chore(deps): Update dependency microsoft/apm to v0.35.0 by eclipse-score-bot · Pull Request #174 · eclipse-score/devcontainer

eclipse-score-bot · 2026-10-22T14:06:54Z

This PR contains the following updates:

Package	Update	Change
microsoft/apm	minor	`0.30.0` → `0.35.0`

Release Notes

microsoft/apm

`v0.35.0`

Compare Source

What's Changed

🔧 Other Changes

fix(hooks): render nested hook metadata as plain JSON by @abhishekacharya200 in #3211
test(hooks): align cursor smoke expectations with native flat handlers by @MohammedAlkindi in #3198
fix: install versioned marketplace package directories by @Pybsama in #3156
fix: keep Codex MCP identity outside native settings by @Pybsama in #3157
fix(cli): report only verified APM build revisions by @danielmeppiel in #3280
fix(hooks): admit and stage hook-only Git-path packages by @danielmeppiel in #3282
fix(hooks): type untyped flat command handlers for Claude by @Parth-Vasave in #3153
Fix native Agent Plugin audit replay for Copilot targets by @bodapatisaikrishna in #3257
test(audit): preserve OpenCode local-bundle lifecycle coverage by @danielmeppiel in #3292
fix(auth): recover private files after API throttling by @danielmeppiel in #3278
fix(audit): preserve Grok Cloud target identity and historical checks by @danielmeppiel in #3289
fix(codex): preserve complete compatibility bundles through native user installs by @danielmeppiel in #3294
fix(lockfile): diagnose merge conflicts without automatic recovery by @lachieh in #3028
fix(policy): resolve marketplace object-form deps in ref-consistency check (#3220) by @Fire162 in #3221
fix(install): verify local content in frozen mode by @dajiaohuang in #3236
fix(pack): preserve and relocate plugin hook resources by @danielmeppiel in #3301
fix(install): include required indirect dependencies in dry-run previews by @danielmeppiel in #3302
fix(install): restore cold frozen plugins with verified MCP declarations by @danielmeppiel in #3305
fix(install): preserve frozen lock bytes and recorded native-service ownership by @danielmeppiel in #3307
fix(audit): preserve project scope across native Windows path spellings by @danielmeppiel in #3316
fix(schema): propose corrected manifest 0.1.48 contract by @danielmeppiel in #3308
fix(triage): prefetch and bound scheduled sweep candidates by @danielmeppiel in #3277
fix(install): capture acquired manifest versions on first install by @danielmeppiel in #3311
fix(deps): support local single-file dependencies by @danielmeppiel in #3310
fix(skills): preserve shared assets and deployment ownership by @danielmeppiel in #3313
fix(opencode): render native MCP environment references by @leninworld in #3303
fix(mcp): preserve conflicting native connections and verify managed updates by @danielmeppiel in #3317
Fix [BUG] Missing kiro prompts primitive entry by @DBVamsi in #3263
fix(audit): respect intentional dependency MCP omissions by @danielmeppiel in #3304
fix(install): preflight selected skill plans before native deployment by @danielmeppiel in #3314
docs: make README manifest example installable by @venkatayedidavs in #3086
add(deps): support consumer-root source replacements by @danielmeppiel in #3309
fix: preserve Windows staging failures and recovery data by @danielmeppiel in #3318
fix(install): retire obsolete absent dependency claims after complete reintegration by @danielmeppiel in #3315
fix(install): persist replacement intent after the last dependency is removed by @danielmeppiel in #3328
fix(audit): fail closed when an explicit --policy cannot be loaded by @danielmeppiel in #3230
fix(ci): restore deterministic fixtures and marketplace replay by @danielmeppiel in #3325
fix(mcp): preserve verified ownership across lifecycle transitions by @danielmeppiel in #3329
fix(ci): use canonical skill results in orchestration fixtures by @danielmeppiel in #3336
fix(ci): align generated skill repair with explicit overwrite consent by @danielmeppiel in #3337
fix(tests): restore canonical fixture contracts for CI by @danielmeppiel in #3338
fix(ci): shard lifecycle smoke without weakening its gate by @danielmeppiel in #3345
fix(install): preserve unchanged manifest requests by @danielmeppiel in #3346
fix(ci): isolate ratchet and scaling execution budgets by @danielmeppiel in #3347
fix(tests): restore MCP and update-plan CI contracts by @danielmeppiel in #3343
fix(install): retain trustworthy rendered skill receipts by @danielmeppiel in #3344
fix(tests): await parallel cache consumers before assertions by @danielmeppiel in #3352
fix(tests): align full-route fixtures with canonical receipt contracts by @danielmeppiel in #3353
chore: release v0.35.0 by @danielmeppiel in #3355
fix(ci): budget macOS ARM full release integration by @danielmeppiel in #3360
fix(ci): budget Linux x64 qualification and expose audit failure by @danielmeppiel in #3362
fix(ci): budget focused Intel release qualification by @danielmeppiel in #3364

New Contributors

@abhishekacharya200 made their first contribution in #3211
@Parth-Vasave made their first contribution in #3153
@Fire162 made their first contribution in #3221
@leninworld made their first contribution in #3303
@DBVamsi made their first contribution in #3263
@venkatayedidavs made their first contribution in #3086

Full Changelog: microsoft/apm@v0.34.0...v0.35.0

`v0.34.0`

Compare Source

What's Changed

🔧 Other Changes

fix(audit): validate skill subsets against prepared lock-pinned replay by @danielmeppiel in #3147
fix(git): preserve symlink capability config precedence by @danielmeppiel in #3145
fix(codex): preserve native agent model settings by @danielmeppiel in #3150
fix(hooks): render native Cursor hooks with import coexistence checks by @danielmeppiel in #3149
feat(install): add grok-bot install target for agent-data/workflows by @sergio-sisternes-epam in #3106
fix(install): stop --frozen rewriting the lockfile it freezes by @salpers in #2384
docs: explain package source vs installed copies by @aryansk in #2599
fix(auth): fall back to git credentials for ADO by @mheeaxa in #2610
feat(audit): allow SkillSpector --baseline through external args by @MohammedAlkindi in #2936
perf(registry): parallelize independent MCP server-info fetches by @sergio-sisternes-epam in #2983
feat: add user-invocable agent frontmatter field (#3132) by @richard-fowles-epam in #3133
fix: clarify stale cleanup message by @Dansatch in #3120
docs(guide): correct ASCII framing, apm run stability, LSP discoverability by @MohammedAlkindi in #2647
docs: fix stale README links by @icecold009 in #3016
fix(install): configure Cursor and OpenCode MCP servers at user scope by @alvedder in #3100
fix(manifest): preserve x-* extension keys and warn on unknown apm.yml keys by @sergio-sisternes-epam in #3222
docs: explain linked context lifetime after install by @dajiaohuang in #3237
fix(audit): replay the project's own content the way install deploys it by @adityaanikam in #3209
fix(prune): preserve case-equivalent GitHub dependencies (supersedes #3158) by @danielmeppiel in #3241
fix(pack): certify manifestless marketplace skills by @yfoel in #3064
feat: add GitHub Copilot marketplace output by @aryansk in #2600
fix(install): preserve skills on unmatched selection by @dajiaohuang in #3235
fix(install): pre-flight SSH github.com marketplace plugins over SSH by @MohammedAlkindi in #3200
fix(mcp): honor CLAUDE_CONFIG_DIR in Claude user-scope stale cleanup by @bodapatisaikrishna in #3148
fix(install): reconcile local skills under shared .agents roots by @tillig in #3190
fix(marketplace): record the commit an annotated tag points to by @nefayran in #3161
docs: clarify apm_modules is derived by @aryansk in #2601
feat(tls): add corporate CA bundles for package HTTPS by @TameTheGame in #2741
fix: avoid duplicate Copilot global instructions by @dajiaohuang in #3113
fix(audit): ignore hook sidecar object-key order by @Pybsama in #3155
fix(ci): repair release-gate integration suite and runtime setup under frozen binary by @danielmeppiel in #3251
fix(runtime): surface pip bootstrap errors in llm runtime setup by @danielmeppiel in #3253
fix(runtime): keep APM truststore bootstrap out of ensurepip on llm re-setup by @danielmeppiel in #3262
chore: release v0.34.0 by @danielmeppiel in #3250
test: pin cwd for deep-coverage CLI fixtures by @danielmeppiel in #3274

New Contributors

@mheeaxa made their first contribution in #2610
@richard-fowles-epam made their first contribution in #3133
@Dansatch made their first contribution in #3120
@icecold009 made their first contribution in #3016
@alvedder made their first contribution in #3100
@adityaanikam made their first contribution in #3209
@bodapatisaikrishna made their first contribution in #3148
@nefayran made their first contribution in #3161
@TameTheGame made their first contribution in #2741
@Pybsama made their first contribution in #3155

Full Changelog: microsoft/apm@v0.33.0...v0.34.0

`v0.33.0`

Compare Source

What's Changed

🔧 Other Changes

fix(install): explain skipped symlinked agent sources (refs #2913) by @danielmeppiel in #2932
fix(compile): resolve context links when folding instructions into CL… by @pavelvodrazka-etnetera in #2918
fix(hooks): render Codex hooks in native shape by @uurien in #3060
fix(cursor): comma-joined bare globs/description in .mdc frontmatter by @YGuyomar in #3011
fix(runtime): reject HTTP errors and bound Codex download retries by @danielmeppiel in #3111
fix(mcp): drop previous-transport keys on Claude server redeclaration by @edenfunf in #3041
fix(mcp): write env-sourced MCP headers into Codex's runtime fields by @edenfunf in #3042
fix(windows): resolve git.exe via shutil.which path= (PATHEXT) by @rwinkelman in #3092
fix(compile): discover Claude dependency memory at arbitrary installed depth by @vyrnsynx in #2952
fix(opencode): preserve explicit MCP enabled values by @dajiaohuang in #3102
fix(marketplace): resolve version tags from package remote by @modelpath-dev in #3044
fix(auth): preserve GitHub MCP runtime references by @dajiaohuang in #3103
fix(install): deploy skills through home directory aliases by @danielmeppiel in #2876
fix(compile): deduplicate global Claude instructions safely by @danielmeppiel in #3119
fix(cursor): preserve native MCP references and authored static values by @danielmeppiel in #3116
fix(audit): bound the deploy-tree hidden-Unicode walk to primitive directories by @lkshrk in #2962
docs(security): clarify insecure transport policy by @WilliamK112 in #2910
docs(install): correct --global local .apm/ deployment claim by @tillig in #2769
fix(copilot): keep Copilot modular instructions split at user-scope since supported - reverts #1619 by @kilianpaquier in #2317
feat(cli): add apm auth for git host credentials (#2788) by @sergio-sisternes-epam in #3134
fix(ci): restore green main CI across unit, integration and mutation lanes by @danielmeppiel in #3142
docs: clarify context availability after cloning by @danielmeppiel in #3144
chore: release v0.33.0 by @danielmeppiel in #3152

New Contributors

@pavelvodrazka-etnetera made their first contribution in #2918
@uurien made their first contribution in #3060
@YGuyomar made their first contribution in #3011
@rwinkelman made their first contribution in #3092
@vyrnsynx made their first contribution in #2952
@modelpath-dev made their first contribution in #3044
@kilianpaquier made their first contribution in #2317

Full Changelog: microsoft/apm@v0.32.0...v0.33.0

`v0.32.0`

Compare Source

What's Changed

🔧 Other Changes

feat(autopilot): origin-aware skills with CODEOWNERS-safe review by @sergio-sisternes-epam in #3003
perf(cli): lazy-load heavyweight command modules by @sergio-sisternes-epam in #3001
fix(alias): reject path-traversing dependency aliases — fixes #2900 by @Danvs60 in #2901
fix(ci): repair advisory locks and platform regressions by @danielmeppiel in #3021
fix(update): preserve marketplace uninstall aliases by @mfroembgen in #2949
Bump setuptools to 83.0.0 to remediate Unicode MANIFEST exclusion bypass by @sergio-sisternes-epam with @Copilot in #2893
feat(autopilot): maintainer canvas, panel-mode, and comment writer by @sergio-sisternes-epam in #3024
fix(install): shorten staging path segments to clear Windows MAX_PATH by @MohammedAlkindi in #2941
fix(installer): correct prebuilt Linux glibc minimum to 2.38 by @danielmeppiel in #2931
fix(update): preserve deployment targets during partial updates by @Wanming08 in #2924
fix(hooks): map prompt-submit to Copilot's userPromptSubmitted by @sheilagithub in #3030
fix(marketplace): authenticate default-host checks by @yfoel in #2917
fix(deps): reject incompatible immutable requirements by @danielmeppiel in #3061
fix(prune): detect orphan skills and preserve retained bundles by @fangkangmi in #3057
chore: release v0.32.0 by @danielmeppiel in #3080
fix(tests): repair v0.32.0 release validation contracts by @danielmeppiel in #3081

New Contributors

@Danvs60 made their first contribution in #2901
@Wanming08 made their first contribution in #2924
@sheilagithub made their first contribution in #3030
@yfoel made their first contribution in #2917

Full Changelog: microsoft/apm@v0.31.0...v0.32.0

`v0.31.0`

Compare Source

What's Changed

🔧 Other Changes

fix(outdated): report published registry versions beyond pins by @danielmeppiel in #2874
harden(gh-aw): require target (breaking), add token-source, fix GitHub policy casing by @danielmeppiel in #2706
fix(ci): recover native Windows workflow contract tests by @danielmeppiel in #2880
fix(codeql): remediate eleven sensitive-data alerts by @danielmeppiel with @Copilot in #2742
Fix skills subset installs for manifestless Git collections by @danielmeppiel with @Copilot in #2891
test: restore complete architecture guard mutation coverage by @danielmeppiel with @Copilot in #2892
fix(registry): exact version selectors must match published build metadata by @nadav-y in #2894
fix(install): fail loudly when a package deploys to no target (closes #2796) by @danielmeppiel in #2806
docs: Add WinGet method installation by @Gijsreyn in #2520
fix(deps): preserve GitLab sparse-fetch transport by @danielmeppiel in #2939
feat(init): onboard existing local packages without rewriting source by @danielmeppiel in #2937
docs: establish issue-first contribution and governance policy by @danielmeppiel in #2954
fix(triage): make automated recommendations advisory by @danielmeppiel in #2956
docs: define issue-backed roadmap and release planning by @danielmeppiel in #2959
fix(governance): require human scope and add neutral eligibility evidence by @danielmeppiel in #2964
fix(git-env): skip the HTTP header probe for non-HTTP effective URLs by @arnaudoisel in #2906
docs: publish the active issue-backed roadmap by @danielmeppiel in #2988
fix(uninstall): preserve unmanaged skills with an empty inventory by @mfroembgen in #2947
fix(ci): repair stale daily release smoke fixtures by @danielmeppiel in #2987
fix(cache): pin core.autocrlf=false on GitCache checkouts by @sergio-sisternes-epam in #2982
chore: release v0.31.0 by @danielmeppiel in #2989

New Contributors

@Gijsreyn made their first contribution in #2520
@arnaudoisel made their first contribution in #2906
@mfroembgen made their first contribution in #2947

Full Changelog: microsoft/apm@v0.30.0...v0.31.0

If you want to rebase/retry this PR, check this box

This PR was generated by #infrastructure automation. Contact us if you have any questions or feedback.

eclipse-score-bot · 2026-10-22T14:06:58Z

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: src/s-core-devcontainer/.devcontainer/s-core-local/versions.yaml

Post-upgrade command 'tools/internal/refresh_lockfile_digests.py' has not been added to the allowed list in allowedCommands

File name: tools/lockfiles/apm.lock.json

Post-upgrade command 'tools/internal/refresh_lockfile_digests.py' has not been added to the allowed list in allowedCommands

eclipse-score-bot requested review from lurtz and opajonk as code owners October 22, 2026 14:06

eclipse-score-bot added the type:dependencies label Oct 22, 2026

chore(deps): Update dependency microsoft/apm to v0.35.0

4a155ea

eclipse-score-bot force-pushed the renovate/microsoft-apm-0.x branch from 5308a08 to 4a155ea Compare October 22, 2026 23:05

eclipse-score-bot changed the title ~~chore(deps): Update dependency microsoft/apm to v0.34.0~~ chore(deps): Update dependency microsoft/apm to v0.35.0 Oct 22, 2026

Navigation Menu

Repository navigation

chore(deps): Update dependency microsoft/apm to v0.35.0 - #174

chore(deps): Update dependency microsoft/apm to v0.35.0#174
eclipse-score-bot wants to merge 1 commit into
mainfrom
renovate/microsoft-apm-0.x

eclipse-score-bot commented Oct 22, 2026 •

edited

Loading

Uh oh!

eclipse-score-bot commented Oct 22, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

eclipse-score-bot commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v0.35.0

What's Changed

🔧 Other Changes

New Contributors

v0.34.0

What's Changed

🔧 Other Changes

New Contributors

v0.33.0

What's Changed

🔧 Other Changes

New Contributors

v0.32.0

What's Changed

🔧 Other Changes

New Contributors

v0.31.0

What's Changed

🔧 Other Changes

New Contributors

Uh oh!

eclipse-score-bot commented Oct 22, 2026

⚠️ Artifact update problem

File name: src/s-core-devcontainer/.devcontainer/s-core-local/versions.yaml

File name: tools/lockfiles/apm.lock.json

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

eclipse-score-bot commented Oct 22, 2026 •

edited

Loading

`v0.35.0`

`v0.34.0`

`v0.33.0`

`v0.32.0`

`v0.31.0`