v4.5.0

What's Changed

🔒 Security

• Add --protected-environment-variables and --protect-dangerous-git-environment-variables to stop jobs from setting chosen environment variables, such as GIT_SSH_COMMAND by @moskyb in #4503
• Check out plugins pinned to a full commit SHA at that commit, even when a branch has the same name by @jasonwbarnett in #4458
• Apply plugin and repository allowlists to job environment variables regardless of case on Windows, and refuse jobs with names that only differ by case by @moskyb in #4498
• Mask URL credentials and query strings in errors captured with buildkite-agent job capture-error by @pinzonjulian in #4485

🐛 Fixed

• Always download buildkite-agent cache restore archives inside the restore's temporary directory by @jamiemonserrate in #4440
• Check the repository against --allowed-repositories before checkout starts by @jamiemonserrate in #4439
• Fix fetching branches with quotes in their names when BUILDKITE_COMMIT is HEAD by @isaacsu in #4512
• Build the branch rather than a tag with the same name when BUILDKITE_COMMIT is HEAD by @isaacsu in #4513

🔧 Changed

• Remove --context from buildkite-agent job capture-error; put all important details in --message instead by @pinzonjulian in #4478
• Truncate messages captured with buildkite-agent job capture-error to 1,000 characters by @123sarahj123 in #4465

🏠 Internal

• Tell robot reviewers how to check release PRs by @moskyb in #4461
• Tell agents how to label PRs by @moskyb in #4499
• Dependency updates by @dependabot[bot] in #4506 and #4510

New Contributors

• @pinzonjulian made their first contribution in #4478

Full Changelog: v4.4.0...v4.5.0