# gstack 1.67.1.0

- Product: gstack (https://whatsnew.fyi/product/gstack)
- Vendor: gstack
- Date: 2026-08-16
- Version: 1.67.1.0
- Original notes: https://raw.githubusercontent.com/garrytan/gstack/main/CHANGELOG.md
- Permalink: https://whatsnew.fyi/product/gstack/releases/1.67.1.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Pre-push secret scanner now catches all-caps database passwords
- **security** — Persisted browser sessions are kept out of git regardless of repository .gitignore configuration
- **security** — App Store Connect key minted during release is scoped to the target app instead of all team apps, with revocation path disclosed in exit report
- **security** — iOS test bridge's Release compile-out is pinned by a free-tier tripwire that fails CI on regression to platform-only gate
- **security** — Browser server's Node spawn shim restores exited promise, eager stdout/stderr drain, and 16MB output cap
- **security** — Bearer-token comparison is constant-time
- **fixed** — Browse state directory carries self-contained .gitignore to prevent session state and request logs from being committed
- **fixed** — Node Bun.spawn polyfill regains exited promise, eager stdout/stderr drain, and output cap on Windows Node fallback

We read every line of external-contributor code from the last two months.
Six findings hardened, two refuted, zero backdoors.
gstack ran an explicit security sweep over all external-contributor code merged since mid-June: the seven directly-merged `time-attack` PRs, the two fork-port squash waves, and the roughly fifty absorbed community PRs.
About 38,000 lines across ~500 files, read with an adversarial eye.
The verdict up front: no backdoor, no exfiltration path, no live secret leak.
The contributions are net security-strengthening.
This release hardens the six real findings the sweep confirmed and locks each one behind a regression test, so the property it protects holds by construction, not by luck.
The pre-push secret scanner now catches all-caps database passwords.
Persisted browser sessions stay out of git whether or not your repo has a `.gitignore`.
The App Store Connect key the release flow mints is scoped to the one app you are shipping, and the exit report tells you it exists and how to revoke it.
The iOS test bridge's Release compile-out (shipped in v1.67.0.0) is now pinned by a free-tier tripwire that fails CI on any regression to a platform-only gate.
The browser server's Node spawn shim has its `exited`/drain/memory-cap contract back.
Bearer-token comparison is constant-time.
The pre-push credential scanner blocks a DSN whose password is a real all-caps secret (`PROD2026SECRET`-style) at the HIGH tier. The `USER:PASSWORD` documentation convention still suppresses, pinned in both directions with a table-driven test over the full placeholder set. (`lib/redact-patterns.ts`)
The browse state directory (`.gstack/`) carries a self-contained `.gitignore` written unconditionally when the directory is created, so persisted `session-state.json` cookies and `browse-network.log` / `browse-audit.jsonl` request headers can never be committed, regardless of the project's own `.gitignore`. (`browse/src/config.ts`)
The Node `Bun.spawn` polyfill regains its `exited` promise, eager stdout/stderr drain, and 16MB output cap, restoring correct child-process handling on the Windows Node fallback (cookie import, browser-skill children). (`browse/src/bun-polyfill.cjs`)
The iOS QA touch bridge's Release compile-out (the `#if !defined(DEBUG)` short-circuit plus the `cSettings` DEBUG define, shipped in v1.67.0.0) is pinned by a free-tier static tripwire: any regression to a platform-only gate, a reordered guard, or a dropped define fails CI on every PR. (`test/ios-debug-bridge-release-guard.test.ts`)
Loopback bearer-token comparison in the browse server is constant-time. (`browse/src/server.ts`)
The App Store Connect upload key minted during an Apple release is scoped to the target app (`allAppsVisible:false` with an explicit `apps` relationship) instead of every app on the team, and the release exit report discloses the key and its revocation path. (`ship/sections/apple-release.md`)
`gstack-egress verify` documents that ledger truncation and deletion are out of scope for the forensic-observability threat model. (`bin/gstack-egress`)