v1.16.21 v1.16.22
tremorlabs/tremorSep 27, 2026 → Sep 28, 20261 day between releases
What's New
Web server restricts hostnames and worktree hooks now require approval
Breaking Changes
- Web server now returns 421 for unauthorized hostnames; add names to config
- Repository worktree hooks now require explicit approval based on SHA256
- Login cookies are now HttpOnly and SameSite=Strict
New Features
- Mandatory approval workflow for repository worktree hooks
- Web server hostname restriction for security
- HttpOnly and SameSite=Strict cookies for login tokens
Improvements
- Fixed two CI test flakes to improve reliability
- Updated web test tooling (vitest bumped to 4.1.11)
Bug Fixes
- Fixed CI test flakes to improve reliability
Upgrade Notes
If using a reverse proxy or Tailscale Serve, add the hostname to [web] allowed_hosts. Approvals from previous versions did not include path/interpreter, so hooks will re-ask for approval. Hooks running under 'always' are unaffected.
The Two Releases
v1.16.21
Sep 27, 2026· 25 days ago
This release adds dynamic model fetching from the installed CLI and removes the deprecated credential refresh daemon, while fixing web push notifications and SSH authentication polling.
Full release notesv1.16.22
Sep 28, 2026· 24 days ago
This release hardens security by restricting web hostnames and introduces a mandatory approval workflow for repository worktree hooks, alongside improvements to test suite stability.
Full release notes