test(deps): update dependency apm to v0.26.0 (main)

[renovate]

This PR contains the following updates:

Package	Update	Change
apm	minor	0.24.1 → 0.26.0

---

Release Notes

microsoft/apm (apm)

v0.26.0

Compare Source

What's Changed

🔧 Other Changes

• feat(tls): verify against the OS trust store by default (closes #​2004) by @​fangkangmi in #​2005
• fix(update): re-check transitive dependencies' own semver ranges during apm update by @​nadav-y in #​2053
• feat(shepherd): enforce canonical owner gate by @​danielmeppiel in #​2180
• fix(deps): git-semver update idempotency in build_update_plan by @​srobroek in #​2165
• fix(audit): preserve dependency link paths during replay by @​danielmeppiel in #​2179
• docs: add deny and doctor CLI references by @​danielmeppiel in #​2178
• fix(installer): expose stable Windows executable by @​danielmeppiel in #​2094
• fix(audit): honor locked skill subsets during replay by @​danielmeppiel in #​2177
• fix(docs): correct relative link depths across docs site by @​JasonTame in #​2170
• fix(pack): pack subdirectory-prefixed skills by @​danielmeppiel in #​2176
• fix(policy): preserve strict policy across warm cache reads by @​danielmeppiel in #​2193
• test(foundation): add hermetic lifecycle integration utilities by @​danielmeppiel in #​2209
• harden(contracts): add platform and rendered documentation evidence by @​danielmeppiel in #​2199
• test: add finite taxonomy and quality ratchets by @​danielmeppiel in #​2198
• test(consume): add real lifecycle contracts by @​danielmeppiel in #​2212
• test(produce): prove real pack-to-install artifact parity by @​danielmeppiel in #​2215
• test(consume): expand source/ref/cache matrix by @​danielmeppiel in #​2219
• test(produce): expand genuine materialization matrix by @​danielmeppiel in #​2218
• fix(deps): canonicalize virtual package manifest bytes by @​danielmeppiel in #​2223
• test(govern): prove strict policy lifecycle parity by @​danielmeppiel in #​2221
• fix(lockfile): converge claude_skill virtual dep name/version across resolution paths (closes #​2206) by @​danielmeppiel in #​2217
• test(quality): synchronize the finite critical-suite count by @​danielmeppiel in #​2230
• fix(deps): preserve custom port in HTTP git URL persisted to apm.yml by @​atulya-singh in #​2210
• fix(audit): exempt is_virtual packages from config-consistency manifest check by @​hugoguitton-lucca in #​2214
• fix(marketplace): close packed source contracts by @​danielmeppiel in #​2228
• fix(pack): emit category in Claude marketplace output by @​mbeacom in #​2189
• fix(cache): preserve nested GitLab repository identity by @​lidorcg in #​2192
• fix(cli): warn when Codex agent tool scope is dropped by @​jstar0 in #​2186
• fix(deps): accept custom port in shorthand so apm.yml entries re-parse by @​atulya-singh in #​2211
• harden(shepherd): require exact-head functional owner evidence by @​danielmeppiel in #​2234
• fix(policy): honor Govern cache TTL with bounded property coverage by @​danielmeppiel in #​2235
• fix(deps): honor SSH for semver ref resolution by @​danielmeppiel in #​2229
• fix(ado): preserve lock coordinates for outdated and update by @​danielmeppiel in #​2226
• fix(deps): bound best-effort ref lookup retries by @​danielmeppiel in #​2238
• fix(virtual-packages): restore hermetic lifecycle convergence by @​danielmeppiel in #​2240
• test(architecture): add bounded mutation pilot by @​danielmeppiel in #​2241
• test(deps): add field-complete lockfile round-trip and reconstruction properties by @​danielmeppiel in #​2246
• fix: Windows CI CRLF baseline and WebSocket shutdown thread-join (closes #​2233) by @​danielmeppiel in #​2237
• fix(prune): reconcile merged hook ownership after package removal by @​danielmeppiel in #​2249
• fix(hooks): scope merged-hook wipe to resolved targets, not all KNOWN_TARGETS by @​danielmeppiel in #​2252
• harden(ci): require hermetic lifecycle smoke subset on pull-request CI by @​danielmeppiel in #​2247
• feat(mutation): add lockfile-normalization owner to bounded mutmut pilot by @​danielmeppiel in #​2251
• fix(ci): restore Windows unit reliability by @​danielmeppiel in #​2262
• fix(deps): add SSH key-auth clone failure guidance by @​danielmeppiel in #​2244
• test(hooks): promote target-scope uninstall smoke by @​danielmeppiel in #​2257
• fix(release): package Rich Unicode tables in frozen binaries by @​danielmeppiel in #​2264
• test(lifecycle): add shared state substrate by @​danielmeppiel in #​2265
• test: remove duplicate validation suite by @​danielmeppiel in #​2263
• fix(quality): correct duplicate group count by @​danielmeppiel in #​2274
• test(fixtures): auth-hardened url_rewrite_subprocess_env for real CLI installs by @​danielmeppiel in #​2267
• test(lifecycle): cover package shape transitions by @​danielmeppiel in #​2273
• fix(deps): preserve shared transitive deps still reachable from survivors by @​danielmeppiel in #​2269
• fix(ci): raise packaged Unix integration timeout by @​danielmeppiel in #​2276
• test(config): cover configuration and shared-graph lifecycle contracts by @​danielmeppiel in #​2277
• test: retire six exact duplicate modules by @​danielmeppiel in #​2278
• fix(install): reconcile dropped-target merge-hook state on target contraction by @​danielmeppiel in #​2275
• fix(manifest): fold legacy 'all' in targets to auto-detect with a deprecation warning by @​kotalab in #​2272
• fix: absolutize Copilot user-scope hook commands (closes #​2232) by @​danielmeppiel in #​2236
• fix(hooks): compose per-file routing with dependency targets by @​srobroek in #​2259
• fix(hooks): rebuild merged hooks from transitive lockfile survivors by @​Shaurya2k06 in #​2256
• test: retire six header-only twin modules by @​danielmeppiel in #​2280
• test(integration): add primitive target lifecycle covering array by @​danielmeppiel in #​2266
• test(ci): isolate the live guardrailing hero by @​danielmeppiel in #​2281
• fix(deps): recover virtual files from GitHub throttles by @​danielmeppiel in #​2284
• fix(install): contract generic shared target rows by @​danielmeppiel in #​2283
• test(integration): retire final header-only test twins by @​danielmeppiel in #​2285
• feat(agentics): add daily performance-scan agentic workflow by @​sergio-sisternes-epam in #​2125
• fix(deps): align integration throttle contracts by @​danielmeppiel in #​2287
• test(outdated): isolate parallel fixtures by @​danielmeppiel in #​2288
• test(integration): hermeticize packaged lifecycle E2E by @​danielmeppiel in #​2289
• fix(prune): reconcile deployment ledger ownership by @​danielmeppiel in #​2292
• fix(install): reconcile dropped target instructions by @​danielmeppiel in #​2295
• fix: guide compile-only project installs (supersedes #​2115, closes #​2057) by @​danielmeppiel in #​2293
• fix(audit): surface ref-consistency before deployment-ledger-owners by @​danielmeppiel in #​2300
• fix(install): remove shared-root skill orphan on target narrowing by @​danielmeppiel in #​2299
• fix(skills): report zero-match filters (supersedes #​2117, closes #​2116) by @​danielmeppiel in #​2294
• fix: selective update plan must not mark unselected deps removed (closes #​2291) by @​danielmeppiel in #​2305
• test(lifecycle): require real state machine gate by @​danielmeppiel in #​2309
• fix(lifecycle): repair packaged G0 contracts by @​danielmeppiel in #​2310
• test(tls): make override oracle state-independent by @​danielmeppiel in #​2311
• fix(install): defer transient GitHub validation failures by @​danielmeppiel in #​2313
• fix(integration): hermeticize stale packaged G0 release-blocker tests by @​danielmeppiel in #​2314
• chore: release v0.26.0 by @​danielmeppiel in #​2316

New Contributors

• @​fangkangmi made their first contribution in #​2005
• @​JasonTame made their first contribution in #​2170
• @​atulya-singh made their first contribution in #​2210
• @​hugoguitton-lucca made their first contribution in #​2214
• @​mbeacom made their first contribution in #​2189
• @​lidorcg made their first contribution in #​2192
• @​jstar0 made their first contribution in #​2186
• @​kotalab made their first contribution in #​2272
• @​Shaurya2k06 made their first contribution in #​2256

Full Changelog: microsoft/apm@v0.25.0...v0.26.0

v0.25.0

Compare Source

What's Changed

🔧 Other Changes

• Fix --target intellij validation (#​1957) by @​sergio-sisternes-epam in #​2041
• fix(install): drop inactive-target ghost entries from lockfile deployed_files (#​2059) by @​edenfunf in #​2114
• ci(release): remove obsolete Homebrew dispatch credential by @​danielmeppiel in #​2088
• fix(marketplace): preserve ADO URL and bearer auth by @​danielmeppiel in #​2121
• refactor(core): consolidate red-team lifecycle fixes behind canonical owners by @​danielmeppiel in #​2155
• fix(pack): select plugin sources by .apm presence by @​danielmeppiel in #​2122
• fix(deps): preserve nested package manifests during prune by @​danielmeppiel in #​2092
• Add .github-private as preferred policy repo candidate by @​sergio-sisternes-epam in #​2058
• perf: fix algorithmic regressions and expand performance-expert agent by @​sergio-sisternes-epam in #​2124
• feat(dashboard): add Triage tab, Comments thread, bulk PR actions, and session navigation by @​sergio-sisternes-epam in #​2043
• chore: release v0.25.0 by @​danielmeppiel in #​2164
• fix(deps): render logical local dep keys in deps list/tree; refresh stale v0.25.0 release tests by @​danielmeppiel in #​2173
• fix(deps): preserve local identity display boundaries by @​danielmeppiel in #​2174

Full Changelog: microsoft/apm@v0.24.1...v0.25.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.