[deps-release-notes] awf — upstream release action items

[github-actions]

Rolling upstream release action items — awf

This is the single canonical tracking issue for action items arising from
new releases of the awf dependency. The update-awf-version workflow appends
a new comment to this issue for each version bump going forward, so the most
recent activity lives in the comments below. This body is a consolidated
history of everything filed so far.

Latest pinned version covered: 0.28.9

Consolidated history (earliest → latest)

0.25.48 → 0.25.60 (was #851)

• OTel distributed tracing in api-proxy (v0.25.51): api-proxy now emits OTel traces; ado-aw could expose config to help consumers use this.
• ARC/DinD split-filesystem auto-detection (v0.25.52): AWF auto-detects DinD split filesystem via sentinel probe; ado-aw docs may need updating.
• Middle-power model fallback (v0.25.53): api-proxy supports model fallback when primary is unavailable; ado-aw could expose this.
• Anthropic WIF support (v0.25.58): api-proxy supports Anthropic WIF schema fields + OIDC validation.
• Pre-startup model validation via requestedModel config (v0.25.58): api-proxy validates requested model before startup; ado-aw may wish to populate this field.

0.25.48 → 0.25.63 (was #859)

• Security: proxy auth normalization hardened (v0.25.49): Prevents malformed Authorization headers from reaching the upstream API.
• Responses API cache reads in token usage rollups (v0.25.63): Fixes under-reporting of cached token reads; improves ado-aw audit accuracy.

0.25.65 → 0.25.66 (was #902)

• Azure/AWS/GCP OIDC support in Copilot adapter (v0.25.66): api-proxy supports cloud OIDC credential injection; ado-aw could expose via engine:/network: front-matter.
• Budget fields in token-usage.jsonl (v0.25.66): maxTurns and budget fields now persisted; ado-aw audit module could surface these in AuditData.

0.25.65 → 0.25.68 (was #930)

• GITHUB_COPILOT_INTEGRATION_ID forwarding fix (v0.25.67): AWF now correctly forwards it as COPILOT_INTEGRATION_ID to the api-proxy.
• PAT-safe integration ID + model name normalization (v0.25.68): Regression fix from v0.25.67; normalizes legacy CAPI model names.

0.25.65 → 0.27.0 (was #950)

• cli-proxy fail fast on DIFC unreachability (v0.25.66): CLI proxy now errors immediately rather than hanging; verify DIFC proxy config before upgrade.

0.25.65 → 0.27.1 (was #970)

• AI credits as OTEL span attributes (v0.27.1): AWF emits AI credit consumption as OTel spans; agent_stats.rs + audit could surface these.
• Redacted resolved config as audit artifact (v0.27.1): ado-aw audit could expose for configuration diagnostics.
• Opt-in diagnostics artifact for blocked LLM request bodies (v0.27.1): ado-aw could surface via ado-aw-debug: flag.

0.25.65 → 0.27.2 (was #983)

• Security: WIF/OIDC Anthropic auth regression (v0.27.2): ANTHROPIC_API_KEY leaked to agent container when Squid blocked OIDC exchange; fixed in 0.27.2.

0.25.65 → 0.27.3 (was #990)

• OTLP fan-out to multiple endpoints (v0.27.3): api-proxy can fan out telemetry to multiple OTLP endpoints simultaneously.

0.27.3 → 0.27.5 (was #1093)

• Security: HTTPS-only for bare API proxy targets (v0.27.5): Prevents over-broad HTTP allowlisting; verify no existing config relies on HTTP.
• allowedModels/disallowedModels in api-proxy (v0.27.5): Model allow/deny-list policy; ado-aw could expose as engine.allowed-models front-matter.
• COPILOT_INTEGRATION_ID forwarding from host env (v0.27.5): api-proxy forwards from host into sandbox; ensure ado-aw passes it through AWF invocation.
• GHES detection fix for Copilot auth prefix (v0.27.4): Fixes auth failures for non-standard GHES hostnames.

0.27.3 → 0.27.7 (was #1118)

• max-cache-misses guardrail (v0.27.6): Limits token spend when cache misses exceed threshold; useful for cost-sensitive pipelines.

0.27.3 → 0.27.9 (was #1184)

• Copilot Business endpoint auth prefix corrected (v0.27.9): Fixed wrong bearer prefix (should be token); Business-account pipelines may have been silently failing.

0.27.9 → 0.27.11 (was #1219)

• Portable self-hosted runner doctor agent (v0.27.11): New AWF diagnostic tool; ado-aw could reference in troubleshooting docs.
• Topology-attach ordering deadlock fix (v0.27.11): Starved cli-proxy health gate; MCPG-based pipelines (--topology-attach mcp-gateway) were directly affected.
• ARC/DinD chroot path fix (v0.27.10): /host/tmp/awf-runner-bin instead of /host/usr collision; update ARC/DinD docs if referencing /host/usr.

0.27.9 → 0.27.12 (was #1241)

• Security: June 2026 dependency refresh (v0.27.12): Routine security dep upgrades; upgrading recommended.
• OIDC config propagation fix (v0.27.12): apiProxy.auth OIDC fields were not propagated to all proxy layers; previously configured OIDC may have been silently ignored.

0.27.9 → 0.27.13 (was #1252)

• Security: ReDoS fix in postprocess script (v0.27.11): ReDoS vulnerability patched; no consumer action beyond upgrading.
• maxRuns counts only inference calls (v0.27.13): Semantics changed — no longer counts tool calls; re-evaluate any max-runs tuning based on total tool-call counts.
• HTTP 429 (not 403) when max turns exceeded (v0.27.13): Update any ado-aw code/docs that treat 403 as the max-turns-exceeded indicator.

0.27.9 → 0.27.15 (was #1260)

• Note: v0.27.14 was retracted; its changes are included in v0.27.15.
• Security: transitive linkify-it → v5.0.1 (v0.27.12): Part of June 2026 security refresh.

0.27.9 → 0.27.21 (was #1304)

• container.mounts in AWF config schema (v0.27.21): ado-aw could expose as front-matter field for custom sandbox mounts.
• Model-to-API endpoint mapping (v0.27.16): AWF maintains a model→endpoint map updated daily; relevant for ado-aw model validation allowlist.

0.27.32 → 0.28.5 (was #1990)

• Firecracker microVM backend removed (v0.28.1, "ci: disable Firecracker workflows and release artifacts") — AWF has dropped Firecracker in favor of Cloud Hypervisor as the sandbox backend. ado-aw does not reference Firecracker directly, but any docs/runner-doctor guidance mentioning it upstream should not be assumed to apply going forward.
• Enforce filesystem allowWrite boundaries in AWF sandboxes (v0.28.5, #7634) — tightens write-path enforcement so sandboxed agents can only write within explicitly allowed paths.
• Route CLI artifact redirects through scoped Squid egress (v0.28.5, #7635) — CLI artifact download redirects are now proxied through Squid's domain-allowlist instead of bypassing egress controls, closing a potential egress-control bypass.
• fix: route CLI proxy through isolated egress relay (v0.28.2, #7338) — routes the CLI proxy through an isolated egress relay for DIFC credential isolation.
• fix(security): suppress non-reachable GO-2026-4337 in gosu binary (v0.27.43, #6645) and update brace-expansion to 5.0.8 (GHSA-mh99-v99m-4gvg) (v0.27.42, #6585) — routine dependency CVE remediations in the AWF toolchain.
• Support compiler-authorized digest-pinned container image manifests (v0.28.4, #7601) — ado-aw could adopt this to pin AWF/MCPG/agent images by digest instead of tag for stronger supply-chain guarantees.
• feat: support secret-backed OpenAI-compatible targets (v0.28.3, #7576) — new API-proxy target type; relevant if ado-aw ever wants to support OpenAI-compatible engine backends secured via secret-backed credentials.
• API proxy: first-class AI-credit accounting for Copilot auto dynamic selector (v0.28.4, #7604) — improved cost/credit accounting when using Copilot's auto model selector, could inform ado-aw's engine cost-reporting/observability docs.
• Recover transient Cloud Hypervisor readiness failures (v0.28.5, #7611) and Fix Cloud Hypervisor API proxy readiness race (v0.28.3, #7582) — reliability fixes for the (preview) Cloud Hypervisor backend that ado-aw's OneBranch integration may rely on.

0.27.32 → 0.28.9 (was #2028) — canonical

• Firecracker support removed (#7362) — anyone relying on the Firecracker VM isolation backend for AWF will need to migrate to the supported sandboxing path before upgrading past this range.
• fix(security): update vulnerable deps in agent and api-proxy images (#6505) — patches known CVEs in the agent/api-proxy container images.
• chore(deps): safe patch updates incl. ajv 8.20.0 security fix (#6962) — bundled ajv security patch.
• Protect ANTHROPIC_AUTH_TOKEN in AWF credential isolation paths (#6410) — extends AWF's credential-isolation guarantees to Anthropic auth tokens.
• Exclude topology-attached MCP peers from agent proxy routing (#6189) — relevant to how ado-aw wires MCPG via --topology-attach; may simplify or change proxy routing assumptions in agentic_pipeline.rs.
• Auto-allow topology-attached container hostnames in Squid ACL (#6473) — reduces manual allowlist entries for topology-attached containers (e.g. MCPG), potentially letting ado-aw drop custom allowlist workarounds.
• Support COPILOT_MODEL=auto (#6474) — new dynamic model-selection env var AWF passes through; ado-aw's engine.rs model handling could expose this as a supported option.
• Route CLI proxy through isolated egress relay (#7338) — changes to how the wrapped az/CLI network egress is routed; worth double-checking az_wrapper.rs assumptions still hold.
• API proxy: first-class AI-credit accounting for Copilot auto dynamic selector (#7604) — new usage/cost accounting surfaced by AWF that ado-aw's audit/otel tooling could ingest.
• Remove "bounded-query" terminology (#7735) — naming/terminology change in AWF docs/config; check for any ado-aw docs or config referencing the old term.

---

Consolidated by the Deps Release-Notes Consolidator workflow. Superseded per-release issues were closed and point here.> Generated by Deps Release-Notes Consolidator · auto · 76.3 AIC · ⌖ 11.6 AIC · ⊞ 10.6K · ◷

[github-actions]

awf 0.27.32 → 0.28.10

Releases analyzed

• v0.27.33
• v0.27.34
• v0.27.35
• v0.27.36
• v0.27.37
• v0.27.38
• v0.27.39
• v0.27.41
• v0.27.42
• v0.27.43
• v0.27.44
• v0.28.0
• v0.28.1
• v0.28.2
• v0.28.3
• v0.28.4
• v0.28.5
• v0.28.6
• v0.28.7
• v0.28.8
• v0.28.9
• v0.28.10

Breaking changes

• Firecracker support removed (v0.28.2) — awf dropped Firecracker as a sandbox backend in favor of Cloud Hypervisor. If ado-aw or downstream consumers reference Firecracker-specific config/flags, this needs a compatibility check.

Security fixes

• Vulnerable dependency updates in agent/api-proxy images (v0.27.39, fix(security)) — patched vulnerable deps shipped in the agent/api-proxy container images.
• Non-reachable CVE suppressions (v0.27.42 x/text in gh CLI binary, v0.27.43 GO-2026-4337 in gosu binary) — both documented as non-reachable/unreachable in AWF's usage, no action expected but noted for awareness.
• ANTHROPIC_AUTH_TOKEN protection in credential isolation paths (v0.27.37) — hardens AWF's credential-isolation handling to also cover this token.
• ajv 8.20.0 security patch (v0.28.0, bundled in chore(deps) patch update) — routine transitive security patch.
• cap_drop host capability bounding-set filtering fix (v0.28.10, PR #7795) — container cap_drop values are now filtered against the host's capability bounding set, preventing invalid/no-op cap-drop configuration from silently failing to restrict privileges.
• MCP gateway Authorization header contract hardened (v0.28.10, PR #7794) — hardens/documents the Authorization header contract to prevent workspace credential exposure through the MCP gateway. Worth reviewing if ado-aw's MCPG integration passes bearer tokens through AWF.
• Sandbox filesystem/network boundary hardening (v0.28.5) — release notes call out sandbox write-boundary enforcement and Squid egress routing hardening as touching "the core security surface"; no breaking changes for existing CLI users per the release notes, but relevant if ado-aw relies on custom allowWrite configs or CLI artifact downloads.

Notable features for ado-aw to adopt

• Unified enclave foundation + enclave MCP script executor (v0.28.0, PRs #6986/#6987-area) — new sandboxed "enclave" execution model; could be relevant to how ado-aw's ado-script bundles or Custom safe-output jobs get executed if AWF exposes this as a supported topology.
• Read-only GitHub CLI access in agent enclaves (v0.28.8, PR #7714) and later a read-only enclave Issues smoke workflow (v0.28.9) — a scoped, read-only gh CLI surface inside enclaves; potentially useful for ado-aw workflows that currently rely on the read-only GitHub MCP server, as an alternative/complementary tool surface.
• Sealed probes for private repositories + confidentiality-aware sealed probe budgets (v0.27.43–0.27.44) — new probing/diagnostics capability with confidentiality controls; may be relevant to ado-aw's audit/diagnostics tooling.
• Compiler-authorized digest-pinned container image manifests (v0.28.4, PR #7601) — supports pinning container images by digest with compiler authorization, which pairs well with ado-aw's supply-chain: provenance-checked image story.
• Secret-backed OpenAI-compatible target support (v0.28.3, PR #7576) and runtime secret-backed OpenAI endpoint override in api-proxy (v0.27.43, PR #6656) — lets the api-proxy route to secret-backed custom OpenAI-compatible endpoints; relevant if ado-aw ever needs to support non-default model providers through AWF's proxy.
• api-proxy CA certificate support (v0.28.10, PR #7816) — lets the API proxy present/trust a custom CA certificate, useful for TLS-inspecting or self-hosted proxy setups.
• Cloud Hypervisor filesystem.allowWrite support + resolved write-boundary logging (v0.28.6, v0.28.10) — AWF now logs the resolved filesystem write boundary before the guest VM boots, improving auditability of allowWrite configuration — useful context for troubleshooting ado-aw sandboxes.
• COPILOT_MODEL=auto support in AWF validation/api-proxy (v0.27.39) and a related warning when Codex uses auto under the AWF API proxy (v0.28.10, PR #7818) — relevant to ado-aw's engine.model handling if it ever surfaces auto as a model value.
• Orphaned fixed-name Docker network reclaim before compose up (v0.28.10, PR #7817) — improves reliability of AWF's compose-based topology bring-up; relevant to smoke-test flakiness triage.

Deprecations

• No explicit deprecation announcements (as opposed to outright removals) were found in this range; see Firecracker removal above under Breaking changes.

Generated by Dependency Version Updater · auto · 133.1 AIC · ⌖ 12.9 AIC · ⊞ 16.5K · ◷

[github-actions]

awf 0.28.9 → 0.28.10

Releases analyzed

• v0.28.10

Security fixes

• MCP gateway Authorization header contract hardened against workspace credential exposure (PR #7794, v0.28.10): the Authorization header contract used when talking to the MCP gateway was hardened and documented to prevent workspace credentials from being exposed. Worth double-checking ado-aw's MCPG wiring doesn't rely on the previous (looser) header behavior.
• Container cap_drop filtered against host capability bounding set (PR #7795, v0.28.10): fixes a case where AWF's container capability drop list could request dropping capabilities outside the host's bounding set, which could previously fail silently or behave inconsistently. Improves sandbox capability isolation guarantees that ado-aw's Agent stage relies on.

Notable features for ado-aw to adopt

• api-proxy CA certificate support (PR #7816, v0.28.10): AWF's api-proxy now supports configuring a CA certificate. This could let ado-aw route TLS-intercepted or custom-CA-signed traffic through AWF's proxy for permissions.read-gated Azure CLI / ADO REST access, if a future scenario needs it.

Deprecations

• None noted for this range.

Generated by Dependency Version Updater · auto · 157.2 AIC · ⌖ 5.45 AIC · ⊞ 16.5K · ◷

[github-actions]

awf 0.27.32 → 0.28.12

Releases analyzed

• v0.28.0
• v0.28.1
• v0.28.2
• v0.28.3
• v0.28.4
• v0.28.5
• v0.28.6
• v0.28.7
• v0.28.8
• v0.28.9
• v0.28.10
• v0.28.11
• v0.28.12

This range fully supersedes the 0.27.32 → 0.28.9 entry previously recorded on this issue; everything up to 0.28.9 is unchanged and repeated here for completeness, plus three new patch releases.

Breaking changes

• Firecracker microVM backend removed (v0.28.1, "ci: disable Firecracker workflows and release artifacts") — AWF has dropped Firecracker in favor of Cloud Hypervisor as the sandbox backend. ado-aw does not reference Firecracker directly, but any docs/runner-doctor guidance mentioning it upstream should not be assumed to apply going forward.

Security fixes

• Enforce filesystem allowWrite boundaries in AWF sandboxes (v0.28.5, #7634) — tightens write-path enforcement so sandboxed agents can only write within explicitly allowed paths.
• Route CLI artifact redirects through scoped Squid egress (v0.28.5, #7635) — CLI artifact download redirects are now proxied through Squid's domain-allowlist instead of bypassing egress controls, closing a potential egress-control bypass.
• fix: route CLI proxy through isolated egress relay (v0.28.2, #7338) — routes the CLI proxy through an isolated egress relay for DIFC credential isolation.
• fix(security): update vulnerable deps in agent and api-proxy images (#6505) — patches known CVEs in the agent/api-proxy container images.
• chore(deps): safe patch updates incl. ajv 8.20.0 security fix (#6962) — bundled ajv security patch.
• Harden and document the mcp gateway Authorization header contract against workspace credential exposure (v0.28.10, #7794) — clarifies/hardens how the MCP gateway Authorization header is handled to avoid workspace credential exposure; worth checking against ado-aw's MCPG --topology-attach wiring.
• Reclaim orphaned fixed-name Docker networks before compose up (v0.28.10, #7817) — reduces risk of stale-network reuse across runs.
• fix(cap-drop): filter container cap_drop against host capability bounding set (v0.28.10, #7795) — tightens container capability dropping to respect the host's bounding set.
• fix: drop CAP_NET_ADMIN from Cloud Hypervisor VMM (v0.28.11, #7887) — removes an unnecessary elevated capability from the Cloud Hypervisor VMM process.
• feat: verify Cloud Hypervisor runtime confinement / verify virtiofsd sandbox confinement before VM boot / isolate Cloud Hypervisor with per-run VMM identities (v0.28.11, #7889, #7890, #7894) — several hardening changes to the (preview) Cloud Hypervisor sandbox backend's isolation guarantees.
• feat: bind Cloud Hypervisor artifacts to attested release manifests (v0.28.11, #7891) — supply-chain hardening for Cloud Hypervisor artifact provenance.

Notable features for ado-aw to adopt

• Support compiler-authorized digest-pinned container image manifests (v0.28.4, #7601) — ado-aw could adopt this to pin AWF/MCPG/agent images by digest instead of tag for stronger supply-chain guarantees.
• feat: support secret-backed OpenAI-compatible targets (v0.28.3, #7576) — new API-proxy target type; relevant if ado-aw ever wants to support OpenAI-compatible engine backends secured via secret-backed credentials.
• API proxy: first-class AI-credit accounting for Copilot auto dynamic selector (v0.28.4, #7604) — improved cost/credit accounting when using Copilot's auto model selector, could inform ado-aw's engine cost-reporting/observability docs.
• Add api-proxy CA certificate support (v0.28.10, #7816) — allows configuring a custom CA for the api-proxy; relevant for enterprises with private-CA TLS interception, could be surfaced via engine:/network: front-matter.
• Warn when Codex uses auto under AWF API proxy (v0.28.10, #7818) — new diagnostic warning; ado-aw's engine validation could surface a similar hint for Codex users.
• Add protected enclave entry diagnostics (v0.28.9, #7772) — richer diagnostics for enclave entry; could improve ado-aw audit output for MCPG-routed enclaves.
• api-proxy: honour explicit `(redacted) scheme in target dialing (v0.28.11, #7868) — previously always dialed 443; relevant if ado-aw ever documents non-HTTPS proxy targets.

Deprecations

• Remove "bounded-query" terminology (#7735) — naming/terminology change in AWF docs/config; check for any ado-aw docs or config referencing the old term.
• Recompile enclave smoke with gateway key handoff (v0.28.10, #7763) — internal enclave key-handoff mechanism change; no direct ado-aw action expected but flagged for awareness given MCPG enclave routing dependency.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• index.crates.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "index.crates.io"

See Network Configuration for more information.

Generated by Dependency Version Updater · auto · 101.9 AIC · ⌖ 5.47 AIC · ⊞ 16.5K · ◷

[github-actions]

awf 0.27.32 → 0.28.13

Releases analyzed

• v0.27.33
• v0.27.34
• v0.27.35
• v0.27.36
• v0.27.37
• v0.27.38
• v0.27.39
• v0.27.41
• v0.27.42
• v0.27.43
• v0.27.44
• v0.28.0
• v0.28.1
• v0.28.2
• v0.28.3
• v0.28.4
• v0.28.5
• v0.28.6
• v0.28.7
• v0.28.8
• v0.28.9
• v0.28.10
• v0.28.11
• v0.28.12
• v0.28.13

This range fully supersedes the 0.27.32 → 0.28.12 entry previously recorded on this issue; everything through 0.28.12 is unchanged, plus one new patch release (v0.28.13).

Breaking changes

• Firecracker microVM backend removed (v0.28.1) — AWF dropped Firecracker in favor of Cloud Hypervisor as the sandbox backend. ado-aw does not reference Firecracker directly, but any docs/runner-doctor guidance mentioning it upstream should not be assumed to apply going forward.

Security fixes

• Enforce filesystem allowWrite boundaries in AWF sandboxes (v0.28.5, #7634) — tightens write-path enforcement so sandboxed agents can only write within explicitly allowed paths.
• Route CLI artifact redirects through scoped Squid egress (v0.28.5, #7635) — closes a potential egress-control bypass.
• Route CLI proxy through isolated egress relay (v0.28.2, #7338) — isolated egress relay for DIFC credential isolation.
• Harden mcp gateway Authorization header contract against workspace credential exposure (v0.28.10, #7794) — worth checking against ado-aw's MCPG --topology-attach wiring.
• Filter container cap_drop against host capability bounding set (v0.28.10, #7795) — tightens container capability dropping.
• Drop CAP_NET_ADMIN from Cloud Hypervisor VMM (v0.28.11, #7887).
• Cloud Hypervisor / virtiofsd confinement + per-run VMM identity isolation hardening (v0.28.11, #7889, #7890, #7894) — hardening for the preview Cloud Hypervisor sandbox backend.
• Bind Cloud Hypervisor artifacts to attested release manifests (v0.28.11, #7891) — supply-chain hardening.
• Patch vulnerable gRPC in GitHub CLI images (v0.28.13, #7997) — routine base-image CVE patch, no ado-aw config changes needed.

Notable features for ado-aw to adopt

• Compiler-authorized digest-pinned container image manifests (v0.28.4, #7601) — ado-aw could adopt this to pin AWF/MCPG/agent images by digest for stronger supply-chain guarantees, pairing well with ado-aw's supply-chain: provenance story.
• Secret-backed OpenAI-compatible API-proxy targets (v0.28.3, #7576) — relevant if ado-aw ever wants to support OpenAI-compatible engine backends.
• API proxy CA certificate support (v0.28.10, #7816) — could be surfaced via engine:/network: front matter for private-CA TLS interception.
• Warn when Codex uses auto under AWF API proxy (v0.28.10, #7818) — ado-aw's engine validation could surface a similar hint.
• Protected enclave entry diagnostics (v0.28.9, #7772) — could improve ado-aw audit output for MCPG-routed enclaves.
• api-proxy: honour explicit scheme in target dialing (v0.28.11, #7868) — relevant if ado-aw ever documents non-HTTPS proxy targets.

Deprecations

• Removed "bounded-query" terminology (#7735) — naming/terminology change in AWF docs/config; check for any ado-aw docs or config referencing the old term.

No new items were introduced by v0.28.13 beyond the routine gRPC CVE patch noted above under Security fixes.

Recorded automatically by the Dependency Version Updater workflow.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• index.crates.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "index.crates.io"

See Network Configuration for more information.

Generated by Dependency Version Updater · auto · 116.1 AIC · ⌖ 5.51 AIC · ⊞ 16.5K · ◷