• [ci] build: skip changelog from markdown link detection (#30426) via Connor Tumbleson (@iBotPeaches)
• [meta] validate the screengrab Gradle wrapper jars on CI (#30422) via Jerome Lacoste (@lacostej)
• [fastlane_core] spec fixtures: build the verify_build apps at spec time instead of committing them (#30421) via Jerome Lacoste (@lacostej)
• [fastlane] search plugins in bundler transitive dependencies as well (#20293) via Jerome Lacoste (@lacostej)
• [snapshot] remove ScreenshotRotate and ScreenshotFlatten, unused since 2015 (#30405) via Jerome Lacoste (@lacostej)
• [ci] release signed attested fastlane gem (#30416) via Connor Tumbleson (@iBotPeaches)
• [action] increment_build_number, increment_version_number: escape the number given to agvtool (#30406) via Jerome Lacoste (@lacostej)
• [action] sonar: escape the scanner's property values (#30409) via Jerome Lacoste (@lacostej)
• [ci] remove creation of fastlane/* tag (#30417) via Connor Tumbleson (@iBotPeaches)
• [ci] move to v0.8.0 of fastlane/github-actions (#30418) via Connor Tumbleson (@iBotPeaches)
• [resign] escape the version options (#30407) via Jerome Lacoste (@lacostej)
• [action] danger: escape the base, head, pr, danger_id and dangerfile values (#30408) via Jerome Lacoste (@lacostej)
• [core][produce][supply] remove classes no code uses (#30411) via Jerome Lacoste (@lacostej)
• [spaceship] remove TestFlight::AppTestInfo, its endpoint is gone (#30412) via Jerome Lacoste (@lacostej)
• [scan] deprecate TestResultParser, scan no longer uses it (#30413) via Jerome Lacoste (@lacostej)
• [docs] add the OpenSSF Scorecard badge to the README (#30414) via Jerome Lacoste (@lacostej)
• [ci] release step 1: declare the write permissions on its job (#30415) via Jerome Lacoste (@lacostej)
• [core] zip_directory: escape the paths it passes to cd, rm and zip (#30400) via Jerome Lacoste (@lacostej)
• [action] push_to_git_remote: escape push option values (#30401) via Jerome Lacoste (@lacostej)
• [action] sourcedocs: escape option values (#30402) via Jerome Lacoste (@lacostej)
• [action] set_pod_key: escape the key, value and project (#30403) via Jerome Lacoste (@lacostej)
• [action] oclint: analyse sources whose path has a space, and escape paths (#30404) via Jerome Lacoste (@lacostej)
• [action] verify_pod_keys: pass the key and target to pod keys as separate arguments (#30397) via Jerome Lacoste (@lacostej)
• [action] lcov, xcode_server_get_assets: deprecate, they no longer work with current Xcode (#30399) via Jerome Lacoste (@lacostej)
• [action] appium: start the server with its path, host and port as separate arguments (#30398) via Jerome Lacoste (@lacostej)
• [action] ensure_no_debug_code: escape the pattern, path and exclude pattern (#30396) via Jerome Lacoste (@lacostej)
• [deliver][snapshot][screengrab][scan] open HTML reports without a shell (#30395) via Jerome Lacoste (@lacostej)
• [action] xcodebuild: escape the build log path given to tee and cat (#30394) via Jerome Lacoste (@lacostej)
• [scan] escape values that were single-quoted in the test command (#30393) via Jerome Lacoste (@lacostej)
• [gym] escape values that were single-quoted in the build and package commands (#30392) via Jerome Lacoste (@lacostej)
• [action] nexus_upload: give curl the credentials on stdin, not on its command line (#30387) via Jerome Lacoste (@lacostej)
• [match] git storage: give a raw private key to ssh-add on stdin (#30382) via Jerome Lacoste (@lacostej)
• [ci] pin GitHub Actions to commit SHAs and default every workflow's token to read-only (#30371) via Jerome Lacoste (@lacostej)
• [snapshot][core] simulator commands: keep paths with spaces as one argument (#30391) via Jerome Lacoste (@lacostej)
• [gym] zip the dSYM when the archive name contains an apostrophe (#30390) via Jerome Lacoste (@lacostej)
• [action] install_xcode_plugin: deprecate, and download over HTTPS into a private temporary directory (#30377) via Jerome Lacoste (@lacostej)
• [action] splunkmint, apteligent: deprecate, their services were retired (#30385) via Jerome Lacoste (@lacostej)
• [core] sh: accept data for the command's standard input (#30386) via Jerome Lacoste (@lacostej)
• [scan] escape the build log path given to tee (#30389) via Jerome Lacoste (@lacostej)
• [core] fastlane_require: install only the gem that was asked for (#30383) via Jerome Lacoste (@lacostej)
• [action] import_from_git: mask git_extra_headers in the printed git command (#30384) via Jerome Lacoste (@lacostej)
• [match] git storage: pass the authorization header through git's environment (requires git 2.31+ with git_basic_authorization/git_bearer_authorization) (#30381) via Jerome Lacoste (@lacostej)
• [sigh] resign: stop when the ipa contains a link to a file outside it (#30380) via Jerome Lacoste (@lacostej)
• [action][pem][spaceship] replace fixed temporary names with mktmpdir (#30375) via Jerome Lacoste (@lacostej)
• [spaceship] keep the App Store Connect key cache in the user's fastlane directory (#30376) via Jerome Lacoste (@lacostej)
• [swift] Add Swift tests for the runner, and run them in CI (#30370) via Jerome Lacoste (@lacostej)
• [action] appaloosa: upload the binary over the presigned URL's scheme (#30372) via Jerome Lacoste (@lacostej)
• Make the Swift Package Manager runner work without SwiftShell (#29238) (#30075) via Wei (@wei18)
• [swift] Warn when the built FastlaneRunner is outdated (#30367) via Jerome Lacoste (@lacostej)
• [swift] Rebuild the runner when one of its Swift files changes, not only the Fastfile (#30366) via Jerome Lacoste (@lacostej)
• [meta] prefill the regression issue title and label instead of asking for it in the README (#30364) via Jerome Lacoste (@lacostej)
• [meta] migrate files out of root (#30351) via Connor Tumbleson (@iBotPeaches)
• [match, supply, zip] mark the options holding secrets as sensitive (#30363) via Jerome Lacoste (@lacostej)
• [internal] move the docs tooling from fastlane/helper to internal/docs (#30361) via Jerome Lacoste (@lacostej)
• [internal] check links in Markdown files in validate_docs (#30360) via Jerome Lacoste (@lacostej)
• [action] push_to_git_remote: push HEAD on a detached HEAD, not the local copy of CI's branch (#30346) via Jerome Lacoste (@lacostej)
• [docs] fix links to sections that no longer exist (#30359) via Jerome Lacoste (@lacostej)
• [core] name the option in the options table's mask, e.g. API_TOKEN_REDACTED (#30357) via Jerome Lacoste (@lacostej)
• [core] name the option in masked output, e.g. API_TOKEN_REDACTED (#30356) via Jerome Lacoste (@lacostej)
• [core] Mask sensitive values in everything fastlane prints (#30355) via Jerome Lacoste (@lacostej)
• [action] upload_to_testflight, upload_to_app_store: upload the binary gym built, not the newest one in the current directory (#30345) via Jerome Lacoste (@lacostej)
• [meta] remove danger (#30352) via Connor Tumbleson (@iBotPeaches)
• [core] use suggested ruby version instead of hard-coded version (#30350) via Connor Tumbleson (@iBotPeaches)
• [action] clean_build_artifacts: say that cert's private key and signing request are kept (#30347) via Jerome Lacoste (@lacostej)
• [meta] remove duplicate contact link for security submission (#30349) via Connor Tumbleson (@iBotPeaches)
• [docs] introduce SECURITY.md (#30348) via Connor Tumbleson (@iBotPeaches)
• [action] github_api, xcode_server_get_assets: skip SSL verification only for their own requests (#30342) via Jerome Lacoste (@lacostej)
• [action] say: speak apostrophes as written (#30341) via Jerome Lacoste (@lacostej)
• [fastlane] import_from_git: escape the branch when updating a cached clone (#30340) via Jerome Lacoste (@lacostej)
• [action] hg_commit_version_bump: pass a message containing quotes intact (#30339) via Jerome Lacoste (@lacostej)
• [core] remove contents of file(s) in fastlane env (#30338) via Connor Tumbleson (@iBotPeaches)
• [internal] Derive which cops the plugin template's RuboCop config drops (#30337) via Jerome Lacoste (@lacostej)
• [ci] Enable Security/Open (#30336) via Jerome Lacoste (@lacostej)
• [spaceship] Say why Apple refused to sign in, and send the refused sign-in once (#30320) via Jerome Lacoste (@lacostej)
• [docs] Add AGENTS.md, testing instructions for specs, and a code-review skill (#30334) via Jerome Lacoste (@lacostej)
• [docs] Testing.md: a spec for a fix has to fail without the fix (#30333) via Jerome Lacoste (@lacostej)
• [docs] Add Design.md, the conventions action changes are reviewed against (#30332) via Jerome Lacoste (@lacostej)
• [ci] Let RuboCop read its target Ruby from fastlane.gemspec (#30326) via Jerome Lacoste (@lacostej)
• [ci] Upgrade RuboCop to 1.91.0 (#30325) via Jerome Lacoste (@lacostej)
• [match] Stop the change_password spec writing to the developer's login keychain (#30328) via Jerome Lacoste (@lacostej)
• [ci] Build fastlane's own cops on RuboCop::Cop::Base (#30303) via Jerome Lacoste (@lacostej)
• [ci] prefix automated spec timings commit w/ [ci] (#30321) via Connor Tumbleson (@iBotPeaches)
• [core] Print the fastlane version, Ruby and install source at the start of each run (#30322) via Jerome Lacoste (@lacostej)
• [build] update to require_tools 0.3.0 (#30053) via Connor Tumbleson (@iBotPeaches)
• [register_device] action can run on macOS platform too (#21229) via Tony Li (@crazytonyli)
• Record the spec timings the split is balanced from (#30319) via github-actions[bot] (@github-actions[bot])
• [core][sigh][action] Decode provisioning profiles with Ruby's OpenSSL, without touching a keychain (#30317) via Jerome Lacoste (@lacostej)
• [match] Stop the read-only runner spec depending on the machine's keychain (#30314) via Jerome Lacoste (@lacostej)
• [ci] Stop naming the two deliberately invalid Ruby files .rb (#30313) via Jerome Lacoste (@lacostej)
• [ci] Keep the minimum Ruby in Fastlane::MINIMUM_RUBY, and check CI tests it (#30302) via Jerome Lacoste (@lacostej)
• [match] ask for the git branch during match init (#30297) via Hamza Naveed (@Hamza0101)
• [spaceship] Read the App Store Connect API key on every login, not from the cache first (#30296) via Jerome Lacoste (@lacostej)
• [spaceship] Show Apple's reason when it cannot start two-factor authentication (#30298) via Jerome Lacoste (@lacostej)
• [ci] Publish test coverage per tool as the job summary (#30295) via Jerome Lacoste (@lacostej)
• [tests] Remove unused WebMock stubs and fixtures (#30288) via Jerome Lacoste (@lacostej)
• [tests] Merge coverage across parallel workers, replace coveralls with SimpleCov 1.2 (#30290) via Jerome Lacoste (@lacostej)
• [tests] Report WebMock stubs that no example requests (#30287) via Jerome Lacoste (@lacostej)
• [core] Hide the loading indicator even when the work raises (#30279) via Jerome Lacoste (@lacostej)
• [ci] build: let Dependabot manage feature updates for GHA only (#30285) via Connor Tumbleson (@iBotPeaches)
• build(deps): bump naturally from 2.2.1 to 2.3.0 (#30277) via dependabot[bot] (@dependabot[bot])
• build(deps): bump mime-types from 3.5.2 to 3.7.0 (#30276) via dependabot[bot] (@dependabot[bot])
• build(deps): bump excon from 1.5.0 to 1.6.0 (#30274) via dependabot[bot] (@dependabot[bot])
• build(deps): bump aws-sdk-s3 from 1.212.0 to 1.232.1 (#30275) via dependabot[bot] (@dependabot[bot])
• build(deps): bump artifactory from 3.0.15 to 3.0.17 (#30273) via dependabot[bot] (@dependabot[bot])
• [xcodebuild] Pass build setting values to xcodebuild unchanged (#30282) via Jerome Lacoste (@lacostej)
• [security] Fix seven more CodeQL alerts (#30281) via Jerome Lacoste (@lacostej)
• [security] Fix the two critical CodeQL alerts (#30280) via Jerome Lacoste (@lacostej)
• [tests] Check that every Ruby version in CI meets the minimum (#30283) via Jerome Lacoste (@lacostej)
• build(deps): bump excon from 0.112.0 to 1.5.0 (#30270) via dependabot[bot] (@dependabot[bot])
• [notify] move to v3 of terminal-notifier (#30259) via Connor Tumbleson (@iBotPeaches)
• build(deps): bump yard from 0.9.42 to 0.9.44 (#30269) via dependabot[bot] (@dependabot[bot])
• [Ruby] Ruby 3.2 is now the minimum (dropping Ruby 3.1) (#30260) via Connor Tumbleson (@iBotPeaches)
• Render the team table from one ERB template (#30266) via Jerome Lacoste (@lacostej)
• [meta] feat: introduce alumni (inactive) team members (#30261) via Connor Tumbleson (@iBotPeaches)
• [scan] introduce option to reduce collecting diagnostics (#30258) via Connor Tumbleson (@iBotPeaches)
• Fix Raise typo in Device validation guard (#30255) via Ary Rabelo (@aryrabelo)
• [match][sigh][spaceship] add support for Apple offline provisioning profiles (#27547) via doronz88 (@doronz88)
• [produce] Support App Store Connect API key for create/enable_services/disable_services (#30158) via jakerenshawballys (@jakerenshawballys)
• [spaceship] Add support for domain association with Apple Pay merchant IDs, domain verify method(s) (#30230) via jack (@signalmoroll)
• Record the spec timings the split is balanced from (#30253) via github-actions[bot] (@github-actions[bot])
• [ci] Open a pull request with the recorded spec timings (#30252) via Jerome Lacoste (@lacostej)
• [tests] Rename WORKERS to FASTLANE_SPEC_WORKERS (#30251) via Jerome Lacoste (@lacostej)
• [ci] Run the random order split weekly, keep recording timings quarterly (#30250) via Jerome Lacoste (@lacostej)
• [tests] Add a rake task that runs spec files against each other to find races (#30246) via Jerome Lacoste (@lacostej)
• [tests] Report the slowest files and examples after a parallel run (#30245) via Jerome Lacoste (@lacostej)
• [tests] Stop cutting heavy spec files into runs of examples (#30247) via Jerome Lacoste (@lacostej)
• [tests] Stop two pty examples depending on what $? happens to hold (#30249) via Jerome Lacoste (@lacostej)
• [tests] Stop the frameit config spec depending on /tmp existing (#30248) via Jerome Lacoste (@lacostej)
• [docs] Say what CI runs, and catalogue the ways the split breaks specs (#30241) via Jerome Lacoste (@lacostej)
• [spaceship] Say what the initialize rule is actually protecting (#30238) via Jerome Lacoste (@lacostej)
• [spaceship] Record the platform Merchant and WebsitePush were fetched with (#30237) via Jerome Lacoste (@lacostej)
• [ci] Upload the worker logs on every run (#30235) via Jerome Lacoste (@lacostej)
• [spaceship] Assert the error class instead of negating a different one (#30234) via Jerome Lacoste (@lacostej)