What's Changed
🔧 Other Changes
- fix(dashboard): enforce POST body size limits by @fallintoplace in #2029
- fix(install): exclude self-entry from dry-run orphan preview by @mia106dev in #2069
- fix(deps): preserve inherited git config when injecting auth headers by @edenfunf in #2382
- Defer disk deletion in apm lock to avoid removing dropped deployed files by @atulya-singh in #2312
- [BUG] fix(audit): self-hydrate cold-cache ci audit from lock pins by @hugoguitton-lucca in #2329
- fix(dashboard): harden static path traversal checks by @fallintoplace in #2027
- fix(auth): try public GitHub anonymously before resolving credentials by @danielmeppiel in #2406
- fix(integration): make MCP targets deterministic (supersedes #2302, closes #2298) by @danielmeppiel in #2307
- fix(self-update): pin installer ref to latest version by @fallintoplace in #2026
- fix: skip package.json sidecar for Copilot/VSCode hook deployment (#2322) by @sergio-sisternes-epam in #2363
- fix(audit): report deployed files that no lockfile entry claims by @salpers in #2380
- fix(mcp): create the lockfile for MCP-only projects by @edenfunf in #2390
- fix(install): preserve MCP target mappings (supersedes #2301, closes #2297) by @danielmeppiel in #2306
- fix(audit): scan the deploy trees for hidden Unicode, not just recorded files by @salpers in #2381
- Fix dep devDependencies.mcp leaking into consumer MCP config (#2340) by @sergio-sisternes-epam in #2361
- fix(deps): exclude stale bare-repo cache from resolver stack during apm update by @sergio-sisternes-epam in #2364
- fix(mcp): render a docker launcher for v0.1 oci container packages by @edenfunf in #2385
- fix(vscode): build container run args from v0.1 registry arguments by @edenfunf in #2387
- fix(hooks): enforce restriction-only package targets by @sergio-sisternes-epam in #2362
- fix(uninstall): accept portable local dependency keys by @danielmeppiel in #2412
- fix(hooks): normalize Copilot lifecycle event aliases by @danielmeppiel in #2405
- fix(auth): on-prem ADO Server hosts misclassified as GHES when GITHUB_HOST is set by @sergio-sisternes-epam in #2365
- fix: write IntelliJ MCP config to plugin-read path by @danielmeppiel in #2410
- fix(install): honor saved targets across MCP and LSP by @danielmeppiel in #2414
- fix(marketplace): honour producer tag_pattern in consumer semver range resolution by @sergio-sisternes-epam in #2366
- fix(deps): preserve mixed-case materialization paths by @danielmeppiel in #2409
- fix(mcp): preserve non-container registry arguments by @danielmeppiel in #2407
- chore: release v0.27.0 by @danielmeppiel in #2416
- fix(release): repair v0.27 integration contracts by @danielmeppiel in #2417
- fix(release): preserve Git isolation across auth fallback by @danielmeppiel in #2422
- fix(release): bound macOS Intel integration coverage by @danielmeppiel in #2423
- fix(release): decouple live ADO acceptance by @danielmeppiel in #2426
New Contributors
Full Changelog: v0.26.0...v0.27.0