Netclaw 0.28.0-beta.1

0.28.0-beta.1 (2026-10-23)

This is the first beta of 0.28.0. A sub-agent now runs in the background: spawn_agent returns a run ID at once, and the result arrives in a later turn. When a child asks for operator consent, the parent gets a notice and pauses until the prompt closes. The daemon logs each tool call again with redacted arguments, and session.log now redacts tool arguments too. An OAuth token refresh no longer writes netclaw.json, so it no longer restarts the daemon. Agent tools can no longer read or write credential folders such as ~/.ssh and ~/.aws.

Downgrade note: read these items before you go back to 0.27.1 or older.

• Delete each Providers.<name>.OAuthTokenExpiry from secrets.json. This release writes that value as plain text, and an older daemon cannot read it (#2529).
• 0.27.1 cannot read a restart manifest that this release writes, because this release writes reminder enum names (#2400).
• A 0.27.1 daemon deletes the retained records of completed one-shot reminders, as it did before (#2402).

Configuration

• The OAuth token expiry moves to secrets.json. Before, each OAuth access-token refresh wrote the new expiry to netclaw.json. The config watcher then restarted the daemon, which could stop work in progress. Now Netclaw writes Providers.<name>.OAuthTokenExpiry to secrets.json, next to the tokens. That one value is not encrypted, because the config binder cannot read an encrypted date. The refresh service also never sends a spent refresh token again (#2529).
  • Upgrade impact: an OAuthTokenExpiry key in netclaw.json is retired. It still applies until the first refresh, and the daemon logs a startup warning for it. Run netclaw doctor --fix to move the value to the provider entry in secrets.json. Doctor makes a backup before it removes the key. Doctor does not change a netclaw.json that has comments, so remove the key by hand in that case.
  • If the daemon stops at startup with an error that names Providers:<name>, run netclaw provider and sign in again.
  • netclaw secrets set now rejects an expiry that is not an ISO 8601 date.
• Invalid model or provider configuration stops startup with one clear message. Before, a bad Models section or a provider with no credential or endpoint crashed the daemon with a stack trace (exit 134). Now the daemon exits 1 with one message. A daemon that runs refuses to reload an invalid file and keeps its current configuration (#2404).
  • Upgrade impact: a supervisor that restarts the daemon on failure shows the same message again. Fix the file, and the daemon starts.
• netclaw doctor --fix deletes less. It never removes a key under Models or a credential. It backs up netclaw.json before it removes any other key (#2404). Doctor also accepts the valid Session keys MaxToolDescriptionChars, MaxToolSchemaWarnChars, MemoryDistillationTurnInterval, and Tuning.StreamingRetryPolicy. Before, --fix deleted them with no backup (#2399). Doctor now reads the Tools and Security sections without regard to letter case (#2531).
• The daemon deletes old logs. A new retention job deletes daemon-*.log and crash-*.log files older than Retention.Logs.Days (default 14). It runs shortly after start and then every 12 hours. It always keeps the newest three daemon logs and the newest three crash logs. The value 0 keeps all logs. Set the value on the new Data Retention page of netclaw config, or with netclaw config retention --logs-days <days> (#2401, #2412, #2417).
  • Upgrade impact: about 30 seconds after the first start, the daemon deletes daemon and crash logs older than 14 days. To keep them, set Retention.Logs.Days to 0 before you upgrade.
• netclaw doctor warns when a profile can write wider than it can read. The warning names the audience profile and its two modes. It has no auto-fix (#2559).

Sessions

• A message from a person reaches the active turn. A child consent notice waits at the front of the input queue for its own turn. A new message from the same person now passes that notice and joins the active turn, as in 0.27.1. An earlier development build held such messages until the turn ended (#2607).

• Each input runs under the authority of its own requester. Inputs from different people no longer share one model call. Only the same requester can join an active turn, and the turn keeps its authority. An automated input, such as a reminder or a child result, no longer closes an open approval prompt. It waits and runs as its own turn (#2505).

• A restart drain stops a tool loop and tells the user. Before, a config restart did not stop a session in a tool loop. The drain timed out after 20 seconds, the turn stopped, and nothing told the user. Now the session stops the turn at the next safe point (#2608):

  • a tool batch boundary, a prepared model request, an empty-reply retry, or the end of a compaction;
  • when the turn cannot resume, the session posts one notice in its channel. The notice says "stopping" for netclaw daemon stop and "restarting" for other reasons;
  • the shutdown alert names each session that timed out in timedOutSessionIds.
  • A tool that runs longer than the drain timeout still holds the drain.

• A restart or a rejected slash command starts the inputs behind it. Before, a restart that resumed a slash command, or a slash command that the session rejected, could leave other inputs with no turn. For example, a reminder fire that waited behind an approval never ran after a mistyped slash command. Now those inputs run (#2592).

• A SQLite lock wait no longer stops a session. The journal and snapshot write timeout is now the SQLite Default Timeout plus 10 seconds (40 seconds by default). Before, it was 10 seconds. A slow disk write now only delays the turn. When a save fails during a turn, the session posts an error that says some actions may already have run. Before, the session stopped with no message (#2569).

  • Upgrade impact: a SQLite connection string with Default Timeout of 0 or less now stops the daemon at startup, because SQLite would wait forever.

• A repeated tool call gets a correction, not a turn failure. After two equal rounds, Netclaw refuses the next identical call. Calls that do new work stay allowed. The model gets a nudge for refused repeats 1 to 4 and a stronger nudge for repeat 5. At repeat 6 the turn ends quietly with the text of the model. The person sees no Netclaw error (#2466, #2553).

  • Upgrade impact: Session.MaxToolIterationsPerTurn stays valid, but it no longer limits a turn. A turn that does new work in each round can now run past 60 rounds.

• A cut-off reply fails the turn. When a reply stops at the output limit with no tool call, the session does not post the cut-off text. The turn ends with an error that says the reply was truncated. A model call that streams only thinking now stops after three times the no-progress timeout (60 minutes by default) (#2502).

• Provider streams retry and fail over more often. A stream attempt now starts at its first real output, not at its first metadata update. Thus retry and failover to the fallback model work again on Responses-based providers, Codex included (#2298).

• A slash command in the input queue runs as a command. Before, a slash command that waited behind a turn or an approval reached the model as plain text. Now the session runs it on the live command path, with the same checks (#2613, fixes #2591).

• A damaged input no longer stops a restart resume. When a stored input has damaged authority, the session logs it, keeps it, and queues the valid inputs. Before, a damaged input could stop the resume halfway with an error (#2615, fixes #2576).

Sub-agents

• A child runs in the background. spawn_agent records the run and returns its run ID at once, so the parent stays available. When the child ends, the runtime writes result.md in the run folder. The parent then gets one notice in a later turn and reads the result with file_read. A notice runs under the authority of the person who started the child (#2464, #2467, #2515).

  • Upgrade impact: netclaw chat -p exits at the end of the first turn. A headless caller does not see a child result that arrives in a later turn. The follow-up turn still runs in the daemon.

• The parent gets a notice and pauses while a child waits for consent. When a child asks for operator consent, the parent gets one notice turn. The notice lists the open child requests and the answers since the last notice. While a child request is open, the session holds reminder fires and refuses spawn_agent. The parent can finish its turn, and prompts from other children still post (#2583).

  • Upgrade impact: an open child approval now holds reminder fires for that session until the prompt closes.

• Netclaw withdraws a child prompt that nothing can answer. Slack, Discord, Mattermost, the TUI, and headless redraw the prompt with no buttons and show the reason. A prompt closes when the parent cancels the child, the child ends or is lost, the prompt post fails, or the daemon restarts. An answered prompt shows "This approval request has an answer." While a child prompt is open, a text answer resolves nothing, and the channel asks for a button (#2584).

  • Upgrade impact: a Mattermost binding with no CallbackUrl (text only) now refuses child consent requests. Set the callback URL to approve child requests in Mattermost.

• owner_restarted names a child that a restart lost. Before, recovery recorded such a run as actor_stopped, and the log said success=True. Now the reason is owner_restarted. The notice says that the parent session restarted and that the runtime does not start the child again. When the run had a checkpoint, the notice also says that effects after the checkpoint are uncertain. A lost run is never a success (#2604).

• The spawn_agent call template includes _rationale. The template in the system prompt had no _rationale, so the model copied it, and the first spawn_agent call of a session often failed. Now the template ends with _rationale (#2606).

• Child status and cancel check only the requester. The owner of a child no longer loses access to it in a later turn. A reminder turn can check and cancel the child runs of its own session. Any other turn of the same session can manage a child that a reminder started (#2504, #2550).

• A second approval answer is not called "expired". An answer to a prompt that already has an answer grants nothing. The session posts "Approval response ignored: that approval prompt already has an answer." (#2504).

• An approval notice turn can cancel a child run of its session. Before, a notice turn that called check_agent_run with Cancel: true for its own child got "This child run is not available to the requester." Now a notice turn can read the status of a child run of its session and cancel it. The notice turn gets no other authority, and a tool that needs consent is still denied with no prompt (#2617).

• A cut-off child reply fails the run. A child reply that stops at the output limit with no tool call now fails with reason output_truncated. A child call that streams only thinking past the cap fails with thinking_only_timeout (#2502).

• Sub-agent profiles no longer set timeoutSeconds. Each child now detects a silent stream after the session FirstTokenTimeout (default 600 seconds). When the loader rejects a profile file, spawn_agent names the file and the reason (#2503).

  • Upgrade impact: a profile that sets timeoutSeconds still loads, and the daemon logs one warning for each reload. A profile that used 60 to 180 seconds now waits 600 seconds for a silent stream.

• Recovery logs a closed child approval once. Replay no longer writes Tool approval requested again for a child approval that a later record closed (#2552).

• Replay clears a noticed child run at a turn of another requester. A notice turn that fails or crashes leaves no end record in the journal. Before, replay kept the noticed run, and a later turn of another person recorded the reminder link of that run. This affected delivery records only, not authority (#2614, fixes #2574).

Reminders

• Interval reminders shorter than 61 minutes run again. Since 0.26.0, the scheduler skipped them on each fire. After downtime, a reminder gets at most one catch-up fire. An expired retry of a recurring reminder counts as one failure, and only five failures in a row disable the reminder (#2402).
• A one-shot reminder deletes itself after it ends. Netclaw keeps a small end record and the history for 12 days. Thus netclaw reminder status, netclaw reminder history, and get_reminder_history still work in that period. cancel_reminder and netclaw reminder cancel delete a one-shot. A recurring reminder is still disabled and kept. Startup cleans up leftover one-shots, so the upgrade needs no operator step (#2533).
• A run with a denied tool is recorded as denied. An unattended run in which authorization denied a tool call is no longer recorded as ok. Netclaw does not retry it and does not count it toward auto-disable. Netclaw sends at most one reminder.tool_denied alert for each distinct denial (#2402).
• A current_session reminder ends when the session admits the fire. The reminder system no longer waits for the post. While an earlier fire of the same reminder waits in the queue, the session drops the newer fire (#2511).
  • Upgrade impact: the reminder system no longer retries a failed post of a current_session reminder. When the reply post fails for good, the session writes an Error log and sends a reminder.delivery.failed alert (#2537).
• A reminder session resumes after a restart. A reminder can enter its own session again after a daemon restart, and the session resumes the interrupted input (#2491).
• A one-shot occurrence has a delivery window of 7 days. Before, an occurrence that nothing acknowledged replayed with no end. A daemon that is offline still delivers a reminder up to a week late (#2438).
• set_reminder accepts more model output. DeliveryKind is now a required parameter. The tool ignores blank optional fields, so a current_session call with empty channel fields succeeds (#2458).
• Reminder import and time zones. netclaw reminder import reads what export writes. Netclaw validates time zones as IANA IDs. /run-reminder and skill bodies reach the model (#2400).

Security

• Agent tools cannot reach credential locations. File tools and shell commands are now denied on ~/.ssh, ~/.aws, ~/.gnupg, ~/.kube, ~/.azure, ~/.config/gh, ~/.config/gcloud, ~/.docker/config.json, ~/.netrc, and ~/.git-credentials. On Windows, the deny also covers the gcloud, GitHub CLI, and gnupg folders under %APPDATA%, and %PROGRAMDATA%\ssh. No approval, ToolOverrides entry, or audience profile can override this deny (#2405).
  • Upgrade impact: commands such as cat ~/.ssh/id_ed25519, ls ~/.aws, ssh -i ..., and docker run -v $HOME/.aws:... are now denied. Commands that name no credential path still work, for example ssh host, git push, aws s3 ls, and kubectl get pods. To change these files, edit them in your own shell.
• The daemon checks Host and Origin on loopback requests. In Local exposure mode, the Host must be localhost or a loopback IP address, such as 127.0.0.1 or [::1]. An Origin header, when present, must be http:// plus the same Host (#2530).
  • Upgrade impact: a client that calls the daemon through another host name now gets 401. A browser app on another local port, for example http://localhost:3000, also gets 401. Call the daemon as http://127.0.0.1:<port> or http://localhost:<port>. For a web app, make the call from its server process, or pair the app with netclaw daemon pair and send the device token.
• Personal file reads reach as far as Personal writes. For the Personal audience, file_read, file_list, file_search, and attach_file now reach at least as far as the write profile. Thus the agent can read the files that its shell writes, for example in /tmp. Protected paths stay denied. Team and Public do not change (#2559).
  • Upgrade impact: a host with Personal ReadFiles.Mode = Roots and a wider WriteFiles gets wider Personal reads. Unattended Personal runs, such as reminders and webhooks, get the same reach with no prompt. Run netclaw doctor to see the profiles.
• The private temp folder is short. On Linux and macOS, the temp folder of a run is now /tmp/netclaw-<uid>/<key>/p (or c<id> for a child). Netclaw creates it with mode 0700 and refuses a shell launch when the owner, mode, or a link is wrong. A short path keeps Unix socket paths, such as the Chrome socket, under their length limit. Windows does not change (#2559).
• A repository grant composes with the session scratch folder. A command that a repository grant covers no longer prompts again when it redirects output to the session scratch folder. Netclaw checks the command and the file write separately. A Once answer covers the command and each file operation (#2563).
• Shell approval judges more commands correctly.
  • A loop or brace list with a finite set of values is judged as each literal command it runs (#2372, #2373).
  • A Bash assignment that no program reads no longer forces an exact prompt for each later command (#2374).
  • A command that runs no program, such as > result.log or echo hi > file, gets the file-tool decision for its redirect, not a shell prompt (#2377).
  • A heredoc with a quoted delimiter, such as python3 - <<'EOF', is data on stdin. A grant can now cover the command (#2381).
  • An option value outside the folder, such as --output=../x, and a link to a target outside the folder now need a grant that covers that location (#2378, #2380).
  • The agent gets a correction only when it can follow it. A word with a run-time value gets a one-time prompt instead (#2379).
  • The prompt and the "Saved" line show the same grant words that Netclaw saves (#2382).
• The output redactor finds more secrets and runs in linear time. It now masks known token formats, prefixed secret variable names, URL credentials, option values such as --password hunter2, API-key, Basic, Cookie, and Proxy-Authorization headers, and HAR or Postman name and value pairs. A long or repetitive tool output no longer slows the redactor (#2401, #2463, #2605).
• Tool access follows the effective posture audience. Tool access for a turn and its sub-agents now follows the effective audience of the deployment posture (#2619).
  • Upgrade impact: a posture can be narrower than the source audience, for example a Team posture with Slack direct messages. In that case, a reminder that someone created before the upgrade has the Personal audience. After the upgrade, run_reminder refuses that reminder, and a chat with the narrower audience does not show it. Create the reminder again from a chat after the upgrade.
• Approval override keys with no value are ignored. Netclaw now ignores a ToolOverrides or McpServerDefaults key that has a colon, such as file_write:control-plane, and keeps the audience default. The daemon logs a startup warning for each ignored key. Override keys now match tool names without regard to letter case. When two keys differ only in case, the more restrictive mode applies (#2622).
  • Upgrade impact: netclaw doctor reports a key with a colon as an error and names the valid forms: tool_name, server/tool, and server__tool. netclaw doctor --fix does not change these keys, so remove them by hand. A tool that such a key changed returns to the audience default, so it can ask for approval again.
• TUI commands no longer write a trace file. Before, the TUI commands wrote netclaw-<mode>-trace.log to the system temp folder. Now no command writes this file (#2620).
  • Upgrade impact: files from older releases stay on disk. Delete each netclaw-*-trace.log file from the system temp folder.
• Provider OAuth token reads require a local-control proof. The provider OAuth status endpoint no longer returns tokens. The CLI reads the tokens from a new local-control endpoint, and only with a local-control proof. The provider manager also shows the browser OAuth progress, the authorization URL, and errors (#2621).
  • Upgrade impact: use the same version for the CLI and the daemon. A new CLI with an older daemon shows an upgrade message during a provider OAuth sign-in.

Channels

• A channel keeps its output route until its session stops. Before, a channel binding could stop before its session, and the session lost its output route. Now a binding stays until the session passivates, then sends its last output and stops. Mattermost stops its typing indicator before that drain (#2429).
• Closed child prompts redraw in each channel. See Sub-agents (#2584).

Tools

• A large tool result keeps its tail. When a tool result is longer than the inline limit (Session.Tuning.MaxInlineToolResultChars, default 12,000 characters), the model now gets the last part, not the first and last parts. Command output, logs, and stack traces put the useful text at the end. tool_output_read still reads the rest (#2425).

• A large tool result is always kept. Before, a session with no workspace folder lost the full text, and the model could not read the middle. Now Netclaw creates the folder, and refuses a link at the folder or its parent (#2414, #2430).

• search_tools ranks its results. Results with the most query words come first, so a built-in tool such as list_reminders is found. The agent guidance now prefers a built-in tool to a netclaw CLI command that needs a shell approval (#2385).

• update_memory keeps a memory in semantic recall. An edit now writes a new embedding. netclaw memory backfill-embeddings does nothing when Memory.Embeddings.Enabled is false (#2395). The netclaw-memory skill states the correct default and log event names (#2419).

• Memory curation uses the Main model. Before, curation used the Compaction model (#2431).

  • Upgrade impact: a deployment with a separate Compaction model now sends curation requests to the Main model. A deployment with no Compaction model does not change.

• The content scanner accepts .potx PowerPoint templates (#2196).

• After a person denies a call, the agent stops and asks. Before, a denial forbade only a retry, so the agent could reach the same goal with another tool. Now the denial text and the agent guidance tell the agent not to reach that goal another way. The agent says what it wanted to do and asks how to continue. Timeout, policy, and unattended denials keep their text (#2616).

Providers

• Codex refreshes its token after an HTTP 401. When ChatGPT rotates an access token early, Netclaw refreshes the token and sends the request one more time (#2432).
• A rejected OpenAI refresh sends the re-auth alert. Netclaw now reads the error object that auth.openai.com sends, so a dead login raises the ProviderAuthExpired alert. A transient failure gets one retry (#2568).
• OpenAI-compatible endpoints work with or without /v1 (#2400).

Telemetry

• The tool call log line is back, with redaction. 0.27.0 removed the Info line for each tool call, and the 0.27.0 notes did not say so. The line returns in the parent session and in sub-agents, with the 0.26.0 template and field names (#2600):

  Invoking tool [{ToolName}] (call={CallId}) args={Args} rationale={Rationale} authorizationAttemptId={AuthorizationAttemptId} sessionId={SessionId}
  

  • The redactor masks secrets in the arguments at each depth, and in key names (#2605).
  • A string longer than 256 characters becomes a length and a hash. A string that contained a secret becomes <N chars, redacted>.
  • The line is capped at 4,096 characters, and the rationale at 500 characters. The line never makes a tool call fail.
  • Upgrade impact: the exported logs now hold one more Info line for each tool call.

• session.log redacts tool arguments. Before, session.log wrote tool call arguments in clear text, cut at 1,000 characters. Now it uses the same redaction, hash, and cap as the log line above. Text that is not a JSON object becomes <arguments unavailable> (#2609).

  • Upgrade impact: session.log no longer holds full long argument values. A long file body appears as its length and hash.

• OTLP over HTTP/protobuf posts to the signal paths (#2400).

• Skill load log lines include the session ID: turn_skill_loaded skill=X method=Y session=Z (#2512).

CLI/TUI

• netclaw chat -p exits 1 when the turn fails. A provider error, a timeout, or another failed turn now gives exit code 1. A failed turn also writes one [turn:failed] category=<model|infra> kind=<Kind> line on stderr. With --json, the envelope adds errorCategory and errorKind (#2409, #2517).
  • Upgrade impact: a script that ran netclaw chat -p and ignored the exit code can now stop on a failed turn. A tool call that headless mode denies still ends with exit code 0 when the model finishes.
• netclaw daemon status exits 1 when the daemon does not run or is not ready. Before, it exited 0 (#2400).
  • Upgrade impact: update scripts that read this exit code.
• Chat input is confirmed after the daemon saves it. Before, Enter and then Ctrl+Q could exit before the daemon kept the text. Now the daemon confirms the text after it records it, and that work continues after the client disconnects. On quit, the CLI reports input that it could not send or confirm (#2426).
  • Upgrade impact: update the CLI and the daemon together. The chat client needs the text-admission protocol of this release.
• Chat messages can be up to 512 KB. Before, a message over 32 KB closed the connection and showed "Message unconfirmed". Now the limit is 512 KB, and the CLI refuses a larger message with its size (#2487).
• The chat view shows each parallel tool call. Each call has its own line, and a tool line stays on one row. A preview no longer breaks a character or an escape code (#2461, #2411). A very long paste no longer stops input, and Ctrl+Q exits fast with a large transcript (#2465, #2520).
• A bad netclaw.json gives one error line. When netclaw.json or secrets.json cannot be read, a CLI command prints Couldn't read <file>: <reason> and exits 1. Before, it crashed with exit 134 and a crash log (#2459).
• MCP commands keep and clean up server state. netclaw mcp add on a known name keeps the audience grants, defaults, and enabled state. netclaw mcp remove also removes the OAuth tokens, grants, and saved approvals of that server (#2394). The permissions screen asks before it grants all tools, and --grant adds the server to the audience (#2403). netclaw mcp auth prints the OAuth redirect URI to register with the provider (#2610).
• Names and endpoints are checked. MCP and provider names now resolve without regard to letter case, so a second key that differs only in case is not written. provider add rejects an endpoint with no scheme. model list shows what the daemon uses (#2462). provider remove, the netclaw config dashboard, and the init wizard read model roles in the current Models.Definitions and Models.Roles shape (#2390).
• netclaw approvals trust-verb refuses a grant that can never match. For a non-shell tool, the command prints the form that works and writes nothing (#2392).
• Messages name real commands. CLI, TUI, doctor, and alert text no longer name commands that do not exist, and no longer tell you to restart the daemon after a config change (#2391).
• Identity setup. netclaw chat --onboarding starts the identity interview (#2401). After Redo identity setup, Enter starts the guided identity chat (#2384). A new beta install with only a channel seed opens the first-run wizard (#2192).
• TUI fixes. The Exposure Mode page keeps unrelated config when it saves (#2531). A pre-filled input puts the cursor at the end, and Provider Manager and Model Manager fit their columns to the terminal (#2400, #2410). On Windows, tables and stats use the locale of the user (#2400).

Daemon and install

• netclaw daemon stop stops only the daemon of its own home. The CLI sends no signal until it proves that the PID serves this home. The daemon answers 409 to a stop notice for another home (#2544).
  • Upgrade impact: on macOS and Windows, the CLI cannot prove the home of a daemon that does not answer, or of a 0.27.1 daemon during netclaw update. netclaw daemon stop then refuses and prints the kill <pid> command to use. Linux reads the proof from /proc.
• Install scripts use NETCLAW_HOME. install.sh and install.ps1 put the config in <NETCLAW_HOME>/config. netclaw daemon install and netclaw doctor --fix now keep the operator lines in daemon.env and change only PATH (#2528).
• systemd and Docker. daemon stop and daemon start go through the systemd unit that owns the daemon. The Docker health check follows Daemon.Port. daemon pair prints a command that you can use (#2400).
• An update check timeout no longer stops the daemon. Before, a network timeout in the update check stopped the daemon 10 seconds after start. netclaw update --check no longer crashes on a timeout (#2538).
• Session folders follow a moved home. When the data directory moves, Netclaw finds session folders under the new path and logs one warning (#2401).

Fixes

• The headless channel closes its session log before it stops (#2611).

Internal

• The session actor moves its tool, model context, task lifetime, restart, and input rules into separate owners, with no behavior change (#2439, #2441, #2442, #2443, #2445, #2446, #2449, #2451, #2454, #2455, #2598).
• Specs, evals, mutation gates, CI, and test reliability work (#2371, #2376, #2398, #2408, #2415, #2427, #2433, #2434, #2435, #2436, #2437, #2447, #2448, #2450, #2456, #2457, #2460, #2501, #2506, #2508, #2509, #2513, #2514, #2521, #2522, #2532, #2534, #2536, #2543, #2545, #2549, #2555, #2556, #2562, #2564, #2565, #2580, #2582, #2585, #2586, #2588, #2594, #2612, #2623, #2624, #2626, #2627, #2628).

Dependency Updates

• Bump ASP.NET Core packages — 10.0.12 → 10.0.13, for the System.Security.Cryptography.Pkcs and System.Security.Cryptography.Xml advisories (#2490)
• Bump OpenTelemetry — 1.19.1 → 1.20.0 (#2518)
• Bump Termina — 0.16.2 → 0.17.0 (#2410, #2465, #2520)
• Bump Aaron.Akka.Reminders — 0.7.0 → 1.5.73.3, and Akka.Hosting 1.5.71 → 1.5.73 (#2402, #2438)
• Bump ShellSyntaxTree — 0.4.0-beta.22 → 0.4.0-beta.24 (#2372)