v1.16.21 v1.16.22
zumerlab/snapdomSep 27, 2026 → Sep 28, 20261 day between releases
What's New
Web server hostname validation and worktree hook approval added in v1.16.22.
Breaking Changes
- Web server returns 421 if hostname is not in [web] allowed_hosts
- Previous worktree hook approvals are invalidated and must be re-approved
New Features
- Anonymous telemetry system using PostHog
- Worktree hooks require approval based on script identity (sha256, path, execution mode)
- HttpOnly, SameSite=Strict cookies for token-based authentication
Improvements
- Cookie security improved with HttpOnly and SameSite=Strict settings
Upgrade Notes
Add hostnames to [web] allowed_hosts or --allowed-host to prevent 421 errors. Re-approve worktree hooks or set run_repo_scripts to 'always' as previous approvals are invalidated.
The Two Releases
v1.16.21
Sep 27, 2026· 25 days ago
This release improves model discovery by querying the installed CLI for new models and removes a deprecated credential refresh daemon. It also restores web push notifications and improves remote SSH authentication handling.
Full release notesv1.16.22
Sep 28, 2026· 24 days ago
This release introduces security hardening for the web server and a new workflow for approving worktree hooks. It also adds an anonymous telemetry system and improves cookie security for the web UI.
Full release notes