v0.83.0

🌟 Release Highlights

This release focuses on security hardening, ESLint rule expansion, and developer experience improvements — with notable fixes to OAuth emission, MCP telemetry, and the Anthropic SDK retry storm.

✨ What's New

• New ESLint rules — Three new analyzers shipped: stringsjoinone (detects single-element strings.Join calls), no-setfailed-then-exit-zero (guards against masked failures), and require-execfilesync-try-catch (enforces error handling around execFileSync). These complement the new require-fs-io-try-catch rule for statSync/readdirSync/copyFileSync/unlinkSync/renameSync.
• Console stderr wrappers — New console.Print* stderr wrappers reduce noise in MCP and secrets call sites, making log output cleaner and easier to follow.
• close_issue agents can choose state-reason at runtime — Agents that close issues can now select the closure reason dynamically, enabling more expressive workflow outcomes.
• Sub-30s make test-unit via impacted-first execution — Test runs now prioritise changed packages first, targeting a <30 s feedback loop for most incremental changes.

🐛 Bug Fixes & Improvements

• OAuth activation YAML multiline fix — Corrects incorrect YAML emission for multiline engine.env.COPILOT_GITHUB_TOKEN in OAuth activation blocks.
• Safeoutputs CLI literal
  fix — Literal in CLI-mode safeoutputs string arguments are now correctly expanded to newlines.
• Claude SDK inner retries disabled — Anthropic SDK retries are suppressed to prevent terminal-error storms when the API is unreliable.
• Compiler scope fix — Resolved a bug where the mount-mcp-clis step reference was emitted out of scope in generated lock files.
• MCP telemetry gap fix — Normalized artifact path discovery eliminates false gaps in daily observability reports.
• create_issue title contamination fix — Report content no longer bleeds into the issue title field.
• Pi engine firewall — pi.dev added to the Pi engine firewall allowlist.
• Threat detection guard — conclude_threat_detection.sh now correctly skips when RUN_DETECTION=false.

🔒 Security

• HTML template renderer — Replaced unsafe string formatting with html/template to resolve an unsafe-quoting alert in the bootstrap page renderer (CodeQL).
• Action pin SHA guard — Runtime guard for empty SHAs in action pins; invalid ruby/setup-ruby entry removed.
• Sighthound CWE-78 fixes — Top 5 command-injection findings addressed.
• Docker build action pinned to commit SHA — Resolves CodeQL alert #625.

📚 Documentation

• Automatic Node.js setup for self-hosted/GPU runners — New guide covering Node.js configuration on runners without pre-installed toolchains.
• Bounded optimization reference — Documents strategies for keeping repetitive agentic work within token and time budgets.
• Linter doc-sync improvements — Registry, prose docs, and spec labels are now kept in sync automatically.

Generated by 🚀 Release · sonnet46 19.1 AIC · ⊞ 7.9K

---

What's Changed

• [instructions] Sync instruction files with release v0.82.14 by @github-actions[bot] in #47049
• refactor(parser): extract extractEngineMCPSettings to bring extractEngineConfig under 60-line limit by @pelikhan with @Copilot in #47009
• Render compressed model alias before AIC in generated footers by @pelikhan with @Copilot in #47018
• Bump prettier from 3.9.5 to 3.9.6 in /actions/setup/js by @dependabot[bot] in #47060
• Bump @github/copilot-sdk from 1.0.6 to 1.0.7 in /actions/setup/js by @dependabot[bot] in #47059
• Bump astro from 7.1.0 to 7.1.3 in /docs by @dependabot[bot] in #47057
• Bump vite from 8.1.0 to 8.1.5 in /actions/setup/js by @dependabot[bot] in #47058
• Add SEC-006 conformance coverage for E009/E010 in safe-output processor paths by @pelikhan with @Copilot in #47003
• fix(eslint-factory): prefer-core-logging suggestion unsafe for non-string arguments by @pelikhan with @Copilot in #47020
• refactor(pkg/linters): extract helpers to eliminate all 33 large-function findings by @pelikhan with @Copilot in #47022
• eslint(no-core-error-then-process-exit): widen detection to non-adjacent pairs by @pelikhan with @Copilot in #47043
• fix: send agent_assignment in assignAgentToIssue REST payload by @pelikhan with @Copilot in #47047
• feat(console): golden tests for non-TTY ProgressBar outputs + TTY/non-TTY comment clarification by @pelikhan with @Copilot in #47042
• Improve signed-commits push refusal rendering in fallback issue bodies by @pelikhan with @Copilot in #47056
• Allow close_issue agents to choose state-reason at runtime by @pelikhan with @Copilot in #47045
• [eslint-miner] eslint: add no-core-error-then-process-exitcode rule by @github-actions[bot] in #47054
• fix(eslint): patch switch fall-through false negative and hoisted function false positive in require-return-after-core-setfailed by @pelikhan with @Copilot in #47055
• refactor(workflow,cli): eliminate 680 function-length lint findings via targeted helper extraction by @pelikhan with @Copilot in #47061
• fix: runtime guard for empty SHA in action pins + remove invalid ruby/setup-ruby@v1.319.0 entry by @pelikhan with @Copilot in #47048
• fix: add actions: write to update_cache_memory and conclusion jobs to unblock cache saves by @pelikhan with @Copilot in #47046
• chore: CLI version updates 2026-07-21 by @pelikhan with @Copilot in #47005
• Update gh-aw-threat-detection to v0.3.0 by @davidslater with @Copilot in #47149
• [dead-code] chore: remove dead functions — 1 function removed by @github-actions[bot] in #47093
• Tighten reference docs for artifact compatibility, audit JSON contracts, and safe-output safeguards by @pelikhan with @Copilot in #47117
• [docs] docs: tighten markdown reference guidance by @github-actions[bot] in #47170
• [log] Add debug logging to token accounting and expression detection by @github-actions[bot] in #47185
• build(deps): bump the npm_and_yarn group across 1 directory with 2 updates by @dependabot[bot] in #47197
• build(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 in the go_modules group across 1 directory by @dependabot[bot] in #47196
• [community] Update community contributions in README by @github-actions[bot] in #47177
• fix: move pages/id-token permissions to deploy job to fix action_required regression by @pelikhan with @Copilot in #47201
• Optimize make test-unit for sub-30s feedback via impacted-first execution by @pelikhan with @Copilot in #47200
• Close linter doc-sync gap by bridging registry, prose docs, and spec labels by @pelikhan with @Copilot in #47204
• [jsweep] Clean convert_gateway_config_shared.cjs by @github-actions[bot] in #47192
• Add console.Print* stderr wrappers and migrate high-volume MCP/secrets callsites by @pelikhan with @Copilot in #47108
• [actionpins] Add missing internal coverage and table-drive action pin mapping tests by @pelikhan with @Copilot in #47206
• fix: guard conclude_threat_detection.sh so threat-detect never runs when RUN_DETECTION=false by @pelikhan with @Copilot in #47019
• fix(multi-device-docs-tester): Chrome SUID sandbox and server unreachable from agent container by @pelikhan with @Copilot in #46157
• docs: document automatic Node.js setup for self-hosted/GPU runners by @pelikhan with @Copilot in #47234
• chore: remove withinDeferredBoundary dead code in require-execsync-try-catch rule by @pelikhan with @Copilot in #47233
• fix(daily-vulnhunter-scan): raise max-ai-credits to 1500 by @pelikhan with @Copilot in #47236
• test: add regression guard for audit tool exposure in gh aw mcp-server by @pelikhan with @Copilot in #47241
• fix: add pi.dev to Pi engine firewall allowlist by @pelikhan with @Copilot in #47243
• [avenger] ## Update wasm golden file for pi engine changes by @github-actions[bot] in #47255
• [instructions] Sync instruction files with release v0.82.15 by @github-actions[bot] in #47254
• Add Pi offline regression coverage to wasm golden engine test by @pelikhan with @Copilot in #47261
• feat(eslint): add no-setfailed-then-exit-zero rule by @pelikhan with @Copilot in #47232
• Fix compiler emission bug: mount-mcp-clis step reference out of scope in generated lock files by @pelikhan with @Copilot in #47235
• eslint: no-core-error-then-process-exitcode — forward scan + top-level autofix by @pelikhan with @Copilot in #47240
• fix: address Sighthound CWE-78 command injection findings (top 5) by @pelikhan with @Copilot in #47242
• testify: migrate assert.Contains(err.Error()) → ErrorContains, fix require-error violations by @pelikhan with @Copilot in #47252
• [eslint-miner] eslint: add require-fs-io-try-catch rule (statSync / readdirSync / copyFileSync / unlinkSync / renameSync) by @github-actions[bot] in #47259
• Add PR-level stale lock file guard for workflow markdown edits by @pelikhan with @Copilot in #47238
• Refactor audit report largefunc slice in pkg/cli by @pelikhan with @Copilot in #47262
• feat: classify driver-exit (0-turn) failures separately from agent-logic failures in health metrics by @pelikhan with @Copilot in #47250
• [WIP] Fix failing GitHub Actions job Integration: Workflow Misc Part 2 by @pelikhan with @Copilot in #47266
• Show evals AIC in generated footer metrics by @pelikhan with @Copilot in #47260
• [WIP] Fix failing GitHub Actions job Integration: Workflow Actions & Containers by @pelikhan with @Copilot in #47279
• fix: remove unused assert import causing fuzz build failure by @pelikhan with @Copilot in #47286
• Fix OAuth activation YAML emission for multiline engine.env.COPILOT_GITHUB_TOKEN by @pelikhan with @Copilot in #47270
• feat(eslint-factory): add require-execfilesync-try-catch rule by @pelikhan with @Copilot in #47251
• Exclude intentional credit-guardrail tests from prod-main health rollups by @pelikhan with @Copilot in #47263
• Migrate deprecated needs.activation.outputs references to steps.sanitized.outputs by @pelikhan with @Copilot in #47264
• fix(create_issue): prevent report content ending up in issue title by @pelikhan with @Copilot in #47282
• Honor gh aw fix dry-run for dispatcher agent and skill refresh by @pelikhan with @Copilot in #47269
• fix(claude): disable Anthropic SDK inner retries to prevent terminal-error storm by @pelikhan with @Copilot in #47237
• feat(linters): add stringsjoinone analyzer by @pelikhan with @Copilot in #47288
• refactor(pkg/workflow): break up 5 large functions exceeding 60-line lint limit by @pelikhan with @Copilot in #47287
• Make AI credit budget increases a last resort by @pelikhan with @Copilot in #47328
• OTLP conclusion: mark non-zero Copilot CLI exits as run failures when conclusion/error signals are absent by @pelikhan with @Copilot in #47268
• Fix false MCP telemetry gaps in daily observability report by normalizing artifact path discovery by @pelikhan with @Copilot in #47299
• [evals] Enforce binary YES/NO outputs in evals parser by @pelikhan with @Copilot in #47245
• Fix literal \n in CLI-mode safeoutputs string args not becoming newlines by @pelikhan with @Copilot in #47330
• Document bounded optimization for repetitive work by @pelikhan with @Copilot in #47335
• Pin docker/build-push-action to commit SHA (CodeQL alert #625) by @pelikhan with @Copilot in #47334

Full Changelog: v0.82.15...v0.83.0