v0.12.0

Infisical/agent-vaultv0.12.0Apr 26, 2026by github-actions[bot]

AI Summary

Enhances security for private hosts and broker header forwarding, while also hardening installation scripts against HTTP redirect attacks.

Key Highlights

Granular allow for private hosts
Broker forwards all client headers, overriding only auth slot
Harden curl against HTTP redirect downgrade

New Features

Granular private host access
Broker header forwarding updates
Install script hardening

Full Release Notes

## Changelog
* ab5507eee7b25bb5ffa8ba12c18b6d73a443c119 Granular allow for private hosts (#106)
* 7f53eecc9c267ca26438f978ed2436605d3d6d65 broker: forward all client headers, only override the auth slot (#133)
* c27a1127916f8d174799a213d7f1d702a07b9f6c deps: bump @tailwindcss/vite from 4.2.2 to 4.2.4 in /web (#119)
* 7a7f3b08ba7d56a61ab8b8b490b164a48436d053 deps: bump @tanstack/react-router from 1.168.23 to 1.168.24 in /web (#120)
* 5bb45f65ef69e166847d4acbaecfdaade297a567 deps: bump github.com/jedib0t/go-pretty/v6 from 6.7.9 to 6.7.10 (#118)
* ee0892f8e774668491a47bc2e24558782f60af9c deps: bump modernc.org/sqlite from 1.49.1 to 1.50.0 (#116)
* ef0e71edc5a945e2d0034b762ffd23a832594ce9 deps: bump tailwindcss from 4.2.2 to 4.2.4 in /web (#117)
* c799fd25f628260a44d972c841ad2a17e71c917b install: dedupe doc snippet, slim telemetry note (#130)
* 92aa52b46d099337b2f348ce945b30ec15d31f58 install: harden curl against HTTP redirect downgrade (#129)

## Verify

```bash
# Verify checksum
sha256sum --check checksums.txt

# Verify signature (requires cosign)
cosign verify-blob \
  --bundle checksums.txt.bundle \
  --certificate-identity-regexp "github.com/Infisical/agent-vault" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  checksums.txt
```