nebi v0.12 (2026-06-05T12:50:34Z)

Welcome to this new release of nebi!

Changelog

Bug Fixes

• 047197b: fix(api): drop invalid wildcard+credentials CORS combo (#385) (@aktech)
• ffa8c5f: fix(frontend): show group shares in Collaborators tab (#386) (@aktech)

Others

• e8f6759: Add local search to docs site (#383) (@MUFFANUJ)
• 8b4b174: Fix: MacOS desktop binary not packaged or signed properly (#381) (@jbouder)
• 42552d2: Fix: Workspace Info section too-wide (#380) (@jbouder)
• bb45aed: Migrate to biome (#362) (@karamba228)
• f4b23ca: ci: inject VERSION build-arg into docker image build (#387) (@aktech)

Installation

Binary Installation

Download the appropriate binary for your platform from the assets below.

Full Changelog: v0.12-rc3...v0.12

nebi v0.12-rc3 (2026-06-04T06:53:47Z)

Welcome to this new release of nebi!

Changelog

New Features

• 32d0bc9: feat(auth): support separate OIDC discovery URL for back-channel calls (#369) (@viniciusdc)

Installation

Binary Installation

Download the appropriate binary for your platform from the assets below.

Full Changelog: v0.12-rc2...v0.12-rc3

nebi v0.12-rc2 (2026-06-03T10:30:59Z)

Welcome to this new release of nebi!

Changelog

Bug Fixes

• cbac786: fix(auth): collapse leading-slash OIDC group paths to one group (#370) (@aktech)

Others

• d33bb7e: document all relevant env vars in CLI (#372) (@pmeier)

Installation

Binary Installation

Download the appropriate binary for your platform from the assets below.

Full Changelog: v0.12-rc1...v0.12-rc2

nebi v0.12-rc1 (2026-06-02T12:16:43Z)

Welcome to this new release of nebi!

Changelog

Bug Fixes

• 0afe891: fix(desktop): re-apply SA_ONSTACK to survive WebKitGTK JSC signal handler clobbering (#351) (@Adam-D-Lewis)
• a135ac4: fix(rbac): drop redundant enforcer.SavePolicy() after grant/revoke (#357) (@aktech)
• 11d6218: fix(worker): persist workspace path after creation (#306) (@viniciusdc)

Others

• dad6163: Groups: share workspaces and registries with groups (native + OIDC) (#346) (@tylerpotts)
• f024a78: [DOC] Launching nebi-desktop from CLI (#344) (@pavithraes)
• 584a3fd: ci(desktop): smoke-test built binaries by launching them for 10s (#358) (@Adam-D-Lewis)
• 352436d: docs(home): equalize demo GIF heights (#368) (@khuyentran1401)
• 473badf: docs(home): swap CLI and Web UI demo order (#356) (@khuyentran1401)

Installation

Binary Installation

Download the appropriate binary for your platform from the assets below.

Full Changelog: v0.11...v0.12-rc1

nebi v0.11 (2026-05-01T19:44:38Z)

Welcome to this new release of nebi!

Changelog

Bug Fixes

• 68b77e5: fix: add repository_path for registry imports (@nenb)
• 516aab4: fix: allow configuration editing on failed workspaces (@tylerpotts)

Others

• 184fbdc: Apply suggestion from @pavithraes (@khuyentran1401)
• a2a7cf2: Fix installation command syntax in documentation (#321) (@trentoliphant)
• d6248c7: Fix installation commands (#336) (@pavithraes)
• 3de0f23: Merge remote-tracking branch 'origin/main' into fix/shrink-binary (@aktech)
• 6fb45dd: build: strip symbols and trim paths in release binary (@aktech)
• febd991: chore(frontend): remove unused RegistryTags page (@aktech)
• 763900d: ci(docker): fallback REGISTRY/PROJECT for fork PRs (@aktech)
• 9a2b54d: ci(docker): skip push on fork PRs (@aktech)
• 7d04d47: docs(cli-local): simplify bundle and import sections (@khuyentran1401)
• dc56022: docs(example): split registry-add cmd from output (@khuyentran1401)
• c8a6798: docs(examples): extract scripts and update tutorial (@khuyentran1401)
• be39f90: refactor(rbac): replace casbin gorm-adapter with in-tree adapter (@aktech)

Installation

Binary Installation

Download the appropriate binary for your platform from the assets below.

Full Changelog: v0.10.5...v0.11

nebi v0.10.5 (2026-04-25T01:00:32Z)

Welcome to this new release of nebi!

Changelog

New Features

• 236c590: feat(executor): CreateWorkspaceOptions with SeedDir support (@aktech)
• 47395c8: feat(oci): cap bundle size + import timeout to bound DoS surface (@aktech)
• bf7b665: feat(service): ImportFromRegistry extracts full bundle in local mode (@aktech)
• 8e2c5d7: feat(service): expose IsLocal() accessor on WorkspaceService (@aktech)
• 613254d: feat(service): forward ImportStagingDir from CreateRequest to job metadata (@aktech)
• ef61443: feat(service): local-mode publish defaults use bundle content hash (@aktech)
• 91835f9: feat(service): publish full bundle in local mode (@aktech)
• d852bff: feat(worker): seed workspace from import_staging_dir metadata (@aktech)

Bug Fixes

• 8fb790e: fix(rbac): nil-guard data layer for local mode (@aktech)

Others

• 2f89cc9: fix(oci,service): bound layer body, graceful publish-defaults, env hygiene (@aktech)
• 21297ba: refactor(handlers): ImportEnvironment delegates to WorkspaceService (@aktech)
• be8e15b: refactor(oci): lift previewBundleForHash into oci.PreviewAssetRefs (@aktech)
• be5c9c8: refactor(service): unify import via SeedDir, share registry endpoint loader (@aktech)
• 1546d97: test(e2e): bundle import via API round-trips assets in local mode (@aktech)
• 482c829: test(e2e): publish via HTTP API in local mode round-trips assets (@aktech)

Installation

Binary Installation

Download the appropriate binary for your platform from the assets below.

Full Changelog: v0.10.4...v0.10.5

nebi v0.10.4 (2026-04-23T19:00:41Z)

Welcome to this new release of nebi!

Changelog

New Features

• 381150d: feat(cli): add 'nebi registry set-default' command (@aktech)
• 2a06984: feat(cli): auto-default the first local registry (@aktech)
• de34470: feat(contenthash): hash bundle assets for content-addressed tag (@aktech)
• 43d0748: feat(oci): add workspace bundle format with asset layers (@aktech)

Bug Fixes

• d884917: fix(cli): align local registry remove message with e2e test (@aktech)
• 5bca586: fix(deps): pin go-containerregistry to v0.20.7 for Go 1.24 compat (@aktech)
• d269855: fix(oci): close manifest reader after push (@aktech)
• 7e2a621: fix(oci): drop .git as a file at any depth (@aktech)
• 1a6eee4: fix(oci): follow next_page cursor in Quay repo listing (@aktech)
• ad85f5e: fix(oci): pin bundle extract to resolved manifest digest (@aktech)
• 51a06de: fix(oci): reject Windows-invalid segment characters (@aktech)
• 868fb2c: fix(oci): reject case-insensitive core file collisions (@aktech)
• 8150cc1: fix(oci): reject symlinked core files (@aktech)
• f39e03f: fix(oci): reject unknown layer media types (@aktech)
• 76c5c38: fix(oci): round-trip zero-byte asset files without fetching (@aktech)
• e0eb732: fix(oci): surface invalid glob patterns from walker (@aktech)
• cecae94: fix(oci): validate core layer title annotations (@aktech)
• 33e0b69: fix: remove unused useInstallPackages and useRemovePackage hooks (@tylerpotts)

Others

• 090dd53: Add Save & Install to configuration tab, move package management to config-driven workflow (@tylerpotts)
• 184346f: Fix build: adapt SolveWorkspace to service layer pattern (@tylerpotts)
• 9ca3125: Load TOML from server (preserving comments and formatting) and warn (@marcelovilla)
• 57c3ab5: Remove recreate workspace feature (@tylerpotts)
• 888f273: Rename workspace creation button to "Create & Save" (@tylerpotts)
• 9602eca: Resolve merge conflict with main: add rbacProvider to solve route (@tylerpotts)
• de8d32f: Revert "docs(oci): explain d.Type vs d.Info tradeoff in walker" (@aktech)
• 18ff2b6: docs(oci): explain d.Type vs d.Info tradeoff in walker (@aktech)
• 5b1af62: perf(cli): use File.ReadDir(1) for import empty-dir check (@aktech)
• 52479b7: refactor(oci): collapse bundle publish assembly behind deep module (@aktech)
• c558d79: refactor(oci): dedupe auth client, scheme strip, and core-file strip (@aktech)
• 0be6c30: refactor(oci): preserve legacy PublishWorkspace shim for server caller (@aktech)
• 7ef3add: refactor(oci): stream bundle import via oras.Copy + file.Store (@aktech)
• 9042a13: refactor(oci): unexport WithAssets (@aktech)
• b537f3f: test(e2e): reset registryLocal flag between CLI invocations (@aktech)
• 8266ac5: test(oci): add CLI e2e for bundle publish+import with local registry (@aktech)

Installation

Binary Installation

Download the appropriate binary for your platform from the assets below.

Full Changelog: v0.10.3...v0.10.4

nebi v0.10.3 (2026-04-17T21:52:23Z)

Welcome to this new release of nebi!

Changelog

New Features

• 1949aeb: feat(server): add explicit host bind support for nebi serve (@nenb)
• 15681ab: feat: CLI-side workspace versioning for local mode (@Adam-D-Lewis)
• 4ae273f: feat: add nebi workspace version subcommands (@Adam-D-Lewis)
• b7a9ed1: feat: show nebi import command inline with copy button on registry page (@aktech)

Bug Fixes

• 85d5533: fix(docs): swap to vanilla-cookieconsent for React 19 compatibility (@khuyentran1401)
• 6bc6b45: fix(frontend): self-host IBM Plex Sans and Fira Code fonts (@aktech)
• a617af2: fix: place Import button before nebi import copy button on registry page (@aktech)

Others

• 55e02a5: Add GDPR cookie consent banner for Google Analytics (@khuyentran1401)
• e8fc6b8: Add Google Analytics (GA4) tracking to nebi.nebari.dev (@khuyentran1401)
• 5349dc7: Default workspace view to remote when connected (@tylerpotts)
• 19e80a9: Update docs/docs/quick-start.md (@khuyentran1401)
• f32878a: Update docs/docs/quick-start.md (@khuyentran1401)
• 1822f02: lint (@Adam-D-Lewis)
• 6e0c61a: refactor: deepen service layer, eliminate handler-DB bypass (@aktech)
• 2b35c21: refactor: eliminate last DB/RBAC globals, add queue tests (@aktech)
• 19ac0b3: refactor: extract AdminService, RegistryService, JobService from handlers (@aktech)
• 5ea3d93: refactor: injectable RBAC, DB transactions, remove worker DB access, consolidate handlers (@aktech)
• a57a7c4: style: gofmt workspace_version.go var block alignment (@Adam-D-Lewis)

Installation

Binary Installation

Download the appropriate binary for your platform from the assets below.

Full Changelog: v0.10.2...v0.10.3

nebi v0.10.2 (2026-04-08T14:11:48Z)

Welcome to this new release of nebi!

Changelog

New Features

• 380d01e: feat: add LocalPublication model and store methods (@Adam-D-Lewis)
• d256e4f: feat: add LocalRegistry model and store methods (@Adam-D-Lewis)
• cf420bc: feat: add OS keychain credential storage with plaintext fallback (@Adam-D-Lewis)
• e2f09ea: feat: add isLocalMode helper for CLI command mode detection (@Adam-D-Lewis)
• 279c545: feat: add local mode support to registry CLI commands (@Adam-D-Lewis)
• a1fd8de: feat: add local publish support to CLI (@Adam-D-Lewis)
• 582c766: feat: add nebi logout command (@Adam-D-Lewis)
• 546b162: feat: inline tag dropdown with import actions on registry browse page (@aktech)

Bug Fixes

• 82babaf: fix: add logout command to Connection Commands group in CLI help (@Adam-D-Lewis)
• 82faac2: fix: full-width import form, label spacing, and import button tooltip (@aktech)
• c61eeea: fix: prevent repository name overflow in import form grid (@aktech)
• 957149d: fix: remove redundant repository lookup bar from registry browse page (@aktech)

Others

• 41849f9: Add announcement banner (#200) (@pavithraes)
• 357232d: Docs updates for soft-launch (#191) (@pavithraes)
• 99fd536: Update docs/docs/server-setup.md (@khuyentran1401)
• e2c4d37: ci: publish CLI binaries as GitHub artifacts on push and PRs (@aktech)
• 5ae436c: ci: upload each CLI binary as a separate artifact (@aktech)
• 0cddb2a: ci: use commit hash in snapshot version instead of -next (@aktech)
• 312d95a: ci: use goreleaser --snapshot to avoid duplicating build config (@aktech)
• 78d926d: refactor: extract content hash into shared package (@Adam-D-Lewis)

Installation

Binary Installation

Download the appropriate binary for your platform from the assets below.

Full Changelog: v0.10.1...v0.10.2

nebi v0.10.1 (2026-03-29T20:00:35Z)

Welcome to this new release of nebi!

Changelog

New Features

• 8b78cd9: feat: add DeviceFlowClientID to auth config (@aktech)
• 7b675d4: feat: add device config and token exchange CLI client methods (@aktech)
• aba6319: feat: add device flow config and token exchange endpoints (@aktech)
• 9c278ed: feat: register device-config and device-token public endpoints (@aktech)
• b9677e4: feat: rewrite CLI login to use RFC 8628 device authorization grant (@aktech)
• 0f21205: feat: store and display remote workspace ID, improve pull output (@aktech)

Bug Fixes

• 6884df0: fix: add git to nebi image for installing packages from git URLs (@aktech)
• 5c2030b: fix: add viper default for device_flow_client_id so env var is read (@aktech)
• 4a2dca2: fix: address review — add logging, handle empty verification_uri_complete, add HTTP timeout, use errors.New for sentinels (@aktech)
• cbff09c: fix: auto-login when behind Envoy Gateway OIDC proxy (@aktech)
• 980375d: fix: gofmt formatting in login.go (@aktech)
• ed04f75: fix: prevent auto-login redirect loop after logout (@aktech)
• 0fe7578: fix: retry OIDC initialization when provider is unavailable at startup (@aktech)
• 121de8c: fix: use authorization code pattern for OIDC callback too (@aktech)
• 5fb1c94: fix: use authorization code pattern for gateway auto-login (@aktech)
• c8fc229: fix: use json.Marshal in CodeExchange to prevent JSON injection (@aktech)

Installation

Binary Installation

Download the appropriate binary for your platform from the assets below.

Full Changelog: v0.10.0...v0.10.1