# Changelog

All notable changes to Cinc Workstation will be documented in this file.
Versions follow Semantic Versioning.

Historical entries from before the Cinc changelog reset are archived in CHANGELOG.pre-cinc-workstation.md.

## [26.2.3] - 2026-09-01

### Highlights

- **`chef*` and `inspec` work on Windows again** ([#30](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/issues/30)). RubyGems cannot create symlinks on Windows, so the redirect binstubs shipped by chef-cli and chef-bin were extracted as text files containing the link target, and every wrapper — `chef`, `chef-cli`, `chef-run`, `chef-analyze`, `chef-client`, `chef-solo`, `chef-shell`, `chef-apply`, `inspec` — died with a `SyntaxError`. The build now copies the wrapper over each stub. This shipped unnoticed because `test:windows-2016` passed with 5 InSpec FAILs recorded; the job now checks `$LASTEXITCODE`.
- **Bundled InSpec resource packs autoload again.** 26.1.0 through 26.2.2 shipped an unpatched `inspec-core` — the fixed gem was rejected on republish because its version had not changed — so profiles using `docker`, `podman` and other bundled resources failed with a fatal deprecation. `inspec-bin` is now source-pinned to rubygems.cinc.sh alongside `inspec`/`inspec-core`, and a smoke-test control guards against a repeat.
- **Cookstyle 8.7.6 → 9.0.0** brings RuboCop 1.90.0, 11 new `Chef/*` cops and 2 newly enabled RuboCop cops. Nothing was removed or renamed, but expect new offenses on cookbooks that were clean under 8.x.
- **Test Kitchen driver majors:** `kitchen-azurerm` 1.13.6 → 2.3.0, `kitchen-google` 2.7.0 → 3.0.2, `kitchen-openstack` 7.0.1 → 8.0.0, `kitchen-hyperv` 0.10.3 → 0.12.0. Review your driver options in `kitchen.yml`.

### Security

- **OpenSSL 3.6.3 → 3.6.4** clears 11 CVEs, most severe Moderate ([release notes](https://openssl-library.org/news/openssl-3.6-notes/)). Reachable from what Workstation ships: **CVE-2026-75803** (AEAD forgeries with empty ciphertext), **CVE-2026-54876** (OCSP response-checking memory leak) and **CVE-2026-63072** (CMS key-unwrap heap overflow). The QUIC, DTLS and CMP fixes cover unused code paths.
- **expat 2.8.2 → 2.8.3** clears **CVE-2026-72522** (denial of service via UTF-16 decoding). The shipped build was never exposed — the flaw needs 16-bit character support, which omnibus-software does not enable — but scanners flag it by version.
- Still waived: **GHSA-98m9-hrrm-r99r** in `faraday` 1.10.6, held at 1.x by inspec's `faraday_middleware` and knife-azure's `ms_rest_azure` chain.

### Bug Fixes

- Materialize gem binstub symlinks as file copies ([`d355e51`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/d355e511c203fafc38b3d1c3b646ceaa450f3df7))
- Source inspec-bin from rubygems.cinc.sh ([`05086d9`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/05086d94318976d130fc42ecd08a88fefd19ebb4))

### Continuous Integration

- Fail the Windows smoke-test job when the InSpec suite fails ([`742a9c6`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/742a9c6954b74e07002469ab96775c1ce261ae13))

### Maintenance

- Update omnibus-software to 26.8.37 ([`2742491`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/2742491ca066f7514781f598df462acdf66d279c))
- Update gem lockfile (2026-08-31) ([`73cddf3`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/73cddf360b89be355f9a7fdfe798b34df7d3d8f3))

### Style

- Appease cookstyle 9 Layout/ExtraSpacing ([`ff6735e`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/ff6735e28773ce224f62d3ad14cd172312c1e9bb))

### Tests

- Assert bundled InSpec resource packs autoload ([`1b3aa8d`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/1b3aa8db8ef646af8006a791aeebbb81a7e5a02a))

### Software updates

Bundled software changes from omnibus-software 26.8.11 → 26.8.37:

- **cacerts** 2026-07-16 → 2026-08-13
- **expat** 2.8.2 → 2.8.3
- **go** 1.26.5 → 1.27.0
- **openssl** 3.6.3 → 3.6.4

### Gem updates

Cinc Workstation bundled gems (components/gems/Gemfile.lock):

- **cookstyle** 8.7.6 → 9.0.0
- **git** 5.0.5 → 5.2.0
- **kitchen-azurerm** 1.13.6 → 2.3.0
- **kitchen-dokken** 2.23.3 → 2.24.0
- **kitchen-ec2** 3.22.3 → 3.22.10
- **kitchen-google** 2.7.0 → 3.0.2
- **kitchen-hyperv** 0.10.3 → 0.12.0
- **kitchen-openstack** 7.0.1 → 8.0.0
- **kitchen-vagrant** 2.2.1 → 2.4.1
- **kitchen-vra** 3.3.3 → 3.4.0
- **knife-google** 5.0.15 → 5.0.17
- **knife-vcenter** 5.0.5 → 5.1.1
- **taste_tester** 410bf7d → 7253f88
- **test-kitchen** 4.1.1 → 4.1.3

Removed with the kitchen-azurerm 2.x legacy Azure SDK drop: **azure_mgmt_network2**, **azure_mgmt_resources2**, **ms_rest2**, **ms_rest_azure2**, **faraday-cookie_jar2**.

## [26.2.2] - 2026-08-10

### Highlights

- **Maintenance release.** A routine dependency refresh plus the packaging fixes it turned out to need. There are no user-facing feature changes, but the dependency movement closed two CVE findings — see Security below.
- **Non-code files no longer ship inside bundled gems.** `.claude` and `.github` directories are now pruned from the installed gem tree, along with the default-gem stubs rubygems leaves behind when a bundle upgrades one of Ruby's own gems. This shrinks the package and keeps CI workflow files, their pinned GitHub Actions, and superseded gemspecs out of what the CVE scanners read.

### Security

- **CVE-2026-54171** ([GHSA-48rx-c7pg-q66r](https://github.com/advisories/GHSA-48rx-c7pg-q66r)) in the bundled `excon` gem is fixed by **excon 0.112.0 → 1.7.0**. This was recorded as still open in 26.2.1, where excon was held at 0.x by a transitive `~> 0.71` constraint. That constraint has now lifted from both directions: `k8s-ruby` 0.18.0 requires `excon (~> 1.5)`, and `fog-core` 2.6.0 relaxed its own bound to `~> 1.0`.
- **[GO-2026-5970](https://pkg.go.dev/vuln/GO-2026-5970)** (high) in `golang.org/x/text`, embedded in the shipped `cinc-analyze` binary, is fixed by **0.34.0 → 0.39.0**. `cinc-analyze` is built from the Cinc [chef-analyze fork](https://gitlab.com/cinc-project/upstream/chef-analyze), which now carries the fixed release.
- Default-gem stubs superseded by newer installed gems are now pruned ([`6343058`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/6343058aa4a2fa09ae20ab0d72bd00201a2d4cc5)). When a bundle upgrades one of Ruby's bundled gems, the stub gemspec stays behind in `specifications/default/` and the scanners read it as an installed package — `json` 2.9.1 was being reported even though `json` 2.21.2 is what ships and activates. Stubs are removed only when a strictly newer regular install of the same gem exists.

### Bug Fixes

- Prune .claude and .github from installed gems ([`7c7d7f5`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/7c7d7f58c4e86688f6053023db1e45a6a94f24e1))
- Ship libcap so cap2 builds on Linux ([`6a887dc`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/6a887dc7ebd60ccc3891d9d11511a2aedebc171c))
- Render full commit URLs in generated entries ([`eeb3c19`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/eeb3c19544ec8baf17b84e55ef9a8009629b7d10))

### Maintenance

- Weekly dependency updates (2026-08-09) ([`d4b0e3d`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/d4b0e3d7e160b1da8a2f09f0f4c6bf41ee292837))

### Software updates

Bundled software changes from omnibus-software 26.7.32 → 26.8.11:

- **Added:** `libcap` 2.78
- **libarchive** 3.8.8 → 3.8.9
- **libffi** 3.7.1 → 3.8.0
- **libnghttp2** 1.69.0 → 1.70.0
- **stunnel** 5.79 → 5.80

### Gem updates

Cinc Workstation bundled gems (components/gems/Gemfile.lock):

- **acme-client** 2.0.32 → 2.0.34
- **Added:** `cap2` 0.2.2 — a native extension pulled in by net-ping on Linux
- **excon** 0.112.0 → 1.7.0 — major version bump, see Security
- **fog-core** 2.5.0 → 2.6.0
- **git** 4.4.0 → 5.0.5 — major version bump
- **k8s-ruby** 0.17.2 → 0.18.0
- **kitchen-dokken** 2.23.1 → 2.23.3
- **mdl** 0.17.0 → 0.18.1
- **mixlib-install** 4.0.1 → 4.1.0
- **net-imap** 0.6.4.1 → 0.6.6
- **net-ping** 2.0.8 → 2.1.0 — now resolves to platform-specific variants, which is what introduced the `cap2` dependency on Linux and the win32 dependencies on Windows
- **test-kitchen** 4.1.0 → 4.1.1
- **toml-rb** 4.2.0 → 4.2.1
- **Added:** `win32-security` 0.5.0 and `win32ole` 1.9.3 — pulled in by net-ping on Windows

The `aws-sdk-*` gems and `aws-partitions` moved forward by their usual routine point releases and are not listed individually.

## [26.2.1] - 2026-07-17

### Highlights

- **mixlib-install now ships from the Cinc Project's own fork** ([cinc-project/distribution/mixlib-install](https://gitlab.com/cinc-project/distribution/mixlib-install)): the bundled mixlib-install (3.16.1 → 4.0.1 from rubygems.cinc.sh) is now built from the dedicated Cinc fork instead of the chef repo; the line resets to 4.0.0 to mark the fork. mixlib-install generates the `install.sh` / `install.ps1` bootstrap scripts and resolves package URLs, so these changes reach anyone installing or upgrading Cinc:
  - **Cinc-only and fully de-branded** — both install scripts and URL resolution target only Cinc products on `packages.cinc.sh` / `omnitruck.cinc.sh`, down to the Windows installer internals.
  - **Removed the Chef commercial / trial / licensed-API and chef-ice paths** — no `license_id`, `CHEF_LICENSE_KEY`, or commercial-endpoint logic remains.
  - **Fix:** the generated `install.sh` now runs `curl --fail`, so a 4xx/5xx server error aborts cleanly instead of saving the error page as the package.
  - **Fix:** a failed `install.sh` now prints the correct Cinc issue-tracker URL.

### Security

Fixes the two Go stdlib advisories flagged by the scheduled CVE scan against the 26.2.0 packages, via the embedded Go toolchain update **1.26.4 → 1.26.5** (all shipped Go binaries are rebuilt with the fixed stdlib):

- **CVE-2026-39822** (high, [GO-2026-4970](https://pkg.go.dev/vuln/GO-2026-4970)) — `os`: root escape via a symlink plus trailing slash when opening paths under `os.Root`.
- **CVE-2026-42505** (medium, [GO-2026-5856](https://pkg.go.dev/vuln/GO-2026-5856)) — `crypto/tls`: Encrypted Client Hello handshakes could be de-anonymized by a passive network observer due to disclosure of pre-shared key identities in the unencrypted client hello.

Still open from the 26.2.0 scan: GHSA-48rx-c7pg-q66r (medium) in the bundled `excon` 0.112.0 gem — the fix requires excon ≥ 1.5.0, but faraday 1.x (held by the Azure toolchain: inspec's faraday_middleware and knife-azure's ms_rest_azure) constrains excon to `~> 0.71` via faraday-excon.

### Bug Fixes

- Make the weekly-updates schedule use the project rake task ([`2f197ad`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/2f197ad6a4a71f879591239859710626f15cf52e))

### Features

- Refresh Go modules in the weekly-updates job ([`1e98dd5`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/1e98dd50c195992f18c40dfaba265590c0ff119a))

### Maintenance

- Update Go modules ([`013c7f2`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/013c7f208f49f68fec030477dbae21f3f25a4b8a))
- Update omnibus-software to 26.7.32 ([`f4aa9c8`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/f4aa9c8f7b47a25fe8994b0aee4c6f1a46860d96))
- Update gem lockfile (2026-07-17) ([`9ad19d6`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/9ad19d6242358209f04cf76016cebaff2bfd09e7))

### Software updates

Bundled software changes from omnibus-software 26.7.11 → 26.7.32:

- **cacerts** 2026-05-14 → 2026-07-16
- **gecode** 6.2.0 → 6.4.0
- **go** 1.26.4 → 1.26.5
- **libffi** 3.6.0 → 3.7.1

### Gem updates

Cinc Workstation bundled gems (components/gems/Gemfile.lock):

- **git** 4.3.2 → 4.4.0
- **knife** 19.3.0 → 19.3.1
- **mixlib-install** 3.16.1 → 4.0.1
- **test-kitchen** 4.0.0 → 4.1.0

## [26.2.0] - 2026-07-07

### Highlights

- **knife now ships from the Cinc Project's own fork** ([cinc-project/distribution/knife](https://gitlab.com/cinc-project/distribution/knife)): the bundled knife (19.2.12 → 19.3.0 from rubygems.cinc.sh) is now built from the dedicated Cinc fork with its own changelog, CI, and release cadence, instead of a branch of the chef repo. The fork completes the Chef → Cinc de-branding — user-facing output and runtime paths (`/etc/cinc`, `~/.cinc`, `knife config use` context) are fully Cinc, and `knife bootstrap` installs cinc-client from omnitruck.cinc.sh — and removes the Chef-ICE / commercial-licensing logic from `knife bootstrap` (no `CHEF_LICENSE_KEY`, `--chef-license-key`, or EULA acceptance). Also fixes nested plugin base classes appearing as runnable subcommands in `knife` / `knife help`, and adds broader unit plus end-to-end bootstrap test coverage.

### Security

- Remediate CVE findings (deps, purge, waivers) ([`c578edb`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/c578edb6a10bc31aefb2fb7a1f541c69bfc1e826))
- CVE scanning via the ci-tools security-scan component ([`a9f5e95`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/a9f5e9560e57616a44d9e3672227b79ddf3cedee))

### Bug Fixes

- Ship mixlib-versioning in the arm64 embedded gems ([`ac131c3`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/ac131c3eb6e324811aad31245337533da37b35b6))
- Heal rb-fsevent when gems rebuilds on a git-cached tree ([`0d53fc5`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/0d53fc54721f98c27a911d4b14dc6b8d2b83def3))
- Scope cleanup to cinc-workstation install dir ([`2c1d9d1`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/2c1d9d16f72c0001d94fcb89b7ae286d9dccbc2f))
- Select deb by TARGETARCH for multi-arch build ([`34807cd`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/34807cde0208e1b79d9e151911f9376c75f4597b))

### Features

- Local security-scan wrapper delegating to ci-tools ([`1c2b2fa`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/1c2b2fa5f924ecd7e6318cdf7ba5b39da04f84ba))

### Maintenance

- Bump Ruby to 3.4.10 (openssl gem 3.3.3) ([`9a7dcfa`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/9a7dcfab7f2c90b1e622cc2c37556b544f0c22c1))
- Route security fixes into a dedicated Security section ([`acfc801`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/acfc801656f4af7350929458102618f88d19b247))

### Software updates

Bundled software changes from omnibus-software 26.5.40 → 26.7.11:

- **Added:** `openssl-fips-provider` 3.0.9
- **cinc-analyze** 0.1.194 → stable/cinc
- **curl** 8.20.0 → 8.21.0
- **expat** 2.8.1 → 2.8.2
- **git-custom-bindir** 2.54.0 → 2.55.0
- **git-windows** 2.54.0 → 2.55.0
- **go** 1.26.3 → 1.26.4
- **libarchive** 3.8.7 → 3.8.8
- **libffi** 3.5.2 → 3.6.0
- **openssl** 3.6.2 → 3.6.3
- **ruby** 3.4.9 → 3.4.10
- **ruby-msys2-devkit** 3.4.9-1 → 3.4.10-1
- **stunnel** 5.78 → 5.79
- Declare a security_scan_cpe for every release-pinned software definition ([omnibus-software@32008f27](https://gitlab.com/cinc-project/distribution/omnibus-software/-/commit/32008f276e10f88ecbfdfe3707ce8381cbaf70cd))
- fix(libnghttp2): Correct openSUSE 15.6 version constraint syntax ([omnibus-software@612aed40](https://gitlab.com/cinc-project/distribution/omnibus-software/-/commit/612aed403ea823e65b1631203d2c5d59b4bb535e))
- fix(libnghttp2): Disable dep tracking on openSUSE Leap 15.6 ([omnibus-software@5405d03e](https://gitlab.com/cinc-project/distribution/omnibus-software/-/commit/5405d03e7a04046a1f1a3805bfc01b29e4d48476))
- Point config_guess at GitLab mirror ([omnibus-software@5a8f4039](https://gitlab.com/cinc-project/distribution/omnibus-software/-/commit/5a8f4039eecc6be7feb94d3c35eef74568b49cc2))

### Gem updates

Cinc Workstation bundled gems (components/gems/Gemfile.lock):

- **Added:** `mixlib-versioning` 1.2.12
- **acme-client** 2.0.31 → 2.0.32
- **bcrypt_pbkdf** 1.1.2 → 1.2.0.beta1
- **berkshelf** 8.1.21 → 8.1.23
- **chef-cli** 6.1.30 → 6.1.34
- **chef-zero** 15.1.0 → 15.1.11
- **cookstyle** 8.6.10 → 8.7.6
- **fauxhai-chef** 9.4.20 → 9.4.22
- **kitchen-google** 2.6.2 → 2.7.0
- **knife** 19.2.12 → 19.3.0
- **mdl** 0.15.0 → 0.17.0
- **minitest** 6.0.6 → 5.27.0
- **net-imap** 0.6.4 → 0.6.4.1
- **net-ssh** 7.3.2 → 7.3.3
- **nokogiri** 1.19.3 → 1.19.4
- **ohai** 19.1.24 → 19.1.40
- **openssl** 3.3.1 → 3.3.3

## [26.1.0] - 2026-05-27

### Breaking Changes

- **Windows MSI UpgradeCode changed** ([`cf71fe5`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/cf71fe5c3c52287f96c169f93f624aac93d1d1a4), #18): GUID changed from `9870C512-DF2C-43D9-8C28-7ACD60ABBE27` to `E02B87D0-EC9F-4D36-99DE-711B1C6747B1`, so winget no longer treats cinc-workstation as `ChefSoftware.Workstation`. One-time impact: 26.1.0+ is not detected as an in-place upgrade over a pre-26.1.0 install — uninstall the old MSI first. Later upgrades work normally.
- **User gem install path changed** ([`de2e7de`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/de2e7de8aabd7c2bb2cdc1c47d09cca5c19e7ef3), #24): `cinc gem install` now installs to `~/.cinc/gem/<engine>/<version>/` (Linux/macOS) and `%LOCALAPPDATA%\cinc-workstation\gem\<engine>\<version>\` (Windows), replacing the old `~/.chef` / `%LOCALAPPDATA%\chef` paths. Old gems are not migrated — reinstall after upgrading. Also fixes the Windows DevKit `pre_install` hook pointing at the defunct `C:\opscode\chef-workstation`, so native gem builds now get the right `PATH`/`RI_DEVKIT`/`CC`.

### Bug Fixes

- `knife config use <profile>` now writes the active context to `~/.cinc/context` instead of `~/.chef/context`, so profile selection actually takes effect (#13). Fixed in the chef repo, delivered via the republished knife gem (chef 19.3.14).
- Docker and Podman InSpec resources now resolve out of the box — both bare (`docker`, `podman`) and prefixed (`docker_container`, `podman_container`, ...) — in profiles and `kitchen-inspec` runs, with no `gem_dependencies`, `inspec plugin install`, or scan-time network access. InSpec 7 split these into the `inspec-docker-resources`/`inspec-podman-resources` gems (bundled since 26.0.2); the enabling fix to load already-installed resource packs lives in the inspec fork and ships via the republished `inspec-core` 7.0.107 gem.
- Preserve bundler git checkouts so license_scout runs ([`d478db5`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/d478db52198a32242a787cbbabac32b0dca36c00), #9): packages now ship the complete `/opt/cinc-workstation/LICENSES/` manifest instead of only ~21 system-library entries.
- Drop stale cinc-run reference from welcome screen ([`31db593`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/31db593c1511d1ccd1a6a8c45df184a75c7ce3ea), #20)
- Skip bio in smoke tests on aarch64 Linux ([`25807c9`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/25807c94efaf1005677b86e63ab4a8342daf5672))
- Skip biome on aarch64 Linux ([`1c4db9b`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/1c4db9b0d11b7438a5df9ba84c043287d1a2b64d))

### Continuous Integration

- Add optional MR jobs for latest AlmaLinux, latest Ubuntu, and aarch64 ([`f42658a`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/f42658af1df29904cda33e33266ccbe716cd3046))

### Features

- Add aarch64 builds for CentOS, Debian, and RockyLinux ([`d233c50`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/d233c50f72ff46a421d4c69e36194f7899b04dc0), #19, #25)
- Add aarch64 builds for Ubuntu 22.04 and 24.04 ([`fca43ed`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/fca43edab72b125cf7cf74039d326d5014ac886b), #19, #25)

### Maintenance

- Refresh Gemfile.locks and go.sum ([`357637c`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/357637c208cc5f98a9a99edef201d11fcee97539))
- Add tasks to manage Go module updates ([`2060a3c`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/2060a3cf3d729b071bf650b3a384e0b9ee77bf9f))
- Remove dead chocolatey packaging files ([`e88a447`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/e88a4479766439738c8e97e4e875dc1612d52f05), #16)

### Software updates

Bundled software changes from omnibus-software 26.5.21 → 26.5.40:

- **cacerts** 2025-12-02 → 2026-05-14
- **git-windows** 2.53.0 → 2.54.0
- **go** 1.26.2 → 1.26.3
- Skip ruby-fast-load_31.patch on Ruby 4.0 ([omnibus-software@0e348886](https://gitlab.com/cinc-project/distribution/omnibus-software/-/commit/0e3488862e21e68b4a573fd7c659e49dbc7d97c1))
- Fix silent failures in version checker and standardize metadata ([omnibus-software@175776e8](https://gitlab.com/cinc-project/distribution/omnibus-software/-/commit/175776e8cfbffea716697f80b2e9266032e73213))

### Gem updates

Cinc Workstation bundled gems (components/gems/Gemfile.lock):

- **chef** 19.2.12 → 19.3.14
- **chef-bin** 19.2.12 → 19.3.14
- **chef-utils** 19.2.12 → 19.3.14
- **kitchen-dokken** 2.23.0 → 2.23.1

## [26.0.2] - 2026-05-20

### Bug Fixes

- Declare Windows-only mixlib-shellout requires as top-level deps ([`d503182`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/d503182579146509467c9ac58da9808f7dc39c27))
- Run bundle install serially on Windows ([`b5a0bb2`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/b5a0bb2782c4888f40676c1f84ebb8d86d4e0c83))
- Work around Psych load race in Bundler parallel installer ([`8815e51`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/8815e51f2242918925aa439062005b6f71aa0ed1))
- Pin ffi-yajl >= 2.7.11 to drop bogus yajl-logger dep ([`8a83a2d`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/8a83a2d40a0daebc30b142ee67a7ba601e463c9f))
- Drop chef-run from postinst wrapper symlinks ([`3f1be98`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/3f1be98b7e3174b678dbcb0a9ec4ecea86031e38))
- Build Docker image from local Ubuntu 22.04 artifact ([`6308b4f`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/6308b4f556c7dd21ebfcb1f1fe39b26129a5fe77))

### Continuous Integration

- Adopt cinc-project/ci-tools changelog-flow components ([`26fb311`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/26fb3118b1b1d2ed116fdcc826929cb4172916a7))

### Features

- Add toml-rb and InSpec docker/podman resource packs ([`0acc967`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/0acc96726f6b0eb52aa4bc8948fb773e6e53dcce))
- Add git gem useful in some unit testing ([`c4611dc`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/c4611dc2d514a30f01364dfab423c816df680422))

### Maintenance

- Refresh Gemfile.locks via rake update ([`f5d7565`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/f5d7565c6b39cd2f6953cf63511661b7dbab6d79))
- Source omnibus gem from rubygems.cinc.sh ([`85539c0`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/85539c06b94d7dfddfe93655552075acb5a29fa8))
- Refresh both Gemfile.locks in the update task ([`0be1708`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/0be1708c3ea33a611208799a80d7cd4db2f8ab62))

### Software updates

Bundled software changes from omnibus-software 26.4.449 → 26.5.21:

- **cinc-analyze** 0.1.192 → 0.1.194
- **curl** 8.19.0 → 8.20.0
- **expat** 2.8.0 → 2.8.1
- **libedit** 20251016-3.1 → 20260512-3.1
- ncurses: support building under mingw on Windows ([omnibus-software@9c514f42](https://gitlab.com/cinc-project/distribution/omnibus-software/-/commit/9c514f4213cc72f4b64cec7575c285de738bd31a))
- bash, ncurses: use omnibus configure DSL helper ([omnibus-software@5d0d513b](https://gitlab.com/cinc-project/distribution/omnibus-software/-/commit/5d0d513b124024043c869a0f4623181d66ce5b27))
- Add Ruby 3.1.7-1 devkit for cinc-client 18 ([omnibus-software@835d8b87](https://gitlab.com/cinc-project/distribution/omnibus-software/-/commit/835d8b87712b9ec0eb33bc661c6f9a9fc140298b))
- fix(git-windows): Set GIT_EXEC_PATH in embedded git.bat shim ([omnibus-software@c9234135](https://gitlab.com/cinc-project/distribution/omnibus-software/-/commit/c9234135f650ff4c808e51dad2b2ea7664c24ada))

### Gem updates

Cinc Workstation bundled gems (components/gems/Gemfile.lock):

- **Added:** `ffi-yajl` 2.7.11
- **Added:** `git` 4.3.2
- **Added:** `inspec-docker-resources` 7.1.8
- **Added:** `inspec-podman-resources` 7.1.5
- **Added:** `toml-rb` 4.2.0
- **kitchen-cinc** 1.0.0 → 1.1.0
- **kitchen-dokken** 2.22.2 → 2.23.0
- **minitest** 6.0.5 → 6.0.6

## [26.0.1] - 2026-04-30

### Bug Fixes

- Don't delete project cache dir in macOS post-package cleanup ([`754e3b2`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/754e3b2b29c975778503348585f147bf5730bb56))
- Exclude bio binary check on macOS smoke tests ([`a923ba7`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/a923ba7ca8a0683d4c6a2da9e66b2873cece474e))
- Use Windows-specific binary list in smoke tests ([`454267a`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/454267abea1d5154b96efc0975210766cc19b2ae))
- Delimit variable name in smoke test throw message ([`c1fe2a8`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/c1fe2a8f9025489eb6bcde7f6998300d330c071e))
- Drop embedded git mingw64\bin from build PATH ([`b9c521f`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/b9c521f3b8bcbc19a0cdc9c19435758fd75d00d7))
- Use host msys2 for native gem builds, drop Git for Windows ([`235dcf9`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/235dcf90c5390f542b5e1e753bc646aee656e2bc))
- Add embedded msys2 devkit to Windows PATH ([`9c8ec08`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/9c8ec0804b0b1d2f6ee429523bd19baa5ed59b35))
- Restrict Windows PATH to embedded toolchain ([`00423d3`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/00423d35b6578eb8d44f7af182d83f1ce12ee533))
- Fix git gem post-install for appbundler ([`cb5a3e6`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/cb5a3e684bbf48988d5370516174cbe7902f1ec3))
- Fix Windows git caching and gem command env in chef-dlls ([`0866e44`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/0866e44b9a152293856e33a87bfc883d298ea1e6))
- Fix git caching by adding default_version to remove-old-gems ([`1ae0320`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/1ae0320b0a3cccf331f299d9986c773c105bf57c))
- Fix macOS rb-fsevent checksum mismatch ([`c42004a`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/c42004a9faeede6cbea960b5113d37b00e3406fe))
- Fix cache_dir grep matching commented lines in omnibus.rb ([`3a56649`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/3a56649a48c8222aa7710f99e51c28fef4e5c384))
- Fix macOS CI permissions and update MR aarch64 to macos-26 ([`c69ec36`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/c69ec36eba58945dfb941eb8abbefe4c031cea20))
- Fix Cinc branding output and restore fork module paths ([`c597f15`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/c597f15010920ea706b9498b4a9f18b2fe035985))
- Fix Go lint pipeline and main-cinc-wrapper module alignment ([`932f1e5`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/932f1e5aaa11acecfb9b6caee9f2f85dd50cda34))

### Continuous Integration

- Snapshot install dir as artifact on failure ([`46e5669`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/46e5669400fbe5840652f6d1854af35f94c67028))
- Align automated changelog release flow ([`98359b7`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/98359b7b15f5880f199ca5ecc08da80609c375a3))
- Add git-cliff changelog release flow ([`f46b2fc`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/f46b2fc1d79d47c9377739355339fd9501ebc3dd))
- Remove redundant VERSION copy that fails in CI ([`71afb57`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/71afb5713853c33c98036e753cab79c9e4576b7a))
- Source omnibus toolchain in ruby lint job ([`92c2c58`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/92c2c58266d83469e08a619343a40f86ba639dbe))

### Documentation

- Add repository agent guidance ([`91120ab`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/91120ab9784dbd8eeda982bc9c964b550609ea4f))

### Features

- Include additional gems ([`099a2c8`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/099a2c8ddd26749d7c0e315acfc8839e86edfcb9))
- Add kitchen-terraform ([`5b7c956`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/5b7c95686a53b33636250465b97d6dfd21ee6580))
- Add kitchen-sync, kitchen-cinc, acme-client, and taste_tester ([`b9f79d8`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/b9f79d8eec187c8de6c7a7537e14a68ef8027d1c))
- Add InSpec test profiles for CI ([`2465c20`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/2465c20048a793026c3f456cf6ed45c9e14c6856))
- Add optional MR builds for Windows and macOS 26 Intel ([`7b601ea`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/7b601ea4fdf19c80714c619835076e657bf6db21))
- Consolidate cinc-workstation as independent fork ([`67b97c5`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/67b97c5e24438b0bed2ca6501f55fbf38dc132ef))

### Maintenance

- Update omnibus-software ([`da94cf3`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/da94cf3f8ad65e4e4ad72a21fcdf7a64418b000b))
- Update omnibus-software ([`4325580`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/4325580326eda3fe0a33963eedbe92f040a69f50))
- Remove macos-13 pipeline targets ([`c5f7df9`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/c5f7df9210a9136557e0909a8900439f493c4dc4))
- Ensure installed git gems include gemspec ([`a70b788`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/a70b788da57a183edbdc31bfc8889f52d6780de8))
- Update to latest omnibus-software ([`335b8d4`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/335b8d47f1ba443a92227ed74ce4c449a03e2b48))
- Pin openssl gem to ruby's bundled default version ([`04f91e9`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/04f91e92958e2ce9c2d34e8583349925902fc9c9))
- Ignore local cache and data directories ([`ec9c095`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/ec9c09573c76cab00e5d5a65189fe9af8346e987))
- Update omnibus-software to latest ([`41f4a4f`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/41f4a4faf734d5d0daaf612ce40444eae914397a))
- Update ruby-shadow with gcc fix ([`36eebb6`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/36eebb65e9bc819abc144d6fb40db3f94d06b70c))
- Update maintenance plan with completed work ([`263cfc9`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/263cfc9b5eb3c0a8062dd240e6e10b5db1d5265e))
- Update omnibus Gemfile.lock ([`dbd5d20`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/dbd5d2080ddb9160d221514834e1ded3b0fa0cdd))
- Move version bump logic to script ([`7fe48eb`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/7fe48ebaa6e0a5bbeb7bad87ab3d57cddea4ef57))
- Bump Chef 19, InSpec 7, and update gem dependencies ([`09f2bb4`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/09f2bb4159e037a5698a22641eeb436014fd9ce4))
- Remove JetBrains .iml editor artifacts ([`c37afa9`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/c37afa95c00b6ea1cf2b92cb2d726f3984ad4a4d))

### Refactoring

- Extract package and test lifecycle scripts ([`dadf041`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/dadf041ddac7032ae63828597c7dbfd9d3073176))
- Remove notice-file software definition ([`e498acb`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/e498acb569c01bf4c285a4aa4f6887d238b295b9))
- Remove chef_deprecations gem and replace hab with bio ([`41a1065`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/41a1065fe2bec05f09fbbdd440bd9ba017436908))
- Remove dead code and consolidate software definitions into omnibus-software ([`374e1d4`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/374e1d407b9877f663e15eb5f36e452affc71e76))
- Remove all references to chef-apply from omnibus ([`05aa146`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/05aa14642e8527ee94c01b30637c8d78d25a4594))
- Remove Chef/Progress-specific CI and other unnecessary files ([`fb5f1e6`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/fb5f1e63a570bdeb28926e12ad9f5b8e99eb4cba))

### Style

- Chefstyle fix ([`b3588b1`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/b3588b18b5f9602ce957b34e9f36c8504ec38059))
- Chefstyle fixes ([`0aa850e`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/0aa850e93bdad9b3ddd297bdc624d41bcef69c7e))
- Chefstyle fixes ([`56bc75e`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/56bc75eab5e3c22cfcda088a015c8955e000eb3d))
- Switch from chefstyle to cookstyle and fix style offenses ([`5c8cf2b`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/5c8cf2b03da08d4e2df682689d40d9dc5cddf063))

### Tests

- Remove cinc-run tests since it was removed from the package ([`2aaf42d`](https://gitlab.com/cinc-project/distribution/cinc-workstation/-/commit/2aaf42dfdb785aae0b8fe1ec74619a240af945ca))

