v0.39.0

Granted v0.39.0 is the first release published under the fwdcloudsec organization. This release includes new features, bug fixes, and updates to the release infrastructure.

Release Infrastructure Changes

Starting with v0.39.0, Granted releases are published to new infrastructure under the granted.dev domain:

• Binary downloads are now hosted at releases.granted.dev
• Linux APT repository has moved to apt.releases.granted.dev — see the installation docs for updated setup instructions
• Homebrew (brew install fwdcloudsec/granted/granted) now builds from source via the fwdcloudsec/homebrew-granted tap. Prebuilt macOS binaries are not currently available — if you need them, please open a discussion
• GPG signing key has been updated (fwdcloudsec/granted-docs#4). The APT repository signing key has been updated too — see the installation docs for the new key

Previous releases remain available at releases.commonfate.io.

Features

• OAuth Authorization Code + PKCE flow for SSO login — adds a more secure SSO authentication method (#923) by @dgilmanuni
• Hierarchical RoleSessionName resolution — role session names are now resolved hierarchically when assuming roles (#884) by @FredPerr
• GRANTED_BROWSER_PROFILE env var — override the browser profile used for console sessions via an environment variable (#914) by @billyjbryant
• Zen browser support — native support for the Zen browser (#930) by @meyerjrr

Bug Fixes

• Fix --mfa-token flag being ignored in credential process mode (#908) by @dafujii
• Fix AWS profile being set incorrectly when role chaining (#841) by @raine-tingley
• Fix Nix install path detection for fish and tcsh shell aliases (#921) by @pyrex41
• Fix SSO browser stdout noise (#916) by @benjamin-pilgrim
• Fix TooManyRequests exception handling (#912) by @silvaalbert
• Fix AWS config directory permissions (#843) by @jescarri
• Fix ExportCredentialSuffix nil handling (#915) by @supergibbs
• Fix help message for browser set command (#909) by @LZong-tw
• Fix --ref flag when adding git profile registries (#864) by @chrnorm

Console Service Map

Added support for: AWS Control Tower, CloudFront, ElastiCache, SQS, Cognito, and Global Accelerator (#871, #877, #893)

Housekeeping

• Upgraded to Go 1.25 and renamed module to github.com/fwdcloudsec/granted (#913)
• Removed legacy Common Fate integrations and plugins (#855, #861)
• Cleaned up registry package (#805) by @EloyTolosaDev
• Dependency updates (#922) by @ericofusco

New Contributors

• @jescarri, @raine-tingley, @EloyTolosaDev, @FredPerr, @mikegray, @LZong-tw, @dafujii, @supergibbs, @ericofusco, @pyrex41, @benjamin-pilgrim, @silvaalbert, @billyjbryant, @dgilmanuni

Thank you to everyone who contributed to this release!

Full Changelog: v0.38.0...v0.39.0