chore: release - merge dev into main - #1523
Merged
Merged
Conversation
Bumps [axios](https://github.com/axios/axios) from 1.16.0 to 1.18.1. - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.16.0...v1.18.1) --- updated-dependencies: - dependency-name: axios dependency-version: 1.18.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…1513) `npm audit --omit=dev --audit-level=high` (CI lint-and-test gate) was red on `dev`, blocking every open PR. Three high findings, two with no Dependabot PR: - js-yaml 4.2.0 -> ^4.3.0 (GHSA-52cp-r559-cp3m, direct dep) - brace-expansion -> ^5.0.8 (GHSA-mh99-v99m-4gvg has NO 2.x backport; only 5.0.8 is patched) - protobufjs override 7.6.4 -> ^7.6.5 (GHSA-j3f2-48v5-ccww, moderate) brace-expansion 5.x is a breaking change: 1.x/2.x did `module.exports = expand` (callable), 5.x exports `{ expand, EXPANSION_MAX, EXPANSION_MAX_LENGTH }`. Forcing it alone breaks every minimatch below v10 at runtime — verified: minimatch@5.1.9 (filelist) throws `expand is not a function`, minimatch@9.0.9 (rimraf, archiver-utils, llmist) throws `brace_expansion_1.default is not a function`. Only minimatch@10 calls the named `.expand()` export. So brace-expansion is pinned together with `minimatch: ^10.2.5`, deduping the tree to one modern copy that is compatible with it. Bumping the direct consumers instead does not work — filelist, llmist, rimraf and test-exclude pin old minimatch transitively and are not upgradeable from here. Verified: audit gate exits 0, build + typecheck clean, 10915 unit tests pass, and filelist brace globbing still resolves `package{.json,-lock.json}`. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Bumps [hono](https://github.com/honojs/hono) from 4.12.26 to 4.12.32. - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.26...v4.12.32) --- updated-dependencies: - dependency-name: hono dependency-version: 4.12.32 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [@hono/node-server](https://github.com/honojs/node-server) from 1.19.13 to 2.0.10. - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v1.19.13...v2.0.10) --- updated-dependencies: - dependency-name: "@hono/node-server" dependency-version: 2.0.10 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.2 to 3.1.4. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.2...v3.1.4) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [shell-quote](https://github.com/ljharb/shell-quote) to 1.9.0 and updates ancestor dependency [concurrently](https://github.com/open-cli-tools/concurrently). These dependencies need to be updated together. Updates `shell-quote` from 1.8.4 to 1.9.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.8.4...v1.9.0) Updates `concurrently` from 10.0.3 to 10.0.4 - [Release notes](https://github.com/open-cli-tools/concurrently/releases) - [Commits](open-cli-tools/concurrently@v10.0.3...v10.0.4) --- updated-dependencies: - dependency-name: concurrently dependency-version: 10.0.4 dependency-type: direct:development - dependency-name: shell-quote dependency-version: 1.9.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Supersedes #1507. Dependabot's own lockfile regeneration for this bump was unusable: it dropped `@trpc/server@11.16.0` and downgraded/moved `react-is`, so `cd web && npm ci` failed the CI gate with EUSAGE (lock out of sync with package.json) on both the original branch and after an explicit rebase. Regenerated from dev's healthy lock with a scoped `npm update seroval seroval-plugins --package-lock-only` instead, which touches only the two transitive entries. seroval is transitive via @tanstack/react-router -> @tanstack/router-core, so package.json is intentionally unchanged. Verified: `cd web && npm ci --dry-run` in sync, `npm run build:web` succeeds. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.12 to 8.5.24. - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.12...8.5.24) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.24 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…5.2 -> 6.0.4 in /web (#1515) Supersedes #1511 (and #1410 before it). The bump itself is fine; Dependabot's lockfile regeneration for the web workspace is not. Its lock fails `npm ci` with EUSAGE — dropping `@trpc/server@11.16.0` and `react-is@19.2.8`, and pinning `@emnapi/*` 2.0.0-alpha prereleases that conflict with the resolved 1.x. Same defect that made #1507 unmergeable; an explicit `@dependabot rebase` did not fix it either. Regenerated the lock from dev's healthy state with a scoped `npm install --save-dev --package-lock-only` instead. vite 8 swaps Rollup for rolldown, hence the large lockfile delta (-1302/+314): the rollup toolchain drops out. Verified: `cd web && npm ci` in sync, `npm run typecheck` clean, and `npm run build:web` succeeds (2883 modules, bundle 1466 kB vs 1511 kB on vite 6). Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Cascade Bot <bot@cascade.dev>
Co-authored-by: Cascade Bot <bot@cascade.dev>
Co-authored-by: Cascade Bot <bot@cascade.dev>
Co-authored-by: Cascade Bot <bot@cascade.dev>
Co-authored-by: Cascade Bot <bot@cascade.dev>
* fix(codex): enforce blockGitPush with PreToolUse hook * fix(codex): default blockGitPush to true for claude-code parity The codex PreToolUse git-push deny hook inverted claude-code's default: claude-code resolves `options?.blockGitPush ?? true` (undefined blocks), while the plan carries the raw `profile.finishHooks.blockGitPush` with no default. Only the four PR-branch agents set it (all to false); every other agent — including implementation and review, the MNG-1755 targets — leaves it undefined. The codex path treated undefined as "do not block", so the deny hook was materialized for zero shipped agents. - writeCodexHooksFile: resolve `const shouldBlock = blockGitPush ?? true` - buildArgs: gate `--dangerously-bypass-hook-trust` on `input.blockGitPush ?? true` - guard the generated hook's `JSON.parse(input)` so unparseable/empty stdin fails open (allow) instead of throwing non-zero with undefined behavior - tests: pin undefined→block for both surfaces + fail-open parse guard Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Cascade Bot <bot@cascade.dev> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
…1522) * fix: enforce update-channel PM posting gate for native-tool engines native-tool engines (Codex, Claude Code, OpenCode) bypassed the filterPostingGadgetNames channel gate because the implementation agent's task-prompt template unconditionally instructed the agent to call PostComment, and NATIVE_TOOL_EXECUTION_RULES told it to translate gadget names into cascade-tools CLI calls — so cascade-tools pm post-comment was invoked via bash regardless of the configured update channel. Two-layer fix: - Prompt suppression: resolve update channel before template rendering and inject pmPostingEnabled into promptContext; implementation.eta now omits the "Post Summary Comment" step when PM posting is disabled. - CLI runtime gate: inject CASCADE_UPDATE_CHANNEL into subprocess env via augmentProjectSecrets; cascade-tools pm post-comment checks this env var and returns a structured skipped response when PM posting is disabled. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011ZaMpedeE8PXsix84cWsq1 * fix: complete update-channel PM posting gate (layer 1 + fail-closed layer 2) Addresses review feedback on PR #1522: - implementation.eta: gate Phase-4 step 10 ("Post summary comment") on pmPostingEnabled, matching the already-gated "Post Summary Comment" section, so layer-1 prompt suppression is complete under scm-only/none. - post-comment.ts: resolve the channel via env-then-/tmp-file fallback (resolveUpdateChannelFromEnv), mirroring the sibling create-pr-review gate. claude-code (the default engine) can strip custom env vars from bash subprocesses, which made the env-only gate fail OPEN. The orchestrator now writes UPDATE_CHANNEL_FILE unconditionally so the CLI gate — the engine-wide defense for every PM-posting agent — holds even when CASCADE_UPDATE_CHANNEL is dropped. - updateChannel.ts: add UPDATE_CHANNEL_ENV_VAR + UPDATE_CHANNEL_FILE constants; secretBuilder.ts uses the constant for the env-var key. - Tests: template gating (implementation-pm-posting.test.ts), CLI skip branch + file-fallback precedence (pm-commands.test.ts), promptContext flag + channel file write (secretOrchestrator.test.ts). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * test(update-channel): pin CASCADE_UPDATE_CHANNEL injection + narrow comment Follow-up on the update-channel PM-posting gate addressing two remaining review points not covered by the prior commit: - Narrow the augmentProjectSecrets comment to `pm post-comment` and flag the SCM posting commands (scm post-pr-comment / create-pr-review / update-pr-comment / reply-to-review-comment) as a follow-up, so it no longer overstates current bash-gate coverage (review nitpick). - Add secretBuilder.test.ts coverage pinning CASCADE_UPDATE_CHANNEL injection (default `both`, `scm-only`, and per-agent-type resolution) — the reviewer flagged this env var as untested (toMatchObject pinned nothing). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(secretBuilder): narrow CASCADE_UPDATE_CHANNEL comment to pm post-comment The comment referenced `scm post-pr-comment` alongside "enforce the channel gate," which read as if SCM CLI posting is gated on CASCADE_UPDATE_CHANNEL. Only `pm post-comment` reads the var. Reword to state that explicitly and frame the SCM commands as a not-yet-gated, out-of-scope follow-up so the comment matches actual coverage. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Cascade Bot <bot@cascade.dev>
Codecov Report❌ Patch coverage is 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated release PR created by the release workflow.
Commits (16):