v0.3.4

Port scans now name the software and version a service reports, can check common UDP services, and report closed ports as closed on Windows instead of filtered. The CLI writes CSV and Markdown tables, inspect gives an OS hint, and the desktop app can update itself. Discovery no longer lists the network broadcast address as a device.

Added

• The CLI can write CSV and Markdown tables. --csv and --md work on
  every command that returns a list (discover, scan, sweep, dns,
  ping, arp, interfaces, mdns and pcap). The columns are the same
  field names --json uses, one row per host, port, record or packet, so a
  result opens straight in a spreadsheet or pastes into an issue without
  going through jq. Text a scanned host chose is made safe for each. A
  banner that starts like a spreadsheet formula is defused, the same way the
  desktop app's CSV export already does it, and one containing Markdown or
  HTML is escaped.

• Port scans show the software and version where a service states them.
  An SSH server's identification line, a web server's Server header, an
  FTP or mail server's greeting and a MySQL or MariaDB server's connection
  greeting usually name the software, often with its version:
  OpenSSH 9.6p1, nginx 1.25.3, MariaDB 10.11.6. Redis, Valkey and
  Memcached say nothing until asked, so each gets the one read-only question
  that returns its version. Scans report this as product and version in
  the JSON, and in a Version column in the CLI, the terminal UI and the
  desktop app. It's far narrower than nmap's -sV: a service that doesn't
  announce itself, and isn't one of those three, gets no version.

• UDP scanning. netscli scan <host> --udp checks the UDP services most
  networks run (DNS, NTP, NetBIOS, SSDP and mDNS), each sent the request it
  expects, or the ports you give with -p. A reply reads as open, with what
  came back (NTP v4, stratum 2, a UPnP device's server string, a Windows
  machine's NetBIOS name). A port-unreachable reads as closed, and silence
  reads as open|filtered, because UDP can't tell a quiet service from a
  firewall. It needs no administrator rights. The terminal UI takes
  /scan <host> --udp, the MCP server's scan_ports takes udp: true, and
  the desktop app's Port Scan has a TCP/UDP switch.

• Inspect gives an OS hint. netscli inspect now says what the host
  probably runs, with the clues behind it, such as a Windows machine's exact
  version and build from the start of an SMB connection (no login), the
  distribution an SSH banner names, an (Ubuntu) or IIS web server header,
  Windows' RPC and file-sharing ports, an Apple or Raspberry Pi network card,
  and the ping reply's TTL. It also shows the host's MAC address and vendor
  when it's on the same network. It's a hint, not nmap's packet
  fingerprinting, and needs no administrator rights. The same hint is in the
  terminal UI, the desktop app's Inspect details and the MCP server's
  inspect_host.

• The desktop app can update itself. It already told you when a newer
  release was out and linked to the release page. Now, where it can, the
  notice opens a dialog with the release notes and an Install and
  restart button. The update is downloaded, checked against NetsCLI's
  signing key, installed, and the app reopens. Nothing downloads unless you
  click it, and the existing setting still turns the check off entirely.

  Installs that a package manager owns keep the old link, because an update
  from inside the app would fight it. That covers Scoop, the AUR package and
  .deb installs. The Homebrew cask now declares auto_updates, so
  Homebrew leaves updates to the app.

  This takes effect from the version after this one. An app can only update
  itself if it was built with the updater, so 0.3.4 is the first that can,
  and 0.3.5 is the first update it will install.

Changed

• MCP scan replies leave out closed and filtered ports. scan_ports and
  inspect_host returned one entry for every port scanned, so a 1,024-port
  scan of a machine with two open ports came to 136,834 bytes of mostly
  "closed". They now return open, open|filtered and errored ports only,
  which made the same scan 178 bytes. Pass include_closed: true for every
  port. Replies are also sent as compact JSON instead of indented, which
  took a sweep of the local network from 15,399 bytes to 8,746.

• Defaults now match across the CLI, TUI, desktop app and MCP server.

  • The desktop app scanned five ports by default (22, 80, 443, 8080 and
    8443) where everything else scans 22, 80 and 443. It now uses the same
    three, for port scans and inspect alike.
  • The MCP server applied the timeout it advertises to every step, so an
    MCP inspect or sweep pinged with 500 ms where the others use 1,000, and
    gave name lookups 500 or 1,000 ms where the others give 1,500. Without a
    timeout each step now keeps its usual default.
  • The MCP tool list advertised defaults the server did not use. DNS
    lookups claimed an A record and look up every type, discover and
    sweep claimed 192.168.1.0/24 and use your own network, and background
    captures claimed capture.pcap and name the file after the job. The
    tool list now says what happens.
  • Ping count tops out at 256 everywhere. The desktop app stopped at 50 or
    64, and the TUI had no limit at all.
  • Desktop inspect ignored the concurrency setting in Preferences. It now
    uses it, like scan, discover and sweep.
  • A desktop packet capture lasts 10 seconds by default, as on the CLI and
    MCP server, instead of 5.

• Discovery reads the Windows device table directly instead of running
  arp -a and parsing its text. On an idle machine that makes no measurable
  difference (arp -a took 65 ms), but it removes a program start from every
  discover and sweep, and under heavy CPU load arp -a took about 4 seconds
  on the same machine.

Fixed

• Discovery reported the broadcast address as a device. The network's
  device table on Windows lists x.x.x.255 with the MAC
  ff:ff:ff:ff:ff:ff, and discovery listed it as a host that ignored ping
  (and a sweep then scanned it). The network and broadcast addresses, and broadcast and
  multicast MACs, are no longer reported.
• Closed ports showed as filtered on Windows. Windows waits about two
  seconds before reporting a refused connection, and the scan stops waiting
  after half a second, so a port that was plainly closed came back as
  filtered. The scan now reports it as closed straight away. A scan of 1,024
  ports on a LAN machine went from 1,022 filtered to 1,022 closed.
• The macOS app could be refused as broken on Apple Silicon. Its only
  signature was the one Apple's linker puts on every arm64 program, which
  claims the app's files are sealed when nothing sealed them. macOS's own
  checks fail it with "code has no resources but signature indicates they
  must be present", a broken app rather than one from an unidentified
  developer, so the Open Anyway route the site describes may never be
  offered. The whole app is now ad-hoc signed, which seals it, and the
  release checks the app inside the finished .dmg before shipping it. It is
  still not notarized, so the first launch still goes through Open Anyway in
  System Settings → Privacy & Security.
• Redis, DNS, NFS, SOCKS and Prometheus ports were probed as if they
  spoke TLS. The scanner treated any service name ending in "s" as a TLS
  variant, a rule meant for imaps and pop3s, so these ports got a TLS
  handshake instead of having their greeting read. The TLS services are now
  listed by name.
• Installing the desktop app with Scoop now adds it to the Start menu. The
  manifest's shortcut pointed at NetsCLI.exe, a file that is in no version of
  the package. Scoop extracts the MSI rather than running it, which leaves the
  app at PFiles\NetsCLI\netscli-gui.exe. Scoop reported "Creating shortcut
  ... failed" and finished the install anyway, so the app was installed with no
  way to launch it but finding the folder. The manifest now flattens that
  folder and names the real executable, and the publish job sets both on every
  release.
• The desktop app itself is signed, not only its installer. Since 0.3.3 the
  .msi has carried an Authenticode signature, but netscli-gui.exe inside it
  did not, and that is the file SmartScreen and antivirus look at when the app
  runs. It is now signed during the build, before it is packed into the
  installer, and the release checks the finished MSI's contents before
  shipping it. Measured on the published 0.3.3 installer. The MSI's signature
  is valid, the app inside it is unsigned.

---

Full changelog: v0.3.3...v0.3.4

v0.3.3

Windows executables and the desktop installer are signed, so Windows no longer warns that the publisher is unknown. Connecting the MCP server to a client no longer means installing netscli first and writing the configuration by hand: npx netscli serve works, and each release carries a one-click bundle for clients that support them.

Added

• Windows executables and the desktop installer are signed. Both netscli
  builds and the .msi now carry an Authenticode signature from a Certum
  certificate, timestamped so it keeps verifying after the certificate
  expires. Windows has been showing an unknown-publisher warning on every
  download since the first release, and SmartScreen treats an unsigned
  installer from a low-reputation domain as something to discourage rather
  than merely flag.

  Signing happens in one job, after the builds and before anything is
  uploaded, so a release carries all three signed or none of them. Half a
  signed release would be worse than none: nothing on the page would say
  which artifacts were which.

• Two new ways to connect the MCP server, so it no longer has to be a
  hand-written config file. Until now the only route was installing netscli,
  finding where it landed, and writing the JSON yourself.

  npx netscli serve now works: netscli is on npm as a small launcher plus
  one prebuilt binary per platform, and npm fetches only the one that matches
  your machine. This is the form every MCP client's documentation already uses.

  There are also .mcpb bundles on each release, one per platform. A client
  that supports MCP bundles installs one in a single action — the binary is
  inside, so nothing else is needed. The install prompt carries a switch for
  the local-network default described below, which is the first time that
  choice has been visible to the person making it rather than buried in an
  environment variable.

  Anyone who already has netscli installed should keep pointing their client
  at it. That copy is the version you chose, there is only one of it, and it
  is the only one of the three that can capture packets — libpcap and Npcap
  cannot be shipped inside an npm package or a bundle.

Documentation

• The MCP page now says what the local-network default is and why. The
  server has refused targets outside your own networks since 0.3.1, and the
  only description of that lived in a source comment, so the first anyone
  heard of it was an error message naming a variable. It is now written down
  next to the reason: this is the one surface where a scan can be requested by
  something a model read rather than by the person at the keyboard.

---

Full changelog: v0.3.2...v0.3.3

v0.3.2

Repairs the Linux packaging. The AUR desktop package installed a file that could not start, and the AppImage aborted before opening a window on any host with a recent Mesa. A desktop window that opens blank now recovers by itself, netscli with no arguments no longer hangs where there is no terminal, and discover names devices from mDNS when reverse DNS comes back empty.

Added

• Discover names hosts from mDNS when reverse DNS cannot. Consumer routers
  do not serve PTR records for their own DHCP clients, and appliances ignore
  LLMNR and NetBIOS, so reverse lookup returned nothing for exactly the devices
  someone opened the app to identify. Those devices announce their names over
  mDNS constantly, and netscli has shipped an mDNS browser all along as a
  separate operation that discover never consulted. It does now, filling only
  the blanks, so nothing that resolves today changes. On one ordinary /24 that
  named 3 more of 26 hosts, taking 21 named to 24. Results carry a
  hostname_source of reverse or mdns, since a name from a device's own
  announcement is a different kind of claim from one in DNS.
• The desktop app says the MCP server exists. Someone who only ever opens
  the app had no way to learn that netscli ships an MCP server, let alone
  connect an agent to one. There is now a panel that looks for a netscli binary
  and gives you the client configuration to paste, including what to do when it
  cannot find one — the desktop installers do not carry the CLI.

Fixed

• netscli with no arguments no longer hangs when there is no terminal.
  With no subcommand it opens the TUI, which needs a terminal to draw on and
  read from. Without one it did not fail, it blocked forever: raw mode was
  entered and the runtime then waited on input that could never arrive. So
  netscli | head, or netscli from a script or a CI job, ran until
  something killed it. It now prints what --help prints and exits 0. The TUI
  is unchanged wherever there is a terminal.

  This has been the behaviour since 0.1.0, and it is what has kept the CLI's
  winget package on 0.2.6. Winget's validation runs the executable and waits
  for it, so the 0.3.1 submission has sat since 12 September carrying
  Validation-Executable-Error while the desktop app's went through the same
  day.

• The docs site lost its navigation and its theme switch between 800px and
  1152px wide, and the search button sat stranded beside the wordmark. The
  header links — Features, Install, FAQ, Docs, Changelog, GitHub — and the
  light/dark control were both hidden across that range, on the understanding
  that the mobile menu carried them from there down. The button that opens
  that menu only appears below 800px, so for 352px of width there was nothing
  to press and no way to reach any of it. The docs sidebar is not a
  substitute: it lists the pages of the docs and carries five of those six
  links nowhere.

  The search button had a second fault behind it. The width at which the links
  hide moved from 900px to 1152px and two rules that depended on that number
  stayed put, so the layout seam ended up on a hidden element, which takes no
  part in the layout. Search fell back to the left with up to 861px of empty
  bar beside it.

  A new check measures where the header's controls sit at seventeen widths.
  Neither fault was visible to the existing accessibility, contrast or
  performance gates, because both are about position rather than markup,
  colour or speed.

• netscli-gui-bin on the AUR installed a desktop app that could not
  start. The PKGBUILD did not set options=('!strip'), and strip is in
  makepkg's default options. An AppImage is the AppImage runtime — an
  ordinary static ELF — with a squashfs image appended after everything the
  ELF headers describe, so stripping it rewrote the file from its section
  table and threw the appended image away. What reached /usr/bin was the
  944,632-byte runtime out of a 79 MB download, and running it said only
  "This doesn't look like a squashfs image". The package built, installed and
  verified its checksum at every step, because the truncation happened after
  the checksum was checked. Reported in #377.

• The Linux desktop AppImage no longer aborts on hosts with a newer Mesa.
  It failed with Could not create default EGL display: EGL_BAD_PARAMETER
  before any window appeared. The AppImage carried its own copies of nine
  display-stack libraries — the wayland client stack, libxkbcommon, and
  part of the xcb/X11 stack — and put them ahead of the host's, so the host's
  Mesa was made to talk to the wayland client library from the machine the
  release was built on. Those libraries are now removed from the image after
  it is built. Reported in #378 against v0.2.6 on Mesa 26.2.2; v0.3.1 bundled
  the same nine.

• A desktop window that opens black or blank now recovers on the next
  launch. WebKitGTK's hardware compositing can fail against a driver that
  only partly supports it, and it fails silently: the window opens, nothing
  paints, and there is nothing on stderr to go on. Seen on virtual machines
  using vmwgfx. The app now marks each launch and clears the mark once the
  UI has actually drawn a frame, so a launch that never drew one is noticed by
  the next, which turns hardware compositing off and says why.

  This could not be a setting in the app. Every GUI preference lives in the
  webview's localStorage, and the webview is the part that is not rendering,
  so someone looking at a blank window cannot reach any of it. Alongside the
  automatic recovery there are now --disable-gpu-compositing and
  --gpu-compositing flags, which are remembered across launches. Linux only:
  the other two platforms use a web engine with neither the fault nor the
  setting. Also reported in #378.

• Text in the desktop app's result tables can be selected again. Both the
  table and its wrapper set user-select: none, so a port, MAC address,
  vendor string or banner could not be dragged over with the mouse — and those
  values are on screen precisely so they can go somewhere else. The only route
  out was the detail pane. Selecting rows is a click, not a drag, so nothing
  was gained by it. Reported in #417.

• The website's release notes lost their paragraph breaks, and the fade over
  a long entry read navy rather than matching the page. Both on the changelog
  page.

Changed

• The website and docs got another pass. The install section's two
  controls line up and its alternatives stopped shouting; the hero badge shows
  the released version; the interfaces are shown rather than described; the
  README says only what a README can and its TUI screenshots work again; the
  comparison with nmap and the other scanners is fairer in both directions.
  Docs pages carry structured data, and the docs shell picked up a Lighthouse
  gate and two fixes it found.

Security

• Three open advisories cleared. rustls 0.23.40 → 0.23.45
  (RUSTSEC-2026-0285, medium), which was in 0.3.1's lockfile and so is in the
  binaries that release produced. The other two are the website's build
  dependencies rather than anything in a release artifact: adm-zip ≤0.6.0
  (GHSA-vwc7-r8mq-g2x9 and GHSA-7q85-xj36-vmfc, high) and devalue <5.9.1
  (GHSA-9rgm-9g3h-6x36, moderate).

---

Full changelog: v0.3.1...v0.3.2

v0.3.1

netscli 0.3.1

The first release since 0.2.6 in May, and a large one: four months of work on the desktop app, the shared core and the website.

The headline is the desktop app. The old dashboard-style GUI is gone. What replaces it is a different application rather than a revision of that one — a native-like shell built around operation tabs, running the same netscli-core operations as the CLI, TUI and MCP server, so its results match the rest of the tool.

• Operation tabs you can reorder by drag or keyboard, and close individually, to either side, or all at once
• Sortable and filterable result tables, row detail panes, and a preview of the CLI command each run is equivalent to
• Save a whole workspace of results to a file and reopen it later; export CSV or JSON, whole or selection-only
• Light and dark themes, and settings for probe concurrency, default and traffic interfaces, IPv4/IPv6 display preference, history and save behaviour
• Full keyboard operation

Also new

• Clear the ARP table, then discover. A chevron beside Run offers a cache-flushing variant on discover, sweep and the ARP tab — the tools where a stale neighbour entry changes the answer.
• Richer port scan results. Scans report open, closed, filtered, error, latency, banners, and HTTP/TLS metadata, keeping the older fields intact for compatibility.
• Probe concurrency is configurable in the desktop app and TUI, not just the CLI and MCP server.

Worth knowing before you upgrade

• netscli scan --json now reports every port, not just the open ones. Filtering to open ports made "all closed", "all filtered" and "every probe errored" the same empty array, so a script could not tell a clean scan from a host that refused every probe. Each entry carries open and status — filter for them if you only want open ports. This changes the shape of existing script output.
• The MCP server now scans only local networks by default. It is the one surface driven by a model rather than by the person at the keyboard, so the instruction to scan a third party can arrive from a web page or a file someone else wrote. RFC1918, loopback, link-local and the carrier-grade NAT range are allowed; set NETSCLI_MCP_ALLOW_PUBLIC_TARGETS=1 to reach past them.
• winget show netscli reported a version this project never issued. v0.2.2 through v0.2.6 went into the public catalog with the tag rather than the version number. Upgrades still worked — winget normalises a leading v — and this release fixes what is displayed.

Notable fixes

• Pinging your own machine works on Windows. ping 127.0.0.1, and the machine's own LAN address, timed out while the system ping answered immediately. Discover and sweep both start from a ping sweep, so both returned nothing for any range covering this host.
• IPv6 hosts can be pinged. ping ::1 reported total loss; there was no ICMPv6 path at all.
• netscli arp --clear, --add and --delete stop claiming success when they did nothing. On Windows these print an elevation warning and then exit 0, so an ordinary run printed "ARP entry added" — and "ok": true in JSON — having touched nothing.
• Discover reports devices the OS already knows about, merging probe replies with the neighbour table, so a device that answers ARP but not ICMP is no longer missing.
• Safety limits are enforced in the engines, not only in Ops. Called directly, 0.0.0.0/0 collected 4,294,967,294 addresses into a Vec before sending a packet.
• The MCP server no longer serialises requests, blocks runtime workers, or dies on a single invalid UTF-8 byte.
• The Windows installer verifies Npcap's signature before running it, and install.sh stops reporting success before libpcap is installed.

Full detail for every change: https://netscli.com/changelog/

What's new in 0.3.1

• Date 0.3.1 in the changelog and add its link reference (#392) by @fstubner
• Fix the crates.io preflight check, which could never pass (#391) by @fstubner
• Let release-drafter be dispatched manually (#390) by @fstubner
• Launch Windows system tools by absolute path (#389) by @fstubner
• Fix two wrong field tables in the result model (#387) by @fstubner
• Fix every finding from the engineering audit (#388) by @fstubner
• Land the two deferred dependency bumps, both verified (#386) by @fstubner
• Take the in-range fixes for six npm advisories (#384) by @fstubner
• Count cargo installs, refresh the README's desktop shots, drop a stale token file (#382) by @fstubner
• ci: check the five publishing credentials without publishing anything (#381) by @fstubner
• test(gui): give the e2e desktop window a 16:9 shape (#380) by @fstubner
• test(gui): assert destructive menu items are marked at rest, not on hover (#379) by @fstubner
• ci: run the site jobs for the files outside site/ that the build reads (#376) by @fstubner
• Drop the 0.3.0 explanation from the 0.3.1 intro, and its dead links (#375) by @fstubner
• site: cut the retrospective sentence from the 0.3.1 summary (#374) by @fstubner
• site: remove the white strip down the right of the TUI screenshot (#373) by @fstubner
• site: stop the changelog printing a release's intro prose twice (#372) by @fstubner
• docs: give the README's TUI preview the same gradient span (#364) by @fstubner
• site: give the TUI screenshot's gradient the same span as the nav wordmark (#363) by @fstubner
• site: make the theme control a real menu, and group the docs bar's buttons (#362) by @fstubner
• Say when a command was copied, and grey packet capture everywhere (#361) by @fstubner
• Collapse the unreleased notes into one 0.3.1 section (#360) by @fstubner
• site: say when the preview port is held by something on another host (#359) by @fstubner
• site: add a second landing layout, and let content pick between them (#358) by @fstubner
• site: make the landing page's section order content (#357) by @fstubner
• site: take the product's name out of the style comments (#356) by @fstubner
• site: read the 404 and changelog page copy from site-content (#355) by @fstubner
• site: keep the measurements in four comments, drop the product name (#354) by @fstubner
• site: describe the install groups without naming the product (#353) by @fstubner
• site: measure the wordmark the content names, not netscli's filename (#352) by @fstubner
• site: read the last of the product's copy from site-content (#351) by @fstubner
• site: read the docs head tags and GitHub link from site-content (#350) by @fstubner
• site: lay the hero CTA in one column when there is no desktop button (#349) by @fstubner
• site: rename the shell's style prefix from netscli- to ui- (#348) by @fstubner
• site: move the hero installers and the docs sidebar into site-content (#346) by @fstubner
• site: drop the await on the synchronous preview cleanup (#345) by @fstubner
• site: split the landing page's tier from the shared palette (#343) by @fstubner
• site: commit the cascade equivalence checker (#342) by @fstubner
• site: move the search dialog out of the stack and delete the stack (#341) by @fstubner
• site: move the docs content out of the stack (#340) by @fstubner
• site: move the docs header, sidebar, contents rail and shell out of the stack (#339) by @fstubner
• site: move the docs theme and base rules out of the numbered stack (#338) by @fstubner
• ci: skip the site preview for Dependabot PRs (#337) by @fstubner
• Light-theme and landing-page pass: two dark bands, theme-following chips, and a lot of measuring (#336) by @fstubner
• Drop the mobile docs section-nav row (#333) by @fstubner
• Darken the wordmark on a light page (#331) by @fstubner
• Make the copy buttons dark in the light theme too (#330) by @fstubner
• Fix four inaccurate claims in the site copy (#329) by @fstubner
• Dark code surfaces, a navy band, and two groups in the nav (#328) by @fstubner
• Serve the install scripts from netscli.com and say what the button downloads (#327) by @fstubner
• Give the landing page a light theme that actually works (#326) by @fstubner
• Stop the contents rail at the title band, and square up two insets (#325) by @fstubner
• Collapse the changelog's release cards before the first frame (#324) by @fstubner
• Settle the page height before sizing the capture window (#323) by @fstubner
• Draw the same theme control in both bars (#322) by @fstubner
• Collapse both nav bars at the same width (#321) by @fstubner
• Derive the wordmark's indent and start the contents rail below the hero (#320) by @fstubner
• Collapse forty text colours into a ramp of three (#309) by @fstubner
• Move the shared role tokens where both halves of the site can read them (#308) by @fstubner
• Quieten the theme control's focus ring and drop the contents rail (#307) by @fstubner
• Delete ten declarations that could never take effect, and tighten the budget (#306) by @fstubner
• Name the panel and menu surfaces (#305) by @fstubner
• Stop the visual harness reporting pages that were never really unstable (#304) by @fstubner
• Make a raised surface get darker in the light theme, not lighter (#303) by @fstubner
• Give each theme one neutral for hairlines and washes (#302) by @fstubner
• Give the light theme one accent instead of three (#301) by @fstubner
• Name the three table surfaces instead of repeating them in six files (#300) by @fstubner
• Point 38 hard-coded colours at the tokens that already held them (#299) by @fstubner
• Pin the look of the built site before the override-layer audit (#298) by @fstubner
• Drop the "On this page" marker and settle every rail bar at 1px (#297) by @fstubner
• Mark destructive menu items with a red icon before you hover them (#296) by @fstubner
• Check the Linux side of the crates from a Windows machine (#295) by @fstubner
• Run a scan or inspect opened from a result straight away (#294) by @fstubner
• Record the acceptance pass, and give every step an observable outcome (#293) by @fstubner
• Fail the build...

v0.2.6

What's new in 0.2.6

• refactor(cli): decompose tui/state.rs into 5 focused module files (#67) @fstubner
• refactor(cli): split tui.rs into tui/ module + extract TUI surface from main.rs (#66) @fstubner
• refactor(cli): extract commands.rs from main.rs (#65) @fstubner
• refactor(gui): split App.tsx per-tab JSX into views/*View.tsx (#64) @fstubner
• refactor(cli): rename formatter.rs -> tui_formatter.rs for naming consistency (#63) @fstubner
• fix(gui): wire up Tauri 2 capabilities so the title-bar buttons work (#62) @fstubner
• ci: cut PR runner-minute spend by ~70% (#61) @fstubner

---

Full changelog: v0.2.5...v0.2.6

v0.2.5

What's new in 0.2.5

• release: v0.2.5 windows scan fix + GUI styling fix + 13 dep bumps (#60) @fstubner
• fix(gui): scans return all hosts on Windows + dashboard recent-scans styling (#59) @fstubner
• deps: bump crossterm 0.27->0.28, tui-textarea 0.4->0.7, mdns-sd 0.13->0.19 (#58) @fstubner
• packaging: add schema header to GUI Winget manifest templates (#56) @fstubner
• deps: bump hickory-resolver 0.24 -> 0.26 (closes RUSTSEC-2026-0119) (#55) @fstubner
• release: extend publish.yml with 4 GUI-channel jobs (#54) @fstubner
• packaging: GUI installer manifest templates (Cask, Winget GUI, Scoop, AUR) (#53) @fstubner
• audit: ignore RUSTSEC-2026-0119 (hickory-proto, not reachable in our usage) (#52) @fstubner

Maintenance

• build(deps): bump the rust-patch group across 1 directory with 2 updates (#57) @dependabot[bot]
• build(deps): bump dialoguer from 0.11.0 to 0.12.0 (#48) @dependabot[bot]
• build(deps): bump clap_mangen from 0.2.33 to 0.3.0 (#46) @dependabot[bot]
• build(deps): bump pcap from 1.3.0 to 2.4.0 (#45) @dependabot[bot]
• build(deps): bump dirs from 5.0.1 to 6.0.0 (#51) @dependabot[bot]
• build(deps): bump clap from 4.5.60 to 4.6.1 in the rust-minor group across 1 directory (#43) @dependabot[bot]

---

Full changelog: v0.2.4...v0.2.5

v0.2.4

What's new in 0.2.4

• No changes

---

Full changelog: v0.2.3...v0.2.4

v0.2.3

What's new in 0.2.3

• release: v0.2.3 fix tauri version skew + AUR publish path (#40) @fstubner

---

Full changelog: v0.2.2...v0.2.3

v0.2.2

What's new in 0.2.2

• release: v0.2.2 lockfile fix + workspace bump (recovers v0.2.1 release.yml failure) (#39) @fstubner

---

Full changelog: v0.2.1...v0.2.2

v0.2.1

What's new in 0.2.1

• chore: gitignore + untrack DEVLOG and docs/superpowers/ (#38) @fstubner
• release: automate publish to crates.io / Homebrew / Scoop / Winget / AUR (#37) @fstubner
• site: surface desktop app downloads in the hero (#36) @fstubner
• site: feature prebuilt GUI installers on the Desktop surface card (#35) @fstubner
• site: 4 SEO-targeted FAQ entries (Angry IP / Advanced IP / nmap / home network) (#26) @fstubner
• site: restore alternating left/right rhythm in surfaces section (#31) @fstubner
• release: prebuilt GUI installers + bump to 0.2.1 (#30) @fstubner
• cli: add --concurrency / -j global flag for tuning in-flight ops (#29) @fstubner
• deps: bump pnet stack 0.34 -> 0.35 (closes #21, #23) (#28) @fstubner
• deps: bump sysinfo 0.30.13 -> 0.38.4 (closes #18) (#27) @fstubner
• site+docs: lead with TUI on landing page; README accuracy fixes (#25) @fstubner
• site: retint install section to brand green (#24) @fstubner

Maintenance

• build(deps): bump the scripts-deps group in /scripts with 3 updates (#32) @dependabot[bot]
• build(deps): bump tokio from 1.48.0 to 1.52.1 in the tokio group (#17) @dependabot[bot]
• build(deps): bump the actions group with 2 updates (#34) @dependabot[bot]
• build(deps): bump windows-sys from 0.52.0 to 0.61.2 (#20) @dependabot[bot]
• build(deps): bump unicode-width from 0.1.14 to 0.2.0 (#19) @dependabot[bot]
• build(deps): bump the rust-minor group with 3 updates (#16) @dependabot[bot]
• build(deps): bump the rust-patch group with 8 updates (#15) @dependabot[bot]
• build(deps): bump openssl from 0.10.75 to 0.10.78 in /scripts (#12) @dependabot[bot]
• build(deps-dev): bump vite from 8.0.9 to 8.0.10 in /apps/netscli-gui in the vite-rollup group (#14) @dependabot[bot]
• build(deps-dev): bump vite from 8.0.8 to 8.0.9 in /apps/netscli-gui in the vite-rollup group (#10) @dependabot[bot]

---

Full changelog: v0.2.0...v0.2.1