# chezmoi changelog

> A dotfile manager that keeps your configuration in sync across every machine, securely.

- Vendor: Tom Payne
- Category: Developer Tools
- Platforms: Desktop
- Official site: https://chezmoi.io
- Tracked by: What's New (https://whatsnew.fyi/product/chezmoi)
- Harvested from: GitHub (twpayne/chezmoi)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## Releases

### v2.72.0

- Date: 2026-08-02
- Version: v2.72.0
- Original notes: https://github.com/twpayne/chezmoi/releases/tag/v2.72.0
- Permalink: https://whatsnew.fyi/product/chezmoi/releases/v2.72.0
- Labels: Platforms: Desktop

- **security** — Fix multiple security vulnerabilities
- **added** — Add shellQuote and shellQuoteList template functions
- **added** — Add gopassCat template function
- **added** — Add debugf template function
- **security** — Tighten permissions on temporary files
- **security** — Ensure HTTP cache directory is private
- **security** — Disallow relative paths with /.. suffix
- **security** — Disallow .. in ignore and remove patterns
- **security** — Disallow .. paths in mackup files
- **security** — Disallow filenames that resolve to .
- **security** — Improve handling of untrusted relative paths
- **security** — Disallow .. paths in .chezmoiroot
- **fixed** — Reject negative format-indent-width template directives
- **security** — Ensure that secret keyring get command always writes a private file
- **security** — Ensure that age-keygen always writes a private file
- **security** — Make persistent state directory private by default
- **security** — Prevent directory escape in tar and rar archives
- **security** — Disallow file and directory names that resolve to ..

##### Changelog
###### Features
* f81cb321789aa3df62871248f5e4d361a59e7cc1 feat: Fix multiple security vulns thanks to secur0.com
* 1e51cc5d88e10ea04d7f74b78380693ce41cbb85 feat: Add shellQuote and shellQuoteList template funcs
* 4249f4f6c24954d3ce8bfd0d76673bb8c55869d3 feat: Add gopassCat template function
* a7d91a55f885d87be7089095c69705e499cd41a4 feat: Add debugf template function
###### Fixes
* 0ad679a834533d3f548c18f62ed7c97dc05a3250 fix: Tighten permissions on temporary files
* 4031be13eebd4a964242fade1b4b23688d6e4589 fix: Ensure HTTP cache dir is private
* ba5a19a2fd28e3a16d9f8d86c6c906acf229dd3e fix: Disallow relative paths with /.. suffix
* 1fe762752a243991df1a749cdf89fa3e4de7df04 fix: Disallow .. in ignore and remove patterns
* 3c9e70b5262856aee320dc68a3035ce2e344d6bf fix: Disallow .. paths in mackup files
* 01b60ddecfd021b83b174dd9ae6d54a9909bc769 fix: Disallow filenames that resolve to .
* 5cdaf4ea3613717756bece1083fde079f4e37978 fix: Improve handling of untrusted relative paths
* e8a57dc1b617068fd54cf4c998ac95bbc9150a70 fix: Disallow .. paths in .chezmoiroot
* 76e2ddf60a7b020fec4f06961ec8401e7a4c6ab9 fix: Reject negative format-indent-width template directives
* 840f68213525cdf7cdaa48a248fe751cb4361a9d fix: Ensure that secret keyring get command always writes a private file
* f7282b8127ad67d17b069ea8b4bfa1f66b8c43ef fix: Ensure that age-keygen always writes a private file
* e7cbe71abd5f51524196a45bb94c1d9b006cf577 fix: Make persistent state directory private by default
* 0d6fc2bf7ca5fd9b24fa93b09874170a0a16572b fix: Prevent directory escape in tar and rar archives
* 239cc6b9eea29698a003bf23eeb0bf112fe93006 fix: Disallow file and dir names that resolve to ..
###### Documentation
* a331111360f57705beb83385f2f5684514682a4c docs: Use more robust quoting functions in examples
* 80441a5fc79775e981f127e4a4c0d5575872eb55 docs: Add link to article
* 6cd634d875a99dd152b1a8fd1ae7fba67f13659f docs: Add link to article

### v2.71.1

- Date: 2026-07-20
- Version: v2.71.1
- Original notes: https://github.com/twpayne/chezmoi/releases/tag/v2.71.1
- Permalink: https://whatsnew.fyi/product/chezmoi/releases/v2.71.1
- Labels: Platforms: Desktop

- **added** — Add --verbose flag to upgrade command
- **added** — Add --skip-secrets flag
- **fixed** — Ensure that external target paths are in target dir

##### Changelog
###### Features
* 8e75b751495194b0e4eb7e5cd65b619a82e1b23a feat: Add --verbose flag to upgrade command
* 8d986d53c884f3da344b3d5ffa66dd0ef0d001c4 feat: Add --skip-secrets flag
###### Fixes
* 942c82cc0e0f0a3ad438b008d45684f3a97d10d4 fix: Ensure that external target paths are in target dir

### v2.71.0

- Date: 2026-07-07
- Version: v2.71.0
- Original notes: https://github.com/twpayne/chezmoi/releases/tag/v2.71.0
- Permalink: https://whatsnew.fyi/product/chezmoi/releases/v2.71.0
- Labels: Platforms: Desktop

- **added** — Enable KeePassXC open mode on Windows
- **added** — Add --error-on-conflict flag
- **changed** — Switch to github.com/bartventer/httpcache for HTTP caching
- **added** — Build Windows MSIX packages
- **added** — Add --revision and --tag flags to init command

##### Changelog
###### Features
* 7974a61848b0a5824c9a8ec549491c1336d6a59c feat: Enable KeePassXC open mode on Windows
* 074c4d94b8b433259631f6ddddf4a4dc485ec4cc feat: Add --error-on-conflict flag
* c63f76347ad216b7decc79e94961a7653bcb100c feat: Switch to github.com/bartventer/httpcache for HTTP caching
* 03438773f296a8d03a5ac98e5db27a5e3e20c4e3 feat: Build Windows MSIX packages
* 47ef7b0d26d77ecfc7cd6b7b6aab005c9208d390 feat: Add --revision and --tag flags to init command
###### Documentation
* 78ab4ca8275cacc60396582ba677bcf27a5f5a1f docs: Add link to article
* 02d905de5b861a1673187141327ba8205e738a69 docs: Add link to video
* b3cc92070e2bbf1f4ee1a62f03898d7fa5d222c2 docs: Add Debian install instructions
* 6687c7a2357419fe9d493f284b8bd1162fd7aa16 docs: Add link to article
* 9066519b90851163656dc7efabe3d246d2d1b5bd docs: Document merge command explainer
* 0ae1bbc7e7e3538d957a5d1255e55c5bd3f82c59 docs: Add link to article

### v2.70.5

- Date: 2026-06-03
- Version: v2.70.5
- Original notes: https://github.com/twpayne/chezmoi/releases/tag/v2.70.5
- Permalink: https://whatsnew.fyi/product/chezmoi/releases/v2.70.5
- Labels: Platforms: Desktop

##### Changelog
###### Documentation
* 1c53abdaf0dac268461585bac3668add0d5a65e2 docs: Add links to articles
* 50af2d32c3eb78c2e306571ad7af1458b2df0301 docs: Add link to article

### v2.70.4

- Date: 2026-05-19
- Version: v2.70.4
- Original notes: https://github.com/twpayne/chezmoi/releases/tag/v2.70.4
- Permalink: https://whatsnew.fyi/product/chezmoi/releases/v2.70.4
- Labels: Platforms: Desktop

- **fixed** — Fix install script for Linux ARM machines
- **fixed** — Run git lfs pull in working copy directory
- **fixed** — Use strings for all paths in template data

##### Changelog
###### Fixes
* 64583685c5eb36e10670bad076d5406a08baf751 fix: Fix install script for Linux ARM machines
* 21e3bf0ed66702840d9a7b9765e579bab16407b3 fix: Run git lfs pull in working copy directory
* 0df44234d03228d8478d938a9b01f4528fe5f76f fix: Use strings for all paths in template data
###### Documentation
* 2e418c0a70362433ca3ab2614cc6c75aee0015d9 docs: Add links to articles
* 7419308415bc884ea3921b50c1fb0be82aaf591c docs: Add link to github.com/djetelina/cheznav
* 9f66c0a47fc2d1703538ede958c35e8a7f1d18da docs: Add links to articles

### v2.70.3

- Date: 2026-05-07
- Version: v2.70.3
- Original notes: https://github.com/twpayne/chezmoi/releases/tag/v2.70.3
- Permalink: https://whatsnew.fyi/product/chezmoi/releases/v2.70.3
- Labels: Platforms: Desktop

- **fixed** — Handle single quoted strings in /etc/os-release

##### Changelog
###### Fixes
* 4fe3c2bd0c415e4c9f0fcea4b518f048201a3721 fix: Handle single quoted strings in /etc/os-release

### v2.70.2

- Date: 2026-04-17
- Version: v2.70.2
- Original notes: https://github.com/twpayne/chezmoi/releases/tag/v2.70.2
- Permalink: https://whatsnew.fyi/product/chezmoi/releases/v2.70.2
- Labels: Platforms: Desktop

- **added** — Add .chezmoi.flags template variable
- **added** — Make stdinIsATTY template func available in all templates
- **changed** — Switch to betterleaks for secret detection
- **fixed** — Re-enable support for TOML 1.1

##### Changelog
###### Features
* 0e3ba0588222996ac707465e5d92f67b0f5a93ed feat: Add .chezmoi.flags template variable
* 0f3969ddda7b60ff06c92d35b19554c44d17dccb feat: Make stdinIsATTY template func available in all templates
* 135c0430dcc0b6f201394932f6f310ea93ba2929 feat: Switch to betterleaks for secret detection
###### Fixes
* 9627c29abbfa318c355a096065350f0a4973ac0c fix: Re-enable support for TOML 1.1
###### Documentation
* b1aacd726df533ffd1f2fec7ded8e2ecfdb26e0e docs: Add links to articles and video
* c4f940fefedb19cabfcd9ad0ec843955e65309fc docs: Always use https to get install script
* c8a0fa4a259069bc65aacc8ee42df9440fbe127a docs: Add link to article
* 7b84c612c6e633cac9ab39dfe9de816641860e42 docs: Improve documentation of secret command

### v2.70.1

- Date: 2026-04-08
- Version: v2.70.1
- Original notes: https://github.com/twpayne/chezmoi/releases/tag/v2.70.1
- Permalink: https://whatsnew.fyi/product/chezmoi/releases/v2.70.1
- Labels: Platforms: Desktop

- **added** — Add .chezmoi.rawHomeDir template variable
- **added** — Add build-info check to doctor command
- **added** — Add globCaseInsensitive template function
- **added** — Detect unknown fields when parsing config files
- **fixed** — Fix Debian ARM package names
- **fixed** — Don't warn on secrets when re-adding encrypted files

##### Changelog
###### Features
* 221fd698c14e10b50d06d192cc02324a274e8a11 feat: Add .chezmoi.rawHomeDir template variable
* 4b909dc1e3394e5f98063068f37764911efd864e feat: Add build-info check to doctor command
* 487db8dece29dda2d1d1252c5c00d0c46f94d796 feat: Add globCaseInsensitive template function
* dd03362165b4bbc6ff61cb89e2a5cb26a0d77647 feat: Detect unknown fields when parsing config files
###### Fixes
* 06ab2d08fa455c7eafcece1559ce0515a0542d9d fix: Fix Debian ARM package names
* f85b2f8398843df81d13546a2c60a86a1760cb6e fix: Don't warn on secrets when re-adding encrypted files
###### Documentation
* 132329211927f0265eb51c0018b2ca306935c043 docs: Add missing protonpass password manager entry
* 2ba550a4eb4245a39458ed0752e473daf0aa1f89 docs: Make the AI/LLM stance even more obvious

### v2.70.0

- Date: 2026-03-09
- Version: v2.70.0
- Original notes: https://github.com/twpayne/chezmoi/releases/tag/v2.70.0
- Permalink: https://whatsnew.fyi/product/chezmoi/releases/v2.70.0
- Labels: Platforms: Desktop

- **added** — Support multiple externals to same target in one .chezmoiexternal file
- **added** — Add podman as an alias for docker command
- **fixed** — Adding exact subdir won't add exact parent

##### Changelog
###### Features
* c8272529f2ed44ee861374f0b4ee6e62d364953e feat: Support multiple externals to same target in one .chezmoiexternal file
* d21012970d3bddc5f498f05193a9fcb007fcf94c feat: Add podman as an alias for docker command
###### Fixes
* 44f73d3dc1678d15343db0c9f56c85065bff1260 fix: Adding exact subdir won't add exact parent
###### Documentation
* 1499bfc5a7e94a0f9c81b65f9e88269faa63f39c docs: Clarify that edit --apply command does not apply scripts
* 883fe1383110c51fd1cfaea30a979fdf4b219c30 docs: Add new articles on using chezmoi with coding agent configuration
* 0bd0e48a4b8c5566c93fd533809bbbf25da3e01b docs: Add am package manager installation instructions
* 7ef5efe5a3a63753ff35d7093b7ef8dbf68064d2 docs: Add link to github.com/daptify14/chezit
* 767015acf6e4813dde9f0cd1b4edad9c0e60da92 docs: Add links to articles
* 8e1b65230c825706052f4bb122a882fe0c712420 docs: Add link to article
* 6f3e1db179b5a7af91bcbe21a78d3065bc8be0e7 docs: Add link to podcast
* 910481edd510a0d6ccea65ecf19df6362cd2b62f docs: Add links to articles

### v2.69.4

- Date: 2026-02-11
- Version: v2.69.4
- Original notes: https://github.com/twpayne/chezmoi/releases/tag/v2.69.4
- Permalink: https://whatsnew.fyi/product/chezmoi/releases/v2.69.4
- Labels: Platforms: Desktop

- **changed** — Prefer PowerShell Core (pwsh) for .ps1 scripts

##### Changelog
###### Features
* 60df04e9d8d38072fdb49c5dd48ab843d5ec58dc feat: Prefer PowerShell Core (pwsh) for .ps1 scripts
###### Documentation
* a85dc2f615ba02c6eb01ce6ce6ffd528a1f85864 docs: Improve Reddit search query for chezmoi
* 74eae4375cafb1eb6156338ede1b3d3b130a5847 docs: Link chattr reference with attributes
* 5d022c4a2cb7f28537524c3e4b2109c02597a4f9 docs: Make no-LLM contribution policy clearer
* 9f3c74f02705f63d2195526496eae9cc480f81a4 docs: Add link to article
* b652f447690ed50e587108f44c008ec81358ede4 docs: Add link to video
* 2d1c6af6cb951dbaf26a57704dcb4a0f45d7f835 docs: Add links to articles
* b0f5578391d8f32bdbacbfff524365c6be1cbc19 docs: Add link to article