v0.93.5

🌟 Release Highlights

This release focuses on hardening: stronger static analysis linters, safer credential handling, and more robust diagnostics.

✨ What's New

• Safe-output integration jobs can now use network credentials (#71833).
• Engine driver crashes are classified with secret-safe stderr diagnostics, making failures easier to triage (#71883).
• Pi CLI default updated to 1.4.0 (#71899).
• New and sharper custom linters: readerstringconv analyzer, parenthesized Flush discard detection, missing goroutine recovery through local closures, and closed detection gaps (#71891, #71896, #71897, #71880).
• Secret-leak analysis now tracks credential handoffs through step outputs (#71850).

🐛 Bug Fixes & Improvements

• Fixed generated conclusion references and fetch warnings; Redis image pinned (#71898).
• Guarded indexing boundaries and prevented cron-step overflow (#71889).
• Refreshed Node image pins and enforced patched runtime dependencies (#71879).
• gh-aw-detection is no longer treated as experimental (#71848).
• Internal consolidation of permission scope expansion, GitHub Contents base64 decoding, and public API GET fallback transport (#71888, #71894, #71893).

📚 Documentation

• Documentation refreshed for recent features (#71867).

Generated by 🚀 Release · copilot · auto · ~14 AIC · ⊞ 12.6K

---

What's Changed

• Allow network credentials in safe-output integration jobs by @pelikhan in #71833
• [docs] Update documentation for features from 2026-10-25 by @github-actions[bot] in #71867
• [jsweep] Clean write_daily_aic_usage_cache.cjs by @github-actions[bot] in #71805
• fix: stop treating gh-aw-detection as experimental by @pelikhan in #71848
• [docs] Update Astro dependencies - 2026-10-25 by @github-actions[bot] in #71796
• Detect parenthesized Flush discards in uncheckedflushreturn by @pelikhan with @Copilot in #71896
• Track credential handoffs through step outputs in secret-leak analysis by @pelikhan with @Copilot in #71850
• Update Pi CLI default to 1.4.0 by @pelikhan with @Copilot in #71899
• Detect missing recovery in goroutines launched through local closures by @pelikhan with @Copilot in #71897
• Refresh Node image pins and enforce patched runtime dependencies by @pelikhan with @Copilot in #71879
• Close custom-linter detection gaps and exempt safe os error checks by @pelikhan with @Copilot in #71880
• feat(linters): add readerstringconv analyzer by @pelikhan with @Copilot in #71891
• Centralize missing permission scope expansion by @pelikhan with @Copilot in #71888
• Unify GitHub Contents base64 decoding by @pelikhan with @Copilot in #71894
• Consolidate public GitHub API GET fallback transport by @pelikhan with @Copilot in #71893
• Fix generated conclusion references and fetch warnings; pin Redis by @pelikhan with @Copilot in #71898
• Guard indexing boundaries and prevent cron-step overflow by @pelikhan with @Copilot in #71889
• Deduplicate AW import normalization in source policy lint rules by @pelikhan with @Copilot in #71887
• [dead-code] chore: remove dead functions — 2 functions removed by @github-actions[bot] in #71916
• Classify engine driver crashes with secret-safe stderr diagnostics by @pelikhan with @Copilot in #71883

Full Changelog: v0.93.4...v0.93.5