[deps-release-notes] awf — upstream release action items

[github-actions]

Rolling upstream release action items — awf

This is the single canonical tracking issue for action items arising from
new releases of the awf dependency. The update-awf-version workflow appends
a new comment to this issue for each version bump going forward, so the most
recent activity lives in the comments below. This body is a consolidated
history of everything filed so far.

Latest pinned version covered: 0.28.9

Consolidated history (earliest → latest)

0.25.48 → 0.25.60 (was #851)

• OTel distributed tracing in api-proxy (v0.25.51): api-proxy now emits OTel traces; ado-aw could expose config to help consumers use this.
• ARC/DinD split-filesystem auto-detection (v0.25.52): AWF auto-detects DinD split filesystem via sentinel probe; ado-aw docs may need updating.
• Middle-power model fallback (v0.25.53): api-proxy supports model fallback when primary is unavailable; ado-aw could expose this.
• Anthropic WIF support (v0.25.58): api-proxy supports Anthropic WIF schema fields + OIDC validation.
• Pre-startup model validation via requestedModel config (v0.25.58): api-proxy validates requested model before startup; ado-aw may wish to populate this field.

0.25.48 → 0.25.63 (was #859)

• Security: proxy auth normalization hardened (v0.25.49): Prevents malformed Authorization headers from reaching the upstream API.
• Responses API cache reads in token usage rollups (v0.25.63): Fixes under-reporting of cached token reads; improves ado-aw audit accuracy.

0.25.65 → 0.25.66 (was #902)

• Azure/AWS/GCP OIDC support in Copilot adapter (v0.25.66): api-proxy supports cloud OIDC credential injection; ado-aw could expose via engine:/network: front-matter.
• Budget fields in token-usage.jsonl (v0.25.66): maxTurns and budget fields now persisted; ado-aw audit module could surface these in AuditData.

0.25.65 → 0.25.68 (was #930)

• GITHUB_COPILOT_INTEGRATION_ID forwarding fix (v0.25.67): AWF now correctly forwards it as COPILOT_INTEGRATION_ID to the api-proxy.
• PAT-safe integration ID + model name normalization (v0.25.68): Regression fix from v0.25.67; normalizes legacy CAPI model names.

0.25.65 → 0.27.0 (was #950)

• cli-proxy fail fast on DIFC unreachability (v0.25.66): CLI proxy now errors immediately rather than hanging; verify DIFC proxy config before upgrade.

0.25.65 → 0.27.1 (was #970)

• AI credits as OTEL span attributes (v0.27.1): AWF emits AI credit consumption as OTel spans; agent_stats.rs + audit could surface these.
• Redacted resolved config as audit artifact (v0.27.1): ado-aw audit could expose for configuration diagnostics.
• Opt-in diagnostics artifact for blocked LLM request bodies (v0.27.1): ado-aw could surface via ado-aw-debug: flag.

0.25.65 → 0.27.2 (was #983)

• Security: WIF/OIDC Anthropic auth regression (v0.27.2): ANTHROPIC_API_KEY leaked to agent container when Squid blocked OIDC exchange; fixed in 0.27.2.

0.25.65 → 0.27.3 (was #990)

• OTLP fan-out to multiple endpoints (v0.27.3): api-proxy can fan out telemetry to multiple OTLP endpoints simultaneously.

0.27.3 → 0.27.5 (was #1093)

• Security: HTTPS-only for bare API proxy targets (v0.27.5): Prevents over-broad HTTP allowlisting; verify no existing config relies on HTTP.
• allowedModels/disallowedModels in api-proxy (v0.27.5): Model allow/deny-list policy; ado-aw could expose as engine.allowed-models front-matter.
• COPILOT_INTEGRATION_ID forwarding from host env (v0.27.5): api-proxy forwards from host into sandbox; ensure ado-aw passes it through AWF invocation.
• GHES detection fix for Copilot auth prefix (v0.27.4): Fixes auth failures for non-standard GHES hostnames.

0.27.3 → 0.27.7 (was #1118)

• max-cache-misses guardrail (v0.27.6): Limits token spend when cache misses exceed threshold; useful for cost-sensitive pipelines.

0.27.3 → 0.27.9 (was #1184)

• Copilot Business endpoint auth prefix corrected (v0.27.9): Fixed wrong bearer prefix (should be token); Business-account pipelines may have been silently failing.

0.27.9 → 0.27.11 (was #1219)

• Portable self-hosted runner doctor agent (v0.27.11): New AWF diagnostic tool; ado-aw could reference in troubleshooting docs.
• Topology-attach ordering deadlock fix (v0.27.11): Starved cli-proxy health gate; MCPG-based pipelines (--topology-attach mcp-gateway) were directly affected.
• ARC/DinD chroot path fix (v0.27.10): /host/tmp/awf-runner-bin instead of /host/usr collision; update ARC/DinD docs if referencing /host/usr.

0.27.9 → 0.27.12 (was #1241)

• Security: June 2026 dependency refresh (v0.27.12): Routine security dep upgrades; upgrading recommended.
• OIDC config propagation fix (v0.27.12): apiProxy.auth OIDC fields were not propagated to all proxy layers; previously configured OIDC may have been silently ignored.

0.27.9 → 0.27.13 (was #1252)

• Security: ReDoS fix in postprocess script (v0.27.11): ReDoS vulnerability patched; no consumer action beyond upgrading.
• maxRuns counts only inference calls (v0.27.13): Semantics changed — no longer counts tool calls; re-evaluate any max-runs tuning based on total tool-call counts.
• HTTP 429 (not 403) when max turns exceeded (v0.27.13): Update any ado-aw code/docs that treat 403 as the max-turns-exceeded indicator.

0.27.9 → 0.27.15 (was #1260)

• Note: v0.27.14 was retracted; its changes are included in v0.27.15.
• Security: transitive linkify-it → v5.0.1 (v0.27.12): Part of June 2026 security refresh.

0.27.9 → 0.27.21 (was #1304)

• container.mounts in AWF config schema (v0.27.21): ado-aw could expose as front-matter field for custom sandbox mounts.
• Model-to-API endpoint mapping (v0.27.16): AWF maintains a model→endpoint map updated daily; relevant for ado-aw model validation allowlist.

0.27.32 → 0.28.5 (was #1990)

• Firecracker microVM backend removed (v0.28.1, "ci: disable Firecracker workflows and release artifacts") — AWF has dropped Firecracker in favor of Cloud Hypervisor as the sandbox backend. ado-aw does not reference Firecracker directly, but any docs/runner-doctor guidance mentioning it upstream should not be assumed to apply going forward.
• Enforce filesystem allowWrite boundaries in AWF sandboxes (v0.28.5, #7634) — tightens write-path enforcement so sandboxed agents can only write within explicitly allowed paths.
• Route CLI artifact redirects through scoped Squid egress (v0.28.5, #7635) — CLI artifact download redirects are now proxied through Squid's domain-allowlist instead of bypassing egress controls, closing a potential egress-control bypass.
• fix: route CLI proxy through isolated egress relay (v0.28.2, #7338) — routes the CLI proxy through an isolated egress relay for DIFC credential isolation.
• fix(security): suppress non-reachable GO-2026-4337 in gosu binary (v0.27.43, #6645) and update brace-expansion to 5.0.8 (GHSA-mh99-v99m-4gvg) (v0.27.42, #6585) — routine dependency CVE remediations in the AWF toolchain.
• Support compiler-authorized digest-pinned container image manifests (v0.28.4, #7601) — ado-aw could adopt this to pin AWF/MCPG/agent images by digest instead of tag for stronger supply-chain guarantees.
• feat: support secret-backed OpenAI-compatible targets (v0.28.3, #7576) — new API-proxy target type; relevant if ado-aw ever wants to support OpenAI-compatible engine backends secured via secret-backed credentials.
• API proxy: first-class AI-credit accounting for Copilot auto dynamic selector (v0.28.4, #7604) — improved cost/credit accounting when using Copilot's auto model selector, could inform ado-aw's engine cost-reporting/observability docs.
• Recover transient Cloud Hypervisor readiness failures (v0.28.5, #7611) and Fix Cloud Hypervisor API proxy readiness race (v0.28.3, #7582) — reliability fixes for the (preview) Cloud Hypervisor backend that ado-aw's OneBranch integration may rely on.

0.27.32 → 0.28.9 (was #2028) — canonical

• Firecracker support removed (#7362) — anyone relying on the Firecracker VM isolation backend for AWF will need to migrate to the supported sandboxing path before upgrading past this range.
• fix(security): update vulnerable deps in agent and api-proxy images (#6505) — patches known CVEs in the agent/api-proxy container images.
• chore(deps): safe patch updates incl. ajv 8.20.0 security fix (#6962) — bundled ajv security patch.
• Protect ANTHROPIC_AUTH_TOKEN in AWF credential isolation paths (#6410) — extends AWF's credential-isolation guarantees to Anthropic auth tokens.
• Exclude topology-attached MCP peers from agent proxy routing (#6189) — relevant to how ado-aw wires MCPG via --topology-attach; may simplify or change proxy routing assumptions in agentic_pipeline.rs.
• Auto-allow topology-attached container hostnames in Squid ACL (#6473) — reduces manual allowlist entries for topology-attached containers (e.g. MCPG), potentially letting ado-aw drop custom allowlist workarounds.
• Support COPILOT_MODEL=auto (#6474) — new dynamic model-selection env var AWF passes through; ado-aw's engine.rs model handling could expose this as a supported option.
• Route CLI proxy through isolated egress relay (#7338) — changes to how the wrapped az/CLI network egress is routed; worth double-checking az_wrapper.rs assumptions still hold.
• API proxy: first-class AI-credit accounting for Copilot auto dynamic selector (#7604) — new usage/cost accounting surfaced by AWF that ado-aw's audit/otel tooling could ingest.
• Remove "bounded-query" terminology (#7735) — naming/terminology change in AWF docs/config; check for any ado-aw docs or config referencing the old term.

---

Consolidated by the Deps Release-Notes Consolidator workflow. Superseded per-release issues were closed and point here.> Generated by Deps Release-Notes Consolidator · auto · 76.3 AIC · ⌖ 11.6 AIC · ⊞ 10.6K · ◷

[github-actions]

awf 0.27.32 → 0.28.10

Releases analyzed

• v0.27.33
• v0.27.34
• v0.27.35
• v0.27.36
• v0.27.37
• v0.27.38
• v0.27.39
• v0.27.41
• v0.27.42
• v0.27.43
• v0.27.44
• v0.28.0
• v0.28.1
• v0.28.2
• v0.28.3
• v0.28.4
• v0.28.5
• v0.28.6
• v0.28.7
• v0.28.8
• v0.28.9
• v0.28.10

Breaking changes

• Firecracker support removed (v0.28.2) — awf dropped Firecracker as a sandbox backend in favor of Cloud Hypervisor. If ado-aw or downstream consumers reference Firecracker-specific config/flags, this needs a compatibility check.

Security fixes

• Vulnerable dependency updates in agent/api-proxy images (v0.27.39, fix(security)) — patched vulnerable deps shipped in the agent/api-proxy container images.
• Non-reachable CVE suppressions (v0.27.42 x/text in gh CLI binary, v0.27.43 GO-2026-4337 in gosu binary) — both documented as non-reachable/unreachable in AWF's usage, no action expected but noted for awareness.
• ANTHROPIC_AUTH_TOKEN protection in credential isolation paths (v0.27.37) — hardens AWF's credential-isolation handling to also cover this token.
• ajv 8.20.0 security patch (v0.28.0, bundled in chore(deps) patch update) — routine transitive security patch.
• cap_drop host capability bounding-set filtering fix (v0.28.10, PR #7795) — container cap_drop values are now filtered against the host's capability bounding set, preventing invalid/no-op cap-drop configuration from silently failing to restrict privileges.
• MCP gateway Authorization header contract hardened (v0.28.10, PR #7794) — hardens/documents the Authorization header contract to prevent workspace credential exposure through the MCP gateway. Worth reviewing if ado-aw's MCPG integration passes bearer tokens through AWF.
• Sandbox filesystem/network boundary hardening (v0.28.5) — release notes call out sandbox write-boundary enforcement and Squid egress routing hardening as touching "the core security surface"; no breaking changes for existing CLI users per the release notes, but relevant if ado-aw relies on custom allowWrite configs or CLI artifact downloads.

Notable features for ado-aw to adopt

• Unified enclave foundation + enclave MCP script executor (v0.28.0, PRs #6986/#6987-area) — new sandboxed "enclave" execution model; could be relevant to how ado-aw's ado-script bundles or Custom safe-output jobs get executed if AWF exposes this as a supported topology.
• Read-only GitHub CLI access in agent enclaves (v0.28.8, PR #7714) and later a read-only enclave Issues smoke workflow (v0.28.9) — a scoped, read-only gh CLI surface inside enclaves; potentially useful for ado-aw workflows that currently rely on the read-only GitHub MCP server, as an alternative/complementary tool surface.
• Sealed probes for private repositories + confidentiality-aware sealed probe budgets (v0.27.43–0.27.44) — new probing/diagnostics capability with confidentiality controls; may be relevant to ado-aw's audit/diagnostics tooling.
• Compiler-authorized digest-pinned container image manifests (v0.28.4, PR #7601) — supports pinning container images by digest with compiler authorization, which pairs well with ado-aw's supply-chain: provenance-checked image story.
• Secret-backed OpenAI-compatible target support (v0.28.3, PR #7576) and runtime secret-backed OpenAI endpoint override in api-proxy (v0.27.43, PR #6656) — lets the api-proxy route to secret-backed custom OpenAI-compatible endpoints; relevant if ado-aw ever needs to support non-default model providers through AWF's proxy.
• api-proxy CA certificate support (v0.28.10, PR #7816) — lets the API proxy present/trust a custom CA certificate, useful for TLS-inspecting or self-hosted proxy setups.
• Cloud Hypervisor filesystem.allowWrite support + resolved write-boundary logging (v0.28.6, v0.28.10) — AWF now logs the resolved filesystem write boundary before the guest VM boots, improving auditability of allowWrite configuration — useful context for troubleshooting ado-aw sandboxes.
• COPILOT_MODEL=auto support in AWF validation/api-proxy (v0.27.39) and a related warning when Codex uses auto under the AWF API proxy (v0.28.10, PR #7818) — relevant to ado-aw's engine.model handling if it ever surfaces auto as a model value.
• Orphaned fixed-name Docker network reclaim before compose up (v0.28.10, PR #7817) — improves reliability of AWF's compose-based topology bring-up; relevant to smoke-test flakiness triage.

Deprecations

• No explicit deprecation announcements (as opposed to outright removals) were found in this range; see Firecracker removal above under Breaking changes.

Generated by Dependency Version Updater · auto · 133.1 AIC · ⌖ 12.9 AIC · ⊞ 16.5K · ◷