The theme for September was trust and we’re very excited about the items we released. Along with our usual package updates, you can now see exactly how a package was built and who vouches for it. Loadouts and sessions have been updated as well to continue streamlining the building process.
New provenance features
Each package page now includes a Provenance tab that shows whether a signed build attestation exists and important information at a glance. It relays crucial details like the artifact digest, the builder, the source commit it was built from, its resolved dependencies, and whether the signatures check out. The same data is available at /api/pkgs/{name}/attestation.json and through the MCP get_attestation tool, so an agent can verify a package as easily as you can.
Another new addition from last month: an easier way to tell a package’s security. Our own 0–100 category scores are gone, and in their place is the project’s OpenSSF Scorecard aggregate, an automated health check on a 0–10 gauge. From the scorecard, you can open every individual check, its score, and OpenSSF’s reasoning. The scorecard reference explains where the number comes from and includes guidance for maintainers who want to improve theirs, right down to a prompt you can hand to a coding agent.
Loadouts that travel with you
Loadouts got more portable. As of v0.6.0, a loadout can live in its own directory at <config>/minimal/loadouts/<name>/loadout.toml. Definitions, assets, and hook scripts form one self-contained unit you can git clone into place. Files copied into a session can reference those assets with $LOADOUT_ROOT instead of hard-coding an absolute path that breaks the moment your config directory moves.
Files copied into a session keep their permission bits on the way into the session, so a script arrives executable and a 0600 key no longer lands world-readable. We’ve also patched the issue with .bashrc, so files copied into the session via loadout will actually take effect in this shell. A file source naming a plain directory expands recursively instead of silently copying nothing, and a read-only mapping with a missing source now fails at spawn with the host path named rather than running against an empty directory and exiting 0. Finally, we added extra elements that builders can define.
Loadouts are something we’re continually tweaking, and the changes implemented last month are already well used by our team. We were careful to make sure that sessions got a similar amount of attention!
Sessions that don’t get stuck
A good chunk of September went into making sure nothing can quietly wedge your sessions. A stalled host no longer holds up every session RPC, where ListSessions, GetSessionRecord, and CreateSession could previously hang for minutes. A client that stops reading can no longer freeze a session, min session attach no longer hangs without a timeout, and min session exec returns when the child exits rather than waiting on a backgrounded grandchild to let go of its pipes.
When the CLI and daemon are on different builds, min now refuses up front and names both versions along with the fix, instead of failing partway through activation and tearing down what it had already created. On the networking side, one network provider now serves every sandbox path, and a task in an own-IP session gets its own address instead of silently falling back to the host’s network.
The final session change: the default session detach chord has moved from ctrl-w to ctrl-] then d. The kernel’s line discipline treats ctrl-w as a special key and was swallowing it before Minimal ever saw it. If you’d prefer something else, the chord is now configurable in the new [session-keys] config section.
Making everything quicker
Getting Started leads with the shortest path in: the installer, min init, and min session activate --attach. That’s three commands, with no personal access token (PAT), keychain entry, or account required.
On macOS and Linux, concurrent min commands that cold-start the VM no longer report that minvmd failed to start when a daemon is in fact running. min add and min update also skip the host artifact cache warm-up when sessions are VM-backed, saving bandwidth and disk on artifacts no session would have used.
For the agents too!
Keeping everything agent friendly is a part of our building process, and in September we worked to make it easier for them to read. Every documentation page now has a plain-markdown mirror at its URL plus .md. /llms-full.txt concatenates the docs, blog, and changelog into one document for agents that want everything in a single fetch. The /llms.txt index now lists every docs page and blog post. Inside a session, npm i -g now installs into ~/.local instead of failing against the read-only package store: a small fix that matters a lot to agents that install their own tools.
Our personal favorite agent gets some extra treatment (we weren’t paid for this shoutout, but we are open to sponsorship opps.) The new claude metapackage pairs claude-code with the Minimal session plugin, so min add --session claude gets you both. claude-code itself moved to 2.1.284 over the month, adding support for Claude Fable 5.1, Opus 5.5, and Sonnet 5.5, and the Minimal plugin now ships its guidance from the pinned minimal-skills bundle at 0.6.0.
Security hardening
We also still care about security. Very much, in fact.
- The
curl | shinstaller now wraps its body in amain()function invoked on the final line, so a truncated download fails to parse instead of partially running. - We updated rustls for RUSTSEC-2026-0285, where TLS 1.3 handshake messages were incorrectly accepted across encryption level boundaries.
- openssl 3.6.4 addresses 11 CVEs, including 2 rated critical.
- The macOS microVM root filesystem picked up fixes for 32 CVEs across stale Alpine pins and openssl. Where upstream hasn’t shipped a fix yet, we backported it ourselves:
- python 3.14.7 carries 5 CVE fixes ahead of upstream, including two tarfile bugs that could write outside the destination directory.
- unzip 6.0 picked up 3 memory-safety fixes from Debian’s patch series.
- lua51 got a fix for CVE-2014-5461, since Lua 5.1 is closed upstream at 5.1.5.
Tidying everything up
We’ve taken some time to clarify some of the common failures we’ve seen, as well as shift some of the functions that people are using every day. We’ve adjusted these failures:
- If an activation can’t compose, it now names the directory it ran from and says no session was created.
- Activating a path that already has a session warns you and points at
min session attach, before creating the new session. - A
minimal.tomlkey at the wrong nesting level gets reported at its correct path instead of an unknown field. For example,lifecycle_hooksbelongs under[[session.lifecycle_hooks]]. - A task command containing
%{, almost always curl’s-w "%{http_code}", now names the cause and shows the working escape rather than surfacing a bare Nickel error.
And we’ve polished these commands:
min addrenders a live progress tree while packages download.min initpicks deterministically among equally-ranked stacks.min updatenow explains what it actually does. It will re-pin[upstream]and any sideloads to each tracking branch’s head, not updateminitself.- Diagnostic bundles from
min bugcapture more of the necessary information, including terminal details, shutdown cause, host memory, and thesessions/,tasks/,logs/, andvcs/directories.
Even more packages
Minimal’s package library is core to what we offer, and just like every other month, we added a bunch more in September. 36 to be exact, including:
Language servers and editors: dev-language-servers (a metapackage covering twelve languages), jdtls, lua-language-server, ols, ruby-lsp, zls, and emacs-site-lisp.
Formal verification: aeneas-latest, cadical, and leangz.
Encryption and signing: gnupg and its supporting libraries, libassuan, libgcrypt, libgpg-error, libksba, and npth.
Coding agents: claude, goose, and plannotator.
Developer tooling: cargo-nextest, dotenvx, git-lfs, go-swagger, herdr, httpie, mariadb (client only), podman-remote, prettier, tuicr, typescript, and yarn.
System utilities: iputils, lsof, tree, which, and xdg-utils.
We keep packages current so you don’t have to think about it. Notable version bumps across the month include:
- openssl 3.6.3 → 3.6.4 (security update)
- Chromium 152 → 153 (security update)
- jdk 21.0.10 → 21.0.12.1 (security update)
- claude-code 2.1.233 → 2.1.284
- emacs 30.2 → 31.1
- go 1.26.6 → 1.27.1
- node 25.8.2 → 26.10.0
- pnpm 11.21.0 → 12.5.1
- rust 1.97.1 → 1.98.1
- terraform 1.15.8 → 1.16.3
O Canada!
Our roots are important to us (ignore the couple Americans on our team), so we’ve taken a step to highlight the relevant tech contributions. Across the site, you’ll find a maple-leaf badge on packages created or maintained by Canadian companies or developers. There is also a new row in the package search filter: “Made by Canadians.” The same fact is exposed as maintainerCountry in the JSON API and MCP tools.
Looking ahead
Minimal remains transparent about what it builds and more forgiving when things go sideways. Get started quicker, never run unidentified items, and trust… but verify. And the next chapter is already out: Minimal 0.7.0, the networking release, shipped today. A session can now have its own address, a name you can open in a browser, rules for what it may reach, and ports it publishes while it runs.
If you have thoughts on our September ships, we’d love to hear from you in the Discord community. And if you haven’t tried Minimal yet, it’s the only way to run in complete isolation on your favorite local machine. Download it now.