v0.24.2

Highlights

GraphQL repository scoping — Query.repository(owner, name) form — Third installment in the v0.24 GraphQL scope-checker hardening series. The proxy's repo-scope checker previously only validated repositoryId/*Id/repositoryNameWithOwner fields and missed GitHub's Query.repository(owner, name) form (and its organization(login).repository(name), repositoryOwner.repository(name), user(login).repository(name) accessors). With queries: ["*"], an in-scope GitHub App surrogate token could read any repository visible to the installation. The checker now walks the AST for repository field selections, resolves the owner from the field's owner arg or its parent's login arg, and validates owner/name against the installation's repo full names case-insensitively. Fail-secure when the owner is unresolvable. (#576)

Other Changes

• Bumped mistune to 3.2.1 to address GHSA-hjph-f4mc-wx4c. (#582)
• Bumped all uv.lock dependencies (main and proxy lockfiles) to latest upstream versions. (#578, #579, #581)

Upgrade

airut update

If airut check reports a pending config schema migration after updating, run airut migrate.