Security
- Update Tokio to 1.53.3 for the AsyncFd I/O-safety advisory (RUSTSEC-2026-0386).
- Update rustls-webpki to 0.103.16 and webpki-root-certs to 1.0.10 to reject distrusted emSign certificate chains (RUSTSEC-2026-0382, RUSTSEC-2026-0383).
- Update the website's follow-redirects lockfile to 1.16.1 (GHSA-q3jh-wrc6-jgq8, GHSA-8r9p-f939-6h3c).
Fixed
- PE-006 checks native AGENTS.md when Claude Code is explicitly selected, including mixed-tool runs. Unscoped shared files retain their existing checks. The warning identifies Claude prompting guidance. (#1705)
- Windows rooted paths in OpenCode instructions and Gemini extension commands follow Node path semantics. Path-sensitive tests use native locations and separator-independent comparisons.
- CC-AG-003 follows the current sub-agents reference. A subagent
modelissonnet,opus,haiku,fable, aclaude-*model ID, orinherit.default,best,opusplan,sonnet[1m], andopus[1m]stay valid on skills and are rejected on subagents.
Changed
- Update serde_json, schemars and toml, and refresh the Claude Code, setup-node and download-artifact action pins with their documentation.
- Cursor release baseline is 3.25.9. The stable endpoint returned a version marker only. The public changelog since 3.24.18 does not change rules, hooks, or MCP schema.