Skip to content

chore(release): update to 1.15.0 - #183

Merged
ashishkurmi merged 1 commit into
step-security:mainfrom
swarit-stepsecurity:swarit/chore/wt/up-ver-1.15.0
Aug 3, 2026
Merged

ashishkurmi merged 1 commit into
step-security:mainfrom
swarit-stepsecurity:swarit/chore/wt/up-ver-1.15.0

Conversation

@swarit-stepsecurity

@swarit-stepsecurity swarit-stepsecurity commented Aug 3, 2026

Copy link
Copy Markdown
Member

Version bump to 1.15.0 so the Release workflow can cut v1.15.0 (it derives the tag from internal/buildinfo/version.go and refuses to run if the tag already exists).

Changes (matches the established up-ver pattern):

  • internal/buildinfo/version.go: Version 1.14.0 → 1.15.0
  • examples/sample-output.json: agent_version → 1.15.0
  • CHANGELOG.md: [Unreleased][1.15.0] - 2026-08-03 + compare link

Minor bump — three new capabilities landed since 1.14.0. The changelog needed backfilling: of the 19 commits merged since v1.14.0, only run gating had an [Unreleased] entry, so this PR writes up the device-policy work and the two fixes (please sanity-check the wording):

  • Added: npm secure-registry device policy (package_config#npm lane, managed ~/.npmrc block); VS Code private marketplace URL (extensions.gallery.serviceUrl) enforcement; MDM verify-only enforcement channel for both the IDE-extension and npm lanes.
  • Changed: all device-policy ownership routed through one lock-protected device-policy-state.json; run-config policy keyed by setting id (breaking pre-GA wire change — needs the backend emitting the settings-map shape); managed settings.json writes preserve a leading UTF-8 BOM.
  • Fixed: Homebrew installed outside PATH; full-userinfo masking in malformed multi-@ index URLs; device-policy clears reported as a removal only when something was removed.
  • (Run gating was already documented under [Unreleased] and carries over verbatim.)

Verified: go build ./internal/buildinfo/ passes, examples/sample-output.json still parses, and the release workflow's extraction (.github/workflows/release.yml:34) resolves 1.15.0.

Bump Version to 1.15.0 so the release workflow can cut v1.15.0, and close
out the [Unreleased] section as [1.15.0].

Minor bump: three new capabilities landed since 1.14.0 (npm secure-registry
device policy, VS Code private marketplace URL enforcement, MDM verify-only
enforcement channel) alongside the already-documented run gating.

Backfills the changelog for the ~19 commits merged since v1.14.0 — the
device-policy work landed without [Unreleased] entries.
@ashishkurmi
ashishkurmi merged commit 4b5f2b4 into step-security:main Aug 3, 2026
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants