chore(deps): update dependency nolabs-ai/nono to v0.75.0

[renovate]

This PR contains the following updates:

Package	Update	Change
nolabs-ai/nono	minor	0.74.0 → 0.75.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

nolabs-ai/nono (nolabs-ai/nono)

v0.75.0

Compare Source

Bug Fixes

• (sandbox) Use capturing group in ** deny-glob Seatbelt regex (#​1764) (#​1764)

• (sandbox) Expand env vars anywhere in local-socket path, not just as prefix (#​1762) (#​1762)

• (why) Evaluate network.deny_domain in nono why host queries (#​1751) (#​1751)

• (cli) Hint at CAP_SYS_PTRACE on pidfd_getfd EPERM, fix doubled error prefix (#​1750) (#​1750)

• (hooks) Expand $WORKDIR/$HOME/etc. in session hook script paths (#​1749) (#​1749)

• (cli) Honor inline custom credential routes in --config manifests (#​1705) (#​1705)

• (credentials) Configurable phantom format for prefix-sniffing clients (#​1489) (#​1489)

• (policy) Make unmatched deny-glob warning platform-accurate (#​1738) (#​1738)

• (proxy) Add redeem_phantoms for by-value phantom redemption (#​1469) (#​1469)

• (cli) Warn when a draft profile cannot resolve its extends chain (#​1702) (#​1702)

• (cli) Make profile promote work for existing profiles (#​1703) (#​1703)

• (sandbox) Grant Refer on command_policies outer exec gate (#​1722) (#​1722)

• (proxy) Skip network audit buffer when --no-audit is set (#​1682) (#​1682)

• (proxy) Decode Basic auth for basic_auth phantom validation (#​1683) (#​1683)

• (proxy) Honor host:port deny entries under wildcard allow (#​1709) (#​1709)

• Broken quote formatting in README (#​1707) (#​1707)

Dependencies

• (deps) Bump globset from 0.4.19 to 0.4.20 (#​1753) (#​1753)

• (deps) Bump hyper from 1.11.0 to 1.11.1 (#​1755) (#​1755)

• (deps) Bump which from 8.0.5 to 8.0.6 (#​1756) (#​1756)

• (deps) Bump rcgen from 0.14.8 to 0.14.9 (#​1752) (#​1752)

• (deps) Bump ureq from 3.3.0 to 3.4.0 (#​1754) (#​1754)

• (deps) Bump aws-lc-rs from 1.17.3 to 1.18.0 (#​1726) (#​1726)

• (deps) Bump tokio-tungstenite from 0.28.0 to 0.30.0 (#​1728) (#​1728)

• (deps) Bump base64 from 0.23.0 to 0.23.1 (#​1727) (#​1727)

• (deps) Bump thiserror from 2.0.18 to 2.0.20 (#​1725) (#​1725)

• (deps) Bump similar from 3.1.1 to 3.2.0 (#​1729) (#​1729)

• (deps) Bump docker/setup-buildx-action from 4.2.0 to 4.3.0 (#​1730) (#​1730)

Documentation

• Add NEP process for design proposals (#​1743) (#​1743)

• Update SECURITY.md to clarify security model (#​1747) (#​1747)

• (security) Security model clarification (#​1734) (#​1734)

Features

• (profile,proxy) Glob patterns for env var and hostname allow/deny lists (#​1692) (#​1692)

• (broker-path) Sanitize PATH for host-side credential and URL brokers (#​1733) (#​1733)

• (examples) Add initial set of tool sandbox examples (#​1696) (#​1696)

• (cli) Show resolved command_policies in profile show (#​1685) (#​1685)

• (cli) Support --extends on nono proxy (#​1686) (#​1686)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

📊 Test coverage

Component	Coverage	Δ vs base
Go (./...)	81.1%	+0.0%
Swift (gui/shared)	77.7%	—

Per-file Go coverage (most uncovered first) — click to expand

File	Coverage	Statements	Δ vs base
internal/libghosttydeps/generate.go	26.7%	162/606	+0.0%
internal/config/config.go	91.8%	1458/1588	+0.0%
internal/libghosttyarchive/archive.go	76.0%	237/312	+0.0%
internal/docspreview/docspreview.go	85.7%	415/484	+0.0%
internal/dependencyhealth/poller.go	60.6%	80/132	+0.0%
internal/dependencyhealth/model.go	61.7%	82/133	+0.0%
cmd/docspreview/main.go	39.0%	32/82	+0.0%
internal/dependencyhealth/provider.go	61.3%	68/111	+0.0%
internal/agent/transcript/claude.go	79.7%	157/197	+0.0%
internal/agent/transcript/codex.go	84.5%	218/258	+0.0%
internal/config/telemetry.go	85.5%	219/256	+0.0%
internal/git/branch.go	52.1%	37/71	+0.0%
cmd/docsdiff/main.go	91.6%	336/367	+0.0%
internal/store/store.go	84.0%	163/194	+0.0%
internal/libghosttydeps/cmd/main.go	0.0%	0/29	+0.0%
internal/git/git.go	77.6%	97/125	+0.0%
internal/sandbox/nono.go	85.5%	153/179	+0.0%
cmd/architecturecheck/main.go	0.0%	0/25	+0.0%
internal/config/notification_instruction.go	88.1%	178/202	+0.0%
internal/config/trigger.go	93.1%	324/348	+0.0%
internal/architecture/check.go	88.6%	171/193	+0.0%
internal/sandbox/safehouse.go	74.7%	65/87	+0.0%
internal/testutil/graith.go	63.3%	38/60	+0.0%
internal/version/update.go	72.4%	55/76	+0.0%
internal/git/worktree.go	82.9%	92/111	+0.0%
internal/sandbox/denials.go	88.8%	151/170	+0.0%
internal/config/paths.go	74.6%	53/71	+0.0%
internal/capabilities/capabilities.go	91.9%	192/209	+0.0%
internal/docspreview/github.go	87.5%	119/136	+0.0%
internal/protocol/manifest.go	78.5%	62/79	+0.0%
cmd/ciclassify/main.go	78.1%	57/73	+0.0%
internal/ciworkflow/credential.go	62.8%	27/43	+0.0%
internal/ciworkflow/p11_js_surface.go	83.7%	77/92	+0.0%
internal/executablepin/pin_linux.go	62.5%	25/40	+0.0%
internal/scenariofile/scenariofile.go	94.2%	244/259	+0.0%
internal/libghosttydeps/lock.go	87.6%	99/113	+0.0%
internal/sandbox/why.go	80.9%	55/68	+0.0%
internal/libghosttydeps/verify.go	83.6%	61/73	+0.0%
internal/telemetry/tracing.go	87.9%	87/99	+0.0%
internal/agent/transcript/render.go	87.7%	64/73	+0.0%
internal/atomicfile/atomicfile.go	81.6%	40/49	+0.0%
internal/ignore/ignore.go	82.7%	43/52	+0.0%
internal/config/watcher.go	78.9%	30/38	+0.0%
internal/sessionlabel/label.go	85.2%	46/54	+0.0%
cmd/libghosttyarchive/main.go	74.1%	20/27	+0.0%
internal/agent/transcript/scanner.go	89.9%	62/69	+0.0%
internal/git/context_command_unix.go	71.4%	15/21	+0.0%
internal/protocol/messages.go	78.6%	22/28	+0.0%
internal/agent/transcript/transcript.go	90.2%	46/51	+0.0%
internal/agent/transcript/usage.go	90.6%	48/53	+0.0%
internal/config/scenario.go	72.2%	13/18	+0.0%
internal/detector/detector.go	95.2%	99/104	+0.0%
internal/config/render.go	93.1%	54/58	+0.0%
internal/sandbox/kernel_linux.go	0.0%	0/4	+0.0%
internal/sandbox/landlock_linux.go	0.0%	0/4	+0.0%
internal/git/maintenance.go	83.3%	15/18	+0.0%
internal/testutil/git.go	93.5%	43/46	+0.0%
internal/ciworkflow/workflow_classifier.go	96.6%	56/58	+0.0%
internal/scenariofile/protocol_config.go	97.7%	84/86	+0.0%
internal/tools/tools.go	96.0%	48/50	+0.0%
cmd/covreport/main.go	97.1%	34/35	+0.0%
internal/covreport/covreport.go	98.7%	77/78	+0.0%
internal/git/username.go	96.0%	24/25	+0.0%
internal/hookoutput/hookoutput.go	90.0%	9/10	+0.0%
internal/libghosttydeps/render.go	94.1%	16/17	+0.0%
internal/output/output.go	95.2%	20/21	+0.0%
internal/processidentity/processidentity.go	93.3%	14/15	+0.0%
internal/protocol/frame.go	95.5%	21/22	+0.0%
internal/sandbox/sandbox.go	95.7%	22/23	+0.0%
internal/testprocess/testprocess.go	90.9%	10/11	+0.0%
internal/agent/agent.go	100.0%	36/36	+0.0%
internal/agent/transcript/limits.go	100.0%	10/10	+0.0%
internal/ciworkflow/path_helpers.go	100.0%	23/23	+0.0%
internal/config/template.go	100.0%	23/23	+0.0%
internal/config/trigger_template.go	100.0%	16/16	+0.0%
internal/cronx/cronx.go	100.0%	23/23	+0.0%
internal/scenariofile/policy.go	100.0%	64/64	+0.0%

_{Base coverage: Go 81.1%. Per-file figures are statement coverage. Swift shows an absolute % (no delta) to keep macOS CI light. Updated on every push.}