v1.16.21 v1.16.22
niri-wm/niriSep 27, 2026 → Sep 28, 20261 day between releases
What's New
Added web server host validation and SHA256-based worktree hook approvals.
Breaking Changes
- Web server now rejects requests to unauthorized host names, returning 421 errors.
New Features
- Web server validates hostnames against a configured list.
- New SHA256-based approval system for worktree hooks.
- HttpOnly SameSite Strict cookies for token-based authentication.
Improvements
- Enhanced web UI security with HttpOnly SameSite Strict cookies.
- Worktree hook execution is now verified via SHA256 and execution context.
- Web server now only responds to configured host names.
Upgrade Notes
If using a reverse proxy or Tailscale Serve, add the host name to `[web] allowed_hosts` to prevent 421 errors. Existing worktree hook approvals are invalidated and will be re-asked for on the next run, unless marked as 'always'.
The Two Releases
v1.16.21
Sep 27, 2026· 25 days ago
Removed the deprecated `creds-refresh` command and added model listing capability from the installed CLI. Fixed push notifications and SSH authentication retry logic.
Full release notesv1.16.22
Sep 28, 2026· 24 days ago
Updated web server host validation to prevent 421 errors and introduced a new approval system for repository worktree hooks based on SHA256 and execution context.
Full release notes