Security
This release includes a security fix for GHSA-5xhm-p3jx-2fmc: when a project allowlist is set, gitlab_api_request now refuses non-project API paths (fail-closed).
What's Changed
✨ Features
- feat(oauth): opt-in to require browser re-authorization instead of refresh #894
- feat: add update_protected_branch tool #895
🐛 Bug Fixes
- fix(startup): hide password pieces split by commas in the API URL log #893
- fix(api): refuse non-project paths when a project allowlist is set #901
📝 Documentation
- docs(config): say the OAuth cleartext error names only the first URL's host #900
🔬 CI/Test
- ci(docker): attach provenance and SBOM attestations to release images #897
- ci(docker): say which ref to run a manual Docker publish from #899
🔨 Chore
- chore(release): remove local publish paths #896
- chore(release): let release.sh take patch, minor or major #898
Note
Deprecation notice (#815): legacy flags and env vars will be removed in v3.0. Migrate now; see the issue for the mapping.