v0.84.2

🔧 Maintenance Release

This release focuses on stability, security hardening, and internal tooling improvements — no user-facing breaking changes.

🐛 Bug Fixes & Improvements

• Fixed argument injection vulnerability (CWE-88) in the git archive fallback path (#49500)
• Fixed Copilot BYOK target resolution for self-hosted provider URLs (#49464)
• Hardened the PR Description Updater against one-shot safe-output exhaustion (#49463)
• Fixed missing create_discussion safe-output in the daily firewall report workflow (#49460)
• Fixed model config propagation into the external threat detection path (#49454)
• Corrected pricing for gpt-5.6-luna, gpt-5.6-terra, and grok-4.5 in the model inventory (#49449)
• Fixed sandbox.agent.memory frontmatter extraction so --memory-limit correctly reaches AWF (#49448)
• Honored GH_AW_DETECTION_CONTINUE_ON_ERROR in detection setup to prevent false job failures (#49415)
• Fixed AI credits throughput rate-limit errors being silently swallowed (#49360)
• Fixed CLI consistency checker to fail fast on empty datasets during pre-agent help bootstrap (#49414)

⚡ Improvements

• Default stacked PR runs now target top-of-stack with a configurable on.pull_request.max-stack option, extended to pull_request_review gating (#49420, #49453)
• Added support for explicit auto-merge strategies in safe-outputs.create-pull-request (#49412)
• Added per-call ref override support to dispatch_workflow for runtime branch targeting (#49408)
• Improved PR failure issue titles for engine HTTP 429 rate limit cases (#49411)
• Prevented Super Linter false-negative failures from a broken summary formatting path (#49409)
• Enabled LFS checkout and expanded shell command allowlist coverage to unblock the Slide Deck Maintainer workflow (#49410)

🔧 Internal

• Added Dependabot Docker update coverage for container image supply chain (#49528)
• CLI version updates: Copilot 1.0.77, Pi 0.83.0, Playwright Browser v1.62.1, Syft v1.50.0, Grype v0.116.1 (#49521)
• Promoted five custom analyzers to enforced linter gates (#49471)
• Stabilized go-logger workflow toolchain resolution (#49473)
• Refined developer skill with cross-trigger nullability guards for generated if: expressions (#49472)
• Removed 4 dead functions via automated dead-code cleanup (#49357)
• Various ESLint factory improvements for JSDoc alias detection and redundant error-handling patterns (#49502, #49496, #49501)

Generated by 🚀 Release · auto · 15.8 AIC · ⊞ 11.1K

---

What's Changed

• Docs: prerender llms.txt so GitHub Pages publishes /llms.txt by @pelikhan with @Copilot in #49353
• Fix AI credits throughput rate-limit errors being silently swallowed by @pelikhan with @Copilot in #49360
• spdd 2026-07-31: cancelled fixture, safeguard TTL, copilot test refs, CTR audit by @pelikhan with @Copilot in #49379
• Prevent Super Linter false-negative failures by disabling broken summary formatting path by @pelikhan with @Copilot in #49409
• [aw] Unblock Slide Deck Maintainer by enabling LFS checkout and shell command allowlist coverage by @pelikhan with @Copilot in #49410
• Fix CLI consistency checker pre-agent help bootstrap to fail fast on empty datasets by @pelikhan with @Copilot in #49414
• Handle persona-explorer invocation failures as first-class partial results by @pelikhan with @Copilot in #49413
• [dead-code] chore: remove dead functions — 4 functions removed by @github-actions[bot] in #49357
• [docs] docs: unbloat GHE data residency debugging guide by @github-actions[bot] in #49442
• Honor GH_AW_DETECTION_CONTINUE_ON_ERROR in detection setup to prevent false job failures by @pelikhan with @Copilot in #49415
• Default stacked PR runs to top-of-stack with configurable on.pull_request.max-stack by @pelikhan with @Copilot in #49420
• Improve PR failure issue title specificity for engine HTTP 429 rate limits by @pelikhan with @Copilot in #49411
• [model-inventory] Fix pricing for gpt-5.6-luna, gpt-5.6-terra, and grok-4.5 by @pelikhan with @Copilot in #49449
• Extend stacked PR max-stack gating to pull_request_review by @pelikhan with @Copilot in #49453
• fix: extract sandbox.agent.memory from frontmatter so --memory-limit reaches AWF by @pelikhan with @Copilot in #49448
• [community] Update community contributions in README by @github-actions[bot] in #49455
• dispatch_workflow: support per-call ref override for runtime branch targeting by @pelikhan with @Copilot in #49408
• fix(daily-firewall-report): add missing create_discussion safe-output by @pelikhan with @Copilot in #49460
• fix: set GOTOOLCHAIN=auto in Avenger and hourly-ci-cleaner workflows by @pelikhan with @Copilot in #49461
• Harden PR Description Updater against one-shot safe-output exhaustion by @pelikhan with @Copilot in #49463
• Promote five custom analyzers to enforced linter gates by @pelikhan with @Copilot in #49471
• Fix Copilot BYOK target resolution for self-hosted provider URLs by @pelikhan with @Copilot in #49464
• Support explicit auto-merge strategies in safe-outputs.create-pull-request by @pelikhan with @Copilot in #49412
• [code-simplifier] refactor: dedupe mention-alias normalization and JSONL iteration helpers in safe-output scripts by @github-actions[bot] in #49462
• [evoskill] Refine developer skill with cross-trigger nullability guards for generated if: expressions by @pelikhan with @Copilot in #49472
• Stabilize go-logger workflow toolchain resolution by @pelikhan with @Copilot in #49473
• fix: propagate model config into external threat detection path by @pelikhan with @Copilot in #49454
• [test-parallel] Add t.Parallel() to TestCompileCommandShortFlags by @github-actions[bot] in #49499
• chore: CLI version updates — Copilot 1.0.77, Pi 0.83.0, Playwright Browser v1.62.1, Syft v1.50.0, Grype v0.116.1 by @pelikhan with @Copilot in #49521
• eslint-factory: flag core.error + core.setFailed(prefix + msg) as redundant by @pelikhan with @Copilot in #49496
• Add Dependabot Docker update coverage for container image supply chain by @pelikhan with @Copilot in #49528
• fix: argument injection in git archive fallback (CWE-88) by @pelikhan with @Copilot in #49500

Full Changelog: v0.84.1...v0.84.2