v0.83.3

🌟 Release Highlights

This release delivers significant security hardening, expanded linter coverage, improved tooling reliability, and key fixes across the compilation and evaluation pipeline.

✨ What's New

• Daily GitHub Docs SEO Optimizer — A new automated workflow (daily-github-docs-seo-optimizer) now continuously scans and improves documentation SEO, keeping content discoverable without manual intervention. (#47975)
• Docker Image Update Monitoring — The cli-version-checker workflow now monitors Docker image updates, ensuring container dependencies stay current. (#47980)
• GitHub MCP Server v1.7.0 — Updated the default GitHub MCP server to v1.7.0, bringing the latest MCP tool improvements to all workflows. (#47923)
• stringsconcatloop Linter — New Go linter detects inefficient string += concatenation inside loops, guiding developers toward strings.Builder for better performance. (#47894)
• Agentic Workflows Skill Enhancement — Unified design/create workflow task and added a dedicated optimize task, making the skill more actionable for common authoring scenarios. (#47890)

🔒 Security Fixes

• Git Argument Injection (VULN-001) — Fixed a git argument injection vulnerability via unvalidated ref/path values in remote import fallbacks. Prevents potential command injection through crafted ref names. (#47957)
• GraphQL Injection Fix — Resolved GraphQL injection in getOwnerNodeId (code scanning alerts #651 and #652). (#47952)
• Firewall Container Digest Refresh — Refreshed gh-aw-firewall v0.27.41 container digest pins following a Go stdlib CVE rebuild. (#47838)
• Post-update SHA Integrity Validation — Added SHA integrity checks for actions-lock entries after updates, preventing supply-chain tampering. (#47959)

🐛 Bug Fixes & Improvements

• WASM Panic Recovery — Compilation panics in the browser WASM build no longer leave promises unresolved, improving playground reliability. (#47854)
• Evals Model Alias Resolution — ModelMappings are now propagated into evals WorkflowData, unblocking model alias resolution in evaluation runs. (#47956)
• require-fetch-try-catch False Positives — Fixed false positives for await fetch inside directly-awaited async callbacks and member-chained calls. (#47969, #47963)
• Goroutine Leak Guards — Added goleak-based leak detection for pkg/cli and pkg/console tests, catching resource leaks early. (#47865, #47891)
• Safe-Output Failure Artifacts — Process Safe Outputs stdout/stderr are now pre-bundled in failure artifacts, making debugging failed safe-output steps significantly easier. (#47855)
• Agentic Failure Issue on Secret Validation — When engine secret validation fails, an agentic failure issue is now created automatically for better observability. (#47893)
• Codex Threat-Detection Config Fix — Fixed config.toml incorrectly emitting model_provider under [history]. (#47832)
• Duplicate Warning Icon Removed — Cleaned up duplicate warning icon in update output. (#47981)

📚 Documentation

• Workflow Recompilation as Critical Invariant — Documentation now explicitly elevates workflow recompilation to a critical invariant. (#47863)
• PR Reviewer Workflows Restricted to COMMENT-only — Updated docs to recommend COMMENT-only triggers by default for PR reviewer workflows. (#47860)
• Codespaces Instruction Loading Clarified — Improved guidance on raw-content instruction loading in Codespaces with enforced fail-fast on download errors. (#47825)

🔧 Internal

• Refactored mcp_setup_generator.go into 5 focused modules. (#47839)
• Consolidated import-editing and file-lookup helpers into internal/astutil. (#47912)
• Enforced appendoneelement, timenowsub, and stringsjoinone linters in CI. (#47970)
• Added CI guard to assert pkg/cli and pkg/console unit tests are executed. (#47905)

Generated by 🚀 Release · sonnet46 · 27.9 AIC · ⊞ 7.9K

---

What's Changed

• fix(smoke-copilot): fix add_comment failures for discussion targeting and workflow_dispatch PR context by @pelikhan with @Copilot in #47722
• Stabilize CompileWorkflow_WithMCP benchmark to remove warning-path overhead by @pelikhan with @Copilot in #47698
• fix: add actions: read to smoke-trigger and smoke-multi-caller caller permissions by @pelikhan with @Copilot in #47721
• [jsweep] Clean convert_gateway_config_claude.cjs by @github-actions[bot] in #47706
• [instructions] Sync instruction files with release 0.83.1 by @github-actions[bot] in #47759
• [spec-extractor] Update package specifications for parser, repoutil, semverutil, sliceutil by @github-actions[bot] in #47767
• [docs] Update glossary - daily scan by @github-actions[bot] in #47769
• spec: add githubapi README + spec_test, fix workflow method signatures by @pelikhan with @Copilot in #47800
• fix: join CheckForUpdatesAsync goroutine and eliminate time.After leak by @pelikhan with @Copilot in #47699
• Clarify raw-content instruction loading in Codespaces and enforce fail-fast on download errors by @pelikhan with @Copilot in #47825
• [eslint-miner] feat(eslint): add require-fetch-try-catch rule by @github-actions[bot] in #47763
• Refactor AI credits pricing to a single shared type and schema ref by @pelikhan with @Copilot in #47723
• Fix Codex threat-detection config.toml emitting model_provider under [history] by @davidslater with @Copilot in #47832
• docs: restrict PR reviewer workflows to COMMENT-only by default by @pelikhan with @Copilot in #47860
• docs(aw): elevate workflow recompilation to a critical invariant by @pelikhan with @Copilot in #47863
• Fix dangling secret_verification_result reference in conclusion condition by @lpcox in #47874
• [docs] docs: unbloat SpecOps pattern by @github-actions[bot] in #47882
• build(deps): bump postcss from 8.5.15 to 8.5.23 in /docs in the npm_and_yarn group across 1 directory by @dependabot[bot] in #47859
• Refactor pre-agent audit error extraction into focused helpers (largefunc backlog slice) by @pelikhan with @Copilot in #47856
• WASM: recover panics in compile goroutine to avoid unresolved browser promises by @pelikhan with @Copilot in #47854
• feat: fall back to older cooled-down release instead of skipping update by @pelikhan with @Copilot in #47730
• Refactor duplicate close-older search flow into a shared helper by @pelikhan with @Copilot in #47870
• eslint-factory: resolve write-once command aliases in no-child-process-interpolated-command by @pelikhan with @Copilot in #47866
• [cli-consistency] Normalize trial option ordering and logs cache-before help text by @pelikhan with @Copilot in #47834
• Add goleak-based package leak checks for pkg/cli and pkg/console tests by @pelikhan with @Copilot in #47865
• docs(AGENTS.md): prohibit agentic workflow checks in Copilot cloud agent runs by @pelikhan with @Copilot in #47892
• feat: unify design/create workflow task, add dedicated optimize task in agentic-workflows skill by @pelikhan with @Copilot in #47890
• Add CI guard to assert pkg/cli and pkg/console unit tests are executed by @pelikhan with @Copilot in #47905
• refactor: split mcp_setup_generator.go into 5 focused modules by @pelikhan with @Copilot in #47839
• fix: create agentic failure issue when engine secret validation fails by @pelikhan with @Copilot in #47893
• [log] Add debug logging to un-logged pkg files by @github-actions[bot] in #47909
• test-quality-sentinel: fix TestMain misclassification, add goleak detection and goroutine-leak guards by @pelikhan with @Copilot in #47891
• fix: refresh gh-aw-firewall v0.27.41 container digest pins (Go stdlib CVE rebuild) by @pelikhan with @Copilot in #47838
• feat(linters): add stringsconcatloop — detect string += concatenation inside loops by @pelikhan with @Copilot in #47894
• [code-simplifier] simplify: extract traverseObjectTree and hasLabelIntentMetadata helpers by @github-actions[bot] in #47908
• Pre-bundle Process Safe Outputs stdout/stderr in safe-output failure artifacts by @pelikhan with @Copilot in #47855
• fix(stringbytesroundtrip): reword []byte(string(b)) diagnostic — defensive copy, not redundant round-trip by @pelikhan with @Copilot in #47926
• [jsweep] Clean issue_title_dedup.cjs by @github-actions[bot] in #47915
• feat(eslint): extend no-err-stack-then-string-fallback to catch instanceof Error .stack form by @pelikhan with @Copilot in #47942
• Stabilize multi-device docs tester Playwright startup and separate infra preflight failures by @pelikhan with @Copilot in #47941
• fix(evals): propagate ModelMappings into evals WorkflowData to unblock AWF model alias resolution by @pelikhan with @Copilot in #47956
• [code-scanning-fix] Fix GraphQL injection in getOwnerNodeId (alerts #651 and #652) by @github-actions[bot] in #47952
• refactor(linters): consolidate duplicated import-editing and file-lookup helpers into internal/astutil by @pelikhan with @Copilot in #47912
• Tighten workflow recompile guardrails for .github/workflows/*.md edits by @pelikhan with @Copilot in #47962
• [instructions] Sync instruction files with release v0.83.1 by @github-actions[bot] in #47965
• Update GitHub MCP server default to v1.7.0 by @pelikhan with @Copilot in #47923
• fix: git argument injection via unvalidated ref/path in remote import fallbacks (VULN-001) by @pelikhan with @Copilot in #47957
• Add post-update SHA integrity validation for actions-lock entries by @pelikhan with @Copilot in #47959
• Enforce appendoneelement, timenowsub, and stringsjoinone linters in CI by @pelikhan with @Copilot in #47970
• chore: sweep deprecated needs.activation.outputs.* references from authoring examples by @pelikhan with @Copilot in #47968
• [spec-extractor] Update package specifications for parser, repoutil, semverutil, sliceutil by @github-actions[bot] in #47971
• Add daily GitHub Docs SEO optimizer by @pelikhan with @Copilot in #47975
• feat: refresh gh-aw-node digest and replace manual scanner installs with gh aw compile flags by @pelikhan with @Copilot in #47958
• Handle chained awaited fetch calls in require-fetch-try-catch by @pelikhan with @Copilot in #47963
• fix(require-fetch-try-catch): no-op false positive for await fetch inside directly-awaited async callback by @pelikhan with @Copilot in #47969
• fix(daily-github-docs-seo-optimizer): allow bash to unblock safeoutputs and sub-agents by @pelikhan with @Copilot in #47979
• feat: monitor Docker image updates in cli-version-checker workflow by @pelikhan with @Copilot in #47980
• fix: remove duplicate warning icon in update output by @pelikhan with @Copilot in #47981
• [eslint-miner] fix(eslint): extend require-fetch-try-catch to detect member-chained fetch calls by @github-actions[bot] in #47967

Full Changelog: v0.83.2...v0.83.3