All Sonny releases

Sonny 0.4.16

Published . Source commit 8cec1d5b5e25d0c046682e9ad0154c01e08cce41.

Download release JSON for this version's installer URLs, byte sizes and SHA-256 hashes.

Downloads and verification

This is an archived release. Its download links require GitLab project access. File hashes and sizes were checked against the release checksum manifest and package metadata; anonymous availability and signature verification are not claimed.

Choose the artifact for your operating system and architecture. Links marked “GitLab access required” need access to the Sonny release project. Public installers and archives use the same download host as the release notifications.

SHA-256 checksums (GitLab access required) · No checksum signature bundle was attached to this historical release. A matching hash checks file integrity. Verify the signature before relying on publisher identity; this page's metadata importer does not perform that verification.

  • sonny-api_0.4.16_linux_amd64.tar.gz

    archive · linux / amd64 · 11066276 bytes · GitLab access required
    SHA-256: 4584b445ddeccdc5a7daebcc0d243e5ec3151cc93dba86527fba3069879845db

  • sonny-api_0.4.16_linux_arm64.tar.gz

    archive · linux / arm64 · 10070157 bytes · GitLab access required
    SHA-256: 30505be591b5b571b72ef68a472ddd47e399daab8e462862aa1610db32e47199

  • sonny_0.4.16_darwin_amd64.tar.gz

    archive · darwin / amd64 · 19352835 bytes · GitLab access required
    SHA-256: c418cd0fe43b41cc8d04b3f6642c49ad01756ab30ea8f691d59ad91193fdd8dc

  • sonny_0.4.16_darwin_arm64.tar.gz

    archive · darwin / arm64 · 18231730 bytes · GitLab access required
    SHA-256: d21b54675bc3be9a2e6386ff89b0c0c2b1c74d5a41d9cf56d993d0b2ab610189

  • sonny_0.4.16_linux_amd64.apk

    installer · linux / amd64 · 32638762 bytes · GitLab access required
    SHA-256: 5b554f433114cc6820e37c88235e7cacdbba9f95f7b203faad3c0c2e4edef251

  • sonny_0.4.16_linux_amd64.deb

    installer · linux / amd64 · 31330340 bytes · GitLab access required
    SHA-256: 53e149dfddcb703d148770f3e4e3165f10614af9a7d061b9ba7706a7f1ec3a8c

  • sonny_0.4.16_linux_amd64.rpm

    installer · linux / amd64 · 31312698 bytes · GitLab access required
    SHA-256: caf6e0d94857d9292ba039a0695434e257d0c611fea9693538fc7dd7a4efac74

  • sonny_0.4.16_linux_amd64.tar.gz

    archive · linux / amd64 · 20280719 bytes · GitLab access required
    SHA-256: 69e77fc326707bb19906bb27a773ab714bd95cf90f21ac526a6c48947cd9eaea

  • sonny_0.4.16_linux_arm64.apk

    installer · linux / arm64 · 29758236 bytes · GitLab access required
    SHA-256: 2ecc822075e27ce1d1899fd53674000873dc5255ca38d1a6b846e58a93dc124d

  • sonny_0.4.16_linux_arm64.deb

    installer · linux / arm64 · 28717968 bytes · GitLab access required
    SHA-256: 1c8b4a93faea0982b8bc2aaf79d36637bce5ef26fbe140fce6bc1a3081b2b0d5

  • sonny_0.4.16_linux_arm64.rpm

    installer · linux / arm64 · 28624279 bytes · GitLab access required
    SHA-256: 45bf28f73135fbed51a53e4a9702b613c138b811e199b93edb2a37cb504d325d

  • sonny_0.4.16_linux_arm64.tar.gz

    archive · linux / arm64 · 18668585 bytes · GitLab access required
    SHA-256: 1caa71d38ad362281e8bcf19da7783d2f1b0c0e32978bcca90a2029e21f8d88b

  • sonny_0.4.16_windows_amd64.zip

    archive · windows / amd64 · 19305818 bytes · GitLab access required
    SHA-256: ca255e84c4c0b5743399babe1ddf352adaf3a749a8a86855a0a63ab801862c8f

  • sonny_0.4.16_windows_arm64.zip

    archive · windows / arm64 · 17406937 bytes · GitLab access required
    SHA-256: 0def42578a5f0587d611605e5280d788e1bca3a324f9b536f60d0c49d384887f

  • checksums.txt

    checksums · 1362 bytes · GitLab access required
    SHA-256: 7f12a21690ca8cb2d14fc60ee3bbc2eeada16b1a7e8417ea46d28277679c9464

Release notes

Changelog

Bug Fixes

  • 13919e5757b92b3b5ff351a7e31d7b36d66e9b4b fix(mesh): clamp ListSessions pagination (H1 DoS) + serialize StreamSession sends (H2 race)
  • 5e2eb663c03fabe779a4d8805a18a0ec872d2551 fix(mesh,release): session-service races/leaks (M2,M3) + ship sonny-api with -tags prod (appsec F1)
  • def5bc0a2554561d759bbedc911821427d674feb fix(mesh,spawn): populate transfer proxy address (M4) + close spawn-cap TOCTOU (M5)
  • 53b6ae66087adb1f0c630020f958ce5fe8274040 fix(privsep): CLOEXEC parent socket, allowlist child env, reject uid/gid 0 (SON-04/05/06)
  • 8cec1d5b5e25d0c046682e9ad0154c01e08cce41 fix(release): inject version into buildinfo, not the no-op main.version (TUI showed ‘dev’)
  • 1a84190737bd0de18fb5cf6a555c40f7bc9267c5 fix(sec): apply the resolved mesh-cwd path to close a symlink-swap TOCTOU
  • 710cd4631536ecbc32098f905ed4c9923b9cc755 fix(sec): close appsec F1 pack-hook RCE + rate-limiter DoS (review iteration 1)
  • 7ed82b5190399bd6d9e9266cadcaafcf17d61940 fix(sec): confine remote mesh cwd changes to allowlisted roots (SON-02 cwd)
  • 75a76407aba9f68914ffb640510999e88dc12255 fix(sec): strip credential-redirect/loader env from untrusted pack spawns (appsec F2)
  • 1ddde6e48b8d90f11190c8efb9e6877841e82580 fix(spawn): tear down the foreground stdin reader deterministically (M6)
  • 6936a77401af42f29614f08d84368d0abb875098 fix(tui): /goal opens a text-input dialog to enter the objective
  • 8a7695db552f5b75a8274d797d97968747e54d87 fix: close confirmed correctness/hardening findings (review iteration 1, batch 2)

Others

  • 9e55d096e61fd5e3e7e1e6a9fd2c1cc5f5024846 chore(deps): bump devnw.dev/synapse v0.2.0 -> v0.2.1 (latest)
  • c9ba9c8b40e8ebbeedb57a1747bc15d475d256ff docs(security): record 2026-07-03 appsec+audit campaign findings and disposition