From d511fcf120783de125b645c63b1bb333586dcfd8 Mon Sep 17 00:00:00 2001
From: chogarcia <choishere@gmail.com>
Date: Mon, 12 Oct 2026 16:10:57 +0200
Subject: [PATCH] release: 0.4.0

---
 CHANGELOG.md      | 12 +++++++++++-
 package-lock.json |  4 ++--
 package.json      |  2 +-
 3 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 815762e..8395362 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## Unreleased
 
+## 0.4.0 — 2026-10-12
+
+### Behaviour changes
+
+- `sf push` now skips dotfiles (`.env`, `.git`, ...) by default; pass
+  `--include-dotfiles` to upload them as before.
+- Sign-in refuses a server answer of auth version 1 for an account previously
+  signed in with version 2; pass `--allow-legacy-login` to override.
+- Symlinks are skipped instead of followed.
+
 ### Security
 
 - **Symlinks are not followed.** `push`, `sync` and the agent list files with
@@ -28,7 +38,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - 0-byte files: uploaded as a header-only cipher-v3 object with the server's
   empty-file proof when `/api/files/upload-capabilities` says `emptyCipherV3`;
   otherwise skipped with a clear message (exit code 2) before any session.
-
+- New uploads send a v6 row-bound encrypted name from upload start (#14).
 - **Downgrade pin for sign-in.** After a sign-in with a login secret (auth
   version 2), the CLI records the account (a SHA-256 of the email) in
   `~/.shieldfive/auth-pins.json` (mode 0600). A later server answer of
diff --git a/package-lock.json b/package-lock.json
index 1c034e6..1121286 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@shieldfive/cli",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@shieldfive/cli",
-      "version": "0.3.1",
+      "version": "0.4.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@noble/ciphers": "^2.1.1",
diff --git a/package.json b/package.json
index 608e37a..9674268 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@shieldfive/cli",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "type": "module",
   "description": "Open-source command-line client for ShieldFive: encrypts files on your machine before upload (contents: AES-256-GCM under an ML-KEM-1024 + X25519 hybrid key; names: AES-256-GCM under your vault key) and pushes or syncs them to your vault. Read the code.",
   "license": "Apache-2.0",