With the major releases that happened in July, August was always going to be a quieter month. A lot of our sprints this last month were dedicated to ensuring the security and stability of Minimal as a whole. We also shipped a lot of quality-of-life updates and a few new capabilities that we find especially exciting: a new session dashboard, lifecycle hooks, and exciting new package updates.
A full-screen session dashboard
The headline feature of the month is min dash, a full-screen Terminal User Interface (TUI) that allows you to browse, inspect, and manage your sessions across every running provider. Additionally, each session now shows its git branch, repo, and worktree so you can orient yourself to the session without needing to fully attach. We’ve also implemented a fix for cursor-position sequences (used by btop) where the terminal output was breaking the preview pane specifically in dash sessions.
min dash in action
A scripted checklist: session lifecycle hooks
With loadouts officially live, we were excited to increase their value as quickly as possible. That’s why one of the first capabilities we introduced was lifecycle hooks specifically for sessions. These lifecycle hooks allow users to define scripts for each transition point, giving you cleaner workflows. Hooks are executed in the sandbox at these points:
on_activateon_attachon_detachon_destroy
This is particularly useful for building agent workflows on top of Minimal, as it wires the session lifecycle directly into your automation without polling or side channels.
Shiny new packages
Minimal’s core is our package library, which is why it’s important for us to be both thorough and accessible. Across the month, we added roughly 29 new packages, including:
Reverse engineering: capstone, gdb, gef, ghidra, rizin, upx, and fq.
WebAssembly and compilation: binaryen, emscripten, bindgen, and gn.
Game development: raylib, raygui, odin, and Lua 5.1 through 5.4.
Developer tooling: biome, grpc, rsync, fx, vlt, libarchive, and helix-grammars.
Packages are updated on our end to ensure all builders have access to the best tools. We updated over 100 packages in August, notably:
- Chromium 151 → 152, which contained a security update
- ffmpeg 8.1 → 9.0
- grafana 12.4 → 13.1
- lerna 9.0 → 10.0
- openssh 10.4p1 → 10.5p1
- postgres 18.4 → 18.6
- tailscale 1.98.9 → 1.102.2
- uv 0.11 → 0.12
Now with 95% more history!
We’ve added historical records to our package function, available for everyone! After authenticating with the locked_commit from your .toml file, you can download an SBOM for a package exactly as it was in a past commit. Compare a package’s dependencies between two of its versions and fetch snapshots of multiple packages as JSON files directly from the Packages API. Whether you’re working on your supply chain or auditing what went into a past build, you deserve to know exactly what goes into your build at all times.
Also new!
There were a few other items that we wanted to mention.
SFTP
We changed the way that SFTP functions by replacing the single-root layout. Paths are now rooted at / with separate /workbench and /home exports. This is a breaking change: if you reference paths directly under /, you need to switch to /workbench/.... We also hardened traversal, symlink-escape, and chmod-softlock protections. Finally, SFTP error responses no longer include host-path details.
It’s a bit less buggy
We discovered that a path-traversal bug let a raw-file output in a client-supplied minimal.toml read arbitrary files off the host. This has since been patched. Archive extraction was hardened against symlink escapes and decompression bombs.
Lightning round
- A JSON parser panic on adversarial input in
jq::parse_filewas fixed. - An HTTP/2 denial-of-service vulnerability (RUSTSEC-2026-0258) was patched via an h2 dependency bump in v0.5.3.
- We backported 10 CVE fixes to libssh2, including one that was rated critical. While the upstream hasn’t been released yet, we dropped the setuid bit from mount/umount in util-linux to close two local privilege escalation CVEs that were marked as unfixable.
- Reliability fixes for two sources of non-deterministic OCI image digests: a stack overflow from deeply nested config values, and a sandbox2 listener panic on socket cleanup races.
- Signal-killed exec-channel tasks now report 128 + signal instead of a generic 1, which makes debugging significantly less frustrating.
Onward!
August might have been quiet quality-of-life updates, but wait until you see what we’re cooking for September. If you’re running into any issues or have thoughts on min dash, we’d love to hear from you in our Discord community. And if you haven’t tried Minimal yet, getting started only takes a few minutes.
Just like every YouTuber with over 1,000 subscribers, we’ve now got merch! If you’re interested in confusing some normies, we’ve got a brand new store with snazzy items like this:
—dangerously-skip-permissions t-shirts from Minimal