This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
Affected surfaces
Summary
AI summaryBroad release touches Bug Fixes, Miscellaneous Tasks, Refactor, and search.
Full changelog
Release Notes
Bug Fixes
- (daemon) Index synced history directly instead of malformed SQL (#3627) (#3641)
- (deps) Update unsound/vulnerable dependencies in Cargo.lock (#3632)
- (docs) Repair every stale link in the repo (#3727)
- (docs) Make the incorrect-decrypt-key error actionable (#3609)
- (hook) Drop agent commands containing NUL bytes via NonNulStr (#3589) (#3660)
- (import) Survive corrupt entries instead of aborting the import (#3721)
- (init) Fix include guard in Bash init script; chore(init): improve inclusion of shell init scripts in Rust (#3645)
- (install) Make /dev/tty authoritative for interactivity detection (#3691)
- (search) Add
DbSearchMode; correctly fall back to "fuzzy" in non-interactive searches (#3744) - (ui) Calculate preview height based on command display width instead of byte count (#3678)
- (win32) Cargo-binstall package metadata (#3673)
- Search functionality to respect character offsets and non-ASCII (#3659)
- Quote argument-hint YAML values so Copilot CLI ≥1.0.65 loads all skills (#3613) (#3614)
- Correct grammar in 'history last' help text (#3430)
- Work around rust nightly warning on eyre bail (#3680)
- Improve non-interactive TTY detection in install.sh (#3315)
- Add /model hint to status bar (#3687)
- Set correct umask for pty-proxy (#3700)
- Atuin AI not erasing the input box before closing (#3715)
- Show server status next to AI progress indicator (#3723)
- Show full command when using AtuinOutput tool (#3725)
Documentation
- (ai) Add self hosting + slash command docs (#3623)
- (config) Standardize TOML examples for config options (#3441)
- Advise users to pass
--lockedwhen installing from Cargo (#3630) - Add docs for store_failed and default for enter_accept (#2696)
- Serve docs.atuin.sh from this repo; remove Desktop docs (#3684)
- Version docs.atuin.sh with mike (per-release + main) (#3688)
- Hotfix bad path (#3690)
- Document built-in bash-preexec (#3651)
- Retheme docs.atuin.sh to the Atuin brand (#3701)
- Bundle of improvements (#3716)
- Remove ugly cards on landing page (#3724)
- Fix broken README links (#3696)
- Lint prose with Vale and gate it in CI (#3726)
- Slightly nicer default config.toml order (#2485)
- Kubernetes self-hosting documentation (#3238)
- Add canonical Supported platforms page (#3736)
- Add friendly hover tips for new terms (#3740)
- Clarify how to uninstall shell integration (#3741)
Features
- (ai) Up/down to scroll through previously sent messages (#3720)
- (bash) Bundle bash-preexec with Atuin; automatically load if no other preexec backend is loaded (#3650)
- (search) Add
--shelloption toatuin searchto filter results by shell (#3658) - (search) Syntax highlight commands in interactive search (#3704)
- (search) Filter by shell in interactive search (#3692)
- (string) EllipsizeExt -- General-purpose utility for adding ellipses to strings (#3639)
- Add 'yolo' setting to Atuin AI options (#3637)
- Add
shellfield to history entries (#3636) - Add hickory-dns resolver for musl target to improve DNS resolution (#3647)
- Add atuin stats --filter-mode (#1737)
- More aggressive optimizations for dist release (#3683)
- Capture zsh comments as history (#3699)
- Allow injecting extra HTTP headers on sync server requests (#3718)
Miscellaneous Tasks
- (atuin-common) Add ellipsize_or_pad for unicode pad (#3663)
- (ci) Bump GitHub Actions to latest versions (#3689)
- (ci) Lint tests & docs in CI (#3746)
- (clap) Simplify clap field types and fix help message formatting (#3640)
- (logging) Refactor logging (#3622)
- (release-skill) Time label-gated PR merges around the release (#3654)
- Remove fossier (#3629)
- Trigger docs repo deploy (#3631)
- Remove redundant test (#3635)
- Add
.editorconfigand.nvim.lua(#3648) - Clean up
WordJumperin atuin/src/command/client/search/cursor.rs (#3662) - Don't panic if clipboard cannot be accessed (#2648)
- Update some dependency versions (#3666)
- Update sqlx to v9 (#3668)
- Follow-up on #1737 (#3649)
- Update Atuin AI to eye-declare v0.6.1 (#3686)
- Remove docs-dispatch (#3694)
- Docker healtcheck (#2451)
- Run windows jobs on depot-windows-2025-16 (#3711)
- Hotfix script (#3714)
- Update flake.nix (#3509)
- Add Timezone and restart policy for postgres backup docker (#3083)
- Add riscv64 to release targets (#3339)
- Build x86_64-apple-darwin on Depot M4 macs; move all macOS CI to Depot (#3742)
Performance
- Do not block counting history (#3729)
- Actually delete history rows, and index active history (#3730)
- Index filtered history search, record store tags, and cache inspector stats (#3731)
Refactor
- (hook) Typed protocol for agent hook events (#3638)
- (render) Slightly nicer and more correct non-printable escaping (#3633)
- (sync) Remove deprecated V1 sync protocol (#3634)
- Use typed Url instead of hand-built string URLs (#3644)
- Extract shared vt100 logic into atuin-common (#3664)
Styling
- Improve Atuin AI TUI styles (#3710)
Testing
- Parametrize tests with rstest across 8 crates (#3653)
Bug
atuin 18.18.0
Install atuin 18.18.0
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/atuinsh/atuin/releases/download/v18.18.0/atuin-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/atuinsh/atuin/releases/download/v18.18.0/atuin-installer.ps1 | iex"
Download atuin 18.18.0
| File | Platform | Checksum |
|--------|----------|----------|
| atuin-aarch64-apple-darwin.tar.gz | Apple Silicon macOS | checksum |
| atuin-x86_64-apple-darwin.tar.gz | Intel macOS | checksum |
| atuin-x86_64-pc-windows-msvc.zip | x64 Windows | checksum |
| atuin-aarch64-unknown-linux-gnu.tar.gz | ARM64 Linux | checksum |
| atuin-x86_64-unknown-linux-gnu.tar.gz | x64 Linux | checksum |
| atuin-aarch64-unknown-linux-musl.tar.gz | ARM64 MUSL Linux | checksum |
| atuin-x86_64-unknown-linux-musl.tar.gz | x64 MUSL Linux | checksum |
Verifying GitHub Artifact Attestations
The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:
gh attestation verify <file-path of downloaded artifact> --repo atuinsh/atuin
You can also download the attestation from GitHub and verify against that directly:
gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>
atuin-server 18.18.0
Install atuin-server 18.18.0
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/atuinsh/atuin/releases/download/v18.18.0/atuin-server-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/atuinsh/atuin/releases/download/v18.18.0/atuin-server-installer.ps1 | iex"
Download atuin-server 18.18.0
| File | Platform | Checksum |
|--------|----------|----------|
| atuin-server-aarch64-apple-darwin.tar.gz | Apple Silicon macOS | checksum |
| atuin-server-x86_64-apple-darwin.tar.gz | Intel macOS | checksum |
| atuin-server-x86_64-pc-windows-msvc.zip | x64 Windows | checksum |
| atuin-server-aarch64-unknown-linux-gnu.tar.gz | ARM64 Linux | checksum |
| atuin-server-x86_64-unknown-linux-gnu.tar.gz | x64 Linux | checksum |
| atuin-server-aarch64-unknown-linux-musl.tar.gz | ARM64 MUSL Linux | checksum |
| atuin-server-x86_64-unknown-linux-musl.tar.gz | x64 MUSL Linux | checksum |
Verifying GitHub Artifact Attestations
The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:
gh attestation verify <file-path of downloaded artifact> --repo atuinsh/atuin
You can also download the attestation from GitHub and verify against that directly:
gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>
Breaking Changes
- Removed deprecated V1 sync protocol
- Minimum Node.js version bumped to 20.12
Security Fixes
- dep: Updated unsound/vulnerable dependencies in Cargo.lock to address known vulnerabilities
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Beta — feedback welcome: [email protected]