cloudposse/atmos v1.234.0 on GitHub

📦 Other Changes

test: Improve coverage for mock AWS auth provider credential and identity flows @Copilot (#2511)

Expanded mock AWS authentication provider coverage for credential expiration, identity validation, environment projection without secret leakage, credential persistence and loading errors, provider resolution, and idempotent logout behavior.

feat: add plugin distribution and verification services @osterman (#3457)

Adds native plugin distribution and verification services for catalogs, discovery, installation, lockfiles, package management, signing, signature verification, authentication adapters, and structured output. Packages are verified before installation, archive and alias conflicts are rejected, configuration updates remain transactional, and compatible variants are preserved for cached and offline restores.

feat: add plugin bootstrap and authoring services @osterman (#3458)

Adds plugin bootstrap and authoring services, including configuration-driven build, scaffold, conformance, OIDC, protocol-generation, and output-formatting support. Plugin installations preserve configured entrypoint names and permissions, reject collisions, and retain recovery artifacts when rollback cannot complete.

feat(cli): add discovery metadata for core commands @osterman (#3466)

Adds command-owned documentation URLs and ordered example metadata to the CLI command registry, with independently inherited documentation and examples and preserved source metadata for aliases.

feat(cli): add discovery metadata for supporting commands @osterman (#3467)

Registers documentation URLs and ordered examples for supporting commands, including authentication, AI/MCP, Git, toolchain and version management, secrets, and developer utilities. Nested commands own their metadata, while commands without dedicated pages inherit their parent documentation.

docs: demonstrate CI failure annotations locally @osterman (#3472)

Adds a runnable local preview to the CI failure annotations documentation, showing the generated annotation, intentional exit code 77, and early admission behavior.

fix(ci): stabilize quality reporting and CI dependencies @osterman (#3476)

Quality reporting now selects the newest CI and Codecov checks, publishes a pending snapshot followed by the final report, recovers unfinished reports and long-running reruns, and groups results into Readiness, Reviews, and Measures. It also improves retry handling, artifact downloads, network checks, and local fixtures for CI-dependent checks.

Add runnable CDK examples with casts for the CDK tutorial @osterman (#3481)

Adds runnable CDK examples for CloudFormation and Terraform using the native components and the local Floci AWS emulator, so they do not require an AWS account. The examples include fresh-once install hooks, lifecycle casts, smoke tests, and links from the CDK tutorial.

Clean up stale overrides in copyable Atmos examples @osterman (#3485)

Removes incidental logging, redundant approval and initialization settings, and global auto-approval overrides from copyable Atmos examples while retaining required configuration and intentional demonstrations. Quick-start guidance and generated configuration snapshots are updated for current defaults.

Reconcile bundled skills and command documentation @osterman (#3491)

Reconciles bundled skills and command documentation with current behavior, including workflow prerequisites, toolchain aliases, OCI examples, backend inspection, authentication restrictions, retry fields, and executable selection. Unsupported command examples are removed and curated executable checks are added.

chore(review): encourage extracting legacy catch-all packages @osterman (#3521)

Adds CodeRabbit path instructions encouraging touched behavior and tests to be extracted into their owning packages, with thin adapters where needed.

chore: bump Claude Code plugin version to v1.233.2 @cloudposse-releaser[bot] (#3528)

Bumps the Claude Code plugin version to v1.233.2.

fix(release): recognize landed native stack members @osterman (#3536)

Release history now recognizes a native stack member when its merge commit is present in the verified release source range, even if GitHub retains the original parent branch as the pull request base.

fix(ci): re-check quality:ready PRs whose head status fails @osterman (#3539)

The scheduled Quality Gate reconciler now re-evaluates a quality:ready pull request when its combined head status is failure or error, even if the report is current and the commit is older than 24 hours.

fix(ci): select current workflow results in quality gate @osterman (#3540)

Quality Gate now selects the newest run of duplicate workflows by creation time and run ID, and excludes GitHub Actions checks only when their check-suite ID identifies a superseded run. Current failures, pending runs, unknown suites, external checks, and synthetic merge-commit checks remain enforced.

fix: plugin release inputs and changelog release badge @osterman (#3554)

Removes the repository root go.mod from the auth-secrets plugin release inputs and bumps that plugin to 1.0.1 once. Changelog posts now show a release badge from frontmatter, detected release data, or Unreleased, and the CDK hooks post gains its missing cast metadata.

docs: add plugin pages and fix CI network checks @osterman (#3575)

Adds /plugins and /plugins/official documentation pages with navigation, quick-start guidance, and official package details. CI network diagnostics now allow StepSecurity up to 60 seconds to initialize and recognize exact eBPF DNS rejection events.

fix(release): group release preview issues by release-notes category @osterman (#3577)

Release preview issues now group milestone pull requests under the same release-note categories and ordering as published releases, sorting pull requests by number within each category.

fix(ci): stop the Quality Gate from blocking on unapproved signal runs @osterman (#3583)

Quality Gate no longer treats Quality Gate Signal runs as CI evidence at their trigger events, and legacy reports blocked by those runs are re-evaluated once. action_required results remain blocking but now direct users to approve waiting workflows.

fix(release): resolve merge-queue commits GitHub left unmerged @osterman (#3613)

Release milestone checks and release planning can resolve a merge-queue commit that GitHub left unmerged by using the pull request number in a GitHub-signed web-flow commit subject targeting the default branch. Direct, unsigned, malformed, unrelated, and unknown commits continue to fail closed.

chore(docs): refresh CLI screengrab casts, batch 2 of 3 @osterman (#3628)

Regenerates the second batch of CLI screengrab casts so the docs player types atmos <command> and reflects current help output.

fix(cast): validate screengrab casts record the program name @osterman (#3629)

Regenerates the final batch of CLI screengrab casts and makes atmos --chdir=demo/casts casts validate screengrabs cli reject cast headers whose command does not match the manifest command, with documented exceptions for --help=all and atmos about --help.

✨ Features

feat(cast): interpret VHS tapes and add atmos cast record @osterman (#2889)

Atmos cast steps can now interpret VHS tapes supplied inline or through tape_file, in steps mode for real command exit codes or session mode for PTY playback. Adds atmos cast record <input.tape>, configurable shell_init, shell selection, waits, screenshots, VHS directives and key handling, while preserving literal typed text and safe output behavior.

Migrate templates to gomplate v5 and drop AWS SDK for Go v1 @osterman (#3036)

Migrates template rendering to gomplate v5 and removes the AWS SDK for Go v1 dependency, with compatibility shims for affected v3 names and datasource behavior. It also moves template APIs into pkg/template and documents behavior changes such as conversion errors, datasource paths, Vault and SSM values, S3 checksums, and the env:NAME syntax.

Add stack planning, selectors, CI, and directory scaffolding @osterman (#3429)

Adds atmos stack plan and stack test, stack-wide and component selectors, --dry-run, lifecycle introspection commands, CI reporting, authentication preflight, and interactive selection. stack create --target can now render one or more decomposed stack directories while preserving scaffold inputs, validation, exclusive writes, and rollback.

feat(cast): Starlark cast recorder, script source, and CI cast checks @osterman (#3431)

Adds cast.recorder(...) for Starlark scripts, allowing one declaration to execute commands, generate casts, or validate saved casts against a fingerprint. Script steps can read local sources, session waits no longer match typed command echoes, YAML hide/show and VHS session actions execute correctly, and CI validates all committed casts.

Add stack lifecycle orchestration and scaffold creation @osterman (#3442)

Adds dependency-aware atmos stack deploy and stack destroy, plus scaffold-backed single-file stack create. Hook declarations are validated against registered lifecycle events for current editions, while scaffold planning remains quiet and reports generation failures with recovery guidance.

Add safe Doctor migrations and fix nested error rendering @osterman (#3454)

Adds safe Doctor migrations for legacy naming patterns and tokens, gated by before-and-after identity checks. It also supports global workspace templates, preserves terminal color through wrappers, improves nested error rendering, and moves hook dispatch logs to Debug.

feat: enable native Go plugins and OIDC authentication @osterman (#3459)

Enables native Go plugins, OCI identity support, plugin startup integration, policy checks, OIDC authentication, and plugin build --platform or --all-platforms. Policy reports preserve JSON field names and embedded objects across YAML output, and plugin commands support multi-platform builds with partial-success reporting.

feat(policy): add validation engines and shared runtime context @osterman (#3461)

Adds native OPA and JSON Schema validation engines with shared environment, runtime, version, FIPS, calendar, and CI evidence context. It also adds deployment and authentication guardrails, common checks, reference documentation, and migration guidance.

fix(yaml): require explicit function tags with edition compatibility @osterman (#3463)

Unpinned configurations and editions from 2026-10-20 now require explicit YAML function tags, preserving tag identity through loading, merging, templates, deferred evaluation, and serialization. Legacy behavior remains available with edition: "2026-10-19", while quoted strings such as "!env SOMETHING" remain literal.

feat(cli): add --docs and --example command discovery @osterman (#3468)

Adds command help documentation links plus global --docs, --docs=md/--docs=markdown, and --example discovery. The CLI can open or render documentation, select and initialize examples with safe overwrite confirmation, and perform discovery before ordinary validation, even outside an Atmos project.

Add Fogg migration and CDK guides with CloudFormation improvements @osterman (#3471)

Adds Fogg migration, AWS CDK, and CDK Terrain guides, along with CloudFormation synthesis improvements. Synthesis hooks run before generated files are read, and CloudFormation supports inherited region and duration-based timeout settings with Doctor migrations.

feat: conditional stack imports and tagging tutorials; fix deferred rendering @osterman (#3473)

Adds conditional stack imports using when, allowing labels and tags to select optional mixins and work with selectors such as atmos list instances --tags pci and --labels pci:true. It also fixes deferred rendering beneath YAML function overrides and expands tagging and scaffolding tutorials.

Validate merged stack auth and preserve secret discovery safety @osterman (#3487)

Adds auth validate --stack with optional --component to validate merged component authentication configuration while retaining strict global validation. Secret discovery remains lazy, default GCP ADC is supported, and the first SOPS write after key generation is repaired.

Generalize component executable overrides and execution flags @osterman (#3488)

Adds consistent --command support to Terraform, Helmfile, Packer, and Ansible while preserving compatibility flags and precedence. Helmfile dry-run behavior, global options, and stderr forwarding are also corrected.

Fix source handling and add backend and alias inspection @osterman (#3490)

Adds atmos toolchain aliases for sorted table or JSON/YAML inspection of effective aliases, and atmos terraform backend list and describe for static merged backend configuration inspection without authentication or expression execution. It also fixes source handling, registry queries, vendor targets, Git detection, inherited version edits, and OCI whiteout extraction.

Run repository checks through Atmos Git hooks and Starlark @osterman (#3494)

Replaces the pre-commit framework with a shared YAML and Starlark suite used by Git hooks, repository checks, formatting, CI, and autofix. Native Git sandboxes, atomic writes, staged-edit preservation, bounded copying, and terminal-aware progress are included.

feat(starlark): add modules, records, and typed configuration @osterman (#3505)

Adds module.load(path) and struct(**fields) to automation scripts, with cached imports, frozen exports, cycle detection, cancellation, and parallel loading. Typed configuration loading and validation support local or HTTPS JSON Schemas, defaults, bounds, optional fields, lists, enums, source diagnostics, immutable records, and config1.merge(config2).

feat(plugins): add public releases, catalog, and auth-secrets @osterman (#3510)

Adds public OCI plugin releases, catalog discovery, and the independently versioned cloudposse/auth-secrets package. New commands include plugin release, release plan, test --build --coverprofile, verify-public, and catalog sync --inventory, with native workflows for signing, verification, publication, and catalog reconciliation.

feat(starlark): add stdin, file writes, and script-local OS controls @osterman (#3526)

Adds stdin= to exec.run, component.exec, and Atmos wrappers for exact byte input without shell arguments, plus the predeclared os module with environment, directory, platform, and architecture access. Scripts can use invocation-local os.setenv, os.chdir, and fs.write_file, which creates exclusively by default and preserves permissions when overwriting.

feat(yaml): support bounded parallel exec evaluation @osterman (#3527)

Adds settings.functions.exec.max_concurrency to bound concurrent evaluation of ordinary !exec expressions while preserving document positions, decoding, and --skip=exec. Failed evaluations cancel outstanding commands, policy checks run before launch, and the default value 1 preserves serial behavior.

Add conditional retries for component error events @osterman (#3542)

Adds action: retry policies for component error events across Terraform/OpenTofu, Helmfile, Packer, Ansible, native providers, containers, and emulators, with predicates, aliases, schemas, diagnostics, and independent retry settings. Windows AWS credential and configuration updates are serialized, and screengrab recordings stage temporary files on the destination filesystem.

feat: native Vault identities and explicit credential templates @noeljackson (#3557)

Vault and OpenBao stores can now consume VAULT_TOKEN from a configured native Atmos identity, while auth-secrets can read named credentials with store, path, and optional exact top-level field references. secrets/env identities render explicit spec.env templates after authentication with masking, size and NUL checks, no ambient process access, and serialized credential operations.

🐛 Bug Fixes

fix(ai): use provider default models in --ai config hints @pcbeingused333 (#3413)

AI setup hints now read each provider's DefaultModel, including Anthropic, Bedrock, Gemini, Ollama, and Grok, instead of maintaining a separate hardcoded list. The Anthropic configuration hint therefore uses the provider's current default model.

fix(include): resolve base_path before the working directory @djal (#3426)

!include and !include.raw now resolve bare relative paths against base_path before the working directory, while ./ and ../ paths remain relative to the including manifest and no longer fall back elsewhere.

test: cover a stack-wide terraform_workspace_template, list it in metadata docs @bercedev (#3453)

Adds end-to-end support for stack-wide terraform_workspace_template, including validation and propagation into Terraform component metadata, and documents it among the supported global metadata fields.

refactor: establish shared API and native plugin SDK @osterman (#3455)

Establishes the shared Atmos API, standalone Go plugin SDK, protocol bindings, native transport, and manifest/configuration primitives while preserving existing pkg/automation imports through deprecated aliases. Native plugin variants are selected by compatible immutable build metadata without OS or architecture fallback.

fix: unify credential handling and OCI registry access @osterman (#3456)

Adds shared extension registry, OCI registry, authentication, credential, and policy primitives for the plugin distribution layer. Credential publication and logout cleanup are serialized, nested registry-auth deadlocks are prevented, GHCR token priority is preserved, and large race-enabled packages receive bounded test budgets.

fix(terraform): run lifecycle hooks in prepared workdirs @osterman (#3462)

Restores Terraform destroy and per-component lifecycle hooks for bulk init and test runs, executing them in prepared work directories with resolved paths and credentials. Tool-version discovery is scoped to each project, and test fixtures can start before emulator authentication without being overwritten.

fix: preserve Helm repository auth and AWS ambient context @osterman (#3470)

Native Helm operations now preserve repository credentials, TLS options, and credential-forwarding policy through chart lookup and installation. AWS ambient authentication context is populated while preserving SDK discovery, AWS_PROFILE, and explicit managed credential overrides.

Preserve literal values and diagnose YAML function scope @osterman (#3486)

Preserves literal YAML values through loading, merging, templates, and output while preventing static diagnostics from executing functions or fetching inputs. Stack random and cwd evaluation works again, Doctor diagnoses unsupported function locations, and plugin archive inventory validates host-local paths.

Fix runtime evaluation and command execution boundaries @osterman (#3489)

Preserves saved plans during inspection and restores single-component destroy CI output, while correcting custom-command boundaries, devcontainer settings, MCP exports, schema flags, Ansible paths, workflow directories, retry defaults, SBOM discovery, and native Helm handling. CI-mode configuration reads are synchronized with theme updates.

fix(helmfile): colorize diff output by default on a TTY @STiFLeR7 (#3498)

atmos helmfile diff now enables color on a capable terminal when Atmos color detection allows it, without overriding an explicit HELM_DIFF_COLOR value from the shell, component, or stack environment.

fix: upgrade Node.js to 24.22.1 and Go to 1.26.10 for CVEs @osterman (#3502)

Updates the AWS SAML Playwright runtime and website to Node.js 24.22.1, upgrades patched website dependencies, and moves the website from Node 25 to the active LTS line. Go is updated to 1.26.10 for the crypto/x509 security fix.

fix(stacks): resolve inherited metadata.component directories @osterman (#3508)

Resolves inherited metadata.component before backend generation while preserving explicit overrides, legacy selection, and disabled metadata inheritance. This fixes component directory selection and affected-component detection for inherited metadata.

build: streamline releases and pin GitHub Actions runners @osterman (#3509)

Reduces published binaries and Linux packages to six supported targets and documents source installation for retired targets. It also adds resumable release recovery with atmos release cut --resume, updates Quality Gate evidence selection, preserves Git sandbox metadata, and makes shared Git hooks select the current checkout's build/atmos.

fix(terraform): propagate skipped functions to nested lookups @osterman (#3513)

Terraform dependency lookups now preserve evaluation options such as --skip=secret, preventing nested output and state evaluation from contacting skipped secret providers. Caches are partitioned by skip list.

fix(terraform): run tests without generating a backend @osterman (#3514)

Terraform tests no longer generate a backend file when auto_generate_backend_file is enabled, so provider-free test modules run without a backend configuration and existing backend files remain unchanged.

fix(secret): honor scoped providers during key generation @osterman (#3515)

atmos secret keygen -s <stack> now resolves stack and component-type providers without evaluating secret values, including provider-only stacks with imported or templated configuration. Explicit component and type selections still fail when no matching component exists.

fix(sops): resolve nested recipient files and relative rules @osterman (#3516)

SOPS discovery now finds nested .sops.yaml recipient files and generates matching repository-relative rules for relative and absolute paths on Unix and Windows. Omitted spec.file values derive wildcard rules from the configured secrets directory.

fix(secret): allow stack secrets without a component @osterman (#3517)

atmos secret set and validate now support stack-scoped declarations without a component, while instance-scoped operations continue to require one. Shared declarations are validated consistently across inherited contexts.

fix(commands): honor stack on custom Atmos steps @osterman (#3518)

Custom Atmos steps now pass their rendered stack value to child commands when no explicit stack flag is present, placing it before passthrough -- and preserving explicit flags such as -sprod.

fix(emulator): validate the Kubernetes API port before startup @osterman (#3519)

Emulator specification validation now rejects Kubernetes configurations that replace container.ports without retaining the API port 6443/tcp, preventing startup with no usable Kubernetes API endpoint.

fix(ui): render email autolinks once and clarify test behavior @osterman (#3520)

Terminal email autolinks in ui.* messages are rendered once, and documentation now clarifies --help=all, stack-variable injection, and retained Terraform test files.

fix(sops): restore missing recipients from existing age keys @osterman (#3522)

SOPS key generation can recover a missing public recipient from an existing age private key without changing private key material, while preserving existing recipient rules and rejecting ambiguous identities.

fix(ui): don't mangle list markers and emails in ui.* messages @osterman (#3524)

Starlark ui.info, ui.success, and ui.warning now preserve Markdown list markers, nested indentation, wrapped layout, and single-rendered email addresses in terminal and toast output. Literal list markers can be escaped with ui.info("1\\. literal").

feat(duration): human-readable minutes/hours in resource-usage summary @osterman (#3529)

Resource-usage summaries now format durations of at least one minute as combined units such as 34m 47s or 1h 2m 3s, while retaining millisecond and second formats for shorter values. Values near a minute round to 1m instead of 60.0s.

fix(security): reduce scanner noise and patch dependencies @osterman (#3541)

Reduces security scanner noise for same-repository actions, reports security backlogs by scanner, and upgrades Go and selected dependencies for security fixes. Terraform hook test state is restored to prevent shuffled-suite interference.

fix(auth): isolate store identity auth from the component manager @osterman (#3546)

Adds AuthenticateIsolated to authenticate store identities on a separate manager without changing the caller's identity chain, stack information, or credentials. AWS, Azure, and GCP store bridges use the isolated context, preventing store authentication from changing subsequent component state or secret lookups.

fix(ai): default Gemini to gemini-3.8-flash @pcbeingused333 (#3553)

Changes the Gemini provider default model to gemini-3.8-flash; the TUI fallback list, --ai setup hints, function-calling hint, and provider documentation follow the new default.

fix(imports): support oci:// in stack and atmos.yaml imports @osterman (#3556)

Stack manifests and atmos.yaml imports now support oci://host/repo:tag//path for files, directories, and globs, including nested_imports: remote, cached pulls, and documented registry authentication. Shared remote-import caching also preserves file extensions and refreshes stale copies after a source is re-pulled.

fix(ai): report cached prompt tokens for OpenAI-compatible providers @pcbeingused333 (#3565)

OpenAI-compatible AI providers now report cached prompt tokens from usage.prompt_tokens_details.cached_tokens in atmos ai usage output and the executor's usage data.

fix(ai): send max_completion_tokens for OpenAI o-series and gpt-6 models @pcbeingused333 (#3566)

OpenAI-compatible clients now send max_completion_tokens for o-series models and gpt-6* models, while models such as Ollama names beginning with o continue to use max_tokens.

fix(ai): apply max_tokens to Gemini requests @pcbeingused333 (#3567)

Gemini requests now send ai.providers.gemini.max_tokens as generationConfig.maxOutputTokens across regular and tool-calling requests. A zero value leaves the model default; otherwise the documented default of 8192 applies when no value is configured.

fix: stabilize CI and clarify script failures @osterman (#3569)

Stabilizes CI and runtime diagnostics by preserving workflow environments, recognizing StepSecurity eBPF enforcement, warming native CI caches with Floci, refreshing website-deployment credentials, and handling already-merged milestone entries. It also clarifies intentional Starlark failures and formatting guidance.

Restore bulk Terraform plan summaries and enforce size limits @osterman (#3580)

Bulk Terraform plans now restore template-based summaries for every executed component, including no-change plans, with shared duration formatting. Aggregate reports and masked summary-file writes are bounded, and oversized output produces a deduplicated warning recommending --tags or --labels.

fix: upgrade regressions in YAML functions, store hooks, custom flags @osterman (#3584)

YAML function values now resolve inside template strings such as app-{{ .vars.region }}, with clear errors for unresolved maps, lists, and rewritten function values. Store hooks skip missing Terraform outputs during destroy with a warning, and custom commands may declare --example and --docs flags of any type.

fix(ai): default Anthropic and Bedrock to Claude Sonnet 5 @pcbeingused333 (#3585)

Anthropic and Bedrock now default to Claude Sonnet 5 using claude-sonnet-5 and global.anthropic.claude-sonnet-5. Requests omit a thinking override so model defaults apply, including adaptive thinking where supported.

fix(terraform): inject Atmos Auth credentials into terraform shell @osterman (#3604)

atmos terraform shell now runs the Atmos Auth Terraform pre-hook before backend and environment setup, injecting identity credentials such as AWS_PROFILE, credential-file paths, and region settings into Terraform initialization and the interactive shell. Authentication failures stop shell setup.

fix: repair plugin publication and AI release previews @osterman (#3605)

Plugin and catalog publication now uploads before --verify-public, with actionable GHCR visibility guidance and safe retries. Milestone release previews use AI summaries, forward the API key through the trusted workflow, and reuse unchanged previews.

fix(terraform): show Terraform's error when workspace setup fails @osterman (#3610)

Terraform workspace setup errors now include Terraform's output from both workspace select -or-create and the workspace new fallback, along with the workspace name and guidance to check backend credentials or rerun with ATMOS_LOGS_LEVEL=debug.

fix(list): escape CSV/TSV cells in list vendor output @pcbeingused333 (#3616)

atmos list vendor --format csv|tsv now quotes cells containing delimiters, quotes, or newlines, keeping multi-value tags and other fields in their correct columns.

fix(secret): run every secret command on stack-scoped secrets @osterman (#3618)

Secret commands including get, delete, import, pull, push, exec, and shell now accept --stack alone for stack-scoped and global secrets. Whole-stack operations exclude instance secrets, while commands that cannot resolve a shared scope require --component or prompt for one on a terminal.

fix(pro): keep the error message in reported exceptions @osterman (#3619)

Exceptions reported to Atmos Pro now retain the masked failure message, prefixed with the failed command and limited to 8 KiB on a rune boundary; nil event information no longer causes a panic. The CI hardening allowlist also removes obsolete Trivy hosts.

fix(auth): retry the GitHub OIDC token request and reuse the JWT per process @mtb-xt (#3621)

GitHub OIDC token requests now retry timeouts, network errors, HTTP 429, and HTTP 5xx responses up to four times with exponential backoff. A valid JWT is reused in memory per process and request identity while its exp claim is more than 60 seconds away; tokens are never persisted.

fix(cast): record the program name in cast headers @osterman (#3627)

Cast headers now record the program name, so auto-recorded commands such as atmos --help display correctly in the docs player. The first batch of CLI screengrabs is regenerated, and stacked-branch file-limit checks compare against the configured stack base.

feat(website): render GitHub-style alerts as admonitions @osterman (#3631)

Documentation and changelog Markdown now convert GitHub-style alerts such as > [!NOTE], > [!WARNING], and > [!CAUTION] into native Docusaurus admonitions; CAUTION maps to the danger style.

fix(ai): count Gemini thinking tokens in output usage @pcbeingused333 (#3632)

Gemini usage accounting now adds thoughtsTokenCount to candidatesTokenCount, so thinking tokens are included in completion usage for streaming and vision requests.

fix(ci): find the merged PR's stored plan when deploying a squash commit @osterman (#3636)

atmos terraform deploy now falls back to the head commit of the merged pull request when locating a stored plan for a squash, merge-commit, rebase, or merge-queue commit, while preferring a plan stored for the deployed commit. The fallback validates the merged PR and warns when pull-requests: read permission is missing.

fix: regressions found in v1.234.0-rc.1 @osterman (#3637)

Fixes v1.234.0-rc.1 regressions in describe stacks, describe affected, and list instances performance, sends legacy stack get|set|delete|format deprecation notices to stderr, improves missing-include path diagnostics, and restores !ci.labels [list] in locals:.

fix: address review follow-ups for the v1.234.0-rc.1 regression fixes @osterman (#3638)

Completes follow-up fixes for the v1.234.0-rc.1 regressions: restored !ci.labels values are no longer re-decoded, missing-include hints preserve queries and | eval, template-manifest errors retain wrapped details, and Gomplate experimental functions enabled upstream are available.

🤖 Automatic Updates

chore(deps): bump github.com/posthog/posthog-go from 1.12.6 to 1.17.4 @dependabot[bot] (#2764)

Updates github.com/posthog/posthog-go from 1.12.6 to 1.17.4, including fixes for duplicated distinct_id values, retries for transient feature-flag requests, improved capture error reporting, opt-in Analytics V1 capture, and additional compression options.

chore(deps): update dependency @types/node to v22.20.5 @renovate[bot] (#3422)

Updates the website's @types/node dependency from 22.20.4 to 22.20.5.

chore(deps): update dependency tsx to v4.23.15 @renovate[bot] (#3423)

Updates tsx from 4.23.13 to 4.23.15, including fixes for bare built-in namespace inheritance, CommonJS require.cache and require.extensions, and portable namespaced register() declarations.

build(deps): bump al.essio.dev/pkg/shellescape from 1.6.0 to 1.6.1 @dependabot[bot] (#3425)

Updates al.essio.dev/pkg/shellescape from 1.6.0 to 1.6.1.

chore(deps): update dependency prettier to v3.9.10 @renovate[bot] (#3507)

Updates Prettier from 3.9.9 to 3.9.10, including a Markdown table parsing fix in micromark-extension-gfm-table.

chore(deps): bump golang.org/x/tools from 0.51.0 to 0.52.0 in /tools/lintroller @dependabot[bot] (#3534)

Updates golang.org/x/tools from 0.51.0 to 0.52.0.

chore(deps): bump golang from 1.27.1 to 1.27.2 in /.devcontainer @dependabot[bot] (#3558)

Updates the Go base image used by .devcontainer from 1.27.1 to 1.27.2.

chore(deps): bump github.com/aws/aws-sdk-go-v2 from 1.47.1 to 1.47.3 @dependabot[bot] (#3559)

Updates github.com/aws/aws-sdk-go-v2 from 1.47.1 to 1.47.3, including regenerated clients and a newer smithy-go sparse-in-dense fix.

chore(deps): bump github.com/PuerkitoBio/goquery from 1.12.0 to 1.13.0 @dependabot[bot] (#3560)

Updates github.com/PuerkitoBio/goquery from 1.12.0 to 1.13.0, adding the top-level goquery.Text helper and performance improvements.

fix(deps): update github.com/cyberphone/json-canonicalization digest to 32a4819 @renovate[bot] (#3572)

Updates the github.com/cyberphone/json-canonicalization dependency to commit 32a4819.

chore(deps): update actions/upload-artifact action to v7.0.2 @renovate[bot] (#3574)

Updates actions/upload-artifact from v7.0.1 to v7.0.2, improving artifact download retries for HTTP 429 responses and honoring valid Retry-After headers.

chore(deps): bump github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi from 1.39.0 to 1.41.4 @dependabot[bot] (#3597)

Updates the AWS Resource Groups Tagging API client from 1.39.0 to 1.41.4.

chore(deps): update step-security/harden-runner action to v2.22.1 @renovate[bot] (#3601)

Updates step-security/harden-runner from v2.22.0 to v2.22.1, fixing security-rule initialization and GHES connectivity on self-hosted runners.

fix(deps): update module github.com/agnivade/levenshtein to v1.2.2 - abandoned @renovate[bot] (#3608)

Updates github.com/agnivade/levenshtein from v1.2.1 to v1.2.2.

chore(deps): update step-security/harden-runner action to v2.22.2 @renovate[bot] (#3612)

Updates step-security/harden-runner from v2.22.1 to v2.22.2, correcting macOS ingress classification and Linux endpoint handling while improving network and DNS tracing.

fix(deps): update module github.com/bmatcuk/doublestar/v4 to v4.10.3 @renovate[bot] (#3615)

Updates github.com/bmatcuk/doublestar/v4 from v4.10.0 to v4.10.3, fixing case-insensitive character ranges, Windows junction traversal, and brace alternatives containing character classes.

fix(deps): update go.starlark.net digest to 4f4267f @renovate[bot] (#3622)

Updates the go.starlark.net dependency to commit 4f4267f.