Go modules · #1852

github.com/cashapp/hermit

v0.52.3cashapp/hermit ↗

Last release 10 days ago
17 Aug 2026
Ships fairly regularly
a new release about every 2 weeks
Rarely documented
notes for 9 of 138 stable releases
Nothing withdrawn
no release was ever pulled
5 years old
194 releases · first in 2021

Release timeline

194 releases since 2021

20222023202420252026

Releases

v0.52.4-0.20260817030610-466336c4c65e17 Aug 2026pre-release
Nothing published for this version
v0.52.4-0.20260802222320-6bccbcab29932 Aug 2026pre-release
Nothing published for this version
v0.52.4-0.20260728003638-449e375aa13f28 Jul 2026pre-release
Nothing published for this version
v0.52.4-0.20260713062743-f2a4a7af682313 Jul 2026pre-release
Nothing published for this version
v0.52.316 Jun 2026
Release notes
fix: re-validate archive paths after applying strip (#575)

Archive path computation validated the entry path before applying
`strip`, then joined the remainder to the destination without
re-checking, so the result could fall outside the destination directory.
This applies to all multi-file extractors (tar, zip, 7z, rpm) via the
shared path helper.

Re-validates the path after `strip`, and tightens `sanitizeExtractPath`
to require a path separator after the destination so a sibling sharing
its name as a prefix is not accepted.

Adds regression tests.

Co-authored-by: Amp <[email protected]>
Open source →
v0.52.216 Jun 2026
Release notes
fix(zsh): stop ../-path completion stalling and double chpwd registra…

…tion (#574)

Two zsh shell-hook issues that compound on machines where Hermit hooks
are evaluated more than once (e.g. a corporate-managed /etc/zshrc plus a
per-user ~/.zshrc install).

1. ../-path tab completion paused ~1s. zsh's _cd completer canonicalises
a `../` prefix by running `cd` in a $(...) subshell, which fires
chpwd_functions -> change_hermit_env and pays for a full Hermit env
switch (validate + source activate-hermit) that is then discarded. Guard
change_hermit_env with `${compstate+_}`, which zsh sets only while its
completion system is running and which is inherited into the _cd
subshell. Interactive `cd`, `(cd ... && cmd)` and `$(cd ... && cmd)` all
leave compstate unset and are unaffected.

2. change_hermit_env was registered twice in chpwd_functions, doubling
the
cost of every real cd. The hook block is evaluated once per startup file
that sources it (system-wide + per-user), and the old
`chpwd_functions+=(change_hermit_env)` is not idempotent. Register via
add-zsh-hook instead, which checks membership before appending. Note a
plain `typeset -gU chpwd_functions` does not help: += bypasses the
unique
flag in zsh 5.9.
Open source →
v0.52.2-0.20260609054746-035e4f3c79979 Jun 2026pre-release
Nothing published for this version
v0.52.121 Apr 2026
Release notes
fix: deadlock between Task.Size and redrawProgress under parallel ins…

…tall (#564)

## Summary

#558 parallelised `hermit install`, which lets many goroutines drive
per-package download progress concurrently. `cache/http.go` calls
`task.Size(total)` followed by `task.Add(n)` for each chunk received;
with a single active task the cycle below could never close, but with
many it closes in two hops.

Lock orderings:

```
Task.Size: task.lock -> ui.lock (via UI.swapSize)
UI.redrawProgress: ui.lock -> task_i.lock (via liveOperations / op.status)
```

Goroutine A inside `task_A.Size` holds `task_A.lock` waiting on
`ui.lock`. Goroutine B, having just returned from its own `task.Add`'s
critical section, enters `redrawProgress` holding `ui.lock` and iterates
operations waiting on `task_A.lock`. Deadlock is silent because the UI
itself is blocked, so no progress output is produced before the job is
killed — matches the wild symptom of `hermit install` stalling with zero
output after `v0.52.0` on CI jobs that install many packages at once.

## Fix

Release `task.lock` in `Task.Size` before calling `UI.swapSize`. The
`oldSize → newSize` delta passed to `swapSize` is additive and
commutative, so doing the swap outside the task's critical section loses
nothing.

## Test

`ui/task_test.go::TestConcurrentTaskSizeAndAddNoDeadlock` fans out
goroutines each interleaving `Size`/`Add` on their own task (mirroring
`cache/http.go`'s download loop).

- Pre-fix: hangs for the test's 10s self-deadline and fails with an
annotated goroutine dump showing the expected `ui.lock` ↔ `task.lock`
cycle.
- Post-fix: completes in ~0s.

Passes `go test -race ./ui/` and existing `go test ./app/`.

---------

Co-authored-by: Josh Friend <[email protected]>
Open source →
v0.52.016 Apr 2026
Release notes
feat: parrallellize hermit install downloads (#558)

Download package archives concurrently during install using errgroup,
with concurrency defaulting to `runtime.NumCPU()`. A new `-j` flag
allows overriding the parallelism level.

Only the download phase is parallelised. Extraction and linking remain
serial because unpack triggers may execute binaries from dependency
packages.

Both install paths benefit:
- **No-args** (re-install existing): parallel download, then serial
CacheAndUnpack.
- **With packages**: parallel download, then serial install/link loop.

A new `State.Download` method is added to expose download-only
functionality, separate from `CacheAndUnpack`.

Co-authored-by: Amp <[email protected]>
Open source →
v0.51.031 Mar 2026
Release notes
Guard zsh prompt prefix updates (#555)

## Summary
- only capture `_HERMIT_OLD_PS1` and prepend the Hermit prompt once in
`update_hermit_ps1`
- avoid re-prepending the Hermit prompt on later precmd runs once the
original prompt has been recorded

## Testing
- `go test ./...`

Co-authored-by: Amp <[email protected]>
Open source →
v0.50.222 Mar 2026
Release notes
fix: sync sources on ListInstalled resolution failure (#552)

Co-authored-by: Amp <[email protected]>
Open source →
v0.50.117 Mar 2026
Release notes
fix: move download outside global lock in CacheAndUnpack (#551)

## Summary

- Move the network download step outside the global file lock in
`CacheAndUnpack()` so slow downloads no longer block other hermit
processes
- Only the fast local extract + link operations remain under the lock,
preventing "timed out acquiring lock" errors in CI
- Consistent with `CacheAndDigest()` which already downloads outside any
lock

This is safe because cache paths are content-addressed (SHA256-based)
and the cache layer uses temp files + atomic `os.Rename` (see
`cache/http.go` `downloadHTTP()`).

per
[ADR-0098](https://docs.google.com/document/d/1CxeLv3gArVytK8pJLw-MMA3t6j4OqE65rK1Kbs6RcrM/edit)
and the [Workspace
Contract](https://docs.google.com/document/d/18Susz4iTeWoINhchvIFmSen_fHU657hAurvNlZFliuY/edit).

## Test plan

- [x] \`go build ./...\` compiles successfully
- [x] \`go test ./state/... ./cache/...\` passes
- [ ] Verify in CI that parallel hermit installs no longer produce lock
timeout errors

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.6 <[email protected]>
Open source →
v0.50.01 Mar 2026
Nothing published for this version
v0.49.418 Feb 2026
Release notes
What's Changed
- Quote activation exports and paths for space-containing roots by @robmaceachern in #545
New Contributors
- @robmaceachern made their first contribution in #545
Full Changelog: v0.49.3...v0.49.4
Open source →
v0.49.317 Feb 2026
Release notes
What's Changed
- cache: do not print spurious '%s' format verb by @marco-m in #544
- fix: prevent Git argument injection RCE by @wsutina in #542
New Contributors
- @marco-m made their first contribution in #544
Full Changelog: v0.49.2...v0.49.3
Open source →
v0.49.210 Feb 2026
Nothing published for this version
v0.49.16 Feb 2026
Nothing published for this version
v0.49.06 Feb 2026
Nothing published for this version
v0.48.15 Feb 2026
Nothing published for this version
v0.48.04 Feb 2026
Nothing published for this version
v0.47.1-0.20260122090100-80919e76b1db22 Jan 2026pre-release
Nothing published for this version
v0.47.029 Dec 2025
Nothing published for this version
v0.46.26 Nov 2025
Nothing published for this version
v0.46.2-0.20250916194246-d18c9c6b139816 Sept 2025pre-release
Nothing published for this version
v0.46.110 Sept 2025
Nothing published for this version
v0.46.08 Sept 2025
Nothing published for this version
v0.45.23 Sept 2025
Nothing published for this version
v0.45.12 Sept 2025
Nothing published for this version
v0.45.028 Aug 2025
Nothing published for this version
v0.44.1214 Jul 2025
Nothing published for this version
v0.44.119 Jul 2025
Nothing published for this version
v0.44.1026 Jun 2025
Nothing published for this version
v0.44.919 Jun 2025
Nothing published for this version
v0.44.81 May 2025
Nothing published for this version
v0.44.724 Apr 2025
Nothing published for this version
v0.44.622 Apr 2025
Nothing published for this version
v0.44.54 Apr 2025
Nothing published for this version
v0.44.426 Mar 2025
Nothing published for this version
v0.44.312 Mar 2025
Nothing published for this version
v0.44.3-0.20250312000545-de127dfc395212 Mar 2025pre-release
Nothing published for this version
v0.44.27 Mar 2025
Nothing published for this version
v0.44.16 Mar 2025
Nothing published for this version
v0.44.1-0.20250306050154-661a59bc4d746 Mar 2025pre-release
Nothing published for this version
v0.44.1-0.20250303030730-8332f01cd90c3 Mar 2025pre-release
Nothing published for this version
v0.44.010 Feb 2025
Nothing published for this version
v0.43.022 Jan 2025
Nothing published for this version
v0.42.16 Jan 2025
Nothing published for this version
v0.42.05 Jan 2025
Nothing published for this version
v0.41.1-0.20241207215554-0418180e1a707 Dec 2024pre-release
Nothing published for this version
v0.41.1-0.20241127220026-10591db1cec627 Nov 2024pre-release
Nothing published for this version
v0.41.1-0.20241114210055-418f46d25a2b14 Nov 2024pre-release
Nothing published for this version
v0.41.1-0.20241112052340-aeb83446f2d312 Nov 2024pre-release
Nothing published for this version
v0.41.017 Oct 2024
Nothing published for this version
v0.40.1-0.20241017213028-71e3426613a617 Oct 2024pre-release
Nothing published for this version
v0.40.021 Jun 2024
Nothing published for this version
v0.39.4-0.20240621051953-3ed25538263d21 Jun 2024pre-release
Nothing published for this version
v0.39.4-0.20240621010344-1c0ace5d06be21 Jun 2024pre-release
Nothing published for this version
v0.39.321 Jun 2024
Nothing published for this version
v0.39.215 May 2024
Nothing published for this version
v0.39.2-0.20240515215756-991aa47af75115 May 2024pre-release
Nothing published for this version

github.com/cashapp/hermit

Release timeline

Releases

What's Changed

New Contributors

What's Changed

New Contributors