v0.91.13

🌟 Release Highlights

This release focuses on security hardening, better quota/API diagnostics, and smoother workflow generation.

✨ What's New

• Dynamic repository checkouts: allowlisted dynamic repository checkout lists (#68593).
• Configurable add-comment link limits, with footer links excluded from the count (#68723).
• GitHub search quotas and MCP 429 retry hints now exposed for easier rate-limit troubleshooting (#68728, #68737).
• AWF model inventories included in unified agent sessions (#68600).
• New linter: deferred-error-unchecked detects unchecked deferred errors (#68780).

🐛 Bug Fixes & Improvements

• OTLP credentials are masked and Grafana Cloud tokens redacted (#68779).
• Aider parser guarded against model inventory spoofing (#68714).
• Fixed explicit parent targeting for scheduled Issue Arborist links (#68623).
• Copilot SDK content-filter failures are now preserved (#68624).
• Staged safe-output handlers infer read permissions (#68724).
• Generated Go setup prefers the root go.mod (#68718).
• Serena Go container gets the runner toolchain PATH (#68734).
• Pre-agent workspace audits exclude the tool cache (#68725).
• Safe-output guidance is resilient to missing sandbox tools (#68716).
• Dependabot alerts remediated and dependencies updated (#68774, #68784).

📚 Documentation

• MCP server CLI reference aligned with help output (#68715), plus glossary and feature doc updates.

Generated by 🚀 Release · copilot · auto · 14.4 AIC · ⊞ 11.7K

---

What's Changed

• Fix stale CI assertions and duplicate work-queue fixture property by @pelikhan in #68605
• Include AWF model inventories in unified agent sessions by @pelikhan in #68600
• Updating work queue protocol and related components by @pelikhan with @Copilot in #68582
• Bump gh-aw-firewall and gh-aw-mcpg dependencies by @lpcox with @Copilot in #68598
• Fix explicit parent targeting for scheduled Issue Arborist links by @pelikhan in #68623
• fix: refresh the pinned TLA+ v1.8.0 runtime checksum by @pelikhan in #68622
• [docs] Update documentation for features from 2026-10-14 by @github-actions[bot] in #68663
• [jsweep] Clean work_queue_settings.cjs by @github-actions[bot] in #68588
• fix: preserve Copilot SDK content-filter failures by @pelikhan in #68624
• Align CLI tester with MCP write and log-access policies by @pelikhan in #68625
• Fix Metrics Collector full-snapshot persistence budgets by @pelikhan in #68628
• [spec-enforcer] Enforce specifications for timeutil, tty, types by @github-actions[bot] in #68673
• [blog] Agent of the Day – 2026-10-14 by @github-actions[bot] in #68711
• [dead-code] chore: remove dead functions — 2 functions removed by @github-actions[bot] in #68710
• [docs] Update glossary - daily scan by @github-actions[bot] in #68654
• Align MCP server CLI reference with help output by @pelikhan with @Copilot in #68715
• fix: bound semantic refactor analysis and reserve final output budget by @pelikhan in #68721
• Exclude tool-cache from pre-agent workspace audits by @pelikhan with @Copilot in #68725
• Align workflow prompts with native MCP permissions by @pelikhan in #68735
• fix: expose runner toolchain PATH to Serena Go container by @pelikhan in #68734
• fix: reduce Super Linter fixture noise and preserve failure diagnostics by @pelikhan in #68733
• Guard Aider parser against model inventory spoofing by @pelikhan with @Copilot in #68714
• Improve ESLint factory queue lifecycle and ledger performance by @pelikhan in #68722
• Clarify GitHub API quota failures and reset diagnostics by @pelikhan in #68737
• Make add-comment link limits configurable and exclude footer links by @pelikhan with @Copilot in #68723
• Infer read permissions for staged safe-output handlers by @pelikhan with @Copilot in #68724
• fix(deps): remediate all 25 open Dependabot alerts by @pelikhan in #68774
• Fix actionable code scanning findings by @pelikhan in #68778
• build(deps): bump actions/download-artifact from 8.0.1 to 8.0.2 by @dependabot[bot] in #68773
• build(deps): bump actions/setup-node from 4.1.0 to 7.1.0 by @dependabot[bot] in #68772
• build(deps): bump actions/upload-code-coverage from 1.4.3 to 1.4.4 by @dependabot[bot] in #68771
• build(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 by @dependabot[bot] in #68769
• build(deps-dev): bump prettier from 3.9.9 to 3.9.10 in /actions/setup/js by @dependabot[bot] in #68761
• build(deps-dev): bump @types/node from 26.6.3 to 26.6.5 in /actions/setup/js by @dependabot[bot] in #68768
• Make safe-output guidance resilient to missing sandbox tools by @pelikhan with @Copilot in #68716
• build(deps): consolidate all pending Dependabot updates by @pelikhan in #68784
• Prefer root go.mod for generated Go setup by @pelikhan with @Copilot in #68718
• Mask decoded OTLP credentials and redact Grafana Cloud tokens by @pelikhan in #68779
• [linter-miner] linter: add deferred-error-unchecked to detect unchecked deferred errors by @github-actions[bot] in #68780
• Expose GitHub search quotas and MCP 429 retry hints by @pelikhan with @Copilot in #68728
• Resolve trusted PR bundle validation base from the base branch tip by @pelikhan with @Copilot in #68717
• Revert "Resolve trusted PR bundle validation base from the base branch tip" by @pelikhan in #68795
• [avenger] Fix Go runtime integration test repository isolation by @github-actions[bot] in #68802
• Add allowlisted dynamic repository checkout lists by @pelikhan in #68593

Full Changelog: v0.91.12...v0.91.13