v0.80.0 v1.16.22
vectorize-io/hindsightSep 27, 2026 → Sep 28, 20260 days between releases
What's New
Web server hardening and strict hook approval workflow introduce breaking changes.
Breaking Changes
- Web server rejects requests to unauthorized hostnames with a 421 status code.
- Repository worktree hooks are skipped if not approved and require manual approval on first run.
New Features
- Host name validation via `[web] allowed_hosts` or `--allowed-host`.
- Secure cookie storage using `HttpOnly` and `SameSite=Strict`.
- Worktree hook approval workflow based on SHA256, resolved path, and execution method.
- New `trust-hooks` command to approve hooks from the CLI.
- Web push notifications (`--push`) are restored.
Improvements
- Secure cookie handling for web server sessions.
- Improved SSH authentication retry handling.
Bug Fixes
- Web push notifications (`--push`) restored functionality.
Upgrade Notes
If you access the web server via a reverse proxy or Tailscale, add the host name to `[web] allowed_hosts` to prevent 421 errors. Hooks approved in versions prior to 1.16.22 are missing metadata and will be skipped until re-approved.
The Two Releases
0.80.0
Sep 27, 2026· 24 days ago
WorkTrunk improves performance for large repos with faster `wt list` and picker rendering. It adds signed packslips for releases and fixes complex issues with submodules and unusual git setups.
Full release notesv1.16.22
Sep 28, 2026· 24 days ago
This release hardens the web server by restricting it to specific hostnames and introduces a strict approval workflow for repository worktree hooks.
Full release notes