chore(deps): Update dependency microsoft/apm to v0.35.0 by eclipse-score-bot · Pull Request #174 · eclipse-score/devcontainer

eclipse-score-bot · 2026-10-22T14:06:54Z

This PR contains the following updates:

Package	Update	Change
microsoft/apm	minor	`0.30.0` → `0.35.0`

Release Notes

microsoft/apm

`v0.35.0`

Compare Source

What's Changed

🔧 Other Changes

fix(hooks): render nested hook metadata as plain JSON by @abhishekacharya200 in #3211
test(hooks): align cursor smoke expectations with native flat handlers by @MohammedAlkindi in #3198
fix: install versioned marketplace package directories by @Pybsama in #3156
fix: keep Codex MCP identity outside native settings by @Pybsama in #3157
fix(cli): report only verified APM build revisions by @danielmeppiel in #3280
fix(hooks): admit and stage hook-only Git-path packages by @danielmeppiel in #3282
fix(hooks): type untyped flat command handlers for Claude by @Parth-Vasave in #3153
Fix native Agent Plugin audit replay for Copilot targets by @bodapatisaikrishna in #3257
test(audit): preserve OpenCode local-bundle lifecycle coverage by @danielmeppiel in #3292
fix(auth): recover private files after API throttling by @danielmeppiel in #3278
fix(audit): preserve Grok Cloud target identity and historical checks by @danielmeppiel in #3289
fix(codex): preserve complete compatibility bundles through native user installs by @danielmeppiel in #3294
fix(lockfile): diagnose merge conflicts without automatic recovery by @lachieh in #3028
fix(policy): resolve marketplace object-form deps in ref-consistency check (#3220) by @Fire162 in #3221
fix(install): verify local content in frozen mode by @dajiaohuang in #3236
fix(pack): preserve and relocate plugin hook resources by @danielmeppiel in #3301
fix(install): include required indirect dependencies in dry-run previews by @danielmeppiel in #3302
fix(install): restore cold frozen plugins with verified MCP declarations by @danielmeppiel in #3305
fix(install): preserve frozen lock bytes and recorded native-service ownership by @danielmeppiel in #3307
fix(audit): preserve project scope across native Windows path spellings by @danielmeppiel in #3316
fix(schema): propose corrected manifest 0.1.48 contract by @danielmeppiel in #3308
fix(triage): prefetch and bound scheduled sweep candidates by @danielmeppiel in #3277
fix(install): capture acquired manifest versions on first install by @danielmeppiel in #3311
fix(deps): support local single-file dependencies by @danielmeppiel in #3310
fix(skills): preserve shared assets and deployment ownership by @danielmeppiel in #3313
fix(opencode): render native MCP environment references by @leninworld in #3303
fix(mcp): preserve conflicting native connections and verify managed updates by @danielmeppiel in #3317
Fix [BUG] Missing kiro prompts primitive entry by @DBVamsi in #3263
fix(audit): respect intentional dependency MCP omissions by @danielmeppiel in #3304
fix(install): preflight selected skill plans before native deployment by @danielmeppiel in #3314
docs: make README manifest example installable by @venkatayedidavs in #3086
add(deps): support consumer-root source replacements by @danielmeppiel in #3309
fix: preserve Windows staging failures and recovery data by @danielmeppiel in #3318
fix(install): retire obsolete absent dependency claims after complete reintegration by @danielmeppiel in #3315
fix(install): persist replacement intent after the last dependency is removed by @danielmeppiel in #3328
fix(audit): fail closed when an explicit --policy cannot be loaded by @danielmeppiel in #3230
fix(ci): restore deterministic fixtures and marketplace replay by @danielmeppiel in #3325
fix(mcp): preserve verified ownership across lifecycle transitions by @danielmeppiel in #3329
fix(ci): use canonical skill results in orchestration fixtures by @danielmeppiel in #3336
fix(ci): align generated skill repair with explicit overwrite consent by @danielmeppiel in #3337
fix(tests): restore canonical fixture contracts for CI by @danielmeppiel in #3338
fix(ci): shard lifecycle smoke without weakening its gate by @danielmeppiel in #3345
fix(install): preserve unchanged manifest requests by @danielmeppiel in #3346
fix(ci): isolate ratchet and scaling execution budgets by @danielmeppiel in #3347
fix(tests): restore MCP and update-plan CI contracts by @danielmeppiel in #3343
fix(install): retain trustworthy rendered skill receipts by @danielmeppiel in #3344
fix(tests): await parallel cache consumers before assertions by @danielmeppiel in #3352
fix(tests): align full-route fixtures with canonical receipt contracts by @danielmeppiel in #3353
chore: release v0.35.0 by @danielmeppiel in #3355
fix(ci): budget macOS ARM full release integration by @danielmeppiel in #3360
fix(ci): budget Linux x64 qualification and expose audit failure by @danielmeppiel in #3362
fix(ci): budget focused Intel release qualification by @danielmeppiel in #3364

New Contributors

@abhishekacharya200 made their first contribution in #3211
@Parth-Vasave made their first contribution in #3153
@Fire162 made their first contribution in #3221
@leninworld made their first contribution in #3303
@DBVamsi made their first contribution in #3263
@venkatayedidavs made their first contribution in #3086

Full Changelog: microsoft/apm@v0.34.0...v0.35.0

`v0.34.0`

Compare Source

What's Changed

🔧 Other Changes

fix(audit): validate skill subsets against prepared lock-pinned replay by @danielmeppiel in #3147
fix(git): preserve symlink capability config precedence by @danielmeppiel in #3145
fix(codex): preserve native agent model settings by @danielmeppiel in #3150
fix(hooks): render native Cursor hooks with import coexistence checks by @danielmeppiel in #3149
feat(install): add grok-bot install target for agent-data/workflows by @sergio-sisternes-epam in #3106
fix(install): stop --frozen rewriting the lockfile it freezes by @salpers in #2384
docs: explain package source vs installed copies by @aryansk in #2599
fix(auth): fall back to git credentials for ADO by @mheeaxa in #2610
feat(audit): allow SkillSpector --baseline through external args by @MohammedAlkindi in #2936
perf(registry): parallelize independent MCP server-info fetches by @sergio-sisternes-epam in #2983
feat: add user-invocable agent frontmatter field (#3132) by @richard-fowles-epam in #3133
fix: clarify stale cleanup message by @Dansatch in #3120
docs(guide): correct ASCII framing, apm run stability, LSP discoverability by @MohammedAlkindi in #2647
docs: fix stale README links by @icecold009 in #3016
fix(install): configure Cursor and OpenCode MCP servers at user scope by @alvedder in #3100
fix(manifest): preserve x-* extension keys and warn on unknown apm.yml keys by @sergio-sisternes-epam in #3222
docs: explain linked context lifetime after install by @dajiaohuang in #3237
fix(audit): replay the project's own content the way install deploys it by @adityaanikam in #3209
fix(prune): preserve case-equivalent GitHub dependencies (supersedes #3158) by @danielmeppiel in #3241
fix(pack): certify manifestless marketplace skills by @yfoel in #3064
feat: add GitHub Copilot marketplace output by @aryansk in #2600
fix(install): preserve skills on unmatched selection by @dajiaohuang in #3235
fix(install): pre-flight SSH github.com marketplace plugins over SSH by @MohammedAlkindi in #3200
fix(mcp): honor CLAUDE_CONFIG_DIR in Claude user-scope stale cleanup by @bodapatisaikrishna in #3148
fix(install): reconcile local skills under shared .agents roots by @tillig in #3190
fix(marketplace): record the commit an annotated tag points to by @nefayran in #3161
docs: clarify apm_modules is derived by @aryansk in #2601
feat(tls): add corporate CA bundles for package HTTPS by @TameTheGame in #2741
fix: avoid duplicate Copilot global instructions by @dajiaohuang in #3113
fix(audit): ignore hook sidecar object-key order by @Pybsama in #3155
fix(ci): repair release-gate integration suite and runtime setup under frozen binary by @danielmeppiel in #3251
fix(runtime): surface pip bootstrap errors in llm runtime setup by @danielmeppiel in #3253
fix(runtime): keep APM truststore bootstrap out of ensurepip on llm re-setup by @danielmeppiel in #3262
chore: release v0.34.0 by @danielmeppiel in #3250
test: pin cwd for deep-coverage CLI fixtures by @danielmeppiel in #3274

New Contributors

@mheeaxa made their first contribution in #2610
@richard-fowles-epam made their first contribution in #3133
@Dansatch made their first contribution in #3120
@icecold009 made their first contribution in #3016
@alvedder made their first contribution in #3100
@adityaanikam made their first contribution in #3209
@bodapatisaikrishna made their first contribution in #3148
@nefayran made their first contribution in #3161
@TameTheGame made their first contribution in #2741
@Pybsama made their first contribution in #3155

Full Changelog: microsoft/apm@v0.33.0...v0.34.0

`v0.33.0`

Compare Source

What's Changed

🔧 Other Changes

fix(install): explain skipped symlinked agent sources (refs #2913) by @danielmeppiel in #2932
fix(compile): resolve context links when folding instructions into CL… by @pavelvodrazka-etnetera in #2918
fix(hooks): render Codex hooks in native shape by @uurien in #3060
fix(cursor): comma-joined bare globs/description in .mdc frontmatter by @YGuyomar in #3011
fix(runtime): reject HTTP errors and bound Codex download retries by @danielmeppiel in #3111
fix(mcp): drop previous-transport keys on Claude server redeclaration by @edenfunf in #3041
fix(mcp): write env-sourced MCP headers into Codex's runtime fields by @edenfunf in #3042
fix(windows): resolve git.exe via shutil.which path= (PATHEXT) by @rwinkelman in #3092
fix(compile): discover Claude dependency memory at arbitrary installed depth by @vyrnsynx in #2952
fix(opencode): preserve explicit MCP enabled values by @dajiaohuang in #3102
fix(marketplace): resolve version tags from package remote by @modelpath-dev in #3044
fix(auth): preserve GitHub MCP runtime references by @dajiaohuang in #3103
fix(install): deploy skills through home directory aliases by @danielmeppiel in #2876
fix(compile): deduplicate global Claude instructions safely by @danielmeppiel in #3119
fix(cursor): preserve native MCP references and authored static values by @danielmeppiel in #3116
fix(audit): bound the deploy-tree hidden-Unicode walk to primitive directories by @lkshrk in #2962
docs(security): clarify insecure transport policy by @WilliamK112 in #2910
docs(install): correct --global local .apm/ deployment claim by @tillig in #2769
fix(copilot): keep Copilot modular instructions split at user-scope since supported - reverts #1619 by @kilianpaquier in #2317
feat(cli): add apm auth for git host credentials (#2788) by @sergio-sisternes-epam in #3134
fix(ci): restore green main CI across unit, integration and mutation lanes by @danielmeppiel in #3142
docs: clarify context availability after cloning by @danielmeppiel in #3144
chore: release v0.33.0 by @danielmeppiel in #3152

New Contributors

@pavelvodrazka-etnetera made their first contribution in #2918
@uurien made their first contribution in #3060
@YGuyomar made their first contribution in #3011
@rwinkelman made their first contribution in #3092
@vyrnsynx made their first contribution in #2952
@modelpath-dev made their first contribution in #3044
@kilianpaquier made their first contribution in #2317

Full Changelog: microsoft/apm@v0.32.0...v0.33.0

`v0.32.0`

Compare Source

What's Changed

🔧 Other Changes

feat(autopilot): origin-aware skills with CODEOWNERS-safe review by @sergio-sisternes-epam in #3003
perf(cli): lazy-load heavyweight command modules by @sergio-sisternes-epam in #3001
fix(alias): reject path-traversing dependency aliases — fixes #2900 by @Danvs60 in #2901
fix(ci): repair advisory locks and platform regressions by @danielmeppiel in #3021
fix(update): preserve marketplace uninstall aliases by @mfroembgen in #2949
Bump setuptools to 83.0.0 to remediate Unicode MANIFEST exclusion bypass by @sergio-sisternes-epam with @Copilot in #2893
feat(autopilot): maintainer canvas, panel-mode, and comment writer by @sergio-sisternes-epam in #3024
fix(install): shorten staging path segments to clear Windows MAX_PATH by @MohammedAlkindi in #2941
fix(installer): correct prebuilt Linux glibc minimum to 2.38 by @danielmeppiel in #2931
fix(update): preserve deployment targets during partial updates by @Wanming08 in #2924
fix(hooks): map prompt-submit to Copilot's userPromptSubmitted by @sheilagithub in #3030
fix(marketplace): authenticate default-host checks by @yfoel in #2917
fix(deps): reject incompatible immutable requirements by @danielmeppiel in #3061
fix(prune): detect orphan skills and preserve retained bundles by @fangkangmi in #3057
chore: release v0.32.0 by @danielmeppiel in #3080
fix(tests): repair v0.32.0 release validation contracts by @danielmeppiel in #3081

New Contributors

@Danvs60 made their first contribution in #2901
@Wanming08 made their first contribution in #2924
@sheilagithub made their first contribution in #3030
@yfoel made their first contribution in #2917

Full Changelog: microsoft/apm@v0.31.0...v0.32.0

`v0.31.0`

Compare Source

What's Changed

🔧 Other Changes

fix(outdated): report published registry versions beyond pins by @danielmeppiel in #2874
harden(gh-aw): require target (breaking), add token-source, fix GitHub policy casing by @danielmeppiel in #2706
fix(ci): recover native Windows workflow contract tests by @danielmeppiel in #2880
fix(codeql): remediate eleven sensitive-data alerts by @danielmeppiel with @Copilot in #2742
Fix skills subset installs for manifestless Git collections by @danielmeppiel with @Copilot in #2891
test: restore complete architecture guard mutation coverage by @danielmeppiel with @Copilot in #2892
fix(registry): exact version selectors must match published build metadata by @nadav-y in #2894
fix(install): fail loudly when a package deploys to no target (closes #2796) by @danielmeppiel in #2806
docs: Add WinGet method installation by @Gijsreyn in #2520
fix(deps): preserve GitLab sparse-fetch transport by @danielmeppiel in #2939
feat(init): onboard existing local packages without rewriting source by @danielmeppiel in #2937
docs: establish issue-first contribution and governance policy by @danielmeppiel in #2954
fix(triage): make automated recommendations advisory by @danielmeppiel in #2956
docs: define issue-backed roadmap and release planning by @danielmeppiel in #2959
fix(governance): require human scope and add neutral eligibility evidence by @danielmeppiel in #2964
fix(git-env): skip the HTTP header probe for non-HTTP effective URLs by @arnaudoisel in #2906
docs: publish the active issue-backed roadmap by @danielmeppiel in #2988
fix(uninstall): preserve unmanaged skills with an empty inventory by @mfroembgen in #2947
fix(ci): repair stale daily release smoke fixtures by @danielmeppiel in #2987
fix(cache): pin core.autocrlf=false on GitCache checkouts by @sergio-sisternes-epam in #2982
chore: release v0.31.0 by @danielmeppiel in #2989

New Contributors

@Gijsreyn made their first contribution in #2520
@arnaudoisel made their first contribution in #2906
@mfroembgen made their first contribution in #2947

Full Changelog: microsoft/apm@v0.30.0...v0.31.0

If you want to rebase/retry this PR, check this box

This PR was generated by #infrastructure automation. Contact us if you have any questions or feedback.

eclipse-score-bot · 2026-10-22T14:06:58Z

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: src/s-core-devcontainer/.devcontainer/s-core-local/versions.yaml

Post-upgrade command 'tools/internal/refresh_lockfile_digests.py' has not been added to the allowed list in allowedCommands

File name: tools/lockfiles/apm.lock.json

Post-upgrade command 'tools/internal/refresh_lockfile_digests.py' has not been added to the allowed list in allowedCommands

eclipse-score-bot · 2026-10-26T11:18:11Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

eclipse-score-bot requested review from lurtz and opajonk as code owners October 22, 2026 14:06

eclipse-score-bot added the type:dependencies label Oct 22, 2026

chore(deps): Update dependency microsoft/apm to v0.35.0

4a155ea

eclipse-score-bot force-pushed the renovate/microsoft-apm-0.x branch from 5308a08 to 4a155ea Compare October 22, 2026 23:05

eclipse-score-bot changed the title ~~chore(deps): Update dependency microsoft/apm to v0.34.0~~ chore(deps): Update dependency microsoft/apm to v0.35.0 Oct 22, 2026

chore: sync tools/README.md with updated lockfile

b389f1a

lurtz mentioned this pull request Oct 26, 2026

fix: Renovate readme sync #176

Merged

fix: refresh apm lockfile URLs and digests to v0.35.0

0c41b21

lurtz approved these changes Oct 26, 2026

View reviewed changes

lurtz added this pull request to the merge queue Oct 26, 2026

Merged via the queue into main with commit 5fba50b Oct 26, 2026
11 checks passed

lurtz deleted the renovate/microsoft-apm-0.x branch October 26, 2026 12:44

Navigation Menu

Repository navigation

chore(deps): Update dependency microsoft/apm to v0.35.0 - #174

chore(deps): Update dependency microsoft/apm to v0.35.0#174
lurtz merged 3 commits into
mainfrom
renovate/microsoft-apm-0.x

eclipse-score-bot commented Oct 22, 2026 •

edited

Loading

Uh oh!

eclipse-score-bot commented Oct 22, 2026

Uh oh!

eclipse-score-bot commented Oct 26, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

eclipse-score-bot commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v0.35.0

What's Changed

🔧 Other Changes

New Contributors

v0.34.0

What's Changed

🔧 Other Changes

New Contributors

v0.33.0

What's Changed

🔧 Other Changes

New Contributors

v0.32.0

What's Changed

🔧 Other Changes

New Contributors

v0.31.0

What's Changed

🔧 Other Changes

New Contributors

Uh oh!

eclipse-score-bot commented Oct 22, 2026

⚠️ Artifact update problem

File name: src/s-core-devcontainer/.devcontainer/s-core-local/versions.yaml

File name: tools/lockfiles/apm.lock.json

Uh oh!

eclipse-score-bot commented Oct 26, 2026

Edited/Blocked Notification

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

eclipse-score-bot commented Oct 22, 2026 •

edited

Loading

`v0.35.0`

`v0.34.0`

`v0.33.0`

`v0.32.0`

`v0.31.0`