feat(deps): update fnox ( v1.27.1 ➔ v1.31.0 )

[renovate]

This PR contains the following updates:

Package	Update	Change
fnox	minor	1.27.1 → 1.31.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

jdx/fnox (fnox)

v1.31.0: : Composable Profiles

Compare Source

A small release headlined by composable multi-profile support, plus a friendlier Proton Pass error when your session is locked.

Added

Compose multiple active profiles (#​605) -- @​gaojunran

You can now activate more than one profile at a time as an ordered overlay stack. The top-level config is the base, and each profile is layered on top in order, with later profiles overriding earlier ones on key conflicts.

# Repeatable flags
fnox -P aws -P prod exec -- ./app

# Comma-separated
fnox -P aws,prod exec -- ./app

# Environment variable
FNOX_PROFILE=aws,prod fnox exec -- ./app

The effective config resolves as top-level config + profiles.aws + profiles.prod, and fnox.<profile>.toml files are loaded for each active profile in order. Write commands (set, remove, import, sync, provider add/remove) target the last active profile by default, and the full profile stack is factored into the daemon's request protocol, socket path, and cache key. Library users get a new with_profiles() builder.

Fixed

Proton Pass suggests unlocking a locked session (#​612) -- @​TyceHerrman

pass-cli reports locked sessions as "Session is locked. Please unlock your session and try again.", but fnox previously fell through to a generic configuration/authentication hint. Locked sessions are now recognized and fnox points you at pass-cli session unlock instead of offering the configured login command. All other Proton Pass error mappings (login, key storage, agent reason, missing fields, missing secrets, generic CLI errors) are unchanged.

New Contributors

• @​gaojunran made their first contribution in #​605
• @​syhol made their first contribution in #​614

Full Changelog: jdx/fnox@v1.30.0...v1.31.0

💚 Sponsor fnox

fnox is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise, aube, hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors.

If fnox is handling secrets or config for you or your team, please consider sponsoring at jdx.dev. Sponsorships are what let fnox stay independent and the project keep moving.

v1.30.0: : Paranoid env mode and Proton Pass PAT auth

Compare Source

A focused release that hardens fnox's secret exposure model with an exec-only env mode, expands Proton Pass authentication for CI and agent use, and cleans up fnox export defaults.

Added

Exec-only env mode and top-level env default (#​604) -- @​jdx

The per-secret env field gains a new "exec" state, and a new top-level env sets the default for all secrets. This lets you keep secrets out of the interactive shell -- where AI coding agents and other inherited processes would see them -- while still injecting them into fnox exec subprocesses.

env	shell integration / fnox export	fnox exec	fnox get
true (default)	yes	yes	yes
"exec" (new)	no	yes	yes
false	no	no	yes

One line flips a project to default-deny:

env = "exec"   # nothing enters the interactive shell

[secrets]
DATABASE_URL = { provider = "age", value = "..." }               # exec-only (inherited)
PS1_TOKEN    = { provider = "age", value = "...", env = true }   # explicit opt-back-in

Per-secret env overrides the top-level default, and the default rides normal config merge order so fnox.local.toml can tighten or loosen it per machine. Existing configs parse with identical semantics.

fnox doctor also warns when a shell-hiding top-level env is combined with an ambient FNOX_AGE_KEY in the environment, since that would undermine the whole posture. This eliminates ambient exposure but is not a hard boundary -- anything that can run commands in your shell can still call fnox get/fnox exec itself.

Proton Pass PAT and agent auth (#​598) -- @​TyceHerrman

The proton-pass provider now supports headless authentication via personal access tokens and audited agent access, so CI and scripted jobs no longer need an interactive pass-cli login --interactive.

export PROTON_PASS_PERSONAL_ACCESS_TOKEN="pst_token::key"
pass-cli login

New provider config field:

[providers.protonpass]
type = "proton-pass"
vault = "Personal"
agent_reason = "fnox secret retrieval"   # for audited agent access

fnox now passes through the full set of PROTON_PASS_* variables (PAT, agent reason, session dir, key provider, encryption key, Linux keyring) plus matching FNOX_PROTON_PASS_* aliases, and includes them in the daemon config fingerprint so cached values invalidate when auth env changes. Error messages point at the right knob when a session, key, or agent reason is missing.

Fixed

Daemon respects daemon_cache = false for default-provider secrets (#​599) -- @​TyceHerrman

The daemon's cache check only consulted a secret's explicit provider, so secrets that resolved through default_provider skipped the effective provider's daemon_cache setting. Cache decisions now use the effective provider in all paths (explicit provider, default_provider, and auto-selection), so opting out of daemon caching actually opts you out.

fnox export no longer leaks env = false secrets (#​604) -- @​jdx

fnox export previously resolved with include_env_false=true and never filtered on env, so secrets marked "only accessible via fnox get" were still included in export output -- and picked up by tools like mise-env-fnox that consume fnox export --format json. Export now follows the same shell semantics as hook-env. Pass --all for the full dump when you want it explicitly.

Changed

fnox export omits the metadata header by default (#​603) -- @​jdx

The env and shell export formats no longer emit the # Exported from profile: ... / # Total secrets: ... comment block by default -- output is now clean assignment lines only, easier to source or feed into other tooling. Pass --header to restore the previous behavior:

fnox export --format env --header

JSON, YAML, and TOML output are unchanged.

Redesigned logo (#​595) -- @​jdx

New fox-in-keyhole mark matching the fnox.jdx.dev site theme.

Full Changelog: jdx/fnox@v1.29.0...v1.30.0

💚 Sponsor fnox

fnox is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise, aube, hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors.

If fnox is handling secrets or config for you or your team, please consider sponsoring at jdx.dev. Sponsorships are what let fnox stay independent and the project keep moving.

v1.29.0: : Age plugins, config-relative paths, and Nix flakes

Compare Source

A feature release focused on hardware-backed age encryption, more predictable path handling in config files, and faster GCP Secret Manager batches -- plus a Nix flake for the flake-curious.

Added

Age plugin recipients and identities (#​569) -- @​nightvisi0n

The age provider now supports age plugins, so hardware-backed and specialty recipients work end to end. That includes age-plugin-yubikey (YubiKey/PIV), age-plugin-se (Apple Secure Enclave), age-plugin-tpm, and friends.

Previously a plugin recipient like age1yubikey1... failed at config load with Failed to parse recipient ... incorrect HRP because the provider only understood native X25519 and SSH recipients. It now parses age::plugin::Recipient values, spawns the matching age-plugin-* binary for encryption, and attaches UiCallbacks to identity files so AGE-PLUGIN-* identities get PIN/touch prompts on decrypt.

Nix flake (#​583) -- @​o-az

fnox is now packaged as a Nix flake. Consume it from another flake:

inputs.fnox.url = "github:jdx/fnox";

# ...then reference inputs.fnox.packages.${system}.default

Or run it directly without installing:

nix run github:jdx/fnox

The flake also exposes a devShells.default with cargo, clippy, and rustfmt.

Fixed

Defaults are used when a provider is inactive (#​572) -- @​jdx

If a secret declared a default and the active profile did not have the referenced provider configured, resolution would fail instead of falling back. Single-secret and batch resolution now share the same fallback path, so fnox get and fnox exec return the default (including interpolated ${...} defaults that reference other secrets resolved in the same batch) when the provider is missing, batch fetch fails, or non-interactive auth aborts. A provider value still wins when the provider succeeds; cycles between fallback defaults are rejected explicitly.

Config paths resolve relative to the config file that declares them (#​582) -- @​jdx

Filesystem paths in provider configuration are now interpreted against the config file that defines them, not the current working directory. This matters especially for nested/imported configs, where a parent fnox.toml could point at keys/age.key and a child config in a subdirectory would silently miss it.

Affected fields:

• age.key_file
• keepass.database, keepass.keyfile
• password-store.store_dir
• foks.home
• imports, and paths reported by fnox config-files

Rules:

• Paths in config files resolve relative to the declaring file, and ~ expands to the user home.
• Absolute paths are used unchanged.
• CLI path arguments still resolve against the current working directory.
• Environment-variable paths keep their existing behavior.

fnox daemon clear clears every running daemon (#​581) -- @​jdx

fnox daemon clear previously only talked to the daemon socket for the current profile, so caches on daemons started under other profiles were left stale. It now scans the daemon runtime directory, sends Clear to every live profile-scoped daemon, and ignores stale sockets during the sweep. When no live daemon responds, you still get the familiar "daemon not running" error.

Changed

Faster batch reads from GCP Secret Manager (#​580) -- @​nils-degroot

google-secret-manager previously used the default batch implementation, which created a fresh client per secret. The provider now implements get_secrets_batch directly: a single client is reused across the batch and up to 10 secrets are fetched concurrently, which noticeably reduces latency for configs with many GCP secrets. Missing payloads and non-UTF-8 values are handled more explicitly, and client-creation errors surface provider-specific auth guidance.

New Contributors

• @​nightvisi0n made their first contribution in #​569
• @​o-az made their first contribution in #​583
• @​nils-degroot made their first contribution in #​580

Full Changelog: jdx/fnox@v1.28.0...v1.29.0

💚 Sponsor fnox

fnox is maintained by @​jdx under en.dev — a small independent studio building developer tooling like mise, aube, hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors.

If fnox is handling secrets or config for you or your team, please consider sponsoring at en.dev. Sponsorships are what let fnox stay independent and the project keep moving.

v1.28.0: : Non-interactive exec

Compare Source

A small feature release that adds a global --non-interactive mode for fnox exec and other resolve paths, so CI and scripted runs can rely on cached credentials and fail fast instead of hanging on auth prompts or device flows.

Added

Global --non-interactive / FNOX_NON_INTERACTIVE (#​565) -- @​jdx

A new top-level flag (and matching env var) disables prompts and browser-based auth flows for the entire invocation. It is propagated through the daemon protocol, so daemon-backed resolution behaves the same way as direct resolution -- including when fnox auto-starts daemon serve to handle the request.

fnox --non-interactive exec -- ./run-tests.sh

# or
FNOX_NON_INTERACTIVE=1 fnox exec -- ./run-tests.sh

In non-interactive mode:

• should_prompt_auth no longer prompts, regardless of TTY or prompt_auth config.
• The github-oauth lease backend still happily reuses cached and refreshable tokens, but fails immediately with a clear interactive auth required for GitHub OAuth device authorization error instead of printing a user code and polling. The error hint points you at running fnox lease create <lease-name> from an interactive terminal first.

This is intended for CI jobs, cron tasks, and other scripted runs where a hung prompt is worse than a fast failure.

Fixed

• CI now installs Vault as the qualified hashicorp/tap/vault formula on macOS so Homebrew treats it as an explicitly chosen tap formula under current tap-trust rules (#​567) -- @​jdx

Full Changelog: jdx/fnox@v1.27.1...v1.28.0

💚 Sponsor fnox

fnox is maintained by @​jdx under en.dev — a small independent studio building developer tooling like mise, aube, hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors.

If fnox is handling secrets or config for you or your team, please consider sponsoring at en.dev. Sponsorships are what let fnox stay independent and the project keep moving.

---

Configuration

📅 Schedule: (in timezone America/Detroit)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.