v0.88.3

🌟 Release Highlights

This release focuses on package manifest composability, safer scheduled upgrades, and hardened release-time security scanning.

✨ What's New

• Recursive package manifest imports — aw.yml manifests can now compose subpackages via an imports field instead of duplicating file declarations, with cycle detection and unified install resolution across local and remote packages (#58233). See the package manifest reference.
• Pre-release auto-upgrades from aw.json — scheduled auto-upgrade workflows can now opt into pre-release gh-aw versions by passing validated CLI options (e.g. --pre-releases) declared in aw.json, with malformed or unsupported options rejected at generation time (#58266).

🐛 Bug Fixes & Improvements

• Fixed zero-valued input defaults being dropped — numeric safe-output input defaults of 0 were incorrectly treated as missing due to truthiness checks; defaults are now preserved with a nullish fallback, restoring correct behavior for type: number inputs with default: 0 (#58291).
• Hardened Windows Defender release scans — release binaries are now verified against the generated checksum manifest before scanning, the recurring Defender workflow can target an explicit release tag, scan reports are preserved on both success and failure, and checksum-valid detections are routed to a deduplicated security tracking issue instead of assuming a source fix (#58115).
• Bumped Agentic Workflow Firewall to v0.28.13 (#58103).
• Fixed the Codex JSONL parser dropping error/warning log items in step summaries (#58195).
• Fixed unsafe quoting in an import cycle error message (#58189).

📚 Documentation

• Updated package specifications for parser, repoutil, semverutil, and sliceutil (#58209).

Generated by 🚀 Release · copilot · auto · 18.3 AIC · ⊞ 11.8K

---

What's Changed

• [spec-extractor] Update package specifications for parser, repoutil, semverutil, sliceutil by @github-actions[bot] in #58209
• Bump Agentic Workflow Firewall to v0.28.13 by @lpcox with @Copilot in #58103
• Add recursive package manifest imports by @pelikhan with @Copilot in #58233
• [code-simplifier] Simplify detection_comparison.py: extract helper functions for casting and legend handling by @github-actions[bot] in #58140
• Harden Windows Defender release scans by @dsyme in #58115
• [blog] Agent of the Day – 2026-09-03 by @github-actions[bot] in #58252
• Enable pre-release auto-upgrades from aw.json by @pelikhan with @Copilot in #58266
• [code-scanning-fix] Fix go/unsafe-quoting: unsafe quoting in import cycle error message by @github-actions[bot] in #58189
• [rendering-scripts] Fix Codex JSONL parser dropping error/warning log items in step summaries by @github-actions[bot] in #58195
• Preserve zero-valued input defaults by @pelikhan with @Copilot in #58291

Full Changelog: v0.88.2...v0.88.3