Prepare 0.8.0

CHANGELOG.md

@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.8.0]
+
 This release stops nvx asking questions an agent could answer, closes a set of
 sandbox and check gaps that 0.7.0 shipped with, and makes pnpm, yarn and bun
 installs as checked as npm ones. Read "Upgrading from 0.7.0" first. Several

internal/nvx/main.go

@@ -812,7 +812,7 @@ func printHelp() {
 // list in README.md. The two are hand-maintained copies and had already drifted:
 // the README was missing doctor, grants, import, setup and shim.
 func helpText() string {
-	return `nvx - A Node.js and Bun version manager that runs package installs in an OS sandbox
+	return `nvx - Runs npm install and npx in an OS sandbox, and manages Node.js and Bun versions
 
 Usage:
   nvx <command> [arguments]

internal/nvx/version.go

@@ -13,7 +13,7 @@ import (
 	"time"
 )
 
-var appVersion = "0.7.0"
+var appVersion = "0.8.0"
 
 // Release represents a Node.js release from the official index.json
 type Release struct {

site/src/content/docs/docs/commands.md

@@ -154,7 +154,7 @@ This is what `nvx help` prints, including every flag and environment
 variable.
 
 ```text
-nvx - A Node.js and Bun version manager that runs package installs in an OS sandbox
+nvx - Runs npm install and npx in an OS sandbox, and manages Node.js and Bun versions
 
 Usage:
   nvx <command> [arguments]

site/src/data/site-content/changelog.ts

@@ -38,6 +38,8 @@ export const changelogSurfaces: ChangelogSurface[] = [
 ];
 
 export const releaseSummaries: Record<string, string> = {
+  'v0.8.0':
+    'Security release. Closes three ways code could get out of the 0.7.0 sandbox or run as you, and makes widening the sandbox a command you run yourself. Agent mode refuses instead of approving, every .env is hidden on all three systems, and installs use the exact lockfile nvx checked.',
   'v0.7.0':
     'The first Authenticode-signed release, and nvx is on npm. pnpm installs inside the Windows sandbox, nvx setup takes seconds, and the pre-install checks cover every package an npm install brings in.',
   'v0.6.0':

site/src/data/site-content/version.ts

@@ -1,4 +1,4 @@
 // The version the structured data and the changelog page report. nvx's own
 // source of truth is internal/nvx/version.go, which a Go test holds equal to
 // the newest CHANGELOG heading; bump this alongside a release.
-export const productVersion = '0.7.0';
+export const productVersion = '0.8.0';