v0.10.1 v1.16.22
grokability/snipe-itSep 21, 2026 → Sep 28, 20267 days between releases
What's New
Major version jump introduces strict hostname validation and requires re-approval for worktree hooks.
Breaking Changes
- Web server returns 421 for requests to unauthorized hostnames unless configured.
- Worktree hooks require explicit approval unless run_repo_scripts is set to 'always'.
- Hooks approved in v1.16.21 and earlier are re-validated on their next run.
New Features
- New trust-hooks command to approve worktree hooks from scripts or CI environments.
- Per-server idle timeout configuration option.
- Enhanced TUI prompts displaying repository, hook, command, and SHA256 details.
Improvements
- Token-based sessions now use HttpOnly, SameSite=Strict cookies for better security.
- Worktree hooks now require approval based on SHA256, resolved path, and execution context.
Bug Fixes
- Fixes bug where approval history was incomplete, causing hooks to be re-asked for approval.
Upgrade Notes
Configure [web] allowed_hosts or --allowed-host if using reverse proxies or Tailscale. Hooks approved before may require re-approval due to history incompatibility. Set run_repo_scripts = 'always' to bypass explicit approval requirements.
The Two Releases
v0.10.1
Sep 21, 2026· 1 month ago
A bug fix release addressing issues with attachment handling, coding agent interactions, retention logic, and security redactions.
Full release notesv1.16.22
Sep 28, 2026· 24 days ago
Version 1.16.22 enhances security by restricting the web server to specific hostnames and implementing strict approval requirements for worktree hooks based on script identity. It also fixes a bug where approval history from the previous version was incomplete, forcing re-approval.
Full release notes