Release notes
HOL Guard v3.57.0a3
PreviewHOL Guard v3.57.0a3, released October 25, 2026, is a preview release with 2 additions, 1 improvement, 7 fixes and 1 other change across 10 merged pull requests. Highlights: Match runtime advisories from the signed supply-chain bundle; Add a false-positive issue form.
2 added · 1 improved · 7 fixed · 1 other
Key facts
- Version
- v3.57.0a3
- Channel
- Preview
- Published
- Previous release
- alpha/v3.57.0a2
- Merged pull requests
- 10
Documented changes
11 typed entries
Verified contributors
1 verified contributor · 10 credits
Attribution coverage
attribution complete; history inventory partial.
Install
Scope
Guard v3.57.0a3 is a preview release published 2026-10-25. Upstream documents: Guard 3.57.0a3 is an opt-in prerelease cut from c7c41cc. Stable installations remain on the stable channel. 10 commits • 10 merged pull requests • 1 contributor since Guard 3.57.0a2. Its comparison base is alpha/v3.57.0a2. It includes 10 verified contribution deliveries with public evidence links.
Changes
Added
2- Match runtime advisories from the signed supply-chain bundle (#5953) Evidence for this change
- Verification and coverage stay native. Python passes the stored bundle response, the recorded sync keyring and the recorded bundle entitlement through unparsed. Rust checks the entitlement with the same rule…
- Only an anchored bundle can clear a runtime. A bundle that verifies only against the key it advertises can still report
affected, but itsnot_affectedmatches are downgraded tounknown… - Unknown stays unknown. Platform-scoped rules match only a confirmed OS/arch; an unconfirmed platform, including a macOS universal binary, reports
platform_unknown. Bundled-component rules report…
- Add a false-positive issue form (#5962) Evidence for this change
- Merged pull request #5956: fix(command): let a parent step return to the root a proven descent left
- Merged pull request #5958: fix(command): keep a help request silent when it names a subcommand's own verb
- Merged pull request #5959: fix(dashboard): count blocked package installs from receipts, not inactive apps
- Merged pull request #5960: refactor(command): make pretool a base layer of guard-command
- Merged pull request #5955: fix(command): read
git submodule statusas the printing command it is - Merged pull request #5954: fix(command): keep a recursive search or listing of a missing path quiet
- Merged pull request #5962: chore: add a false-positive issue form
- Merged pull request #5961: fix(supply-chain): say where an auditable project folder must live
- Merged pull request #5953: feat: match runtime advisories from the signed supply-chain bundle
- Merged pull request #5952: fix(command): read a process substitution as the path it opens
Improved
1- commandMake pretool a base layer of guard-command (#5960) Evidence for this change
Fixed
7- supply-chainSay where an auditable project folder must live (#5961) Evidence for this change
- dashboardCount blocked package installs from receipts, not inactive apps (#5959) Evidence for this change
- commandRead
git submodule statusas the printing command it is (#5955) Evidence for this change - commandLet a parent step return to the root a proven descent left (#5956) Evidence for this change
- commandKeep a recursive search or listing of a missing path quiet (#5954) Evidence for this change
- commandRead a process substitution as the path it opens (#5952) Evidence for this change
- commandKeep a help request silent when it names a subcommand's own verb (#5958) Evidence for this change
Other changes
1- Guard 3.57.0a3 is an opt-in prerelease cut from
c7c41cc. Stable installations remain on the stable channel. 10 commits • 10 merged pull requests • 1 contributor since Guard 3.57.0a2. Evidence for this change
Upgrade and compatibility
None documented.
Compare with the previous release
Predecessor on the same channel: alpha/v3.57.0a2
Verified contributors
Credits derive from public pull-request authorship, verified commit authorship, or verified co-authorship — never from thanks text or release metadata. Each distinct contributor is listed once; the evidence ledger paginates every published credit record.