Update dependency github:microsoft/apm to v0.28.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
github:microsoft/apm	tools	minor	v0.25.0 → v0.28.0

---

Release Notes

microsoft/apm (github:microsoft/apm)

v0.28.0

Compare Source

What's Changed

🔧 Other Changes

• feat(kiro): deploy agents primitive to .kiro/agents/ (#​2089) by @​danielmeppiel in #​2440
• fix(marketplace): accept plugin collection versions by @​danielmeppiel in #​2454
• fix(compilation): preserve applyTo lists for hidden tool placement by @​danielmeppiel in #​2441
• fix(marketplace): allow nested HTTPS source paths by @​danielmeppiel in #​2439
• fix(hooks): anchor Claude project commands to project root by @​danielmeppiel in #​2442
• fix: audit contained local plugin sources (supersedes #​2444, closes #​2428) by @​danielmeppiel in #​2460
• fix(pack): route empty dependencies bundle (supersedes #​2447, closes #​2431) by @​danielmeppiel in #​2458
• fix(marketplace): effective output path (supersedes #​2448, closes #​2427) by @​danielmeppiel in #​2461
• fix(mcp): resolve runtime variables consistently by @​danielmeppiel in #​2455
• Add experimental Grok Cloud target support by @​sergio-sisternes-epam with @​Copilot in #​2420
• refactor(performance): eliminate repeated I/O and lockfile scans by @​danielmeppiel in #​2472
• feat(registry): align object-form registry deps with git skills: by @​nadav-y in #​2166
• fix(init): reject empty/whitespace project names by @​nadav-y in #​2200
• fix(compile): preserve nested worktree files (supersedes #​2453) by @​danielmeppiel in #​2473
• chore: release v0.28.0 by @​danielmeppiel in #​2477
• fix(tests): make local marketplace canonical assertions platform-native by @​danielmeppiel in #​2480
• fix(install): re-download aliased deps after a manifest ref bump by @​danielmeppiel in #​2484
• fix(outdated): degrade gracefully when Rich progress rendering fails by @​danielmeppiel in #​2507

Full Changelog: microsoft/apm@v0.27.0...v0.28.0

v0.27.0

Compare Source

What's Changed

🔧 Other Changes

• fix(dashboard): enforce POST body size limits by @​fallintoplace in #​2029
• fix(install): exclude self-entry from dry-run orphan preview by @​mia106dev in #​2069
• fix(deps): preserve inherited git config when injecting auth headers by @​edenfunf in #​2382
• Defer disk deletion in apm lock to avoid removing dropped deployed files by @​atulya-singh in #​2312
• [BUG] fix(audit): self-hydrate cold-cache ci audit from lock pins by @​hugoguitton-lucca in #​2329
• fix(dashboard): harden static path traversal checks by @​fallintoplace in #​2027
• fix(auth): try public GitHub anonymously before resolving credentials by @​danielmeppiel in #​2406
• fix(integration): make MCP targets deterministic (supersedes #​2302, closes #​2298) by @​danielmeppiel in #​2307
• fix(self-update): pin installer ref to latest version by @​fallintoplace in #​2026
• fix: skip package.json sidecar for Copilot/VSCode hook deployment (#​2322) by @​sergio-sisternes-epam in #​2363
• fix(audit): report deployed files that no lockfile entry claims by @​salpers in #​2380
• fix(mcp): create the lockfile for MCP-only projects by @​edenfunf in #​2390
• fix(install): preserve MCP target mappings (supersedes #​2301, closes #​2297) by @​danielmeppiel in #​2306
• fix(audit): scan the deploy trees for hidden Unicode, not just recorded files by @​salpers in #​2381
• Fix dep devDependencies.mcp leaking into consumer MCP config (#​2340) by @​sergio-sisternes-epam in #​2361
• fix(deps): exclude stale bare-repo cache from resolver stack during apm update by @​sergio-sisternes-epam in #​2364
• fix(mcp): render a docker launcher for v0.1 oci container packages by @​edenfunf in #​2385
• fix(vscode): build container run args from v0.1 registry arguments by @​edenfunf in #​2387
• fix(hooks): enforce restriction-only package targets by @​sergio-sisternes-epam in #​2362
• fix(uninstall): accept portable local dependency keys by @​danielmeppiel in #​2412
• fix(hooks): normalize Copilot lifecycle event aliases by @​danielmeppiel in #​2405
• fix(auth): on-prem ADO Server hosts misclassified as GHES when GITHUB_HOST is set by @​sergio-sisternes-epam in #​2365
• fix: write IntelliJ MCP config to plugin-read path by @​danielmeppiel in #​2410
• fix(install): honor saved targets across MCP and LSP by @​danielmeppiel in #​2414
• fix(marketplace): honour producer tag_pattern in consumer semver range resolution by @​sergio-sisternes-epam in #​2366
• fix(deps): preserve mixed-case materialization paths by @​danielmeppiel in #​2409
• fix(mcp): preserve non-container registry arguments by @​danielmeppiel in #​2407
• chore: release v0.27.0 by @​danielmeppiel in #​2416
• fix(release): repair v0.27 integration contracts by @​danielmeppiel in #​2417
• fix(release): preserve Git isolation across auth fallback by @​danielmeppiel in #​2422
• fix(release): bound macOS Intel integration coverage by @​danielmeppiel in #​2423
• fix(release): decouple live ADO acceptance by @​danielmeppiel in #​2426

New Contributors

• @​salpers made their first contribution in #​2380

Full Changelog: microsoft/apm@v0.26.0...v0.27.0

v0.26.0

Compare Source

What's Changed

🔧 Other Changes

• feat(tls): verify against the OS trust store by default (closes #​2004) by @​fangkangmi in #​2005
• fix(update): re-check transitive dependencies' own semver ranges during apm update by @​nadav-y in #​2053
• feat(shepherd): enforce canonical owner gate by @​danielmeppiel in #​2180
• fix(deps): git-semver update idempotency in build_update_plan by @​srobroek in #​2165
• fix(audit): preserve dependency link paths during replay by @​danielmeppiel in #​2179
• docs: add deny and doctor CLI references by @​danielmeppiel in #​2178
• fix(installer): expose stable Windows executable by @​danielmeppiel in #​2094
• fix(audit): honor locked skill subsets during replay by @​danielmeppiel in #​2177
• fix(docs): correct relative link depths across docs site by @​JasonTame in #​2170
• fix(pack): pack subdirectory-prefixed skills by @​danielmeppiel in #​2176
• fix(policy): preserve strict policy across warm cache reads by @​danielmeppiel in #​2193
• test(foundation): add hermetic lifecycle integration utilities by @​danielmeppiel in #​2209
• harden(contracts): add platform and rendered documentation evidence by @​danielmeppiel in #​2199
• test: add finite taxonomy and quality ratchets by @​danielmeppiel in #​2198
• test(consume): add real lifecycle contracts by @​danielmeppiel in #​2212
• test(produce): prove real pack-to-install artifact parity by @​danielmeppiel in #​2215
• test(consume): expand source/ref/cache matrix by @​danielmeppiel in #​2219
• test(produce): expand genuine materialization matrix by @​danielmeppiel in #​2218
• fix(deps): canonicalize virtual package manifest bytes by @​danielmeppiel in #​2223
• test(govern): prove strict policy lifecycle parity by @​danielmeppiel in #​2221
• fix(lockfile): converge claude_skill virtual dep name/version across resolution paths (closes #​2206) by @​danielmeppiel in #​2217
• test(quality): synchronize the finite critical-suite count by @​danielmeppiel in #​2230
• fix(deps): preserve custom port in HTTP git URL persisted to apm.yml by @​atulya-singh in #​2210
• fix(audit): exempt is_virtual packages from config-consistency manifest check by @​hugoguitton-lucca in #​2214
• fix(marketplace): close packed source contracts by @​danielmeppiel in #​2228
• fix(pack): emit category in Claude marketplace output by @​mbeacom in #​2189
• fix(cache): preserve nested GitLab repository identity by @​lidorcg in #​2192
• fix(cli): warn when Codex agent tool scope is dropped by @​jstar0 in #​2186
• fix(deps): accept custom port in shorthand so apm.yml entries re-parse by @​atulya-singh in #​2211
• harden(shepherd): require exact-head functional owner evidence by @​danielmeppiel in #​2234
• fix(policy): honor Govern cache TTL with bounded property coverage by @​danielmeppiel in #​2235
• fix(deps): honor SSH for semver ref resolution by @​danielmeppiel in #​2229
• fix(ado): preserve lock coordinates for outdated and update by @​danielmeppiel in #​2226
• fix(deps): bound best-effort ref lookup retries by @​danielmeppiel in #​2238
• fix(virtual-packages): restore hermetic lifecycle convergence by @​danielmeppiel in #​2240
• test(architecture): add bounded mutation pilot by @​danielmeppiel in #​2241
• test(deps): add field-complete lockfile round-trip and reconstruction properties by @​danielmeppiel in #​2246
• fix: Windows CI CRLF baseline and WebSocket shutdown thread-join (closes #​2233) by @​danielmeppiel in #​2237
• fix(prune): reconcile merged hook ownership after package removal by @​danielmeppiel in #​2249
• fix(hooks): scope merged-hook wipe to resolved targets, not all KNOWN_TARGETS by @​danielmeppiel in #​2252
• harden(ci): require hermetic lifecycle smoke subset on pull-request CI by @​danielmeppiel in #​2247
• feat(mutation): add lockfile-normalization owner to bounded mutmut pilot by @​danielmeppiel in #​2251
• fix(ci): restore Windows unit reliability by @​danielmeppiel in #​2262
• fix(deps): add SSH key-auth clone failure guidance by @​danielmeppiel in #​2244
• test(hooks): promote target-scope uninstall smoke by @​danielmeppiel in #​2257
• fix(release): package Rich Unicode tables in frozen binaries by @​danielmeppiel in #​2264
• test(lifecycle): add shared state substrate by @​danielmeppiel in #​2265
• test: remove duplicate validation suite by @​danielmeppiel in #​2263
• fix(quality): correct duplicate group count by @​danielmeppiel in #​2274
• test(fixtures): auth-hardened url_rewrite_subprocess_env for real CLI installs by @​danielmeppiel in #​2267
• test(lifecycle): cover package shape transitions by @​danielmeppiel in #​2273
• fix(deps): preserve shared transitive deps still reachable from survivors by @​danielmeppiel in #​2269
• fix(ci): raise packaged Unix integration timeout by @​danielmeppiel in #​2276
• test(config): cover configuration and shared-graph lifecycle contracts by @​danielmeppiel in #​2277
• test: retire six exact duplicate modules by @​danielmeppiel in #​2278
• fix(install): reconcile dropped-target merge-hook state on target contraction by @​danielmeppiel in #​2275
• fix(manifest): fold legacy 'all' in targets to auto-detect with a deprecation warning by @​kotalab in #​2272
• fix: absolutize Copilot user-scope hook commands (closes #​2232) by @​danielmeppiel in #​2236
• fix(hooks): compose per-file routing with dependency targets by @​srobroek in #​2259
• fix(hooks): rebuild merged hooks from transitive lockfile survivors by @​Shaurya2k06 in #​2256
• test: retire six header-only twin modules by @​danielmeppiel in #​2280
• test(integration): add primitive target lifecycle covering array by @​danielmeppiel in #​2266
• test(ci): isolate the live guardrailing hero by @​danielmeppiel in #​2281
• fix(deps): recover virtual files from GitHub throttles by @​danielmeppiel in #​2284
• fix(install): contract generic shared target rows by @​danielmeppiel in #​2283
• test(integration): retire final header-only test twins by @​danielmeppiel in #​2285
• feat(agentics): add daily performance-scan agentic workflow by @​sergio-sisternes-epam in #​2125
• fix(deps): align integration throttle contracts by @​danielmeppiel in #​2287
• test(outdated): isolate parallel fixtures by @​danielmeppiel in #​2288
• test(integration): hermeticize packaged lifecycle E2E by @​danielmeppiel in #​2289
• fix(prune): reconcile deployment ledger ownership by @​danielmeppiel in #​2292
• fix(install): reconcile dropped target instructions by @​danielmeppiel in #​2295
• fix: guide compile-only project installs (supersedes #​2115, closes #​2057) by @​danielmeppiel in #​2293
• fix(audit): surface ref-consistency before deployment-ledger-owners by @​danielmeppiel in #​2300
• fix(install): remove shared-root skill orphan on target narrowing by @​danielmeppiel in #​2299
• fix(skills): report zero-match filters (supersedes #​2117, closes #​2116) by @​danielmeppiel in #​2294
• fix: selective update plan must not mark unselected deps removed (closes #​2291) by @​danielmeppiel in #​2305
• test(lifecycle): require real state machine gate by @​danielmeppiel in #​2309
• fix(lifecycle): repair packaged G0 contracts by @​danielmeppiel in #​2310
• test(tls): make override oracle state-independent by @​danielmeppiel in #​2311
• fix(install): defer transient GitHub validation failures by @​danielmeppiel in #​2313
• fix(integration): hermeticize stale packaged G0 release-blocker tests by @​danielmeppiel in #​2314
• chore: release v0.26.0 by @​danielmeppiel in #​2316

New Contributors

• @​fangkangmi made their first contribution in #​2005
• @​JasonTame made their first contribution in #​2170
• @​atulya-singh made their first contribution in #​2210
• @​hugoguitton-lucca made their first contribution in #​2214
• @​mbeacom made their first contribution in #​2189
• @​lidorcg made their first contribution in #​2192
• @​jstar0 made their first contribution in #​2186
• @​kotalab made their first contribution in #​2272
• @​Shaurya2k06 made their first contribution in #​2256

Full Changelog: microsoft/apm@v0.25.0...v0.26.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Test Results

0 tests  ±0   0 ✅ ±0   0s ⏱️ ±0s
0 suites ±0   0 💤 ±0 
0 files   ±0   0 ❌ ±0 

Results for commit 20531b4. ± Comparison against base commit a330bd7.

♻️ This comment has been updated with latest results.