Skip to content

Atuin

v18.18.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 18h CLI & Terminal
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

shell fish history rust

Affected surfaces

deps

Summary

AI summary

Broad release touches Bug Fixes, Miscellaneous Tasks, Refactor, and search.

Full changelog

Release Notes

Bug Fixes

  • (daemon) Index synced history directly instead of malformed SQL (#3627) (#3641)
  • (deps) Update unsound/vulnerable dependencies in Cargo.lock (#3632)
  • (docs) Repair every stale link in the repo (#3727)
  • (docs) Make the incorrect-decrypt-key error actionable (#3609)
  • (hook) Drop agent commands containing NUL bytes via NonNulStr (#3589) (#3660)
  • (import) Survive corrupt entries instead of aborting the import (#3721)
  • (init) Fix include guard in Bash init script; chore(init): improve inclusion of shell init scripts in Rust (#3645)
  • (install) Make /dev/tty authoritative for interactivity detection (#3691)
  • (search) Add DbSearchMode; correctly fall back to "fuzzy" in non-interactive searches (#3744)
  • (ui) Calculate preview height based on command display width instead of byte count (#3678)
  • (win32) Cargo-binstall package metadata (#3673)
  • Search functionality to respect character offsets and non-ASCII (#3659)
  • Quote argument-hint YAML values so Copilot CLI ≥1.0.65 loads all skills (#3613) (#3614)
  • Correct grammar in 'history last' help text (#3430)
  • Work around rust nightly warning on eyre bail (#3680)
  • Improve non-interactive TTY detection in install.sh (#3315)
  • Add /model hint to status bar (#3687)
  • Set correct umask for pty-proxy (#3700)
  • Atuin AI not erasing the input box before closing (#3715)
  • Show server status next to AI progress indicator (#3723)
  • Show full command when using AtuinOutput tool (#3725)

Documentation

  • (ai) Add self hosting + slash command docs (#3623)
  • (config) Standardize TOML examples for config options (#3441)
  • Advise users to pass --locked when installing from Cargo (#3630)
  • Add docs for store_failed and default for enter_accept (#2696)
  • Serve docs.atuin.sh from this repo; remove Desktop docs (#3684)
  • Version docs.atuin.sh with mike (per-release + main) (#3688)
  • Hotfix bad path (#3690)
  • Document built-in bash-preexec (#3651)
  • Retheme docs.atuin.sh to the Atuin brand (#3701)
  • Bundle of improvements (#3716)
  • Remove ugly cards on landing page (#3724)
  • Fix broken README links (#3696)
  • Lint prose with Vale and gate it in CI (#3726)
  • Slightly nicer default config.toml order (#2485)
  • Kubernetes self-hosting documentation (#3238)
  • Add canonical Supported platforms page (#3736)
  • Add friendly hover tips for new terms (#3740)
  • Clarify how to uninstall shell integration (#3741)

Features

  • (ai) Up/down to scroll through previously sent messages (#3720)
  • (bash) Bundle bash-preexec with Atuin; automatically load if no other preexec backend is loaded (#3650)
  • (search) Add --shell option to atuin search to filter results by shell (#3658)
  • (search) Syntax highlight commands in interactive search (#3704)
  • (search) Filter by shell in interactive search (#3692)
  • (string) EllipsizeExt -- General-purpose utility for adding ellipses to strings (#3639)
  • Add 'yolo' setting to Atuin AI options (#3637)
  • Add shell field to history entries (#3636)
  • Add hickory-dns resolver for musl target to improve DNS resolution (#3647)
  • Add atuin stats --filter-mode (#1737)
  • More aggressive optimizations for dist release (#3683)
  • Capture zsh comments as history (#3699)
  • Allow injecting extra HTTP headers on sync server requests (#3718)

Miscellaneous Tasks

  • (atuin-common) Add ellipsize_or_pad for unicode pad (#3663)
  • (ci) Bump GitHub Actions to latest versions (#3689)
  • (ci) Lint tests & docs in CI (#3746)
  • (clap) Simplify clap field types and fix help message formatting (#3640)
  • (logging) Refactor logging (#3622)
  • (release-skill) Time label-gated PR merges around the release (#3654)
  • Remove fossier (#3629)
  • Trigger docs repo deploy (#3631)
  • Remove redundant test (#3635)
  • Add .editorconfig and .nvim.lua (#3648)
  • Clean up WordJumper in atuin/src/command/client/search/cursor.rs (#3662)
  • Don't panic if clipboard cannot be accessed (#2648)
  • Update some dependency versions (#3666)
  • Update sqlx to v9 (#3668)
  • Follow-up on #1737 (#3649)
  • Update Atuin AI to eye-declare v0.6.1 (#3686)
  • Remove docs-dispatch (#3694)
  • Docker healtcheck (#2451)
  • Run windows jobs on depot-windows-2025-16 (#3711)
  • Hotfix script (#3714)
  • Update flake.nix (#3509)
  • Add Timezone and restart policy for postgres backup docker (#3083)
  • Add riscv64 to release targets (#3339)
  • Build x86_64-apple-darwin on Depot M4 macs; move all macOS CI to Depot (#3742)

Performance

  • Do not block counting history (#3729)
  • Actually delete history rows, and index active history (#3730)
  • Index filtered history search, record store tags, and cache inspector stats (#3731)

Refactor

  • (hook) Typed protocol for agent hook events (#3638)
  • (render) Slightly nicer and more correct non-printable escaping (#3633)
  • (sync) Remove deprecated V1 sync protocol (#3634)
  • Use typed Url instead of hand-built string URLs (#3644)
  • Extract shared vt100 logic into atuin-common (#3664)

Styling

  • Improve Atuin AI TUI styles (#3710)

Testing

  • Parametrize tests with rstest across 8 crates (#3653)

Bug

  • Fix enter_accept default (#3717)
  • Abort install.sh on cURL fails (#2911)

atuin 18.18.0

Install atuin 18.18.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/atuinsh/atuin/releases/download/v18.18.0/atuin-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/atuinsh/atuin/releases/download/v18.18.0/atuin-installer.ps1 | iex"

Download atuin 18.18.0

| File | Platform | Checksum |
|--------|----------|----------|
| atuin-aarch64-apple-darwin.tar.gz | Apple Silicon macOS | checksum |
| atuin-x86_64-apple-darwin.tar.gz | Intel macOS | checksum |
| atuin-x86_64-pc-windows-msvc.zip | x64 Windows | checksum |
| atuin-aarch64-unknown-linux-gnu.tar.gz | ARM64 Linux | checksum |
| atuin-x86_64-unknown-linux-gnu.tar.gz | x64 Linux | checksum |
| atuin-aarch64-unknown-linux-musl.tar.gz | ARM64 MUSL Linux | checksum |
| atuin-x86_64-unknown-linux-musl.tar.gz | x64 MUSL Linux | checksum |

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo atuinsh/atuin

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

atuin-server 18.18.0

Install atuin-server 18.18.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/atuinsh/atuin/releases/download/v18.18.0/atuin-server-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/atuinsh/atuin/releases/download/v18.18.0/atuin-server-installer.ps1 | iex"

Download atuin-server 18.18.0

| File | Platform | Checksum |
|--------|----------|----------|
| atuin-server-aarch64-apple-darwin.tar.gz | Apple Silicon macOS | checksum |
| atuin-server-x86_64-apple-darwin.tar.gz | Intel macOS | checksum |
| atuin-server-x86_64-pc-windows-msvc.zip | x64 Windows | checksum |
| atuin-server-aarch64-unknown-linux-gnu.tar.gz | ARM64 Linux | checksum |
| atuin-server-x86_64-unknown-linux-gnu.tar.gz | x64 Linux | checksum |
| atuin-server-aarch64-unknown-linux-musl.tar.gz | ARM64 MUSL Linux | checksum |
| atuin-server-x86_64-unknown-linux-musl.tar.gz | x64 MUSL Linux | checksum |

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo atuinsh/atuin

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Breaking Changes

  • Removed deprecated V1 sync protocol
  • Minimum Node.js version bumped to 20.12

Security Fixes

  • dep: Updated unsound/vulnerable dependencies in Cargo.lock to address known vulnerabilities

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Atuin

Get notified when new releases ship.

Sign up free

About Atuin

Sync shell history across devices

All releases →

Related context

Beta — feedback welcome: [email protected]