[deps-release-notes] mcpg — upstream release action items

Rolling upstream release action items — `mcpg`

This is the single canonical tracking issue for action items arising from
new releases of the mcpg dependency. The update-awf-version workflow appends
a new comment to this issue for each version bump going forward, so the most
recent activity lives in the comments below. This body is a consolidated
history of everything filed so far.

Latest pinned version covered: 0.4.13

Consolidated history (earliest → latest)

`0.3.12` → `0.3.23` (was #882)

OTel span attributes aligned with gen_ai semantic conventions (v0.3.16): MCPG now emits OTel spans following the OpenTelemetry gen_ai semconv. ado-aw's audit analyzer (src/audit/analyzers/otel.rs) may need updating if it relies on specific MCPG span field names.
Per-session tool call limits in allow-only guard policies (v0.3.20): MCPG enforces per-session limits in allow-only mode; ado-aw could expose as a configurable field (e.g., tools.call-limit:).
Timeout fields added to embedded JSON schema (v0.3.23): MCPG config schema now includes timeout fields; ado-aw should review whether to surface in engine: or tools: front-matter.
Security: GHE Cloud data residency proxy routing fix (v0.3.23): GraphQL requests were routed to wrong upstream for GHE Cloud data-residency tenants; fixed automatically on version bump.

`0.3.23` → `0.3.24` (was #903)

Breaking: "API key" surface renamed to "Agent ID" (v0.3.24): Deprecated compatibility aliases removed; gateway now uses X-Agent-ID for routing. Audit MCPG config types in src/compile/extensions/mod.rs for any removed alias fields.
Unauthenticated /reflect endpoint for live DIFC label snapshots (v0.3.24): New diagnostics endpoint; ado-aw's audit/status commands could use this for richer DIFC diagnostics.

`0.3.23` → `0.3.25` (was #931)

Security: $ENV expansion disabled in tool response filters (v0.3.25): Prevents environment variable leakage/injection through crafted tool responses. Verify any custom filter expressions remain functional.
Metadata endpoint allowlisting (v0.3.25): MCPG proxy now allowlists metadata endpoints and passes through unrecognized reads; may resolve prior MCP client liveness/metadata call blocking.

`0.3.25` → `0.3.26` (was #1059)

OTLP multi-endpoint fan-out via GH_AW_OTLP_ENDPOINTS (v0.3.26): MCPG supports sending OTel telemetry to multiple OTLP endpoints; ado-aw could expose in compiled pipeline variables.
Deprecation: MCP_GATEWAY_API_KEY → MCP_GATEWAY_AGENT_ID (v0.3.26): run.sh now reads MCP_GATEWAY_AGENT_ID with deprecated fallback for MCP_GATEWAY_API_KEY. ado-aw generates pipelines that set MCP_GATEWAY_API_KEY (src/compile/agentic_pipeline.rs, src/compile/common.rs); migrate to MCP_GATEWAY_AGENT_ID before the fallback is removed.

`0.3.25` → `0.3.27` (was #1119)

GitHub MCP Server v1.3.0 support (v0.3.27): MCPG routes PR commits and supports get_file_blame spec; verify GitHub MCP extension config + network allowlists are compatible.
refusal-labels guard policy (v0.3.27): New guard policy type for classifying agent refusals; ado-aw could expose in MCPG configuration.
MCP_GATEWAY_SHUTDOWN_TIMEOUT env var documented (v0.3.27): ado-aw could expose in generated pipeline teardown steps.

`0.3.25` → `0.3.28` (was #1169)

Security: wazero WASM guard hardening (v0.3.28): Added memory cap and backend call limit to wazero WASM runtime; protects against malicious/malformed WASM guards. Consumers benefit automatically on upgrade.

`0.3.25` → `0.3.29` (was #1185)

Security: DIFC labeling gaps covered (v0.3.28): get_code_quality_finding, ui_get, add_gpg_key, add_ssh_key previously lacked DIFC integrity/secrecy labels; gap now closed. Older MCPG versions did not enforce integrity for these operations.
Opt-in observed URL domain audit pipeline (v0.3.29): Records which URL domains appear in MCP tool responses + write sinks; ado-aw could expose opt-in flag and surface data in ado-aw audit reports.

`0.3.29` → `0.3.31` (was #1242)

Gateway domain validation widened to RFC-1123 topology hostnames (v0.3.30): Accepts topology hostnames like my-server.namespace.svc.cluster.local; fixes unexpected validation errors.
Prompt passthrough via go-sdk (v0.3.31): Fixes context propagation + adds prompt passthrough through SDK-mediated backend calls.
DIFC proxy GHEC data-residency REST API host derivation fix (v0.3.31): Fixes wrong API host calculation for GHEC data-residency deployments.

`0.3.29` → `0.3.32` (was #1253)

GitHub reaction operations classified as WRITE_OPERATIONS (v0.3.32): Adding/removing emoji reactions now subject to DIFC integrity enforcement. Agents calling GitHub reaction APIs require adequate DIFC integrity clearance. This is a security tightening — confirm DIFC integrity level is configured correctly.

`0.4.1` → `0.4.12` (was #2029)

fix: bump Go to 1.26.4 and grpc to v1.82.1 to clear High CVEs (release 0.4.5, PR #9933) — resolves high-severity CVEs in the Go runtime and gRPC dependency used by the MCPG binary/image.
No breaking changes, no notable features (remaining releases in this range were internal refactors/CI hygiene changes with no consumer-visible effect), no deprecations identified in this range.

`0.4.1` → `0.4.13` (was #2040) — canonical

Security (v0.4.5): Bumped Go to 1.26.4 and grpc to v1.82.1 to clear High-severity CVEs in the toolchain/dependency graph. No consumer-facing action required beyond re-pinning to a version that includes the fix. See the v0.4.5 release.
v0.4.6/v0.4.7: Added configurable stdio container runtime support (Docker/Podman) with runtime command overrides, including a dockerless Podman mode. ado-aw could surface this as an alternative container runtime option for the MCPG sidecar in environments where Docker-in-Docker/Docker daemon access is restricted (relevant given this repo's own "Docker in Docker is not supported" constraint). See the gh-aw-mcpg releases.

Consolidated by the Deps Release-Notes Consolidator workflow. Superseded per-release issues were closed and point here.> Generated by Deps Release-Notes Consolidator · auto · 76.3 AIC · ⌖ 11.6 AIC · ⊞ 10.6K · ◷

`mcpg` `0.4.13` → `0.4.14`

Releases analyzed

v0.4.14

Notable features for ado-aw to adopt

Plural gateway agent ID configuration (PR #12116, v0.4.14): adds GatewayConfig.AgentIDs (agent_ids in TOML / gateway.agentIds in stdin JSON), letting a single gateway configuration list multiple concurrent primary/enclave agent session identifiers instead of just one. Singular (agentId/agent_id) and plural forms are mutually exclusive — the published schema now requires exactly one of agentId or agentIds (with minItems: 1 / non-blank entries enforced). ado-aw's MCPG gateway config generation could adopt agentIds where a pipeline needs to expose more than one concurrent agent identity through a single gateway instance.

Deprecations

apiKey removed from the published schema (PR #12116, v0.4.14): the bundled/published MCPG config schema and docs no longer reference apiKey; internal legacy api_key/apiKey parsing is still supported for compatibility, but it is no longer part of the documented contract. ado-aw should confirm it does not rely on the now-undocumented apiKey field name in generated gateway configs and migrate any residual references to agentId/agentIds.

Generated by Dependency Version Updater · auto · 157.2 AIC · ⌖ 5.45 AIC · ⊞ 16.5K · ◷

`mcpg` `0.4.1` → `0.4.15`

Releases analyzed

(Versions between 0.4.1 and 0.4.13 were already covered by the previous comment on this issue; this comment covers the newly-released 0.4.14 and 0.4.15.)

Security fixes

v0.4.15 — "Cover notification and star mutations in GitHub guard" (PR #12105): extends DIFC-style guard coverage to GitHub reaction, notification, and star mutation operations, closing a gap where these mutation types were not previously subject to the same access checks as other GitHub write operations.

Notable features for ado-aw to adopt

v0.4.14 / v0.4.15 — "Add mutually exclusive plural gateway agent ID configuration" (PR #12116) and "Isolate runtime access for multiple gateway agent IDs" (PR #12186): MCPG now supports configuring multiple, mutually-exclusive gateway agent IDs with isolated runtime access per agent ID. This could let ado-aw route distinct agent identities (e.g. per-job or per-tool) through MCPG with stronger isolation guarantees, worth evaluating for future multi-agent pipeline scenarios.

Deprecations

None noted in this range.

Generated by Dependency Version Updater · auto · 190.1 AIC · ⌖ 6.38 AIC · ⊞ 16.5K · ◷

`mcpg` `0.4.1` → `0.4.17`

Releases analyzed

Security fixes

Go/gRPC CVE remediation: "fix: bump Go to 1.26.4 and grpc to v1.82.1 to clear High CVEs" (v0.4.5).
Secret sanitization in logs: "fix(logger): sanitize secrets in file/server log lines" (v0.4.9) — reduces risk of credential leakage in gateway log output.
Trusted host-path mount policy: "Enforce a trusted host-path mount policy before launching container MCP servers" (v0.4.9) — hardens container MCP server launch against untrusted host mounts.

Notable features for ado-aw to adopt

Circuit breaker reliability fix: "Fix circuit breaker wedging permanently in HALF-OPEN after transport-error probe" (v0.4.9) — could reduce transient MCPG connectivity failures ado-aw pipelines might otherwise retry around.
Explicit DNS SANs on proxy TLS certificates: "Add explicit DNS SANs to proxy TLS certificates" (v0.4.12) — may improve TLS validation compatibility for consumers connecting via hostname.
gh CLI token authorization scheme support: "Accept gh CLI token authorization scheme for enclave capabilities" (v0.4.13) — could simplify credential wiring for gh-CLI-flavored auth in enclave/proxy scenarios.
Dynamic enclave admission / repository delegation: "Add github-repository-delegation-v1 control-plane core (ADR 0001)" (v0.4.16) and "Extend repository delegation for dynamic enclave admission (idempotency, recovery, owner scoping, reconciliation)" (v0.4.17) — a new control-plane primitive for scoping repository access dynamically; worth evaluating whether ado-aw's azure-devops/MCPG integration could use this for finer-grained per-run repository delegation instead of static scope configuration.
MCPGatewaySpecVersion bumps: 1.15.0 (v0.4.6) and 1.17.0 (v0.4.15) — gateway spec version increments that may introduce schema-visible config fields; worth a diff check against ado-aw's mcpg.rs typed config if any new gateway spec fields should be surfaced.

Deprecations

Deprecated DIFC resource API removed: "Remove deprecated DIFC resource API and colocate schema cache" (v0.4.11) — internal API removal; no direct ado-aw impact since ado-aw doesn't call this internal Go API, noting for completeness only.

Generated by Dependency Version Updater · auto · 141.8 AIC · ⌖ 6.33 AIC · ⊞ 16.5K · ◷

`mcpg` `0.4.13` → `0.4.20`

Releases analyzed

Notable features for ado-aw to adopt

Enable repository delegation in unified MCP gateway mode (v0.4.19, #12753) and extended repository delegation for dynamic enclave admission (v0.4.17, #12605) — MCPG now supports delegating repository access dynamically within unified gateway mode, including idempotent recovery and owner scoping. ado-aw could surface this for dynamic-repo-scoped agentic workflows instead of static allowlists.
Honor sink-visibility exemption in safe-outputs safety net (v0.4.20, #12767) — MCPG's safe-outputs safety net now respects a sink-visibility exemption; relevant to how ado-aw's own safe-outputs sanitization/labeling interacts with MCPG's guard layer. Worth confirming ado-aw's safe-output DIFC expectations still hold under this change.
Mutually exclusive plural gateway agent ID configuration (v0.4.14, #12116) and isolate runtime access for multiple gateway agent IDs (v0.4.15, #12186) — MCPG now supports configuring/isolating multiple gateway agent IDs; may be relevant if ado-aw ever needs multi-agent-ID MCPG topologies.

Deprecations

none identified in this range.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

index.crates.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "index.crates.io"

See Network Configuration for more information.

Generated by Dependency Version Updater · auto · 178.7 AIC · ⌖ 5.94 AIC · ⊞ 16.5K · ◷

`mcpg` `0.4.1` → `0.4.20`

Releases analyzed

Breaking changes

None identified. MCPGatewaySpecVersion moved from 1.15.0 → 1.17.0 (v0.4.6, v0.4.15) across this range but no consumer-visible schema break was described.

Security fixes

Bump Go to 1.26.4 and grpc to v1.82.1 to clear High CVEs (v0.4.5) — resolves high-severity CVEs in the Go toolchain/grpc dependency used by the gateway binary ado-aw pins via MCPG_VERSION.
Add explicit DNS SANs to proxy TLS certificates (v0.4.12) — hardens TLS certificate validation for the gateway's internal proxy.

Notable features for ado-aw to adopt

Configurable stdio container runtime (Docker/Podman) with runtime command overrides, plus dockerless Podman mode (v0.4.6, v0.4.7) — could let ado-aw's MCPG compilation (src/compile/mcpg.rs) support Podman-based stdio MCP servers, useful for OneBranch/rootless environments.
Mutually exclusive plural gateway agent ID configuration and isolate runtime access for multiple gateway agent IDs (v0.4.14, v0.4.15) — relevant if ado-aw ever needs to route multiple distinct agent identities through one MCPG instance (e.g. multi-agent custom safe-output jobs).
Repository delegation for dynamic enclave admission (idempotency, recovery, owner scoping, reconciliation) across v0.4.17–v0.4.19, culminating in repository delegation enabled in unified MCP gateway mode (v0.4.19) — a new capability for dynamically admitting repositories into an enclave session; worth evaluating for ado-aw's dynamic-repository-enclave scenarios (mirrors AWF's own dynamic-enclave work landing in the same window).
Honor sink-visibility exemption in safe-outputs safety net (v0.4.20) — a DIFC/safe-outputs behavior change in the gateway's safety net that ado-aw's safe-output pipeline should be aware of, though no explicit ado-aw action was called out upstream.
Auto-detect wazero execution engine instead of forcing Compiler mode (v0.4.15) — may improve jq-filter performance/portability for MCPG's tool-response filtering, transparent to ado-aw.

Deprecations

Removed deprecated DIFC Resource type and its constructors (v0.4.11) — internal to MCPG's Go API surface; ado-aw does not consume the Go SDK directly, so no action expected, but flagged in case any ado-script bundle vendors MCPG internals.

Generated by Dependency Version Updater · auto · 195.5 AIC · ⌖ 3.17 AIC · ⊞ 14.8K · ◷

`mcpg` `0.4.20` → `0.4.21`

Releases analyzed

v0.4.21

Breaking changes

None identified in this release.

Security fixes

None identified beyond routine CI dependency bumps (actions/*, docker/*, astral-sh/setup-uv) and GitHub Actions pinning to commit SHAs, none of which affect the shipped mcpg binary's runtime behavior.

Notable features for ado-aw to adopt

Honor proxy environment settings in custom HTTP transports (PR #12832, v0.4.21) — MCPG's custom HTTP transports now respect standard proxy environment variables (e.g. HTTPS_PROXY). Worth checking whether ado-aw's MCPG launch env/passthrough should rely on this instead of duplicating proxy config.
Delegation control-plane documentation (PR #12900, v0.4.21) — documents the delegation control feature and MCP_GATEWAY_DELEGATION_* environment variables (building on the repository-delegation features already noted in the 0.4.13 → 0.4.20 comment above). ado-aw could reference this doc if it ever wires up dynamic repository delegation through MCPG.

Deprecations

None identified in this release.

Generated by Dependency Version Updater · auto · 148.4 AIC · ⌖ 11.8 AIC · ⊞ 14.8K · ◷

`mcpg` `0.4.1` → `0.4.22`

Releases analyzed

Security fixes

Bump Go to 1.26.4 and grpc to v1.82.1 to clear High CVEs — resolves high-severity CVEs in the Go toolchain and gRPC dependency used by the MCPG binary. (v0.4.5)
Sanitize secrets in file/server log lines — hardens the logger against accidental secret leakage into log output. (v0.4.9)
Bound SSE event size on SDK streamable/SSE client transports — prevents unbounded SSE payloads from being accepted, reducing DoS/resource-exhaustion risk. (v0.4.22)

Notable features for ado-aw to adopt

Add configurable stdio container runtime (Docker/Podman) with runtime command overrides — MCPG can now launch stdio MCP servers via Podman as well as Docker; worth evaluating if ado-aw wants to support Podman-based stdio MCP containers. (v0.4.6)
Repository delegation for dynamic enclave admission (idempotency, recovery, owner scoping, reconciliation) enabled in unified MCP gateway mode — a significant new delegation feature; relevant if ado-aw's MCPG integration ever needs dynamic per-repository enclave admission rather than static configuration. (v0.4.17, v0.4.19)
Isolate runtime access for multiple gateway agent IDs / mutually exclusive plural gateway agent ID configuration — new multi-agent-ID configuration surface that could simplify ado-aw's MCPG wiring if it ever needs to route multiple distinct agent identities through one gateway. (v0.4.14, v0.4.15)
Honor proxy environment settings in custom HTTP transports — improves HTTP proxy interoperability for user-defined MCP HTTP servers behind corporate/sandboxed proxies. (v0.4.21)
Honor sink-visibility exemption in safe-outputs safety net — DIFC guard refinement for safe-output write paths; worth confirming ado-aw's safe-output sink labeling still aligns. (v0.4.20)

Deprecations

None identified in this range.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

index.crates.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "index.crates.io"

See Network Configuration for more information.

Generated by Dependency Version Updater · auto · 226.6 AIC · ⌖ 6.83 AIC · ⊞ 14.8K · ◷

`mcpg` `0.4.1` → `0.4.23`

Releases analyzed

Note: this comment covers only the increment beyond 0.4.13, since prior bumps up to that version were already recorded above.

Breaking changes

MCPGatewaySpecVersion bumped to 1.17.0 (v0.4.15, #12159) — the gateway's own spec version advanced across this range (also passed through 1.15.0/1.16.0 in the previously-recorded range). Since MCPG negotiates this spec version with ado-aw's compiled MCPG launch config (src/compile/mcpg.rs), confirm the compiler's config generation is still compatible before/after this bump.

Security fixes

Redact enclave MCP request and response payloads from exported logs by default (v0.4.23, #13179) — improves default log hygiene for MCPG-routed enclave traffic; worth confirming ado-aw's audit command still extracts the fields it needs from the (now redacted) exported logs.
Pin GitHub Actions to commit SHAs (v0.4.21, #12895) — upstream CI hardening only, no consumer-visible effect on ado-aw.

Notable features for ado-aw to adopt

Enable repository delegation in unified MCP gateway mode (v0.4.19, #12753) plus the broader delegation control-plane work across v0.4.16-v0.4.22 (idempotency, recovery, owner scoping, reconciliation, TTL-in-seconds semantics) — this is a substantial new capability for scoping dynamic repository access through MCPG; worth evaluating whether ado-aw's enclave/repository-scoping story (ado_proxy, azure_cli extension) could build on it instead of, or alongside, its own scope model.
Honor sink-visibility exemption in safe-outputs safety net (v0.4.20, #12767) — directly relevant to ado-aw's own safe_outputs module; confirm ado-aw's safe-output MCP tool definitions interact correctly with this exemption path.
Fix data race in getCircuitBreaker (v0.4.22, #13146) — reliability fix for MCPG's circuit-breaker under concurrent load; no action needed beyond taking the fix.
Bound SSE event size on SDK streamable/SSE client transports (v0.4.23, #13145) — defensive hardening against oversized SSE events; no ado-aw-side change needed but good to be aware of if agents stream large tool responses through MCPG.

Deprecations

No new deprecations identified in this range (0.4.13 → 0.4.23) beyond the ones noted above; the remainder was internal refactors, Go-guard test coverage, dependency bumps, and CI/doc hygiene with no consumer-visible effect.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

index.crates.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "index.crates.io"

See Network Configuration for more information.

Generated by Dependency Version Updater · auto · 278.5 AIC · ⌖ 5.29 AIC · ⊞ 14.8K · ◷

`mcpg` `0.4.1` → `0.4.24`

Releases analyzed

v0.4.2 ... v0.4.24 (23 releases total)

Breaking changes

None identified as consumer-visible breaking changes. Most of this range is internal refactors, test coverage, dependency bumps, and DIFC/guard label coverage expansion with no schema or CLI-flag changes affecting ado-aw's MCPG integration.

Security fixes

Add explicit DNS SANs to proxy TLS certificates (v0.4.12) — hardens the proxy's TLS certificate generation.
Redact enclave MCP request and response payloads from exported logs by default (v0.4.23) — prevents sensitive enclave traffic from leaking into exported logs.
Restrict advertised MCP protocol versions to avoid sessionless discovery on stateful HTTP frontends (v0.4.24) — closes a discovery/enumeration gap on stateful HTTP MCP frontends.
Pin GitHub Actions to commit SHAs (v0.4.21) — supply-chain hardening for upstream CI.
fix: bump Go to 1.26.4 and grpc to v1.82.1 to clear High CVEs (v0.4.5).

Notable features for ado-aw to adopt

Add github-repository-delegation-v1 control-plane core (ADR 0001), extended across v0.4.16 through v0.4.19 with idempotency, recovery, owner scoping, reconciliation, and finally enabled in unified MCP gateway mode in v0.4.19 — a new repository-delegation control plane for dynamic enclave admission. Worth evaluating for ado-aw's dynamic-enclave / repository-scoped GitHub MCP identity work (paired with AWF's "dynamic GitHub-MCP-backed enclave repository admission" feature landed in the same period).
Add capability-bound enclave issue reads (v0.4.11) — narrower, capability-scoped read access for enclaves; relevant to ado-aw's ado-proxy-style scoped-credential design philosophy.
Document delegation control feature and MCP_GATEWAY_DELEGATION_* environment variables (v0.4.21) — new env vars ado-aw's MCPG launch-env wiring (src/compile/mcpg.rs) may want to surface if repository delegation is adopted.
Make OTLP/HTTP exporter defaults explicit (v0.4.24) — clarifies observability/tracing exporter defaults.

Deprecations

Remove deprecated DIFC resource API and colocate schema cache (v0.4.11) — the previously-deprecated DIFC Resource type and its constructors have now been fully removed upstream. If ado-aw ever referenced the DIFC resource API directly (it does not appear to), no migration is needed; noting for completeness since the removal completed a deprecation cycle in this range.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

index.crates.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "index.crates.io"

See Network Configuration for more information.

Generated by Dependency Version Updater · auto · 299.2 AIC · ⌖ 12.4 AIC · ⊞ 14.8K · ◷

`mcpg` `0.4.1` → `0.4.25`

Releases analyzed

Security fixes

Go/grpc bumped to clear High CVEs (v0.4.5): "bump Go to 1.26.4 and grpc to v1.82.1 to clear High CVEs" — routine dependency-driven CVE remediation with no ado-aw-facing change, but worth noting as it confirms the pinned binary carries fixed Go/grpc versions.
Enclave request/response payload redaction (v0.4.23): "Redact enclave MCP request and response payloads from exported logs by default" — reduces the chance of secrets/PII leaking into exported MCPG logs; ado-aw's audit analyzers (src/audit/analyzers/mcp.rs) should confirm they still parse the redacted log shape correctly.
MCP protocol version discovery restriction (v0.4.24): "Restrict advertised MCP protocol versions to avoid sessionless discovery on stateful HTTP frontends" — closes a discovery/enumeration surface on stateful HTTP MCP frontends.

Notable features for ado-aw to adopt

Configurable stdio container runtime (Docker/Podman) (v0.4.6): MCPG can launch stdio MCP servers via Podman as well as Docker, including a "dockerless Podman mode" added later in the range. ado-aw's tools.md/MCP container wiring could expose a runtime selector if Podman-only agent hosts become relevant.
Trusted host-path mount policy for container MCP servers (v0.4.9): "Enforce a trusted host-path mount policy before launching container MCP servers" — hardens bind-mount handling; ado-aw's own container/mount validation (src/compile/container_invocation.rs) should be reviewed for parity/consistency with this policy.
github-repository-delegation-v1 control-plane (introduced v0.4.16, extended through v0.4.21): a new dynamic repository-delegation/admission mechanism (idempotency, recovery, owner scoping, reconciliation) for scoping which repositories an agent session can touch at runtime. This looks like a meaningful primitive ado-aw could build on for narrowing MCPG-mediated GitHub access per pipeline/job — worth a design review against ado-aw's existing permissions:/repo-scoping model.
Schema enforce JSON Schema format constraints (v0.4.25): tightens MCPG's embedded config-schema validation; double-check the tools:/MCP config front matter ado-aw emits still validates cleanly against the stricter schema.

Deprecations

No explicit deprecations were announced in this range (the removed Resource DIFC API mentioned around v0.4.11 predates the 0.4.1 baseline for this bump and was already internal-only).

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

index.crates.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "index.crates.io"

See Network Configuration for more information.

Generated by Dependency Version Updater · auto · 217.5 AIC · ⌖ 14.6 AIC · ⊞ 14.3K · ◷

`mcpg` `0.4.1` → `0.4.26`

Releases analyzed

v0.4.2 ... v0.4.26 (25 releases spanning v0.4.2–v0.4.26; full list below)
v0.4.2
v0.4.3
v0.4.4
v0.4.5
v0.4.6
v0.4.7
v0.4.8
v0.4.9
v0.4.10
v0.4.11
v0.4.12
v0.4.13
v0.4.14
v0.4.15
v0.4.16
v0.4.17
v0.4.18
v0.4.19
v0.4.20
v0.4.21
v0.4.22
v0.4.23
v0.4.24
v0.4.25
v0.4.26

Breaking changes

Deprecated DIFC Resource type and constructors removed (v0.4.11, PR #11677/#11685) — any custom MCPG integration still constructing labels via the old DIFC Resource API would need to migrate.
Delegation TTL wire values reinterpreted as seconds (v0.4.18, PR #12686) — a config/wire-format change for anything setting delegation TTLs; values previously interpreted in a different unit will now be treated as seconds.

Security fixes

Bump Go to 1.26.4 and grpc to v1.82.1 to clear High CVEs (v0.4.5, PR #9933).
Sanitize secrets in file/server log lines (v0.4.9, PR #10774) — closes a potential secret-leak vector in MCPG's own logging.
Enforce a trusted host-path mount policy before launching container MCP servers (v0.4.9, PR #10928) — relevant to ado-aw's stdio-container MCP server mounts.
Pin GitHub Actions to commit SHAs (v0.4.21, PR #12895, by @github-security-bot) — supply-chain hardening of MCPG's own CI.
Fix circuit breaker wedging permanently in HALF-OPEN after a transport-error probe (v0.4.9, PR #10719) — availability/reliability fix for MCPG's backend circuit breaker.

Notable features for ado-aw to adopt

Configurable stdio container runtime (Docker/Podman), including a dockerless Podman mode (v0.4.6–v0.4.7, PR #10003/#10270/#10287) — worth evaluating for ado-aw's MCPG container invocation IR (src/compile/container_invocation.rs), in case Podman becomes a viable alternative container runtime on OneBranch build agents.
Repository-delegation / dynamic enclave admission control plane (v0.4.16–v0.4.21, starting PR #12555, "github-repository-delegation-v1 control-plane core") — a new mechanism for dynamically scoping GitHub MCP access to specific repositories at runtime, with idempotency/recovery/owner-scoping semantics added in v0.4.17 (PR #12605) and enablement in unified gateway mode in v0.4.19 (PR #12753). This pairs with AWF's dynamic enclave admission work (see the companion awf comment on this issue) and could inform a future least-privilege GitHub MCP scoping model for ado-aw's Azure DevOps MCP tool.
Proxy artifact ZIP downloads through actions_get with DIFC-safe redirect passthrough (v0.4.7, PR #10350) — relevant if ado-aw ever needs to fetch GitHub Actions artifacts through MCPG.
Honor sink-visibility exemption in the safe-outputs safety net (v0.4.20, PR #12767) — directly touches MCPG's safe-outputs DIFC sink handling, which underlies ado-aw's own safe-outputs: mechanism; worth a closer look to see if it changes observed sink behavior for custom safe-output tools.

Deprecations

None beyond the DIFC Resource type removal captured above as a breaking change (it was removed outright in this range rather than left in a still-supported-but-deprecated state).

Generated by Dependency Version Updater · auto · 172.2 AIC · ⌖ 2.71 AIC · ⊞ 14.3K · ◷

`mcpg` `0.4.1` → `0.4.28`

Releases analyzed

v0.4.2 ... v0.4.28 (27 releases total in range; see the compare view for the full list)

This range was previously partially covered by the now-superseded v0.4.13 canonical comment (bumps through 0.4.13). This comment covers the remaining 0.4.14 → 0.4.28 releases.

Breaking changes

update_issue_comment reclassified as an upstream read-write tool (v0.4.28, PR #14249) — DIFC guard policies that previously treated this tool as read-only will now require write-level clearance. Any ado-aw agent configured with a read-only guard policy that calls update_issue_comment may start being denied; worth a spot-check against existing workflow guard policies.

Security fixes

Isolate runtime access for multiple gateway agent IDs (v0.4.15, PR #12186) — tightens tenant isolation when a gateway is configured with more than one agent ID.
Bound SSE event size on SDK streamable/SSE client transports (v0.4.22, PR #13145) — caps unbounded SSE event sizes, closing a potential memory-exhaustion vector for MCP client transports.
Redact enclave MCP request and response payloads from exported logs by default (v0.4.23, PR #13179) — reduces default exposure of potentially sensitive tool-call payloads in exported/audit logs; relevant to ado-aw audit's MCPG log analyzer.
Restrict advertised MCP protocol versions to avoid sessionless discovery on stateful HTTP frontends (v0.4.24, PR #13221) — closes a discovery bypass on stateful HTTP MCP frontends.
Prevent a canceled client from disabling the shared WASM guard (v0.4.28, PR #14094) — fixes a guard-bypass path where an in-flight client cancellation could leave the shared WASM policy guard disabled for subsequent calls.
Multiple DIFC guard-coverage closures across this range (GitHub reaction operations, discussion mutations, repository-governance tools) progressively tightened which operations require elevated integrity clearance — routine coverage hardening, no ado-aw action required beyond the version bump.

Notable features for ado-aw to adopt

github-repository-delegation-v1 control-plane (ADR 0001), introduced in v0.4.16 and extended through v0.4.17–v0.4.19 (dynamic enclave admission with idempotency, recovery, owner scoping, and unified-gateway-mode support) — a new repository-delegation model for MCPG gateways. Worth evaluating as a potential alternative/complement to ado-aw's current enclave/credential-isolation model for custom safe-output jobs.
Mutually exclusive plural gateway agent ID configuration (v0.4.14, PR #12116) — lets a single gateway be configured with multiple agent IDs; relevant if ado-aw ever needs multi-agent MCPG routing in one pipeline.
Auto-detect wazero execution engine instead of forcing Compiler mode (v0.4.15, PR #12234) — improves WASM guard portability/performance automatically on upgrade; no action needed.
Honor sink-visibility exemption in safe-outputs safety net (v0.4.20, PR #12767) — refines MCPG's safe-outputs safety-net behavior for exempted sinks; worth reviewing against ado-aw's own safe-output sanitization model for consistency.

Deprecations

None identified in this range.

Generated by Dependency Version Updater · auto · 257.4 AIC · ⌖ 12.6 AIC · ⊞ 16.1K · ◷

`mcpg` `0.4.13` → `0.4.29`

Releases analyzed

Breaking changes

None identified in this range.

Security fixes

Redact enclave MCP request and response payloads from exported logs by default (v0.4.23, PR #13179) — closes a gap where enclave MCP traffic could be written to exported logs in cleartext; ado-aw's audit MCP log consumption should be unaffected but benefits automatically from reduced sensitive-data exposure in exported logs.
Restrict advertised MCP protocol versions to avoid sessionless discovery on stateful HTTP frontends (v0.4.24, PR #13221) — tightens MCP protocol-version advertisement to prevent a sessionless-discovery information leak on HTTP-mode gateways.
Bound SSE event size on SDK streamable/SSE client transports (v0.4.22, PR #13145) — caps SSE event size to guard against unbounded-memory abuse from a malicious/misbehaving MCP backend.
Enforce JSON Schema format constraints (v0.4.25, PR #13363) — tightens input validation against tool schemas, reducing the surface for malformed/crafted tool-call payloads.
Label GitHub security alerts as private reader data (v0.4.28, PR #14413) — strengthens DIFC labeling so GitHub security-alert content is treated as private/sensitive by default.
Accept mixed-case repository scopes in static allow-only policies (v0.4.29, PR #14492) — fixes a policy-matching gap where differently-cased repo scopes could unexpectedly bypass an allow-only guard policy.

Notable features for ado-aw to adopt

Honor proxy environment settings in custom HTTP transports (v0.4.21, PR #12832) — relevant if ado-aw ever needs to route custom HTTP MCP backends through a corporate proxy.
Document delegation control feature and MCP_GATEWAY_DELEGATION_* env vars (v0.4.21, PR #12900) and the broader github-repository-delegation-v1 control-plane work across v0.4.16–v0.4.21 — MCPG now supports dynamic repository delegation/enclave admission; ado-aw could expose this to let agents request scoped access to additional repositories at runtime instead of only the statically-configured set.
Classify update_issue_comment as an upstream read-write tool (v0.4.28, PR #14249) — worth confirming ado-aw's own safe-output tool classifications remain consistent with MCPG's guard policy for this tool.

Deprecations

None newly identified in this range (the MCP_GATEWAY_API_KEY → MCP_GATEWAY_AGENT_ID deprecation was already recorded in a prior comment).

Generated by Dependency Version Updater · auto · 186.9 AIC · ⌖ 6.75 AIC · ⊞ 16.2K · ◷

`mcpg` `0.4.13` → `0.4.30`

The previous canonical comment covered up through 0.4.13. This comment covers the remaining range to the new pin, 0.4.30.

Releases analyzed

Breaking changes

None identified. This range is dominated by internal refactors, test-coverage additions, dependency bumps, and the new (additive) "repository delegation" control-plane feature, which does not remove or rename any existing MCPG surface that ado-aw relies on.

Security fixes

Bound SSE event size on SDK streamable/SSE client transports (v0.4.24) — caps unbounded SSE payload growth, reducing a potential resource-exhaustion vector for MCP client transports.
GitHub Actions pinned to commit SHAs (v0.4.21) — supply-chain hardening of MCPG's own CI, no direct ado-aw action needed.
Redact enclave MCP request and response payloads from exported logs by default (v0.4.23) — reduces accidental credential/data leakage in exported enclave logs; relevant to ado-aw audit's MCP log analyzer, which should expect redacted payloads by default going forward.
Prevent a canceled client from disabling the shared WASM guard (v0.4.28) — fixes a guard-policy bypass path triggered by client cancellation.

Notable features for ado-aw to adopt

Repository delegation control-plane (ADR 0001/0002) (multiple releases, v0.4.16–v0.4.30, e.g. v0.4.26) — MCPG now supports dynamic enclave admission with idempotency, recovery, owner scoping, and reconciliation for delegated repository access. This is a substantial new capability; ado-aw could expose a front-matter option to opt into repository delegation instead of static repo scoping for multi-repo agentic workflows.
Honor sink-visibility exemption in safe-outputs safety net (v0.4.20) — refines how MCPG's safe-output DIFC safety net treats sink-visibility-exempt data; worth confirming ado-aw's safe-output sanitization assumptions still align.
DIFC sink validation, multipart labeling, and denial telemetry improvements (v0.4.16) — richer denial telemetry could be surfaced in ado-aw audit's MCP analyzer.
Classify update_issue_comment as an upstream read-write tool (v0.4.28) — a DIFC classification change for a GitHub MCP tool; ado-aw's GitHub extension/tool-allowlist docs should reflect this tool's write classification if referenced.

Deprecations

None identified in this range.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

index.crates.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "index.crates.io"

See Network Configuration for more information.

Generated by Dependency Version Updater · auto · 383.7 AIC · ⌖ 5.96 AIC · ⊞ 16.2K · ◷

[deps-release-notes] mcpg — upstream release action items #2040

Description

Rolling upstream release action items — mcpg

Consolidated history (earliest → latest)

0.3.12 → 0.3.23 (was #882)

0.3.23 → 0.3.24 (was #903)

0.3.23 → 0.3.25 (was #931)

0.3.25 → 0.3.26 (was #1059)

0.3.25 → 0.3.27 (was #1119)

0.3.25 → 0.3.28 (was #1169)

0.3.25 → 0.3.29 (was #1185)

0.3.29 → 0.3.31 (was #1242)

0.3.29 → 0.3.32 (was #1253)

0.4.1 → 0.4.12 (was #2029)

0.4.1 → 0.4.13 (was #2040) — canonical

Activity

github-actions commented on Aug 30, 2026

mcpg 0.4.13 → 0.4.14

Releases analyzed

Notable features for ado-aw to adopt

Deprecations

github-actions commented on Sep 2, 2026

mcpg 0.4.1 → 0.4.15

Releases analyzed

Security fixes

Notable features for ado-aw to adopt

Deprecations

github-actions commented on Sep 7, 2026

mcpg 0.4.1 → 0.4.17

Releases analyzed

Security fixes

Notable features for ado-aw to adopt

Deprecations

github-actions commented on Sep 9, 2026

mcpg 0.4.13 → 0.4.20

Releases analyzed

Notable features for ado-aw to adopt

Deprecations

github-actions commented on Sep 12, 2026

mcpg 0.4.1 → 0.4.20

Releases analyzed

Breaking changes

Security fixes

Notable features for ado-aw to adopt

Deprecations

github-actions commented on Sep 13, 2026

mcpg 0.4.20 → 0.4.21

Releases analyzed

Breaking changes

Security fixes

Notable features for ado-aw to adopt

Deprecations

github-actions commented on Sep 15, 2026

mcpg 0.4.1 → 0.4.22

Releases analyzed

Security fixes

Notable features for ado-aw to adopt

Deprecations

github-actions commented on Sep 16, 2026

mcpg 0.4.1 → 0.4.23

Releases analyzed

Breaking changes

Security fixes

Notable features for ado-aw to adopt

Deprecations

github-actions commented on Sep 17, 2026

mcpg 0.4.1 → 0.4.24

Releases analyzed

Breaking changes

Security fixes

Notable features for ado-aw to adopt

Deprecations

github-actions commented on Sep 20, 2026

mcpg 0.4.1 → 0.4.25

Releases analyzed

Security fixes

Notable features for ado-aw to adopt

Deprecations

github-actions commented on Sep 26, 2026

mcpg 0.4.1 → 0.4.26

Rolling upstream release action items — `mcpg`

`0.3.12` → `0.3.23` (was #882)

`0.3.23` → `0.3.24` (was #903)

`0.3.23` → `0.3.25` (was #931)

`0.3.25` → `0.3.26` (was #1059)

`0.3.25` → `0.3.27` (was #1119)

`0.3.25` → `0.3.28` (was #1169)

`0.3.25` → `0.3.29` (was #1185)

`0.3.29` → `0.3.31` (was #1242)

`0.3.29` → `0.3.32` (was #1253)

`0.4.1` → `0.4.12` (was #2029)

`0.4.1` → `0.4.13` (was #2040) — canonical

`mcpg` `0.4.13` → `0.4.14`

`mcpg` `0.4.1` → `0.4.15`

`mcpg` `0.4.1` → `0.4.17`

`mcpg` `0.4.13` → `0.4.20`

`mcpg` `0.4.1` → `0.4.20`

`mcpg` `0.4.20` → `0.4.21`

`mcpg` `0.4.1` → `0.4.22`

`mcpg` `0.4.1` → `0.4.23`

`mcpg` `0.4.1` → `0.4.24`

`mcpg` `0.4.1` → `0.4.25`

`mcpg` `0.4.1` → `0.4.26`

`mcpg` `0.4.1` → `0.4.28`

`mcpg` `0.4.13` → `0.4.29`

`mcpg` `0.4.13` → `0.4.30`