Telemetry Tracker v1.16.6

Highlights

• CodeQL medium / Actions hygiene — harden GitHub Actions (permissions, pin pnpm/action-setup, env-based composite inputs), sanitize CR/LF in email/dashboard debug logs, and harden publish CLI (execFile + validated OTP args) (#586)
• Dependabot moderate/low alerts — resolve transitive advisories via pnpm overrides for js-yaml, yaml, postcss, uuid, brace-expansion, @babel/core, esbuild, and diff (#587)

Upgrade (self-hosted)

From v1.16.5, no database migrations.

None — no database changes in this release.

Breaking changes

• None.

Product update email

Skipped — mid-line PATCH on v1.16.x — Release Intelligence (line-close policy).

Ops notes

• Leave brief-worker alone.
• Still open: Dependabot #45 (@opentelemetry/core) — blocked on Sentry 9→10 major (OTel 2.x).
• Reminder: Railway alert-rules-evaluator cron (node dist/jobs/run-alert-rules-evaluator.js) is still manual / not auto-provisioned if schedule-oriented CUSTOM Alert Rules are in use — see RAILWAY.md.

Full changelog

See CHANGELOG.md.