v2.3.23

Changes in v2.3.23

⚠️ Output change

• get_merge_request_conflicts now returns { has_conflicts, conflict_status?, conflict_files? }. has_conflicts is always present. conflict_status and conflict_files are included only on GitLab 19.4+, and older instances return has_conflicts only. The previous REST endpoint did not exist, so every earlier call failed with 404 (#1005).

🐛 Bug Fixes

• fix(issues): clarify milestone title vs id in filter descriptions #1001
• fix(attachments): skip name forms that hold a new percent escape #1002
• fix: use GraphQL for get_merge_request_conflicts #1005
• fix(attachments): find uploads whose names use another Unicode form #987

♻️ Refactor

• refactor: move milestones handlers out of index.ts (#516) #986
• refactor: move labels handlers out of index.ts (#516) #989

📝 Documentation

• docs: add GitHub Sponsors funding for GitLab E2E testing #988

🔬 CI/Test

• ci: add OpenSSF Scorecard workflow and README badge #1000
• ci: fix OpenSSF Scorecard findings (dangerous workflow, token permissions, vulnerable deps, signed releases) #1008
• ci: pin remaining dependencies and wire the Scorecard token #1011
• ci(mcpb): attach SLSA provenance (.intoto.jsonl) to releases #1013

🔨 Chore

• chore(deps): bump sigstore/cosign-installer from 4.1.2 to 4.1.3 #1014
• chore(deps): bump express-rate-limit from 8.7.1 to 8.7.3 in the patch-updates group #992

Contributors

• @zereight (8 PRs: #1000, #1001, #1008, #1011, #1013, #986, #988, #989)
• @dependabot[bot] (2 PRs: #1014, #992)
• @guillaume-alvarez (2 PRs: #1002, #987)
• @mandreev-dev (1 PR: #1005)

⚠️ Deprecation notice

Deprecated configuration options (e.g. GITLAB_READ_ONLY_MODE, USE_GITLAB_WIKI, and other legacy flags) still work during the grace period, but they will be removed in v3.0.0. Please migrate to the replacements described in the pinned issue #815.