--- url: https://ws.kloudkit.com/changelog.md description: >- Release notes for Kloud Workspace, generated from commit history of each tagged release --- # Changelog ![Changelog](/icons/changelog.svg){.doc-image width=150px} Release notes for each tagged Kloud Workspace image, generated from the commit history. The newest release is listed first. ::: v-pre ## \[0.5.4] β€” 2026-11-03 ### Changed * ⌨️ Let Ctrl+G reach the terminal on Windows and Linux, instead of opening Go to Recent Directory * πŸ”§ Enable Python Environments so the Ansible extension stops prompting ### Dependencies * πŸ”’ Build k9s, kube-linter, gotests, impl and task from source to clear their high and critical CVEs * πŸ”’ Raise VS Code's bundled undici to 7.30.1 *(ws-server)* * ⬆️ Bump ansible-core to 2.22.0 * ⬆️ Bump claude-code to 2.1.317, uv to 0.13.7, buildx to 0.38.1, compose to 5.7.0, helm to 4.3.1 and starship to 1.27.0 ## \[0.5.3] β€” 2026-11-01 ### Added * πŸ” Re-check OIDC sessions with the IdP via `WS_AUTH_OIDC_SESSION_REFRESH`, so users disabled there lose access *(opt-in)* ### Changed * πŸšͺ End the IdP session on OIDC sign-out, through the IdP's `end_session_endpoint` * 🚫 Tell OIDC access denials apart from failed sign-ins, and offer "Sign in as a different user" when denied * 🎨 Make ws-cli output pipe-safe and consistent across every command *(#799)* * πŸ“„ Keep the startup console colored and write `workspace.log` as plain text *(#799)* * 🐚 Run startup scripts with the terminal's zsh environment *(#782)* * ⚑️ Open new terminals faster by loading `fzf-history` settings on the first search * πŸ”₯ Drop the `yarn` plugin, and its `y` alias, from the default `WS_ZSH_PLUGINS` * πŸ”’οΈ Refuse changed SSH host keys outside private networks *(#801)* * ⚑️ Expire idle SSH control connections after 10 minutes and detect dead hosts *(#801)* ### Dependencies * πŸ”Ό Bump VS Code to 1.144.0 *(ws-server#35, ws-server#36)* * ⬆️ Bump http-proxy-3 to 2.0.1 *(ws-server#34)* * ⬆️ Sweep Renovate updates, including uv 0.13 and the Kubernetes Python client 37 *(#800)* * ⬆️ Bump Node.js to 24.22.2 and sweep Renovate updates, including Go 1.27.3 and Rust 1.99.1 *(#801)* ### Fixed * πŸ”’ Stop forwarding the workspace session cookies to forwarded ports on websocket upgrades *(ws-server#34)* * 🧩 Load TypeScript server plugin extensions on the workspace host *(ws-server#35)* * πŸ“œ Fix `ws logs` filtering with `--level`, `--tail` and `--follow` *(#799)* * ⏱️ Time out `ws info extensions` instead of hanging * 🏠 Own `~/.ws` for `kloud` when it is a mounted volume *(#782)* * 🧷 Render a `&` in `WS_AUTH_OIDC_FORBIDDEN_MESSAGE` literally ## \[0.5.2] β€” 2026-10-07 ### Breaking * βœ‚οΈ Separate `WS_SERVER_PROXY_DOMAIN` and `WS_SERVER_SSL_HOSTS` entries with spaces only; commas no longer split * πŸ“¦ Drop the gh, cloudflared, hashicorp and jfrog apt sources; install those tools through their features ### Added * 🐍 Build `pet` from source for the Python extensions ### Changed * πŸ”— Resolve forwarded-port links from the host the editor is viewed at; terminals no longer get `VSCODE_PROXY_URI` * 🧰 Install the vendor-apt CLIs from static release binaries * 🚚 Fetch `sops` and `talos` from the `/` store path * πŸ‘· Build each image once: promote the tested PR image to `:dev`, release on native arm64 *(#780)* ### Dependencies * ⬆️ Sweep Renovate dependency updates *(#778)* ### Fixed * πŸ’ͺ Ship arm64-native `kube-linter` and `starship`; earlier arm64 images had wrong-arch builds *(#781)* * πŸͺ Scope OIDC cookie domains the way ws-server parses proxy domains *(#779)* * πŸ” Fix startup feature installs and `WS_NPM_ADDITIONAL_PACKAGES` failing TLS behind a custom root CA *(#777)* * πŸ€– Point Renovate at the features.d playbook pins ## \[0.5.1] β€” 2026-10-05 ### Dependencies * πŸ€– Bump claude-code to 2.1.289 * 🐍 Bump uv to 0.12.23 and ruff to 0.16.10 * 🐹 Build on Go 1.27.1 * πŸ“¦ Bump pnpm to 11.28.4 * 🐳 Bump docker compose to 5.6.0 and the docker Python SDK to 7.2.0 * ☸️ Bump helm to 4.3.0 and the kubernetes.core collection to 6.6.0 * πŸ”Ž Bump fzf to 0.74.4 * πŸ“‹ Bump go-task to 3.54.0 * ⚑ Bump ws-cli to Go 1.27.1 and its latest modules ## \[0.5.0] β€” 2026-10-05 ### Breaking * 🚚 Move editor settings and extensions to `~/.local/share/ws-server/`; existing volumes are not migrated * πŸ›’ Read the extension gallery from the `WS_MARKETPLACE_*` variables; `EXTENSIONS_GALLERY` is ignored * πŸ—‘οΈ Remove `/etc/workspace/config.yaml`; the editor is configured through `WS_*` variables only * πŸ” Remove `WS_SERVER_SSL_ROOT`; self-signed certificates are minted in memory * πŸ”€ Remove `ws serve font`; install fonts from their upstream projects ### Added * πŸ†™ Ship VS Code 1.140.0 * 🎨 Rebrand the editor and docs with the Kloud Workspace icons * πŸšͺ Add a Sign out action to the editor, overridable via `WS_EDITOR_LOGOUT_URL` * πŸ“ Add `WS_EDITOR_DISABLE_FILE_DOWNLOADS` and `WS_EDITOR_DISABLE_FILE_UPLOADS` * 🐞 Enable .NET debugging + revive terminal-link remap on the live workbench bundle *(#735)* * 🌱 Seed files from a durable source directory on startup *(#727)* * πŸ“‘ Add editor-state IPC routes + ws-cli editor; rewire open/openn * ⌨️ Add ws completion via compdef ws=ws-cli * πŸ€– Agent-consumable documentation: `llms.txt`, `llms-full.txt`, per-page raw Markdown, and AI-crawler hints ### Changed * 🌐 Treat a leading `*.` in `WS_SERVER_PROXY_DOMAIN` as the bare suffix instead of rejecting it * πŸ”– Single-source the workspace version through manifest.json * πŸ«™ Swap to the `ws-cli` seed engine, retire the `vault` + seed tier *(#728)* * πŸ‘· Adopt shared ws-meta CI actions for changelog + PR emoji check * πŸ“œ Propagate CHANGELOG.md to ws-meta for the public surface *(#723)* ### Dependencies * 🐍 Bump pylint to 4.1.2 * πŸ”‘ Bump ansible-lint to 26.9.0 and op to 2.40.0 * 🧰 Bump deps: setup-node v6, claude-code, delve, uv, starship * ⚑ Bump ws-cli to 0.0.69 * ⚑ Bump ws-cli to 0.0.68 * πŸ“¦ Bump claude-code, uv, pnpm, ruff * 🐧 Bump base-image v0.1.2 (Debian 13.5) & ws-cli v0.0.65 ### Fixed * 🐳 Skip dockerd when CAP\_NET\_ADMIN is missing instead of restart-looping * πŸ”— Make `file://` terminal links clickable in browser *(#725)* ### Removed * βœ‚οΈ Remove the `openn` alias ### Security * πŸ›‘οΈ Trust custom CAs in git, cargo & aws via CA-bundle env vars * πŸ‹ Install `docker compose`/`buildx` from upstream releases *(#724)* ## \[0.4.0] β€” 2026-06-23 ### Breaking * πŸ’₯ Reject wildcard proxy domains instead of silently stripping the `*.` prefix * πŸ’₯ Move shell/REPL history to `~/.ws/history`; history at the previous paths is not migrated *(#704)* ### Added * ✨ dotnet: Debian 13 trixie + selectable version bands (8.0/9.0/10.0) * ✨ Install additional pip packages and uv tools via env vars *(#703)* * ✨ Install additional npm packages via `WS_NPM_ADDITIONAL_PACKAGES` * ✨ Run `cloudflared` as a supervised s6 tunnel daemon *(#700)* * ✨ Skip feature-install sections via `--skip-*` flags *(#698)* * ✨ Enable built-in Markdown features and markdownlint parity *(#697)* * ✨ Add user feature playbooks under `~/.ws/features.d` *(#696)* * ✨ Query `show env` by canonical dotted keys, retire WS\_\* query form *(#693)* * ✨ Enforce WS\_\* value validation via declared patterns * ✨ Retire common.sh env wrappers into `ws-cli show env` * ✨ Add in-workspace OIDC auth via oauth2-proxy *(#690)* * ✨ Add fonts.yaml manifest and render to fonts.sh *(#683)* ### Changed * πŸ—οΈ Automate release tagging and changelog from a WS\_VERSION literal *(#722)* * ♻️ dotnet: DRY the version var, trim zshenv comments * 🚚 Move shell/REPL history to `~/.ws/history` and consolidate env into `zshenv` *(#704)* * ♻️ Extract `github_binary` role task and sweep feature playbooks *(#701)* * 🚚 Replace `dumb-init` with `s6-overlay` v3 daemon supervision *(#699)* * πŸ—οΈ Audit image build: isolate code-server into a cache-stable stage *(#695)* * πŸ—οΈ Audit dependency manifest: sudo PATH parity + Renovate hygiene *(#694)* * πŸš€ Swap jedi for pyrefly LSP *(#689)* ### Fixed * πŸ› Fixed renovate syntax * πŸ› Own proxy-domain {{port}} prefix in startup, reject wildcards ## \[0.3.0] β€” 2026-06-01 ### Added * ✨ Add a `--target` flag to `ws-cli logs` for the metrics and `dockerd` components * ✨ Add the `ripgrep` fast recursive search tool * ✨ Add the `tshark` terminal network-protocol analyzer * ✨ Add GitHub authentication support * ✨ Bundle the `syft`, `grype`, `dive`, and `osv-scanner` SBOM and vulnerability tools as an `image-extras` feature * ✨ Add a `version` option to the `cpp` feature and support offline installation * ✨ Add a `WS_APT_DISABLE_RESTRICTIONS` toggle ### Changed * πŸ—οΈ Slim the dev image and install `pnpm` from npm * πŸ—οΈ Render `extensions.sh` from a new `extensions.yaml` manifest * πŸ—οΈ Harden the `~/.ws/` convention: add `ca.d/` and drop the override environment variables * πŸ—οΈ Resolve the pip and npm registries from the environment or user config * πŸ—οΈ Add a drift-safe APT resolver for `ws-feature-store` drift * πŸ—οΈ Route additional APT installs through a feature playbook * 🚚 Move `dive` to an opt-in feature * ♻️ Migrate secret-shaped and path-shaped `WS_*` variables to the `secret: true` and `type: path` schema flags * ♻️ Read every `WS_*` variable through `ws-cli show env`, dropping `check_env_set` and `resolve_secret` * πŸ—οΈ Add `server.ssl_root` and an absolute `secrets.vault` default ### Removed * πŸ”₯ Trim dead-weight bundled assets from the VSCode extensions ### Fixed * πŸ› Fix a prompt-hide regression and harden the zsh shell-init layer * πŸ› Harden the workspace startup scripts for first boot * πŸ› Fix the Claude statusline ahead/behind icons to match starship * πŸ› Fix web-font loading and cache the static assets * πŸ› Rename `server.root_dir` to `server.root` to match the runtime environment variable * πŸ› Stamp debug "Skipped" lines from the `common.sh` environment helpers ### Security * πŸ”’ Deny CNI plugins by default ### Dependencies * ⬆️ Bump the `base-image` to `v0.1.1` * ⬆️ Bump `ws-cli` * ⬆️ Bump `ansible-core` to `v2.21.0` ## \[0.2.1] β€” 2026-05-05 ### Dependencies * ⬆️ Bump `kubectl` ## \[0.2.0] β€” 2026-04-27 ### Added * ✨ Add the GitLab CLI * ✨ Add the `claude-code` CLI * ✨ Add the `bun` JavaScript runtime as a feature * ✨ Add a `notify` endpoint to the IPC interface * ✨ Add an opt-in open-code (`oc`) environment * ✨ Support a custom `.ws` configuration directory ### Changed * 🚚 Move `oc` into a feature * 🚚 Migrate to `uv` for Python package management * 🚚 Move delimited parsing to the `dilimit` helper * πŸ—οΈ Source features from `ws-feature-store` * πŸ—οΈ Package build artifacts as well ### Fixed * πŸ› Fix `fzf` history search ### Dependencies * ⬆️ Update Helm to v4 :::