v3.1.4

Changed

• Reviewed dependency maintenance. Update Uvicorn, Tenacity, Cosmos DB and
  Storage management SDKs, and adopt jest-dom 7 on the existing Node 22 test
  toolchain. Preserve the patched security dependencies and generated lock.
• Grouped Actions maintenance. Check GitHub Actions weekly against
  develop, grouped with a seven-day cooldown, matching the component
  maintenance policy without introducing duplicate updates against main.
• Chunk key hashing. Use SHA-256 instead of SHA-1 for the truncated suffix
  of long Blob and SharePoint document IDs. Short IDs and parent IDs remain
  unchanged. Existing long-key documents are not migrated automatically.
  Reindex affected parents to replace their stored chunks before relying on
  the new IDs; retained citations to previous chunk IDs may need refreshing.
• Shared repository protection standard. Require pull requests and passing
  quality, behavior and frontend checks without mandatory second-person review.
  Preserve protected-base integrity, immutable Actions references and narrowly
  scoped privileged workflow authorization.

Fixed

• Dependabot configuration syntax. Separate the GitHub Actions update
  entry from the preceding package labels so all three update streams remain
  valid YAML and dependency maintenance continues to run.
• Security dependency updates. Update aiohttp, PyJWT, Pillow and pypdf to
  versions outside the reported vulnerable ranges. Refresh frontend tooling
  and transitive dependencies, with a scoped patched selector-parser override
  for Tailwind typography.
• Immutable GitHub Actions references. Pin the remaining workflow actions
  to verified full-length commit SHAs without changing their selected versions,
  and require agents to preserve SHA pinning when editing or regenerating CI.

Validation

• Release PR Azure/agent-app-ingestion#370 passed all required repository checks and the protected quality gate. The main release tree matches that validated candidate.
• The complete Dependabot YAML parses successfully with all three update streams, weekly Actions grouping, develop targets and a seven-day cooldown.
• Shared contract files are unchanged from the previous stable release.
• Validation was offline; no Azure deployment or live Azure end-to-end test was performed.

Publication scope and recovery

• This release publishes the source tag and GitHub Release only, not a container image or Python package.
• Prefer a forward corrective patch if an adoption issue appears; preserve immutable published tags. Previous stable reference: v3.1.3.