Skip to content

Hm

v0.0.6 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Pipelines
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

ai-agents build-automation ci-cd cli code-generation dag
+11 more
developer-tools devops docker iac llm pipeline pipelines-as-code python rust task-runner typescript

Summary

AI summary

Broad release touches feat, fix, init, and dsl.

Full changelog

What's Changed

  • Add Dagger pipeline mirroring .harmont/ci.py for comparison by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/30
  • refactor(dsl): griffe-legible toolchains + Google docstrings by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/31
  • refactor(dsl): kill pipeline.py module/function shadow by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/32
  • feat(hm): pipelines + render commands (machine-readable IR for backend discovery) by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/33
  • fix(hm): discovery prefers Python + empty registry for pipeline-less repos by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/34
  • Drop elm, haskell, ocaml, dotnet, composer, perl, gradle toolchains by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/51
  • fix: add musl Linux release artifacts by @tadhgdowdall in https://github.com/harmont-dev/harmont-cli/pull/52
  • feat: add Elixir/OTP toolchain (hm.ex) by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/55
  • feat: add install.sh, versioned with the CLI by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/59
  • feat: unified js/ts toolchain with pm/runtime axes (CLI-19) by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/58
  • feat: accept named 'pipelines' export in TS DSL (CLI-10) by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/61
  • feat: remove schedule trigger and croniter dependency (CLI-3) by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/63
  • feat: pipeline() takes array of steps instead of variadic args (CLI-9) by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/64
  • refactor: simplify cmake module — generic defines, drop overspecific params by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/56
  • feat: cmake SDK simplification + TS cache key fix by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/68
  • js|ts: unify the python impl and fix gaps around yarn and deno by @versecafe in https://github.com/harmont-dev/harmont-cli/pull/67
  • feat: hm init onboarding wizard with 7 project templates (CLI-23) by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/71
  • feat: auto-detect JS runtime/package manager (CLI-26) by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/74
  • feat: hierarchical TOML config with figment (CLI-25) by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/73
  • feat: publish harmont SDK to npm and PyPI for IDE type support (CLI-21) by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/75
  • fix: install.sh prefer musl binaries, drop glibc CI builds (CLI-18) by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/78
  • feat(sdk): rename TS package to @harmont/hm; fix example .py pipelines by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/77
  • feat: replace legacy Docker runner with hm-vm crate by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/79
  • feat: step + pipeline timeouts (hm.timeout / pipeline timeout) by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/76
  • docs: add Common Changelog for unreleased changes since v0.0.5 by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/80
  • feat: hm run --cloud — run local worktree in the cloud with live logs by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/49
  • fix: address 18 findings from 2026-06-08 audit by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/81
  • build: bump harmont-cloud SDK to 0.1.2 by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/82
  • fix: filter noisy tracing spans from TUI progress output by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/84
  • fix(js): pin corepack PM version from packageManager field by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/86
  • ci: migrate CI pipeline from GHA to hm by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/92
  • fix: include Cargo.toml + *.rs in Rust warmup cache key (CLI-29) by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/91
  • fix: cross-SDK cache key compatibility (CLI-12) by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/94
  • feat(init): add Claude Code skills to hm init wizard by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/97
  • feat(init): add write-pipeline skill for Claude Code (CLI-33) by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/98
  • feat(init): add convert-gha skill for GHA pipeline migration (CLI-35) by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/99
  • fix(init): skip template prompt when .hm pipeline already exists by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/101
  • feat: add -k/--keep-going flag to hm run (CLI-36) by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/102
  • README rewrite + config-dir unification + Ruby removal by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/103
  • fix(ci): restore green CI by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/104
  • docs: add Docs chip to README badge row (CLI-38) by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/107
  • feat(init): ask to link org during hm init (CLI-39) by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/110
  • ci: run the full workspace test suite (CLI-37) by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/109
  • refactor(hm-dsl-engine): Replace positional (bool, bool) detection result with a named struct or DslLanguage set by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/114
  • refactor(hm-plugin-cloud): Replace raw i32 process exit codes with a typed ExitCode enum by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/115
  • refactor(hm-vm): Magic "ephemeral" sentinel string passed through snapshot() label couples vm.rs and docker.rs by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/121
  • refactor(hm-plugin-cloud): render_prefs returns a (bool, bool) tuple whose two fields are trivially swappable by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/118
  • refactor(hm-config): Mark public config structs #[non_exhaustive] by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/120
  • refactor(hm-exec): Model parallelism as NonZeroUsize instead of usize coerced with .max(1) by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/116
  • refactor(hm-dsl-engine): Replace stringly-typed run() mode ("list"/"render") with an internal enum by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/113
  • fix(dsl): port corepack PM version pin to Python DSL; fail-fast on legacy pipeline(step) form by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/134
  • refactor(hm-util): Replace bare (file_mode: u32, dir_mode: u32) pair with distinct mode newtypes to prevent swapped-argument bugs by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/122
  • fix(release): make harmont-cli crates.io-publishable (or drop the dead channel) and fix install docs by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/129
  • fix(cloud): correct watch URL host/path, taxonomy, and archive size guard by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/132
  • refactor(hm-pipeline-ir): timeout_seconds uses Option where 0 is a meaningless / footgun value by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/125
  • refactor(hm-vm): SnapshotId exposes a public String field, allowing arbitrary IDs to be minted anywhere by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/119
  • docs: fix examples README, README TS imports, and init-template skills (schedule/npm/ruby/gha-404) by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/131
  • refactor(hm-plugin-protocol): Mark the wire-protocol BuildEvent enum #[non_exhaustive] by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/123
  • fix(init): stop --force wiping config.toml; guard skill overwrites by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/135
  • refactor(hm-vm): ImageRegistry capacity is a bare u64 where 0 silently makes the cache evict every entry by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/117
  • fix(exec): propagate skips transitively under keep-going; UTF8-safe display_name; reap ephemeral images; fix cache clean by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/130
  • refactor(hm-exec): Replace raw-string-literal job-state match with a typed classifier by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/124
  • fix(hm): unbreak main — NonZeroU64 capacity in cache clean by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/137
  • feat(ts-engine): implement registry_json so hm pipelines supports TypeScript-only repos by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/128
  • refactor(hm-config): Replace stringly-typed backend: String with a closed enum by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/126
  • fix(config): migrate ~/.harmont config forward, plumb HARMONT_* env, hint on legacy .harmont/ project dir by @markovejnovic in https://github.com/harmont-dev/harmont-cli/pull/133

New Contributors

  • @tadhgdowdall made their first contribution in https://github.com/harmont-dev/harmont-cli/pull/52
  • @versecafe made their first contribution in https://github.com/harmont-dev/harmont-cli/pull/67

Full Changelog: https://github.com/harmont-dev/harmont-cli/compare/v0.0.5...v0.0.6

Breaking Changes

  • Drop elm, haskell, ocaml, dotnet, composer, perl, gradle toolchains
  • feat: pipeline() takes array of steps instead of variadic args (CLI-9)
  • feat(sdk): rename TS package to @harmont/hm

Security Fixes

  • fix: address 18 findings from 2026-06-08 audit

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Hm

Get notified when new releases ship.

Sign up free

Related context

Earlier breaking changes

  • v0.0.2 Remove deployment feature (hm dev).

Beta — feedback welcome: [email protected]