[deps-release-notes] awf — upstream release action items

Rolling upstream release action items — `awf`

This is the single canonical tracking issue for action items arising from
new releases of the awf dependency. The update-awf-version workflow appends
a new comment to this issue for each version bump going forward, so the most
recent activity lives in the comments below. This body is a consolidated
history of everything filed so far.

Latest pinned version covered: 0.28.26

Consolidated history (earliest → latest)

`0.25.48` → `0.25.60` (was #851)

OTel distributed tracing in api-proxy (v0.25.51): api-proxy now emits OTel traces; ado-aw could expose config to help consumers use this.
ARC/DinD split-filesystem auto-detection (v0.25.52): AWF auto-detects DinD split filesystem via sentinel probe; ado-aw docs may need updating.
Middle-power model fallback (v0.25.53): api-proxy supports model fallback when primary is unavailable; ado-aw could expose this.
Anthropic WIF support (v0.25.58): api-proxy supports Anthropic WIF schema fields + OIDC validation.
Pre-startup model validation via requestedModel config (v0.25.58): api-proxy validates requested model before startup; ado-aw may wish to populate this field.

`0.25.48` → `0.25.63` (was #859)

Security: proxy auth normalization hardened (v0.25.49): Prevents malformed Authorization headers from reaching the upstream API.
Responses API cache reads in token usage rollups (v0.25.63): Fixes under-reporting of cached token reads; improves ado-aw audit accuracy.

`0.25.65` → `0.25.66` (was #902)

Azure/AWS/GCP OIDC support in Copilot adapter (v0.25.66): api-proxy supports cloud OIDC credential injection; ado-aw could expose via engine:/network: front-matter.
Budget fields in token-usage.jsonl (v0.25.66): maxTurns and budget fields now persisted; ado-aw audit module could surface these in AuditData.

`0.25.65` → `0.25.68` (was #930)

GITHUB_COPILOT_INTEGRATION_ID forwarding fix (v0.25.67): AWF now correctly forwards it as COPILOT_INTEGRATION_ID to the api-proxy.
PAT-safe integration ID + model name normalization (v0.25.68): Regression fix from v0.25.67; normalizes legacy CAPI model names.

`0.25.65` → `0.27.0` (was #950)

cli-proxy fail fast on DIFC unreachability (v0.25.66): CLI proxy now errors immediately rather than hanging; verify DIFC proxy config before upgrade.

`0.25.65` → `0.27.1` (was #970)

AI credits as OTEL span attributes (v0.27.1): AWF emits AI credit consumption as OTel spans; agent_stats.rs + audit could surface these.
Redacted resolved config as audit artifact (v0.27.1): ado-aw audit could expose for configuration diagnostics.
Opt-in diagnostics artifact for blocked LLM request bodies (v0.27.1): ado-aw could surface via ado-aw-debug: flag.

`0.25.65` → `0.27.2` (was #983)

Security: WIF/OIDC Anthropic auth regression (v0.27.2): ANTHROPIC_API_KEY leaked to agent container when Squid blocked OIDC exchange; fixed in 0.27.2.

`0.25.65` → `0.27.3` (was #990)

OTLP fan-out to multiple endpoints (v0.27.3): api-proxy can fan out telemetry to multiple OTLP endpoints simultaneously.

`0.27.3` → `0.27.5` (was #1093)

Security: HTTPS-only for bare API proxy targets (v0.27.5): Prevents over-broad HTTP allowlisting; verify no existing config relies on HTTP.
allowedModels/disallowedModels in api-proxy (v0.27.5): Model allow/deny-list policy; ado-aw could expose as engine.allowed-models front-matter.
COPILOT_INTEGRATION_ID forwarding from host env (v0.27.5): api-proxy forwards from host into sandbox; ensure ado-aw passes it through AWF invocation.
GHES detection fix for Copilot auth prefix (v0.27.4): Fixes auth failures for non-standard GHES hostnames.

`0.27.3` → `0.27.7` (was #1118)

max-cache-misses guardrail (v0.27.6): Limits token spend when cache misses exceed threshold; useful for cost-sensitive pipelines.

`0.27.3` → `0.27.9` (was #1184)

Copilot Business endpoint auth prefix corrected (v0.27.9): Fixed wrong bearer prefix (should be token); Business-account pipelines may have been silently failing.

`0.27.9` → `0.27.11` (was #1219)

Portable self-hosted runner doctor agent (v0.27.11): New AWF diagnostic tool; ado-aw could reference in troubleshooting docs.
Topology-attach ordering deadlock fix (v0.27.11): Starved cli-proxy health gate; MCPG-based pipelines (--topology-attach mcp-gateway) were directly affected.
ARC/DinD chroot path fix (v0.27.10): /host/tmp/awf-runner-bin instead of /host/usr collision; update ARC/DinD docs if referencing /host/usr.

`0.27.9` → `0.27.12` (was #1241)

Security: June 2026 dependency refresh (v0.27.12): Routine security dep upgrades; upgrading recommended.
OIDC config propagation fix (v0.27.12): apiProxy.auth OIDC fields were not propagated to all proxy layers; previously configured OIDC may have been silently ignored.

`0.27.9` → `0.27.13` (was #1252)

Security: ReDoS fix in postprocess script (v0.27.11): ReDoS vulnerability patched; no consumer action beyond upgrading.
maxRuns counts only inference calls (v0.27.13): Semantics changed — no longer counts tool calls; re-evaluate any max-runs tuning based on total tool-call counts.
HTTP 429 (not 403) when max turns exceeded (v0.27.13): Update any ado-aw code/docs that treat 403 as the max-turns-exceeded indicator.

`0.27.9` → `0.27.15` (was #1260)

Note: v0.27.14 was retracted; its changes are included in v0.27.15.
Security: transitive linkify-it → v5.0.1 (v0.27.12): Part of June 2026 security refresh.

`0.27.9` → `0.27.21` (was #1304)

container.mounts in AWF config schema (v0.27.21): ado-aw could expose as front-matter field for custom sandbox mounts.
Model-to-API endpoint mapping (v0.27.16): AWF maintains a model→endpoint map updated daily; relevant for ado-aw model validation allowlist.

`0.27.32` → `0.28.5` (was #1990)

Firecracker microVM backend removed (v0.28.1, "ci: disable Firecracker workflows and release artifacts") — AWF has dropped Firecracker in favor of Cloud Hypervisor as the sandbox backend. ado-aw does not reference Firecracker directly, but any docs/runner-doctor guidance mentioning it upstream should not be assumed to apply going forward.
Enforce filesystem allowWrite boundaries in AWF sandboxes (v0.28.5, #7634) — tightens write-path enforcement so sandboxed agents can only write within explicitly allowed paths.
Route CLI artifact redirects through scoped Squid egress (v0.28.5, #7635) — CLI artifact download redirects are now proxied through Squid's domain-allowlist instead of bypassing egress controls, closing a potential egress-control bypass.
fix: route CLI proxy through isolated egress relay (v0.28.2, #7338) — routes the CLI proxy through an isolated egress relay for DIFC credential isolation.
fix(security): suppress non-reachable GO-2026-4337 in gosu binary (v0.27.43, #6645) and update brace-expansion to 5.0.8 (GHSA-mh99-v99m-4gvg) (v0.27.42, #6585) — routine dependency CVE remediations in the AWF toolchain.
Support compiler-authorized digest-pinned container image manifests (v0.28.4, #7601) — ado-aw could adopt this to pin AWF/MCPG/agent images by digest instead of tag for stronger supply-chain guarantees.
feat: support secret-backed OpenAI-compatible targets (v0.28.3, #7576) — new API-proxy target type; relevant if ado-aw ever wants to support OpenAI-compatible engine backends secured via secret-backed credentials.
API proxy: first-class AI-credit accounting for Copilot auto dynamic selector (v0.28.4, #7604) — improved cost/credit accounting when using Copilot's auto model selector, could inform ado-aw's engine cost-reporting/observability docs.
Recover transient Cloud Hypervisor readiness failures (v0.28.5, #7611) and Fix Cloud Hypervisor API proxy readiness race (v0.28.3, #7582) — reliability fixes for the (preview) Cloud Hypervisor backend that ado-aw's OneBranch integration may rely on.

`0.27.32` → `0.28.9` (was #2028)

Firecracker support removed (#7362) — anyone relying on the Firecracker VM isolation backend for AWF will need to migrate to the supported sandboxing path before upgrading past this range.
fix(security): update vulnerable deps in agent and api-proxy images (#6505) — patches known CVEs in the agent/api-proxy container images.
chore(deps): safe patch updates incl. ajv 8.20.0 security fix (#6962) — bundled ajv security patch.
Protect ANTHROPIC_AUTH_TOKEN in AWF credential isolation paths (#6410) — extends AWF's credential-isolation guarantees to Anthropic auth tokens.
Exclude topology-attached MCP peers from agent proxy routing (#6189) — relevant to how ado-aw wires MCPG via --topology-attach; may simplify or change proxy routing assumptions in agentic_pipeline.rs.
Auto-allow topology-attached container hostnames in Squid ACL (#6473) — reduces manual allowlist entries for topology-attached containers (e.g. MCPG), potentially letting ado-aw drop custom allowlist workarounds.
Support COPILOT_MODEL=auto (#6474) — new dynamic model-selection env var AWF passes through; ado-aw's engine.rs model handling could expose this as a supported option.
Route CLI proxy through isolated egress relay (#7338) — changes to how the wrapped az/CLI network egress is routed; worth double-checking az_wrapper.rs assumptions still hold.
API proxy: first-class AI-credit accounting for Copilot auto dynamic selector (#7604) — new usage/cost accounting surfaced by AWF that ado-aw's audit/otel tooling could ingest.
Remove "bounded-query" terminology (#7735) — naming/terminology change in AWF docs/config; check for any ado-aw docs or config referencing the old term.

`0.27.32` → `0.28.23` (was #2230)

Firecracker microVM backend support was removed (v0.28.2) in favor of Cloud Hypervisor. ado-aw does not reference Firecracker or select a sandbox backend explicitly, so no action is required, but worth noting if any future AWF backend-selection flag is adopted.
Legacy "bounded execution" was removed in favor of MCP enclaves (v0.28.0). ado-aw does not reference bounded-execution terminology or flags.
fix(security): enforce TLS SNI allowlist (v0.28.23) — tightens AWF's own domain-filtering enforcement at the TLS layer.
Hardened and documented the MCP gateway Authorization header contract against workspace credential exposure (v0.28.10) — relevant to ado-aw's MCPG integration; worth a spot-check that ado-aw's MCPG wiring doesn't rely on any now-tightened header behavior.
Multiple CVE/dependency patch fixes across agent, api-proxy, and Squid images, plus GitHub Actions pinned to commit SHAs (v0.27.39, v0.27.42, v0.27.43, v0.28.16) — routine upstream hardening, no ado-aw code change needed.
GCP Workload Identity Federation support for Gemini and Vertex API proxy adapters (v0.28.23) — could be surfaced if ado-aw adds Gemini/Vertex engine support in the future.
Preserve explicit upstream proxy ports (v0.28.23) — may improve reliability for any future custom-port MCP/proxy configuration.

`0.27.32` → `0.28.26` (was #2252) — canonical

Breaking changes: None identified. Upstream's v0.28.5 notes explicitly state "There are no breaking changes for existing awf CLI users" for the security-hardening changes below, and no other release in this range documents a removed/renamed flag, changed config schema, or removed egress/safe-output surface.
Security fix — Stricter allowWrite filesystem-boundary enforcement (v0.28.5, PR #7634) — AWF now more strictly enforces that sandboxed agents can only write within explicitly allowed paths. Upstream's own upgrade notes ask consumers relying on allowWrite scoping to confirm existing allowlists still cover intended write paths. ado-aw should double-check any mounts it passes with write access (e.g. the ado-proxy -v "${AZ_WRAPPER_DIR}:/var/lib/ado-proxy:rw" mount in agentic_pipeline.rs) still work under the tightened enforcement.
Security fix — CLI artifact redirects routed through scoped Squid egress (v0.28.5, PR #7635) — closes a bypass where CLI artifact download redirects could skip the domain-allowlist egress path. No action needed beyond the version bump; purely upstream-side hardening.
--api-proxy-ca-cert <path> (v0.28.10, PR #7816) — lets the AWF api-proxy sidecar trust an additional CA certificate for upstream TLS verification. Could be useful if ado-aw ever needs to route through a corporate TLS-inspecting proxy for the Copilot/model API traffic.
--network-subnet <cidr> (v0.28.16, PR #8398) — relocates the awf-net Docker network off its default 172.30.0.0/24 subnet to avoid collisions with host/cluster networks. Worth surfacing as a compiler-level escape hatch if ADO-hosted agent pools ever collide with that default range.
--reflect (v0.28.13) — starts AWF, queries the API proxy's /reflect endpoint, and prints its JSON response; a lightweight diagnostic mode that could help ado-aw audit/trace verify API-proxy model routing without a full agent run.
GitHub REST/GraphQL API point budgets (v0.28.26, PR #8978) — adds --max-github-api-points-rest / --max-github-api-points-graphql budget controls to the api-proxy. Could let ado-aw cap GitHub API consumption per Agent job run, complementing its existing tool/network allow-listing model.
Deprecations: None identified in this range.

Consolidated by the Deps Release-Notes Consolidator workflow. Superseded per-release issues were closed and point here.> Generated by Deps Release-Notes Consolidator · auto · 62.4 AIC · ⌖ 2.48 AIC · ⊞ 10.3K · ◷

`awf` `0.27.32` → `0.28.27`

Releases analyzed

v0.27.33
v0.27.34
v0.27.35
v0.27.36
v0.27.37
v0.27.38
v0.27.39
v0.27.41
v0.27.42
v0.27.43
v0.27.44
v0.28.0 ... v0.28.26 (as previously analyzed in the comment above)
v0.28.27 (new since the last recorded bump)

Breaking changes

None identified. Same conclusion as the prior comment; v0.28.27 adds no new breaking changes.

Security fixes

No new security fixes since the prior comment. (The allowWrite filesystem-boundary enforcement and Squid egress routing fixes from v0.28.5 remain the notable security items in this overall range — see the comment above.)

Notable features for ado-aw to adopt

No new notable features in v0.28.27 itself (documentation clarification + internal test/CI changes only). The previously-noted --api-proxy-ca-cert, --network-subnet, --reflect, and GitHub REST/GraphQL API point budget features (through v0.28.26) remain open adoption candidates — see the comment above.

Deprecations

None identified in v0.28.27.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

index.crates.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "index.crates.io"

See Network Configuration for more information.

Generated by Dependency Version Updater · auto · 273.7 AIC · ⌖ 6.6 AIC · ⊞ 14.3K · ◷

`awf` `0.28.27` → `0.28.29`

Releases analyzed

Breaking changes

None identified.

Security fixes

None identified in this range. (fast-uri was bumped to a patched 3.1.8 in v0.28.28, a routine transitive dependency patch with no consumer-visible effect.)

Notable features for ado-aw to adopt

Native OpenAI and Anthropic model routing (v0.28.28) — adds first-class API-proxy routing for OpenAI/Anthropic model targets alongside Copilot. Could inform future ado-aw engine: support for non-Copilot providers.
/reflect now exposes the routed model selection (v0.28.29) — extends the diagnostic --reflect mode (previously noted as adoptable in the comment above) to also report which model was actually routed to; useful for ado-aw audit/trace model-routing diagnostics.

Deprecations

None identified in this range.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

index.crates.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "index.crates.io"

See Network Configuration for more information.

Generated by Dependency Version Updater · auto · 137.2 AIC · ⌖ 5.7 AIC · ⊞ 16.1K · ◷

`awf` `0.28.26` → `0.28.31`

Releases analyzed

Breaking changes

None identified. This range is dominated by internal test/CI hygiene changes and api-proxy model-routing work; no removed/renamed flags or config-schema changes are documented.

Security fixes

None identified in this range (no CVE/advisory references in the release notes for v0.28.27–v0.28.31).

Notable features for ado-aw to adopt

--max-num-tool-calls (v0.28.31, PR #9271) — optional run-wide cap on enclave tool calls. Could complement ado-aw's existing cost/turn controls as a hard ceiling on tool invocations per Agent job run.
Model routing made advisory instead of pinning requests (v0.28.31, PR #9272) — AWF's model-routing selection now informs rather than hard-pins the request; relevant if ado-aw surfaces model-routing config, since fallback behavior changes.
Trace-based tool-call optimization recommendations (v0.28.31, PR #9270) — AWF can now derive tool-call optimization suggestions from traces; ado-aw audit/trace could surface these recommendations.
Ordered fallback models on 5xx, timeout, or model_not_supported (v0.28.31, PR #9356) — api-proxy can automatically fail over to a configured fallback model list; ado-aw's engine: front-matter could expose this for resilience against transient provider outages.
Fail closed on invalid API proxy model allowlists (v0.28.31, PR #9358) — hardens the model-allowlist validation path; no action needed beyond the version bump, but worth noting the stricter failure mode if ado-aw ever configures allowedModels/disallowedModels.
Native OpenAI and Anthropic model routing (v0.28.28, PR #9223) — adds first-class routing for OpenAI/Anthropic targets alongside Copilot; relevant if ado-aw adds support for those engines directly.
Authenticated broker-to-host enclave executor protocol (ADR 0002 v1) (v0.28.31, PR #9279) — new authenticated executor protocol between the enclave broker and host; worth a design review if ado-aw's AWF integration ever needs host-side script execution.
No-network Cloud Hypervisor support for script enclaves and closed Cloud Hypervisor networking for agent enclaves (v0.28.31, PRs #9303/#9314) — tighter network isolation options for the preview Cloud Hypervisor backend; relevant to ado-aw's OneBranch sandboxing story.

Deprecations

None identified in this range.

Generated by Dependency Version Updater · auto · 257.4 AIC · ⌖ 12.6 AIC · ⊞ 16.1K · ◷

`awf` `0.27.32` → `0.28.37`

Releases analyzed

Breaking changes

None identified. This range builds on the prior 0.27.32 → 0.28.26 consolidated range already recorded above and contains no documented config-schema changes, removed flags, or removed egress/safe-output surfaces.

Security fixes

Fail closed on invalid API proxy model allowlists (v0.28.31, PR #9358) — tightens model-allowlist enforcement so a malformed/invalid allowlist now denies rather than silently permits requests.
Authenticated broker-to-host enclave executor protocol (ADR 0002 v1) (v0.28.31, PR #9279) — adds authentication to the enclave broker/host executor channel, closing a previously-unauthenticated internal protocol surface.
Closed Cloud Hypervisor networking for agent enclaves (v0.28.31, PR #9314) — further restricts network reachability for the (preview) Cloud Hypervisor sandbox backend.

Notable features for ado-aw to adopt

--max-num-tool-calls run-wide enclave tool-call cap (v0.28.31, PR #9271) — a budget control complementary to AWF's existing GitHub API point budgets; ado-aw could expose this alongside --max-github-api-points-rest/--max-github-api-points-graphql as a front-matter cost-control knob.
Native OpenAI and Anthropic model routing (v0.28.28, PR #9223) — api-proxy can now route natively to OpenAI/Anthropic in addition to Copilot; relevant if ado-aw extends engine: support beyond Copilot.
Routed model selection exposed in /reflect (v0.28.29, PR #9239) and /reflect models filtered by policy (v0.28.31, PR #9321) — building on the --reflect diagnostic mode already noted in the prior range; ado-aw audit/trace could use these to verify the effective routed model and policy-filtered model set without a full agent run.
Model routing made advisory instead of pinning requests (v0.28.31, PR #9272) — changes routing semantics from a hard pin to an advisory hint; worth confirming ado-aw's model-selection expectations still hold under this behavior.

Deprecations

None identified in this range.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

index.crates.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "index.crates.io"

See Network Configuration for more information.

Generated by Dependency Version Updater · auto · 280.6 AIC · ⌖ 9.93 AIC · ⊞ 16.2K · ◷

`awf` `0.28.26` → `0.28.44`

Releases analyzed

Breaking changes

None identified in this range.

Security fixes

Mask /tmp/gh-aw/mcp-logs from Cloud Hypervisor guest agents (v0.28.28, PR #9205) — prevents sandboxed Cloud Hypervisor guests from reading MCP log paths from the host.
Centralize sensitive-path masking across runtimes (v0.28.28, PR #9220) — consolidates path-masking logic so sensitive host paths are consistently hidden from agents regardless of runtime backend.
Fail closed on invalid API proxy model allowlists (v0.28.31, PR #9358) — a malformed/invalid allowedModels/disallowedModels config now rejects startup instead of silently permitting all models.
Reject unsupported reasoning efforts before proxying (v0.28.40, PR #9520) — api-proxy now validates reasoning effort values before forwarding, closing off a silent-misconfiguration path.

Notable features for ado-aw to adopt

Native OpenAI and Anthropic model routing (v0.28.28, PR #9223) — api-proxy can now route natively to OpenAI/Anthropic in addition to Copilot; relevant if ado-aw adds first-class support for those engine backends.
Expose routed model selection in /reflect (v0.28.29, PR #9239) — pairs with AWF's --reflect diagnostic mode noted in the prior comment range; could let ado-aw audit/trace surface the actual routed model for a run.
Optional run-wide cap on enclave tool calls (--max-num-tool-calls) (v0.28.31, PR #9271) — ado-aw could expose this as a compiler-level budget knob alongside existing turn/cost controls.
Ordered fallback models on 5xx, timeout, or model_not_supported (v0.28.31, PR #9356) — api-proxy can fail over to a configured fallback model list; could reduce flaky pipeline failures if surfaced via engine: front matter.
Trace-based tool-call optimization recommendations (v0.28.31, PR #9270) — AWF can analyze a run's trace and suggest tool-call optimizations; could complement ado-aw audit's existing OTel analysis.

Deprecations

None identified in this range.

Generated by Dependency Version Updater · auto · 186.9 AIC · ⌖ 6.75 AIC · ⊞ 16.2K · ◷

`awf` `0.27.32` → `0.28.49`

Releases analyzed

Breaking changes

None identified in this range. No release in 0.28.27–0.28.49 documents a removed/renamed flag, changed config schema, or removed egress/safe-output surface.

Security fixes

None identified in this range beyond what was already covered by the previous canonical-issue comment (0.28.26). The changes in this range (v0.28.27–v0.28.49) are predominantly enclave/Cloud Hypervisor reliability fixes, model-routing features, and internal test/refactor work.

Notable features for ado-aw to adopt

Native OpenAI and Anthropic model routing (v0.28.28) — AWF now supports routing requests natively to OpenAI and Anthropic in addition to Copilot; relevant if ado-aw ever exposes non-Copilot engine backends.
/reflect now exposes the routed model selection (v0.28.29) — could help ado-aw audit/trace confirm which model a run actually used.
Model routing made advisory instead of pinning requests (v0.28.31) — changes routing semantics; worth a spot-check that ado-aw's engine/model config assumptions aren't relying on routing being authoritative.
--max-num-tool-calls run-wide cap on enclave tool calls (v0.28.31) — could be surfaced as a front-matter budget control alongside existing turn/time limits.
Ordered fallback models on 5xx/timeout/model_not_supported (v0.28.31) — resilience feature; ado-aw's engine: config could expose a fallback-model list.
--api-proxy-ca-cert (v0.28.10 era, carried into this range) — lets the API proxy trust an additional CA; useful for corporate TLS-inspecting proxies.
--network-subnet flag to relocate awf-net off its default subnet (v0.28.16 era) — worth surfacing as a compiler-level escape hatch for ADO-hosted agent pools that collide with the default range.
Cloud Hypervisor enclave reliability work (multiple releases v0.28.33–v0.28.47) — a steady stream of fixes to Cloud Hypervisor mount/export/readiness handling; no direct ado-aw action, but relevant background if OneBranch's sandbox backend is (or becomes) Cloud Hypervisor-based.

Deprecations

None identified in this range.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

index.crates.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "index.crates.io"

See Network Configuration for more information.

Generated by Dependency Version Updater · auto · 383.7 AIC · ⌖ 5.96 AIC · ⊞ 16.2K · ◷

`awf` `0.27.32` → `0.28.50`

Releases analyzed

Breaking changes

None identified. No release in this range documents a removed/renamed flag, changed config schema, or removed egress/safe-output surface.

Security fixes

None identified beyond what was already recorded through v0.28.26. The 0.28.27–0.28.50 range is dominated by internal CI/test/enclave-diagnostics hardening (e.g. Cloud Hypervisor enclave mount/snapshot diagnostics, enclave gateway readiness classification) with no CVE references or consumer-facing credential-handling changes called out.

Notable features for ado-aw to adopt

--max-num-tool-calls run-wide tool-call cap (v0.28.31): AWF now supports an optional run-wide cap on enclave tool calls. ado-aw could expose this as a compiler-level budget/guardrail alongside its existing max-turns/session-limit controls.
Trace-based tool-call optimization recommendations (v0.28.31): AWF can analyze traces and recommend tool-call optimizations; relevant to ado-aw audit/trace tooling for surfacing efficiency suggestions.
Model routing made advisory instead of pinning requests, plus native OpenAI/Anthropic model routing and ordered fallback models on 5xx/timeout/model_not_supported (v0.28.28, v0.28.31): api-proxy gained fallback-model routing and advisory model selection; could inform ado-aw's engine: model-selection and resiliency docs.
/reflect now exposes the routed model selection (v0.28.29): Builds on the --reflect diagnostic mode already noted in the prior range; ado-aw audit/trace could surface routed-model info for diagnosing engine/model mismatches.
Authenticated broker-to-host enclave executor protocol (ADR 0002 v1) (v0.28.31): New enclave execution protocol; worth tracking if ado-aw's OneBranch sandboxing integration touches enclave execution paths.

Deprecations

None identified in this range.

Generated by Dependency Version Updater · auto · 204.3 AIC · ⌖ 12.3 AIC · ⊞ 16.2K · ◷

`awf` `0.27.32` → `0.28.51`

Releases analyzed

v0.28.0
v0.28.1 ... v0.28.26 — already recorded in the consolidated history above (up through 0.28.26)
v0.28.27
v0.28.28
v0.28.29
v0.28.30
v0.28.31
v0.28.33 ... v0.28.47
v0.28.49
v0.28.50
v0.28.51

Breaking changes

None identified. No removed/renamed CLI flags, config schema changes, or removed egress/safe-output surfaces are documented in this range.

Security fixes

None explicitly flagged in this range's release notes (the bulk of the range is internal enclave-diagnostics/test-coverage/CI work for AWF's own Cloud Hypervisor and NVX sandbox-backend previews).

Notable features for ado-aw to adopt

--max-num-tool-calls (v0.28.31) — "Add optional run-wide cap on enclave tool calls." A new budget/safety guardrail similar in spirit to the previously-noted max-cache-misses flag; ado-aw could expose this as an additional cost/safety control alongside its existing tool/network allow-listing model.
Native OpenAI and Anthropic model routing (v0.28.28) — the api-proxy now natively routes OpenAI/Anthropic requests (previously Copilot-centric). Relevant if ado-aw ever adds first-class OpenAI/Anthropic engine support beyond the Copilot CLI.
Model routing selection exposed via /reflect (v0.28.29) — the api-proxy's /reflect diagnostic endpoint (previously noted in the canonical history) now also reports the routed model selection; could help ado-aw audit/trace confirm which model a run actually used.
Model routing made advisory instead of pinning requests (v0.28.31) — a behavior refinement to the routing feature noted above; worth confirming ado-aw's model-selection expectations still hold if/when it adopts AWF's routing.
Versioned shared model-pricing catalog support (v0.28.51) — AWF now ships a versioned model-pricing catalog; could inform or replace any ado-aw-side cost-estimation/audit logic for AI-credit reporting.

Deprecations

None identified in this range.

Recorded automatically by the dependency version updater workflow.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

index.crates.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "index.crates.io"

See Network Configuration for more information.

Generated by Dependency Version Updater · auto · 195.1 AIC · ⌖ 5.59 AIC · ⊞ 16.2K · ◷

[deps-release-notes] awf — upstream release action items #2252

Description

Rolling upstream release action items — awf

Consolidated history (earliest → latest)

0.25.48 → 0.25.60 (was #851)

0.25.48 → 0.25.63 (was #859)

0.25.65 → 0.25.66 (was #902)

0.25.65 → 0.25.68 (was #930)

0.25.65 → 0.27.0 (was #950)

0.25.65 → 0.27.1 (was #970)

0.25.65 → 0.27.2 (was #983)

0.25.65 → 0.27.3 (was #990)

0.27.3 → 0.27.5 (was #1093)

0.27.3 → 0.27.7 (was #1118)

0.27.3 → 0.27.9 (was #1184)

0.27.9 → 0.27.11 (was #1219)

0.27.9 → 0.27.12 (was #1241)

0.27.9 → 0.27.13 (was #1252)

0.27.9 → 0.27.15 (was #1260)

0.27.9 → 0.27.21 (was #1304)

0.27.32 → 0.28.5 (was #1990)

0.27.32 → 0.28.9 (was #2028)

0.27.32 → 0.28.23 (was #2230)

0.27.32 → 0.28.26 (was #2252) — canonical

Activity

github-actions commented on Sep 28, 2026

awf 0.27.32 → 0.28.27

Releases analyzed

Breaking changes

Security fixes

Notable features for ado-aw to adopt

Deprecations

github-actions commented on Sep 30, 2026

awf 0.28.27 → 0.28.29

Releases analyzed

Breaking changes

Security fixes

Notable features for ado-aw to adopt

Deprecations

github-actions commented on Oct 2, 2026

awf 0.28.26 → 0.28.31

Releases analyzed

Breaking changes

Security fixes

Notable features for ado-aw to adopt

Deprecations

github-actions commented on Oct 6, 2026

awf 0.27.32 → 0.28.37

Releases analyzed

Breaking changes

Security fixes

Notable features for ado-aw to adopt

Deprecations

github-actions commented on Oct 7, 2026

awf 0.28.26 → 0.28.44

Releases analyzed

Breaking changes

Security fixes

Notable features for ado-aw to adopt

Deprecations

github-actions commented on Oct 8, 2026

awf 0.27.32 → 0.28.49

Releases analyzed

Breaking changes

Security fixes

Notable features for ado-aw to adopt

Deprecations

github-actions commented on Oct 9, 2026

awf 0.27.32 → 0.28.50

Releases analyzed

Breaking changes

Security fixes

Notable features for ado-aw to adopt

Deprecations

github-actions commented on Oct 12, 2026

awf 0.27.32 → 0.28.51

Releases analyzed

Breaking changes

Security fixes

Notable features for ado-aw to adopt

Rolling upstream release action items — `awf`

`0.25.48` → `0.25.60` (was #851)

`0.25.48` → `0.25.63` (was #859)

`0.25.65` → `0.25.66` (was #902)

`0.25.65` → `0.25.68` (was #930)

`0.25.65` → `0.27.0` (was #950)

`0.25.65` → `0.27.1` (was #970)

`0.25.65` → `0.27.2` (was #983)

`0.25.65` → `0.27.3` (was #990)

`0.27.3` → `0.27.5` (was #1093)

`0.27.3` → `0.27.7` (was #1118)

`0.27.3` → `0.27.9` (was #1184)

`0.27.9` → `0.27.11` (was #1219)

`0.27.9` → `0.27.12` (was #1241)

`0.27.9` → `0.27.13` (was #1252)

`0.27.9` → `0.27.15` (was #1260)

`0.27.9` → `0.27.21` (was #1304)

`0.27.32` → `0.28.5` (was #1990)

`0.27.32` → `0.28.9` (was #2028)

`0.27.32` → `0.28.23` (was #2230)

`0.27.32` → `0.28.26` (was #2252) — canonical

`awf` `0.27.32` → `0.28.27`

`awf` `0.28.27` → `0.28.29`

`awf` `0.28.26` → `0.28.31`

`awf` `0.27.32` → `0.28.37`

`awf` `0.28.26` → `0.28.44`

`awf` `0.27.32` → `0.28.49`

`awf` `0.27.32` → `0.28.50`

`awf` `0.27.32` → `0.28.51`