Skip to content

Fono

v0.2.2 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

assistant dictation linux llm local-first rust
+5 more
speach-to-text stt vulkan whisper wyoming

Affected surfaces

deps

Summary

AI summary

Live streaming dictation now ships in the binary and update supply‑chain hardening verifies asset integrity.

Full changelog

First release in which the streaming live-dictation pipeline is
actually reachable from the shipped binary. v0.2.1 and earlier
release artefacts were built without the interactive feature, so
record --live, the live overlay, test-overlay, and
[interactive].enabled were all stubbed out at build time. v0.2.2
flips interactive into the default feature set.

Also bundles the Wave 2 close-out: typed ModelCapabilities API for
fono-bench, per-asset .sha256 sidecar verification in
fono update, --bin-dir CLI flag, real-fixture CI bench gate
against the committed baseline, and the doc-reconciliation pass
(closed three superseded plans, backfilled ADRs 0005–0008 +
0010–0014, added 0017/0018/0019).

Highlights

  • Live streaming dictation now ships in the binary. First-time
    users on v0.2.2 will see record --live actually work; v0.2.1
    users upgrading get the feature for the first time.
  • Self-update supply-chain hardening. Each release now publishes
    a per-asset <asset>.sha256 sidecar alongside the aggregate
    SHA256SUMS; the next-version client verifies streamed bytes
    against the sidecar and refuses on mismatch.
  • fono update --bin-dir <path> to override the install
    directory (matches install-script BIN_DIR semantics).
  • Real-fixture CI gate. Every PR runs
    fono-bench equivalence --stt local --model tiny.en and diffs
    against docs/bench/baseline-comfortable-tiny-en.json.

See CHANGELOG.md for the full breakdown.

Install

One-liner (downloads the bare static binary, verifies SHA-256, drops
into ~/.local/bin):

curl -fsSL https://raw.githubusercontent.com/bogdanr/fono/main/packaging/install.sh | sh

Or grab a distro package directly from the assets below.

Security Fixes

  • Update supply‑chain hardening: each asset now ships with a per‑asset `.sha256` sidecar; the client verifies and refuses mismatched downloads

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Fono

Get notified when new releases ship.

Sign up free

Beta — feedback welcome: [email protected]