v0.27.0

What's Changed

🔧 Other Changes

• fix(dashboard): enforce POST body size limits by @fallintoplace in #2029
• fix(install): exclude self-entry from dry-run orphan preview by @mia106dev in #2069
• fix(deps): preserve inherited git config when injecting auth headers by @edenfunf in #2382
• Defer disk deletion in apm lock to avoid removing dropped deployed files by @atulya-singh in #2312
• [BUG] fix(audit): self-hydrate cold-cache ci audit from lock pins by @hugoguitton-lucca in #2329
• fix(dashboard): harden static path traversal checks by @fallintoplace in #2027
• fix(auth): try public GitHub anonymously before resolving credentials by @danielmeppiel in #2406
• fix(integration): make MCP targets deterministic (supersedes #2302, closes #2298) by @danielmeppiel in #2307
• fix(self-update): pin installer ref to latest version by @fallintoplace in #2026
• fix: skip package.json sidecar for Copilot/VSCode hook deployment (#2322) by @sergio-sisternes-epam in #2363
• fix(audit): report deployed files that no lockfile entry claims by @salpers in #2380
• fix(mcp): create the lockfile for MCP-only projects by @edenfunf in #2390
• fix(install): preserve MCP target mappings (supersedes #2301, closes #2297) by @danielmeppiel in #2306
• fix(audit): scan the deploy trees for hidden Unicode, not just recorded files by @salpers in #2381
• Fix dep devDependencies.mcp leaking into consumer MCP config (#2340) by @sergio-sisternes-epam in #2361
• fix(deps): exclude stale bare-repo cache from resolver stack during apm update by @sergio-sisternes-epam in #2364
• fix(mcp): render a docker launcher for v0.1 oci container packages by @edenfunf in #2385
• fix(vscode): build container run args from v0.1 registry arguments by @edenfunf in #2387
• fix(hooks): enforce restriction-only package targets by @sergio-sisternes-epam in #2362
• fix(uninstall): accept portable local dependency keys by @danielmeppiel in #2412
• fix(hooks): normalize Copilot lifecycle event aliases by @danielmeppiel in #2405
• fix(auth): on-prem ADO Server hosts misclassified as GHES when GITHUB_HOST is set by @sergio-sisternes-epam in #2365
• fix: write IntelliJ MCP config to plugin-read path by @danielmeppiel in #2410
• fix(install): honor saved targets across MCP and LSP by @danielmeppiel in #2414
• fix(marketplace): honour producer tag_pattern in consumer semver range resolution by @sergio-sisternes-epam in #2366
• fix(deps): preserve mixed-case materialization paths by @danielmeppiel in #2409
• fix(mcp): preserve non-container registry arguments by @danielmeppiel in #2407
• chore: release v0.27.0 by @danielmeppiel in #2416
• fix(release): repair v0.27 integration contracts by @danielmeppiel in #2417
• fix(release): preserve Git isolation across auth fallback by @danielmeppiel in #2422
• fix(release): bound macOS Intel integration coverage by @danielmeppiel in #2423
• fix(release): decouple live ADO acceptance by @danielmeppiel in #2426

New Contributors

• @salpers made their first contribution in #2380

Full Changelog: v0.26.0...v0.27.0