Release notes
HOL Guard v3.56.0a6
PreviewHOL Guard v3.56.0a6, released October 24, 2026, is a preview release with 4 additions, 6 fixes and 3 other changes across 12 merged pull requests. Highlights: Set each app's protection from its App coverage row; Open About and Supply chain on the HOL brand hero.
4 added · 6 fixed · 3 other
Key facts
- Version
- v3.56.0a6
- Channel
- Preview
- Published
- Previous release
- alpha/v3.56.0a5
- Merged pull requests
- 12
Documented changes
13 typed entries
Verified contributors
3 verified contributors · 13 credits
Attribution coverage
attribution complete; history inventory partial.
Install
Scope
Guard v3.56.0a6 is a preview release published 2026-10-24. Upstream documents: Guard 3.56.0a6 is an opt-in prerelease cut from a71cc79. Stable installations remain on the stable channel. 12 commits • 12 merged pull requests • 3 contributors since Guard 3.56.0a5. Its comparison base is alpha/v3.56.0a5. It includes 13 verified contribution deliveries with public evidence links.
Changes
Added
4- dashboardSet each app's protection from its App coverage row (#5888) Evidence for this change
- Each app whose hooks Guard manages carries its Protected/Watch choice on its App coverage row. Unmanaged apps keep their coverage status (Observed, Needs repair and so on) and get no choice, because a posture there…
- The machine posture line ("Machine: Protected · 1 in Watch") moves into the App coverage header.
- Watch rows sort first and get the attention tint and a "Watch · recording only" line.
- dashboardOpen About and Supply chain on the HOL brand hero (#5886) Evidence for this change
- Shared surface.
dashboard/src/brand-hero.tsxholds the hero, badge, facts row and a flatBrandMark. Home renders through it with no visual change. - About. The hero shows whether Guard is protecting this device, has approvals waiting, or isn't reporting. Its actions are "Read Guard docs" (white primary) and "View source". Facts list the version, cloud sync…
- Supply chain. The status hero reads Protected, Partly protected, Restart to finish, Not protected or Checking. The live label under the mark counts the tools being guarded or still unprotected. When repairs are…
- Shared surface.
- actionLink public repositories to their HOL Plugins listing in the job summary (#5887) Evidence for this change
- The run is on github.com.
- The event payload marks the repository as public (
repository.privateisfalse) and itsfull_namematchesGITHUB_REPOSITORY. Private, unknown-visibility and enterprise-server runs never show it. - The mode is not
submit.
- mcp-serversAdd P6 MCP contribution (#5882) Evidence for this change
Fixed
6- extensionsList Guard's own coverage ahead of external extensions (#5893) Evidence for this change
- dashboardDraw the Releases screen from the brand palette (#5891) Evidence for this change
- scannerDistinguish direct eval calls (#2922) Evidence for this change
- direct
eval(...), including optional direct calls; - explicit global calls such as
globalThis.eval(...),window.eval(...), and Python builtins forms; and new Function(...).
- direct
- containRun a project's own pytest from the virtual environment beside it (#5884) Evidence for this change
- containPlan a grouped test command as the list inside it (#5885) Evidence for this change
- commandRead a find -exec body as the program's arguments (#5881) Evidence for this change
Other changes
3- Guard 3.56.0a6 is an opt-in prerelease cut from
a71cc79. Stable installations remain on the stable channel. 12 commits • 12 merged pull requests • 3 contributors since Guard 3.56.0a5. Evidence for this change - Lock zod 4.6.6 in the Gauntlet SDK tree (#5897) Evidence for this change
- Bump locked dependency floors for published advisories (#5892) Evidence for this change
- Merged pull request #5886: feat(dashboard): open About and Supply chain on the HOL brand hero (#5886)
- Direct commit 7247dde70459: Merge remote-tracking branch 'origin/main' into mm-2922
- Merged pull request #5887: feat(action): link public repositories to their HOL Plugins listing in the job summary (#5887)
- Merged pull request #2922: fix(scanner): distinguish direct eval calls (#2922)
- Merged pull request #5885: fix(contain): plan a grouped test command as the list inside it (#5885)
- Merged pull request #5888: feat(dashboard): set each app's protection from its App coverage row (#5888)
- Merged pull request #5893: fix(extensions): list Guard's own coverage ahead of external extensions (#5893)
- Merged pull request #5892: deps: bump locked dependency floors for published advisories (#5892)
- Merged pull request #5884: fix(contain): run a project's own pytest from the virtual environment beside it (#5884)
- Merged pull request #5881: fix(command): read a find -exec body as the program's arguments (#5881)
- Merged pull request #5891: fix(dashboard): draw the Releases screen from the brand palette (#5891)
- Merged pull request #5897: deps: lock zod 4.6.6 in the Gauntlet SDK tree (#5897)
- Merged pull request #5882: feat(mcp-servers): add P6 MCP contribution (#5882)
Upgrade and compatibility
None documented.
Compare with the previous release
Predecessor on the same channel: alpha/v3.56.0a5
Verified contributors
Credits derive from public pull-request authorship, verified commit authorship, or verified co-authorship — never from thanks text or release metadata. Each distinct contributor is listed once; the evidence ledger paginates every published credit record.