[deps-release-notes] mcpg — upstream release action items

[github-actions]

Rolling upstream release action items — mcpg

This is the single canonical tracking issue for action items from new mcpg releases. The update-awf-version workflow appends a comment here for each version bump going forward — the most recent activity lives in the comments below. This body consolidates everything filed so far.

Latest pinned version covered: 0.3.32

Consolidated history (earliest → latest)

0.3.12 → 0.3.23 (was #882)

• OTel span attributes aligned with gen_ai semantic conventions (v0.3.16): MCPG now emits OTel spans following the OpenTelemetry gen_ai semconv. ado-aw's audit analyzer (src/audit/analyzers/otel.rs) may need updating if it relies on specific MCPG span field names.
• Per-session tool call limits in allow-only guard policies (v0.3.20): MCPG enforces per-session limits in allow-only mode; ado-aw could expose as a configurable field (e.g., tools.call-limit:).
• Timeout fields added to embedded JSON schema (v0.3.23): MCPG config schema now includes timeout fields; ado-aw should review whether to surface in engine: or tools: front-matter.
• Security: GHE Cloud data residency proxy routing fix (v0.3.23): GraphQL requests were routed to wrong upstream for GHE Cloud data-residency tenants; fixed automatically on version bump.

0.3.23 → 0.3.24 (was #903)

• Breaking: "API key" surface renamed to "Agent ID" (v0.3.24): Deprecated compatibility aliases removed; gateway now uses X-Agent-ID for routing. Audit MCPG config types in src/compile/extensions/mod.rs for any removed alias fields.
• Unauthenticated /reflect endpoint for live DIFC label snapshots (v0.3.24): New diagnostics endpoint; ado-aw's audit/status commands could use this for richer DIFC diagnostics.

0.3.23 → 0.3.25 (was #931)

• Security: $ENV expansion disabled in tool response filters (v0.3.25): Prevents environment variable leakage/injection through crafted tool responses. Verify any custom filter expressions remain functional.
• Metadata endpoint allowlisting (v0.3.25): MCPG proxy now allowlists metadata endpoints and passes through unrecognized reads; may resolve prior MCP client liveness/metadata call blocking.

0.3.25 → 0.3.26 (was #1059)

• OTLP multi-endpoint fan-out via GH_AW_OTLP_ENDPOINTS (v0.3.26): MCPG supports sending OTel telemetry to multiple OTLP endpoints; ado-aw could expose in compiled pipeline variables.
• Deprecation: MCP_GATEWAY_API_KEY → MCP_GATEWAY_AGENT_ID (v0.3.26): run.sh now reads MCP_GATEWAY_AGENT_ID with deprecated fallback for MCP_GATEWAY_API_KEY. ado-aw generates pipelines that set MCP_GATEWAY_API_KEY (src/compile/agentic_pipeline.rs, src/compile/common.rs); migrate to MCP_GATEWAY_AGENT_ID before the fallback is removed.

0.3.25 → 0.3.27 (was #1119)

• GitHub MCP Server v1.3.0 support (v0.3.27): MCPG routes PR commits and supports get_file_blame spec; verify GitHub MCP extension config + network allowlists are compatible.
• refusal-labels guard policy (v0.3.27): New guard policy type for classifying agent refusals; ado-aw could expose in MCPG configuration.
• MCP_GATEWAY_SHUTDOWN_TIMEOUT env var documented (v0.3.27): ado-aw could expose in generated pipeline teardown steps.

0.3.25 → 0.3.28 (was #1169)

• Security: wazero WASM guard hardening (v0.3.28): Added memory cap and backend call limit to wazero WASM runtime; protects against malicious/malformed WASM guards. Consumers benefit automatically on upgrade.

0.3.25 → 0.3.29 (was #1185)

• Security: DIFC labeling gaps covered (v0.3.28): get_code_quality_finding, ui_get, add_gpg_key, add_ssh_key previously lacked DIFC integrity/secrecy labels; gap now closed. Older MCPG versions did not enforce integrity for these operations.
• Opt-in observed URL domain audit pipeline (v0.3.29): Records which URL domains appear in MCP tool responses + write sinks; ado-aw could expose opt-in flag and surface data in ado-aw audit reports.

0.3.29 → 0.3.31 (was #1242)

• Gateway domain validation widened to RFC-1123 topology hostnames (v0.3.30): Accepts topology hostnames like my-server.namespace.svc.cluster.local; fixes unexpected validation errors.
• Prompt passthrough via go-sdk (v0.3.31): Fixes context propagation + adds prompt passthrough through SDK-mediated backend calls.
• DIFC proxy GHEC data-residency REST API host derivation fix (v0.3.31): Fixes wrong API host calculation for GHEC data-residency deployments.

0.3.29 → 0.3.32 (was #1253) — canonical

• GitHub reaction operations classified as WRITE_OPERATIONS (v0.3.32): Adding/removing emoji reactions now subject to DIFC integrity enforcement. Agents calling GitHub reaction APIs require adequate DIFC integrity clearance. This is a security tightening — confirm DIFC integrity level is configured correctly.

---

Consolidated by the Deps Release-Notes Consolidator workflow. Superseded per-release issues were closed and point here.

Generated by Deps Release-Notes Consolidator · 319.3 AIC · ⌖ 17.7 AIC · ⊞ 6.6K · ◷

[github-actions]

mcpg 0.3.29 → 0.3.33

Releases analyzed

• v0.3.30
• v0.3.31
• v0.3.32
• v0.3.33

Security fixes

• DIFC reaction operations classification (v0.3.32): fix(guard): add reaction operations to WRITE_OPERATIONS and DIFC rules — GitHub reaction operations (👍/👎 etc.) were previously missing from the WRITE_OPERATIONS and DIFC enforcement rules. They are now correctly classified. ado-aw workflows whose agent uses reaction tools may see tighter authorization enforcement after this MCPG upgrade.
• DIFC GHEC data-residency host derivation (v0.3.31): Fix DIFC proxy GHEC data-residency REST API host derivation — the DIFC proxy was incorrectly deriving the REST API host for GitHub Enterprise Cloud (GHEC) data-residency domains. Fixed to ensure DIFC policies apply correctly to GHEC endpoints.

Deprecations

• api_key deprecated in favour of agent_id (v0.3.33): Replace deprecated api_key with agent_id in example config — if ado-aw's compiled pipelines or documentation reference the api_key MCPG config field, they should be updated to use agent_id instead.

Generated by Dependency Version Updater · 122.6 AIC · ⌖ 15.2 AIC · ⊞ 10.9K · ◷

[github-actions]

mcpg 0.3.29 → 0.4.0

Releases analyzed

• v0.3.30
• v0.3.31
• v0.3.32
• v0.3.33
• v0.4.0

Security fixes

• Reaction operations added to WRITE_OPERATIONS and DIFC rules (v0.3.32): GitHub reaction operations (e.g. adding a thumbs-up on an issue or PR) were not classified as write operations in the DIFC guard and were missing from WRITE_OPERATIONS. They now are. No ado-aw changes needed; this confirms reactions are properly gated at the MCPG layer.
• Sink-visibility guard policy prevents GitLost exfiltration (v0.4.0): New write-sink guard policy (Add sink-visibility to write-sink guard policy to prevent GitLost exfiltration) checks sink visibility before allowing writes, preventing a class of exfiltration where an agent could write to a private or unlisted sink. No ado-aw changes required; defense-in-depth improvement at the MCPG guard layer.

Notable features for ado-aw to adopt

• ToolAnnotations no longer dropped in routed mode (v0.4.0): Fix ToolAnnotations drop in routed mode — tool annotations were silently dropped in multi-backend (routed) mode. Since ado-aw uses routed mode for its MCP setup, tool annotations set by ado-aw's safe-outputs MCP tools are now correctly propagated to the agent.
• OTel tracing improvements (v0.4.0): feat(tracing): OTel improvements from go-fan review — improved OpenTelemetry span and trace coverage in the MCPG routing layer; better observability for diagnosing tool-call latency and routing hops in ado-aw audit.
• Gateway domain validation widened to RFC-1123 topology hostnames (v0.3.30): fix: widen gateway.domain validation to accept RFC-1123 topology hostnames — gateway.domain now accepts hostnames like mcpg.namespace.svc.cluster.local; relevant for ado-aw users deploying MCPG inside Kubernetes clusters.

Deprecations

• api_key config field deprecated in favor of agent_id (v0.3.33): Replace deprecated api_key with agent_id in example config — the api_key field in MCPG config has been replaced by agent_id. Audit ado-aw's MCPG config generation (e.g. src/compile/extensions/safe_outputs.rs, src/compile/common.rs) for any api_key field emission and migrate to agent_id.

Generated by Dependency Version Updater · 180.6 AIC · ⌖ 14.4 AIC · ⊞ 10.9K · ◷

[github-actions]

mcpg 0.3.29 → 0.4.1

Releases analyzed

• v0.3.30
• v0.3.31
• v0.3.32
• v0.3.33
• v0.4.0
• v0.4.1

Notable features for ado-aw to adopt

• force-public-repos enforcement for public repositories (v0.4.1, #8933, #8948): MCPG now automatically enforces repos="public" when a workflow runs in a public GitHub repository, applying in both standard and proxy modes. ado-aw should document this behavior in docs/mcpg.md and docs/network.md so users authoring workflows for public repositories understand why they may see stronger repo-access restrictions at runtime. No compiler change required, but the behavioural guarantee may be worth surfacing to users.

• ToolAnnotations now pass through in routed mode (v0.4.0, #8567): A bug that silently dropped ToolAnnotations when routing MCP calls through MCPG was fixed. If ado-aw surfaces tool annotations (e.g., for the azure-devops or cache-memory tools), those annotations will now be visible to the agent. No ado-aw code change required; verify that any tool-annotation metadata ado-aw emits is intentional.

Deprecations

• api_key field deprecated in favour of agent_id (v0.3.33, #8342): MCPG's example config replaced api_key with agent_id. If ado-aw generates or documents MCPG config that includes api_key, it should be updated to use agent_id to stay aligned with the upstream recommendation. Check src/compile/extensions/safe_outputs.rs, src/compile/extensions/github.rs, and any doc references to MCPG config schema.

Generated by Dependency Version Updater · 119.2 AIC · ⌖ 13.6 AIC · ⊞ 10.9K · ◷

[github-actions]

mcpg 0.4.1 → 0.4.3

Releases analyzed

• v0.4.2
• v0.4.3

Notable features for ado-aw to adopt

• MCP_GATEWAY_FORCE_PUBLIC_REPOS and GITHUB_REPOSITORY documented as gateway env vars — v0.4.2 adds these to ENVIRONMENT_VARIABLES.md. MCP_GATEWAY_FORCE_PUBLIC_REPOS forces the gateway to treat all repos as public (useful for restricted-token scenarios). ado-aw could consider surfacing MCP_GATEWAY_FORCE_PUBLIC_REPOS as a config option for consumers that need it. (v0.4.2)
• MCP_GATEWAY_WASM_GUARDS_DIR env var now checked by detectGuardWasm — v0.4.2 extends WASM guard discovery to also check this env var, giving consumers an additional way to configure custom WASM guards. No ado-aw change required; noted for awareness. (v0.4.2)

Generated by Dependency Version Updater · 91.2 AIC · ⌖ 12.7 AIC · ⊞ 10.9K · ◷

[github-actions]

mcpg 0.4.1 → 0.4.5

Releases analyzed

• v0.4.2
• v0.4.3
• v0.4.4
• v0.4.5

Security fixes

• Bump Go to 1.26.4 and grpc to v1.82.1 to clear High CVEs — upstream dependency bumps clear High-severity CVEs in MCPG's Go runtime and gRPC library. ado-aw consumers running a pinned MCPG image will benefit after upgrading to 0.4.5. (v0.4.5)

Notable features for ado-aw to adopt

• MCP_GATEWAY_FORCE_PUBLIC_REPOS env var documented — MCP_GATEWAY_FORCE_PUBLIC_REPOS and GITHUB_REPOSITORY are now formally documented in ENVIRONMENT_VARIABLES.md. ado-aw could expose MCP_GATEWAY_FORCE_PUBLIC_REPOS as a front-matter option if consumers need to force MCPG to treat repos as public for routing purposes. (v0.4.2)
• Config schema error locations now formatted as JSON Pointers — MCPG now reports config schema validation errors with JSON Pointer paths, making misconfiguration easier to diagnose. ado-aw's lint / mcp-author error surfaces may benefit from consuming these improved error messages if they forward MCPG config errors to users. (v0.4.4)

Generated by Dependency Version Updater · 108.7 AIC · ⌖ 13.4 AIC · ⊞ 11K · ◷

[github-actions]

mcpg 0.4.1 → 0.4.6

Releases analyzed

• v0.4.2
• v0.4.3
• v0.4.4
• v0.4.5
• v0.4.6

Security fixes

• fix: bump Go to 1.26.4 and grpc to v1.82.1 to clear High CVEs (v0.4.5) — Go runtime and gRPC were bumped to resolve High severity CVEs. This fix is contained in the pre-built MCPG binary that ado-aw pins; updating MCPG_VERSION to 0.4.5+ picks it up automatically.

Notable features for ado-aw to adopt

• Add configurable stdio container runtime (Docker/Podman) with runtime command overrides (v0.4.6) — MCPG now supports selecting between Docker and Podman (and overriding runtime commands) via a new MCP_GATEWAY_CONTAINER_RUNTIME environment variable. ado-aw could expose this option in the engine: or tools: front-matter block to let consumers running rootless Podman environments switch runtimes without forking the pipeline.
• chore: bump MCPGatewaySpecVersion to 1.15.0 (v0.4.6) — The MCP Gateway spec version advanced to 1.15.0. ado-aw should verify that any spec-version-gated behaviour in the gateway (e.g. new routing modes or capability negotiation) remains compatible with the compiled pipeline output.
• docs: add MCP_GATEWAY_FORCE_PUBLIC_REPOS and GITHUB_REPOSITORY to ENVIRONMENT_VARIABLES.md (v0.4.2) — Two new documented environment variables: MCP_GATEWAY_FORCE_PUBLIC_REPOS (forces public-repo scope) and GITHUB_REPOSITORY (repo context injection). ado-aw may want to pass GITHUB_REPOSITORY through to the MCPG container in the compiled pipeline.

Generated by Dependency Version Updater · 124.3 AIC · ⌖ 12.8 AIC · ⊞ 11K · ◷

[github-actions]

mcpg 0.4.1 → 0.4.7

Releases analyzed

• v0.4.2
• v0.4.3
• v0.4.4
• v0.4.5
• v0.4.6
• v0.4.7

Security fixes

• Bumped Go to 1.26.4 and gRPC to v1.82.1 to resolve High CVEs in the MCPG runtime. (v0.4.5)

Notable features for ado-aw to adopt

• Added dockerless Podman mode: MCPG can now run agent containers via Podman instead of Docker, which may unblock ado-aw users on runner pools where Docker is unavailable or restricted. ado-aw documentation and runner prerequisites guidance may want to reference this. (v0.4.7)

Generated by Dependency Version Updater · 103.7 AIC · ⌖ 13.7 AIC · ⊞ 11.1K · ◷

[github-actions]

mcpg 0.4.1 → 0.4.8

Releases analyzed

• v0.4.2
• v0.4.3
• v0.4.4
• v0.4.5
• v0.4.6
• v0.4.7
• v0.4.8

Security fixes

• v0.4.5 bumps Go to 1.26.4 and grpc to v1.82.1 to clear High severity CVEs. Since ado-aw pulls the MCPG image (ghcr.io/github/gh-aw-mcpg), consumers benefit automatically once the pinned version is updated — no action needed beyond the version bump itself.

The remaining releases in this range (0.4.2, 0.4.3, 0.4.4, 0.4.6, 0.4.7, 0.4.8) were documentation updates, clippy/lint fixes, internal refactors, and test-coverage improvements with no consumer-visible effect — no breaking changes, notable adoptable features, or deprecations were found.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• index.crates.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "index.crates.io"

See Network Configuration for more information.

Generated by Dependency Version Updater · aut00 · 131.4 AIC · ⌖ 12.9 AIC · ⊞ 16.1K · ◷

[github-actions]

mcpg 0.4.1 → 0.4.9

Releases analyzed

• v0.4.2
• v0.4.3
• v0.4.4
• v0.4.5
• v0.4.6
• v0.4.7
• v0.4.8
• v0.4.9

Security fixes

• Go/grpc CVE remediation (v0.4.5): bumped Go to 1.26.4 and grpc to v1.82.1 "to clear High CVEs." No consumer action needed beyond upgrading the pinned version.
• Trusted host-path mount policy enforcement (v0.4.9): MCPG now "Enforce[s] a trusted host-path mount policy before launching container MCP servers," tightening how container MCP servers can be mounted. Worth double-checking ado-aw's container MCP server configuration surfaces (docs/mcp.md) remain compatible.

Notable features for ado-aw to adopt

• Dockerless Podman mode (v0.4.7): MCPG added a "dockerless Podman mode" and a secure Podman 6 runtime image, plus configurable stdio container runtime (Docker/Podman) with runtime command overrides (v0.4.6). ado-aw could expose a container-runtime: option in tools:/mcp: front-matter for consumers who prefer Podman over Docker.
• /reflect-adjacent diagnostics / DIFC labeling coverage expansion (v0.4.8–v0.4.9): continued DIFC label test coverage additions (PR review write tools, legacy aliases) reduce the chance of unlabeled write operations; no direct action needed, but reinforces confidence in DIFC-based safe-output policy for azure-devops/GitHub MCP tools.

The remainder of the 0.4.2–0.4.9 range is dominated by internal refactors, test-coverage improvements, and doc reconciliation with no consumer-visible behavior change.

Generated by Dependency Version Updater · auto · 83.3 AIC · ⌖ 6.36 AIC · ⊞ 16.2K · ◷

[github-actions]

mcpg 0.4.1 → 0.4.10

Releases analyzed

• v0.4.2
• v0.4.3
• v0.4.4
• v0.4.5
• v0.4.6
• v0.4.7
• v0.4.8
• v0.4.9
• v0.4.10

Security fixes

• Go/gRPC bumped to clear High CVEs (v0.4.5): bumped Go to 1.26.4 and grpc to v1.82.1 to clear reported High-severity CVEs in the toolchain/runtime. Consumers get this automatically on upgrade — no action required beyond bumping the pin.
• Trusted host-path mount policy enforcement (v0.4.9): MCPG now enforces a trusted host-path mount policy before launching container MCP servers, hardening against untrusted host-path mounts being passed to containerized MCP servers. Worth confirming ado-aw's generated MCP container configs (src/tools/, MCPG extension wiring) don't rely on any host-path mount pattern that this policy would now reject.

Notable features for ado-aw to adopt

• Configurable stdio container runtime (Docker/Podman), dockerless Podman mode, secure Podman 6 runtime image (v0.4.6, v0.4.7): MCPG can now run stdio-based container MCP servers via Podman instead of only Docker, including a dockerless mode and a hardened Podman 6 runtime image, with configurable runtime command overrides. ado-aw could expose a runtime: (docker/podman) option in its MCPG/container tool configuration for environments where Docker-in-Docker isn't available or Podman is preferred for security/isolation reasons.

Generated by Dependency Version Updater · auto · 123.8 AIC · ⌖ 5.24 AIC · ⊞ 16.5K · ◷

[github-actions]

mcpg 0.4.10 → 0.4.11

Releases analyzed

• v0.4.11

Notable features for ado-aw to adopt

• Capability-bound enclave issue reads (v0.4.11, PR #11813): adds a scoped, capability-bound path for reading GitHub issues from inside the enclave. Worth evaluating whether ado-aw's GitHub MCP tool wiring can adopt this narrower read scope instead of broader issue-read permissions.

---

This release was otherwise routine: test coverage improvements, debug logging additions, internal refactors (DIFC resource API cleanup, Rust guard dedup), a testify dependency bump, and CI/workflow maintenance — no breaking changes, security fixes, or deprecations.

Generated by Dependency Version Updater · auto · 171.5 AIC · ⌖ 6.64 AIC · ⊞ 16.5K · ◷