Release notes

HOL Guard v3.57.0a4

Preview

HOL Guard v3.57.0a4, released October 25, 2026, is a preview release with 4 additions, 2 fixes and 1 other change across 6 merged pull requests. Highlights: Show plugin update prompts in the local Guard dashboard; Review Node.js launches of builds with known high or critical advisories.

Changes since the previous release on this channel: alpha/v3.57.0a3alpha/v3.57.0a4

4 added · 2 fixed · 1 other

Published Original GitHub release for alpha/v3.57.0a4

Key facts

Version
v3.57.0a4
Channel
Preview
Published
Previous release
alpha/v3.57.0a3
Merged pull requests
6

Documented changes

7 typed entries

Verified contributors

1 verified contributor · 6 credits

Attribution coverage

attribution complete; history inventory partial.

Install

Current installation guide

Scope

Guard v3.57.0a4 is a preview release published 2026-10-25. Upstream documents: Guard 3.57.0a4 is an opt-in prerelease cut from 7663521. Stable installations remain on the stable channel. 6 commits • 6 merged pull requests • 1 contributor since Guard 3.57.0a3. Its comparison base is alpha/v3.57.0a3. It includes 6 verified contribution deliveries with public evidence links.

Changes

Added

4
  • dashboardShow plugin update prompts in the local Guard dashboard (#5969) Evidence for this change
    • The dashboard cannot reach hol.org (CSP), so two new daemon routes do the work: GET /v1/plugins/updates runs the same native comparison as the CLI, and POST /v1/plugins/updates/dismiss records a dismissal for one…
    • Both routes need the dashboard session token. The Rust route policy lists them in TOKEN_REQUIRED_PATHS and allows them only with the right method (GET for the read, POST for the dismissal).
    • The check runs only when the reader presses "Check for plugin updates". Guard downloads the public release index and compares versions on the device; nothing about the installed plugins is sent.
  • runtimeReview Node.js launches of builds with known high or critical advisories (#5957) Evidence for this change
  • plugin-releaseAdd the trusted reusable Plugin Release workflow (#5970) Evidence for this change
    • The workflow starts with permissions: {}. The one job asks for contents: read, id-token: write, attestations: write, artifact-metadata: write and security-events: write (the last only matters with…
    • Every composite input is forwarded, and the composite's outputs (score, check result, runtime count, attestation URL, registration status and releases page URL) are exposed to the caller.
    • The doc now describes the workflow as shipped and shows a minimal caller.
  • plugin-releasePin the Guard wheel and smoke-test the composite (#5965) Evidence for this change

Fixed

2
  • plugin-releaseSend a User-Agent so release registration reaches HOL (#5973) Evidence for this change
    • Plugin release and Guarded Repository registration now send User-Agent: hol-guard-attestation-registration.
    • When registration fails, the runner now prints the HTTP status code next to the error class. It still prints no body and no token.
  • dashboardLabel the audit priority badge as high priority, not critical (#5964) Evidence for this change
    • Merged pull request #5973: fix(plugin-release): send a User-Agent so release registration reaches HOL
    • Merged pull request #5970: feat(plugin-release): add the trusted reusable Plugin Release workflow
    • Merged pull request #5957: feat(runtime): review Node.js launches of builds with known high or critical advisories
    • Merged pull request #5969: feat(dashboard): show plugin update prompts in the local Guard dashboard
    • Merged pull request #5964: fix(dashboard): label the audit priority badge as high priority, not critical
    • Merged pull request #5965: feat(plugin-release): pin the Guard wheel and smoke-test the composite

Other changes

1

Upgrade and compatibility

None documented.

Compare with the previous release

Predecessor on the same channel: alpha/v3.57.0a3

Verified contributors

Credits derive from public pull-request authorship, verified commit authorship, or verified co-authorship — never from thanks text or release metadata. Each distinct contributor is listed once; the evidence ledger paginates every published credit record.

Contributors

Evidence ledger6 credits