Rolling upstream release action items — awf

This is the single canonical tracking issue for action items arising from new releases of the awf dependency (gh-aw-firewall). The dependency version updater workflow appends a new comment to this issue for each version bump, so the most recent activity lives in the comments below.

The companion version-bump PR for the first recorded range is titled chore(deps): update AWF_VERSION to 0.28.5.

awf 0.27.32 → 0.28.5

Releases analyzed

• v0.27.33
• v0.27.34
• v0.27.35
• v0.27.36
• v0.27.37
• v0.27.38
• v0.27.39
• v0.27.41
• v0.27.42
• v0.27.43
• v0.27.44
• v0.28.0
• v0.28.1
• v0.28.2
• v0.28.3
• v0.28.4
• v0.28.5

Breaking changes

• Firecracker microVM backend removed (v0.28.1, "ci: disable Firecracker workflows and release artifacts", v0.28.0/v0.28.1 changelogs) — AWF has dropped Firecracker in favor of Cloud Hypervisor as the sandbox backend. ado-aw does not reference Firecracker directly, but any docs/runner-doctor guidance mentioning it upstream should not be assumed to apply going forward.

Security fixes

• Enforce filesystem allowWrite boundaries in AWF sandboxes (v0.28.5, #7634) — tightens write-path enforcement so sandboxed agents can only write within explicitly allowed paths. Worth a check that ado-aw's generated --allow-write / AWF mount config still aligns with the tightened semantics.
• Route CLI artifact redirects through scoped Squid egress (v0.28.5, #7635) — CLI artifact download redirects are now proxied through Squid's domain-allowlist instead of bypassing egress controls, closing a potential egress-control bypass.
• fix: route CLI proxy through isolated egress relay (v0.28.2, #7338) — routes the CLI proxy through an isolated egress relay for DIFC credential isolation.
• fix(security): suppress non-reachable GO-2026-4337 in gosu binary (v0.27.43, #6645) and update brace-expansion to 5.0.8 (GHSA-mh99-v99m-4gvg) (v0.27.42, #6585) — routine dependency CVE remediations in the AWF toolchain.

Notable features for ado-aw to adopt

• Support compiler-authorized digest-pinned container image manifests (v0.28.4, #7601) — AWF can now accept compiler-authorized digest-pinned image manifests. ado-aw could adopt this to pin AWF/MCPG/agent images by digest instead of tag for stronger supply-chain guarantees.
• feat: support secret-backed OpenAI-compatible targets (v0.28.3, #7576) — new API-proxy target type; relevant if ado-aw ever wants to support OpenAI-compatible engine backends secured via secret-backed credentials.
• API proxy: first-class AI-credit accounting for Copilot auto dynamic selector (v0.28.4, #7604) — improved cost/credit accounting when using Copilot's auto model selector, could inform ado-aw's engine cost-reporting/observability docs.
• Recover transient Cloud Hypervisor readiness failures (v0.28.5, #7611) and Fix Cloud Hypervisor API proxy readiness race (v0.28.3, #7582) — reliability fixes for the (preview) Cloud Hypervisor backend that ado-aw's OneBranch integration may rely on.

Deprecations

• Firecracker is fully removed rather than merely deprecated as of v0.28.1 (see Breaking changes above) — no further deprecation window.

network:
  allowed:
    - defaults
    - "index.crates.io"

Generated by Dependency Version Updater · auto · 112.4 AIC · ⌖ 6.19 AIC · ⊞ 16.5K · ◷