Release notes
HOL Guard v3.59.0
StableHOL Guard v3.59.0, released November 4, 2026, is a stable release with 55 additions, 6 improvements, 177 fixes and 11 other changes. Highlights: builder: carry reviewed literals on the unclassified rule; optional license and; cigar: add a folder picker for projects and keep CIGAR on after it rests (#6992).
55 added · 6 improved · 177 fixed · 11 other
Published Original GitHub release for v3.59.0
Key facts
- Version
- v3.59.0
- Channel
- Stable
- Published
- Previous release
- v3.58.0
Documented changes
249 typed entries
Verified contributors
Credits being verified. Attribution coverage is unknown.
Attribution coverage
attribution not yet verified; history inventory partial.
Install
Scope
Guard v3.59.0 is a stable release published 2026-11-04. Upstream documents: builder: carry reviewed literals on the unclassified rule; optional license and description (#6868). Its comparison base is v3.58.0. Attribution for this release is being verified.
Changes
Added
55- builder: carry reviewed literals on the unclassified rule; optional license and description (#6868) (40825c7) Evidence for this change
- cigar: add a folder picker for projects and keep CIGAR on after it rests (#6992) (4a5f3a5) Evidence for this change
- cigar: add matching project files to Claude Code and Codex prompts (#6997) (1a86d77) Evidence for this change
- cigar: add matching project files to Pi and Oh My Pi prompts (#7030) (9005d07) Evidence for this change
- cigar: introduce the workspace as Context and mark it beta (f91ad40) Evidence for this change
- cigar: one calm screen, with everything else behind Advanced (#7006) (c6dca0a) Evidence for this change
- cigar: re-add recent projects in one click and use plain language on the Privacy tab (#6994) (53a7089) Evidence for this change
- cigar: set up CIGAR on macOS Intel and Linux, not only Apple Silicon (#6918) (8359b5e) Evidence for this change
- cigar: stop resending excerpts a session already has (#7194) (b89a182) Evidence for this change
- cigar: turn CIGAR on with one click (#6890) (5179c9f) Evidence for this change
- cli: add the cloud-actions command grammar (#7032) (5116993) Evidence for this change
- cli: sign in to Guard Cloud for cloud actions, one workspace per profile (#7038) (45ba3c2) Evidence for this change
- cloud-actions: apply and restore AI tool settings (#7056) (d20a3fa) Evidence for this change
- cloud-actions: check the saved sign-in live in status and add doctor (#7058) (c509d27) Evidence for this change
- cloud-actions: open Guard Cloud from accounts connect (#7050) (fb256c4) Evidence for this change
- cloud-actions: preview an AI tool's Cloud actions settings (#7046) (653c024) Evidence for this change
- command: accept optional cloud action bindings beside command and MCP contributions (#6959) (987f786) Evidence for this change
- command: add Cross Exam coverage with terminator-aware stdio (101bc5f) Evidence for this change
- command: add stateless cloud action evaluator (#6897) (ae55866) Evidence for this change
- command: compile cloud action bindings into a deterministic build artifact (#6964) (4771edf) Evidence for this change
- command: read a Homebrew search without review (#6786) (15653a6) Evidence for this change
- command: read compiled cloud action binding artifacts with explicit version checks (#6969) (c3548a6) Evidence for this change
- command: run the test scripts a project names for its suites (#6848) (ca019d5) Evidence for this change
- connect: report Cloud actions from hol-guard connect (#7128) (6097f10) Evidence for this change
- context: add a lean Codex sessions switch to the CIGAR settings tab (#7183) (1bd8f77) Evidence for this change
- context: add lean Codex sessions command (#7175) (c7b0432) Evidence for this change
- context: run CIGAR context assistance natively on Windows (#6941) (0c875ae) Evidence for this change
- daemon: report Cloud actions sign-ins to the local dashboard (#7074) (243ef7e) Evidence for this change
- dashboard: link each Cloud actions sign-in to its Guard Cloud pages (#7092) (e7de15c) Evidence for this change
- dashboard: rework every CIGAR tab and replace native dropdowns (#6949) (1818880) Evidence for this change
- dashboard: show Cloud actions sign-ins in Settings (#7087) (f33a02d) Evidence for this change
- dashboard: show where each Extension runs (#7089) (86c6908) Evidence for this change
- extension-builder: point cloud binding errors at the rejected binding (#7057) (4e24657) Evidence for this change
- extensions: add the rupa Markdown render and verify command extension (ba72a6f) Evidence for this change
- extensions: add Unwreck command protection (9d1bae7) Evidence for this change
- extensions: validate cloud action bindings with the source compiler (#7028) (237b155) Evidence for this change
- guard-yanez-pulse: verify Yanez Pulse approval receipts (5a60be3) Evidence for this change
- guard: finish Antigravity settings and skill discovery (#5644) (03b7a4c) Evidence for this change
- guard: integrate optional CIGAR context assistance (#6501) (6c2af28) Evidence for this change
- local-cli: read a script's commands from its source before running it (#6894) (b913aac) Evidence for this change
- mcp-servers: add opt-in Vicem Context Baton MCP contribution (7a4f345) Evidence for this change
- mcp-servers: add opt-in Wever Labs hosted MCP contribution (b7688ee) Evidence for this change
- mcp-servers: add the opt-in Aletheia MCP contribution (5c72ef7) Evidence for this change
- mcp-servers: add the opt-in cappz-market MCP contribution (b4a2d5e) Evidence for this change
- mcp-servers: add the opt-in GitFerry MCP contribution (24de5b9) Evidence for this change
- mcp-servers: add the opt-in Legwork MCP contribution (e9d4fc4) Evidence for this change
- mcp-servers: add the opt-in Netatmo Energy MCP contribution (84e6821) Evidence for this change
- mcp-servers: add the opt-in SecureInput MCP contribution (4dbce9a) Evidence for this change
- mcp-servers: add the opt-in Vulnify hosted MCP contribution (2cbddb2) Evidence for this change
- mcp: add Rel-Time Protocol (@rel-time/mcp-server) contribution (37c15c0) Evidence for this change
- runners: contain Jasmine, QUnit and uvu runs that stay in their workspace (#7107) (efa5f56) Evidence for this change
- scanner: read a credential a command line carries as an argument (#6737) (fa6a411) Evidence for this change
- scanner: read a credential carried inside a base64 payload (#6719) (9cb0c46) Evidence for this change
- scanner: read the files a committed archive carries (#6739) (c6cc038) Evidence for this change
- scanner: read the files a committed zip carries (#6800) (67563f9) Evidence for this change
Improved
6- approvals: settle a claimed native review retry in one store call (#6715) (ccaf48f) Evidence for this change
- guard: derive policy-bundle claim identities in the resident (#6777) (84aed73) Evidence for this change
- guard: derive policy-bundle lookup identities in the resident (#6771) (193f833) Evidence for this change
- hook: queue an edge PostToolUse activity behind its receipt (#6736) (104fbf6) Evidence for this change
- hook: queue an edge PreToolUse activity the daemon returns as rendered (#6745) (a2d5c03) Evidence for this change
- hook: record a direct answer's command activity in the resident (#6724) (83a6d80) Evidence for this change
Fixed
177- aibom: upload one primary body per inventory item (#7177) (65c7809) Evidence for this change
- approvals: open paused reviews signed in, and in HOL Guard Desktop when it is installed (#7154) (35774be) Evidence for this change
- cigar: install CIGAR without a separate qualification receipt (#6907) (ec72918) Evidence for this change
- cigar: keep picked folders listed while CIGAR rests (#7015) (0f87f95) Evidence for this change
- cigar: keep picked project folders across restarts and settings saves (#7012) (d4bb724) Evidence for this change
- cigar: prefer source files over tests in prompt context (#7010) (834f467) Evidence for this change
- cigar: projects count for every app and Home explains CIGAR again (#7106) (ddf0acc) Evidence for this change
- cigar: rank prompt files by word rarity and keep the first prompt after a break (#7065) (91822de) Evidence for this change
- cigar: show the quoted lines when CIGAR picks other lines of the same file (#7102) (0f02a40) Evidence for this change
- cigar: wake a resting CIGAR worker when a Claude Code session starts (#7101) (31e2563) Evidence for this change
- cigar: wake resting project context when a session or prompt starts (#7014) (ac4df9a) Evidence for this change
- cigar: warm the project when a prompt finds CIGAR still starting (#7083) (f14afd9) Evidence for this change
- claude: move upgraded installs back onto the native SessionStart lane (#7132) (05f427b) Evidence for this change
- cli: report a refused Guard Cloud signing key as a runtime error (#6980) (61fa5a7) Evidence for this change
- cloud-actions: bind the exchange proof to the subject token (#7187) (d56b73a) Evidence for this change
- cloud-actions: doctor notices a revoked connection with no AI tool set up (#7196) (1895226) Evidence for this change
- cloud-actions: keep the Cloud actions folder private when only a lock is taken (#7093) (65bf771) Evidence for this change
- cloud-actions: let the local Cloud actions reads run without a review (#7104) (290fb61) Evidence for this change
- cloud-actions: put settings back when apply is interrupted after the move (#7077) (dbb6754) Evidence for this change
- cloud-review: name the published Cloud rule that queued a review (#6787) (606694f) Evidence for this change
- codex: honor approvals across hook waits and retries (2f91754) Evidence for this change
- codex: let Codex's own sandbox contain calls Guard's runner cannot start in (#7179) (c6847e9) Evidence for this change
- command: charge a grep include walk only for its own time (#6878) (d7c1fd6) Evidence for this change
- command: contain a package test run quieted by npm's own option (#7023) (aed5050) Evidence for this change
- command: contain a run that reports its own status after a cd (#6998) (e3187f7) Evidence for this change
- command: contain a run whose output passes through cut (#6999) (5f284f1) Evidence for this change
- command: contain a type-check that pipes through one observer (#6978) (fe9e64c) Evidence for this change
- command: contain a Vitest run that names the files to run (#6972) (7ccd039) Evidence for this change
- command: contain a workspace test file run straight through Bun (#6953) (9722532) Evidence for this change
- command: gate the words a package script run passes on (#6880) (710e262) Evidence for this change
- command: keep a Git command that drops committed history at review (#6703) (eee5b2a) Evidence for this change
- command: keep a search over a root that is not there quiet (#7020) (d1b6045) Evidence for this change
- command: keep a sibling run contained when a cat stage respells its output (#7231) (5a87dca) Evidence for this change
- command: let a grep include narrow the recursive walk (#6779) (4167f3b) Evidence for this change
- command: let a read-only step before a Git read keep its configuration proof (#7223) (77e4b87) Evidence for this change
- command: let an ESM test run keep its NODE_OPTIONS prefix (#7029) (fc26c30) Evidence for this change
- command: list the extensions this device was delivered (#6986) (6976f67) Evidence for this change
- command: name a bisect session so it stops reading as unknown (#6784) (d02ea31) Evidence for this change
- command: name the records git keeps beside the history (#6804) (353f464) Evidence for this change
- command: project a setting prefix whose value holds a pattern (#7031) (809dc6d) Evidence for this change
- command: prove a cd to a sibling checkout on Windows (#7229) (f82a5fa) Evidence for this change
- command: prove tsc reads only when its project says so (#6934) (fcfc099) Evidence for this change
- command: read
git switch -as the branch Git left last (#6866) (56b0b5e) Evidence for this change - command: read a crates.io search without the package review (#6792) (a3f1db7) Evidence for this change
- command: read a grep include glob by what it can select (#6767) (48d0b1a) Evidence for this change
- command: read a health check written with a retry policy (#6761) (d782819) Evidence for this change
- command: read a helm command's usage text without review (#6722) (e0d5c33) Evidence for this change
- command: read a line-walking loop's own name without review (#6822) (1dd0cd3) Evidence for this change
- command: read a lock directory's own marker without a review (#6943) (cf53f46) Evidence for this change
- command: read a lone usage flag as the text it prints (#6718) (583e57d) Evidence for this change
- command: read a loopback liveness ping without review (#6755) (1c3ab0a) Evidence for this change
- command: read a manager run behind the options that only choose how much it prints (#6889) (96da49d) Evidence for this change
- command: read a manager's second-level usage text without review (#6740) (8c9d24b) Evidence for this change
- command: read a package manager's local-bin spelling in one place (#7018) (03a8b10) Evidence for this change
- command: read a package manager's own verb aliases (#6896) (386893e) Evidence for this change
- command: read a package manager's usage text without review (#6727) (cc80f5d) Evidence for this change
- command: read a pattern in a setting value as data a contained run drops (#7218) (23d4795) Evidence for this change
- command: read a project's own Mocha as the read-only run it is (#6860) (c7889c2) Evidence for this change
- command: read a quoted pipe in a loop body as text (#6734) (5ad6353) Evidence for this change
- command: read a search that lists file names into xargs (#6776) (b909d94) Evidence for this change
- command: read a search tool's recursive and alternation globs (#6855) (635fad0) Evidence for this change
- command: read a sed address a reader spells as a pattern (#6895) (7bcaaf8) Evidence for this change
- command: read a sed region a reader names with a pattern (#7228) (a91b72a) Evidence for this change
- command: read a test run by the interpreter it names (#6870) (a5252ea) Evidence for this change
- command: read a tool's own off switch as an inert setting (#7045) (baf3177) Evidence for this change
- command: read a usage page a rendering flag sits beside (#6748) (6bd85a1) Evidence for this change
- command: read a wait for a service as the question it asks (#6757) (330e6ef) Evidence for this change
- command: read a wget health check that names where the response goes (#6766) (7fe8ab4) Evidence for this change
- command: read a workspace's own tsc under the path that names its binary (#6976) (699cf01) Evidence for this change
- command: read ag and ack search patterns as patterns, not paths (#6919) (2d2bcbf) Evidence for this change
- command: read an fd walk that hands its files to a reader (#6774) (35d1b84) Evidence for this change
- command: read an HTTPie request to a dev server without review (#6770) (067bff3) Evidence for this change
- command: read go mod's reporting subcommands inside the sandbox (#6788) (52c538a) Evidence for this change
- command: read npm's own reporting keys in front of a test run (#7042) (45089cc) Evidence for this change
- command: read pnpm's registry reports the way npm's are read (#6730) (7385719) Evidence for this change
- command: read the DigitalOcean contexts a listing names (#6826) (408cc77) Evidence for this change
- command: read the gem queries that print what is installed (#6798) (e8d74a9) Evidence for this change
- command: read the git verbs that compare commits (#6797) (383e5f3) Evidence for this change
- command: read the helper script a skill document names (#6838) (7fe3d11) Evidence for this change
- command: read the installer's link as the entry it points at (#7026) (2a1c9ca) Evidence for this change
- command: read the loopback host written as an IPv6 literal (#6685) (af44845) Evidence for this change
- command: read the message filters a script pipes into git (#6837) (ea63f0c) Evidence for this change
- command: read the other spelling of git blame (#6839) (5378073) Evidence for this change
- command: read the program an fd --exec runs (#6886) (9479a1d) Evidence for this change
- command: read the ref names a script asks git for (#6828) (60aad9c) Evidence for this change
- command: read the staged comparison a script asks git for (#6820) (e3a393e) Evidence for this change
- command: read the subcommand behind yarn workspaces (#6914) (72f9008) Evidence for this change
- command: read the unstaged comparison a script asks git for (#6825) (a2dda64) Evidence for this change
- command: read the word that stops a retry loop (#6772) (fe1b92a) Evidence for this change
- command: read the workspace root pnpm names without spelling it (#6732) (541a930) Evidence for this change
- command: read uv's lockfile assertion inside the sandbox (#6789) (2664d40) Evidence for this change
- command: read what a tool launcher already holds (#6714) (c6a0e09) Evidence for this change
- command: root a contained run in a project that carries no repository (#7225) (474b2b6) Evidence for this change
- command: run a local tool whose own name carries a manager's (#6996) (3eed30b) Evidence for this change
- command: run a test runner Bun launched by its entry path (#6885) (d09c586) Evidence for this change
- command: run a test runner that was told not to watch (#6807) (6786058) Evidence for this change
- command: run Bun's own test runner contained instead of reviewing it (#6842) (2b1b81d) Evidence for this change
- command: run every search spelling a cd compound already proves (#7021) (d8700d2) Evidence for this change
- command: stop reading an operand word as the program a command runs (#6891) (ac22669) Evidence for this change
- contained: contain a sibling runner whose output a filter trims (#6961) (96fa9f2) Evidence for this change
- contained: run inert NODE_OPTIONS prefixes and inline shell scripts the review sent to the sandbox (#7233) (80a919a) Evidence for this change
- contained: run node and bun installed by a version manager (#7217) (c4714f2) Evidence for this change
- context: lead a prompt's code with the part that defines its words (#7180) (4475afb) Evidence for this change
- context: lead prompt context with the file the prompt names (#7075) (1b4f27b) Evidence for this change
- daemon: give a packaged Windows start the time it actually needs (#6874) (bb4cea1) Evidence for this change
- dashboard: make Cloud actions links and commands accessible (#7164) (451187c) Evidence for this change
- dashboard: plain words on the CIGAR Settings and Updates tabs (#7186) (f16fb1c) Evidence for this change
- dashboard: put the long Codex session switch first on CIGAR Settings (#7202) (b03f4a0) Evidence for this change
- dashboard: say what CIGAR does on Home and Settings in plain words (#7053) (dca7dac) Evidence for this change
- dashboard: show Reconnect when Guard Cloud revokes this computer's connection (#7189) (2d92bf0) Evidence for this change
- dashboard: smoother first run for CIGAR setup and projects (#7204) (3532434) Evidence for this change
- desktop: wait for a Core that outlasts the start window during bootstrap (#6738) (4fc087a) Evidence for this change
- gauntlet: prepare optional extension packs without the driver's env var (#7222) (d20c603) Evidence for this change
- git: allow a shared-objects clone of a local checkout (#7155) (73fc718) Evidence for this change
- git: read a proven origin listing without a review (#6950) (c0ebbc6) Evidence for this change
- grok: route Grok's workspace containment through its own hook (#6930) (c05e0d6) Evidence for this change
- guard-command: give AVA the contained run Vitest, Jest and Mocha already have (#7098) (51f9bdb) Evidence for this change
- guard: give a session's first prompt code while CIGAR starts (#7161) (b0a4ce8) Evidence for this change
- guard: leave passing matches out of CIGAR prompt context (#7201) (a02d9b0) Evidence for this change
- guard: let CIGAR read React files that pass a password prop (#7145) (9913369) Evidence for this change
- guard: plan grouped shell work the sandbox was told to contain (#7219) (e8d8f07) Evidence for this change
- guard: read a file:// target as the path it names in Oh My Pi reads (#7221) (8ba0371) Evidence for this change
- guard: read a sort key, field separator or buffer size as the option value it is (#7118) (1282435) Evidence for this change
- guard: read the columns paste, join and column lay out (#7121) (e3702fd) Evidence for this change
- guard: read the decompressing viewers and the remaining text filters instead of reviewing them (#7192) (0fb41fb) Evidence for this change
- guard: read the dump and paging filters instead of reviewing them (#7130) (3bca61e) Evidence for this change
- guard: read the lines nl, tac, rev, fold, expand and fmt lay out (#7125) (bf87fdd) Evidence for this change
- guard: read the Windows DNS host name in the resident (#6775) (98d5968) Evidence for this change
- guard: run workspace Python against a venv activated outside the project (#7224) (aaa0670) Evidence for this change
- guard: stop resending review events the server has permanently quarantined (#6810) (6e8cb1e) Evidence for this change
- hooks: hand a stale bounded bridge's hook to the runtime the resident runs (#6979) (8ab38cc) Evidence for this change
- local-cli: launch a pasted script as an MCP server only when its source serves MCP (#6905) (eec2160) Evidence for this change
- mcp.aseprite: describe the published 0.2.0 server (a3bb602) Evidence for this change
- mcp: decide calls to non-ASCII tool names in the native relay (#6763) (cfb2701) Evidence for this change
- mcp: launch Cline's managed MCP servers through the native relay (#6749) (7c9965c) Evidence for this change
- mcp: say when a server exits before Guard's discovery probe hears it (#7152) (1312c0c) Evidence for this change
- muse: keep skill discovery issue ids free of local paths (#7166) (a61cd76) Evidence for this change
- network-protection: verify bundles whose threat feeds exceed 4,096 entries (#7138) (506d52b) Evidence for this change
- network: refresh a lapsed token before giving up on the network bundle (#7149) (4d2fffd) Evidence for this change
- network: verify a network protection bundle too large for a request frame (#7148) (a25e3a5) Evidence for this change
- package: bind a pinned tsc through its typescript package (#6923) (afaba69) Evidence for this change
- package: name the distribution a local wheel installs (#6989) (1f2a125) Evidence for this change
- package: read a pnpm monorepo lockfile through its importer (#6939) (011c005) Evidence for this change
- package: read a test script's runner body with that runner's own grammar (#6973) (daaee0a) Evidence for this change
- package: read bun's workspace selector before its verb (#6988) (b5c1204) Evidence for this change
- package: read pnpm and yarn lockfiles for the pinned-runner verdict (#6932) (43e3962) Evidence for this change
- package: run a project's own pinned runner without a package review (#6906) (9f14e9c) Evidence for this change
- policy: acknowledge v2 bundles that carry no managed delivery (#6783) (9c9d16d) Evidence for this change
- policy: ask before a command a Cloud review rule names (#6834) (136dfd5) Evidence for this change
- policy: enforce Cloud review rules from v2 bundles (#6833) (43d6990) Evidence for this change
- policy: let policy commands run first on a new Guard home (#6937) (97b1b22) Evidence for this change
- policy: say how many inactive devices Cloud left out of policy status (#6900) (ca158ba) Evidence for this change
- policy: show Cloud's version number for an applied v1 bundle in policy status (#6852) (a90a055) Evidence for this change
- policy: stop holding a new publication against an older v1 shadow (#6853) (7f5f457) Evidence for this change
- policy: tell users how to show a policy with workspace rules (#6926) (47d4d3e) Evidence for this change
- pretool: allow an Oh My Pi search whose path argument is left empty (#7234) (cf167d2) Evidence for this change
- pretool: treat an empty structured field as absent, not a malformed payload (#7216) (3a6f0ac) Evidence for this change
- prompt: stop holding secret-category prompts and review their tool calls instead (#7157) (ce40b11) Evidence for this change
- reads: read a project's own hidden configuration instead of refusing its name (#7163) (de6ea15) Evidence for this change
- review: stop advising a split that cannot reduce a chained review (#7156) (e4b1f16) Evidence for this change
- runners: read cucumber-js runs inside their own workspace (#7114) (e916591) Evidence for this change
- runners: read tap, borp, poku and lab runs inside their own workspace (#7153) (a6f4fe1) Evidence for this change
- runners: read tape and tsd runs inside their own workspace (#7111) (9eccb63) Evidence for this change
- runners: read tsx --test the way node --test already reads it (#7108) (bee0040) Evidence for this change
- runtime: let Cursor and ZCode retries reach the approval the user gave (#6873) (19b22c3) Evidence for this change
- runtime: record the Guard version on native review requests (#6977) (220e31e) Evidence for this change
- runtime: run every read-only containment profile on Linux (#6993) (36d2f6d) Evidence for this change
- runtime: share one file among older durable runtime copies (#6975) (8861c4f) Evidence for this change
- runtime: show matched code, not a file list, when CIGAR is busy or late (#7209) (61bc1c0) Evidence for this change
- sandbox: run the tool a macOS developer shim forwards to inside the workspace sandbox (#6991) (19d7c6a) Evidence for this change
- scanner: read the zip behind a self-extracting stub (#6843) (f01b1ba) Evidence for this change
- scanner: wipe the archive buffers the secret scan reads from (#6854) (e3d56de) Evidence for this change
- scanner: wipe the file buffers the secret scan reads from (#6847) (c62a118) Evidence for this change
- status: drop team policy fields that were always false (#7096) (2048060) Evidence for this change
- supply-chain: give the Cloud evaluate retry a longer deadline than the first try (#6862) (2ec0224) Evidence for this change
- test: read every file a tsx test run loads (#6954) (cd14e04) Evidence for this change
- worktree: recognise a branch named after the worktree start point (#7135) (09ed8e1) Evidence for this change
Other changes
11- actions: bump actions/download-artifact from 8.0.1 to 8.0.2 (#3167) (a1e15ff) Evidence for this change
- actions: bump actions/setup-node from 4.4.0 to 7.1.0 (#6982) (da1b7eb) Evidence for this change
- actions: bump actions/upload-artifact from 7.0.1 to 7.0.2 (#6981) (ab1c356) Evidence for this change
- actions: bump astral-sh/setup-uv from 8.2.0 to 10.3.3 (#6983) (c86b82e) Evidence for this change
- actions: bump codeql init and analyze together to 4.38.2 (#7002) (9da8e90) Evidence for this change
- actions: bump docker/build-push-action from 7.2.0 to 7.4.0 (#3159) (27c0450) Evidence for this change
- actions: bump docker/login-action from 4.2.0 to 4.6.0 (#3166) (31aee03) Evidence for this change
- actions: bump github/codeql-action/upload-sarif from 4.38.1 to 4.38.2 (#3157) (285a9e1) Evidence for this change
- docker: bump the docker-all group across 3 directories with 1 update (#6987) (67fa59b) Evidence for this change
- extension-builder: explain when to add a hosted action binding and how it is reviewed (#7069) (fd5dd05) Evidence for this change
- extensions: test contributions with an installed Guard (#7116) (c03c82a) Evidence for this change
Upgrade and compatibility
None documented.
Compare with the previous release
Predecessor on the same channel: v3.58.0
Verified contributors
Credits derive from public pull-request authorship, verified commit authorship, or verified co-authorship — never from thanks text or release metadata. Each distinct contributor is listed once; the evidence ledger paginates every published credit record.
Evidence ledger0 credits
No credits are published for this release yet.