[deps-release-notes] awf — upstream release action items

Rolling upstream release action items — `awf`

This is the single canonical tracking issue for action items from new awf releases. The update-awf-version workflow appends a comment here for each version bump going forward — the most recent activity lives in the comments below. This body consolidates everything filed so far.

Latest pinned version covered: 0.27.21

Consolidated history (earliest → latest)

`0.25.48` → `0.25.60` (was #851)

OTel distributed tracing in api-proxy (v0.25.51): api-proxy now emits OTel traces; ado-aw could expose config to help consumers use this.
ARC/DinD split-filesystem auto-detection (v0.25.52): AWF auto-detects DinD split filesystem via sentinel probe; ado-aw docs may need updating.
Middle-power model fallback (v0.25.53): api-proxy supports model fallback when primary is unavailable; ado-aw could expose this.
Anthropic WIF support (v0.25.58): api-proxy supports Anthropic WIF schema fields + OIDC validation.
Pre-startup model validation via requestedModel config (v0.25.58): api-proxy validates requested model before startup; ado-aw may wish to populate this field.

`0.25.48` → `0.25.63` (was #859)

Security: proxy auth normalization hardened (v0.25.49): Prevents malformed Authorization headers from reaching the upstream API.
Responses API cache reads in token usage rollups (v0.25.63): Fixes under-reporting of cached token reads; improves ado-aw audit accuracy.

`0.25.65` → `0.25.66` (was #902)

Azure/AWS/GCP OIDC support in Copilot adapter (v0.25.66): api-proxy supports cloud OIDC credential injection; ado-aw could expose via engine:/network: front-matter.
Budget fields in token-usage.jsonl (v0.25.66): maxTurns and budget fields now persisted; ado-aw audit module could surface these in AuditData.

`0.25.65` → `0.25.68` (was #930)

GITHUB_COPILOT_INTEGRATION_ID forwarding fix (v0.25.67): AWF now correctly forwards it as COPILOT_INTEGRATION_ID to the api-proxy.
PAT-safe integration ID + model name normalization (v0.25.68): Regression fix from v0.25.67; normalizes legacy CAPI model names.

`0.25.65` → `0.27.0` (was #950)

cli-proxy fail fast on DIFC unreachability (v0.25.66): CLI proxy now errors immediately rather than hanging; verify DIFC proxy config before upgrade.

`0.25.65` → `0.27.1` (was #970)

AI credits as OTEL span attributes (v0.27.1): AWF emits AI credit consumption as OTel spans; agent_stats.rs + audit could surface these.
Redacted resolved config as audit artifact (v0.27.1): ado-aw audit could expose for configuration diagnostics.
Opt-in diagnostics artifact for blocked LLM request bodies (v0.27.1): ado-aw could surface via ado-aw-debug: flag.

`0.25.65` → `0.27.2` (was #983)

Security: WIF/OIDC Anthropic auth regression (v0.27.2): ANTHROPIC_API_KEY leaked to agent container when Squid blocked OIDC exchange; fixed in 0.27.2.

`0.25.65` → `0.27.3` (was #990)

OTLP fan-out to multiple endpoints (v0.27.3): api-proxy can fan out telemetry to multiple OTLP endpoints simultaneously.

`0.27.3` → `0.27.5` (was #1093)

Security: HTTPS-only for bare API proxy targets (v0.27.5): Prevents over-broad HTTP allowlisting; verify no existing config relies on HTTP.
allowedModels/disallowedModels in api-proxy (v0.27.5): Model allow/deny-list policy; ado-aw could expose as engine.allowed-models front-matter.
COPILOT_INTEGRATION_ID forwarding from host env (v0.27.5): api-proxy forwards from host into sandbox; ensure ado-aw passes it through AWF invocation.
GHES detection fix for Copilot auth prefix (v0.27.4): Fixes auth failures for non-standard GHES hostnames.

`0.27.3` → `0.27.7` (was #1118)

max-cache-misses guardrail (v0.27.6): Limits token spend when cache misses exceed threshold; useful for cost-sensitive pipelines.

`0.27.3` → `0.27.9` (was #1184)

Copilot Business endpoint auth prefix corrected (v0.27.9): Fixed wrong bearer prefix (should be token); Business-account pipelines may have been silently failing.

`0.27.9` → `0.27.11` (was #1219)

Portable self-hosted runner doctor agent (v0.27.11): New AWF diagnostic tool; ado-aw could reference in troubleshooting docs.
Topology-attach ordering deadlock fix (v0.27.11): Starved cli-proxy health gate; MCPG-based pipelines (--topology-attach mcp-gateway) were directly affected.
ARC/DinD chroot path fix (v0.27.10): /host/tmp/awf-runner-bin instead of /host/usr collision; update ARC/DinD docs if referencing /host/usr.

`0.27.9` → `0.27.12` (was #1241)

Security: June 2026 dependency refresh (v0.27.12): Routine security dep upgrades; upgrading recommended.
OIDC config propagation fix (v0.27.12): apiProxy.auth OIDC fields were not propagated to all proxy layers; previously configured OIDC may have been silently ignored.

`0.27.9` → `0.27.13` (was #1252)

Security: ReDoS fix in postprocess script (v0.27.11): ReDoS vulnerability patched; no consumer action beyond upgrading.
maxRuns counts only inference calls (v0.27.13): Semantics changed — no longer counts tool calls; re-evaluate any max-runs tuning based on total tool-call counts.
HTTP 429 (not 403) when max turns exceeded (v0.27.13): Update any ado-aw code/docs that treat 403 as the max-turns-exceeded indicator.

`0.27.9` → `0.27.15` (was #1260)

Note: v0.27.14 was retracted; its changes are included in v0.27.15.
Security: transitive linkify-it → v5.0.1 (v0.27.12): Part of June 2026 security refresh.

`0.27.9` → `0.27.21` (was #1304) — canonical

container.mounts in AWF config schema (v0.27.21): ado-aw could expose as front-matter field for custom sandbox mounts.
Model-to-API endpoint mapping (v0.27.16): AWF maintains a model→endpoint map updated daily; relevant for ado-aw model validation allowlist.

Consolidated by the Deps Release-Notes Consolidator workflow. Superseded per-release issues were closed and point here.

Generated by Deps Release-Notes Consolidator · 319.3 AIC · ⌖ 17.7 AIC · ⊞ 6.6K · ◷

`awf` `0.27.9` → `0.27.22`

Releases analyzed

Notable features for ado-aw to adopt

container.mounts in AWF config schema (v0.27.21): AWF's config file schema now supports a container.mounts field. ado-aw could consider exposing this as a front-matter option so users can declare custom container mounts for the agent sandbox without bypassing the compiler.
Model-to-API endpoint mapping (v0.27.16): AWF now ships a model-to-API endpoint mapping (with a daily updater workflow). ado-aw's engine/model configuration may be able to leverage this mapping to validate or auto-resolve api-target from a model identifier.

Generated by Dependency Version Updater · 122.6 AIC · ⌖ 15.2 AIC · ⊞ 10.9K · ◷

`awf` `0.27.9` → `0.27.24`

Releases analyzed

Notable features for ado-aw to adopt

container.mounts added to AWF config file schema (v0.27.21): AWF now supports a container.mounts field in its JSON/YAML config file. ado-aw generates AWF invocations and currently passes all options as CLI flags. If ado-aw adopts config-file generation, exposing container.mounts through a front-matter field (e.g., under engine: or a new mounts: block) would allow consumers to bind-mount additional workspace paths into the agent container.
maxRuns limit now correctly counts only inference calls (v0.27.13): A bug fix that corrects the counting of inference calls against the --max-runs limit (previously all calls were counted, not just inference calls). Agent runs that were hitting the limit prematurely may now run longer. Worth noting if ado-aw or its docs reference expected maxRuns behavior.
HTTP 429 (not 403) returned when max turns exceeded (v0.27.13): AWF now returns 429 instead of 403 when the agent exceeds the maximum turn limit. If ado-aw parses AWF exit codes or error responses to produce diagnostics (e.g., in audit or conclusion jobs), the expected response code has changed.

Generated by Dependency Version Updater · 94.6 AIC · ⌖ 13.6 AIC · ⊞ 10.9K · ◷

`awf` `0.27.9` → `0.27.26`

Releases analyzed

Security fixes

Fixed catastrophic regex backtracking in AWF's postprocess script (v0.27.11): eliminates a potential ReDoS vector in AWF's domain validation postprocessing. No configuration change needed for consumers, but upgrading pins this fix.

Notable features for ado-aw to adopt

Model-to-API endpoint mapping (v0.27.16): AWF now maintains a machine-readable model-to-API-endpoint mapping table that is updated daily via an automated workflow. ado-aw could potentially reference this mapping to surface supported model/API target combinations or validate engine.api-target values against known model/endpoint pairings.
maxRuns now counts only inference calls (v0.27.13): --max-runs previously counted all agent calls (tool calls + LLM inference calls) against the limit; it now counts only LLM inference calls. Users who configure --max-runs via engine.args will get more tool-call headroom per run. ado-aw documentation or defaults could be updated to reflect the corrected semantics.

Generated by Dependency Version Updater · 105.6 AIC · ⌖ 17.3 AIC · ⊞ 10.9K · ◷

`awf` `0.27.9` → `0.27.27`

Releases analyzed

Security fixes

Dependency security refresh (v0.27.12): Applied safe dependency updates for June 2026 security refresh; routine transitive dependency security updates in the AWF build.

Notable features for ado-aw to adopt

container.mounts added to AWF config file schema (v0.27.21): New container.mounts field in the AWF config schema (feat: add container.mounts to AWF config file schema). ado-aw's AWF config generation could surface this to allow pipeline authors to mount additional paths into the agent container.
claude-sonnet-5 AI-credits pricing added (v0.27.27): Add claude-sonnet-5 to AI-credits pricing to prevent runtime unknown-model rejection. Ensures claude-sonnet-5 is recognized at the AWF layer without triggering an unknown-model 429; verify claude-sonnet-5 is in ado-aw's src/engine.rs model allowlist.
Claude Fable 5 / Mythos 5 unblocked at AWF AI-credits guard (v0.27.27): Unblock AI credits guard for Claude Fable/Mythos 5 by adding curated pricing and catalog fallback entries. These model families now pass the AWF AI-credits guard; ado-aw can add them to its model allowlist once they are available via the Copilot CLI.
Gemini usageMetadata token parsing (v0.27.27): fix: add Gemini usageMetadata support to token parsers. AWF now correctly parses Gemini token usage; Gemini model token tracking in pipeline audit data should now be accurate.

Generated by Dependency Version Updater · 180.6 AIC · ⌖ 14.4 AIC · ⊞ 10.9K · ◷

`awf` `0.27.9` → `0.27.28`

Releases analyzed

Notable features for ado-aw to adopt

container.mounts added to AWF config file schema (v0.27.21, #5755): AWF now accepts a container.mounts field in its JSON/YAML config, allowing consumers to inject custom volume mounts into the sandboxed container. ado-aw's compiler could optionally expose this via a new front-matter field (e.g., under supply-chain: or a dedicated container: block) so users can mount workspace directories or secrets without breaking the network isolation model.
build-tools added to SHA digest pinning infrastructure (v0.27.27, #5986): AWF extended its digest-pinning support to cover build-tools images in addition to the previously supported categories. ado-aw's supply-chain: mirror paths that reference build-tool images may benefit from enabling digest pinning to improve supply-chain integrity.
COPILOT_MODEL validated after alias resolution (v0.27.28, #6044): AWF now validates the selected Copilot model after alias resolution rather than before. This means model aliases configured in ado-aw's engine: block will be resolved before AWF's validation runs — reducing spurious "unsupported model" rejections when using model aliases. No ado-aw code change required, but worth noting in the documentation for engine.model.

Generated by Dependency Version Updater · 119.2 AIC · ⌖ 13.6 AIC · ⊞ 10.9K · ◷

`awf` `0.27.28` → `0.27.30`

Releases analyzed

Notable features for ado-aw to adopt

gVisor runtime support (--container-runtime gvisor): AWF now supports running the agent container under gVisor (via runsc) for kernel-level sandboxing. ado-aw could expose this as a front-matter field (e.g. engine.container-runtime: gvisor) to allow pipelines to opt into stronger isolation. (v0.27.30)
Docker sbx microVM runtime support (--container-runtime sbx): AWF now supports the Docker sbx microVM runtime for hypervisor-level isolation. ado-aw could similarly expose sbx as a selectable container runtime. (v0.27.30)
Recursive model alias resolution in validateRequestedModel: AWF now resolves chained model aliases (with cycle protection). This is transparent to ado-aw consumers today but may be relevant if ado-aw surfaces model-alias configuration. (v0.27.29)

Generated by Dependency Version Updater · 62.3 AIC · ⌖ 11.8 AIC · ⊞ 10.9K · ◷

`awf` `0.27.28` → `0.27.31`

Releases analyzed

Notable features for ado-aw to adopt

New --container-runtime option with gvisor and sbx values (v0.27.30): AWF now supports selecting the container runtime via --container-runtime gvisor (OCI runtime via Docker Compose, translating to runsc) and --container-runtime sbx (Docker sbx microVM with hypervisor isolation). These provide stronger sandbox isolation than the default container runtime. ado-aw's pipeline compiler could expose a container-runtime: front-matter field to let workflow authors opt into gVisor or sbx isolation for higher-security workloads. (v0.27.30 — PRs #6093, #6101)

Generated by Dependency Version Updater · 77.3 AIC · ⌖ 11.7 AIC · ⊞ 10.9K · ◷

`awf` `0.27.9` → `0.27.35`

Releases analyzed

Security fixes

Exclude GITHUB_TOKEN from agent container when API proxy is enabled — when the AWF API proxy is active, GITHUB_TOKEN was inadvertently forwarded into the agent container; this is now blocked (v0.27.33). ado-aw consumers using engine.api-target with a proxy should upgrade AWF promptly.

Notable features for ado-aw to adopt

Model-to-API endpoint mapping with daily updater — AWF now maintains an internal map from model names to their API endpoints (feat: add model-to-API endpoint mapping and daily updater workflow, v0.27.16). This could inform how ado-aw surfaces or validates engine.model values against known endpoints.
Recursive alias resolution with cycle protection in validateRequestedModel — AWF now resolves model aliases recursively (with cycle detection) when validating the requested model (v0.27.29). If ado-aw surfaces model alias validation, this expanded resolution logic may be relevant.
Handle gh-aw offline BYOK sentinel in Copilot auth selection for Business/Enterprise targets — AWF now recognises an offline BYOK sentinel to select the correct auth path for Business/Enterprise API targets (v0.27.33). ado-aw's engine.provider / engine.api-target documentation and compilation may want to reflect this.

Generated by Dependency Version Updater · 93.6 AIC · ⌖ 12.8 AIC · ⊞ 10.9K · ◷

`awf` `0.27.9` → `0.27.37`

Releases analyzed

Security fixes

ANTHROPIC_AUTH_TOKEN is now protected in AWF credential isolation paths — v0.27.37 adds explicit masking/isolation for ANTHROPIC_AUTH_TOKEN alongside existing credential isolation. No ado-aw config change required; this is a sandbox hardening fix that takes effect automatically on upgrade. (v0.27.37)

Notable features for ado-aw to adopt

Sandbox PATH now includes ~/.local/bin for rootless Copilot installs — v0.27.37 fixes agents that install tools to ~/.local/bin in rootless mode being invisible to subsequent steps. ado-aw users on rootless runners benefit automatically on upgrade; no config change needed. (v0.27.37)
Recursive alias resolution with cycle protection in validateRequest — v0.27.29 adds recursive resolution for domain aliases in the AWF allowlist, with cycle detection. This improves correctness for complex network.allowed entries. No ado-aw config change needed; takes effect on upgrade. (v0.27.29)
Model-to-API endpoint mapping added — v0.27.16 adds a model-to-API endpoint mapping table and a daily updater workflow in AWF. This could inform future ado-aw engine: model routing or diagnostic tooling. (v0.27.16)

Generated by Dependency Version Updater · 91.2 AIC · ⌖ 12.7 AIC · ⊞ 10.9K · ◷

`awf` `0.27.9` → `0.27.38`

Releases analyzed

Security fixes

ANTHROPIC_AUTH_TOKEN is now protected in AWF credential isolation paths (v0.27.37): AWF now explicitly isolates ANTHROPIC_AUTH_TOKEN from being forwarded to the sandboxed agent process, in line with the existing protection of GITHUB_TOKEN. ado-aw consumers using Anthropic-backed engines benefit from this automatically on upgrade.

Notable features for ado-aw to adopt

Model-to-API endpoint mapping with daily updater (v0.27.16): AWF added a built-in model-to-API endpoint registry that is updated daily. This powers model-policy config propagation to the API proxy, giving the allowlist tighter model-level egress control. ado-aw could consider documenting this capability for users who want to constrain which models an agent may call.
Recursive alias resolution with cycle protection in validateRequestedModel (v0.27.29): AWF's model-policy validator now resolves model aliases recursively (with cycle detection). This means model aliases in engine.model configurations will be transparently resolved; no ado-aw code change is required, but it is worth verifying that existing alias chains behave as expected after the bump.
Model-policy config propagation fix to api-proxy preventing exact-model policy bypasses (v0.27.36): A fix was applied to ensure model-policy rules are correctly propagated to the AWF API proxy, closing a path where exact-model policies could be bypassed. ado-aw consumers using engine.model restrictions benefit automatically.

Generated by Dependency Version Updater · 100 AIC · ⌖ 12.9 AIC · ⊞ 10.9K · ◷

`awf` `0.27.32` → `0.27.39`

Releases analyzed

Security fixes

Protect ANTHROPIC_AUTH_TOKEN in AWF credential isolation paths (v0.27.37): AWF now explicitly isolates ANTHROPIC_AUTH_TOKEN in its credential isolation paths. ado-aw should verify that any BYOK/Anthropic key wiring in the agent job does not inadvertently expose this token outside the sandbox.
Exclude GITHUB_TOKEN from agent container when API proxy is enabled (v0.27.33): When the AWF API proxy is active, GITHUB_TOKEN is no longer passed into the agent container. ado-aw callers that rely on GITHUB_TOKEN being present inside the AWF sandbox should review whether any tooling depends on it in that path.

Notable features for ado-aw to adopt

Handle gh-aw offline BYOK sentinel in Copilot auth selection for Business/Enterprise targets (v0.27.33): AWF now handles an offline BYOK sentinel in the Copilot auth selection flow for Business/Enterprise. ado-aw may want to surface this as a supported path in its engine: config or auth documentation for enterprise customers.
Expose RHEL/Amazon Linux CA roots in chroot mode (v0.27.39): AWF now exposes RHEL and Amazon Linux CA roots inside the chroot sandbox. This improves compatibility for ado-aw pipelines running on RHEL-based ADO agent pools; no ado-aw code change is likely required, but RHEL pool users benefit from upgrading the pinned version.
Fix model-policy config propagation to api-proxy; prevent exact-model family rewrites (v0.27.36): Model-policy configuration is now correctly propagated to the AWF API proxy, and exact-model identifiers are no longer rewritten to family aliases. ado-aw's engine.model pinning should now be reliably enforced end-to-end.
Fix ~/.local/bin missing from sandbox PATH for rootless Copilot installs (v0.27.37): Rootless Copilot installs (the ado-aw default) could fail to locate the copilot binary if it landed in ~/.local/bin. This is now fixed upstream; no ado-aw change needed.

Generated by Dependency Version Updater · 68.1 AIC · ⌖ 12.2 AIC · ⊞ 11K · ◷

`awf` `0.27.32` → `0.27.41`

Releases analyzed

Security fixes

ANTHROPIC_AUTH_TOKEN added to AWF credential isolation paths — AWF now protects ANTHROPIC_AUTH_TOKEN in its API proxy credential isolation, preventing the token from leaking through the firewall's transparent proxy. (v0.27.37)

Notable features for ado-aw to adopt

~/.local/bin added to sandbox PATH for rootless copilot installs — AWF now includes ~/.local/bin in the sandbox PATH, fixing copilot CLI discovery for rootless runner installations. ado-aw consumers on rootless Azure DevOps agents should benefit automatically after bumping AWF_VERSION. (v0.27.37)
fix(agent): restore python3 in agent image for seccomp regression check — python3 was restored in the AWF agent image after a seccomp regression; consumers relying on the agent image's python3 for init scripts will see this fixed. (v0.27.41)

Generated by Dependency Version Updater · 108.7 AIC · ⌖ 13.4 AIC · ⊞ 11K · ◷

`awf` `0.27.32` → `0.27.42`

Releases analyzed

Security fixes

Protect ANTHROPIC_AUTH_TOKEN in AWF credential isolation paths (v0.27.37) — ANTHROPIC_AUTH_TOKEN is now protected in AWF's credential isolation alongside other API keys. ado-aw consumers using Anthropic-backed models should verify tokens are not being leaked through agent stdout/env passthrough.
fix(supply-chain): ignore unreachable x/text CVE embedded in gh CLI binary (v0.27.42) — A CVE in the x/text package embedded in the bundled gh CLI binary has been assessed as unreachable and annotated accordingly. No action needed for ado-aw consumers, but confirms the binary's supply-chain posture has been reviewed.

Notable features for ado-aw to adopt

fix: add ~/.local/bin to sandbox PATH for rootless copilot installs (v0.27.37) — AWF now includes ~/.local/bin in the sandbox PATH, fixing rootless Copilot installs that place binaries there. ado-aw consumers running on rootless runner images benefit automatically from this upgrade.

Generated by Dependency Version Updater · 124.3 AIC · ⌖ 12.8 AIC · ⊞ 11K · ◷

`awf` `0.27.32` → `0.27.43`

Releases analyzed

Security fixes

ANTHROPIC_AUTH_TOKEN is now explicitly protected in AWF's credential isolation paths, preventing it from leaking through the API proxy — ado-aw consumers using Anthropic BYOK should verify their AWF version is at or above this. (v0.27.37)

Notable features for ado-aw to adopt

AWF now handles the gh-aw offline BYOK sentinel in Copilot auth selection for Business/Enterprise SKUs — relevant if ado-aw pipelines use BYOK Anthropic credentials and encounter auth-selection failures in offline/airgapped setups. (v0.27.33)
~/.local/bin is now added to the sandbox PATH for rootless Copilot installs, fixing runtime lookup failures in certain pool configurations. (v0.27.37)

Generated by Dependency Version Updater · 103.7 AIC · ⌖ 13.7 AIC · ⊞ 11.1K · ◷

`awf` `0.27.32` → `0.27.44`

Releases analyzed

v0.27.33 – v0.27.44 (11 releases in range; individually linked below)

Notable features for ado-aw to adopt

v0.27.44 adds confidentiality-aware sealed probe budgets. This looks like a refinement to AWF's egress/telemetry sealing behavior — worth a quick look to see whether ado-aw's AWF invocation (awf ... --allow-domains ...) needs any new flags or config to opt into or account for this, though it may be fully internal to AWF's own probe accounting.

The remaining releases in this range (0.27.33–0.27.43) were internal refactors, test/CI changes, and documentation updates with no consumer-visible effect — no breaking changes, security fixes, or deprecations were found.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

index.crates.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "index.crates.io"

See Network Configuration for more information.

Generated by Dependency Version Updater · aut00 · 131.4 AIC · ⌖ 12.9 AIC · ⊞ 16.1K · ◷

`awf` `0.27.32` → `0.28.0`

Releases analyzed

Breaking changes

refactor: remove legacy bounded execution in favor of MCP enclaves (PR #6994, v0.28.0) — the previous "bounded execution" path is removed entirely in favor of the new unified enclave model. Any ado-aw code or docs referencing the old bounded-execution mechanism should be reviewed for compatibility.
feat: route unified enclaves exclusively through mcpg (PR #6992, v0.28.0) — enclave traffic is now routed exclusively through MCPG rather than any prior direct path, which is a routing/topology change consumers relying on the previous behavior would notice.

Security fixes

fix(security): update vulnerable deps in agent and api-proxy images (PR #6505, v0.27.39)
feat(containers): add gh-aw-node Dockerfile with CVE patches; integrate into release and supply-chain gate (PR #6707, v0.27.43)

Notable features for ado-aw to adopt

Unified enclave foundation, enclave MCP script executor, and enclave agent executor (PRs #6986, #6988, #6990, v0.28.0) — new enclave-based execution model for MCP scripts and agents; ado-aw's ado_script/enclave-adjacent execution paths should be evaluated for adoption.
feat(cli): add API proxy reflection mode (PR #6936, v0.27.44) — could improve API proxy diagnostics/observability surfaced during Stage 1 agent runs.
feat: add sealed probes for private repositories and feat: add confidentiality-aware sealed probe budgets (PRs #6673, #6728, v0.27.43/v0.27.44) — sealed-probe confidentiality controls relevant to ado-aw's private-repo/threat-detection network policies.
Firecracker guest execution transport, primary-agent runtime preview, and a runnable Cloud Hypervisor v53.0 microVM backend (PRs #7133–#7138, #7212, #7222, #7225, v0.28.0) — a new microVM-based sandbox backend alternative to gVisor/Docker sbx that ado-aw could expose as an additional --container-runtime option once stable.

Deprecations

None noted in this range beyond the bounded-execution removal already captured under Breaking changes.

Generated by Dependency Version Updater · auto · 165.3 AIC · ⌖ 12.8 AIC · ⊞ 16.2K · ◷

`awf` `0.27.32` → `0.28.1`

Releases analyzed

Security fixes

Protected ANTHROPIC_AUTH_TOKEN in AWF credential isolation paths (v0.27.37)
Updated vulnerable dependencies in the agent and api-proxy images (v0.27.42)
brace-expansion bumped to 5.0.8 fixing GHSA-mh99-v99m-4gvg (v0.27.42)
Suppressed non-reachable GO-2026-4337 advisory in the bundled gosu binary, and ignored an unreachable x/text CVE embedded in the gh CLI binary (v0.27.42, v0.27.43)
Safe patch updates including an ajv 8.20.0 security fix (v0.28.0)

Notable features for ado-aw to adopt

Added a "unified enclave foundation" plus an enclave MCP script executor and enclave agent executor, routing unified enclaves exclusively through mcpg, replacing legacy bounded execution (v0.28.0) — worth evaluating whether ado-aw's Agent-stage sandboxing/MCPG wiring should track this new execution model.
--enable-host-access can now be combined with --network-isolation (topology mode) (v0.27.43).
Runtime model metadata and pricing overlays for the API proxy, and a runtime secret-backed OpenAI endpoint override (v0.27.43).
Sealed probes for private repositories, and confidentiality-aware sealed probe budgets (v0.27.43, v0.27.44).

Deprecations

None called out in this range.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

index.crates.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "index.crates.io"

See Network Configuration for more information.

Generated by Dependency Version Updater · auto · 121.3 AIC · ⌖ 5.1 AIC · ⊞ 16.5K · ◷

`awf` `0.27.32` → `0.28.3`

Releases analyzed

Breaking changes

None identified in this range.

Security fixes

Dependency security patches: vulnerable deps updated in agent and api-proxy images (v0.27.43); brace-expansion bumped to 5.0.8 fixing GHSA-mh99-v99m-4gvg (v0.27.43); ajv bumped to 8.20.0 for a security fix (v0.27.44); non-reachable advisories GO-2026-4337 (gosu) and an x/text CVE embedded in the gh CLI binary were reviewed and suppressed as unreachable (v0.27.44, v0.27.42).

Notable features for ado-aw to adopt

Sealed probes for private repositories, plus confidentiality-aware sealed-probe budgets, were added (v0.27.44) — could be relevant if ado-aw ever needs to reach private-repo resources from inside the sandbox with tighter confidentiality controls.
A "unified enclave" foundation, MCP script executor, agent executor, and routing of unified enclaves exclusively through mcpg were added (v0.28.0) — worth watching as a potential future execution model for custom safe-output/tool jobs.
Support for secret-backed OpenAI-compatible targets was added (v0.28.3) — could let engine: configurations point at custom OpenAI-compatible endpoints with proper secret handling.
The CLI proxy now routes through an isolated egress relay (v0.28.2), which may affect how ado-aw's az CLI wrapper interacts with AWF's proxy topology — worth a sanity check against az_wrapper.rs.

Deprecations

None identified in this range.

Generated by Dependency Version Updater · auto · 83.7 AIC · ⌖ 6.39 AIC · ⊞ 16.5K · ◷

`awf` `0.27.32` → `0.28.4`

Releases analyzed

Breaking changes

Firecracker microVM backend support was removed (v0.28.1, v0.28.2) in favor of Cloud Hypervisor; if ado-aw docs or configuration ever referenced Firecracker as a sandbox backend option, they need updating.

Security fixes

Dependency security patches: vulnerable deps updated in agent and api-proxy images (v0.27.43); brace-expansion bumped to 5.0.8 fixing GHSA-mh99-v99m-4gvg (v0.27.43); ajv bumped to 8.20.0 for a security fix (v0.27.44); non-reachable advisories GO-2026-4337 (gosu) and an x/text CVE embedded in the gh CLI binary were reviewed and suppressed as unreachable (v0.27.44, v0.27.42).

Notable features for ado-aw to adopt

Sealed probes for private repositories, plus confidentiality-aware sealed-probe budgets, were added (v0.27.44) — could be relevant if ado-aw ever needs to reach private-repo resources from inside the sandbox with tighter confidentiality controls.
A "unified enclave" foundation, MCP script executor, agent executor, and routing of unified enclaves exclusively through mcpg were added (v0.28.0) — worth watching as a potential future execution model for custom safe-output/tool jobs.
Support for secret-backed OpenAI-compatible targets was added (v0.28.3) — could let engine: configurations point at custom OpenAI-compatible endpoints with proper secret handling.
The CLI proxy now routes through an isolated egress relay (v0.28.2), which may affect how ado-aw's az CLI wrapper interacts with AWF's proxy topology — worth a sanity check against az_wrapper.rs.
Compiler-authorized digest-pinned container image manifests are now supported (v0.28.4) — ado-aw's supply-chain: front-matter could adopt digest pinning for AWF/MCPG container references to strengthen provenance guarantees.
api-proxy gained first-class AI-credit accounting for the Copilot auto dynamic model selector (v0.28.4) — relevant to agent_stats.rs / ado-aw audit token/credit reporting when engine.model: auto is used.
Container workdir ownership on native-root runners is now repaired automatically instead of failing silently (v0.28.4) — reduces a known runner-doctor failure mode for self-hosted native-root runners.

Deprecations

None identified in this range.

Generated by Dependency Version Updater · auto · 78.8 AIC · ⌖ 10.3 AIC · ⊞ 16.5K · ◷

Consolidated into the canonical rolling issue #2028 ( [deps-release-notes] awf — upstream release action items ). Its action items have been preserved there.

Generated by Deps Release-Notes Consolidator · auto · 76.3 AIC · ⌖ 11.6 AIC · ⊞ 10.6K

[deps-release-notes] awf — upstream release action items #1304

Description

Rolling upstream release action items — awf

Consolidated history (earliest → latest)

0.25.48 → 0.25.60 (was #851)

0.25.48 → 0.25.63 (was #859)

0.25.65 → 0.25.66 (was #902)

0.25.65 → 0.25.68 (was #930)

0.25.65 → 0.27.0 (was #950)

0.25.65 → 0.27.1 (was #970)

0.25.65 → 0.27.2 (was #983)

0.25.65 → 0.27.3 (was #990)

0.27.3 → 0.27.5 (was #1093)

0.27.3 → 0.27.7 (was #1118)

0.27.3 → 0.27.9 (was #1184)

0.27.9 → 0.27.11 (was #1219)

0.27.9 → 0.27.12 (was #1241)

0.27.9 → 0.27.13 (was #1252)

0.27.9 → 0.27.15 (was #1260)

0.27.9 → 0.27.21 (was #1304) — canonical

Activity

github-actions commented on Jul 3, 2026

awf 0.27.9 → 0.27.22

Releases analyzed

Notable features for ado-aw to adopt

github-actions commented on Jul 6, 2026

awf 0.27.9 → 0.27.24

Releases analyzed

Notable features for ado-aw to adopt

github-actions commented on Jul 7, 2026

awf 0.27.9 → 0.27.26

Releases analyzed

Security fixes

Notable features for ado-aw to adopt

github-actions commented on Jul 8, 2026

awf 0.27.9 → 0.27.27

Releases analyzed

Security fixes

Notable features for ado-aw to adopt

github-actions commented on Jul 9, 2026

awf 0.27.9 → 0.27.28

Releases analyzed

Notable features for ado-aw to adopt

github-actions commented on Jul 12, 2026

awf 0.27.28 → 0.27.30

Releases analyzed

Notable features for ado-aw to adopt

github-actions commented on Jul 13, 2026

awf 0.27.28 → 0.27.31

Releases analyzed

Notable features for ado-aw to adopt

github-actions commented on Jul 16, 2026

awf 0.27.9 → 0.27.35

Releases analyzed

Security fixes

Notable features for ado-aw to adopt

github-actions commented on Jul 20, 2026

awf 0.27.9 → 0.27.37

Releases analyzed

Security fixes

Notable features for ado-aw to adopt

github-actions commented on Jul 21, 2026

awf 0.27.9 → 0.27.38

Releases analyzed

Security fixes

Notable features for ado-aw to adopt

github-actions commented on Jul 23, 2026

awf 0.27.32 → 0.27.39

Releases analyzed

Security fixes

Notable features for ado-aw to adopt

github-actions commented on Jul 24, 2026

awf 0.27.32 → 0.27.41

Releases analyzed

Security fixes

Notable features for ado-aw to adopt

github-actions commented on Jul 27, 2026

awf 0.27.32 → 0.27.42

Releases analyzed

Security fixes

Rolling upstream release action items — `awf`

`0.25.48` → `0.25.60` (was #851)

`0.25.48` → `0.25.63` (was #859)

`0.25.65` → `0.25.66` (was #902)

`0.25.65` → `0.25.68` (was #930)

`0.25.65` → `0.27.0` (was #950)

`0.25.65` → `0.27.1` (was #970)

`0.25.65` → `0.27.2` (was #983)

`0.25.65` → `0.27.3` (was #990)

`0.27.3` → `0.27.5` (was #1093)

`0.27.3` → `0.27.7` (was #1118)

`0.27.3` → `0.27.9` (was #1184)

`0.27.9` → `0.27.11` (was #1219)

`0.27.9` → `0.27.12` (was #1241)

`0.27.9` → `0.27.13` (was #1252)

`0.27.9` → `0.27.15` (was #1260)

`0.27.9` → `0.27.21` (was #1304) — canonical

`awf` `0.27.9` → `0.27.22`

`awf` `0.27.9` → `0.27.24`

`awf` `0.27.9` → `0.27.26`

`awf` `0.27.9` → `0.27.27`

`awf` `0.27.9` → `0.27.28`

`awf` `0.27.28` → `0.27.30`

`awf` `0.27.28` → `0.27.31`

`awf` `0.27.9` → `0.27.35`

`awf` `0.27.9` → `0.27.37`

`awf` `0.27.9` → `0.27.38`

`awf` `0.27.32` → `0.27.39`

`awf` `0.27.32` → `0.27.41`

`awf` `0.27.32` → `0.27.42`

`awf` `0.27.32` → `0.27.43`

`awf` `0.27.32` → `0.27.44`

`awf` `0.27.32` → `0.28.0`

`awf` `0.27.32` → `0.28.1`

`awf` `0.27.32` → `0.28.3`

`awf` `0.27.32` → `0.28.4`