cloudposse/atmos v1.234.0-rc.1 on GitHub

📦 Other Changes

test: Improve coverage for mock AWS auth provider credential and identity flows @Copilot (#2511)

Expanded mock AWS authentication coverage for credential expiration, environment projection without secret leakage, validation, identity metadata, provider resolution, environment preparation, persisted credential loading, missing or invalid credential files, and idempotent logout removal.

feat: add plugin distribution and verification services @osterman (#3457)

Added plugin distribution and verification services for catalogs, discovery, installation, lockfiles, package management, signing, signature verification, authentication adapters, and structured output. Packages are verified before installation, archive and alias collisions are rejected, configuration updates remain transactional, and compatible variants are preserved for installation, cache verification, signatures, and offline restores.

feat: add plugin bootstrap and authoring services @osterman (#3458)

Added plugin bootstrap and authoring services, including configuration-driven build, scaffold, conformance, OIDC, and output workflows. Plugin installation preserves entrypoint names and permissions, rejects collisions, and rolls back incomplete installs while retaining recovery artifacts when cleanup cannot finish.

feat(cli): add discovery metadata for core commands @osterman (#3466)

Added command-owned documentation URLs and ordered example metadata to the command registry, with independently inherited documentation and examples and metadata preserved for aliases across core commands.

feat(cli): add discovery metadata for supporting commands @osterman (#3467)

Registered documentation URLs and ordered examples for supporting commands, including authentication, AI/MCP, Git, toolchain and version management, secrets, and developer utilities. Nested commands can own metadata while commands without dedicated pages inherit their parent documentation.

docs: demonstrate CI failure annotations locally @osterman (#3472)

Added a runnable local preview to the CI failure annotations documentation, showing the generated annotation, intentional exit code 77, and early admission behavior.

fix(ci): stabilize quality reporting and CI dependencies @osterman (#3476)

Updated quality reporting to select the newest CI and Codecov checks, publish pending and final reports, recover unfinished or long-running reports, and organize results into Readiness, Reviews, and Measures. Toolchain retries, Windows artifact hosts, local fixtures, and local Atmos Pact execution are also supported.

Add runnable CDK examples with casts for the CDK tutorial @osterman (#3481)

Added runnable examples/cdk-cloudformation and examples/cdk-terraform CDK examples using the local Floci AWS emulator, with kind: steps synth hooks, freshness-controlled install steps, smoke tests, lifecycle casts, and tutorial integration.

Clean up stale overrides in copyable Atmos examples @osterman (#3485)

Removed incidental logging, redundant approval and initialization settings, and global caching auto-approval from copyable Atmos examples while retaining required and instructional configuration. Quick-start guidance and generated configuration snapshots were updated for current defaults.

Reconcile bundled skills and command documentation @osterman (#3491)

Reconciled bundled skills and command documentation, correcting examples for workflow dependencies, toolchain aliases, ECR login, retries, vendor pinning, Ansible, themes, authentication, OCI, and backend inspection while removing unsupported command examples.

chore(review): encourage extracting legacy catch-all packages @osterman (#3521)

Added CodeRabbit path instructions encouraging focused extraction of touched behavior and tests into owning packages, with thin adapters where needed.

chore: bump Claude Code plugin version to v1.233.2 @cloudposse-releaser[bot] (#3528)

Bumped the Claude Code plugin version to v1.233.2.

fix(release): recognize landed native stack members @osterman (#3536)

Release history now recognizes merged native-stack pull requests when their merge commits are present in the verified release range, even if GitHub retained the original non-main PR base.

fix(ci): re-check quality:ready PRs whose head status fails @osterman (#3539)

The scheduled Quality Gate reconciler now re-evaluates quality:ready pull requests whose combined commit status is failure or error, even when the report is current and the commit is older than 24 hours.

fix(ci): select current workflow results in quality gate @osterman (#3540)

Quality Gate now selects the newest workflow run by creation time and run ID when several runs target the same commit, excluding superseded GitHub Actions checks only when their check-suite ID identifies the older run. Current failures, pending runs, unknown suites, external checks, and synthetic merge-commit checks remain enforced.

fix: plugin release inputs and changelog release badge @osterman (#3554)

Plugin release inputs no longer include the repository root go.mod for auth-secrets, which is bumped to 1.0.1 once. Changelog posts now show a release badge from frontmatter, detected release data, or Unreleased, and the CDK hooks post includes its cast metadata.

docs: add plugin pages and fix CI network checks @osterman (#3575)

Added /plugins and /plugins/official documentation with quick-start and official package guidance. StepSecurity diagnostics now allow up to 60 seconds for protection startup and recognize exact eBPF DNS rejection events.

fix(release): group release preview issues by release-notes category @osterman (#3577)

Release preview issues now group milestone pull requests under the same release-notes categories and order as published releases, sorting entries by pull request number within each category.

fix(ci): stop the Quality Gate from blocking on unapproved signal runs @osterman (#3583)

Quality Gate no longer treats Quality Gate Signal workflow runs as CI evidence at their trigger events, and re-evaluates reports blocked by the previous exclusion marker. action_required results now direct users to approve waiting workflow runs rather than inspect logs.

fix(release): resolve merge-queue commits GitHub left unmerged @osterman (#3613)

Release milestone checks and release planning can resolve merge-queue commits that GitHub left unmerged by using the pull request number in a GitHub-signed default-branch commit subject, then applying the normal milestone and release-label validation.

chore(docs): refresh CLI screengrab casts, batch 2 of 3 @osterman (#3628)

Refreshed the second batch of 138 CLI screengrab casts so the documentation player types > atmos <command> and reflects current help output.

fix(cast): validate screengrab casts record the program name @osterman (#3629)

Refreshed the final 136 CLI screengrab casts and added validation to atmos --chdir=demo/casts casts validate screengrabs cli, which rejects cast headers whose command does not match the manifest while allowing supported help variants and the special atmos about --help case.

✨ Features

feat(cast): interpret VHS tapes and add atmos cast record @osterman (#2889)

type: cast steps can now interpret inline or file-based VHS tapes in steps or PTY-backed session mode without requiring the vhs binary or writing generated YAML. Added atmos cast record <input.tape> with --output, --format, --mode, --shell, and --shell-init, plus configurable clean shell initialization, wait handling, screenshots, and VHS-compatible setup and output behavior.

Add stack planning, selectors, CI, and directory scaffolding @osterman (#3429)

Added atmos stack plan and stack test, stack-wide and component selectors, --dry-run, lifecycle introspection commands, authentication preflight, CI reporting, and multi-stack stack create --target directory scaffolding. Selectors support --stack, repeated or comma-separated --component, --all, --affected, tags, labels, and interactive selection while preserving dependency ordering and native hooks.

feat(cast): Starlark cast recorder, script source, and CI cast checks @osterman (#3431)

Added cast.recorder(...) for Starlark declarations that generate and validate recordings, including commands, PTY blocks, setup and cleanup, assertions, policies, and replacements. Script steps can load .star, .py, .sh, or .bash sources, session waits no longer match typed command echoes, and CI validates committed casts.

Add stack lifecycle orchestration and scaffold creation @osterman (#3442)

Added dependency-aware atmos stack deploy and stack destroy, plus scaffold-backed single-file stack create. Hook declarations are validated against registered lifecycle events for current editions, while scaffold planning, failure reporting, and stale-generation recovery preserve existing files safely.

Add safe Doctor migrations and fix nested error rendering @osterman (#3454)

Added safe Doctor migrations from legacy naming patterns and tokens to templates, gated by before-and-after identity checks. Nested errors now render without raw Markdown, preserve terminal color through wrappers, separate metadata explanations from actionable hints, and log hook dispatch at Debug level.

feat: enable native Go plugins and OIDC authentication @osterman (#3459)

Enabled experimental native plugin commands, startup integration, built-in OCI identity, OIDC authentication, policy checks, and plugin build --platform or --all-platforms with environment bindings and partial-success reporting. Policy JSON/YAML output preserves fields and embedded objects, and the CLI includes plugin creation, installation, verification, execution, and management workflows.

feat(policy): add validation engines and shared runtime context @osterman (#3461)

Added native OPA and JSON Schema policy engines with boolean and diagnostic Rego results, YAML/JSON file checks, and shared environment, runtime, version, FIPS, calendar, and CI evidence across the policy engines.

fix(yaml): require explicit function tags with edition compatibility @osterman (#3463)

Unpinned configurations and editions from 2026-10-20 now require explicit YAML function tags, preserving tag identity through loading, merging, templates, deferred evaluation, and serialization. Legacy behavior remains available with edition: "2026-10-19".

feat(cli): add --docs and --example command discovery @osterman (#3468)

Command help and usage errors now show copyable documentation URLs, with global --docs, --docs=md or --docs=markdown, and --example discovery and initialization. Discovery works before normal project validation, preserves aliases, --chdir, flag ownership, and initialization safeguards, and can operate outside an Atmos project.

Add Fogg migration and CDK guides with CloudFormation improvements @osterman (#3471)

Added Fogg migration, AWS CDK, and CDK Terrain guides, plus CloudFormation synthesis improvements that run hooks before reading generated files and support inherited region and duration-based timeout settings with Doctor migrations.

feat: conditional stack imports and tagging tutorials; fix deferred rendering @osterman (#3473)

Added conditional stack imports using when, with native labels and tags available to CLI selectors such as atmos list instances --tags pci and --labels pci:true. Import precedence, nested metadata, authentication discovery, tag merge semantics, and deferred rendering now preserve literal values and correct evaluation scope.

Validate merged stack auth and preserve secret discovery safety @osterman (#3487)

Added auth validate --stack with optional --component to validate merged component authentication configuration while retaining strict global validation. Secret discovery remains lazy, the default GCP ADC specification is supported, and the first SOPS write after key generation is repaired.

Generalize component executable overrides and execution flags @osterman (#3488)

Added consistent --command executable overrides for Terraform, Helmfile, Packer, and Ansible, preserving compatibility flags and command-line precedence. Helmfile dry-run behavior, global options, and stderr forwarding were also corrected.

Fix source handling and add backend and alias inspection @osterman (#3490)

Added atmos toolchain aliases to list effective built-in and configured aliases as sorted table, JSON, or YAML output, and atmos terraform backend list and describe for static merged backend inspection without authentication or expression execution. Import caching, vendor extraction, Git source handling, version edits, and OCI whiteout processing were also corrected.

Run repository checks through Atmos Git hooks and Starlark @osterman (#3494)

Repository checks, formatting, CI, and autofix now run through shared YAML/Starlark Git hooks using native Git sandboxes and atomic writes. Staged and unstaged edits are preserved when fixes are applied, and hook installation backs up existing launchers during forced replacement.

feat(starlark): add modules, records, and typed configuration @osterman (#3505)

Added module.load(path) and struct(**fields) to automation scripts, with cached imports, frozen exports, cycle detection, cancellation, and parallel loading. Added typed YAML/JSON configuration loading and validation with local or HTTPS JSON Schemas, defaults, bounds, optional fields, lists, enums, diagnostics, immutable records, and config1.merge(config2).

feat(plugins): add public releases, catalog, and auth-secrets @osterman (#3510)

Added public OCI plugin releases and catalog discovery, with cloudposse/auth-secrets as the first independently versioned package. Native commands now support plugin release planning, testing, signing, public verification, and catalog synchronization, while secrets/store and secrets/env provide scoped secret access, environment projection, masking, expiry, cycle checks, and logout.

feat(starlark): add stdin, file writes, and script-local OS controls @osterman (#3526)

Added stdin= to exec.run, component.exec, and atmos.* wrappers, plus the predeclared os module with environment, directory, platform, and architecture controls scoped to one script invocation. Added fs.write_file(path, content, overwrite=False, mode=0o600) with exclusive creation by default and permission-preserving overwrites.

feat(yaml): support bounded parallel exec evaluation @osterman (#3527)

Added settings.functions.exec.max_concurrency to bound concurrent evaluation of ordinary !exec expressions, preserving document positions and --skip=exec. A limit of 1 remains the default; failures cancel outstanding commands and policy checks run before execution.

Add conditional retries for component error events @osterman (#3542)

Added conditional action: retry policies for component error events across Terraform/OpenTofu, Helmfile, Packer, Ansible, native Helm, Kubernetes, CloudFormation, containers, and emulators, including predicates, aliases, schemas, diagnostics, and independent retry budgets. AWS configuration and credential updates on Windows are serialized with cross-platform file locks.

feat: native Vault identities and explicit credential templates @noeljackson (#3557)

Vault and OpenBao stores can now consume VAULT_TOKEN from a configured native Atmos identity, while auth-secrets providers read named credentials through store, path, and optional exact top-level field references. secrets/env identities render explicit spec.env templates after authentication with masking, size and NUL checks, restricted helpers, and no process-environment mutation.

🐛 Bug Fixes

fix(ai): use provider default models in --ai config hints @pcbeingused333 (#3413)

AI setup hints now read each provider's DefaultModel, so generated atmos.yaml snippets stay aligned with the models accepted by Anthropic, Bedrock, Gemini, Ollama, and Grok providers.

fix(include): resolve base_path before the working directory @djal (#3426)

!include and !include.raw now resolve paths against base_path before the working directory, while ./ and ../ paths remain strictly relative to the including manifest. This ensures atmos describe affected compares files from the correct rebased checkout.

test: cover a stack-wide terraform_workspace_template, list it in metadata docs @bercedev (#3453)

Stack-wide terraform_workspace_template values are now covered in Terraform component metadata documentation and processing behavior.

refactor: establish shared API and native plugin SDK @osterman (#3455)

Added the canonical pkg/api contracts, standalone native plugin SDK, protocol bindings, transport, manifest and configuration primitives, and Starlark cast integration while preserving deprecated pkg/automation imports and compatible installed binaries.

fix: unify credential handling and OCI registry access @osterman (#3456)

Added shared extension descriptors, OCI registry support, and unified authentication and credential handling for the plugin distribution layer. Credential publication and logout cleanup are serialized, nested registry-auth deadlocks are avoided, and GHCR token precedence is preserved.

fix(terraform): run lifecycle hooks in prepared workdirs @osterman (#3462)

Terraform bulk init and test operations now run destroy, before, after, and per-component hooks in prepared work directories while preserving resolved paths and credentials for after-hooks. Tool-version discovery is scoped to each project's configuration.

fix: preserve Helm repository auth and AWS ambient context @osterman (#3470)

Native Helm operations now preserve repository credentials, TLS options, and credential-forwarding policy through chart lookup and rendering. AWS ambient authentication is populated while retaining SDK discovery, AWS_PROFILE, and explicit managed credential overrides.

Preserve literal values and diagnose YAML function scope @osterman (#3486)

Stack function values and literal template text now preserve explicit evaluation timing through loading, merging, rendering, and output, while stack random and cwd functions evaluate correctly. Doctor diagnoses functions in unsupported locations, and raw YAML shielding no longer affects decoded command arguments or import paths.

Fix runtime evaluation and command execution boundaries @osterman (#3489)

Preserved saved plans during inspection, restored single-component destroy CI output, and corrected custom-command boundaries, devcontainer settings, MCP exports, schema-directory flags, Ansible paths, workflow directories, retry defaults, SBOM discovery, and native Helm rendering. CI-mode configuration reads now synchronize with theme updates.

fix(helmfile): colorize diff output by default on a TTY @STiFLeR7 (#3498)

atmos helmfile diff now sets HELM_DIFF_COLOR=true when Atmos detects that the terminal supports color, unless the user has already set that variable in the component, stack, or shell environment.

fix: upgrade Node.js to 24.22.1 and Go to 1.26.10 for CVEs @osterman (#3502)

Updated the downloaded AWS SAML driver runtime and website to Node.js 24.22.1, upgraded Go to 1.26.10, and patched the website's dompurify, launch-editor, and follow-redirects overrides.

fix(stacks): resolve inherited metadata.component directories @osterman (#3508)

Inherited metadata.component is now resolved before backend generation while preserving explicit overrides, legacy component selection, and disabled metadata inheritance. This aligns displayed component paths, execution directories, and affected-component detection.

build: streamline releases and pin GitHub Actions runners @osterman (#3509)

Release builds now publish six binaries and six Linux packages, with source installation documented for retired targets. atmos release cut --resume can recover unfinished releases, Quality Gate uses current policy and status evidence, and shared Git hooks select the current checkout's build/atmos executable across linked worktrees.

fix(terraform): propagate skipped functions to nested lookups @osterman (#3513)

Terraform nested output and state lookups now preserve evaluation options such as --skip=secret, preventing dependency lookups from contacting skipped secret providers. Caches are partitioned by skip list.

fix(terraform): run tests without generating a backend @osterman (#3514)

Terraform tests no longer generate a backend file when auto_generate_backend_file is enabled, allowing provider-free test modules to run without requiring backend_type and preserving existing backend files.

fix(secret): honor scoped providers during key generation @osterman (#3515)

atmos secret keygen -s <stack> now resolves stack, component, and type-scoped providers without evaluating secret values, including provider-only stacks. Ambiguous provider overrides are rejected.

fix(sops): resolve nested recipient files and relative rules @osterman (#3516)

SOPS discovery now finds nested .sops.yaml recipient files and generates matching rules relative to each recipient file, supporting relative and absolute paths, custom scope directories, and Unix or Windows separators.

fix(secret): allow stack secrets without a component @osterman (#3517)

atmos secret set and validate now support stack/global declarations without requiring a component, while instance-scoped operations continue to require one.

fix(commands): honor stack on custom Atmos steps @osterman (#3518)

Custom type: atmos steps now pass their rendered stack to child commands when no explicit stack flag is present, placing it before passthrough -- and preserving explicit forms such as -sprod.

fix(emulator): validate the Kubernetes API port before startup @osterman (#3519)

Emulator specification validation now rejects Kubernetes port mappings that omit the API server's required 6443/tcp port.

fix(ui): render email autolinks once and clarify test behavior @osterman (#3520)

Terminal email autolinks in ui.* messages are rendered once. Documentation now clarifies --help=all, stack-variable injection, and retained Terraform test files.

fix(sops): restore missing recipients from existing age keys @osterman (#3522)

SOPS key generation can recover a missing public recipient from an existing age private key without changing private key material, while preserving recipient rules and rejecting ambiguous multiple identities.

fix(ui): don't mangle list markers and emails in ui.* messages @osterman (#3524)

Starlark ui.info, ui.success, and ui.warning now preserve Markdown list markers, nested indentation, and email text in terminal and toast output, including no-color rendering. Literal list markers can be escaped with ui.info("1\\. literal").

feat(duration): human-readable minutes/hours in resource-usage summary @osterman (#3529)

Resource-usage summaries now use duration.Format, displaying minute- and hour-scale durations as 34m 47s or 1h 2m 3s while retaining readable sub-minute formatting and rounding 59.96s to 1m.

fix(security): reduce scanner noise and patch dependencies @osterman (#3541)

Reduced Semgrep false positives for same-repository actions, organized security backlogs by scanner, and patched Go and JavaScript dependencies including the Windows runtime workaround dependencies.

fix(auth): isolate store identity auth from the component manager @osterman (#3546)

Added AuthenticateIsolated to authenticate a store identity without changing the caller's authentication chain, stack information, or credentials. AWS, Azure, and GCP store bridges now use the isolated context, preventing secret resolution from changing subsequent component or Terraform state authentication.

fix(ai): default Gemini to gemini-3.8-flash @pcbeingused333 (#3553)

Changed the default Gemini model to gemini-3.8-flash, including the TUI function-calling hint and provider documentation.

fix(imports): support oci:// in stack and atmos.yaml imports @osterman (#3556)

Stack and atmos.yaml imports now support oci://host/repo:tag//path for files, directories, and globs, with nested_imports: remote, XDG caching, imports.ttl, and registry authentication. Missing paths return ErrOCIImportMissingPath; shared remote-import caching also preserves file extensions and refreshes stale copies.

fix(ai): report cached prompt tokens for OpenAI-compatible providers @pcbeingused333 (#3565)

OpenAI-compatible AI providers now report cached prompt tokens from usage.prompt_tokens_details.cached_tokens, so atmos ai chat and usage output include cache-read counts.

fix(ai): send max_completion_tokens for OpenAI o-series and gpt-6 models @pcbeingused333 (#3566)

OpenAI-compatible requests now use max_completion_tokens for all o-series models and gpt-6* models, while models such as Ollama names that merely start with o continue using max_tokens.

fix(ai): apply max_tokens to Gemini requests @pcbeingused333 (#3567)

Gemini requests now send ai.providers.gemini.max_tokens as generationConfig.maxOutputTokens across normal and tool-calling methods; zero leaves the model default unchanged.

fix: stabilize CI and clarify script failures @osterman (#3569)

Stabilized CI and runtime diagnostics by preserving workflow environments, recognizing StepSecurity eBPF enforcement, warming native CI caches with Floci, refreshing AWS credentials before website deployment, and clarifying intentional Starlark failures and formatting guidance.

Restore bulk Terraform plan summaries and enforce size limits @osterman (#3580)

Bulk Terraform plans now restore template-based summaries for every executed component, including no-change runs, while aggregate reports and cumulative masked summary-file writes are bounded. Oversized output produces one warning recommending --tags or --labels.

fix: upgrade regressions in YAML functions, store hooks, custom flags @osterman (#3584)

YAML function values embedded in templates now resolve correctly, with clear errors for rewritten functions or maps and lists inside larger strings. Store hooks skip missing Terraform outputs during destroy events with a warning, and custom commands may define --example and --docs flags of any type.

fix(ai): default Anthropic and Bedrock to Claude Sonnet 5 @pcbeingused333 (#3585)

Anthropic and Bedrock now default to Claude Sonnet 5 using claude-sonnet-5 and global.anthropic.claude-sonnet-5, respectively. Requests omit a thinking override so model defaults apply.

fix(terraform): inject Atmos Auth credentials into terraform shell @osterman (#3604)

atmos terraform shell now runs the Atmos Auth Terraform pre-hook during setup, injecting identity credential variables such as AWS_PROFILE, AWS_SHARED_CREDENTIALS_FILE, AWS_CONFIG_FILE, and region settings into initialization, workspace selection, and the interactive shell.

fix: repair plugin publication and AI release previews @osterman (#3605)

Plugin publication now uploads plugins and catalogs before --verify-public, with actionable GHCR visibility guidance and safe retries. Milestone release previews now use AI summaries, forward the API key through the trusted workflow, and reuse unchanged previews.

fix(terraform): show Terraform's error when workspace setup fails @osterman (#3610)

Terraform workspace setup errors now include Terraform's output from both workspace select -or-create and the workspace new fallback, along with the workspace name and guidance to check backend credentials or permissions and rerun with ATMOS_LOGS_LEVEL=debug.

fix(list): escape CSV/TSV cells in list vendor output @pcbeingused333 (#3616)

atmos list vendor --format csv|tsv now escapes delimiters, quotes, and newlines using encoding/csv, keeping values such as multi-tag cells in a single field.

fix(secret): run every secret command on stack-scoped secrets @osterman (#3618)

Secret commands including get, delete, import, pull, push, exec, and shell now accept --stack alone for stack-scoped and global secrets. Whole-stack operations exclude instance secrets unless --component is supplied, and unresolved shared scope prompts on a terminal or reports why --component is required.

fix(pro): keep the error message in reported exceptions @osterman (#3619)

Exceptions sent to Atmos Pro now retain the masked failure text prefixed by the failed command and truncated to 8 KiB on a rune boundary; nil exception information no longer panics. Obsolete Trivy hostnames were also removed from runner hardening.

fix(auth): retry the GitHub OIDC token request and reuse the JWT per process @mtb-xt (#3621)

GitHub OIDC authentication retries token requests on timeouts, network errors, HTTP 429, and HTTP 5xx responses with four exponential-backoff attempts. A valid JWT is reused in memory across identities within one Atmos process while its exp claim is more than 60 seconds away; tokens are never persisted.

fix(cast): record the program name in cast headers @osterman (#3627)

Auto-recorded cast headers now include the program name, so recordings show atmos --help instead of --help; the first batch of 138 CLI screengrabs was refreshed accordingly.

feat(website): render GitHub-style alerts as admonitions @osterman (#3631)

Documentation and changelog Markdown now convert GitHub-style alerts such as > [!NOTE], > [!TIP], > [!IMPORTANT], > [!WARNING], and > [!CAUTION] into native Docusaurus admonitions.

fix(ai): count Gemini thinking tokens in output usage @pcbeingused333 (#3632)

Gemini usage reporting now counts thoughtsTokenCount together with candidatesTokenCount as completion tokens, so reasoning tokens appear in context and token-usage totals.

🤖 Automatic Updates

chore(deps): bump github.com/posthog/posthog-go from 1.12.6 to 1.17.4 @dependabot[bot] (#2764)

Updated github.com/posthog/posthog-go from 1.12.6 to 1.17.4.

chore(deps): update dependency @types/node to v22.20.5 @renovate[bot] (#3422)

Updated the website's @types/node dependency from 22.20.4 to 22.20.5.

chore(deps): update dependency tsx to v4.23.15 @renovate[bot] (#3423)

Updated the website's tsx dependency from 4.23.13 to 4.23.15.

build(deps): bump al.essio.dev/pkg/shellescape from 1.6.0 to 1.6.1 @dependabot[bot] (#3425)

Updated al.essio.dev/pkg/shellescape from 1.6.0 to 1.6.1.

chore(deps): update dependency prettier to v3.9.10 @renovate[bot] (#3507)

Updated the website's Prettier dependency from 3.9.9 to 3.9.10.

chore(deps): bump golang.org/x/tools from 0.51.0 to 0.52.0 in /tools/lintroller @dependabot[bot] (#3534)

Updated golang.org/x/tools from 0.51.0 to 0.52.0 in tools/lintroller.

chore(deps): bump golang from 1.27.1 to 1.27.2 in /.devcontainer @dependabot[bot] (#3558)

Updated the development container's Go image from 1.27.1 to 1.27.2.

chore(deps): bump github.com/aws/aws-sdk-go-v2 from 1.47.1 to 1.47.3 @dependabot[bot] (#3559)

Updated github.com/aws/aws-sdk-go-v2 from 1.47.1 to 1.47.3.

chore(deps): bump github.com/PuerkitoBio/goquery from 1.12.0 to 1.13.0 @dependabot[bot] (#3560)

Updated github.com/PuerkitoBio/goquery from 1.12.0 to 1.13.0.

fix(deps): update github.com/cyberphone/json-canonicalization digest to 32a4819 @renovate[bot] (#3572)

Updated the github.com/cyberphone/json-canonicalization dependency digest to 32a4819.

chore(deps): update actions/upload-artifact action to v7.0.2 @renovate[bot] (#3574)

Updated actions/upload-artifact from v7.0.1 to v7.0.2, improving artifact download retries for HTTP 429 responses and honoring valid Retry-After headers.

chore(deps): bump github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi from 1.39.0 to 1.41.4 @dependabot[bot] (#3597)

Updated github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi from 1.39.0 to 1.41.4.

chore(deps): update step-security/harden-runner action to v2.22.1 @renovate[bot] (#3601)

Updated step-security/harden-runner from v2.22.0 to v2.22.1, fixing initialization and GHES connectivity on self-hosted runners.

fix(deps): update module github.com/agnivade/levenshtein to v1.2.2 - abandoned @renovate[bot] (#3608)

Updated github.com/agnivade/levenshtein from v1.2.1 to v1.2.2.

chore(deps): update step-security/harden-runner action to v2.22.2 @renovate[bot] (#3612)

Updated step-security/harden-runner from v2.22.1 to v2.22.2, correcting macOS ingress classification and Linux endpoint handling while improving network and DNS tracing.

fix(deps): update module github.com/bmatcuk/doublestar/v4 to v4.10.3 @renovate[bot] (#3615)

Updated github.com/bmatcuk/doublestar/v4 from v4.10.0 to v4.10.3, including fixes for Windows junction traversal and case-insensitive character ranges.

fix(deps): update go.starlark.net digest to 4f4267f @renovate[bot] (#3622)

Updated the go.starlark.net dependency digest to 4f4267f.