Release Notes

🛡️ Security

• Fixed a security issue where task outputs being hydrated from the remote cache can overwrite files
  outside the output list, if the manifest in the remote cache has been compromised.

🧰 Toolchains

• Go
  • Fixed a go.mod parsing regression that failed to parse tool ().

Install moon_cli 2.3.3

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/moonrepo/moon/releases/download/v2.3.3/moon_cli-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/moonrepo/moon/releases/download/v2.3.3/moon_cli-installer.ps1 | iex"

Download moon_cli 2.3.3

Release Notes

🚀 Updates

• Added panic handling to the daemon server, to capture and log unexpected panics.
• Updated the pipeline to continue if the daemon client cannot connect, instead of failing the whole
  pipeline.

🐞 Fixes

• Potential fix for the daemon client connection refused error. If this problem persists,
  temporarily disable the daemon and report an issue.
• Fixed an issue with project:^ inputs where resolved files would be excluded when project sources
  overlap.

🧰 Toolchains

• Go
  • Added an inferRelationshipsPackages setting to customize the package patterns passed to
    go list --deps.
  • Updated go list --deps relationship inference to scan all packages (./...) by default, so
    dependencies imported only from subdirectories (internal/, pkg/, ...) are now inferred.

Install moon_cli 2.3.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/moonrepo/moon/releases/download/v2.3.2/moon_cli-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/moonrepo/moon/releases/download/v2.3.2/moon_cli-installer.ps1 | iex"

Download moon_cli 2.3.2

Release Notes

🚀 Updates

• Added in-memory caching to certain toolchain operations, primarily around locating executables.
• Improved daemon startup performance by loading the workspace graph in the background after the
  server is ready.
• Updated plugin distribution to use ghcr.io instead of raw URLs, which should improve reliability
  and performance of plugin downloads.

🐞 Fixes

• Reworked the daemon connect/ready logic to possibly fix some Windows connection issues.
• Fixed an issue where the task dependency cacheStrategy inferrence was not working correctly
  based on what experiments are enabled.
• Fixed an issue where locks created at .moon/cache/locks would not be cleaned up.

⚙️ Internal

• Updated proto to v0.57.4 from 0.57.3.

Install moon_cli 2.3.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/moonrepo/moon/releases/download/v2.3.1/moon_cli-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/moonrepo/moon/releases/download/v2.3.1/moon_cli-installer.ps1 | iex"

Download moon_cli 2.3.1

Release Notes

🚀 Updates

• Cache
  • Added a new experiment that stores task outputs in a local content-addressable storage (CAS)
    cache, sharing the same format used by the remote cache. Enables deduplicated storage across
    tasks and a unified cache shape locally and remotely.
    • Enable with the experiments.casOutputsCache setting in .moon/workspace.*.
  • Added a new top-level cache setting in .moon/workspace.* for tuning the content-addressable
    storage (CAS) cache.
• Daemon
  • When pipeline.autoCleanCache is enabled (by default), the auto-clean will now run in the
    daemon, instead of at the tail-end of the main process.
  • When utilizing webhooks, the requests will now be made from the daemon, instead of the main
    process.
• Git
  • Added SHA256 support for commit hashes. This is in preparation for Git's transition to SHA256 as
    the default hash algorithm.
• Hash
  • Added a new experiment that replaces the VCS/Git based file hashing mechanism with a custom
    native implementation that runs within our task pool. This can improve performance by 10-50%.
    • Enable with the experiments.nativeFileHashing setting in .moon/workspace.*.
• MCP
  • Added get_template and get_templates tools so AI coding assistants can discover templates
    and inspect their variable schemas before calling generate.
• Tasks
  • Added tags support to tasks through new tags and options.mergeTags settings.
    • Added taskTag field support to MQL.
    • Added --tags option support to moon query tasks.
    • Updated targets to support the # tag syntax in the task scope, allowing you to reference
      tasks by their tags. For example: app:#quality.
  • Added a cacheStrategy field to task dependencies that controls how a dependency's changes
    invalidate the current task's cache. Supports hash, ignored, and outputs — the latter
    mixes in the dependency's output files instead of its hash, so build tasks are only invalidated
    when upstream outputs change, not when upstream inputs change.
    • Behavior change: when cacheStrategy is omitted, the default is now hash if the
      dependency declares outputs and ignored if it doesn't, instead of always hash. Tasks that
      depend on output-less tasks (e.g. lint, test) will see fewer cache invalidations. Set
      cacheStrategy: 'hash' explicitly to restore the previous behavior for a given dependency.
• Performance
  • Reduced task target memory footprint by 50-100%.

🧰 Toolchains

• JavaScript
  • Added support for Deno v2.8.
    • Will use deno ci for installs in CI when deno.lock exists and the configured Deno version
      is >= v2.8.
    • Will pass --prod to deno install for production installs when the configured Deno version
      is >= v2.8.
    • Will resolve catalog: references in package.json files using catalogs declared in a root
      deno.json.
• Python
  • Added unstable support for uv pip.
    • Can be configured using unstable_python.packageManager: 'uv-pip' in .moon/toolchains.*.
    • Will inherit install arguments from unstable_pip.installArgs.
    • Will inherit sync arguments from unstable_uv.syncArgs.
    • Will inherit venv arguments from unstable_uv.venvArgs.

🐞 Fixes

• Fixed a glob regression where unbounded walks could be up to 10x slower.

⚙️ Internal

• Updated proto to v0.57.3 from 0.56.4.
• Updated Rust to v1.96.0.
• Updated dependencies.

Install moon_cli 2.3.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/moonrepo/moon/releases/download/v2.3.0/moon_cli-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/moonrepo/moon/releases/download/v2.3.0/moon_cli-installer.ps1 | iex"

Download moon_cli 2.3.0

Release Notes

🐞 Fixes

• Fixed an issue where the InstallDependencies action would scan manifests within the vendor
  directory, which could cause issues with some package managers.

🧰 Toolchains

• Go
  • Added support for Go v1.24 ignore in go.mod and go.work.

Install moon_cli 2.2.6

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/moonrepo/moon/releases/download/v2.2.6/moon_cli-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/moonrepo/moon/releases/download/v2.2.6/moon_cli-installer.ps1 | iex"

Download moon_cli 2.2.6

Release Notes

🐞 Fixes

• Fixed an issue where dot folders would be ignored during globs. The .git folder is still always
  ignored.
• Fixed an issue where nested node_modules folders would be ignored during globs. The
  node_modules folder at the glob target root is still always ignored.
• Fixed an issue where toolchain specific fields, like versionFromPrototools, were missing from
  the generated JSON schemas.
• Fixed an issue where commands executed during toolchain actions (like setup environment) may
  trigger a file system deadlock.

🧰 Toolchains

• Python
  • Updated venv commands to be skipped during environment setup if the directory already exists.
    Configure --clear to force re-initializing.

Install moon_cli 2.2.5

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/moonrepo/moon/releases/download/v2.2.5/moon_cli-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/moonrepo/moon/releases/download/v2.2.5/moon_cli-installer.ps1 | iex"

Download moon_cli 2.2.5

Release Notes

🐞 Fixes

• Fixed an issue where proto's auto-clean would remove tools installed by moon as they weren't
  marked as used.
• Fixed a regression where moon would fail with Failed to execute git and capture output when
  .gitmodules referenced a submodule that hadn't been checked out (e.g. update = none).
  Uninitialized submodules are now skipped, matching the v1 behavior.
• Fixed an issue where toolchain dependency installation would be skipped even when the vendor
  directory does not exist.
• Fixed an issue where failing actions would not re-run again because their hash would be persisted,
  even on failure.
• Fixed an issue where WouldBlock errors would trigger when attempting to flush buffered output to
  the console.
• Fixed an issue where --upstream=none would error for missing dependencies.

🧰 Toolchains

• Python
  • Fixed an issue where the wrong arguments were passed to uv sync depending on whether proto is
    managing the Python version.
  • Fixed an issue where venv paths were not available to commands run through the toolchain, like
    uv sync.

⚙️ Internal

• Updated dependencies.

Install moon_cli 2.2.4

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/moonrepo/moon/releases/download/v2.2.4/moon_cli-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/moonrepo/moon/releases/download/v2.2.4/moon_cli-installer.ps1 | iex"

Download moon_cli 2.2.4

Release Notes

🐞 Fixes

• Fixed a potential deadlock in the action pipeline when running many sync heavy operations.

Install moon_cli 2.2.3

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/moonrepo/moon/releases/download/v2.2.3/moon_cli-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/moonrepo/moon/releases/download/v2.2.3/moon_cli-installer.ps1 | iex"

Download moon_cli 2.2.3

Release Notes

🚀 Updates

• Updated the VS Code extension to point to the v2 JSON schemas. If you are still using moon v1,
  you'll need to pin to an older VS Code extension version until you upgrade to moon v2.

🐞 Fixes

• Fixed a regression in plugin loading that reduced performance of graph operations.
• Fixed an issue where the unpack extension would trigger a missing plugin locator error.

🧰 Toolchains

• Python
  • Fixed the Python toolchain depending on pip/uv, when it should be reversed.

⚙️ Internal

• Updated proto to v0.56.4 from 0.56.3.
• Updated dependencies.

Install moon_cli 2.2.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/moonrepo/moon/releases/download/v2.2.2/moon_cli-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/moonrepo/moon/releases/download/v2.2.2/moon_cli-installer.ps1 | iex"

Download moon_cli 2.2.2

Release Notes

🚀 Updates

• Added request retry support (via proto), that will retry up to 3 times with exponential backoff
  for transient errors (network issues, rate limits, etc).
• Improved async affected tracking by another 5-10%.
• Updated PowerShell commands to use -EncodedCommand instead of -Command to avoid
  quoting/escaping issues. Let us know if you run into any issues with this change.

🐞 Fixes

• Fixed --summary not being respected in moon ci.
• Fixed issues with graph visualizer commands failing with a JavaScript error after the v2.2 graph
  changes.
• Fixed an issue where checking the remote cache for an entry before the task execution could
  cause the task to fail if the remote cache check errored. We now treat remote cache errors as
  cache misses, and allow the task to execute.
• Fixed an issue where filtered graphs would point to the wrong data because indexes changed.

🧰 Toolchains

• JavaScript
  • Fixed pnpm-lock.yaml parsing for pnpm v10's multi-document lockfiles, which are written when
    managePackageManagerVersions is enabled (the default).
• TypeScript
  • Updated project references to start with ./ in preparation for the removal of baseUrl in
    TypeScript v7.

⚙️ Internal

• Updated proto to v0.56.3 from 0.56.1.
• Updated Rust to v1.95.0.
• Updated dependencies.

Install moon_cli 2.2.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/moonrepo/moon/releases/download/v2.2.1/moon_cli-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/moonrepo/moon/releases/download/v2.2.1/moon_cli-installer.ps1 | iex"

Download moon_cli 2.2.1