Milestones
List view
Patch release v1.3.6.
No due datePatch release v1.3.5.
No due datePatch release v1.3.4.
No due datePlugin lifecycle: nself remove left the command working and required Docker for a plugin with no tables; an installed plugin's manifest was never being read; the third-party install path had missed two fixes made to the registry path.
No due datebrew install was broken since 1.3.0 (formula carried 1.2.7 hashes). Permissions declared in the descriptive form are now enforced for the 121 plugins that were exempt. 52 commands to 49: release, flags and maintenance extracted.
No due dateSecurity: plugin signature verification was skipped on every cache-warm install, because the registry cache dropped authorPublicKey, signature and publishStatus together. Also a two-command plugin published only one binary, and nself install sentry resolved to the paid bundle.
No due dateThin core: 92 commands to 60, 25 command families extracted to plugins. Fixed the plugin install path, which was broken end to end — the registry cache dropped pluginType/binaryName, installing a CLI plugin required Docker, and the release pipeline shipped source with no binary.
No due datePatch release. Security: migrated off github.com/lib/pq (7 advisories, none with an upstream fix) to jackc/pgx v5; govulncheck goes from 7 findings to zero (#236, closes #232). Fixes: nself ssl add / ssl setup issued certificates that never reached nginx — the install step was missing entirely, the host and container cert paths disagreed, and renewal had no deploy-hook (#237). DR drill reminder no longer opens duplicate issues (#235). @nself/sdk publish is idempotent so a partially-failed release is re-runnable (#234). Embedded __heap_base is derived from the module's dylink.0 section instead of 0 (#239). Known issue carried: #231 (embedded PG does not boot — pglite exports no memory, so wasmtime's WASI cannot bind; needs a MAIN_MODULE build or a custom WASI shim).
No due datePatch release. 40 commits since v1.2.5. CI/release reliability: Go toolchain resolved from go.mod across all workflows (seven carried stale 1.22/1.25 pins that could not build a module requiring 1.26.6); govulncheck gated on a reviewed allowlist via one shared script rather than any-finding; sdk/py clean under ruff 0.16.3. Embedded Postgres: boot deadlock fixed (#221), __stack_pointer initialised to top of memory (#229). Integration tests quarantined pending #231. Known issues carried: #231 (embedded PG WASM SIDE_MODULE relocation), #232 (migrate off lib/pq, 7 unfixed advisories).
No due dateRelease v1.2.5 (nginx validation fix + SDK coherence)
No due dateRelease v1.2.4 (retroactive milestone for DENY-005 release gate)
No due dateRelease v1.2.3 (retroactive milestone for DENY-005 release gate)
No due dateRelease v1.2.2 (retroactive milestone for DENY-005 release gate)
No due dateRelease v1.2.1 (retroactive milestone for DENY-005 release gate)
No due dateRelease v1.2.0 (retroactive milestone for DENY-005 release gate)
No due date- No due date
nSelf CLI v1.1.7 release
No due datenSelf CLI v1.1.4 — P103 patch release
No due date