Repository navigation
v0.135.0
What's new
You can now stop an active run from Discord with /fro-bot cancel, targeting it from the run thread or its bound channel. The command reports whether cancellation succeeded and posts a notice in the thread; it avoids cancelling quarantined runs, where owned work may still be running. #2066 #2063
Bug fixes
Gateway run ownership updates are now serialized and duplicate snapshots are skipped, preventing concurrent writes from losing to each other with a conditional-store conflict. The terminal write waits for pending ownership updates to drain, while retaining the existing stale-ETag retry as a backstop. #2059
Discord approval and question cards now show deciding actors where Discord renders them correctly: mentions appear in card descriptions instead of titles, and dashboard approvers appear as escaped plain-text logins rather than broken Discord mentions. Existing non-human decisions and mention suppression remain unchanged. #2057 #2061
The Hono update includes fixes for middleware bypasses involving mounted paths and wildcard routes, skipped multipart form validation, CSS helper HTML injection, and CSRF checks for hyperlink-auditing requests. #2062
Operations
The workspace shell-permission documentation now matches the gateway behavior: commands ask only when an operator rule matches, the last matching rule wins, and commands in compound expressions are checked individually. It also provides a working example for selectively prompting on commands such as rm and sudo. #2064
Renovate post-upgrade jobs now build only the committed Action bundle where needed, skip builds for lint-only and GitHub Actions updates, and avoid fetching the full AWS SDK changelog. This reduces work on update branches while retaining validation of the generated bundle and Renovate command configuration. #2054
Full changelog
0.135.0 (2026-11-04)
Features
Build System
- deps: build only the Action bundle in Renovate post-upgrade tasks (#2054) (ec6398f)
- deps: ignore the minimatch 10.2.6 advisory in OSV until a fixed line is usable (#2065) (8f689a9)
- deps: update Systematic to v3.30.1 (#2060) (d824275)
Bug Fixes
- deps: update dependency @aws-sdk/client-s3 to v3.1161.0 (#2037) (6214a97)
- deps: update dependency discord.js to v14.28.0 (#2045) (36b6399)
- deps: update dependency hono to v4.13.16 (#2062) (b297889)
- gateway: do not cancel a run that is quarantined (#2063) (229e29c)
- gateway: serialize run ownership writes so they stop losing to each other (#2059) (423bc69)
- gateway: show a dashboard approval's decider as plain text on the Discord card (#2061) (d107dd6)
- gateway: show the approval decider in the card body, not the title (#2057) (787ef88)