zrok version history

- Fixed an issue where reserved shares were deleted during shutdown or process exit, preserving reservations unless explicitly released. - Resolved `go vet` findings and improved signal handling, XML literals, and context cancellation. - Updated npm dependencies for `ui` and `agent/agentUi` components.

## CHANGELOG FIX: The Python SDK `ProxyShare` now rejects absolute proxy request paths before forwarding. This prevents a viewer from using an absolute URL path to make the proxy host request arbitrary internal or loopback services instead of the configured target. FIX: Updated Python SDK unit tests to patch `zrok2.*` modules instead of the legacy `zrok.*` package path, allowing the non-integration test suite to pass against the v2 Python package layout. FIX: The zrok2 Docker Compose self-hosting metrics service now defaults to `influxdb:2.8-alpine` instead of the floating `influxdb:2-alpine` tag to avoid upstream image regressions. Docker Compose integration test failures now also include compose service status, container health details, and focused InfluxDB logs for faster diagnosis. FIX: The `zrok2 copy` drive sync path now rejects unsafe WebDAV and zrok drive paths before writing to a local filesystem target. Local drive sync operations are root-confined to prevent attacker-controlled paths or symlinks from writing, removing, moving, or timestamping files outside the selected destination while still allowing symlinks that resolve within the destination tree. FIX:

## CHANGELOG FIX: The `drive` backend mode WebDAV implementation now prevents symlink traversal outside the configured shared directory. `Stat`, `OpenFile`, `Mkdir`, `RemoveAll`, and `Rename` now reject symlinks that resolve outside the drive root while continuing to allow symlinks that resolve within that tree. This fixes `GHSA-74m3-9qvm-rp9h`.

## CHANGELOG FEATURE: Added several new `admin` API endpoints for interfacing with additional management controls: finding limit classes by label, finding applied/applying/removing limit classes from accounts, getting/setting skip interstitial status for an account (https://github.com/openziti/zrok/issues/1210) CHANGE: Removed the legacy `admin` `/grants` endpoint. Its prior synchronization behavior is now replaced by the new skip interstitial grant management endpoints. (https://github.com/openziti/zrok/issues/726) CHANGE: Applying limit classes now validates requested assignments to prevent conflicting effective limit class combinations on an account (https://github.com/openziti/zrok/issues/726) FIX: Escaped proxyUi output by switching to html/template and removed reflected refreshInterval values from github oauth error pages. FIX: Users could get into a state where an allocated name returns a `500` error; this happened by various combinations of abnormal share termination, or deleting a name from underneath a live share... both resulted in bad frontend mappings that prevented proper share operation. The `zrok2 delete name` now refuses to delete names with an activ

## CHANGELOG FEATURE: Major changes to how "unique names" and "reserved sharing" work. See the [zrok v2 Migration Guide](https://docs.zrok.io) for details. Reserved sharing, including the `zrok reserve`, `zrok release` and `zrok share reserved` commands have been removed. Namespaces and reserved names replace these concepts in a much more powerful, flexible way which can accomplish what reserved sharing did in a much better way. (https://github.com/openziti/zrok/issues/726) CHANGE: **Binary renamed from `zrok` to `zrok2`**. This allows zrok v1 and v2 to coexist on the same system without conflicts. All command invocations now use `zrok2` (e.g., `zrok2 enable`, `zrok2 share public`). (https://github.com/openziti/zrok/issues/1124) CHANGE: **Environment directory changed from `~/.zrok` to `~/.zrok2`**. This provides complete isolation between v1 and v2 environments. Users running `zrok2 enable` will create a new environment in `~/.zrok2`; existing `~/.zrok` environments are not affected. (https://github.com/openziti/zrok/issues/1124) CHANGE: **Environment variables renamed from `ZROK_*` to `ZROK2_*`**. All environment variables now use the `ZROK2_` prefix (e.g., `ZROK2_API

## CHANGELOG **This is a pre-release version of zrok v2.0.0. Not all recipes, platforms and distributions have been updated yet.** FEATURE: Major changes to how "unique names" and "reserved sharing" work. See the [zrok v2 Migration Guide](https://docs.zrok.io) for details. Reserved sharing, including the `zrok reserve`, `zrok release` and `zrok share reserved` commands have been removed. Namespaces and reserved names replace these concepts in a much more powerful, flexible way which can accomplish what reserved sharing did in a much better way. (https://github.com/openziti/zrok/issues/726) CHANGE: **Binary renamed from `zrok` to `zrok2`**. This allows zrok v1 and v2 to coexist on the same system without conflicts. All command invocations now use `zrok2` (e.g., `zrok2 enable`, `zrok2 share public`). (https://github.com/openziti/zrok/issues/1124) CHANGE: **Environment directory changed from `~/.zrok` to `~/.zrok2`**. This provides complete isolation between v1 and v2 environments. Users running `zrok2 enable` will create a new environment in `~/.zrok2`; existing `~/.zrok` environments are not affected. (https://github.com/openziti/zrok/issues/1124) CHANGE: **Environmen

## CHANGELOG **This is a pre-release version of zrok v2.0.0. Not all recipes, platforms and distributions have been updated yet.** FEATURE: Major changes to how "unique names" and "reserved sharing" work. See the [zrok v2 Migration Guide](https://docs.zrok.io) for details. Reserved sharing, including the `zrok reserve`, `zrok release` and `zrok share reserved` commands have been removed. Namespaces and reserved names replace these concepts in a much more powerful, flexible way which can accomplish what reserved sharing did in a much better way. (https://github.com/openziti/zrok/issues/726) CHANGE: **Binary renamed from `zrok` to `zrok2`**. This allows zrok v1 and v2 to coexist on the same system without conflicts. All command invocations now use `zrok2` (e.g., `zrok2 enable`, `zrok2 share public`). (https://github.com/openziti/zrok/issues/1124) CHANGE: **Environment directory changed from `~/.zrok` to `~/.zrok2`**. This provides complete isolation between v1 and v2 environments. Users running `zrok2 enable` will create a new environment in `~/.zrok2`; existing `~/.zrok` environments are not affected. (https://github.com/openziti/zrok/issues/1124) CHANGE: **Environmen

## CHANGELOG **This is a pre-release version of zrok v2.0.0. Not all recipes, platforms and distributions have been updated yet.** FEATURE: Major changes to how "unique names" and "reserved sharing" work. See the [zrok v2 Migration Guide](https://docs.zrok.io) for details. Reserved sharing, including the `zrok reserve`, `zrok release` and `zrok share reserved` commands have been removed. Namespaces and reserved names replace these concepts in a much more powerful, flexible way which can accomplish what reserved sharing did in a much better way. (https://github.com/openziti/zrok/issues/726) CHANGE: **Binary renamed from `zrok` to `zrok2`**. This allows zrok v1 and v2 to coexist on the same system without conflicts. All command invocations now use `zrok2` (e.g., `zrok2 enable`, `zrok2 share public`). (https://github.com/openziti/zrok/issues/1124) CHANGE: **Environment directory changed from `~/.zrok` to `~/.zrok2`**. This provides complete isolation between v1 and v2 environments. Users running `zrok2 enable` will create a new environment in `~/.zrok2`; existing `~/.zrok` environments are not affected. (https://github.com/openziti/zrok/issues/1124) CHANGE: **Environmen

## CHANGELOG CHANGE: The `vpn` backend mode has been removed from zrok due to dependency management issues. The underlying TUN device libraries created conflicts that prevented updates to critical dependencies. See the [VPN removal guide](https://docs.zrok.io/docs/guides/vpn/) for migration alternatives and future plans. CHANGE: Updated `github.com/greenpau/caddy-security` to `v1.1.31`. Updated `github.com/smallstep/certificates` to `v0.29.0` (CVE-2025-66406 was reported, but only effects indirect dependencies and not relevant to any viable `caddy-security` use cases) (https://github.com/openziti/zrok/issues/1120) FIX: the `zrok-share.bash` wrapper script for Docker and Linux services was updated to use the new spelling of the `--oauth-email-address-pattern` option (it was `--oauth-email-domains` until v0.4.26 when it changed to `--oauth-email-address-patterns`)

## CHANGELOG **OOPS! `v1.1.10` is a re-release of the mis-tagged `v1.1.9` release. Apologies!** CHANGE: The `publicProxy` now supports "striped session cookies" to support larger authentication payloads when working with OIDC providers that use larger tokens/payloads. (https://github.com/openziti/zrok/issues/1101) FIX: Fix for icon/favicon in HTML for the api console. (https://github.com/openziti/zrok/pull/1094)