Repository navigation
v3.22.4
What's new
Bug Fixes
The local operation observer now checks worktree content independently of Git's clean filters and configuration, preventing changed files from appearing unchanged and stale evidence from being reused. Snapshots include HEAD paths dropped from the index and ignore-rule contents, compare raw file bytes and modes against HEAD, and refuse snapshots when repository anchors move or content changes during the read. Submodule checks distinguish uninitialized and displaced paths, while length-prefixed digest fields prevent ambiguous tree identities. These changes close false-clean paths that could otherwise allow an uncommitted edit to mint a commit receipt. (#1129)
PostCSS's compatible Nano ID dependency is resolved to 3.3.20 to address the denial-of-service advisory GHSA-2v37-7h3g-55p8, with manifests and other locked packages unchanged. (#1127)
Documentation
New solution records capture the digest-collapse, release-gate, brokered-push and action-pin fixes, along with the operation observer's false-clean fixes and the review-spiral scope cut, preserving those findings for future work. (#1122, #1130)
Tests
Release tests no longer tie the App token action to one specific commit, avoiding test failures on Renovate updates. The step test checks the action's identity, while the shared action-pin test continues to require a full 40-character commit SHA and a version comment. (#1121)
Also in this release
- deps: Update actions/create-github-app-token to v3.3.0 (#1102), fro-bot/agent to v0.122.2 (#1123), and github/codeql-action to v4.39.0 (#1132).