# What changed in microsandbox

> 38 changes in microsandbox 0.7 from its official release notes, upgrade guides and advisories: 1 breaking, 3 security, 12 new APIs and options. Each one cited. Sources checked 2026-10-19. HTML: https://unstale.sh/npm/microsandbox/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## microsandbox 0.7

### Breaking changes

- Disk restores that would silently drop host mounts are refused. (0.7.8) — [release notes](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.8)

### Security

- Truncated HPACK blocks are rejected before decoding. (0.7.8) — [release notes](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.8)
- Applies exec limits before switching users. (0.7.7) — [release notes](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.7)
- Prevents secret leaks and corrects adapter behavior. (0.7.7) — [release notes](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.7)

### New APIs and options

- An opt-in helper provides application certificate trust. (0.7.8) — [release notes](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.8)
- Filesystem state limits can be configured for snapshots. (0.7.8) — [release notes](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.8)
- Secret substitution can be scoped to specific header fields. (0.7.8) — [release notes](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.8)
- The msb restore command accepts --mount-disk. (0.7.8) — [release notes](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.8)
- Detached jobs can be owned by the runtime. (0.7.8) — [release notes](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.8)
- Adds cache cleanup functionality. (0.7.7) — [release notes](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.7)
- Adds controls for command tree depth and display. (0.7.7) — [release notes](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.7)
- Adds DAX support to the filesystem. (0.7.7) — [release notes](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.7)
- Adds an option to disable guest clock synchronization. (0.7.7) — [release notes](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.7)
- Adds support for an HTTP CONNECT outbound proxy. (0.7.7) — [release notes](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.7)
- Makes the filesystem init binary optional. (0.7.7) — [release notes](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.7)
- Adds storage usage reports. (0.7.7) — [release notes](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.7)

### Performance

- Reduces host CPU usage for paused sandboxes. (0.7.7) — [release notes](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.7)

### Behavior and default changes

- Published ports support ranges. (0.7.8) — [release notes](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.8)

### Fixes and other changes

- Cached paths are updated after Windows directory renames. (0.7.8) — [release notes](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.8)
- Disk-only restores from snapshot archives are allowed. (0.7.8) — [release notes](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.8)
- Memory limits and usage now follow live memory resizes. (0.7.8) — [release notes](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.8)
- The relay keeps running if a local client's arena closes mid-route. (0.7.8) — [release notes](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.8)
- SQLite locks are preserved during Linux identity checks. (0.7.8) — [release notes](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.8)
- Storage cleanup and snapshot recovery are repaired. (0.7.8) — [release notes](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.8)
- Windows cleanup and usage accounting are completed. (0.7.8) — [release notes](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.8)
- Keeps earlier DNS answers bound to a domain. (0.7.7) — [release notes](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.7)
- Surfaces guest initialization failures. (0.7.7) — [release notes](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.7)
- Accepts reordered image metadata when importing an archive. (0.7.7) — [release notes](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.7)
- Regenerates the image VMDK descriptor when importing an archive. (0.7.7) — [release notes](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.7)
- Provides a utoipa schema for nat64_prefixes. (0.7.7) — [release notes](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.7)
- Publishes ports without host routes. (0.7.7) — [release notes](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.7)
- Includes the peer's message in rejected operation errors. (0.7.7) — [release notes](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.7)
- Reads restored resource targets while the sandbox is still starting. (0.7.7) — [release notes](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.7)
- Allows removing a sandbox that never started. (0.7.7) — [release notes](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.7)
- Supports secret policy modification options in Python. (0.7.7) — [release notes](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.7)
- Creates SFTP files and directories as the session user. (0.7.7) — [release notes](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.7)
- Reports symlinked bind mount roots at create time. (0.7.7) — [release notes](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.7)
- Drains TCP responses before closing. (0.7.7) — [release notes](https://github.com/superradcompany/microsandbox/releases/tag/v0.7.7)