Otterdog v1.8.0

Security

• fix(credentials): invoke the pass and bitwarden CLIs without a shell, fixes CVE-2026-123717 (GHSA-886p-g538-rcmp), reported by @kiki156578, fixed by @mbarbero and @heurtematte

Added

• feat: allow to ignore repository environments with exclude_environments by @netomi in #887
• feat: manage Dependabot and Codespaces secrets by @heurtematte in #890
• feat: validate configurations with otterdog in the playground by @heurtematte in #891
• feat(org): manage code security configurations by @heurtematte in #892
• Feat/ruleset additional rule types by @heurtematte in #900
• Feat/dashboard theme by @heurtematte in #912
• Feat/team idp sync by @heurtematte in #911
• feat: warn when base_template references a branch by @heurtematte in #921
• feat: allow to disable the web ui by default via otterdog.json by @netomi in #913
• feat: support a local base template by @netomi in #917
• feat: restrict the secrets that an organization can reference by @heurtematte in #923

Changed

• Breaking: move the standard Jsonnet defaults from examples/template to otterdog/resources/defaults and ship them with the otterdog package (#889).
  Configurations using https://github.com/eclipse-csi/otterdog#examples/template/otterdog-defaults.libsonnet with a ref that includes this change (e.g. @v1.8.0 or @main) need to update:

  • defaults.jsonnet.base_template in otterdog.json to https://github.com/eclipse-csi/otterdog#otterdog/resources/defaults/otterdog-defaults.libsonnet@<ref>
  • the import statement of every organization configuration from import 'vendor/otterdog/examples/template/otterdog-defaults.libsonnet' to import 'vendor/otterdog/otterdog/resources/defaults/otterdog-defaults.libsonnet'

  Configurations pinned to an earlier release tag are not affected.

• Breaking: the standard Jsonnet defaults define the functions of Dependabot and Codespaces secrets (#890).
  Configurations using them need credentials that can read these secrets, e.g. a GitHub App with the Codespaces secrets, Dependabot secrets, Organization codespaces secrets and Organization dependabot secrets permissions, see Create a GitHub App.

• Breaking: secret names that are not uppercase are reported as an error by the validation, as GitHub normalizes secret names to uppercase (#890).

• Breaking: a failure to read the secrets of an organization, a repository or an environment aborts the operation, instead of being considered as no secrets (#890).
  Codespaces secrets that GitHub does not make available for an organization are skipped (#914).

• Breaking: the values used to look up credentials with the pass and bitwarden providers are no longer subject to shell expansion (see Security below).
  A configuration relying on $VARIABLE, ~ or globbing inside a bitwarden item id or a pass key must resolve it beforehand, or use the env credential provider.

• refactor: move standard Jsonnet templates into package resources by @heurtematte in #889

• chore: run the tests in parallel by @heurtematte in #899

• docs: build the documentation with Zensical by @heurtematte in #908

• docs: link the documentation at csi.eclipse.dev instead of Read the Docs by @heurtematte in #909

• website official artwork by @heurtematte in #910

• chore(deps-dev): bump dnspython from 2.8.0 to 2.9.0 in the python-security group across 1 directory by @dependabot[bot] in #896

• chore(deps): bump the npm-minor-patch group in /otterdog/webapp/static with 4 updates by @dependabot[bot] in #901

• chore(deps): bump the github-actions group with 2 updates by @dependabot[bot] in #902

• chore(deps-dev): bump the python-minor-patch group with 4 updates by @dependabot[bot] in #903

• chore(deps-dev): bump the python-minor-patch group with 5 updates by @dependabot[bot] in #931

• chore(deps): bump the npm-minor-patch group in /otterdog/webapp/static with 4 updates by @dependabot[bot] in #928

• chore(deps): bump rossjrw/pr-preview-action from 1.8.1 to 1.8.2 in the github-actions group by @dependabot[bot] in #930

• chore(deps-dev): bump types-requests from 2.33.0.20261006 to 2.33.0.20261030 by @dependabot[bot] in #932

• chore(deps-dev): bump types-pyyaml from 6.0.12.20260906 to 6.0.12.20261030 by @dependabot[bot] in #935

• chore(deps-dev): bump pytest-asyncio from 1.4.1 to 1.4.1.post1 by @dependabot[bot] in #934

• chore(deps-dev): bump types-hvac from 2.4.0.20260731 to 2.4.0.20261102 by @dependabot[bot] in #933

• chore(deps): bump cm6-graphql from 0.2.2 to 1.0.0 in /otterdog/webapp/static by @dependabot[bot] in #929

• chore(deps): declare graphql as a direct dependency of the webapp by @heurtematte in #936

Fixed

• fix: do not flag every workflow settings change as cost-related by @heurtematte in #885
• fix: translate deprecated code scanning language javascript-typescript by @netomi in #888
• recheck approvals when merging a pull request via /otterdog merge by @heurtematte in #895
• fix: generate the SBOM with cyclonedx-bom 7.6.0 by @heurtematte in #898
• fix: respect custom templates throughout the playground by @AlexanderLanin in #893
• fix: do not remove the teams managed outside otterdog when applying a pull request by @heurtematte in #905
• fix: find the base of a rebase-merged pull request before GitHub associates its commits by @heurtematte in #904
• Fix/installation before config by @heurtematte in #906
• fix(custom-property): default values_editable_by to org_actors by @heurtematte in #907
• fix: skip Codespaces secrets that GitHub does not make available by @netomi in #914
• fix: write lists with a null default as replacement in generated jsonnet by @netomi in #916
• fix: only retrieve workflow settings defined by the default config on import by @netomi in #919
• fix: send javascript-typescript when updating the code scanning default setup by @heurtematte in #922
• fix: do not send team permissions when updating repository settings by @heurtematte in #924
• fix: ignore the private pages setting reported for non-enterprise plans by @netomi in #925
• fix: synchronize the otterdog processes updating the same base template by @heurtematte in #927