[deps-release-notes] awf — upstream release action items

Rolling upstream release action items — `awf`

This is the single canonical tracking issue for action items arising from
new releases of the awf dependency. The update-awf-version workflow appends
a new comment to this issue for each version bump going forward, so the most
recent activity lives in the comments below. This body is a consolidated
history of everything filed so far.

Latest pinned version covered: 0.28.9

Consolidated history (earliest → latest)

`0.25.48` → `0.25.60` (was #851)

OTel distributed tracing in api-proxy (v0.25.51): api-proxy now emits OTel traces; ado-aw could expose config to help consumers use this.
ARC/DinD split-filesystem auto-detection (v0.25.52): AWF auto-detects DinD split filesystem via sentinel probe; ado-aw docs may need updating.
Middle-power model fallback (v0.25.53): api-proxy supports model fallback when primary is unavailable; ado-aw could expose this.
Anthropic WIF support (v0.25.58): api-proxy supports Anthropic WIF schema fields + OIDC validation.
Pre-startup model validation via requestedModel config (v0.25.58): api-proxy validates requested model before startup; ado-aw may wish to populate this field.

`0.25.48` → `0.25.63` (was #859)

Security: proxy auth normalization hardened (v0.25.49): Prevents malformed Authorization headers from reaching the upstream API.
Responses API cache reads in token usage rollups (v0.25.63): Fixes under-reporting of cached token reads; improves ado-aw audit accuracy.

`0.25.65` → `0.25.66` (was #902)

Azure/AWS/GCP OIDC support in Copilot adapter (v0.25.66): api-proxy supports cloud OIDC credential injection; ado-aw could expose via engine:/network: front-matter.
Budget fields in token-usage.jsonl (v0.25.66): maxTurns and budget fields now persisted; ado-aw audit module could surface these in AuditData.

`0.25.65` → `0.25.68` (was #930)

GITHUB_COPILOT_INTEGRATION_ID forwarding fix (v0.25.67): AWF now correctly forwards it as COPILOT_INTEGRATION_ID to the api-proxy.
PAT-safe integration ID + model name normalization (v0.25.68): Regression fix from v0.25.67; normalizes legacy CAPI model names.

`0.25.65` → `0.27.0` (was #950)

cli-proxy fail fast on DIFC unreachability (v0.25.66): CLI proxy now errors immediately rather than hanging; verify DIFC proxy config before upgrade.

`0.25.65` → `0.27.1` (was #970)

AI credits as OTEL span attributes (v0.27.1): AWF emits AI credit consumption as OTel spans; agent_stats.rs + audit could surface these.
Redacted resolved config as audit artifact (v0.27.1): ado-aw audit could expose for configuration diagnostics.
Opt-in diagnostics artifact for blocked LLM request bodies (v0.27.1): ado-aw could surface via ado-aw-debug: flag.

`0.25.65` → `0.27.2` (was #983)

Security: WIF/OIDC Anthropic auth regression (v0.27.2): ANTHROPIC_API_KEY leaked to agent container when Squid blocked OIDC exchange; fixed in 0.27.2.

`0.25.65` → `0.27.3` (was #990)

OTLP fan-out to multiple endpoints (v0.27.3): api-proxy can fan out telemetry to multiple OTLP endpoints simultaneously.

`0.27.3` → `0.27.5` (was #1093)

Security: HTTPS-only for bare API proxy targets (v0.27.5): Prevents over-broad HTTP allowlisting; verify no existing config relies on HTTP.
allowedModels/disallowedModels in api-proxy (v0.27.5): Model allow/deny-list policy; ado-aw could expose as engine.allowed-models front-matter.
COPILOT_INTEGRATION_ID forwarding from host env (v0.27.5): api-proxy forwards from host into sandbox; ensure ado-aw passes it through AWF invocation.
GHES detection fix for Copilot auth prefix (v0.27.4): Fixes auth failures for non-standard GHES hostnames.

`0.27.3` → `0.27.7` (was #1118)

max-cache-misses guardrail (v0.27.6): Limits token spend when cache misses exceed threshold; useful for cost-sensitive pipelines.

`0.27.3` → `0.27.9` (was #1184)

Copilot Business endpoint auth prefix corrected (v0.27.9): Fixed wrong bearer prefix (should be token); Business-account pipelines may have been silently failing.

`0.27.9` → `0.27.11` (was #1219)

Portable self-hosted runner doctor agent (v0.27.11): New AWF diagnostic tool; ado-aw could reference in troubleshooting docs.
Topology-attach ordering deadlock fix (v0.27.11): Starved cli-proxy health gate; MCPG-based pipelines (--topology-attach mcp-gateway) were directly affected.
ARC/DinD chroot path fix (v0.27.10): /host/tmp/awf-runner-bin instead of /host/usr collision; update ARC/DinD docs if referencing /host/usr.

`0.27.9` → `0.27.12` (was #1241)

Security: June 2026 dependency refresh (v0.27.12): Routine security dep upgrades; upgrading recommended.
OIDC config propagation fix (v0.27.12): apiProxy.auth OIDC fields were not propagated to all proxy layers; previously configured OIDC may have been silently ignored.

`0.27.9` → `0.27.13` (was #1252)

Security: ReDoS fix in postprocess script (v0.27.11): ReDoS vulnerability patched; no consumer action beyond upgrading.
maxRuns counts only inference calls (v0.27.13): Semantics changed — no longer counts tool calls; re-evaluate any max-runs tuning based on total tool-call counts.
HTTP 429 (not 403) when max turns exceeded (v0.27.13): Update any ado-aw code/docs that treat 403 as the max-turns-exceeded indicator.

`0.27.9` → `0.27.15` (was #1260)

Note: v0.27.14 was retracted; its changes are included in v0.27.15.
Security: transitive linkify-it → v5.0.1 (v0.27.12): Part of June 2026 security refresh.

`0.27.9` → `0.27.21` (was #1304)

container.mounts in AWF config schema (v0.27.21): ado-aw could expose as front-matter field for custom sandbox mounts.
Model-to-API endpoint mapping (v0.27.16): AWF maintains a model→endpoint map updated daily; relevant for ado-aw model validation allowlist.

`0.27.32` → `0.28.5` (was #1990)

Firecracker microVM backend removed (v0.28.1, "ci: disable Firecracker workflows and release artifacts") — AWF has dropped Firecracker in favor of Cloud Hypervisor as the sandbox backend. ado-aw does not reference Firecracker directly, but any docs/runner-doctor guidance mentioning it upstream should not be assumed to apply going forward.
Enforce filesystem allowWrite boundaries in AWF sandboxes (v0.28.5, #7634) — tightens write-path enforcement so sandboxed agents can only write within explicitly allowed paths.
Route CLI artifact redirects through scoped Squid egress (v0.28.5, #7635) — CLI artifact download redirects are now proxied through Squid's domain-allowlist instead of bypassing egress controls, closing a potential egress-control bypass.
fix: route CLI proxy through isolated egress relay (v0.28.2, #7338) — routes the CLI proxy through an isolated egress relay for DIFC credential isolation.
fix(security): suppress non-reachable GO-2026-4337 in gosu binary (v0.27.43, #6645) and update brace-expansion to 5.0.8 (GHSA-mh99-v99m-4gvg) (v0.27.42, #6585) — routine dependency CVE remediations in the AWF toolchain.
Support compiler-authorized digest-pinned container image manifests (v0.28.4, #7601) — ado-aw could adopt this to pin AWF/MCPG/agent images by digest instead of tag for stronger supply-chain guarantees.
feat: support secret-backed OpenAI-compatible targets (v0.28.3, #7576) — new API-proxy target type; relevant if ado-aw ever wants to support OpenAI-compatible engine backends secured via secret-backed credentials.
API proxy: first-class AI-credit accounting for Copilot auto dynamic selector (v0.28.4, #7604) — improved cost/credit accounting when using Copilot's auto model selector, could inform ado-aw's engine cost-reporting/observability docs.
Recover transient Cloud Hypervisor readiness failures (v0.28.5, #7611) and Fix Cloud Hypervisor API proxy readiness race (v0.28.3, #7582) — reliability fixes for the (preview) Cloud Hypervisor backend that ado-aw's OneBranch integration may rely on.

`0.27.32` → `0.28.9` (was #2028) — canonical

Firecracker support removed (#7362) — anyone relying on the Firecracker VM isolation backend for AWF will need to migrate to the supported sandboxing path before upgrading past this range.
fix(security): update vulnerable deps in agent and api-proxy images (#6505) — patches known CVEs in the agent/api-proxy container images.
chore(deps): safe patch updates incl. ajv 8.20.0 security fix (#6962) — bundled ajv security patch.
Protect ANTHROPIC_AUTH_TOKEN in AWF credential isolation paths (#6410) — extends AWF's credential-isolation guarantees to Anthropic auth tokens.
Exclude topology-attached MCP peers from agent proxy routing (#6189) — relevant to how ado-aw wires MCPG via --topology-attach; may simplify or change proxy routing assumptions in agentic_pipeline.rs.
Auto-allow topology-attached container hostnames in Squid ACL (#6473) — reduces manual allowlist entries for topology-attached containers (e.g. MCPG), potentially letting ado-aw drop custom allowlist workarounds.
Support COPILOT_MODEL=auto (#6474) — new dynamic model-selection env var AWF passes through; ado-aw's engine.rs model handling could expose this as a supported option.
Route CLI proxy through isolated egress relay (#7338) — changes to how the wrapped az/CLI network egress is routed; worth double-checking az_wrapper.rs assumptions still hold.
API proxy: first-class AI-credit accounting for Copilot auto dynamic selector (#7604) — new usage/cost accounting surfaced by AWF that ado-aw's audit/otel tooling could ingest.
Remove "bounded-query" terminology (#7735) — naming/terminology change in AWF docs/config; check for any ado-aw docs or config referencing the old term.

Consolidated by the Deps Release-Notes Consolidator workflow. Superseded per-release issues were closed and point here.> Generated by Deps Release-Notes Consolidator · auto · 76.3 AIC · ⌖ 11.6 AIC · ⊞ 10.6K · ◷

`awf` `0.27.32` → `0.28.10`

Releases analyzed

Breaking changes

Firecracker support removed (v0.28.2) — awf dropped Firecracker as a sandbox backend in favor of Cloud Hypervisor. If ado-aw or downstream consumers reference Firecracker-specific config/flags, this needs a compatibility check.

Security fixes

Vulnerable dependency updates in agent/api-proxy images (v0.27.39, fix(security)) — patched vulnerable deps shipped in the agent/api-proxy container images.
Non-reachable CVE suppressions (v0.27.42 x/text in gh CLI binary, v0.27.43 GO-2026-4337 in gosu binary) — both documented as non-reachable/unreachable in AWF's usage, no action expected but noted for awareness.
ANTHROPIC_AUTH_TOKEN protection in credential isolation paths (v0.27.37) — hardens AWF's credential-isolation handling to also cover this token.
ajv 8.20.0 security patch (v0.28.0, bundled in chore(deps) patch update) — routine transitive security patch.
cap_drop host capability bounding-set filtering fix (v0.28.10, PR #7795) — container cap_drop values are now filtered against the host's capability bounding set, preventing invalid/no-op cap-drop configuration from silently failing to restrict privileges.
MCP gateway Authorization header contract hardened (v0.28.10, PR #7794) — hardens/documents the Authorization header contract to prevent workspace credential exposure through the MCP gateway. Worth reviewing if ado-aw's MCPG integration passes bearer tokens through AWF.
Sandbox filesystem/network boundary hardening (v0.28.5) — release notes call out sandbox write-boundary enforcement and Squid egress routing hardening as touching "the core security surface"; no breaking changes for existing CLI users per the release notes, but relevant if ado-aw relies on custom allowWrite configs or CLI artifact downloads.

Notable features for ado-aw to adopt

Unified enclave foundation + enclave MCP script executor (v0.28.0, PRs #6986/#6987-area) — new sandboxed "enclave" execution model; could be relevant to how ado-aw's ado-script bundles or Custom safe-output jobs get executed if AWF exposes this as a supported topology.
Read-only GitHub CLI access in agent enclaves (v0.28.8, PR #7714) and later a read-only enclave Issues smoke workflow (v0.28.9) — a scoped, read-only gh CLI surface inside enclaves; potentially useful for ado-aw workflows that currently rely on the read-only GitHub MCP server, as an alternative/complementary tool surface.
Sealed probes for private repositories + confidentiality-aware sealed probe budgets (v0.27.43–0.27.44) — new probing/diagnostics capability with confidentiality controls; may be relevant to ado-aw's audit/diagnostics tooling.
Compiler-authorized digest-pinned container image manifests (v0.28.4, PR #7601) — supports pinning container images by digest with compiler authorization, which pairs well with ado-aw's supply-chain: provenance-checked image story.
Secret-backed OpenAI-compatible target support (v0.28.3, PR #7576) and runtime secret-backed OpenAI endpoint override in api-proxy (v0.27.43, PR #6656) — lets the api-proxy route to secret-backed custom OpenAI-compatible endpoints; relevant if ado-aw ever needs to support non-default model providers through AWF's proxy.
api-proxy CA certificate support (v0.28.10, PR #7816) — lets the API proxy present/trust a custom CA certificate, useful for TLS-inspecting or self-hosted proxy setups.
Cloud Hypervisor filesystem.allowWrite support + resolved write-boundary logging (v0.28.6, v0.28.10) — AWF now logs the resolved filesystem write boundary before the guest VM boots, improving auditability of allowWrite configuration — useful context for troubleshooting ado-aw sandboxes.
COPILOT_MODEL=auto support in AWF validation/api-proxy (v0.27.39) and a related warning when Codex uses auto under the AWF API proxy (v0.28.10, PR #7818) — relevant to ado-aw's engine.model handling if it ever surfaces auto as a model value.
Orphaned fixed-name Docker network reclaim before compose up (v0.28.10, PR #7817) — improves reliability of AWF's compose-based topology bring-up; relevant to smoke-test flakiness triage.

Deprecations

No explicit deprecation announcements (as opposed to outright removals) were found in this range; see Firecracker removal above under Breaking changes.

Generated by Dependency Version Updater · auto · 133.1 AIC · ⌖ 12.9 AIC · ⊞ 16.5K · ◷

`awf` `0.28.9` → `0.28.10`

Releases analyzed

v0.28.10

Security fixes

MCP gateway Authorization header contract hardened against workspace credential exposure (PR #7794, v0.28.10): the Authorization header contract used when talking to the MCP gateway was hardened and documented to prevent workspace credentials from being exposed. Worth double-checking ado-aw's MCPG wiring doesn't rely on the previous (looser) header behavior.
Container cap_drop filtered against host capability bounding set (PR #7795, v0.28.10): fixes a case where AWF's container capability drop list could request dropping capabilities outside the host's bounding set, which could previously fail silently or behave inconsistently. Improves sandbox capability isolation guarantees that ado-aw's Agent stage relies on.

Notable features for ado-aw to adopt

api-proxy CA certificate support (PR #7816, v0.28.10): AWF's api-proxy now supports configuring a CA certificate. This could let ado-aw route TLS-intercepted or custom-CA-signed traffic through AWF's proxy for permissions.read-gated Azure CLI / ADO REST access, if a future scenario needs it.

Deprecations

None noted for this range.

Generated by Dependency Version Updater · auto · 157.2 AIC · ⌖ 5.45 AIC · ⊞ 16.5K · ◷

`awf` `0.27.32` → `0.28.12`

Releases analyzed

This range fully supersedes the 0.27.32 → 0.28.9 entry previously recorded on this issue; everything up to 0.28.9 is unchanged and repeated here for completeness, plus three new patch releases.

Breaking changes

Firecracker microVM backend removed (v0.28.1, "ci: disable Firecracker workflows and release artifacts") — AWF has dropped Firecracker in favor of Cloud Hypervisor as the sandbox backend. ado-aw does not reference Firecracker directly, but any docs/runner-doctor guidance mentioning it upstream should not be assumed to apply going forward.

Security fixes

Enforce filesystem allowWrite boundaries in AWF sandboxes (v0.28.5, #7634) — tightens write-path enforcement so sandboxed agents can only write within explicitly allowed paths.
Route CLI artifact redirects through scoped Squid egress (v0.28.5, #7635) — CLI artifact download redirects are now proxied through Squid's domain-allowlist instead of bypassing egress controls, closing a potential egress-control bypass.
fix: route CLI proxy through isolated egress relay (v0.28.2, #7338) — routes the CLI proxy through an isolated egress relay for DIFC credential isolation.
fix(security): update vulnerable deps in agent and api-proxy images (#6505) — patches known CVEs in the agent/api-proxy container images.
chore(deps): safe patch updates incl. ajv 8.20.0 security fix (#6962) — bundled ajv security patch.
Harden and document the mcp gateway Authorization header contract against workspace credential exposure (v0.28.10, #7794) — clarifies/hardens how the MCP gateway Authorization header is handled to avoid workspace credential exposure; worth checking against ado-aw's MCPG --topology-attach wiring.
Reclaim orphaned fixed-name Docker networks before compose up (v0.28.10, #7817) — reduces risk of stale-network reuse across runs.
fix(cap-drop): filter container cap_drop against host capability bounding set (v0.28.10, #7795) — tightens container capability dropping to respect the host's bounding set.
fix: drop CAP_NET_ADMIN from Cloud Hypervisor VMM (v0.28.11, #7887) — removes an unnecessary elevated capability from the Cloud Hypervisor VMM process.
feat: verify Cloud Hypervisor runtime confinement / verify virtiofsd sandbox confinement before VM boot / isolate Cloud Hypervisor with per-run VMM identities (v0.28.11, #7889, #7890, #7894) — several hardening changes to the (preview) Cloud Hypervisor sandbox backend's isolation guarantees.
feat: bind Cloud Hypervisor artifacts to attested release manifests (v0.28.11, #7891) — supply-chain hardening for Cloud Hypervisor artifact provenance.

Notable features for ado-aw to adopt

Support compiler-authorized digest-pinned container image manifests (v0.28.4, #7601) — ado-aw could adopt this to pin AWF/MCPG/agent images by digest instead of tag for stronger supply-chain guarantees.
feat: support secret-backed OpenAI-compatible targets (v0.28.3, #7576) — new API-proxy target type; relevant if ado-aw ever wants to support OpenAI-compatible engine backends secured via secret-backed credentials.
API proxy: first-class AI-credit accounting for Copilot auto dynamic selector (v0.28.4, #7604) — improved cost/credit accounting when using Copilot's auto model selector, could inform ado-aw's engine cost-reporting/observability docs.
Add api-proxy CA certificate support (v0.28.10, #7816) — allows configuring a custom CA for the api-proxy; relevant for enterprises with private-CA TLS interception, could be surfaced via engine:/network: front-matter.
Warn when Codex uses auto under AWF API proxy (v0.28.10, #7818) — new diagnostic warning; ado-aw's engine validation could surface a similar hint for Codex users.
Add protected enclave entry diagnostics (v0.28.9, #7772) — richer diagnostics for enclave entry; could improve ado-aw audit output for MCPG-routed enclaves.
api-proxy: honour explicit `(redacted) scheme in target dialing (v0.28.11, #7868) — previously always dialed 443; relevant if ado-aw ever documents non-HTTPS proxy targets.

Deprecations

Remove "bounded-query" terminology (#7735) — naming/terminology change in AWF docs/config; check for any ado-aw docs or config referencing the old term.
Recompile enclave smoke with gateway key handoff (v0.28.10, #7763) — internal enclave key-handoff mechanism change; no direct ado-aw action expected but flagged for awareness given MCPG enclave routing dependency.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

index.crates.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "index.crates.io"

See Network Configuration for more information.

Generated by Dependency Version Updater · auto · 101.9 AIC · ⌖ 5.47 AIC · ⊞ 16.5K · ◷

`awf` `0.27.32` → `0.28.13`

Releases analyzed

This range fully supersedes the 0.27.32 → 0.28.12 entry previously recorded on this issue; everything through 0.28.12 is unchanged, plus one new patch release (v0.28.13).

Breaking changes

Firecracker microVM backend removed (v0.28.1) — AWF dropped Firecracker in favor of Cloud Hypervisor as the sandbox backend. ado-aw does not reference Firecracker directly, but any docs/runner-doctor guidance mentioning it upstream should not be assumed to apply going forward.

Security fixes

Enforce filesystem allowWrite boundaries in AWF sandboxes (v0.28.5, #7634) — tightens write-path enforcement so sandboxed agents can only write within explicitly allowed paths.
Route CLI artifact redirects through scoped Squid egress (v0.28.5, #7635) — closes a potential egress-control bypass.
Route CLI proxy through isolated egress relay (v0.28.2, #7338) — isolated egress relay for DIFC credential isolation.
Harden mcp gateway Authorization header contract against workspace credential exposure (v0.28.10, #7794) — worth checking against ado-aw's MCPG --topology-attach wiring.
Filter container cap_drop against host capability bounding set (v0.28.10, #7795) — tightens container capability dropping.
Drop CAP_NET_ADMIN from Cloud Hypervisor VMM (v0.28.11, #7887).
Cloud Hypervisor / virtiofsd confinement + per-run VMM identity isolation hardening (v0.28.11, #7889, #7890, #7894) — hardening for the preview Cloud Hypervisor sandbox backend.
Bind Cloud Hypervisor artifacts to attested release manifests (v0.28.11, #7891) — supply-chain hardening.
Patch vulnerable gRPC in GitHub CLI images (v0.28.13, #7997) — routine base-image CVE patch, no ado-aw config changes needed.

Notable features for ado-aw to adopt

Compiler-authorized digest-pinned container image manifests (v0.28.4, #7601) — ado-aw could adopt this to pin AWF/MCPG/agent images by digest for stronger supply-chain guarantees, pairing well with ado-aw's supply-chain: provenance story.
Secret-backed OpenAI-compatible API-proxy targets (v0.28.3, #7576) — relevant if ado-aw ever wants to support OpenAI-compatible engine backends.
API proxy CA certificate support (v0.28.10, #7816) — could be surfaced via engine:/network: front matter for private-CA TLS interception.
Warn when Codex uses auto under AWF API proxy (v0.28.10, #7818) — ado-aw's engine validation could surface a similar hint.
Protected enclave entry diagnostics (v0.28.9, #7772) — could improve ado-aw audit output for MCPG-routed enclaves.
api-proxy: honour explicit scheme in target dialing (v0.28.11, #7868) — relevant if ado-aw ever documents non-HTTPS proxy targets.

Deprecations

Removed "bounded-query" terminology (#7735) — naming/terminology change in AWF docs/config; check for any ado-aw docs or config referencing the old term.

No new items were introduced by v0.28.13 beyond the routine gRPC CVE patch noted above under Security fixes.

Recorded automatically by the Dependency Version Updater workflow.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

index.crates.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "index.crates.io"

See Network Configuration for more information.

Generated by Dependency Version Updater · auto · 116.1 AIC · ⌖ 5.51 AIC · ⊞ 16.5K · ◷

`awf` `0.28.9` → `0.28.13`

Releases analyzed

Security fixes

fix: patch vulnerable gRPC in GitHub CLI images (v0.28.13, PR #7997): Patches a vulnerable gRPC dependency bundled in the GitHub CLI images shipped inside AWF's agent image. No consumer action required beyond re-pinning past this version.

Notable features for ado-aw to adopt

Cloud Hypervisor confinement/isolation hardening (v0.28.11): A cluster of hardening work for the (preview) Cloud Hypervisor sandbox backend — drops CAP_NET_ADMIN from the VMM, verifies runtime confinement and virtiofsd sandbox confinement before VM boot, reserves microVM network resources atomically, binds Cloud Hypervisor artifacts to attested release manifests, isolates the VMM with per-run identities, and adds durable identity-validated microVM cleanup. ado-aw's OneBranch integration may benefit from documenting or relying on these stronger isolation guarantees once Cloud Hypervisor becomes the default backend.
Fail-closed Docker sandbox egress verification (v0.28.10, PR #7956): Adds a fail-closed check that Docker-sandboxed egress is actually being enforced; relevant to ado-aw's own network-isolation guarantees for the Agent stage.
Normalized parameterized model IDs for AI-credit pricing (v0.28.10, PR #7974): Improves cost accounting accuracy for parameterized model IDs; could improve ado-aw audit's cost/credit reporting.

No breaking changes or deprecations were identified in this range beyond what was already logged in the prior 0.28.9 comment.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

index.crates.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "index.crates.io"

See Network Configuration for more information.

Generated by Dependency Version Updater · auto · 200.8 AIC · ⌖ 5.47 AIC · ⊞ 16.5K · ◷

`awf` `0.28.9` → `0.28.14`

Releases analyzed

Security fixes

Patched vulnerable gRPC in GitHub CLI images (v0.28.13) — routine CVE remediation in the bundled GitHub CLI image; no consumer action beyond upgrading.

Notable features for ado-aw to adopt

Trusted enclave response schemas (v0.28.10) — formalizes schema validation for enclave-mediated responses; relevant if ado-aw ever wires enclave-backed MCP routing.
Dynamic repository enclave contract + GitHub-MCP-backed enclave repository admission (v0.28.13, v0.28.14) — AWF now supports admitting repositories into an enclave dynamically via GitHub MCP; worth evaluating for ado-aw's own dynamic-repo scoping story.
Enclave agent.tools.github configuration alongside legacy issues-read-v1 marker (v0.28.14) — new config surface for enclave GitHub tool scoping; ado-aw's GitHub MCP extension config may want to track this going forward.
GPT-6 Astra model support (v0.28.14) — add to any ado-aw model allowlist/docs if surfaced.

Deprecations

none identified in this range.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

index.crates.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "index.crates.io"

See Network Configuration for more information.

Generated by Dependency Version Updater · auto · 178.7 AIC · ⌖ 5.94 AIC · ⊞ 16.5K · ◷

`awf` `0.27.32` → `0.28.15`

Releases analyzed

Breaking changes

Firecracker microVM support removed (v0.28.1, v0.28.2) — Firecracker workflows/release artifacts were disabled and then the Firecracker engine was removed in favor of Cloud Hypervisor. ado-aw does not reference Firecracker directly, but worth confirming no downstream docs or examples assume it as an AWF backend.

Security fixes

ajv 8.20.0 security fix (v0.28.0) — safe dependency patch bump bundled with other safe-patch updates.
Enforce filesystem allowWrite boundaries in AWF sandboxes (v0.28.5) — tightens write-path enforcement so sandboxed agents can only write within explicitly allowed paths.
Route CLI artifact redirects through scoped Squid egress (v0.28.5) — CLI artifact download redirects are now proxied through Squid's domain-allowlist instead of bypassing egress controls; relevant to ado-aw's network-isolation model.
Patch vulnerable gRPC in GitHub CLI images (v0.28.13) — fixes a vulnerable gRPC dependency embedded in the gh CLI image AWF ships.
Update brace-expansion to 5.0.8 (GHSA-mh99-v99m-4gvg) (v0.28.13) — patches a known-CVE npm dependency.
Two additional "security" fixes in this range (v0.27.42: ignore unreachable x/text CVE in gh CLI binary; v0.27.43: suppress non-reachable GO-2026-4337 in gosu binary) are advisory-suppression fixes for unreachable code paths rather than exploitable issues — noted for completeness but not actionable.

Notable features for ado-aw to adopt

Read-only GitHub CLI access to agent enclaves (v0.28.8) and agent enclaves connected directly to shared GitHub MCP (v0.28.13) — could simplify or harden how ado-aw's Agent stage reaches GitHub read APIs without a full token.
Support compiler-authorized digest-pinned container image manifests (v0.28.4) — potential hook for supply-chain-pinned image verification in ado-aw's container invocation IR.
Support secret-backed OpenAI-compatible targets (v0.28.3) and continued API-proxy provider expansion (Google Vertex AI documented in v0.28.13) — relevant if ado-aw ever exposes additional model providers via engine.provider.
mcpg v0.4.18 now required, plus enclave network membership fix (v0.28.15) — confirms the MCPG_VERSION bump in this same batch is compatible; no action needed beyond keeping the two version bumps in lockstep.

Deprecations

None called out explicitly in this range beyond the Firecracker removal (treated above as breaking since it was a full backend removal rather than an announced-but-still-present deprecation).

Generated by Dependency Version Updater · auto · 195.5 AIC · ⌖ 3.17 AIC · ⊞ 14.8K · ◷

`awf` `0.28.15` → `0.28.16`

Releases analyzed

v0.28.16

Breaking changes

None identified in this release.

Security fixes

None identified in this release beyond routine dependency patches (ajv/dompurify docs-site advisories, smol-toml override, picomatch npm audit finding, js-yaml bump) — all scoped to AWF's own docs-site/tooling, not consumer-facing.

Notable features for ado-aw to adopt

--network-subnet flag (PR #8398, v0.28.16) — lets awf relocate its internal network off subnets that collide with the host/cluster network. Could be useful for ado-aw/OneBranch runners that see subnet collisions with awf-net.
"auto" model support for Pi and Codex via provider-prefix stripping (PR #8500, v0.28.16) — api-proxy now resolves auto model requests for Pi/Codex engines by stripping the provider prefix. Relevant if ado-aw ever exposes Pi/Codex as an engine: option with model: auto.

Deprecations

None identified in this release.

Generated by Dependency Version Updater · auto · 148.4 AIC · ⌖ 11.8 AIC · ⊞ 14.8K · ◷

`awf` `0.27.32` → `0.28.17`

Releases analyzed

Breaking changes

CLI shell command execution model changed (v0.28.5 area / dispatcher docs) — no direct breaking CLI-flag removal was found in this range, but see the Security section below: allowWrite filesystem boundary enforcement is now stricter, which could reject writes that a previously-lax sandbox silently permitted. Existing pinned configs relying on writing outside declared paths should be reviewed. (v0.28.5)
New --network-subnet flag changes default awf-net allocation behavior when host/cluster subnets collide — relevant if ado-aw ever pins a subnet range implicitly. (v0.28.16)

Security fixes

Enforce filesystem allowWrite boundaries in AWF sandboxes — tightens write-path enforcement so sandboxed agents can only write within explicitly allowed paths. (v0.28.5)
Route CLI artifact redirects through scoped Squid egress — ensures CLI artifact download redirects are proxied through Squid's domain-allowlist instead of bypassing egress controls. (v0.28.5)
Fix vulnerable gRPC in GitHub CLI images — patches a vulnerable gRPC dependency bundled in GitHub CLI container images. (v0.28.13)
Pin GitHub Actions to commit SHAs — supply-chain hardening for the firewall's own CI workflows. (v0.28.16)
Suppress non-reachable GO-2026-4337 in gosu binary / ignore unreachable x/text CVE embedded in gh CLI binary — advisory triage/suppression of unreachable CVEs bundled in vendored binaries. (v0.27.42, v0.27.43)
Remediate docs-site ajv/dompurify advisories, resolve npm audit picomatch finding, bump js-yaml to 5.4.1 — dependency-level security patches in the firewall's docs/tooling stack. (v0.28.16)

Notable features for ado-aw to adopt

Add fail-closed Docker sbx egress verification — could improve confidence in ado-aw's own sandboxed Docker workloads if reused. (v0.28.13)
--network-subnet to relocate awf-net off colliding host/cluster subnets — useful if ado-aw's CI/self-hosted runners ever collide with the default AWF subnet. (v0.28.16)
Preserve redacted upstream non-2xx payloads and correlation metadata in API proxy audit logs — could improve ado-aw audit's ADO-proxy correlation if similar logging patterns apply. (v0.28.17)
Append broker-generated repository scope to enclave agent prompts — relevant if ado-aw's own enclave/agent prompt construction could benefit from surfacing scope context similarly. (v0.28.17)
Support enclave agent.tools.github configuration alongside legacy issues-read-v1 marker — new configuration surface worth knowing about if ado-aw's GitHub tool wiring interacts with AWF enclave config. (v0.28.14)

Deprecations

Legacy issues-read-v1 marker — still supported alongside the new agent.tools.github configuration, but flagged as legacy in the release notes; worth tracking for eventual removal. (v0.28.14)

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

index.crates.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "index.crates.io"

See Network Configuration for more information.

Generated by Dependency Version Updater · auto · 226.6 AIC · ⌖ 6.83 AIC · ⊞ 14.8K · ◷

`awf` `0.27.32` → `0.28.18`

Releases analyzed

Note: this comment covers only the increment beyond 0.28.9, since prior bumps up to that version were already recorded above.

Security fixes

Patched vulnerable gRPC in GitHub CLI images (v0.28.11, #7997) — resolves a known gRPC CVE in the bundled gh CLI images shipped with the agent sandbox.
Remediated docs-site ajv/dompurify advisories (v0.28.18, #8395) — dependency-only fix, no runtime impact on ado-aw consumers.
Resolved remaining npm audit picomatch finding in api-proxy lockfile (v0.28.18, #8412).
smol-toml overridden to patched 1.8.0 (v0.28.18, #8400).

Notable features for ado-aw to adopt

--network-subnet flag to relocate awf-net off colliding host/cluster subnets (v0.28.18, #8398) — could help avoid Docker network collisions on self-hosted/OneBranch runners; worth exposing as a compiler-controlled flag if collisions are observed in practice.
api-proxy CA certificate support (v0.28.14, #7816) — allows the api-proxy sidecar to trust a custom CA, which may be relevant for enterprises with TLS-inspecting corporate proxies in front of the AWF sandbox.
Redact enclave-agent session logs by default (v0.28.18, #8578) — improves default log hygiene for enclave-based agent runs; worth confirming ado-aw's audit tooling still parses the (now redacted) logs correctly.
Requires mcpg v0.4.18+ and fixes enclave network membership (v0.28.16, #8305) — this AWF release documents a minimum MCPG version dependency; since this update also bumps MCPG_VERSION to 0.4.23, ado-aw's pinned pair satisfies this constraint, but future independent bumps of either constant should keep this compatibility floor in mind.

Deprecations

No new deprecations identified in this range (0.28.9 → 0.28.18); the rest of the range consisted of Cloud Hypervisor/dynamic-enclave preview work, CI/test/doc hygiene, and internal refactors with no consumer-visible effect on ado-aw's standalone/1ES/job/stage AWF invocation.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

index.crates.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "index.crates.io"

See Network Configuration for more information.

Generated by Dependency Version Updater · auto · 278.5 AIC · ⌖ 5.29 AIC · ⊞ 14.8K · ◷

`awf` `0.27.32` → `0.28.20`

Releases analyzed

v0.27.33 ... v0.28.20 (32 releases total)

Breaking changes

Remove Firecracker support (v0.28.2) — the Firecracker microVM backend has been removed entirely. ado-aw does not reference Firecracker directly, so no action is required unless a future integration assumed its availability.
Enforce filesystem allowWrite boundaries in AWF sandboxes (v0.28.5) — write-path enforcement inside the sandbox is now stricter; any custom allowWrite configs should be re-verified after upgrade.

Security fixes

Enforce filesystem allowWrite boundaries in AWF sandboxes (v0.28.5) — tightens write-path enforcement so sandboxed agents can only write within explicitly allowed paths.
Route CLI artifact redirects through scoped Squid egress (v0.28.5) — ensures CLI artifact download redirects are proxied through Squid's domain-allowlist instead of bypassing egress controls.
Route CLI proxy through isolated egress relay (v0.28.2) — hardens the cli-proxy credential-isolation path.
fix(security): update vulnerable deps in agent and api-proxy images (v0.27.42).
Switch Squid image to Alpine to remove Berkeley DB/Sleepycat components (v0.27.42) — reduces the Squid image's attack surface.
fix(security): suppress non-reachable GO-2026-4337 in gosu binary (v0.27.44).
fix(supply-chain): ignore unreachable x/text CVE embedded in gh CLI binary (v0.27.42).
chore(deps): safe patch updates incl. ajv 8.20.0 security fix (v0.28.0).
Pin GitHub Actions to commit SHAs (v0.28.16) — supply-chain hardening for upstream CI.

Notable features for ado-aw to adopt

Dynamic GitHub-MCP-backed enclave repository admission and run dynamic agent enclaves with repository-scoped GitHub MCP identities (v0.28.14) — AWF can now admit and scope enclaves per-repository via GitHub MCP identity; worth evaluating for ado-aw's dynamic-enclave / MCP surfaces once mcpg support (see below) is adopted.
--network-subnet flag to relocate awf-net off colliding host/cluster subnets (v0.28.16) — useful knob for CI runners with pre-existing Docker network collisions.
--enable-host-access/--allow-host-ports confirmed to work standalone with --network-isolation (topology mode) and in strict security mode (v0.27.43, v0.28.0) — could simplify host-service access scenarios if ado-aw ever needs them.
Harden and document the MCP gateway Authorization header contract against workspace credential exposure (v0.27.44) — relevant to ado-aw's MCPG integration; worth a docs cross-check.
docs: require mcpg v0.4.18 and fix enclave network membership (v0.28.15) — AWF now expects at least mcpg v0.4.18 for correct enclave network membership. The companion MCPG bump in this cycle (to 0.4.24) satisfies this.

Deprecations

None called out explicitly in this range beyond the Firecracker removal noted above (which was a full removal, not a deprecation window).

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

index.crates.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "index.crates.io"

See Network Configuration for more information.

Generated by Dependency Version Updater · auto · 299.2 AIC · ⌖ 12.4 AIC · ⊞ 14.8K · ◷

`awf` `0.27.32` → `0.28.22`

Releases analyzed

34 releases were published between v0.27.33 and v0.28.22. Highlights below; see the full compare for the complete list.

v0.28.1 — enclave/routing groundwork
v0.28.2 — Firecracker removed, Cloud Hypervisor engine work begins, unified enclave foundation
v0.28.5 — allowWrite filesystem scoping enforcement made stricter
v0.28.9 — Cloud Hypervisor filesystem write planner / virtiofsd staging
v0.28.16–v0.28.17 — Cloud Hypervisor hardening (tool-cache mounts, confinement verification, per-run VMM identities)
v0.28.20–v0.28.22 — dynamic GitHub-MCP-backed enclave repository admission, NVX phase 2/3 foundations, routing configuration surface

Breaking changes

Firecracker microVM backend removed (v0.28.2, PR #7362) in favor of Cloud Hypervisor v53.0. ado-aw does not reference Firecracker directly, so no action needed unless a future --container-runtime value assumption depended on it.
Legacy "bounded execution" replaced by MCP enclaves (v0.28.0, PR #6994) — routes unified enclaves exclusively through MCPG. Worth confirming ado-aw's MCPG integration (src/compile/mcpg.rs) still matches the current enclave contract on the next MCPG bump.
Stricter allowWrite filesystem enforcement (v0.28.5, PR #7634) — existing filesystem allowlists should be double-checked if ado-aw ever sets allowWrite scoping directly.

Security fixes

fast-uri bumped to 3.1.4, closing GHSA-4c8g-83qw-93j6 and GHSA-v2hh-gcrm-f6hx (v0.27.41, PR #6497/#6502).
ajv bumped to 8.20.0 for a security fix (v0.27.44, PR #6962).
Vulnerable dependencies patched in agent and api-proxy container images (v0.27.42, PR #6505); Squid image switched to Alpine to drop Berkeley DB/Sleepycat components (PR #6507).
brace-expansion patched for GHSA-mh99-v99m-4gvg (v0.27.44, PR #6585).
gVisor gRPC vulnerability patched in GitHub CLI images (v0.28.9, PR #7997).
GitHub Actions pinned to commit SHAs across the AWF repo's own CI (v0.28.13, PR #8424) — upstream hygiene, no ado-aw action needed.

Notable features for ado-aw to adopt

Cloud Hypervisor v53.0 preview backend (--cloud-hypervisor-preview and related flags, v0.28.2 onward) — a GitHub-hosted KVM-based microVM alternative to container isolation. Could be surfaced as an opt-in runtimes/engine option if stronger isolation is desired.
--pids-limit (v0.27.44, PR #7150) — configurable process/thread ceiling for the agent container; ado-aw currently doesn't set this explicitly.
--network-subnet (v0.28.13) — lets callers override the default 172.30.0.0/24 awf-net CIDR when it collides with host/cluster networks (e.g. OpenShift's 172.30.0.0/16). Worth documenting as an escape hatch for self-hosted runners.
--verify-sbx-egress (v0.28.13) — fails fast before agent startup if Docker sbx doesn't block direct non-proxy egress; a good diagnostic/hardening flag to consider wiring into the standalone/1ES compile targets.
DIFC cli-proxy-egress relay for isolated CLI proxy credential paths (v0.28.1/v0.28.2) — relevant to the ado-proxy credential-isolation design; worth a look for parity ideas.
Sealed probes for private repositories / confidentiality-aware sealed probe budgets (v0.27.43/v0.28.1, PR #6673/#6728) — could inform future ado-aw execution-context contributor design for private-repo linked work items.
Dynamic GitHub-MCP-backed enclave repository admission (v0.28.20/v0.28.21, PR #8217/#8276) — repository-scoped GitHub MCP identities for dynamic agent enclaves; relevant to ado-aw's own scoped-credential model for custom safe-output jobs.

Deprecations

Firecracker support removed entirely (not just deprecated) as of v0.28.2 — superseded by Cloud Hypervisor v53.0. No ado-aw front-matter references Firecracker today.
"Bounded execution" terminology retired in favor of "MCP enclaves" (v0.27.44/v0.28.0-era PRs #6994, #7735) — purely internal AWF terminology, no consumer-facing ado-aw impact identified.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

index.crates.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "index.crates.io"

See Network Configuration for more information.

Generated by Dependency Version Updater · auto · 211.2 AIC · ⌖ 4.95 AIC · ⊞ 14.3K · ◷

Consolidated into the canonical rolling issue #2230 ( [deps-release-notes] awf — upstream release action items ). Its action items have been preserved there.

Generated by Deps Release-Notes Consolidator · auto · 74.6 AIC · ⌖ 4.15 AIC · ⊞ 9.6K

[deps-release-notes] awf — upstream release action items #2028

Description

Rolling upstream release action items — awf

Consolidated history (earliest → latest)

0.25.48 → 0.25.60 (was #851)

0.25.48 → 0.25.63 (was #859)

0.25.65 → 0.25.66 (was #902)

0.25.65 → 0.25.68 (was #930)

0.25.65 → 0.27.0 (was #950)

0.25.65 → 0.27.1 (was #970)

0.25.65 → 0.27.2 (was #983)

0.25.65 → 0.27.3 (was #990)

0.27.3 → 0.27.5 (was #1093)

0.27.3 → 0.27.7 (was #1118)

0.27.3 → 0.27.9 (was #1184)

0.27.9 → 0.27.11 (was #1219)

0.27.9 → 0.27.12 (was #1241)

0.27.9 → 0.27.13 (was #1252)

0.27.9 → 0.27.15 (was #1260)

0.27.9 → 0.27.21 (was #1304)

0.27.32 → 0.28.5 (was #1990)

0.27.32 → 0.28.9 (was #2028) — canonical

Activity

github-actions commented on Aug 29, 2026

awf 0.27.32 → 0.28.10

Releases analyzed

Breaking changes

Security fixes

Notable features for ado-aw to adopt

Deprecations

github-actions commented on Aug 30, 2026

awf 0.28.9 → 0.28.10

Releases analyzed

Security fixes

Notable features for ado-aw to adopt

Deprecations

github-actions commented on Sep 1, 2026

awf 0.27.32 → 0.28.12

Releases analyzed

Breaking changes

Security fixes

Notable features for ado-aw to adopt

Deprecations

github-actions commented on Sep 3, 2026

awf 0.27.32 → 0.28.13

Releases analyzed

Breaking changes

Security fixes

Notable features for ado-aw to adopt

Deprecations

github-actions commented on Sep 6, 2026

awf 0.28.9 → 0.28.13

Releases analyzed

Security fixes

Notable features for ado-aw to adopt

github-actions commented on Sep 9, 2026

awf 0.28.9 → 0.28.14

Releases analyzed

Security fixes

Notable features for ado-aw to adopt

Deprecations

github-actions commented on Sep 12, 2026

awf 0.27.32 → 0.28.15

Releases analyzed

Breaking changes

Security fixes

Notable features for ado-aw to adopt

Deprecations

github-actions commented on Sep 13, 2026

awf 0.28.15 → 0.28.16

Releases analyzed

Breaking changes

Security fixes

Notable features for ado-aw to adopt

Deprecations

github-actions commented on Sep 15, 2026

awf 0.27.32 → 0.28.17

Releases analyzed

Breaking changes

Security fixes

Rolling upstream release action items — `awf`

`0.25.48` → `0.25.60` (was #851)

`0.25.48` → `0.25.63` (was #859)

`0.25.65` → `0.25.66` (was #902)

`0.25.65` → `0.25.68` (was #930)

`0.25.65` → `0.27.0` (was #950)

`0.25.65` → `0.27.1` (was #970)

`0.25.65` → `0.27.2` (was #983)

`0.25.65` → `0.27.3` (was #990)

`0.27.3` → `0.27.5` (was #1093)

`0.27.3` → `0.27.7` (was #1118)

`0.27.3` → `0.27.9` (was #1184)

`0.27.9` → `0.27.11` (was #1219)

`0.27.9` → `0.27.12` (was #1241)

`0.27.9` → `0.27.13` (was #1252)

`0.27.9` → `0.27.15` (was #1260)

`0.27.9` → `0.27.21` (was #1304)

`0.27.32` → `0.28.5` (was #1990)

`0.27.32` → `0.28.9` (was #2028) — canonical

`awf` `0.27.32` → `0.28.10`

`awf` `0.28.9` → `0.28.10`

`awf` `0.27.32` → `0.28.12`

`awf` `0.27.32` → `0.28.13`

`awf` `0.28.9` → `0.28.13`

`awf` `0.28.9` → `0.28.14`

`awf` `0.27.32` → `0.28.15`

`awf` `0.28.15` → `0.28.16`

`awf` `0.27.32` → `0.28.17`

`awf` `0.27.32` → `0.28.18`

`awf` `0.27.32` → `0.28.20`

`awf` `0.27.32` → `0.28.22`