v0.7.6

Changelog

Bug fixes

• f23ea48: fix(ssh): pass GIT_PROTOCOL from ssh session down to binary (@aymanbagabas)

---

Verifying the artifacts

First, download the checksums.txt file, for example, with wget:

wget 'https://github.com/charmbracelet/soft-serve/releases/download/v0.7.6/checksums.txt'

Then, verify it using cosign:

cosign verify-blob \
  --certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --cert 'https://github.com/charmbracelet/soft-serve/releases/download/v0.7.6/checksums.txt.pem' \
  --signature 'https://github.com/charmbracelet/soft-serve/releases/download/v0.7.6/checksums.txt.sig' \
  ./checksums.txt

If the output is Verified OK, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum:

sha256sum --ignore-missing -c checksums.txt

Done! You artifacts are now verified!

Thoughts? Questions? We love hearing from you. Feel free to reach out on Twitter, The Fediverse, or on Discord.

v0.7.5

Changelog

New Features

• e02c00f: feat(tests): add a testcase for soft man (@aymanbagabas)
• fc81914: feat: add ssh lfs-transfer tests (@aymanbagabas)
• c3915b2: feat: run test coverage against postgres (@aymanbagabas)
• a985ccd: feat: test ssh ui output (@aymanbagabas)
• 40d76a1: feat: update integration tests (#434) (@aymanbagabas)

Bug fixes

• 81ee0ec: fix(git): hang on git i/o error (@aymanbagabas)
• f801b96: fix(meta): use "chore" prefix for dependabot (@aymanbagabas)
• 43f087f: fix(mirror): add user missing from context (@nilium)
• b15f874: fix(mirror): don't need git gc (@aymanbagabas)
• 07076f8: fix(mirror): skip LFS instead of failing to mirror a repo (@nilium)
• 0e77ee9: fix(ssh): allocate pty and use the latest tea middleware (@aymanbagabas)
• 621d920: fix(ssh): check of empty pk and tidy context mw (@aymanbagabas)
• d54c6de: fix(ssh): emulate pty on windows (@aymanbagabas)
• 6c917ac: fix(test): path separator on windows (@aymanbagabas)
• 8c9777d: fix(test): tidy testscript and skip ssh-lfs test (@aymanbagabas)
• 6e9db8e: fix(web): superfluous write (@aymanbagabas)
• 8c181bc: fix(web): write http prefix before references (@aymanbagabas)
• abd5580: fix(webhook): we don't care about the default branch if it's missing (@aymanbagabas)
• b06b555: fix: disable soft-browse test (@aymanbagabas)
• 143918b: fix: executable path in hooks (#459) (@wahjava)
• 047b6a7: fix: invalid error on empty repo collabs (#466) (@aymanbagabas)
• 0191234: fix: lint (@aymanbagabas)
• 194455d: fix: lint issues (@aymanbagabas)
• d119d53: fix: only use glamour for mk files (#467) (@aymanbagabas)
• aa15af5: fix: tidy notify os interrupt signals (@aymanbagabas)
• 7b97817: fix: unquote git quoted filenames (@aymanbagabas)
• 920e4a7: fix: use lipgloss renderers (@aymanbagabas)
• bb59bee: fix: use the latest git-lfs-transfer and update implementation (@aymanbagabas)

Dependency updates

• cd964a6: feat(deps): bump github.com/go-git/go-git/v5 from 5.10.1 to 5.11.0 (@dependabot[bot])
• 45ce909: feat(deps): bump github.com/golang-jwt/jwt/v5 from 5.1.0 to 5.2.0 (#437) (@dependabot[bot])
• e064c39: feat(deps): bump github.com/google/uuid from 1.4.0 to 1.5.0 (@dependabot[bot])
• dbe42e3: feat(deps): bump github.com/prometheus/client_golang (@dependabot[bot])
• 3e75d86: feat(deps): bump github.com/rogpeppe/go-internal (@dependabot[bot])
• 538de6a: feat(deps): bump golang.org/x/crypto from 0.16.0 to 0.17.0 (@dependabot[bot])
• 3d02df4: feat(deps): bump golang.org/x/crypto from 0.17.0 to 0.18.0 (@dependabot[bot])
• d1d7d7f: feat(deps): bump golang.org/x/sync from 0.5.0 to 0.6.0 (@dependabot[bot])
• afeae6c: feat(deps): bump modernc.org/sqlite from 1.27.0 to 1.28.0 (@dependabot[bot])

Documentation updates

• 87d61a3: docs(README): add Windows install instruction for Winget (#304) (@kbdharun)
• 83495e2: docs: add CLI instructions for mirrors to README (#543) (@rubenhoenle)
• 876db8d: docs: correct spelling of read-only (@mkirl)
• 11c0bc5: docs: update readme root.go to main.go (#478) (@pratikkuikel)

Other work

• bba9b26: Correct make repo private command in README.md (#515) (@troylusty)
• 15d661f: Create CODEOWNERS (@maaslalani)
• 6ddae64: Simplify installation with brew (#534) (@skatkov)
• b5f5721: build: fix golanci-lint configs (@caarlos0)
• b4da757: ci: sign & notarize macos binaries (#537) (@caarlos0)
• ca7c2bb: docs(docker README): Update docker file with SOFT_SERVE_INITIAL_ADMIN_KEYS env variable for both docker and compose examples (@CRBroughton)
• 4daebdd: sec: do not append session envs to git run (#544) (@caarlos0)

---

Verifying the artifacts

First, download the checksums.txt file, for example, with wget:

wget 'https://github.com/charmbracelet/soft-serve/releases/download/v0.7.5/checksums.txt'

Then, verify it using cosign:

cosign verify-blob \
  --certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --cert 'https://github.com/charmbracelet/soft-serve/releases/download/v0.7.5/checksums.txt.pem' \
  --signature 'https://github.com/charmbracelet/soft-serve/releases/download/v0.7.5/checksums.txt.sig' \
  ./checksums.txt

If the output is Verified OK, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum:

sha256sum --ignore-missing -c checksums.txt

Done! You artifacts are now verified!

Thoughts? Questions? We love hearing from you. Feel free to reach out on Twitter, The Fediverse, or on Discord.

v0.7.4

Changelog

Bug fixes

• 178b9d5: fix(daemon): tests after upgrading go-git (@aymanbagabas)
• fc2c62f: fix(daemon): timeout test (@aymanbagabas)
• fa23c9c: fix(ui): dry glamour chroma renderer (@aymanbagabas)
• e419a93: fix(ui): go back on esc (@aymanbagabas)
• 0a38578: fix(ui): hide clone command while browse only (@aymanbagabas)
• 812d840: fix(ui): render about page using glamour (@aymanbagabas)

Dependency updates

• 4ccd373: feat(deps): bump github.com/charmbracelet/log from 0.3.0 to 0.3.1 (#431) (@dependabot[bot])
• 0ec24e3: feat(deps): bump github.com/go-git/go-git/v5 from 5.10.0 to 5.10.1 (#429) (@dependabot[bot])
• 8e5966a: feat(deps): bump golang.org/x/crypto from 0.15.0 to 0.16.0 (#430) (@dependabot[bot])

Other work

• bac2ff3: build: avoid duplicated CI runs (#433) (@caarlos0)

---

Verifying the artifacts

First, download the checksums.txt file, for example, with wget:

wget 'https://github.com/charmbracelet/soft-serve/releases/download/v0.7.4/checksums.txt'

Then, verify it using cosign:

cosign verify-blob \
  --certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --cert 'https://github.com/charmbracelet/soft-serve/releases/download/v0.7.4/checksums.txt.pem' \
  --signature 'https://github.com/charmbracelet/soft-serve/releases/download/v0.7.4/checksums.txt.sig' \
  ./checksums.txt

If the output is Verified OK, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum:

sha256sum --ignore-missing -c checksums.txt

Done! You artifacts are now verified!

Thoughts? Questions? We love hearing from you. Feel free to reach out on Twitter, The Fediverse, or on Discord.

v0.7.3

Changelog

Bug fixes

• 63786d0: fix(web): superfluous write (@aymanbagabas)

---

Verifying the artifacts

First, download the checksums.txt file, for example, with wget:

wget 'https://github.com/charmbracelet/soft-serve/releases/download/v0.7.3/checksums.txt'

Then, verify it using cosign:

cosign verify-blob \
  --certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --cert 'https://github.com/charmbracelet/soft-serve/releases/download/v0.7.3/checksums.txt.pem' \
  --signature 'https://github.com/charmbracelet/soft-serve/releases/download/v0.7.3/checksums.txt.sig' \
  ./checksums.txt

If the output is Verified OK, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum:

sha256sum --ignore-missing -c checksums.txt

Done! You artifacts are now verified!

Thoughts? Questions? We love hearing from you. Feel free to reach out on Twitter, The Fediverse, or on Discord.

v0.7.2

Changelog

Bug fixes

• e0148ca: fix(http): times out on large repositories (#428) (@aymanbagabas)
• 6dc3c59: fix: lint issues (@aymanbagabas)

Dependency updates

• 49f34dd: feat(deps): bump github.com/charmbracelet/log from 0.2.5 to 0.3.0 (#424) (@dependabot[bot])
• e6713ba: feat(deps): bump github.com/go-jose/go-jose/v3 from 3.0.0 to 3.0.1 (#423) (@dependabot[bot])
• ccb46a4: feat(deps): bump github.com/golang-jwt/jwt/v5 from 5.0.0 to 5.1.0 (#422) (@dependabot[bot])
• 40423e8: feat(deps): bump github.com/gorilla/handlers from 1.5.1 to 1.5.2 (#419) (@dependabot[bot])
• fabeb84: feat(deps): bump github.com/gorilla/mux from 1.8.0 to 1.8.1 (#417) (@dependabot[bot])
• b5fa038: feat(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (#418) (@dependabot[bot])
• 71d2cd0: feat(deps): bump golang.org/x/crypto from 0.14.0 to 0.15.0 (#425) (@dependabot[bot])
• d5e81ad: feat(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (#420) (@dependabot[bot])
• 1383d18: feat(deps): bump modernc.org/sqlite from 1.26.0 to 1.27.0 (#416) (@dependabot[bot])

---

Verifying the artifacts

First, download the checksums.txt file, for example, with wget:

wget 'https://github.com/charmbracelet/soft-serve/releases/download/v0.7.2/checksums.txt'

Then, verify it using cosign:

cosign verify-blob \
  --certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --cert 'https://github.com/charmbracelet/soft-serve/releases/download/v0.7.2/checksums.txt.pem' \
  --signature 'https://github.com/charmbracelet/soft-serve/releases/download/v0.7.2/checksums.txt.sig' \
  ./checksums.txt

If the output is Verified OK, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum:

sha256sum --ignore-missing -c checksums.txt

Done! You artifacts are now verified!

Thoughts? Questions? We love hearing from you. Feel free to reach out on Twitter, The Fediverse, or on Discord.

v0.7.1

Local browsing, webhooks, stash, and blame views! You can now browse local repositories by running soft in any repo to see commits, files, diffs, stash, and blame.

Soft Serve now supports repository webhooks so you can get notifications about repository changes. See repository webhooks for more information.

Changelog

New Features

• 8f182ec: feat(ci): add codecov config (@aymanbagabas)
• 56a17a3: feat(ui): show committer in blame (@aymanbagabas)
• 02e1617: feat: browse local repositories (#369) (@aymanbagabas)
• e2e79fe: feat: job config (#402) (@jolheiser)
• 29de922: feat: update to latest env (#412) (@caarlos0)

Bug fixes

• f76ae7a: fix(config): add jobs default config (@aymanbagabas)
• 03ba1ab: fix(gomod): use git-module fork (@aymanbagabas)
• 35582d2: fix: remove unwanted gitattributes (@aymanbagabas)
• f915f4d: refactor,fix: add rename lfs objects migration (#409) (@aymanbagabas)

Dependency updates

• da50842: feat(deps): bump github.com/charmbracelet/keygen from 0.4.3 to 0.5.0 (#398) (@dependabot[bot])
• 9503c88: feat(deps): bump github.com/charmbracelet/lipgloss from 0.8.0 to 0.9.1 (#401) (@dependabot[bot])
• d1ab2b5: feat(deps): bump github.com/charmbracelet/log from 0.2.4 to 0.2.5 (#394) (@dependabot[bot])
• a735362: feat(deps): bump github.com/charmbracelet/wish from 1.1.1 to 1.2.0 (#407) (@dependabot[bot])
• e319131: feat(deps): bump github.com/go-git/go-git/v5 from 5.9.0 to 5.10.0 (#404) (@dependabot[bot])
• 5852219: feat(deps): bump github.com/google/uuid from 1.3.0 to 1.3.1 (#405) (@dependabot[bot])
• 7ec3a38: feat(deps): bump github.com/google/uuid from 1.3.1 to 1.4.0 (#406) (@dependabot[bot])
• 6662e1a: feat(deps): bump golang.org/x/net from 0.15.0 to 0.17.0 (#400) (@dependabot[bot])
• 5df79ee: feat(deps): bump golang.org/x/sync from 0.3.0 to 0.4.0 (#395) (@dependabot[bot])

Other work

• 0846323: Repository webhooks (#375) (@aymanbagabas)
• 139be67: doc: update readme (#413) (@aymanbagabas)
• 0f41cab: refactor: rename pkgs (#408) (@aymanbagabas)

---

Verifying the artifacts

First, download the checksums.txt file, for example, with wget:

wget 'https://github.com/charmbracelet/soft-serve/releases/download/v0.7.1/checksums.txt'

Then, verify it using cosign:

cosign verify-blob \
  --certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --cert 'https://github.com/charmbracelet/soft-serve/releases/download/v0.7.1/checksums.txt.pem' \
  --signature 'https://github.com/charmbracelet/soft-serve/releases/download/v0.7.1/checksums.txt.sig' \
  ./checksums.txt

If the output is Verified OK, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum:

sha256sum --ignore-missing -c checksums.txt

Done! You artifacts are now verified!

Thoughts? Questions? We love hearing from you. Feel free to reach out on Twitter, The Fediverse, or on Discord.

v0.6.2

Changelog

Bug fixes

• 407c4ec: fix(ssh): add authentication middleware (@aymanbagabas)

Dependency updates

• d6b6f7c: feat(deps): bump github.com/hashicorp/golang-lru/v2 from 2.0.6 to 2.0.7 (#392) (@dependabot[bot])
• 53832a9: feat(deps): bump github.com/prometheus/client_golang (@dependabot[bot])
• 6f0a418: feat(deps): bump modernc.org/sqlite from 1.25.0 to 1.26.0 (#391) (@dependabot[bot])

---

Verifying the artifacts

First, download the checksums.txt file, for example, with wget:

wget 'https://github.com/charmbracelet/soft-serve/releases/download/v0.6.2/checksums.txt'

Then, verify it using cosign:

cosign verify-blob \
  --certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --cert 'https://github.com/charmbracelet/soft-serve/releases/download/v0.6.2/checksums.txt.pem' \
  --signature 'https://github.com/charmbracelet/soft-serve/releases/download/v0.6.2/checksums.txt.sig' \
  ./checksums.txt

If the output is Verified OK, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum:

sha256sum --ignore-missing -c checksums.txt

Done! You artifacts are now verified!

Thoughts? Questions? We love hearing from you. Feel free to reach out on Twitter, The Fediverse, or on Discord.

v0.6.1

Changelog

New Features

• 9021825: feat(ci): run tests against both sqlite and postgres (@aymanbagabas)

Bug fixes

• 6a42d89: fix(db): quote postgres keywords (#383) (@aymanbagabas)
• fa09286: fix: postgres driver issues (@aymanbagabas)

Dependency updates

• 5464150: feat(deps): bump github.com/go-git/go-git/v5 from 5.8.1 to 5.9.0 (#381) (@dependabot[bot])
• 3c747e4: feat(deps): bump golang.org/x/crypto from 0.12.0 to 0.13.0 (#379) (@dependabot[bot])

---

Verifying the artifacts

First, download the checksums.txt file, for example, with wget:

wget 'https://github.com/charmbracelet/soft-serve/releases/download/0.6.1/checksums.txt'

Then, verify it using cosign:

cosign verify-blob \
  --certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --cert 'https://github.com/charmbracelet/soft-serve/releases/download/0.6.1/checksums.txt.pem' \
  --signature 'https://github.com/charmbracelet/soft-serve/releases/download/0.6.1/checksums.txt.sig' \
  ./checksums.txt

If the output is Verified OK, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum:

sha256sum --ignore-missing -c checksums.txt

Done! You artifacts are now verified!

Thoughts? Questions? We love hearing from you. Feel free to reach out on Twitter, The Fediverse, or on Discord.

v0.6.0

Git LFS Support

Soft Serve now supports Git LFS over both HTTP and SSH. You can upload/download LFS files on your Soft Serve instance. The SSH protocol is enabled by default. To use HTTP instead, you can disable the SSH protocol in the config under lfs.ssh_enabled.

Collaborator Access Levels

You can now specify the access level for collaborators. Before, all repository collaborators would have read-write access. Now you can have more fine control over repository collaborator access. If you don't specify an access level when adding a collaborator to a repository, read-write access level will be used.

HTTP Authentication

Prior to this release, Soft Serve Git HTTP server would only serve public repositories and wouldn't allow push access. Now, you can use user access tokens to push repositories over HTTP. You can generate a personal token using the token SSH command.

Postgres Support

We have added Postgres database support for those who need a more powerful database engine. SQLite is still the default database engine for Soft Serve. Head to Database Configuration for more information on how to set up Postgres for your Soft Serve instance.

Changelog

New Features

• 61ad744: feat(ssh): use custom logging middleware (@aymanbagabas)
• f69f064: feat(web): implement git auth and lfs (@aymanbagabas)
• 882e701: feat: add collaborators with access level (@aymanbagabas)
• af81aec: feat: add lfs config and tests (@aymanbagabas)
• 8e68dba: feat: implement git-lfs preliminary support (@aymanbagabas)
• c7829a3: feat: print clone url on repo create (@aymanbagabas)
• e0882cc: feat: store repo meta data in repo directory (#338) (@aymanbagabas)
• e4a47c5: feat: support git push options (#341) (@aymanbagabas)
• a9e5ace: feat: support user access tokens (@aymanbagabas)
• f1a1da5: feat: use gorilla/mux (@aymanbagabas)

Bug fixes

• c4dde1c: feat,fix: add task manager (@aymanbagabas)
• 7cd0583: fix(ci): golangci linter (@aymanbagabas)
• db3bc9b: fix(cmd): user info reporting false admin status (@aymanbagabas)
• bd8c60c: fix(lfs): don't timeout when searching lfs objects (@aymanbagabas)
• babc52f: fix(lfs): fetch missing lfs objects when mirroring (@aymanbagabas)
• 8d41446: fix(ssh): increase the default idle-timeout to 10 minutes (@aymanbagabas)
• fe70399: fix(tests): make git-daemon use random port (@aymanbagabas)
• e5f8b20: fix(tests): testscript race condition (@aymanbagabas)
• ea6b9a4: fix: add repo owner and separate lfs data for each repository (@aymanbagabas)
• 942d494: fix: add ssh commands back (#370) (@aymanbagabas)
• fd167be: fix: backend update hook arguments (@aymanbagabas)
• e10942e: fix: config paths on windows (@aymanbagabas)
• 8594ecf: fix: demo gif (#373) (@maaslalani)
• 02fd650: fix: disable codecov on push (@aymanbagabas)
• 1c781fe: fix: ignore case README filenames (@bashbunni)
• 050a0d1: fix: initial default branch name (#340) (@aymanbagabas)
• 969cf76: fix: metric cardinality et al (#315) (@caarlos0)
• b0eebaa: fix: panic on ssh lfs transfer (@aymanbagabas)
• 09dedc4: fix: remove extra metrics label (@aymanbagabas)
• da5bf4e: fix: remove repo when stat mismatch (@aymanbagabas)
• d0afaa0: fix: respect gitattributes (#342) (@aymanbagabas)
• 7c73084: fix: tests (@aymanbagabas)
• b26060b: refactor,fix(ssh): use cobra for git commands (@aymanbagabas)

Dependency updates

• ddb3bd6: feat(deps): bump github.com/charmbracelet/bubbles from 0.15.0 to 0.16.1 (@dependabot[bot])
• 940bde7: feat(deps): bump github.com/charmbracelet/bubbletea (@dependabot[bot])
• bf6b47f: feat(deps): bump github.com/charmbracelet/bubbletea (@dependabot[bot])
• 191b832: feat(deps): bump github.com/charmbracelet/keygen from 0.4.2 to 0.4.3 (@dependabot[bot])
• 62b9fda: feat(deps): bump github.com/charmbracelet/lipgloss from 0.7.1 to 0.8.0 (#372) (@dependabot[bot])
• 75cf8a5: feat(deps): bump github.com/charmbracelet/log (@dependabot[bot])
• 277bbc1: feat(deps): bump github.com/charmbracelet/log from 0.2.1 to 0.2.2 (@dependabot[bot])
• 104aa73: feat(deps): bump github.com/charmbracelet/log from 0.2.3 to 0.2.4 (#371) (@dependabot[bot])
• 1491acb: feat(deps): bump github.com/go-git/go-git/v5 from 5.6.1 to 5.7.0 (@dependabot[bot])
• e610867: feat(deps): bump github.com/go-git/go-git/v5 from 5.7.0 to 5.8.1 (@dependabot[bot])
• a12b45b: feat(deps): bump github.com/gogs/git-module from 1.8.2 to 1.8.3 (#365) (@dependabot[bot])
• c2a9b29: feat(deps): bump github.com/hashicorp/golang-lru/v2 from 2.0.2 to 2.0.3 (@dependabot[bot])
• fa6deb4: feat(deps): bump github.com/hashicorp/golang-lru/v2 from 2.0.3 to 2.0.4 (@dependabot[bot])
• bb94850: feat(deps): bump github.com/hashicorp/golang-lru/v2 from 2.0.4 to 2.0.5 (@dependabot[bot])
• d1593cc: feat(deps): bump github.com/hashicorp/golang-lru/v2 from 2.0.5 to 2.0.6 (#374) (@dependabot[bot])
• f0eb762: feat(deps): bump github.com/lib/pq from 1.2.0 to 1.10.9 (#339) (@dependabot[bot])
• f147ff5: feat(deps): bump github.com/muesli/termenv from 0.15.1 to 0.15.2 (@dependabot[bot])
• 7b3f2c2: feat(deps): bump github.com/prometheus/client_golang (#325) (@dependabot[bot])
• d7fcf9d: feat(deps): bump github.com/rogpeppe/go-internal (@dependabot[bot])
• 0e9abaf: feat(deps): bump go.uber.org/automaxprocs from 1.5.2 to 1.5.3 (#343) (@dependabot[bot])
• 75172cf: feat(deps): bump golang.org/x/crypto from 0.10.0 to 0.11.0 (#335) (@dependabot[bot])
• 05ecf8d: feat(deps): bump golang.org/x/crypto from 0.11.0 to 0.12.0 (@dependabot[bot])
• 691f681: feat(deps): bump golang.org/x/crypto from 0.9.0 to 0.10.0 (#323) (@dependabot[bot])
• a72790a: feat(deps): bump golang.org/x/sync from 0.2.0 to 0.3.0 (@dependabot[bot])
• 6ce418b: feat(deps): bump modernc.org/sqlite from 1.22.1 to 1.23.0 (@dependabot[bot])
• 65de5ba: feat(deps): bump modernc.org/sqlite from 1.23.0 to 1.23.1 (@dependabot[bot])
• ad4231b: feat(deps): bump modernc.org/sqlite from 1.23.1 to 1.24.0 (#336) (@dependabot[bot])
• f52dcd2: feat(deps): bump modernc.org/sqlite from 1.24.0 to 1.25.0 (@dependabot[bot])

Documentation updates

• abcb242: Revert "docs: update soft-serve demo GIF / screencast" (@maaslalani)
• 0353cf2: docs: add sqlite foreign key note (@aymanbagabas)
• 49ec3aa: docs: update readme (#360) (@aymanbagabas)
• 0509a50: docs: update soft-serve demo GIF / screencast (@maaslalani)

Other work

• b60a7f2: Add commit command (#331) (@luandy64)
• e78725f: Smart HTTP Git transport & partial clones (#291) (#332) (@aymanbagabas)
• b3d5ce8: refactor: combine migrations into one (@aymanbagabas)
• e398b4d: refactor: implement database module and abstract backend (#337) (@aymanbagabas)
• 3a61783: refactor: move jobs into its own module (@aymanbagabas)

---

Verifying the artifacts

First, download the checksums.txt file, for example, with wget:

wget 'https://github.com/charmbracelet/soft-serve/releases/download/0.6.0/checksums.txt'

Then, verify it using cosign:

cosign verify-blob \
  --certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --cert 'https://github.com/charmbracelet/soft-serve/releases/download/0.6.0/checksums.txt.pem' \
  --signature 'https://github.com/charmbracelet/soft-serve/releases/download/0.6.0/checksums.txt.sig' \
  ./checksums.txt

If the ou...

v0.5.5

Changelog

Bug fixes

• fee41f4: fix: initial default branch name (@aymanbagabas)

---

Thoughts? Questions? We love hearing from you. Feel free to reach out on Twitter, The Fediverse, or on Discord.