Skip to content

Release v0.16.2 - #548

Merged
Paulo Lacerda (placerda) merged 10 commits into
mainfrom
release/v0.16.2
Nov 6, 2026
Merged

Release v0.16.2#548
Paulo Lacerda (placerda) merged 10 commits into
mainfrom
release/v0.16.2

Conversation

@placerda

@placerda Paulo Lacerda (placerda) commented Nov 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Release v0.16.2

Patch release from validated develop commit 644a075d1f1095be8f440ecac9d959a0b0a0736d. Final candidate: c2b10c9aef3ba37539b804bb1d623541f90f22c8.

Scope

Validation and actual staged artifacts

  • Preferred Cut Release succeeded.
  • Final-head Staging succeeded: strict lint, full CI suite, Python build, real TestPyPI upload/install/smoke tests and artifact-only pre-release VSIX packaging.
  • Required full local suite on this exact candidate: 1710 passed, 1 skipped. The skip is the negative missing-MCP test because MCP is installed. No Azure credentials or live cloud calls were used.
  • TestPyPI wheel and sdist for 0.16.2.dev10 match the official published SHA256 digests.
  • Actual wheel payload matches the candidate's security helper and changed workflow templates. Wheel and sdist include the new protected ADO entry template.
  • Actual candidate VSIX is 0.16.2, pre-release, with exactly seven unique skill registrations and all referenced files present. SHA256: 79fbd2c4d58799cb1ff713033f78c048cb675dacdad200cd52db217c024efc77.
  • Release notes, metadata and preserved ancestry reviewed. No unrelated integration changes or overlapping release were found.
  • Human installs, evaluates and approves this exact staged VSIX. The 0.16.1 approval does not apply to this candidate.
  • Release PR reviewed and merged through normal controls.
  • Stable tag v0.16.2 pushed on the verified main merge commit. Tagging publishes Python irreversibly without an approval pause.
  • Main immediately synchronized back into develop, with empty origin/develop..origin/main log and correct Unreleased structure.
  • Actual human marketplace-release deployment approval, stable Marketplace publication, PyPI publication and GitHub Release verified.

Required consumer migration

Installing the new package does not migrate existing copied workflows. Consumers must regenerate the YAML and configure and validate the protected resources and exclusive status identities documented in CI/CD setup. Publishing this code does not configure or demonstrate those controls in consumer organizations. This is not a general prompt-injection defense.

Issue #499 will be closed only after actual release publication is verified, with these migration limitations explicitly recorded. Python Trusted Publishing, Marketplace Entra OIDC, protected deployment approval, shared Azure settings and secrets remain unchanged.

dependabot Bot and others added 10 commits November 6, 2026 18:02
@dependabot
chore(deps): bump mem0ai from 2.0.5 to 2.0.18 in /infra/e2e/agent-app
906cd86 
Bumps [mem0ai](https://github.com/mem0ai/mem0) from 2.0.5 to 2.0.18.
- [Release notes](https://github.com/mem0ai/mem0/releases)
- [Commits](mem0ai/mem0@v2.0.5...v2.0.18)

---
updated-dependencies:
- dependency-name: mem0ai
  dependency-version: 2.0.18
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@placerda
Merge pull request #545 from Azure/chore/sync-release-0.16.1
1e644d0 
Synchronize released main history through the normal green develop CI controls.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@placerda
fix: isolate credentialed PR evaluation from candidate code
62443a8 
Preserve automatic data-only PR evaluation with trusted configuration, protected templates, credential-safe destinations, and revision-bound status provenance. Relates to #499.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@placerda
docs: clarify independent PR secret-group protections
b8df011 
Distinguish administrator-controlled nonsecret values from independently checked secret resources. Do not imply a service connection check protects a group after the connection is removed.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@placerda
fix: allow the trusted ADO cloud config producer output
b570fdb 
Grant AGENTOPS_CI_CONFIG only to the named trusted preparation step and restrict eval consumers to their exit-code output. Cover generic and prompt-agent PR cloud gates in the regression matrix.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@placerda
Merge pull request #546 from Azure/dependabot/pip/infra/e2e/agent-app…
f98e873 
…/mem0ai-2.0.18

Integrate the reviewed E2E sample dependency update into develop after the complete CI matrix passed. No changes to the separate security fix or stable release.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@placerda
chore: sync develop before PR gate fix integration
3ac5564 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@placerda
Merge pull request #547 from Azure/placerda-pr-gate-config-review
644a075 
Integrate the reviewed PR evaluation isolation fix after refreshing current develop and passing full local and CI validation. Keep the migration requirements explicit and the change under Unreleased.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@github-actions
chore: prepare release 0.16.2
6802a9a
@placerda
docs: complete release 0.16.2 dependency notes
c2b10c9 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@placerda

Paulo Lacerda (placerda) commented Nov 6, 2026

Copy link
Copy Markdown
Contributor Author

The maintainer explicitly confirmed installing, evaluating and approving the exact staged 0.16.2 VSIX in the release session. This applies to candidate c2b10c9 and VSIX SHA256 79fbd2c4d58799cb1ff713033f78c048cb675dacdad200cd52db217c024efc77.

Final-head staging 42306196445 succeeded. Required local full suite on that head: 1710 passed, one expected missing-MCP negative-test skip because MCP is installed. Actual TestPyPI hashes, packaged security payload, isolated wheel installation and CLI smoke tests were verified. Live main/develop refs and unused stable version were rechecked immediately before the normal merge.

This records the actual human candidate evaluation, not a fabricated formal self-approval or Marketplace deployment approval. The protected marketplace-release approval remains required. Issue #499 stays open until actual publication is verified, then closes with the mandatory consumer workflow migration and external-control caveats.

@placerda
Paulo Lacerda (placerda) merged commit 0f2173d into main Nov 6, 2026
5 checks passed
@placerda Paulo Lacerda (placerda) mentioned this pull request Nov 6, 2026
Merged
@placerda
Paulo Lacerda (placerda) deleted the release/v0.16.2 branch November 6, 2026 23:30

This branch was successfully deployed

1 active deployment
staging — c2b10c9a Deployed Nov 6, 2026 by placerda via publish-testpypi #84
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@placerda