# Release Announcement v0.3.0 (August 31 2023) **URL:** \ **Category:** Announcements\ **Created:** [August 31, 2023, 4:10pm UTC](https://discourse.flox.dev/t/release-announcement-v0-3-0-august-31-2023/791 "2023-08-31T16:10:19Z")\ **Posts on this page:** 8\ **Page:** 1

**Author:** ![robinbrantley](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.flox.dev/robinbrantley/32/39_2.png) [@robinbrantley](https://discourse.flox.dev/u/robinbrantley)\ **Post date:** [August 31, 2023, 4:10pm UTC](https://discourse.flox.dev/t/release-announcement-v0-3-0-august-31-2023/791/1 "2023-08-31T16:10:19Z")

Hi everyone! A new release is now available. With this update we are starting to drive towards the flox CLI general availability (1.0) release as described in our earlier [Discourse announcement](https://discourse.flox.dev/t/upcoming-changes-in-the-flox-cli-0-3-x/787). This first release in the 0.3.x series begins that work with a greater than usual number of user-facing changes and bug fixes. Check out the release notes [here](https://github.com/flox/flox/blob/main/doc/release-notes/rl-0.3.0.md) for more details, and upgrade via your preferred package manager [here](https://floxdev.com/docs/install-flox/). Happy hacking! ---

---

**Author:** ![robinbrantley](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.flox.dev/robinbrantley/32/39_2.png) [@robinbrantley](https://discourse.flox.dev/u/robinbrantley)\ **Post date:** [September 2, 2023, 3:40pm UTC](https://discourse.flox.dev/t/release-announcement-v0-3-0-august-31-2023/791/3 "2023-09-02T15:40:01Z")

---

**Author:** ![anon59756714](https://avatars.discourse-cdn.com/v4/letter/a/48db29/32.png) [@anon59756714](https://discourse.flox.dev/u/anon59756714)\ **Post date:** [September 4, 2023, 12:20pm UTC](https://discourse.flox.dev/t/release-announcement-v0-3-0-august-31-2023/791/4 "2023-09-04T12:20:07Z")

Hi, @robinbrantley, great changes and nice progress 🙂 I have question about flox-gh binary, why the only method of saving creds is saving it to disk? Is that a Nix problem that it does not connect to OS? With GH token being on the line I do not like the idea of using InsecureStorage. ---

**Author:** ![limeytexan](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.flox.dev/limeytexan/32/10_2.png) [@limeytexan](https://discourse.flox.dev/u/limeytexan)\ **Post date:** [September 4, 2023, 5:25pm UTC](https://discourse.flox.dev/t/release-announcement-v0-3-0-august-31-2023/791/5 "2023-09-04T17:25:05Z")

> [@anon59756714](#): > > I have question about flox-gh binary, why the only method of saving creds is saving it to disk? Is that a Nix problem that it does not connect to OS? With GH token being on the line I do not like the idea of using InsecureStorage. Good question and thank you for highlighting! First things first - if you are at all concerned that your flox CLI token may have been compromised, please navigate to [your flox CLI OAuth App page](https://github.com/settings/connections/applications/b819ed5468f121e0286a) and select the `Revoke access` button. Secondly, we completely agree - by way of background, we encountered a collision between the tokens being stored in the keychain for the `gh` app, employed a workaround as a temporary measure and neglected to return back to it. It was my mistake and it should only take a few hours to reinstate use of the keychain - I’ll get on that now and let you know when there’s a new version to test available in the `flox/prerelease` environment. If it helps to allay your concerns, I also wanted to give some background to the `flox-gh` app. As I’m sure you’ve already realized `flox-gh` is a build of GitHub’s `gh` modified to authenticate against GitHub OAuth using a flox OAuth app ID which generates a separate token for the express purposes of authenticating with our flox cloud services. Notably, the token for this app has _no scope privileges_ as you can confirm by way of the `flox auth status` command: ```auto flox [flox/prerelease default] [brantley@clubsoda:~/src/flox]$ flox auth status github.com ✓ Logged in to github.com as limeytexan (/home/brantley/.config/flox/gh/hosts.yml) ✓ Token: gho_ ************************************ ✓ Token scopes: none ``` This is _much_ different from the “gist, read:org, repo, workflow” scopes of tokens required by the `gh` app. For what it’s worth I am equally paranoid about the storage of those GitHub tokens! Again, many thanks for highlighting this issue - I will get back to you with an update ASAP. 👍 ---

**Author:** ![limeytexan](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.flox.dev/limeytexan/32/10_2.png) [@limeytexan](https://discourse.flox.dev/u/limeytexan)\ **Post date:** [September 4, 2023, 7:33pm UTC](https://discourse.flox.dev/t/release-announcement-v0-3-0-august-31-2023/791/6 "2023-09-04T19:33:16Z")

The patch which restores secure token storage is now available as flox/flox [PR255](https://github.com/flox/flox/pull/255). Again, I’ll let you know when it is available for use in the `flox/prerelease` environment. Thanks again for the prompt and thorough feedback! ---

**Author:** ![robinbrantley](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.flox.dev/robinbrantley/32/39_2.png) [@robinbrantley](https://discourse.flox.dev/u/robinbrantley)\ **Post date:** [September 5, 2023, 7:33pm UTC](https://discourse.flox.dev/t/release-announcement-v0-3-0-august-31-2023/791/7 "2023-09-05T19:33:06Z")

FYI: the updated version (flox-0.3.3-r625) is now available in the flox/prerelease environment. We are also in the process of publishing updated flox installers which I will be announcing shortly. 🙂 Thanks again @anon59756714 for calling this important issue to our attention. ---

**Author:** ![anon59756714](https://avatars.discourse-cdn.com/v4/letter/a/48db29/32.png) [@anon59756714](https://discourse.flox.dev/u/anon59756714)\ **Post date:** [September 11, 2023, 4:21pm UTC](https://discourse.flox.dev/t/release-announcement-v0-3-0-august-31-2023/791/8 "2023-09-11T16:21:07Z")

Hi, thank you for looking at that problem 🙂 I wasn’t aware of the collision, I thought that this was changed by the renaming. I noticed that lack of scopes but I did not have time to investigate what scope-less actually mean. I see that PR is merged, when I have time I will upgrade flox again and hopefully break more stuff 😃