v3.138.3

What's Changed

🔒 Security

• Prevent case variants of Windows job environment variable names from bypassing signature verification and allowlist checks by @CerealBoy in #4605
• Reject pipeline YAML with excessive alias expansion instead of exhausting memory during buildkite-agent pipeline upload by @dependabot[bot] in #4579

🐛 Fixed

• Prevent unnecessary ping-stream reconnections and keep paused agents paused when receiving keepalives or unknown stream actions by @moskyb in #4616

🏠 Internal

• Fix copying release binaries to the S3 latest directory in v3 release pipelines by @moskyb in #4561
• Dependency updates by @dependabot[bot] in #4575, #4577, #4578, #4584, #4581, #4580, #4582, #4601, #4603 and #4604

Full Changelog: v3.138.2...v3.138.3