplify cargo version requirements by [@jdx](https://github.com/jdx) in [#694](https://github.com/jdx/fnox/pull/694)
- update rust crate usage-lib to v5.1.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#695](https://github.com/jdx/fnox/pull/695)
- update rust crate google-cloud-secretmanager-v1 to v1.12.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#706](https://github.com/jdx/fnox/pull/706)
- update jdx/mise-action action to v4.2.4 by [@renovate[bot]](https://github.com/renovate[bot]) in [#697](https://github.com/jdx/fnox/pull/697)
- update rust crate aho-corasick to v1.1.5 by [@renovate[bot]](https://github.com/renovate[bot]) in [#698](https://github.com/jdx/fnox/pull/698)
- update rust crate data-encoding to v2.11.1 by [@renovate[bot]](https://github.com/renovate[bot]) in [#700](https://github.com/jdx/fnox/pull/700)
- update rust crate clap to v4.6.5 by [@renovate[bot]](https://github.com/renovate[bot]) in [#699](https://github.com/jdx/fnox/pull/699)
- update rust crate ignore to v0.4.32 by [@renovate[bot]](https://github.com/renovate[bot]) in [#701](https://github.com/jdx/fnox/pull/701)
- update rust crate keepass to v0.13.20 by [@renovate[bot]](https://github.com/renovate[bot]) in [#702](https://github.com/jdx/fnox/pull/702)
- update zizmorcore/zizmor-action action to v0.6.2 by [@renovate[bot]](https://github.com/renovate[bot]) in [#704](https://github.com/jdx/fnox/pull/704)
- update rust crate rustls to v0.23.43 by [@renovate[bot]](https://github.com/renovate[bot]) in [#703](https://github.com/jdx/fnox/pull/703)
- update rust crate base64 to v0.23.1 by [@renovate[bot]](https://github.com/renovate[bot]) in [#707](https://github.com/jdx/fnox/pull/707)
- update rust crate globset to v0.4.20 by [@renovate[bot]](https://github.com/renovate[bot]) in [#708](https://github.com/jdx/fnox/pull/708)
- update dependency @anthropic-ai/claude-code to v2.1.222 by [@renovate[bot]](https://github.com/renovate[bot]) in [#710](https://github.com/jdx/fnox/pull/710)
- update rust crate ignore to v0.4.33 by [@renovate[bot]](https://github.com/renovate[bot]) in [#709](https://github.com/jdx/fnox/pull/709)
- lock file maintenance by [@renovate[bot]](https://github.com/renovate[bot]) in [#715](https://github.com/jdx/fnox/pull/715)

## [1.33.0](https://github.com/jdx/fnox/compare/v1.32.0..v1.33.0) - 2026-08-09

### 🚀 Features

- **(bitwarden)** support custom fields by [@jdx](https://github.com/jdx) in [#690](https://github.com/jdx/fnox/pull/690)

### 🐛 Bug Fixes

- **(bitwarden)** support slashes in custom fields by [@jdx](https://github.com/jdx) in [#693](https://github.com/jdx/fnox/pull/693)
- **(ci)** update Infisical project bootstrap by [@jdx](https://github.com/jdx) in [#675](https://github.com/jdx/fnox/pull/675)

### 📚 Documentation

- **(sync)** clarify personal age provider setup by [@jdx](https://github.com/jdx) in [#692](https://github.com/jdx/fnox/pull/692)

### 🔍 Other Changes

- run perf jobs on bamboo by [@jdx](https://github.com/jdx) in [#672](https://github.com/jdx/fnox/pull/672)
- build perf binaries on bamboo by [@jdx](https://github.com/jdx) in [#674](https://github.com/jdx/fnox/pull/674)

### 📦️ Dependency Updates

- update jdx/mise-action action to v4.2.3 by [@renovate[bot]](https://github.com/renovate[bot]) in [#677](https://github.com/jdx/fnox/pull/677)
- update rust crate keepass to v0.13.18 by [@renovate[bot]](https://github.com/renovate[bot]) in [#678](https://github.com/jdx/fnox/pull/678)
- update rust crate schemars to v1.2.2 by [@renovate[bot]](https://github.com/renovate[bot]) in [#679](https://github.com/jdx/fnox/pull/679)
- update dependency github:jdx/tak to v0.0.5 by [@renovate[bot]](https://github.com/renovate[bot]) in [#676](https://github.com/jdx/fnox/pull/676)
- update rust crate jsonwebtoken to v11 by [@renovate[bot]](https://github.com/renovate[bot]) in [#685](https://github.com/jdx/fnox/pull/685)
- update zizmorcore/zizmor-action action to v0.6.1 by [@renovate[bot]](https://github.com/renovate[bot]) in [#680](https://github.com/jdx/fnox/pull/680)
- update rust crate base64 to 0.23 by [@renovate[bot]](https://github.com/renovate[bot]) in [#683](https://github.com/jdx/fnox/pull/683)
- update rust crate usage-lib to v4.1.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#684](https://github.com/jdx/fnox/pull/684)
- update dependency @anthropic-ai/claude-code to v2.1.220 by [@renovate[bot]](https://github.com/renovate[bot]) in [#681](https://github.com/jdx/fnox/pull/681)
- update rust crate usage-lib to v5 by [@renovate[bot]](https://github.com/renovate[bot]) in [#687](https://github.com/jdx/fnox/pull/687)
- update rust crate rmcp to v3 by [@renovate[bot]](https://github.com/renovate[bot]) in [#688](https://github.com/jdx/fnox/pull/688)

## [1.32.0](https://github.com/jdx/fnox/compare/v1.31.1..v1.32.0) - 2026-08-01

### 🚀 Features

- **(azure-ac)** add Azure App Configuration provider by [@jmoreno11](https://github.com/jmoreno11) in [#659](https://github.com/jdx/fnox/pull/659)
- **(exec)** add process replacement mode by [@davdroman](https://github.com/davdroman) in [#654](https://github.com/jdx/fnox/pull/654)
- **(proxy)** add destination-scoped credential brokering by [@jdx](https://github.com/jdx) in [#667](https://github.com/jdx/fnox/pull/667)
- assume an IAM role in the AWS providers by [@halms](https://github.com/halms) in [#671](https://github.com/jdx/fnox/pull/671)

### 🐛 Bug Fixes

- **(config)** load global config for explicit --config paths by [@jdx](https://github.com/jdx) in [#651](https://github.com/jdx/fnox/pull/651)
- **(config)** stabilize instruction-count benchmarks by [@jdx](https://github.com/jdx) in [#670](https://github.com/jdx/fnox/pull/670)
- **(env)** add fnox artifact to ci path by [@jdx](https://github.com/jdx) in [#650](https://github.com/jdx/fnox/pull/650)

### 📚 Documentation

- **(contributing)** standardize AI disclosures by [@jdx](https://github.com/jdx) in [#660](https://github.com/jdx/fnox/pull/660)

### ⚡ Performance

- track instruction counts, and gate pull requests on them by [@jdx](https://github.com/jdx) in [#656](https://github.com/jdx/fnox/pull/656)

### 🧪 Testing

- **(config)** assert the parse-error diagnostic in config-files test by [@jdx](https://github.com/jdx) in [#653](https://github.com/jdx/fnox/pull/653)

### 📦️ Dependency Updates

- update rust crate age to 0.12 by [@renovate[bot]](https://github.com/renovate[bot]) in [#645](https://github.com/jdx/fnox/pull/645)
- update rust crate ignore to v0.4.30 by [@renovate[bot]](https://github.com/renovate[bot]) in [#649](https://github.com/jdx/fnox/pull/649)
- update jdx/mise-action action to v4.2.1 by [@renovate[bot]](https://github.com/renovate[bot]) in [#633](https://github.com/jdx/fnox/pull/633)
- update demand by [@jdx](https://github.com/jdx) in [#655](https://github.com/jdx/fnox/pull/655)
- lock file maintenance by [@renovate[bot]](https://github.com/renovate[bot]) in [#657](https://github.com/jdx/fnox/pull/657)
- update actions/checkout action to v7.0.1 by [@renovate[bot]](https://github.com/renovate[bot]) in [#662](https://github.com/jdx/fnox/pull/662)
- update dependency @anthropic-ai/claude-code to v2.1.216 by [@renovate[bot]](https://github.com/renovate[bot]) in [#664](https://github.com/jdx/fnox/pull/664)
- update jdx/pr-closer action to v1.2.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#665](https://github.com/jdx/fnox/pull/665)
- update jdx/renovate-config digest to aa7a43b by [@renovate[bot]](https://github.com/renovate[bot]) in [#661](https://github.com/jdx/fnox/pull/661)
- update rust crate usage-lib to v4 by [@renovate[bot]](https://github.com/renovate[bot]) in [#666](https://github.com/jdx/fnox/pull/666)
- update jdx/mise-action action to v4.2.1 by [@renovate[bot]](https://github.com/renovate[bot]) in [#663](https://github.com/jdx/fnox/pull/663)
- update jdx/renovate-config digest to d4f71e1 by [@renovate[bot]](https://github.com/renovate[bot]) in [#668](https://github.com/jdx/fnox/pull/668)
- update dependency @anthropic-ai/claude-code to v2.1.217 by [@renovate[bot]](https://github.com/renovate[bot]) in [#669](https://github.com/jdx/fnox/pull/669)

### New Contributors

- @jmoreno11 made their first contribution in [#659](https://github.com/jdx/fnox/pull/659)
- @davdroman made their first contribution in [#654](https://github.com/jdx/fnox/pull/654)

## [1.31.1](https://github.com/jdx/fnox/compare/v1.31.0..v1.31.1) - 2026-07-24

### 🛡️ Security

- **(deps)** update dependency @anthropic-ai/claude-code to v2.1.207 by [@renovate[bot]](https://github.com/renovate[bot]) in [#625](https://github.com/jdx/fnox/pull/625)

### 🔍 Other Changes

- regenerate aube-lock.yaml on renovate branches by [@jdx](https://github.com/jdx) in [#626](https://github.com/jdx/fnox/pull/626)
- exclude aube-lock.yaml from prettier by [@jdx](https://github.com/jdx) in [#629](https://github.com/jdx/fnox/pull/629)

### 📦️ Dependency Updates

- update rust crate bytes to v1.12.1 by [@renovate[bot]](https://github.com/renovate[bot]) in [#617](https://github.com/jdx/fnox/pull/617)
- update rust crate usage-lib to v3.5.5 by [@renovate[bot]](https://github.com/renovate[bot]) in [#620](https://github.com/jdx/fnox/pull/620)
- update dependency @anthropic-ai/claude-code to v2.1.206 by [@renovate[bot]](https://github.com/renovate[bot]) in [#621](https://github.com/jdx/fnox/pull/621)
- update rust crate keepass to v0.13.16 by [@renovate[bot]](https://github.com/renovate[bot]) in [#619](https://github.com/jdx/fnox/pull/619)
- update rust crate ignore to v0.4.28 by [@renovate[bot]](https://github.com/renovate[bot]) in [#618](https://github.com/jdx/fnox/pull/618)
- update rust crate regex to v1.13.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#623](https://github.com/jdx/fnox/pull/623)
- enable MSRV-aware resolution and document MSRV policy by [@jdx](https://github.com/jdx) in [#627](https://github.com/jdx/fnox/pull/627)
- update rust crate globset to v0.4.19 by [@renovate[bot]](https://github.com/renovate[bot]) in [#636](https://github.com/jdx/fnox/pull/636)
- update rust crate clap to v4.6.2 by [@renovate[bot]](https://github.com/renovate[bot]) in [#635](https://github.com/jdx/fnox/pull/635)
- update rust crate regex to v1.13.1 by [@renovate[bot]](https://github.com/renovate[bot]) in [#638](https://github.com/jdx/fnox/pull/638)
- update rust crate toml_edit to v0.25.13 by [@renovate[bot]](https://github.com/renovate[bot]) in [#641](https://github.com/jdx/fnox/pull/641)
- update jdx/renovate-config digest to 5fee46e by [@renovate[bot]](https://github.com/renovate[bot]) in [#632](https://github.com/jdx/fnox/pull/632)
- update rust crate which to v8.0.5 by [@renovate[bot]](https://github.com/renovate[bot]) in [#643](https://github.com/jdx/fnox/pull/643)
- update rust crate usage-lib to v3.5.6 by [@renovate[bot]](https://github.com/renovate[bot]) in [#642](https://github.com/jdx/fnox/pull/642)
- update rust crate tokio to v1.52.4 by [@renovate[bot]](https://github.com/renovate[bot]) in [#640](https://github.com/jdx/fnox/pull/640)
- update rust crate rustls to v0.23.42 by [@renovate[bot]](https://github.com/renovate[bot]) in [#639](https://github.com/jdx/fnox/pull/639)
- update rust crate apple-native-keyring-store to v1.0.1 by [@renovate[bot]](https://github.com/renovate[bot]) in [#634](https://github.com/jdx/fnox/pull/634)
- update zizmorcore/zizmor-action action to v0.6.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#647](https://github.com/jdx/fnox/pull/647)
- update dependency @anthropic-ai/claude-code to v2.1.212 by [@renovate[bot]](https://github.com/renovate[bot]) in [#644](https://github.com/jdx/fnox/pull/644)
- update rust crate ignore to v0.4.29 by [@renovate[bot]](https://github.com/renovate[bot]) in [#637](https://github.com/jdx/fnox/pull/637)
- update rust crate google-cloud-secretmanager-v1 to v1.11.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#646](https://github.com/jdx/fnox/pull/646)

## [1.31.0](https://github.com/jdx/fnox/compare/v1.30.0..v1.31.0) - 2026-07-17

### 🚀 Features

- **(config)** support composing multiple active profiles by [@gaojunran](https://github.com/gaojunran) in [#605](https://github.com/jdx/fnox/pull/605)

### 🐛 Bug Fixes

- **(config)** satisfy clippy profile slice lint by [@jdx](https://github.com/jdx) in [#616](https://github.com/jdx/fnox/pull/616)
- **(proton-pass)** suggest unlocking locked sessions by [@TyceHerrman](https://github.com/TyceHerrman) in [#612](https://github.com/jdx/fnox/pull/612)

### 🛡️ Security

- **(deps)** update node.js to v24.18.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#609](https://github.com/jdx/fnox/pull/609)

### 🔍 Other Changes

- Update sync workflow example by [@syhol](https://github.com/syhol) in [#614](https://github.com/jdx/fnox/pull/614)

### 📦️ Dependency Updates

- update rust crate usage-lib to v3.5.4 by [@renovate[bot]](https://github.com/renovate[bot]) in [#608](https://github.com/jdx/fnox/pull/608)
- update rust crate demand to v2.0.3 by [@renovate[bot]](https://github.com/renovate[bot]) in [#607](https://github.com/jdx/fnox/pull/607)
- update rust crate rmcp to v2 by [@renovate[bot]](https://github.com/renovate[bot]) in [#610](https://github.com/jdx/fnox/pull/610)
- bump communique to 1.2.3 by [@jdx](https://github.com/jdx) in [#613](https://github.com/jdx/fnox/pull/613)

### New Contributors

- @syhol made their first contribution in [#614](https://github.com/jdx/fnox/pull/614)
- @gaojunran made their first contribution in [#605](https://github.com/jdx/fnox/pull/605)

## [1.30.0](https://github.com/jdx/fnox/compare/v1.29.0..v1.30.0) - 2026-07-09

### 🚀 Features

- **(config)** add exec-only env mode and top-level env default by [@jdx](https://github.com/jdx) in [#604](https://github.com/jdx/fnox/pull/604)
- **(proton-pass)** support agent and PAT auth by [@TyceHerrman](https://github.com/TyceHerrman) in [#598](https://github.com/jdx/fnox/pull/598)

### 🐛 Bug Fixes

- **(daemon)** respect default provider daemon cache setting by [@TyceHerrman](https://github.com/TyceHerrman) in [#599](https://github.com/jdx/fnox/pull/599)
- **(export)** omit metadata header by default by [@jdx](https://github.com/jdx) in [#603](https://github.com/jdx/fnox/pull/603)
- **(release-plz)** install claude cli from lockfile by [@jdx](https://github.com/jdx) in [#592](https://github.com/jdx/fnox/pull/592)

### 📚 Documentation

- redesign logo with fox-in-keyhole mark matching site theme by [@jdx](https://github.com/jdx) in [#595](https://github.com/jdx/fnox/pull/595)

### 🔍 Other Changes

- **(release)** skip ai reviews for release prs by [@jdx](https://github.com/jdx) in [#606](https://github.com/jdx/fnox/pull/606)
- Update sponsor references for jdx.dev by [@jdx](https://github.com/jdx) in [#585](https://github.com/jdx/fnox/pull/585)
- use release backends for cargo tools by [@jdx](https://github.com/jdx) in [#593](https://github.com/jdx/fnox/pull/593)
- schedule releases for Monday morning by [@jdx](https://github.com/jdx) in [#597](https://github.com/jdx/fnox/pull/597)
- gate autorelease on fix and feat commits by [@jdx](https://github.com/jdx) in [#600](https://github.com/jdx/fnox/pull/600)

### 📦️ Dependency Updates

- update rust crate anyhow to v1.0.103 by [@renovate[bot]](https://github.com/renovate[bot]) in [#586](https://github.com/jdx/fnox/pull/586)
- update zizmorcore/zizmor-action action to v0.5.7 by [@renovate[bot]](https://github.com/renovate[bot]) in [#587](https://github.com/jdx/fnox/pull/587)
- update rust crate tera to v2 by [@renovate[bot]](https://github.com/renovate[bot]) in [#588](https://github.com/jdx/fnox/pull/588)
- lock file maintenance by [@renovate[bot]](https://github.com/renovate[bot]) in [#591](https://github.com/jdx/fnox/pull/591)

## [1.29.0](https://github.com/jdx/fnox/compare/v1.28.0..v1.29.0) - 2026-07-01

### 🚀 Features

- **(age)** support age plugin recipients and identities by [@nightvisi0n](https://github.com/nightvisi0n) in [#569](https://github.com/jdx/fnox/pull/569)
- nix flake packaging by [@o-az](https://github.com/o-az) in [#583](https://github.com/jdx/fnox/pull/583)

### 🐛 Bug Fixes

- **(config)** fall back to defaults for inactive providers by [@jdx](https://github.com/jdx) in [#572](https://github.com/jdx/fnox/pull/572)
- **(config)** resolve relative provider paths from config file by [@jdx](https://github.com/jdx) in [#582](https://github.com/jdx/fnox/pull/582)
- **(daemon)** clear all profile caches by [@jdx](https://github.com/jdx) in [#581](https://github.com/jdx/fnox/pull/581)

### 🚜 Refactor

- **(gcp-sm)** implement get_secrets_batch to improve performance by [@nils-degroot](https://github.com/nils-degroot) in [#580](https://github.com/jdx/fnox/pull/580)

### 🔍 Other Changes

- Enable Entire for Codex by [@jdx](https://github.com/jdx) in [#573](https://github.com/jdx/fnox/pull/573)

### 📦️ Dependency Updates

- update rust-lang/crates-io-auth-action action to v1.0.5 by [@renovate[bot]](https://github.com/renovate[bot]) in [#574](https://github.com/jdx/fnox/pull/574)
- update jdx/mise-action action to v4.2.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#575](https://github.com/jdx/fnox/pull/575)
- update actions/checkout action to v7 by [@renovate[bot]](https://github.com/renovate[bot]) in [#576](https://github.com/jdx/fnox/pull/576)

### New Contributors

- @o-az made their first contribution in [#583](https://github.com/jdx/fnox/pull/583)
- @nightvisi0n made their first contribution in [#569](https://github.com/jdx/fnox/pull/569)

## [1.28.0](https://github.com/jdx/fnox/compare/v1.27.1..v1.28.0) - 2026-06-24

### 🚀 Features

- **(exec)** add non-interactive auth mode by [@jdx](https://github.com/jdx) in [#565](https://github.com/jdx/fnox/pull/565)

### 🐛 Bug Fixes

- **(ci)** install qualified vault formula by [@jdx](https://github.com/jdx) in [#567](https://github.com/jdx/fnox/pull/567)

### 🧪 Testing

- **(lease)** harden github app mock startup by [@jdx](https://github.com/jdx) in [#566](https://github.com/jdx/fnox/pull/566)

### 📦️ Dependency Updates

- update jdx/pr-closer action to v1.1.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#557](https://github.com/jdx/fnox/pull/557)
- update rust crate openssl-sys to v0.9.117 by [@renovate[bot]](https://github.com/renovate[bot]) in [#559](https://github.com/jdx/fnox/pull/559)
- update rust crate aws-sdk-secretsmanager to v1.108.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#562](https://github.com/jdx/fnox/pull/562)
- update rust crate aws-sdk-kms to v1.111.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#561](https://github.com/jdx/fnox/pull/561)
- update rust crate aws-sdk-ssm to v1.113.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#563](https://github.com/jdx/fnox/pull/563)
- update rust crate aws-sdk-sts to v1.107.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#564](https://github.com/jdx/fnox/pull/564)
- update rust crate xx to v2.6.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#560](https://github.com/jdx/fnox/pull/560)
- lock file maintenance lockfile maintenance by [@renovate[bot]](https://github.com/renovate[bot]) in [#547](https://github.com/jdx/fnox/pull/547)

## [1.27.1](https://github.com/jdx/fnox/compare/v1.27.0..v1.27.1) - 2026-06-18

### 🐛 Bug Fixes

- **(daemon)** gate unix socket code by [@jdx](https://github.com/jdx) in [#555](https://github.com/jdx/fnox/pull/555)
- **(export)** emit dotenv format for env exports by [@jdx](https://github.com/jdx) in [#554](https://github.com/jdx/fnox/pull/554)

### 📚 Documentation

- Add Doppler in Cloud Secret Manager list by [@bowenc](https://github.com/bowenc) in [#552](https://github.com/jdx/fnox/pull/552)

### New Contributors

- @bowenc made their first contribution in [#552](https://github.com/jdx/fnox/pull/552)

## [1.27.0](https://github.com/jdx/fnox/compare/v1.26.0..v1.27.0) - 2026-06-17

### 🚀 Features

- **(config)** add secret default interpolation by [@jdx](https://github.com/jdx) in [#549](https://github.com/jdx/fnox/pull/549)
- **(daemon)** add per-user secret resolver daemon by [@jdx](https://github.com/jdx) in [#550](https://github.com/jdx/fnox/pull/550)
- **(scan)** implement fnox scan secret detection by [@jdx](https://github.com/jdx) in [#548](https://github.com/jdx/fnox/pull/548)

### 📚 Documentation

- link to all sponsors by [@jdx](https://github.com/jdx) in [#543](https://github.com/jdx/fnox/pull/543)
- clarify contribution fit by [@jdx](https://github.com/jdx) in [#545](https://github.com/jdx/fnox/pull/545)

### 🔍 Other Changes

- **(ci)** use shared coderabbit config by [@jdx](https://github.com/jdx) in [#546](https://github.com/jdx/fnox/pull/546)

## [1.26.0](https://github.com/jdx/fnox/compare/v1.25.1..v1.26.0) - 2026-06-12

### 🚀 Features

- **(age)** support provider-backed identities by [@k35o](https://github.com/k35o) in [#515](https://github.com/jdx/fnox/pull/515)
- **(gcp-sm)** implement put_secret_value by [@nils-degroot](https://github.com/nils-degroot) in [#530](https://github.com/jdx/fnox/pull/530)
- **(provider)** add vault credential command by [@jdx](https://github.com/jdx) in [#526](https://github.com/jdx/fnox/pull/526)

### 🐛 Bug Fixes

- **(fido2)** send keep-alive messages to stderr by [@baprx](https://github.com/baprx) in [#506](https://github.com/jdx/fnox/pull/506)
- Respect $COLUMNS when not connected to a tty by [@davidolrik](https://github.com/davidolrik) in [#523](https://github.com/jdx/fnox/pull/523)

### 📚 Documentation

- document BatchGetSecretValue IAM permission requirement by [@gaffneyc](https://github.com/gaffneyc) in [#513](https://github.com/jdx/fnox/pull/513)
- add sponsor footer by [@jdx](https://github.com/jdx) in [#510](https://github.com/jdx/fnox/pull/510)

### 🛡️ Security

- **(deps)** update azure-sdk-for-rust monorepo to v1 by [@renovate[bot]](https://github.com/renovate[bot]) in [#499](https://github.com/jdx/fnox/pull/499)
- **(deps)** update rust crate usage-lib to v3.4.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#539](https://github.com/jdx/fnox/pull/539)

### 🔍 Other Changes

- **(ci)** fix zizmor version comments by [@jdx](https://github.com/jdx) in [#518](https://github.com/jdx/fnox/pull/518)
- **(ci)** use pr-closer action by [@jdx](https://github.com/jdx) in [#517](https://github.com/jdx/fnox/pull/517)
- **(release-plz)** drop cargo update from release PR by [@jdx](https://github.com/jdx) in [#496](https://github.com/jdx/fnox/pull/496)

### 📦️ Dependency Updates

- refresh mise lock attestations by [@jdx](https://github.com/jdx) in [#504](https://github.com/jdx/fnox/pull/504)
- update zizmorcore/zizmor-action action to v0.5.4 by [@renovate[bot]](https://github.com/renovate[bot]) in [#498](https://github.com/jdx/fnox/pull/498)
- lock file maintenance by [@renovate[bot]](https://github.com/renovate[bot]) in [#503](https://github.com/jdx/fnox/pull/503)
- update rust crate shlex to v2 by [@renovate[bot]](https://github.com/renovate[bot]) in [#508](https://github.com/jdx/fnox/pull/508)
- update infisical lock entry by [@jdx](https://github.com/jdx) in [#514](https://github.com/jdx/fnox/pull/514)
- update rust crate reqwest to v0.13.4 by [@renovate[bot]](https://github.com/renovate[bot]) in [#519](https://github.com/jdx/fnox/pull/519)
- update rust crate toml_edit to v0.25.12 by [@renovate[bot]](https://github.com/renovate[bot]) in [#520](https://github.com/jdx/fnox/pull/520)
- update aws-sdk-rust monorepo to v1.108.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#521](https://github.com/jdx/fnox/pull/521)
- update rust crate keepass to 0.13 by [@renovate[bot]](https://github.com/renovate[bot]) in [#522](https://github.com/jdx/fnox/pull/522)
- add age macos x64 lock entry by [@jdx](https://github.com/jdx) in [#531](https://github.com/jdx/fnox/pull/531)
- update actions/checkout action to v6.0.3 by [@renovate[bot]](https://github.com/renovate[bot]) in [#532](https://github.com/jdx/fnox/pull/532)
- update rust crate chrono to v0.4.45 by [@renovate[bot]](https://github.com/renovate[bot]) in [#534](https://github.com/jdx/fnox/pull/534)
- update rust crate aws-sdk-sts to v1.106.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#541](https://github.com/jdx/fnox/pull/541)
- update jdx/mise-action action to v4.1.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#536](https://github.com/jdx/fnox/pull/536)
- update rust crate tabled to 0.21 by [@renovate[bot]](https://github.com/renovate[bot]) in [#538](https://github.com/jdx/fnox/pull/538)
- update aws-sdk-rust monorepo to v1.110.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#535](https://github.com/jdx/fnox/pull/535)
- update rust crate aws-config to v1.8.18 by [@renovate[bot]](https://github.com/renovate[bot]) in [#533](https://github.com/jdx/fnox/pull/533)
- update rust crate aws-sdk-kms to v1.110.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#540](https://github.com/jdx/fnox/pull/540)
- update rust crate google-cloud-secretmanager-v1 to v1.10.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#537](https://github.com/jdx/fnox/pull/537)
- lock file maintenance lockfile maintenance by [@renovate[bot]](https://github.com/renovate[bot]) in [#524](https://github.com/jdx/fnox/pull/524)

### New Contributors

- @nils-degroot made their first contribution in [#530](https://github.com/jdx/fnox/pull/530)
- @k35o made their first contribution in [#515](https://github.com/jdx/fnox/pull/515)
- @gaffneyc made their first contribution in [#513](https://github.com/jdx/fnox/pull/513)
- @baprx made their first contribution in [#506](https://github.com/jdx/fnox/pull/506)

## [1.25.1](https://github.com/jdx/fnox/compare/v1.25.0..v1.25.1) - 2026-05-17

### 🐛 Bug Fixes

- **(keychain)** run blocking calls on spawn_blocking; batch serially by [@jdx](https://github.com/jdx) in [#495](https://github.com/jdx/fnox/pull/495)

### 🔍 Other Changes

- **(ci)** add PR autocloser by [@jdx](https://github.com/jdx) in [#490](https://github.com/jdx/fnox/pull/490)
- **(release-plz)** use crates.io trusted publishing by [@jdx](https://github.com/jdx) in [#491](https://github.com/jdx/fnox/pull/491)

### 📦️ Dependency Updates

- update keepass to 0.12 and migrate provider to new API by [@jdx](https://github.com/jdx) in [#494](https://github.com/jdx/fnox/pull/494)
- migrate from keyring v3 to keyring-core v1 by [@jdx](https://github.com/jdx) in [#493](https://github.com/jdx/fnox/pull/493)

## [1.25.0](https://github.com/jdx/fnox/compare/v1.24.1..v1.25.0) - 2026-05-14

### 🚀 Features

- **(provider)** add FOKS (Federated Open Key Service) provider by [@maxtaco](https://github.com/maxtaco) in [#486](https://github.com/jdx/fnox/pull/486)

### 🐛 Bug Fixes

- **(cli)** exit cleanly on SIGPIPE instead of panicking in println! by [@maxtaco](https://github.com/maxtaco) in [#487](https://github.com/jdx/fnox/pull/487)
- **(docs)** read version from [workspace.package] in Cargo.toml by [@jdx](https://github.com/jdx) in [#483](https://github.com/jdx/fnox/pull/483)

### New Contributors

- @maxtaco made their first contribution in [#486](https://github.com/jdx/fnox/pull/486)

## [1.24.1](https://github.com/jdx/fnox/compare/v1.24.0..v1.24.1) - 2026-05-13

### 🐛 Bug Fixes

- **(config)** preserve secret table formatting by [@jdx](https://github.com/jdx) in [#467](https://github.com/jdx/fnox/pull/467)
- **(shell)** prevent shell expansion of secret values in bash/zsh activation by [@jdx](https://github.com/jdx) in [#473](https://github.com/jdx/fnox/pull/473)

### 📚 Documentation

- clarify mise env plugin status by [@jdx](https://github.com/jdx) in [#472](https://github.com/jdx/fnox/pull/472)

### 🛡️ Security

- **(ci)** assert mise run render produces no diff by [@jdx](https://github.com/jdx) in [#479](https://github.com/jdx/fnox/pull/479)
- **(ci)** add zizmor workflow for github actions security analysis by [@jdx](https://github.com/jdx) in [#480](https://github.com/jdx/fnox/pull/480)

### 🔍 Other Changes

- **(ci)** remove autofix.ci workflow by [@jdx](https://github.com/jdx) in [#478](https://github.com/jdx/fnox/pull/478)
- remove pull_request_target workflow by [@jdx](https://github.com/jdx) in [#476](https://github.com/jdx/fnox/pull/476)
- remove caching from publishing workflows by [@jdx](https://github.com/jdx) in [#477](https://github.com/jdx/fnox/pull/477)

### 📦️ Dependency Updates

- lock file maintenance by [@renovate[bot]](https://github.com/renovate[bot]) in [#475](https://github.com/jdx/fnox/pull/475)

## [1.24.0](https://github.com/jdx/fnox/compare/v1.23.1..v1.24.0) - 2026-05-06

### 🚀 Features

- **(github-oauth)** add github oauth lease backend by [@jdx](https://github.com/jdx) in [#464](https://github.com/jdx/fnox/pull/464)

### 🐛 Bug Fixes

- **(ci)** de-duplicate sponsor section in release notes by [@jdx](https://github.com/jdx) in [#459](https://github.com/jdx/fnox/pull/459)

### 🔍 Other Changes

- **(ci)** use !cancelled() instead of always() for final job by [@jdx](https://github.com/jdx) in [#461](https://github.com/jdx/fnox/pull/461)
- set dev profile debug to 1 by [@jdx](https://github.com/jdx) in [#462](https://github.com/jdx/fnox/pull/462)

## [1.23.1](https://github.com/jdx/fnox/compare/v1.23.0..v1.23.1) - 2026-05-02

### 🚜 Refactor

- extract providers and core types into fnox-core crate by [@jdx](https://github.com/jdx) in [#458](https://github.com/jdx/fnox/pull/458)

### 📚 Documentation

- prefix star count with ★ glyph and populate it on deploy by [@jdx](https://github.com/jdx) in [#447](https://github.com/jdx/fnox/pull/447)
- add favicons and web app manifest by [@jdx](https://github.com/jdx) in [#448](https://github.com/jdx/fnox/pull/448)

### 🔍 Other Changes

- **(docs)** remove shrill.en.dev analytics script by [@jdx](https://github.com/jdx) in [#457](https://github.com/jdx/fnox/pull/457)
- **(release)** add musl Linux targets for Alpine compatibility by [@jdx](https://github.com/jdx) in [#452](https://github.com/jdx/fnox/pull/452)
- add plausible analytics by [@jdx](https://github.com/jdx) in [#451](https://github.com/jdx/fnox/pull/451)
- bump hk to 1.44.3 by [@jdx](https://github.com/jdx) in [#454](https://github.com/jdx/fnox/pull/454)

### 📦️ Dependency Updates

- update autofix-ci/action action to v1.3.4 by [@renovate[bot]](https://github.com/renovate[bot]) in [#455](https://github.com/jdx/fnox/pull/455)
- update apple-actions/import-codesign-certs action to v7 by [@renovate[bot]](https://github.com/renovate[bot]) in [#456](https://github.com/jdx/fnox/pull/456)

## [1.23.0](https://github.com/jdx/fnox/compare/v1.22.0..v1.23.0) - 2026-04-26

### 🚀 Features

- **(config)** add line selector for multiline secrets by [@fgrosse](https://github.com/fgrosse) in [#446](https://github.com/jdx/fnox/pull/446)

### New Contributors

- @fgrosse made their first contribution in [#446](https://github.com/jdx/fnox/pull/446)

## [1.22.0](https://github.com/jdx/fnox/compare/v1.21.0..v1.22.0) - 2026-04-26

### 🚀 Features

- **(library)** top-level Fnox::discover() / get / list convenience API by [@bglusman](https://github.com/bglusman) in [#442](https://github.com/jdx/fnox/pull/442)

### 🐛 Bug Fixes

- **(docs)** stack banner and pin close button on mobile by [@jdx](https://github.com/jdx) in [#437](https://github.com/jdx/fnox/pull/437)
- **(set)** fall back to current provider when updating secrets by [@rpendleton](https://github.com/rpendleton) in [#439](https://github.com/jdx/fnox/pull/439)

### 📚 Documentation

- **(site)** show release version and github stars by [@jdx](https://github.com/jdx) in [#443](https://github.com/jdx/fnox/pull/443)
- add cross-site announcement banner by [@jdx](https://github.com/jdx) in [#434](https://github.com/jdx/fnox/pull/434)
- respect banner expires field by [@jdx](https://github.com/jdx) in [#436](https://github.com/jdx/fnox/pull/436)

### 🛡️ Security

- **(build)** deterministic provider ordering in generated schema by [@jdx](https://github.com/jdx) in [#432](https://github.com/jdx/fnox/pull/432)

### 🔍 Other Changes

- **(release)** append en.dev sponsor blurb to release notes by [@jdx](https://github.com/jdx) in [#431](https://github.com/jdx/fnox/pull/431)

### 📦️ Dependency Updates

- bump communique to 1.0.3 by [@jdx](https://github.com/jdx) in [#435](https://github.com/jdx/fnox/pull/435)
- bump communique 1.0.3 → 1.0.4 by [@jdx](https://github.com/jdx) in [#438](https://github.com/jdx/fnox/pull/438)
- bump communique to 1.1.2 by [@jdx](https://github.com/jdx) in [#444](https://github.com/jdx/fnox/pull/444)

### New Contributors

- @bglusman made their first contribution in [#442](https://github.com/jdx/fnox/pull/442)

## [1.21.0](https://github.com/jdx/fnox/compare/v1.20.0..v1.21.0) - 2026-04-21

### 🚀 Features

- Powershell integration by [@nbfritch](https://github.com/nbfritch) in [#421](https://github.com/jdx/fnox/pull/421)

### 🐛 Bug Fixes

- **(Windows)** Nushell integration by [@john-trieu-nguyen](https://github.com/john-trieu-nguyen) in [#425](https://github.com/jdx/fnox/pull/425)
- **(Windows)** Command resolution for executables by [@john-trieu-nguyen](https://github.com/john-trieu-nguyen) in [#427](https://github.com/jdx/fnox/pull/427)

### 📚 Documentation

- add releases nav and aube lock by [@jdx](https://github.com/jdx) in [#422](https://github.com/jdx/fnox/pull/422)
- include linux native packages in aube lock by [@jdx](https://github.com/jdx) in [#423](https://github.com/jdx/fnox/pull/423)

### 🔍 Other Changes

- Use published `clap-sort` crate instead of inlined module by [@jdx](https://github.com/jdx) in [#409](https://github.com/jdx/fnox/pull/409)
- add communique 1.0.1 by [@jdx](https://github.com/jdx) in [#424](https://github.com/jdx/fnox/pull/424)

### 📦️ Dependency Updates

- lock file maintenance by [@renovate[bot]](https://github.com/renovate[bot]) in [#381](https://github.com/jdx/fnox/pull/381)
- update taiki-e/upload-rust-binary-action digest to 10c1cf6 by [@renovate[bot]](https://github.com/renovate[bot]) in [#383](https://github.com/jdx/fnox/pull/383)
- update rust crate tokio to v1.51.1 by [@renovate[bot]](https://github.com/renovate[bot]) in [#384](https://github.com/jdx/fnox/pull/384)
- update rust crate indexmap to v2.14.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#385](https://github.com/jdx/fnox/pull/385)
- update rust crate rmcp to v1.4.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#389](https://github.com/jdx/fnox/pull/389)
- update rust crate strum to 0.28 by [@renovate[bot]](https://github.com/renovate[bot]) in [#395](https://github.com/jdx/fnox/pull/395)
- update rust crate toml_edit to 0.25 by [@renovate[bot]](https://github.com/renovate[bot]) in [#396](https://github.com/jdx/fnox/pull/396)
- update rust crate miniz_oxide to 0.9 by [@renovate[bot]](https://github.com/renovate[bot]) in [#390](https://github.com/jdx/fnox/pull/390)
- update rust crate ratatui to 0.30 by [@renovate[bot]](https://github.com/renovate[bot]) in [#392](https://github.com/jdx/fnox/pull/392)
- update actions/checkout action to v6 by [@renovate[bot]](https://github.com/renovate[bot]) in [#397](https://github.com/jdx/fnox/pull/397)
- update actions/deploy-pages action to v5 by [@renovate[bot]](https://github.com/renovate[bot]) in [#399](https://github.com/jdx/fnox/pull/399)
- update actions/configure-pages action to v6 by [@renovate[bot]](https://github.com/renovate[bot]) in [#398](https://github.com/jdx/fnox/pull/398)
- update actions/setup-node action to v6 by [@renovate[bot]](https://github.com/renovate[bot]) in [#400](https://github.com/jdx/fnox/pull/400)
- update actions/upload-pages-artifact action to v4 by [@renovate[bot]](https://github.com/renovate[bot]) in [#401](https://github.com/jdx/fnox/pull/401)
- update dependency node to v24 by [@renovate[bot]](https://github.com/renovate[bot]) in [#403](https://github.com/jdx/fnox/pull/403)
- update apple-actions/import-codesign-certs action to v6 by [@renovate[bot]](https://github.com/renovate[bot]) in [#402](https://github.com/jdx/fnox/pull/402)
- update nick-fields/retry action to v4 by [@renovate[bot]](https://github.com/renovate[bot]) in [#406](https://github.com/jdx/fnox/pull/406)
- update github artifact actions (major) by [@renovate[bot]](https://github.com/renovate[bot]) in [#404](https://github.com/jdx/fnox/pull/404)
- update jdx/mise-action action to v4 by [@renovate[bot]](https://github.com/renovate[bot]) in [#405](https://github.com/jdx/fnox/pull/405)
- update rust crate which to v8 by [@renovate[bot]](https://github.com/renovate[bot]) in [#408](https://github.com/jdx/fnox/pull/408)
- update rust crate usage-lib to v3 by [@renovate[bot]](https://github.com/renovate[bot]) in [#407](https://github.com/jdx/fnox/pull/407)
- bump rustcrypto stack (aes-gcm, sha2, hkdf) together by [@jdx](https://github.com/jdx) in [#410](https://github.com/jdx/fnox/pull/410)
- update rust crate reqwest to 0.13 by [@renovate[bot]](https://github.com/renovate[bot]) in [#393](https://github.com/jdx/fnox/pull/393)
- update rust crate libloading to 0.9 by [@renovate[bot]](https://github.com/renovate[bot]) in [#388](https://github.com/jdx/fnox/pull/388)
- update rust crate keepass to 0.10 by [@renovate[bot]](https://github.com/renovate[bot]) in [#387](https://github.com/jdx/fnox/pull/387)
- update rust crate rand to 0.10 by [@renovate[bot]](https://github.com/renovate[bot]) in [#391](https://github.com/jdx/fnox/pull/391)
- lock file maintenance by [@renovate[bot]](https://github.com/renovate[bot]) in [#411](https://github.com/jdx/fnox/pull/411)
- update rust crate google-cloud-secretmanager-v1 to v1.8.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#415](https://github.com/jdx/fnox/pull/415)
- update actions/upload-pages-artifact action to v5 by [@renovate[bot]](https://github.com/renovate[bot]) in [#418](https://github.com/jdx/fnox/pull/418)
- update rust crate rmcp to v1.5.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#416](https://github.com/jdx/fnox/pull/416)
- update rust crate clap to v4.6.1 by [@renovate[bot]](https://github.com/renovate[bot]) in [#413](https://github.com/jdx/fnox/pull/413)
- update rust crate tokio to v1.52.1 by [@renovate[bot]](https://github.com/renovate[bot]) in [#417](https://github.com/jdx/fnox/pull/417)
- update rust crate keepass to v0.10.6 by [@renovate[bot]](https://github.com/renovate[bot]) in [#414](https://github.com/jdx/fnox/pull/414)
- update taiki-e/upload-rust-binary-action digest to f0d45ae by [@renovate[bot]](https://github.com/renovate[bot]) in [#419](https://github.com/jdx/fnox/pull/419)
- update rust crate aws-sdk-sts to v1.102.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#420](https://github.com/jdx/fnox/pull/420)

### New Contributors

- @john-trieu-nguyen made their first contribution in [#427](https://github.com/jdx/fnox/pull/427)
- @nbfritch made their first contribution in [#421](https://github.com/jdx/fnox/pull/421)

## [1.20.0](https://github.com/jdx/fnox/compare/v1.19.0..v1.20.0) - 2026-04-04

### 🚀 Features

- **(provider)** add Doppler secrets manager provider by [@natefaerber](https://github.com/natefaerber) in [#376](https://github.com/jdx/fnox/pull/376)

### 🐛 Bug Fixes

- **(ci)** pin LocalStack to v4 (last free community version) by [@jdx](https://github.com/jdx) in [#379](https://github.com/jdx/fnox/pull/379)
- **(sync)** skip post-processing when resolving secrets for sync by [@rpendleton](https://github.com/rpendleton) in [#371](https://github.com/jdx/fnox/pull/371)

### 🚜 Refactor

- **(providers)** extract shared error helpers to FnoxError methods by [@jdx](https://github.com/jdx) in [#380](https://github.com/jdx/fnox/pull/380)

### 📦️ Dependency Updates

- lock file maintenance by [@renovate[bot]](https://github.com/renovate[bot]) in [#369](https://github.com/jdx/fnox/pull/369)
- update taiki-e/upload-rust-binary-action digest to 0e34102 by [@renovate[bot]](https://github.com/renovate[bot]) in [#372](https://github.com/jdx/fnox/pull/372)
- update dependency vue to v3.5.32 by [@renovate[bot]](https://github.com/renovate[bot]) in [#373](https://github.com/jdx/fnox/pull/373)
- update rust crate indexmap to v2.13.1 by [@renovate[bot]](https://github.com/renovate[bot]) in [#378](https://github.com/jdx/fnox/pull/378)
- update rust crate blake3 to v1.8.4 by [@renovate[bot]](https://github.com/renovate[bot]) in [#377](https://github.com/jdx/fnox/pull/377)
- lock file maintenance by [@renovate[bot]](https://github.com/renovate[bot]) in [#374](https://github.com/jdx/fnox/pull/374)

### New Contributors

- @natefaerber made their first contribution in [#376](https://github.com/jdx/fnox/pull/376)
- @rpendleton made their first contribution in [#371](https://github.com/jdx/fnox/pull/371)

## [1.19.0](https://github.com/jdx/fnox/compare/v1.18.0..v1.19.0) - 2026-03-22

### 🚀 Features

- add `reencrypt` subcommand for updating encryption recipients by [@jdx](https://github.com/jdx) in [#365](https://github.com/jdx/fnox/pull/365)

### 🐛 Bug Fixes

- **(set)** prompt for secret value when -k flag is used by [@jdx](https://github.com/jdx) in [#367](https://github.com/jdx/fnox/pull/367)

### 📦️ Dependency Updates

- lock file maintenance by [@renovate[bot]](https://github.com/renovate[bot]) in [#360](https://github.com/jdx/fnox/pull/360)
- lock file maintenance by [@renovate[bot]](https://github.com/renovate[bot]) in [#362](https://github.com/jdx/fnox/pull/362)

## [1.18.0](https://github.com/jdx/fnox/compare/v1.17.0..v1.18.0) - 2026-03-13

### 🚀 Features

- **(mcp)** add secret allowlist to limit agent access by [@jdx](https://github.com/jdx) in [#358](https://github.com/jdx/fnox/pull/358)
- **(sync)** add --local-file output target by [@florian-lackner365](https://github.com/florian-lackner365) in [#317](https://github.com/jdx/fnox/pull/317)

### 🐛 Bug Fixes

- properly handle auth prompt in batch providers by [@johnpyp](https://github.com/johnpyp) in [#349](https://github.com/jdx/fnox/pull/349)

### 🚜 Refactor

- **(yubikey)** dynamically load libusb at runtime by [@jdx](https://github.com/jdx) in [#348](https://github.com/jdx/fnox/pull/348)

### 🛡️ Security

- **(mcp)** redact secret values from exec output by [@jdx](https://github.com/jdx) in [#357](https://github.com/jdx/fnox/pull/357)

### 📦️ Dependency Updates

- lock file maintenance by [@renovate[bot]](https://github.com/renovate[bot]) in [#344](https://github.com/jdx/fnox/pull/344)
- update jdx/mise-action digest to 5228313 by [@renovate[bot]](https://github.com/renovate[bot]) in [#351](https://github.com/jdx/fnox/pull/351)
- update swatinem/rust-cache digest to e18b497 by [@renovate[bot]](https://github.com/renovate[bot]) in [#352](https://github.com/jdx/fnox/pull/352)
- update taiki-e/upload-rust-binary-action digest to 381995c by [@renovate[bot]](https://github.com/renovate[bot]) in [#353](https://github.com/jdx/fnox/pull/353)
- update dependency vue to v3.5.30 by [@renovate[bot]](https://github.com/renovate[bot]) in [#354](https://github.com/jdx/fnox/pull/354)
- update rust crate openssl-sys to v0.9.112 by [@renovate[bot]](https://github.com/renovate[bot]) in [#355](https://github.com/jdx/fnox/pull/355)
- update rust crate clap to v4.6.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#356](https://github.com/jdx/fnox/pull/356)

### New Contributors

- @florian-lackner365 made their first contribution in [#317](https://github.com/jdx/fnox/pull/317)

## [1.17.0](https://github.com/jdx/fnox/compare/v1.16.1..v1.17.0) - 2026-03-09

### 🚀 Features

- **(cloudflare)** add Cloudflare API token lease backend by [@jdx](https://github.com/jdx) in [#335](https://github.com/jdx/fnox/pull/335)
- **(fido2)** bump demand to v2, mask PIN during typing by [@jdx](https://github.com/jdx) in [#334](https://github.com/jdx/fnox/pull/334)
- **(get)** resolve leased credentials from `fnox get` by [@jdx](https://github.com/jdx) in [#338](https://github.com/jdx/fnox/pull/338)
- **(init)** add -f as short alias for --force by [@jdx](https://github.com/jdx) in [#329](https://github.com/jdx/fnox/pull/329)
- **(lease)** add --all flag, default to creating all leases by [@jdx](https://github.com/jdx) in [#337](https://github.com/jdx/fnox/pull/337)
- **(lease)** add GitHub App installation token lease backend by [@jdx](https://github.com/jdx) in [#342](https://github.com/jdx/fnox/pull/342)

### 🐛 Bug Fixes

- **(config)** fix directory locations to follow XDG spec by [@jdx](https://github.com/jdx) in [#336](https://github.com/jdx/fnox/pull/336)
- **(exec)** use unix exec and exit silently on subprocess failure by [@jdx](https://github.com/jdx) in [#339](https://github.com/jdx/fnox/pull/339)
- **(fido2)** remove duplicate touch prompt by [@jdx](https://github.com/jdx) in [#332](https://github.com/jdx/fnox/pull/332)
- **(set)** write to lowest-priority existing config file by [@jdx](https://github.com/jdx) in [#331](https://github.com/jdx/fnox/pull/331)
- **(tui)** skip providers requiring interactive auth by [@jdx](https://github.com/jdx) in [#333](https://github.com/jdx/fnox/pull/333)

### 🛡️ Security

- **(ci)** retry lint step to handle transient pkl fetch failures by [@jdx](https://github.com/jdx) in [#341](https://github.com/jdx/fnox/pull/341)
- **(mcp)** add MCP server for secret-gated AI agent access by [@jdx](https://github.com/jdx) in [#343](https://github.com/jdx/fnox/pull/343)
- add guide for fnox sync by [@jdx](https://github.com/jdx) in [#328](https://github.com/jdx/fnox/pull/328)

### 🔍 Other Changes

- share Rust cache across CI jobs by [@jdx](https://github.com/jdx) in [#340](https://github.com/jdx/fnox/pull/340)

## [1.16.1](https://github.com/jdx/fnox/compare/v1.16.0..v1.16.1) - 2026-03-08

### 🐛 Bug Fixes

- **(set)** error on encryption failure; use LocalStack for AWS tests by [@jdx](https://github.com/jdx) in [#324](https://github.com/jdx/fnox/pull/324)

### 📦️ Dependency Updates

- add Cross.toml to install libudev-dev for linux cross-compilation by [@jdx](https://github.com/jdx) in [#326](https://github.com/jdx/fnox/pull/326)

## [1.16.0](https://github.com/jdx/fnox/compare/v1.15.1..v1.16.0) - 2026-03-08

### 🐛 Bug Fixes

- **(docs)** escape angle brackets in lease create doc by [@jdx](https://github.com/jdx) in [#323](https://github.com/jdx/fnox/pull/323)

### 🛡️ Security

- **(lease)** ephemeral credential leasing by [@jdx](https://github.com/jdx) in [#318](https://github.com/jdx/fnox/pull/318)

### 📦️ Dependency Updates

- update jdx/mise-action digest to e79ddf6 by [@renovate[bot]](https://github.com/renovate[bot]) in [#312](https://github.com/jdx/fnox/pull/312)
- publish to crates.io on release by [@jdx](https://github.com/jdx) in [#315](https://github.com/jdx/fnox/pull/315)
- add libudev-dev to release-plz CI workflow by [@jdx](https://github.com/jdx) in [#322](https://github.com/jdx/fnox/pull/322)
- update aws-sdk-rust monorepo to v1.8.15 by [@renovate[bot]](https://github.com/renovate[bot]) in [#313](https://github.com/jdx/fnox/pull/313)

## [1.15.1](https://github.com/jdx/fnox/compare/v1.15.0..v1.15.1) - 2026-03-02

### 🐛 Bug Fixes

- **(sync)** use sync cache field instead of overwriting provider/value by [@jdx](https://github.com/jdx) in [#309](https://github.com/jdx/fnox/pull/309)

### ⚡ Performance

- **(aws-sm)** skip expensive tests on non-release PRs by [@jdx](https://github.com/jdx) in [#310](https://github.com/jdx/fnox/pull/310)
- **(provider)** use async tokio::process::Command for CLI-based providers by [@jdx](https://github.com/jdx) in [#308](https://github.com/jdx/fnox/pull/308)

### 📦️ Dependency Updates

- lock file maintenance by [@renovate[bot]](https://github.com/renovate[bot]) in [#306](https://github.com/jdx/fnox/pull/306)

## [1.15.0](https://github.com/jdx/fnox/compare/v1.14.0..v1.15.0) - 2026-03-02

### 🚀 Features

- **(provider)** allow auth_command override per-provider in config by [@jdx](https://github.com/jdx) in [#305](https://github.com/jdx/fnox/pull/305)
- **(vault)** make address field optional and fallback to VAULT_ADDR by [@chermed](https://github.com/chermed) in [#301](https://github.com/jdx/fnox/pull/301)
- add `fnox sync` command by [@jdx](https://github.com/jdx) in [#298](https://github.com/jdx/fnox/pull/298)
- nushell integration by [@tiptenbrink](https://github.com/tiptenbrink) in [#304](https://github.com/jdx/fnox/pull/304)

### 🐛 Bug Fixes

- **(provider)** only trigger auth prompt for ProviderAuthFailed errors by [@TyceHerrman](https://github.com/TyceHerrman) in [#297](https://github.com/jdx/fnox/pull/297)
- **(provider)** add missing provider add types and proton-pass vault by [@TyceHerrman](https://github.com/TyceHerrman) in [#302](https://github.com/jdx/fnox/pull/302)

### New Contributors

- @chermed made their first contribution in [#301](https://github.com/jdx/fnox/pull/301)
- @tiptenbrink made their first contribution in [#304](https://github.com/jdx/fnox/pull/304)

## [1.14.0](https://github.com/jdx/fnox/compare/v1.13.0..v1.14.0) - 2026-02-28

### 🚀 Features

- **(proton-pass)** add Proton Pass provider by [@TyceHerrman](https://github.com/TyceHerrman) in [#292](https://github.com/jdx/fnox/pull/292)
- Add AWS Profile support for AWS PS and Secrets Manager in provider config by [@micahvdk](https://github.com/micahvdk) in [#290](https://github.com/jdx/fnox/pull/290)
- encode decode secrets by [@pitoniak32](https://github.com/pitoniak32) in [#273](https://github.com/jdx/fnox/pull/273)

### 🐛 Bug Fixes

- **(aws-sm)** deduplicate secret IDs in batch requests by [@jdx](https://github.com/jdx) in [#296](https://github.com/jdx/fnox/pull/296)

### 📚 Documentation

- require AI disclosure on GitHub comments by [@jdx](https://github.com/jdx) in [#288](https://github.com/jdx/fnox/pull/288)

### 📦️ Dependency Updates

- update dependency vue to v3.5.29 by [@renovate[bot]](https://github.com/renovate[bot]) in [#294](https://github.com/jdx/fnox/pull/294)
- update rust crate chrono to v0.4.44 by [@renovate[bot]](https://github.com/renovate[bot]) in [#295](https://github.com/jdx/fnox/pull/295)

### New Contributors

- @pitoniak32 made their first contribution in [#273](https://github.com/jdx/fnox/pull/273)
- @TyceHerrman made their first contribution in [#292](https://github.com/jdx/fnox/pull/292)
- @micahvdk made their first contribution in [#290](https://github.com/jdx/fnox/pull/290)

## [1.13.0](https://github.com/jdx/fnox/compare/v1.12.1..v1.13.0) - 2026-02-21

### 🚀 Features

- add JSON secrets by [@halms](https://github.com/halms) in [#247](https://github.com/jdx/fnox/pull/247)

### 🐛 Bug Fixes

- **(config)** preserve TOML comments in import and remove by [@jdx](https://github.com/jdx) in [#268](https://github.com/jdx/fnox/pull/268)
- **(release)** write release notes to file instead of capturing stdout by [@jdx](https://github.com/jdx) in [#263](https://github.com/jdx/fnox/pull/263)
- **(release)** make release notes editorialization non-blocking by [@jdx](https://github.com/jdx) in [#269](https://github.com/jdx/fnox/pull/269)

### 📚 Documentation

- **(config)** fix env-specific config example in mise integration guide by [@jdx](https://github.com/jdx) in [#267](https://github.com/jdx/fnox/pull/267)
- **(shell)** remove incorrect `cd .` reload instructions by [@jdx](https://github.com/jdx) in [#265](https://github.com/jdx/fnox/pull/265)
- rename CRUSH.md to AGENTS.md by [@sweepies](https://github.com/sweepies) in [#282](https://github.com/jdx/fnox/pull/282)

### 🔍 Other Changes

- replace gen-release-notes script with communique by [@jdx](https://github.com/jdx) in [#285](https://github.com/jdx/fnox/pull/285)

### 📦️ Dependency Updates

- update taiki-e/upload-rust-binary-action digest to f391289 by [@renovate[bot]](https://github.com/renovate[bot]) in [#274](https://github.com/jdx/fnox/pull/274)
- update rust crate usage-lib to v2.16.2 by [@renovate[bot]](https://github.com/renovate[bot]) in [#277](https://github.com/jdx/fnox/pull/277)
- update rust crate clap to v4.5.58 by [@renovate[bot]](https://github.com/renovate[bot]) in [#276](https://github.com/jdx/fnox/pull/276)
- update rust crate google-cloud-secretmanager-v1 to v1.5.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#278](https://github.com/jdx/fnox/pull/278)
- update rust crate crossterm to 0.29 by [@renovate[bot]](https://github.com/renovate[bot]) in [#279](https://github.com/jdx/fnox/pull/279)
- lock file maintenance by [@renovate[bot]](https://github.com/renovate[bot]) in [#281](https://github.com/jdx/fnox/pull/281)
- update aws-sdk-rust monorepo to v1.8.14 by [@renovate[bot]](https://github.com/renovate[bot]) in [#275](https://github.com/jdx/fnox/pull/275)
- update keepass to 0.8.21 and adapt to new API by [@jdx](https://github.com/jdx) in [#286](https://github.com/jdx/fnox/pull/286)

### New Contributors

- @sweepies made their first contribution in [#282](https://github.com/jdx/fnox/pull/282)
- @halms made their first contribution in [#247](https://github.com/jdx/fnox/pull/247)

## [1.12.1](https://github.com/jdx/fnox/compare/v1.12.0..v1.12.1) - 2026-02-10

### 🐛 Bug Fixes

- load global config in shell integration hook-env by [@jdx](https://github.com/jdx) in [#262](https://github.com/jdx/fnox/pull/262)

### 📚 Documentation

- condense CLAUDE.md from 1159 to 96 lines by [@jdx](https://github.com/jdx) in [#260](https://github.com/jdx/fnox/pull/260)

### 🛡️ Security

- disable light mode in documentation site by [@jdx](https://github.com/jdx) in [#261](https://github.com/jdx/fnox/pull/261)

### 📦️ Dependency Updates

- lock file maintenance by [@renovate[bot]](https://github.com/renovate[bot]) in [#257](https://github.com/jdx/fnox/pull/257)

## [1.12.0](https://github.com/jdx/fnox/compare/v1.11.0..v1.12.0) - 2026-02-09

### 🚀 Features

- implement as_file to inject a secret as a file instead of as a value by [@kfkonrad](https://github.com/kfkonrad) in [#250](https://github.com/jdx/fnox/pull/250)
- add a `--no-defaults` CLI flag by [@jaydenfyi](https://github.com/jaydenfyi) in [#252](https://github.com/jdx/fnox/pull/252)

### 📚 Documentation

- document tools=true requirement for mise integration by [@jdx](https://github.com/jdx) in [#245](https://github.com/jdx/fnox/pull/245)
- add opengraph meta tags by [@jdx](https://github.com/jdx) in [#256](https://github.com/jdx/fnox/pull/256)

### 🔍 Other Changes

- reduce CI bats test parallelism from 3 to 2 tranches by [@jdx](https://github.com/jdx) in [#243](https://github.com/jdx/fnox/pull/243)
- add tone calibration to release notes prompt by [@jdx](https://github.com/jdx) in [#251](https://github.com/jdx/fnox/pull/251)
- Add Bitwarden SM provider by [@nikuda](https://github.com/nikuda) in [#253](https://github.com/jdx/fnox/pull/253)

### 📦️ Dependency Updates

- update autofix-ci/action action to v1.3.3 by [@renovate[bot]](https://github.com/renovate[bot]) in [#254](https://github.com/jdx/fnox/pull/254)
- update aws-sdk-rust monorepo to v1.8.13 by [@renovate[bot]](https://github.com/renovate[bot]) in [#255](https://github.com/jdx/fnox/pull/255)

### New Contributors

- @nikuda made their first contribution in [#253](https://github.com/jdx/fnox/pull/253)
- @jaydenfyi made their first contribution in [#252](https://github.com/jdx/fnox/pull/252)
- @kfkonrad made their first contribution in [#250](https://github.com/jdx/fnox/pull/250)

## [1.11.0](https://github.com/jdx/fnox/compare/v1.10.1..v1.11.0) - 2026-02-01

### 🚀 Features

- add `config-files` subcommand by [@jdx](https://github.com/jdx) in [#238](https://github.com/jdx/fnox/pull/238)

### 🧪 Testing

- **(bitwarden)** serialize tests to prevent flaky CI failures by [@jdx](https://github.com/jdx) in [#242](https://github.com/jdx/fnox/pull/242)
- add unit tests for dependency resolution level computation by [@jdx](https://github.com/jdx) in [#239](https://github.com/jdx/fnox/pull/239)

## [1.10.1](https://github.com/jdx/fnox/compare/v1.10.0..v1.10.1) - 2026-01-30

### 🐛 Bug Fixes

- **(exec)** resolve secrets in dependency order using Kahn's algorithm by [@jdx](https://github.com/jdx) in [#237](https://github.com/jdx/fnox/pull/237)
- don't thank @jdx in LLM-generated release notes by [@jdx](https://github.com/jdx) in [#230](https://github.com/jdx/fnox/pull/230)

### 📚 Documentation

- add conventional commit guidance to CRUSH.md by [@jdx](https://github.com/jdx) in [#226](https://github.com/jdx/fnox/pull/226)
- clarify fix type is for CLI bugs only by [@jdx](https://github.com/jdx) in [#231](https://github.com/jdx/fnox/pull/231)

### 🛡️ Security

- **(set)** add security guidance for secret value argument by [@jdx](https://github.com/jdx) in [#229](https://github.com/jdx/fnox/pull/229)

### 🔍 Other Changes

- add creative titles to GitHub releases by [@jdx](https://github.com/jdx) in [#224](https://github.com/jdx/fnox/pull/224)
- add mise.local.toml to .gitignore by [@jdx](https://github.com/jdx) in [#236](https://github.com/jdx/fnox/pull/236)

### 📦️ Dependency Updates

- update rust crate clap to v4.5.56 by [@renovate[bot]](https://github.com/renovate[bot]) in [#234](https://github.com/jdx/fnox/pull/234)
- update rust crate google-cloud-secretmanager-v1 to v1.4.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#235](https://github.com/jdx/fnox/pull/235)

## [1.10.0](https://github.com/jdx/fnox/compare/v1.9.2..v1.10.0) - 2026-01-25

### 🚀 Features

- **(1password)** add token field supporting secret references by [@jdx](https://github.com/jdx) in [#200](https://github.com/jdx/fnox/pull/200)
- **(vault)** add namespace option by [@pierrop](https://github.com/pierrop) in [#220](https://github.com/jdx/fnox/pull/220)
- add JSON schema for fnox.toml by [@jdx](https://github.com/jdx) in [#196](https://github.com/jdx/fnox/pull/196)
- add --all flag to provider test command by [@jdx](https://github.com/jdx) in [#202](https://github.com/jdx/fnox/pull/202)
- add documentation URLs to error diagnostics by [@jdx](https://github.com/jdx) in [#212](https://github.com/jdx/fnox/pull/212)
- preserve source error chains for JSON/YAML errors by [@jdx](https://github.com/jdx) in [#214](https://github.com/jdx/fnox/pull/214)
- use structured error variants instead of generic Config/Provider by [@jdx](https://github.com/jdx) in [#213](https://github.com/jdx/fnox/pull/213)
- add "Did you mean?" suggestions for typos by [@jdx](https://github.com/jdx) in [#204](https://github.com/jdx/fnox/pull/204)
- add --dry-run flag to data-modifying commands by [@jdx](https://github.com/jdx) in [#201](https://github.com/jdx/fnox/pull/201)
- Support fnox.toml (and variants) dotfiles. by [@dharrigan](https://github.com/dharrigan) in [#141](https://github.com/jdx/fnox/pull/141)
- add source code spans for better error reporting by [@jdx](https://github.com/jdx) in [#205](https://github.com/jdx/fnox/pull/205)
- use #[related] for validation errors to show all issues at once by [@jdx](https://github.com/jdx) in [#211](https://github.com/jdx/fnox/pull/211)
- add source code span tracking for default_provider errors by [@jdx](https://github.com/jdx) in [#209](https://github.com/jdx/fnox/pull/209)
- add source code span tracking for SecretConfig.value by [@jdx](https://github.com/jdx) in [#210](https://github.com/jdx/fnox/pull/210)
- improve miette error handling with structured provider errors and URLs by [@jdx](https://github.com/jdx) in [#216](https://github.com/jdx/fnox/pull/216)

### 🐛 Bug Fixes

- update claude CLI model and add bypassPermissions by [@jdx](https://github.com/jdx) in [#194](https://github.com/jdx/fnox/pull/194)
- update claude CLI model and add bypassPermissions by [@jdx](https://github.com/jdx) in [#195](https://github.com/jdx/fnox/pull/195)
- preserve TOML comments in `fnox set` by [@jdx](https://github.com/jdx) in [#223](https://github.com/jdx/fnox/pull/223)

### 🚜 Refactor

- convert miette::miette!() to FnoxError in encrypt.rs and list.rs by [@jdx](https://github.com/jdx) in [#208](https://github.com/jdx/fnox/pull/208)
- use structured errors in remove and export commands by [@jdx](https://github.com/jdx) in [#206](https://github.com/jdx/fnox/pull/206)
- use structured errors in import command by [@jdx](https://github.com/jdx) in [#207](https://github.com/jdx/fnox/pull/207)

### 📚 Documentation

- add comprehensive TUI dashboard guide by [@jdx](https://github.com/jdx) in [#203](https://github.com/jdx/fnox/pull/203)
- add mise integration guide by [@jdx](https://github.com/jdx) in [#215](https://github.com/jdx/fnox/pull/215)

### ⚡ Performance

- reduce KMS API calls in CI tests by [@jdx](https://github.com/jdx) in [#217](https://github.com/jdx/fnox/pull/217)

### 🛡️ Security

- add Black Ops One font branding to docs by [@jdx](https://github.com/jdx) in [#198](https://github.com/jdx/fnox/pull/198)

### 📦️ Dependency Updates

- lock file maintenance by [@renovate[bot]](https://github.com/renovate[bot]) in [#197](https://github.com/jdx/fnox/pull/197)
- update jdx/mise-action digest to 6d1e696 by [@renovate[bot]](https://github.com/renovate[bot]) in [#218](https://github.com/jdx/fnox/pull/218)
- update rust crate proc-macro2 to v1.0.106 by [@renovate[bot]](https://github.com/renovate[bot]) in [#219](https://github.com/jdx/fnox/pull/219)

### New Contributors

- @pierrop made their first contribution in [#220](https://github.com/jdx/fnox/pull/220)
- @dharrigan made their first contribution in [#141](https://github.com/jdx/fnox/pull/141)

## [1.9.2](https://github.com/jdx/fnox/compare/v1.9.1..v1.9.2) - 2026-01-19

### 🚀 Features

- add interactive TUI dashboard using ratatui by [@jdx](https://github.com/jdx) in [#188](https://github.com/jdx/fnox/pull/188)

### 🐛 Bug Fixes

- gen-release-notes improvements by [@jdx](https://github.com/jdx) in [#191](https://github.com/jdx/fnox/pull/191)

### 🔍 Other Changes

- exclude CHANGELOG.md from prettier by [@jdx](https://github.com/jdx) in [#190](https://github.com/jdx/fnox/pull/190)

## [1.9.1](https://github.com/jdx/fnox/compare/v1.9.0..v1.9.1) - 2026-01-19

### 🐛 Bug Fixes

- use positional args in gen-release-notes by [@jdx](https://github.com/jdx) in [#187](https://github.com/jdx/fnox/pull/187)

## [1.9.0](https://github.com/jdx/fnox/compare/v1.8.0..v1.9.0) - 2026-01-19

### 🚀 Features

- add authentication prompting for expired credentials by [@jdx](https://github.com/jdx) in [#184](https://github.com/jdx/fnox/pull/184)
- add LLM-generated editorialized release notes by [@jdx](https://github.com/jdx) in [#185](https://github.com/jdx/fnox/pull/185)

### 🐛 Bug Fixes

- remove LLM generation from release-plz by [@jdx](https://github.com/jdx) in [#186](https://github.com/jdx/fnox/pull/186)

### 🚜 Refactor

- **(edit)** batch resolve secrets by profile for efficiency by [@johnpyp](https://github.com/johnpyp) in [#182](https://github.com/jdx/fnox/pull/182)

## [1.8.0](https://github.com/jdx/fnox/compare/v1.7.0..v1.8.0) - 2026-01-17

### 🚀 Features

- add passwordstate provider by [@davidolrik](https://github.com/davidolrik) in [#147](https://github.com/jdx/fnox/pull/147)
- aws-ps batch concurrency, aws-kms 10 -> 100 concurrency by [@johnpyp](https://github.com/johnpyp) in [#180](https://github.com/jdx/fnox/pull/180)

### 🐛 Bug Fixes

- resolve clippy unused_assignments warnings in error.rs by [@jdx](https://github.com/jdx) in [#174](https://github.com/jdx/fnox/pull/174)
- improve AWS SDK error messages and enable SSO support by [@daghoidahl](https://github.com/daghoidahl) in [#173](https://github.com/jdx/fnox/pull/173)

### 📚 Documentation

- add AWS Parameter store to sidebar and provider lists by [@johnpyp](https://github.com/johnpyp) in [#178](https://github.com/jdx/fnox/pull/178)

### 🧪 Testing

- Add missing skip logic to aws_parameter_store.bats by [@jdx](https://github.com/jdx) in [#145](https://github.com/jdx/fnox/pull/145)

### 🛡️ Security

- **(deps)** update azure-sdk-for-rust monorepo to 0.30 by [@renovate[bot]](https://github.com/renovate[bot]) in [#144](https://github.com/jdx/fnox/pull/144)

### 📦️ Dependency Updates

- pin dependencies by [@renovate[bot]](https://github.com/renovate[bot]) in [#133](https://github.com/jdx/fnox/pull/133)
- update rust crate demand to v1.8.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#134](https://github.com/jdx/fnox/pull/134)
- lock file maintenance by [@renovate[bot]](https://github.com/renovate[bot]) in [#137](https://github.com/jdx/fnox/pull/137)
- update rust crate usage-lib to v2.9.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#143](https://github.com/jdx/fnox/pull/143)
- update rust crate age to v0.11.2 by [@renovate[bot]](https://github.com/renovate[bot]) in [#149](https://github.com/jdx/fnox/pull/149)
- update aws-sdk-rust monorepo to v1.8.12 by [@renovate[bot]](https://github.com/renovate[bot]) in [#148](https://github.com/jdx/fnox/pull/148)
- update rust crate gcp_auth to v0.12.5 by [@renovate[bot]](https://github.com/renovate[bot]) in [#151](https://github.com/jdx/fnox/pull/151)
- update rust crate dbus to v0.9.10 by [@renovate[bot]](https://github.com/renovate[bot]) in [#150](https://github.com/jdx/fnox/pull/150)
- update rust crate google-cloud-secretmanager-v1 to v1.2.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#153](https://github.com/jdx/fnox/pull/153)
- update rust crate reqwest to v0.12.25 by [@renovate[bot]](https://github.com/renovate[bot]) in [#152](https://github.com/jdx/fnox/pull/152)
- lock file maintenance by [@renovate[bot]](https://github.com/renovate[bot]) in [#154](https://github.com/jdx/fnox/pull/154)
- update dependency vue to v3.5.26 by [@renovate[bot]](https://github.com/renovate[bot]) in [#156](https://github.com/jdx/fnox/pull/156)
- update rust crate console to v0.16.2 by [@renovate[bot]](https://github.com/renovate[bot]) in [#157](https://github.com/jdx/fnox/pull/157)
- lock file maintenance by [@renovate[bot]](https://github.com/renovate[bot]) in [#162](https://github.com/jdx/fnox/pull/162)
- update rust crate arc-swap to v1.8.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#167](https://github.com/jdx/fnox/pull/167)
- update rust crate chrono to v0.4.43 by [@renovate[bot]](https://github.com/renovate[bot]) in [#176](https://github.com/jdx/fnox/pull/176)
- update aws-sdk-rust monorepo to v1.98.0 by [@renovate[bot]](https://github.com/renovate[bot]) in [#177](https://github.com/jdx/fnox/pull/177)

### New Contributors

- @johnpyp made their first contribution in [#180](https://github.com/jdx/fnox/pull/180)
- @daghoidahl made their first contribution in [#173](https://github.com/jdx/fnox/pull/173)
- @davidolrik made their first contribution in [#147](https://github.com/jdx/fnox/pull/147)

## [1.7.0](https://github.com/jdx/fnox/compare/v1.6.1..v1.7.0) - 2025-11-27

### 🚀 Features

- **(init)** improve wizard with traits and missing providers by [@jdx](https://github.com/jdx) in [#129](https://github.com/jdx/fnox/pull/129)
- add KeePass provider support by [@jdx](https://github.com/jdx) in [#123](https://github.com/jdx/fnox/pull/123)
- add AWS Parameter Store provider support by [@jdx](https://github.com/jdx) in [#126](https://github.com/jdx/fnox/pull/126)
- support global config file for machine-wide secrets by [@jdx](https://github.com/jdx) in [#128](https://github.com/jdx/fnox/pull/128)
- add secret references in provider configuration by [@jdx](https://github.com/jdx) in [#131](https://github.com/jdx/fnox/pull/131)

### 🐛 Bug Fixes

- **(set)** always write to local config, create override for parent secrets by [@jdx](https://github.com/jdx) in [#122](https://github.com/jdx/fnox/pull/122)

### 🚜 Refactor

- simplify Provider trait by removing key_file parameter by [@jdx](https://github.com/jdx) in [#124](https://github.com/jdx/fnox/pull/124)

### 📚 Documentation

- add KeePass provider documentation by [@jdx](https://github.com/jdx) in [#125](https://github.com/jdx/fnox/pull/125)

### ⚡ Performance

- **(tests)** reduce AWS Secrets Manager API calls by [@jdx](https://github.com/jdx) in [#127](https://github.com/jdx/fnox/pull/127)

## [1.6.1](https://github.com/jdx/fnox/compare/v1.6.0..v1.6.1) - 2025-11-26

### 🐛 Bug Fixes

- **(edit)** preserve all user edits including non-secret config by [@jdx](https://github.com/jdx) in [#119](https://github.com/jdx/fnox/pull/119)

### 🚜 Refactor

- **(age)** use age crate for encryption instead of CLI by [@KokaKiwi](https://github.com/KokaKiwi) in [#112](https://github.com/jdx/fnox/pull/112)
- **(password-store)** implement Provider trait with put_secret returning key by [@KokaKiwi](https://github.com/KokaKiwi) in [#117](https://github.com/jdx/fnox/pull/117)

### 📚 Documentation

- add password-store provider documentation by [@KokaKiwi](https://github.com/KokaKiwi) in [#111](https://github.com/jdx/fnox/pull/111)

### 📦️ Dependency Updates

- lock file maintenance by [@renovate[bot]](https://github.com/renovate[bot]) in [#113](https://github.com/jdx/fnox/pull/113)
- lock file maintenance by [@renovate[bot]](https://github.com/renovate[bot]) in [#114](https://github.com/jdx/fnox/pull/114)

### New Contributors

- @renovate[bot] made their first contribution in [#114](https://github.com/jdx/fnox/pull/114)

## [1.6.0](https://github.com/jdx/fnox/compare/v1.5.2..v1.6.0) - 2025-11-21

### 🚀 Features

- add password-store provider with GPG-encrypted local storage by [@KokaKiwi](https://github.com/KokaKiwi) in [#102](https://github.com/jdx/fnox/pull/102)

### 🐛 Bug Fixes

- prevent config hierarchy duplication in fnox set command by [@jdx](https://github.com/jdx) in [#107](https://github.com/jdx/fnox/pull/107)
- preserve newly created profile sections in edit command by [@jdx](https://github.com/jdx) in [#108](https://github.com/jdx/fnox/pull/108)

### 📚 Documentation

- add looping example for age provider by [@Lailanater](https://github.com/Lailanater) in [#106](https://github.com/jdx/fnox/pull/106)

### New Contributors

- @Lailanater made their first contribution in [#106](https://github.com/jdx/fnox/pull/106)
- @KokaKiwi made their first contribution in [#102](https://github.com/jdx/fnox/pull/102)

## [1.5.2](https://github.com/jdx/fnox/compare/v1.5.1..v1.5.2) - 2025-11-19

### 🐛 Bug Fixes

- **(ci)** vendor dbus dependency for cross-compilation by [@jdx](https://github.com/jdx) in [#99](https://github.com/jdx/fnox/pull/99)

## [1.5.1](https://github.com/jdx/fnox/compare/v1.5.0..v1.5.1) - 2025-11-18

### 🐛 Bug Fixes

- **(ci)** configure dbus dependencies for cross-compilation by [@jdx](https://github.com/jdx) in [#97](https://github.com/jdx/fnox/pull/97)

## [1.5.0](https://github.com/jdx/fnox/compare/v1.4.0..v1.5.0) - 2025-11-18

### 🚀 Features

- **(bitwarden)** rbw support (experimental) by [@nilleb](https://github.com/nilleb) in [#91](https://github.com/jdx/fnox/pull/91)

### 🐛 Bug Fixes

- **(ci)** bitwarden setup by [@nilleb](https://github.com/nilleb) in [#92](https://github.com/jdx/fnox/pull/92)
- **(ci)** install dbus dependencies for release workflow by [@jdx](https://github.com/jdx) in [#96](https://github.com/jdx/fnox/pull/96)

## [1.4.0](https://github.com/jdx/fnox/compare/v1.3.0..v1.4.0) - 2025-11-15

### 🚀 Features

- **(bitwarden)** specify profile by [@nilleb](https://github.com/nilleb) in [#90](https://github.com/jdx/fnox/pull/90)

### 🐛 Bug Fixes

- **(ci)** make final job fail if any dependencies fail by [@jdx](https://github.com/jdx) in [#74](https://github.com/jdx/fnox/pull/74)
- **(ci)** install dbus dependencies for autofix and release-plz workflows by [@jdx](https://github.com/jdx) in [#89](https://github.com/jdx/fnox/pull/89)
- **(docs)** imports -> import by [@lttb](https://github.com/lttb) in [#84](https://github.com/jdx/fnox/pull/84)
- **(edit)** add .toml extension, decrypt secrets properly, and support adding new secrets by [@jdx](https://github.com/jdx) in [#88](https://github.com/jdx/fnox/pull/88)
- **(keychain)** use Secret Service backend for Linux by [@jdx](https://github.com/jdx) in [#86](https://github.com/jdx/fnox/pull/86)
- respect --profile/-P CLI flag when loading config files by [@jdx](https://github.com/jdx) in [#87](https://github.com/jdx/fnox/pull/87)

### 🔍 Other Changes

- shellcheck/shfmt by [@jdx](https://github.com/jdx) in [#77](https://github.com/jdx/fnox/pull/77)

### New Contributors

- @nilleb made their first contribution in [#90](https://github.com/jdx/fnox/pull/90)
- @lttb made their first contribution in [#84](https://github.com/jdx/fnox/pull/84)

## [1.3.0](https://github.com/jdx/fnox/compare/v1.2.3..v1.3.0) - 2025-11-01

### 🚀 Features

- add support for fnox.$FNOX_PROFILE.toml config files by [@jdx](https://github.com/jdx) in [#64](https://github.com/jdx/fnox/pull/64)
- add Infisical provider with CLI integration and self-hosted CI by [@jdx](https://github.com/jdx) in [#67](https://github.com/jdx/fnox/pull/67)

### 🐛 Bug Fixes

- **(tests)** skip keychain tests in CI when gnome-keyring-daemon unavailable by [@jdx](https://github.com/jdx) in [#72](https://github.com/jdx/fnox/pull/72)
- **(tests)** let gnome-keyring-daemon create its own control directory by [@jdx](https://github.com/jdx) in [#73](https://github.com/jdx/fnox/pull/73)
- add unique namespacing to parallel provider tests by [@jdx](https://github.com/jdx) in [#68](https://github.com/jdx/fnox/pull/68)

### 🚜 Refactor

- remove unused env_diff module and __FNOX_DIFF by [@jdx](https://github.com/jdx) in [#70](https://github.com/jdx/fnox/pull/70)

### ⚡ Performance

- parallelize CI tests across GHA workers using tranches by [@jdx](https://github.com/jdx) in [#65](https://github.com/jdx/fnox/pull/65)

### 🛡️ Security

- **(security)** store only hashes in __FNOX_SESSION instead of plaintext secrets by [@jdx](https://github.com/jdx) in [#71](https://github.com/jdx/fnox/pull/71)

## [1.2.3](https://github.com/jdx/fnox/compare/v1.2.2..v1.2.3) - 2025-11-01

### 🐛 Bug Fixes

- support FNOX_AGE_KEY by [@Cantido](https://github.com/Cantido) in [#60](https://github.com/jdx/fnox/pull/60)
- use inline tables by default in TOML output and preserve existing format by [@jdx](https://github.com/jdx) in [#62](https://github.com/jdx/fnox/pull/62)
- enhance edit command to decrypt secrets before editing by [@jdx](https://github.com/jdx) in [#63](https://github.com/jdx/fnox/pull/63)

### 📚 Documentation

- use single-line TOML syntax with section headers by [@jdx](https://github.com/jdx) in [#51](https://github.com/jdx/fnox/pull/51)
- clean up documentation and organize providers sidebar by [@jdx](https://github.com/jdx) in [cd019c0](https://github.com/jdx/fnox/commit/cd019c00a77370790444d85d4bc80d25f63ceacc)

### 🛡️ Security

- warn about multiline secrets in ci-redact by [@jdx](https://github.com/jdx) in [#53](https://github.com/jdx/fnox/pull/53)

### 🔍 Other Changes

- add semantic PR title validation by [@jdx](https://github.com/jdx) in [#61](https://github.com/jdx/fnox/pull/61)

### New Contributors

- @Cantido made their first contribution in [#60](https://github.com/jdx/fnox/pull/60)

## [1.2.2](https://github.com/jdx/fnox/compare/v1.2.1..v1.2.2) - 2025-10-29

### 🐛 Bug Fixes

- resolve secrets from providers when using --values flag in list command by [@jdx](https://github.com/jdx) in [#47](https://github.com/jdx/fnox/pull/47)
- hook-env now inherits providers from parent configs by [@jdx](https://github.com/jdx) in [#37](https://github.com/jdx/fnox/pull/37)

### 🚜 Refactor

- change profile flag from -p to -P by [@jdx](https://github.com/jdx) in [#42](https://github.com/jdx/fnox/pull/42)

### 📚 Documentation

- clean up local overrides docs by [@jdx](https://github.com/jdx) in [#46](https://github.com/jdx/fnox/pull/46)

### 🔍 Other Changes

- Update commands reference link to CLI reference by [@thomascjohnson](https://github.com/thomascjohnson) in [#44](https://github.com/jdx/fnox/pull/44)
- add autofix.ci workflow for automatic linting fixes by [@jdx](https://github.com/jdx) in [#45](https://github.com/jdx/fnox/pull/45)

### New Contributors

- @thomascjohnson made their first contribution in [#44](https://github.com/jdx/fnox/pull/44)

## [1.2.1](https://github.com/jdx/fnox/compare/v1.2.0..v1.2.1) - 2025-10-28

### 🛡️ Security

- **(import)** require --provider flag to prevent plaintext storage by [@jdx](https://github.com/jdx) in [#35](https://github.com/jdx/fnox/pull/35)

## [1.2.0](https://github.com/jdx/fnox/compare/v1.1.0..v1.2.0) - 2025-10-28

### 🚀 Features

- add support for fnox.local.toml local config overrides by [@jdx](https://github.com/jdx) in [#30](https://github.com/jdx/fnox/pull/30)
- add batch secret resolution to improve performance by [@jdx](https://github.com/jdx) in [#31](https://github.com/jdx/fnox/pull/31)

### 🐛 Bug Fixes

- import command now reads from input file instead of config file by [@jdx](https://github.com/jdx) in [#28](https://github.com/jdx/fnox/pull/28)

### 📚 Documentation

- Add VitePress documentation and GitHub Pages deployment by [@jdx](https://github.com/jdx) in [#32](https://github.com/jdx/fnox/pull/32)

### 🔍 Other Changes

- Update URLs to use custom domain fnox.jdx.dev and remove DOCS_DEPLOYMENT.md by [@jdx](https://github.com/jdx) in [79a2c78](https://github.com/jdx/fnox/commit/79a2c7875e8b74283b71093be74d1e41171e5143)
- Remove DOCS_DEPLOYMENT.md by [@jdx](https://github.com/jdx) in [dd9cb7b](https://github.com/jdx/fnox/commit/dd9cb7b90c6ffff43074aaba5908cc444bb8f412)
- Remove ONEPASSWORD.md (content migrated to docs) by [@jdx](https://github.com/jdx) in [622baa3](https://github.com/jdx/fnox/commit/622baa3052abdebce3955d181848770bf9ef1ed6)
- Add fnox vault logo by [@jdx](https://github.com/jdx) in [95a100f](https://github.com/jdx/fnox/commit/95a100fd22b6c9019a5d8e0d907680a235ec52bd)
- Add auto-generated CLI reference documentation by [@jdx](https://github.com/jdx) in [582af5b](https://github.com/jdx/fnox/commit/582af5ba07f232f727041934af344bf953d72bab)
- Show CLI Reference in sidebar on all pages by [@jdx](https://github.com/jdx) in [a19d6d1](https://github.com/jdx/fnox/commit/a19d6d127ae7d462424390147e9d46643dff16a6)
- Remove 'When to Use' sections from provider docs by [@jdx](https://github.com/jdx) in [9fc9a75](https://github.com/jdx/fnox/commit/9fc9a756b9e85f5277deb46f0e11df61095eb663)
- Add custom dark theme with Fort Knox styling by [@jdx](https://github.com/jdx) in [9c83a2e](https://github.com/jdx/fnox/commit/9c83a2eb4a4e1e17bd793e6c1a6e56aecc25fac8)
- Fix dead links to /reference/commands by [@jdx](https://github.com/jdx) in [86762d8](https://github.com/jdx/fnox/commit/86762d8076f084f0fe704519dc4e2974d518dc02)

## [1.1.0](https://github.com/jdx/fnox/compare/v1.0.1..v1.1.0) - 2025-10-27

### 🚀 Features

- add top-level secret inheritance for profiles by [@jdx](https://github.com/jdx) in [#21](https://github.com/jdx/fnox/pull/21)
- add global if_missing configuration with priority chain by [@jdx](https://github.com/jdx) in [#22](https://github.com/jdx/fnox/pull/22)

### 🐛 Bug Fixes

- SSH key support in age provider by [@jdx](https://github.com/jdx) in [#26](https://github.com/jdx/fnox/pull/26)

## [1.0.1](https://github.com/jdx/fnox/compare/v1.0.0..v1.0.1) - 2025-10-26

### 🐛 Bug Fixes

- default to warn instead of error for missing secrets by [@jdx](https://github.com/jdx) in [#20](https://github.com/jdx/fnox/pull/20)
- expand tilde (~) in FNOX_AGE_KEY_FILE path by [@pepicrft](https://github.com/pepicrft) in [#17](https://github.com/jdx/fnox/pull/17)
- make the onepassword vault name optional by [@btkostner](https://github.com/btkostner) in [#15](https://github.com/jdx/fnox/pull/15)
- do not require OP_SERVICE_ACCOUNT_TOKEN for 1password by [@btkostner](https://github.com/btkostner) in [#16](https://github.com/jdx/fnox/pull/16)

### 🛡️ Security

- skip age setup and redact tests for fork PRs by [@jdx](https://github.com/jdx) in [#18](https://github.com/jdx/fnox/pull/18)

### 🔍 Other Changes

- **(ci)** add retry action for integration tests by [@jdx](https://github.com/jdx) in [#19](https://github.com/jdx/fnox/pull/19)
- **(release)** add macOS code signing to release workflow by [@jdx](https://github.com/jdx) in [#11](https://github.com/jdx/fnox/pull/11)
- wip by [@jdx](https://github.com/jdx) in [b164101](https://github.com/jdx/fnox/commit/b164101cdceac3e4c204fa5c400a48f976334a0d)
- Update README.md by [@jdx](https://github.com/jdx) in [10ac17e](https://github.com/jdx/fnox/commit/10ac17ec17a777ad9076755231229153577535b7)

### New Contributors

- @btkostner made their first contribution in [#16](https://github.com/jdx/fnox/pull/16)
- @pepicrft made their first contribution in [#17](https://github.com/jdx/fnox/pull/17)

## [1.0.0](https://github.com/jdx/fnox/compare/v0.2.2..v1.0.0) - 2025-10-20

### 🐛 Bug Fixes

- Remove duplicate openssl-sys from main dependencies by [@jdx](https://github.com/jdx) in [8b4c8c7](https://github.com/jdx/fnox/commit/8b4c8c787a0c301c6d4a4910001c7515a5c4a6a4)

## [0.2.2](https://github.com/jdx/fnox/compare/v0.2.1..v0.2.2) - 2025-10-20

### 🐛 Bug Fixes

- Clean up Azure CLI directory in test teardown by [@jdx](https://github.com/jdx) in [#5](https://github.com/jdx/fnox/pull/5)
- Make vendored OpenSSL Linux-only to fix Windows builds by [@jdx](https://github.com/jdx) in [#6](https://github.com/jdx/fnox/pull/6)

## [0.2.1](https://github.com/jdx/fnox/compare/v0.2.0..v0.2.1) - 2025-10-20

### 🐛 Bug Fixes

- Enable vendored OpenSSL for cross-compilation by [@jdx](https://github.com/jdx) in [#3](https://github.com/jdx/fnox/pull/3)

## [0.2.0](https://github.com/jdx/fnox/compare/v0.1.0..v0.2.0) - 2025-10-20

### 🚀 Features

- Add release workflow for building multi-platform binaries by [@jdx](https://github.com/jdx) in [04b63c7](https://github.com/jdx/fnox/commit/04b63c70b1a3d989cf71cca2d55d62ab5085085f)

### 🐛 Bug Fixes

- Remove label requirement from PR creation in release-plz by [@jdx](https://github.com/jdx) in [354d0a1](https://github.com/jdx/fnox/commit/354d0a17368e9051fb21fa8012356ecd83a60f35)
- Use FNOX_GH_TOKEN for PR creation permissions by [@jdx](https://github.com/jdx) in [decca13](https://github.com/jdx/fnox/commit/decca13e9a4a8e356bee8226011b1e9c868c6e5b)
- Use FNOX_GH_TOKEN in release workflow by [@jdx](https://github.com/jdx) in [64c774b](https://github.com/jdx/fnox/commit/64c774b77519602c84b20d033df10cbd468dd9d0)
- Remove incorrect [secrets] section assertions from init tests by [@jdx](https://github.com/jdx) in [7496483](https://github.com/jdx/fnox/commit/7496483a8c5bdeab615ab38616548dacfe7f4d83)

### 🔍 Other Changes

- Fix Bitwarden provider to use --session flag and close stdin by [@jdx](https://github.com/jdx) in [9dcfe86](https://github.com/jdx/fnox/commit/9dcfe86c4791c6f7cc4dcc9e5439c70a6b587c78)

### New Contributors

- @mise-en-dev made their first contribution in [#2](https://github.com/jdx/fnox/pull/2)

## [0.1.0] - 2025-10-20

### 🐛 Bug Fixes

- Handle repos with no tags in release-plz script by [@jdx](https://github.com/jdx) in [3fb62c6](https://github.com/jdx/fnox/commit/3fb62c686d32923fc182c799fc43aefd421bd071)

### 🔍 Other Changes

- init by [@jdx](https://github.com/jdx) in [8a39de2](https://github.com/jdx/fnox/commit/8a39de2e92e433eda02fda8ef686e609b7005463)

### New Contributors

- @jdx made their first contribution

<!-- generated by git-cliff -->