What go-task/task shipped
Written by FoxPlug from the repository's own releases; not affiliated with Taskfile. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/go-task/task; Taskfile did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of November 2, 2026
What shipped
- Remote Taskfiles that redirect from https to http are now refused unless --insecure is passed, and remote headers are no longer sent across that downgrade. Pull request #3091
- Optional remote includes are now skipped when running with --offline and the include is not cached, instead of failing with a cache miss. Pull request #3081
- The website lockfile was regenerated to pick up security fixes, cutting open Dependabot alerts from 62 down to 12. Pull request #3093
- GitHub Actions dependency lockfiles were adopted across all seven workflows, with a CI job to verify the lockfile. Pull request #3080
- The prealloc linter was enabled in the golangci-lint configuration to flag slice declarations that could be preallocated. Pull request #3085
- Seven grammar errors were fixed in the contributing guide, with wording changes only. Pull request #3090
Why it matters
This week brings two behavior fixes that affect real usage: offline runs with optional remote includes no longer fail on a cache miss, and https remotes can no longer silently drop to plaintext on a redirect. The dependency work on the website lockfile reduces outstanding security alerts, and the remaining alerts are noted as coming from a pinned vite version.
Changelog entry
- Fix(remote): refuse https to http redirects unless --insecure is set; stop sending remote headers on that downgrade Pull request #3091
- Fix: skip optional remote includes on offline cache miss instead of failing Pull request #3081
- Chore(website): regenerate lockfile to pick up security fixes, reducing open alerts from 62 to 12 Pull request #3093
- Chore(ci): adopt GitHub Actions dependency lockfiles across all seven workflows with a verification job Pull request #3080
- Chore(lint): enable the prealloc linter in golangci-lint Pull request #3085
- Docs: fix grammar in the contributing guide Pull request #3090
This week in Taskfile: https remotes no longer silently redirect to http without --insecure, and optional remote includes are skipped on an offline cache miss instead of failing. Also: website lockfile regenerated to cut open security alerts from 62 to 12.
This week in Taskfile: Remote Taskfiles that redirect from https to http are now refused unless --insecure is passed, and remote headers are not sent on that same-host downgrade. Optional remote includes are now skipped when running with --offline and the include is not cached, rather than failing with a cache miss. The website lockfile was regenerated to pick up security fixes, bringing open Dependabot alerts down from 62 to 12; the rest come from vite 5, which vitepress 1.6.x pins. GitHub Actions dependency lockfiles were also adopted across all seven workflows, and the prealloc linter was enabled.
Week of October 26, 2026
What shipped
- Interactive prompts now resolve enum references that use sh variables, so a selection menu appears instead of a text prompt. Pull request #3070
- Choice prompts in interactive mode now support case-insensitive search with a slash, match counts, an empty-results message, and Page Up, Page Down, Home and End navigation. Pull request #3071
- WildcardMatch now escapes regex metacharacters in task names, so a name containing one no longer causes a panic or a wrong match for the whole Taskfile. Pull request #2916
- File watching now detects filesystem changes with fsbroker instead of fsnotify, with deduplication and normalized behavior across operating systems. Pull request #3064
- The release workflow now writes the cask quarantine hook with
postflight_steps, removing the Homebrew deprecation warning on every brew run that touches the go-task cask. Pull request #3084 - A new nightly release, v3.55.0-nightly, includes dependency updates and a docs fix for the website search. Release
Why it matters
This week fixes two problems that hit interactive users directly: enum choices backed by sh variables now show a menu, and large choice lists can be searched and scrolled. Task names containing regex metacharacters no longer break matching for the whole Taskfile, and file watching moves to a more consistent backend. The release workflow change also stops a recurring Homebrew warning.
Changelog entry
- Fix: resolve dynamic enum refs in interactive prompts Pull request #3070
- Feat(input): add search and scrolling to choice prompts Pull request #3071
- Fix: escape regex metacharacters in WildcardMatch Pull request #2916
- Refactor(watch): detect filesystem changes with fsbroker Pull request #3064
- Fix(release): use
postflight_stepsfor cask quarantine hook Pull request #3084 - Release: v3.55.0-nightly Release
This week in Taskfile: interactive choice prompts now support search and paging, and enum refs built from sh variables show a real menu. Task names with regex metacharacters no longer break matching, file watching moves to fsbroker, and the Homebrew cask warning is fixed.
This week's changes to Taskfile: interactive choice prompts now support case-insensitive search, match counts and paging through large lists, and enum references computed by sh variables now show a selection menu instead of a text prompt. Task name matching now escapes regex metacharacters, so one special character in a name no longer panics or mis-matches the whole Taskfile. File watching now uses fsbroker for deduplication and more consistent behavior across operating systems. The release workflow now writes the cask quarantine hook with postflight_steps, which removes the Homebrew deprecation warning. A nightly release, v3.55.0-nightly, is also out.
More from go-task/task on GitHub
Merged pull requests
- feat: use mvdan/sh's BashOpts (#3035, merged September 26, 2026 by pd93) (source)
- fix: unwrap inner TaskError code from TaskRunError (#3041, merged September 26, 2026 by r3wretrhy) (source)
- refactor: functional options (#3037, merged September 26, 2026 by pd93) (source)
- feat(remote): add remote.headers to use HTTP Header (#2976, merged September 19, 2026 by vmaerten) (source)
- feat(site): add versioned Algolia search and configuration export (#3031, merged September 19, 2026 by vmaerten) (source)
- docs: split guide into multiple pages (#3016, merged September 19, 2026 by vmaerten) (source)
- fix: path normalisation in watcher (#3028, merged September 15, 2026 by pd93) (source)
- docs: redesign installation page (#3025, merged September 13, 2026 by vmaerten) (source)
- docs: redesign homepage (#3010, merged September 8, 2026 by vmaerten) (source)
- feat: publish versioned homebrew casks (#3023, merged September 8, 2026 by vmaerten) (source)
- docs: improve public page accessibility and metadata (#3009, merged August 30, 2026 by vmaerten) (source)
- docs: describe remaining documentation pages (#3008, merged August 30, 2026 by vmaerten) (source)