crxjs/chrome-extension-tools (@crxjs/vite-plugin)

\n\n### [`v2.7.1`](https://redirect.github.com/crxjs/chrome-extension-tools/blob/HEAD/packages/vite-plugin/CHANGELOG.md#271)\n\n##### Patch Changes\n\n- [`efa9c63`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/efa9c63): Update direct dependency ranges for `convert-source-map`, `debug`,\n and `fs-extra`.\n- [`6efde9d`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/6efde9d): Filter Vite 8/Rolldown-only options before the dev file writer calls\n Rollup, removing `Unknown input options: platform` warnings.\n\n### [`v2.7.0`](https://redirect.github.com/crxjs/chrome-extension-tools/blob/HEAD/packages/vite-plugin/CHANGELOG.md#270)\n\n##### Minor Changes\n\n- [`9f00943`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/9f00943): Add dev HMR support for manifest-declared MAIN world content scripts.\n\n##### Patch Changes\n\n- [`a9cc89a`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/a9cc89a): Remove unused vite-plugin dependencies and update selected dependency\n versions.\n\n### [`v2.6.1`](https://redirect.github.com/crxjs/chrome-extension-tools/blob/HEAD/packages/vite-plugin/CHANGELOG.md#261)\n\n##### Patch Changes\n\n- [`2b88621`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/2b88621): Coalesce file writer readiness waits so large dev-server graph\n updates do not repeatedly recompute the same dependency traversal. This also\n fixes late HMR readiness waits that could miss the shared ready event and\n delay content script updates.\n\n### [`v2.6.0`](https://redirect.github.com/crxjs/chrome-extension-tools/blob/HEAD/packages/vite-plugin/CHANGELOG.md#260)\n\n##### Minor Changes\n\n- [`4f5d2ec`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4f5d2ec): feat: add IIFE content script bundling\n\n Content scripts named with `.iife.ts` extension are automatically bundled as\n self-contained IIFE files with all dependencies inlined. This is useful for\n MAIN world content scripts used with `chrome.scripting.executeScript` or\n `chrome.scripting.registerContentScripts`.\n\n##### Patch Changes\n\n- [`5316e9c`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/5316e9c): Allow `chrome-extension://` and `moz-extension://` origins in Vite\n dev-server CORS automatically. This keeps extension pages able to fetch\n dev-server files on Vite releases with the stricter localhost-only CORS\n default, including Vite `4.5.6`, `5.4.12`, and `6.0.9+`, without requiring\n projects to configure `server.cors.origin` manually.\n- [`1aee9ad`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/1aee9ad): fix: dynamic content scripts failing in build --watch mode\n- [`2f8bab5`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/2f8bab5): Fix the dev-mode loading page so it waits for the requested extension\n HTML file, preserves the page URL query string, allows extension-origin\n readiness polling, and throttles automatic reloads to avoid rapid flicker.\n- [`1681511`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/1681511): Expand vite-plugin CI to run e2e tests against supported Vite\n versions and fix compatibility issues exposed by the matrix.\n- [`0593d58`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/0593d58): fix: publish ESM declarations for the Vite plugin entrypoint\n\n### [`v2.5.0`](https://redirect.github.com/crxjs/chrome-extension-tools/blob/HEAD/packages/vite-plugin/CHANGELOG.md#250)\n\n##### Minor Changes\n\n- [`4756baf`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4756baf): feat: add HMR support for CSS declared in manifest content\\_scripts\n\n- [`4756baf`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4756baf): add: browser\\_specific\\_settings.gecko properties\n\n- [`4756baf`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4756baf): Fix \"TypeError: plugins is not iterable\" error when using\n rolldown-vite (Vite 7).\n\n In rolldown-vite, the buildStart hook doesn't receive options.plugins. This\n fix uses the configResolved hook to get plugins from the resolved config, with\n buildStart kept as a fallback for older Vite versions.\n\n- [`4756baf`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4756baf): Fixed\n [#852](https://redirect.github.com/crxjs/chrome-extension-tools/issues/852), the plugin\n now emits a correct URL in `service-worker-loader.js` when the Vite option\n `server.https` is enabled.\n\n- [`4756baf`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4756baf): fix: resolve TypeScript types correctly for ESM and CJS consumers\n\n- [`4756baf`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4756baf): feat: add Vite 8 beta support\n\n##### Patch Changes\n\n- [`4756baf`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4756baf): ci: migrate release workflow to npm trusted publishers\n\n- [`570312a`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/570312a): fix: sanitize colons from output filenames on Windows\n\n- [`4756baf`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4756baf): fix: copy CSS files declared in manifest content\\_scripts to output\n\n- [`4756baf`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4756baf): Replace cheerio with node-html-parser to fix npm deprecation warning\n for whatwg-encoding.\n\n Also adds explicit vite peerDependency declaration (^3.0.0 through ^7.0.0) to\n enable proper version resolution when used with different vite versions.\n\n- [`4756baf`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4756baf): ci: run compat tests against stable Vite 8, make the vite8 available\n as a peer dependency\n\n- [`4756baf`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4756baf): fix: UnoCSS/TailwindCSS HMR issues with virtual CSS modules\n\n- [`8a99b4f`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/8a99b4f): made data\\_collection\\_permissions optional\n\n- [`4756baf`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4756baf): fix: respect user's build.manifest setting in Vite 4+\n\n When users set `build.manifest: false` in their Vite config, the Vite manifest\n file (`.vite/manifest.json` in Vite 5+, or `manifest.json` in older versions)\n is now properly removed from the output bundle.\n\n CRXJS internally requires the Vite manifest to derive content script resources\n during build, so it forces `build.manifest: true`. Previously, this meant the\n Vite manifest was always included in the output even if the user explicitly\n disabled it. Now, CRXJS removes the manifest from the bundle after processing\n if the user didn't want it.\n\n Closes [#1077](https://redirect.github.com/crxjs/chrome-extension-tools/issues/1077)\n\n- [`d364bd8`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/d364bd8): chore: upgrade chokidar to 5.0.0\n\n- [`4756baf`](https://redirect.github.com/crxjs/chrome-extension-tools/commit/4756baf): feat(client): Update the style and content of the development mode\n loading page\n\n

\n\n

figma/plugin-typings (@figma/plugin-typings)

\n\n### [`v1.139.0`](https://redirect.github.com/figma/plugin-typings/compare/v1.138.0...v1.139.0)\n\n[Compare Source](https://redirect.github.com/figma/plugin-typings/compare/v1.138.0...v1.139.0)\n\n

\n\n

figma/rest-api-spec (@figma/rest-api-spec)

\n\n### [`v0.43.0`](https://redirect.github.com/figma/rest-api-spec/compare/v0.42.0...2a90e5adc67d8117d7c2da624f03a9bfa3027fb6)\n\n[Compare Source](https://redirect.github.com/figma/rest-api-spec/compare/v0.42.0...2a90e5adc67d8117d7c2da624f03a9bfa3027fb6)\n\n### [`v0.42.0`](https://redirect.github.com/figma/rest-api-spec/compare/v0.41.0...v0.42.0)\n\n[Compare Source](https://redirect.github.com/figma/rest-api-spec/compare/v0.41.0...v0.42.0)\n\n### [`v0.41.0`](https://redirect.github.com/figma/rest-api-spec/compare/v0.40.0...v0.41.0)\n\n[Compare Source](https://redirect.github.com/figma/rest-api-spec/compare/v0.40.0...v0.41.0)\n\n

\n\n

jsverse/transloco (@jsverse/transloco)

\n\n### [`v8.4.0`](https://redirect.github.com/jsverse/transloco/blob/HEAD/CHANGELOG.md#840-2026-06-13)\n\n[Compare Source](https://redirect.github.com/jsverse/transloco/compare/bd284ecd5e14ee6b5cbee0d84e3432a749e49d6a...b2b52b3bbcb4d958522e3ccee3e64e422555f8c5)\n\n##### 🚀 Features\n\n- **transloco:** transpile function arguments in FunctionalTranspiler\n\n##### 🩹 Fixes\n\n- translateSignal utility missing injector for toSignal\n- **transloco-scoped-libs:** multi-scope i18n with join strategy\n\n##### ❤️ Thank You\n\n- Dafnik\n- f-aubert\n- Ilshat Khamitov\n\n

\n\n

microsoft/tsdoc (@microsoft/tsdoc)

\n\n### [`v0.17.1`](https://redirect.github.com/microsoft/tsdoc/blob/HEAD/tsdoc/CHANGELOG.md#0171)\n\nTue, 29 Sep 2026 18:52:33 GMT\n\n##### Patches\n\n- Add missing tsdoc-unsupported-html-name to TSDocConfiguration.allTsdocMessageIds so eslint-plugin-tsdoc does not crash when reportUnsupportedHtmlElements is enabled (GitHub [#453](https://redirect.github.com/microsoft/tsdoc/issues/453))\n- Fix an issue where `TSDocEmitter` dropped a line break that appeared before an inline node such as a code span, `{@link}` tag, or HTML element, joining the adjacent words.\n\n### [`v0.17.0`](https://redirect.github.com/microsoft/tsdoc/blob/HEAD/tsdoc/CHANGELOG.md#0170)\n\nWed, 16 Sep 2026 01:24:29 GMT\n\n##### Minor changes\n\n- Update emitter to not replace line breaks\n\n

\n\n

modelcontextprotocol/typescript-sdk (@modelcontextprotocol/client)

\n\n### [`v2.2.0`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/releases/tag/%40modelcontextprotocol/client%402.2.0)\n\n[Compare Source](https://redirect.github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/client@2.1.0...@modelcontextprotocol/client@2.2.0)\n\n##### Minor Changes\n\n- [#2887](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2887) [`edd12e2`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/edd12e282620ebf770d67316f19cf91d4112a1bd) Thanks [@maxisbey](https://redirect.github.com/maxisbey)! - Constructing `ClientCredentialsProvider`, `PrivateKeyJwtProvider`, `StaticPrivateKeyJwtProvider` or `CrossAppAccessProvider` without `expectedIssuer` is deprecated: the constructor logs one `console.warn` and that call signature is marked `@deprecated`. Behaviour is otherwise unchanged. Pass the `issuer` of the authorization server the credentials were registered with.\n\n `fetchToken()` throws `AuthorizationServerMismatchError`, before sending anything, when the provider's client information is bound to a different authorization server than the one it is called with. The `AuthorizationServerMismatchError` message no longer assumes the authorization-code callback; its fields are unchanged.\n\n `OAuthTokensSchema` and `OAuthClientInformationSchema` accept the optional `issuer` stamp, so a provider that reads storage back through them keeps it. `auth()` overwrites it on every save.\n\n##### Patch Changes\n\n- [#2885](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2885) [`9dd722f`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/9dd722fd0b533b3cb44cd2834409f7ea4dd32b00) Thanks [@claude](https://redirect.github.com/apps/claude)! - Sending a notification on a closed connection no longer produces a briefly unhandled promise rejection (seen as `unhandledrejection` on Cloudflare Workers) in addition to the returned rejection.\n\n- [#2883](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2883) [`c0f7aec`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/c0f7aec2925a46b32dc2f2aad5bf636a36f02c78) Thanks [@claude](https://redirect.github.com/apps/claude)! - Fix a type-check failure for CommonJS TypeScript projects introduced in 2.1.0: `dist/index.d.cts` imported types from `jose`, which is ESM-only, so `tsc` with `module: node16`/`node18` and `skipLibCheck: false` failed with TS1479. The two `jose` types used by the DPoP API (`CryptoKey`, `JWK`) are now inlined into the declaration files. No runtime change.\n\n- [#2768](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2768) [`efebf5b`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/efebf5b2ba2f07c6fa27ada824a0999b801fec0a) Thanks [@web-abin](https://redirect.github.com/web-abin)! - Correct the JSDoc for insecure OAuth token endpoints. The TLS requirement comes from the MCP authorization specification's OAuth 2.1 communication-security rules, not SEP-2207, which covers OIDC-flavored refresh-token guidance. Documentation only; no runtime behavior change.\n\n- [#2729](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2729) [`a4ae2f9`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/a4ae2f98da3814a9290f2791cfcca8148dcec978) Thanks [@claude](https://redirect.github.com/apps/claude)! - Correct the `registerClient` `@deprecated` notice: Dynamic Client Registration was deprecated by spec PR [#2858](https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2858) (Client ID Metadata Documents), not SEP-2577 (which deprecates roots, sampling, and logging). The notice now also names the earliest possible removal date under the feature lifecycle policy (2027-07-28) and clarifies that the `client_id_metadata_document_supported` gating lives in the built-in `auth()` flow — `registerClient` called directly always sends the registration request. Documentation only; no runtime behavior change.\n\n- [#2862](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2862) [`e780e13`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/e780e13869ad419a864b669bd5fa9702cfb36b14) Thanks [@SyedTashfin](https://redirect.github.com/SyedTashfin)! - Preserve `_meta` on `input_required` results. The 2026-07-28 decode seam rebuilt the payload from `inputRequests` and `requestState` only, so result-level metadata a server sent on an `input_required` result (including `io.modelcontextprotocol/serverInfo`) was dropped before an `allowInputRequired: true` caller could see it. `Result._meta` is a result-level field, so `input_required` carries it exactly like any other result.\n\n- [#2886](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2886) [`ef39308`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/ef39308e963496b75e50553f6265d99cacb4fbb9) Thanks [@claude](https://redirect.github.com/apps/claude)! - `listTools()`, `listPrompts()`, `listResources()` and `listResourceTemplates()` called without a cursor now follow `nextCursor` until the server stops sending one, instead of stopping silently with a short list when a cursor repeats; a page that has the same items and the same `nextCursor` as the page before it ends the walk and is not added twice, and `listMaxPages` still caps the walk.\n\n- [#2642](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2642) [`cfa09db`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/cfa09db614308eaf4fd575c89833da8878d4acb7) Thanks [@claude](https://redirect.github.com/apps/claude)! - Fix `Client.listen()` rejections escaping as process-level unhandled rejections. The internal `opening` promise could reject (ack timeout, transport close, server cancel, caller abort) while `listen()` was still serially awaiting `transport.send(...)`, so no rejection handler was attached yet — the rejection surfaced as an `unhandledRejection` that caller-side handling cannot prevent, and a send that never settles (e.g. a stdio write parked on `'drain'`) left `listen()` suspended forever even though the ack timer had already fired. `listen()` now suspends on the `opening` state machine directly and routes send failures into it, so every termination path rejects the returned promise and nothing escapes.\n\n- [#2597](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2597) [`7f7a94c`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/7f7a94c22017e121a960e071bb50ec75e34450bd) Thanks [@arimu1](https://redirect.github.com/arimu1)! - Treat hostnames ending in `.localhost` as loopback for the SEP-2207 token-endpoint https guard (RFC 6761 §6.3), so host-based multi-tenant local OAuth works. The SDK does not resolve the name itself: `*.localhost` reaches the local machine only if the system resolver follows RFC 6761.\n\n- Updated dependencies \\[[`edd12e2`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/edd12e282620ebf770d67316f19cf91d4112a1bd)]:\n - [@modelcontextprotocol/core](https://redirect.github.com/modelcontextprotocol/core)@2.2.0\n\n### [`v2.1.0`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/releases/tag/%40modelcontextprotocol/client%402.1.0)\n\n[Compare Source](https://redirect.github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/client@2.0.0...@modelcontextprotocol/client@2.1.0)\n\n##### Minor Changes\n\n- [#2629](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2629) [`dcc0102`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/dcc01028ff6a499a5728c2b6181c1727d52e2fab) Thanks [@gbshankar](https://redirect.github.com/gbshankar)! - Add DPoP (RFC 9449 / SEP-1932) sender-constrained access token support to the client.\n - Opt in by implementing `OAuthClientProvider.dpop()` returning a `DpopSession` (new, along with `generateDpopKeyPair`, `accessTokenHash`, `isDpopNonceChallenge`). `auth()` / `exchangeAuthorization` / `refreshAuthorization` / `fetchToken` then sign a DPoP proof into token requests (retrying once on an authorization-server `use_dpop_nonce` challenge, with client authentication re-applied per attempt), and `StreamableHTTPClientTransport`, `SSEClientTransport` and `withOAuth` present a `token_type: \"DPoP\"` access token as `Authorization: DPoP ` plus a fresh per-request proof, retry a resource-server `use_dpop_nonce` challenge once, and pick up a `DPoP-Nonce` delivered on any response. Tokens the AS issued as `Bearer` are still presented as Bearer.\n - DPoP is applied at the fetch layer: the transports wrap their resource-server `fetch` (including a caller-supplied `fetch` / `eventSourceInit.fetch`) with the new `withDpopFromProvider(provider)` middleware, so proofs are always bound to the request actually sent. `withDpop(session, getToken)` is exported for callers that manage tokens themselves (e.g. alongside a minimal `AuthProvider`); the `AuthProvider` interface itself is unchanged.\n - `auth()` now recovers from `invalid_dpop_proof` on refresh (e.g. a refresh token bound to a key that is no longer held) by discarding the tokens and re-authorizing, like `invalid_grant`. `OAuthErrorCode` gains `InvalidDpopProof` and `UseDpopNonce`; `extractWWWAuthenticateParams` recognizes the `DPoP` challenge scheme; `OAuthMetadataSchema` gains `dpop_signing_alg_values_supported`.\n\n##### Patch Changes\n\n- [#2726](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2726) [`6fa4227`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/6fa42279fecaba423635072f716bbb2f6f7c77f3) Thanks [@LuckTerence](https://redirect.github.com/LuckTerence)! - `SdkError` and `SdkHttpError` accept standard `ErrorOptions` as an optional fourth constructor argument and forward it to `Error`, so a wrapped error is reachable through the standard `Error.cause` chain. Version-negotiation probe failures (`SdkErrorCode.EraNegotiationFailed`) now use it: the underlying `TypeError: fetch failed` and the DNS or socket error beneath it surface via `error.cause`, so pino, Sentry, and `util.inspect` render `ENOTFOUND` / `ECONNREFUSED` / `ETIMEDOUT` instead of stopping at the `SdkError` ([#2657](https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2657)). The previous `error.data.cause` slot is still populated for compatibility but is deprecated and slated for removal; read `error.cause` instead.\n\n- [#2654](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2654) [`03842cd`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/03842cd9cae9a9b142c77d2fb65e829fc4e03eab) Thanks [@pshah19](https://redirect.github.com/pshah19)! - Treat request id `0` as a real id. Two guards tested a `RequestId` for truthiness, so the legal JSON-RPC ids `0` and `''` were read as absent. Id `0` is not a corner case: the outbound request counter is zero-based, so it is the first id every peer assigns, which on the server→client leg is the first `sampling/createMessage`, `elicitation/create`, or `roots/list` a server sends.\n\n - `notifications/cancelled` carrying id `0` was ignored, and the in-flight handler ran to completion with its `AbortSignal` never fired.\n - A notification sent with `relatedRequestId: 0` wrongly passed the debounce gate (for methods opted into `debouncedNotificationMethods`). Because the pending set is keyed by method alone, a second such notification in the same tick was silently dropped rather than sent.\n\n Absent is now the only value that means \"no id\".\n\n- [#2043](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2043) [`c4248a9`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/c4248a935f245a86b2fb8b88b9c3d594e2bfea75) Thanks [@ChrisJr404](https://redirect.github.com/ChrisJr404)! - On Windows, stdio servers spawned by `StdioClientTransport` now also inherit `COMSPEC`, `PATHEXT`, `PROGRAMDATA`, `PROGRAMFILES(X86)`, `PROGRAMW6432`, and `WINDIR` (added to `DEFAULT_INHERITED_ENV_VARS`). Programs a server launches can depend on them: PowerShell finds no native executables without `PATHEXT`, and Windows OpenSSH exits 255 without `ProgramData`.\n\n- [#2668](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2668) [`3e90449`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/3e90449fd52997da43b79a536d2c19c446603cc7) Thanks [@KKonstantinov](https://redirect.github.com/KKonstantinov)! - Stop sending `notifications/cancelled` for the `initialize` handshake. The spec is explicit that a client MUST NOT attempt to cancel its `initialize` request, but the outbound cancel path fired for any in-flight request: aborting the `AbortSignal` passed to `connect()`, or letting the handshake hit its timeout, put a forbidden cancellation on the wire naming the initialize request id.\n\n The local behaviour is unchanged — the caller's promise still rejects with the same abort/timeout error, and `connect()` still tears the connection down. Only the wire notification is suppressed. Every other method keeps the existing cancellation path.\n\n- [#2475](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2475) [`b654261`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/b65426158ed9f29aea8ef3dc09ca22d7d9d6f970) Thanks [@sanjibani](https://redirect.github.com/sanjibani)! - `StreamableHTTPClientTransport` and `SSEClientTransport` now give their transport-managed headers precedence over same-named entries in `requestInit.headers`: `Authorization` when `authProvider` yields a token, `mcp-protocol-version`, and (Streamable HTTP) `mcp-session-id`. Header names compare case-insensitively and every `HeadersInit` form is covered (plain object, tuple array, `Headers` instance). Previously the caller-supplied value won, so a static `Authorization` placeholder (e.g. an env-var API key) kept overriding the OAuth token even after the provider obtained one and the fallback-to-OAuth flow never completed; a `Headers` instance or lowercase key produced a combined `Bearer , Bearer ` value instead. A configured `Authorization` is still sent while the provider has no token, and other configured headers pass through unchanged. Closes [#2208](https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2208).\n\n- [#2581](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2581) [`5119ee7`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/5119ee7fd7790e335a3fb60ef36f85334e2a6326) Thanks [@hugosmoreira](https://redirect.github.com/hugosmoreira)! - Preserve the exact OAuth resource indicator from protected resource metadata when building authorization and token requests. Previously a pathless `resource` such as `https://example.com` was normalized to `https://example.com/` via `URL.href`, which breaks authorization servers that require the `resource` parameter to match the published value exactly (Microsoft Entra ID rejects it with `AADSTS9010010`). The exported OAuth helpers (`startAuthorization`, `exchangeAuthorization`, `refreshAuthorization`, `fetchToken`, `executeTokenRequest`) now also accept a `string` for `resource`; `selectResourceURL` still returns a `URL`, and a provider's `validateResourceURL` result is used unchanged. Fixes [#1968](https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/1968).\n\n- [`3924de9`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/3924de99df834302d89f5997a1b64ca268282284) - Let `saveTokens` failures surface after a successful token refresh. In `auth()`, one `try`\n wrapped both `refreshAuthorization()` and the `provider.saveTokens()` that persists its\n result, and the `catch` deliberately swallows anything that is not an `OAuthError` — plus\n `ServerError` — so that a failed refresh falls through to a fresh authorization request.\n A persistence error thrown by the provider landed in that same branch: it was discarded\n with no log and no rethrow, and `auth()` continued to `startAuthorization()` and returned\n `'REDIRECT'`.\n\n Against an authorization server that rotates refresh tokens (the OAuth 2.1 default, and\n Keycloak's) this loses credentials rather than merely hiding an error. The exchange has\n already succeeded server-side, so the old refresh token is invalidated at the moment the\n new one is issued; dropping the new token set leaves nothing usable on either side. On a\n headless or CLI client, where `redirectToAuthorization` is typically a no-op, the fallthrough\n is silent and the client is left with stale tokens and no indication of why.\n\n The `try`/`catch` now covers only `refreshAuthorization()`. Persisting the result happens\n after it, on an unguarded path, so a provider's I/O error propagates to the caller.\n\n Refresh-request failures keep their existing control flow exactly: a `ServerError` or an\n unknown error still falls through to a new authorization flow, a non-`ServerError`\n `OAuthError` is still rethrown, and `InsecureTokenEndpointError` is still surfaced. The\n SEP-2352 `issuer` stamp written with the refreshed tokens is unchanged.\n\n Those fallbacks no longer happen in silence, though. Both routes to an unexplained\n re-authorization now emit a `console.warn` naming the cause: the in-place fallthrough in\n the refresh block, and `auth()`'s outer recovery for `invalid_grant`, `invalid_client`,\n and `unauthorized_client`, which discards stored credentials and retries. The second one\n matters most in practice — an expired, revoked, or rotation-reuse-detected refresh token\n is reported as `invalid_grant`, which is precisely the state a dropped token set leaves\n behind for the next call.\n\n Consumers whose `OAuthClientProvider.saveTokens` can reject should note that `auth()` may\n now reject where it previously returned `'REDIRECT'` — that rejection is the failure that\n was being discarded.\n\n- [#2613](https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2613) [`70de0c8`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/70de0c8b569b0d664a56b90be2f141d1d1645880) Thanks [@jwcarman](https://redirect.github.com/jwcarman)! - Emit and validate the `Mcp-Name` header for tasks requests per SEP-2663's Streamable HTTP binding: the client transport now mirrors `params.taskId` into `Mcp-Name` on `tasks/get` / `tasks/update` / `tasks/cancel` (previously omitted, causing conforming servers to reject every task poll with `-32020 HeaderMismatch`), and the server-side standard-header validation cross-checks it via the same shared `MCP_NAME_HEADER_SOURCE` table.\n\n On the server, `createMcpHandler` now answers a modern (2026-07-28) `tasks/get` / `tasks/update` / `tasks/cancel` POST that omits `Mcp-Name`, or whose header disagrees with `params.taskId`, with `400` / `-32020` (`HeaderMismatch`) at the `standard-header-validation` rung, the same treatment `tools/call` / `prompts/get` / `resources/read` already get. Legacy-era (2025-11-25) tasks traffic is unaffected. Clients built with this SDK release send the header; hand-rolled clients that omitted it must add it.\n\n- Updated dependencies \\[[`dcc0102`](https://redirect.github.com/modelcontextprotocol/typescript-sdk/commit/dcc01028ff6a499a5728c2b6181c1727d52e2fab)]:\n - [@modelcontextprotocol/core](https://redirect.github.com/modelcontextprotocol/core)@2.1.0\n\n

\n\n

OpenAPITools/openapi-generator-cli (@openapitools/openapi-generator-cli)

\n\n### [`v2.41.0`](https://redirect.github.com/OpenAPITools/openapi-generator-cli/releases/tag/v2.41.0)\n\n[Compare Source](https://redirect.github.com/OpenAPITools/openapi-generator-cli/compare/v2.40.1...v2.41.0)\n\n##### Features\n\n- **release:** v7.25.0 release ([#1278](https://redirect.github.com/OpenAPITools/openapi-generator-cli/issues/1278)) ([b6cef74](https://redirect.github.com/OpenAPITools/openapi-generator-cli/commit/b6cef74bd28bd914ed700ad1b61c7839d5ec20b4))\n\n### [`v2.40.1`](https://redirect.github.com/OpenAPITools/openapi-generator-cli/releases/tag/v2.40.1)\n\n[Compare Source](https://redirect.github.com/OpenAPITools/openapi-generator-cli/compare/v2.40.0...v2.40.1)\n\n##### Bug Fixes\n\n- **deps:** update dependency fs-extra to v11.4.0 ([#1264](https://redirect.github.com/OpenAPITools/openapi-generator-cli/issues/1264)) ([254a7d5](https://redirect.github.com/OpenAPITools/openapi-generator-cli/commit/254a7d5ca748970f56f1ca1f11287213a98e3928))\n\n### [`v2.40.0`](https://redirect.github.com/OpenAPITools/openapi-generator-cli/releases/tag/v2.40.0)\n\n[Compare Source](https://redirect.github.com/OpenAPITools/openapi-generator-cli/compare/v2.39.1...v2.40.0)\n\n##### Features\n\n- **release:** v7.24.0 release ([#1259](https://redirect.github.com/OpenAPITools/openapi-generator-cli/issues/1259)) ([a241dc9](https://redirect.github.com/OpenAPITools/openapi-generator-cli/commit/a241dc9027c0f93d0c890e103782b1deda8ff946))\n\n

\n\n

Redocly/redocly-cli (@redocly/openapi-core)

\n\n### [`v2.57.0`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/openapi-core%402.57.0)\n\n[Compare Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/openapi-core@2.56.1...@redocly/openapi-core@2.57.0)\n\n##### Minor Changes\n\n- Added `const` checking to the `no-enum-type-mismatch` rule: a `const` value must conform to the schema's `type`, the same way every `enum` value does.\n\n **Note**: linting output may include new errors for schemas whose `const` value doesn't match their `type`.\n\n##### Patch Changes\n\n- Fixed an issue where `no-enum-type-mismatch` dropped violations and reported a wrong location when `type` was written as an array.\n\n### [`v2.56.1`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/openapi-core%402.56.1)\n\n[Compare Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/openapi-core@2.56.0...@redocly/openapi-core@2.56.1)\n\n##### Patch Changes\n\n- Improved overall startup performance.\n\n### [`v2.56.0`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/openapi-core%402.56.0)\n\n[Compare Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/openapi-core@2.55.0...@redocly/openapi-core@2.56.0)\n\n##### Minor Changes\n\n- Added support for applying Overlay documents to the `bundle` command output.\n Pass overlays with the new `--overlay` option or list them under `overlays` for an API in `redocly.yaml`.\n- Added support for linting Overlay 1.1 and 1.2 documents, including the `copy` action field, the `$self` field, and reusable actions in `components.actions`.\n The `spec-ref-siblings` rule now checks the fields next to a reusable action `$ref` in Overlay documents.\n\n##### Patch Changes\n\n- Updated [@redocly/config](https://redirect.github.com/redocly/config) to v0.59.0.\n\n### [`v2.55.0`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.55.0)\n\n[Compare Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/openapi-core@2.54.3...@redocly/openapi-core@2.55.0)\n\n##### Minor Changes\n\n- Added the `--replace` option to the `push` command.\n `--replace` removes the files under the mount path that are not part of the push.\n\n##### Patch Changes\n\n- Fixed `respect` so known secrets are masked in non-JSON request bodies, such as `application/x-www-form-urlencoded` token requests.\n- Fixed `respect` so a step fails with a clear error when a runtime expression embedded in a string has no value, such as `Bearer {$outputs.accessToken}`.\n- Updated [@redocly/openapi-core](https://redirect.github.com/redocly/openapi-core) to v2.55.0.\n- Updated [@redocly/respect-core](https://redirect.github.com/redocly/respect-core) to v2.55.0.\n- Updated [@redocly/reunite-integration](https://redirect.github.com/redocly/reunite-integration) to v2.55.0.\n- Fixed an issue where the `workflow-dependsOn` rule reported a duplicate when different workflows listed the same workflow in `dependsOn`.\n\n### [`v2.54.3`](https://redirect.github.com/Redocly/redocly-cli/releases/tag/%40redocly/cli%402.54.3)\n\n[Compare Source](https://redirect.github.com/Redocly/redocly-cli/compare/@redocly/openapi-core@2.54.2...@redocly/openapi-core@2.54.3)\n\n##### Patch Changes\n\n- Fixed an issue where generated clients attempted to parse compressed archives (`application/gzip`, `application/x-tar`), PDF files, Office documents, audio, video and font responses as JSON instead of decoding them as binary.\n- Added the value of the `REDOCLY_ENVIRONMENT` environment variable to the `user-agent` header of the `login`, `push`, and `push-status` requests.\n- Updated [@redocly/client-generator](https://redirect.github.com/redocly/client-generator) to v0.4.16.\n- Updated [@redocly/reunite-integration](https://redirect.github.com/redocly/reun\n\n> ❗ **Important**\n> \n> ✂ PR body was truncated to here.\n\n\n

\n\n---\n\n### Configuration\n\n📅 **Schedule**: (in timezone Europe/Paris)\n\n- Branch creation\n - At any time (no schedule defined)\n- Automerge\n - At any time (no schedule defined)\n\n🚦 **Automerge**: Enabled.\n\n♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.\n\n👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired.\n\n---\n\n - [ ] If you want to rebase/retry this PR, check this box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/AmadeusITGroup/otter).\n\n","d1703e28c54d9dbf4c0183930201e2735c59eef1","dc99f59e884b931e2bb38803fb77f08ea6254ba9",{"_455":456,"_457":458,"_459":460,"_461":462,"_463":464,"_465":466,"_467":-5,"_468":-5,"_469":470,"_471":472,"_473":462,"_474":475,"_476":477,"_478":479,"_480":481,"_482":483,"_484":485,"_486":487,"_488":-5,"_148":489,"_490":491,"_492":493,"_388":494,"_495":496,"_497":498,"_499":-5,"_500":-5,"_501":-5,"_502":-5,"_503":-5,"_504":-5,"_505":-5,"_506":-5,"_507":508,"_509":510,"_511":512,"_513":514,"_515":-5,"_516":514},"suggestedFixId","6ac3dd46a32573f60f1d056b","fixedTasks",[519],"otherFailedTasks",[],"verificationStatus","COMPLETED","verificationTasksExecuted",[519],"userAction","NONE","userActionOrigin","userCommitMessage","suggestedFix","diff --git a/apps/chrome-devtools/src/app-components/app.ts b/apps/chrome-devtools/src/app-components/app.ts\nindex 2e256df01..b5ab967fd 100644\n--- a/apps/chrome-devtools/src/app-components/app.ts\n+++ b/apps/chrome-devtools/src/app-components/app.ts\n@@ -115,8 +115,6 @@ export class App {\n \n private readonly selectedComponentInfo = new BehaviorSubject(undefined);\n \n- private readonly updateSelectedComponentInfoCallback = this.updateSelectedComponentInfo.bind(this);\n-\n public selectedComponentInfo$ = this.selectedComponentInfo.asObservable();\n \n constructor() {\n@@ -152,7 +150,7 @@ export class App {\n `function getTranslations(node){ return (${getTranslationsRec})(node, getTranslations); } `\n + `function getAnalyticEvents(node){ return (${getAnalyticEventsRec})(node, getAnalyticEvents); } `\n + `(${getSelectedComponentInfo})(getTranslations, getAnalyticEvents);`,\n- this.updateSelectedComponentInfoCallback\n+ (...[info]) => this.updateSelectedComponentInfo(info)\n );\n /* eslint-enable @typescript-eslint/restrict-template-expressions */\n }\n","suggestedFixDescription","fix(chrome-devtools): destructure eval callback args for @types/chrome 0.3","suggestedFixStatus","suggestedFixReasoning","The first fix passed the lambda `(info) => this.updateSelectedComponentInfo(info)`.\nTypeScript still reported TS2769 because the target callback is `(...args: [result, exceptionInfo] | [result, undefined]) => void`.\nA lambda that declares a single parameter is typed as `[info: ...]`, so the two-element tuples are not assignable to it (\"Source has 2 element(s) but target allows only 1\").\nContextual typing did not widen the parameter list, so the arity mismatch remained.\n\nThe change in `apps/chrome-devtools/src/app-components/app.ts` replaces the lambda with `(...[info]) => this.updateSelectedComponentInfo(info)`.\n- The rest parameter accepts the whole tuple union, which satisfies the arity requirement.\n- Destructuring the first element gives `info` the type `OtterLikeComponentInfo | undefined`, which is what `updateSelectedComponentInfo` expects.\n- The exception info is ignored, as it was before, so runtime behavior is unchanged.\n- It avoids an unused `_exceptionInfo` parameter that could trigger lint warnings.\n- No `as any` or `@ts-ignore` is used.\n\nThe earlier removal of the bound callback field stays, since the lambda replaces it.","suggestedFixExecutionTime",33421,"verificationExecutionTime",225011,"reviewComment","We're fixing the TS2769 error in `chrome-devtools:build-components` with these changes. The @types/chrome 0.3 bump types the `inspectedWindow.eval` callback with `(result, exceptionInfo)` arguments, which the old single-parameter bound callback didn't match. Our inline lambda lets TypeScript infer the new argument types and forwards only the result.","originalSuggestedFix","diff --git a/apps/chrome-devtools/src/app-components/app.ts b/apps/chrome-devtools/src/app-components/app.ts\nindex 2e256df01..19dde4216 100644\n--- a/apps/chrome-devtools/src/app-components/app.ts\n+++ b/apps/chrome-devtools/src/app-components/app.ts\n@@ -115,8 +115,6 @@ export class App {\n \n private readonly selectedComponentInfo = new BehaviorSubject(undefined);\n \n- private readonly updateSelectedComponentInfoCallback = this.updateSelectedComponentInfo.bind(this);\n-\n public selectedComponentInfo$ = this.selectedComponentInfo.asObservable();\n \n constructor() {\n@@ -152,7 +150,7 @@ export class App {\n `function getTranslations(node){ return (${getTranslationsRec})(node, getTranslations); } `\n + `function getAnalyticEvents(node){ return (${getAnalyticEventsRec})(node, getAnalyticEvents); } `\n + `(${getSelectedComponentInfo})(getTranslations, getAnalyticEvents);`,\n- this.updateSelectedComponentInfoCallback\n+ (info) => this.updateSelectedComponentInfo(info)\n );\n /* eslint-enable @typescript-eslint/restrict-template-expressions */\n }\n","originalSuggestedFixDescription","fix(chrome-devtools): adapt eval callback to @types/chrome 0.3","originalSuggestedFixReasoning","The PR bumps `@types/chrome` from ^0.1.0 to ^0.3.0.\nIn 0.3.x, the callback for `chrome.devtools.inspectedWindow.eval` is typed as a rest-args union of two tuples: `[result: undefined, exceptionInfo: EvaluationExceptionInfo]` and `[result: OtterLikeComponentInfo | undefined, exceptionInfo: undefined]`.\nThe previous code passed `this.updateSelectedComponentInfo.bind(this)`, typed `(info?: OtterLikeComponentInfo) => void`.\nThat type is not assignable to the tuple-based callback, which caused TS2769 at `apps/chrome-devtools/src/app-components/app.ts:155`.\n\nChanges in `apps/chrome-devtools/src/app-components/app.ts`:\n- Removed the `updateSelectedComponentInfoCallback` field, which was only used for this one call.\n- Passed an inline lambda `(info) => this.updateSelectedComponentInfo(info)` to `eval` instead.\n\nWhy this approach:\n- The lambda's parameter is contextually typed from the new signature, so `info` is inferred as `OtterLikeComponentInfo | undefined`.\n- Only the result is forwarded, so runtime behavior is unchanged. The exception info was never used before.\n- It needs no `as any`, `@ts-ignore` or other type loosening.\n- The `this` binding is kept, because the lambda is an arrow function.\n\nNo configuration file defined predefined fixes or off-limits areas for this task. `.nx/SELF_HEALING.md` does not exist, and `CLAUDE.md` and `AGENTS.md` have no such sections.\nI did not run a build or lint here, since the failed task will be rerun to verify the fix.","userActionRecordedAt",["D",1791221062952],"suggestedAt",["D",1791221062952],"verifiedAt",["D",1791221288515],"gUvq","failureClassification","code_change","fileModeMap",{"_517":518},"suggestedFixFailureReason","suggestedFixFailureReasonDetails","suggestedFixFailureReasonType","assignedAgentName","autoApplySkipped","autoApplySkipReason","flakyRerunSkipped","flakyRerunPending","confidence",8,"confidenceReasoning","The fix is local, touching a single call site in one file, and the rerun of the only failing task (chrome-devtools:build-components) passed. The root cause was clearly the @types/chrome 0.3 change to the eval callback typing, with no type-safety bypass and no runtime behavior change. It is not a 9 because a few other valid approaches exist, such as a two-parameter callback or changing the method signature. The lint target was not run as part of this verification.","fixApplicationAttempts",[],"taskOutputSummary","TASK ID: chrome-devtools:build-components\n❯ Building...\n✔ Building...\nApplication bundle generation failed. [11.597 seconds] - 2026-10-05T17:21:15.610Z\n\n✘ [ERROR] TS2769: No overload matches this call.\n Overload 1 of 3, '(expression: string, options?: EvalOptions | undefined): Promise', gave the following error.\n Type '(info?: OtterLikeComponentInfo | undefined) => void' has no properties in common with type 'EvalOptions'.\n Overload 2 of 3, '(expression: string, callback: (...args: [result: undefined, exceptionInfo: EvaluationExceptionInfo] | [result: OtterLikeComponentInfo | undefined, exceptionInfo: undefined]) => void): void', gave the following error.\n Argument of type '(info?: OtterLikeComponentInfo | undefined) => void' is not assignable to parameter of type '(...args: [result: undefined, exceptionInfo: EvaluationExceptionInfo] | [result: OtterLikeComponentInfo | undefined, exceptionInfo: undefined]) => void'.\n Types of parameters 'info' and 'args' are incompatible.\n Type '[result: undefined, exceptionInfo: EvaluationExceptionInfo] | [result: OtterLikeComponentInfo | undefined, exceptionInfo: undefined]' is not assignable to type '[info?: OtterLikeComponentInfo | undefined]'.\n Type '[result: undefined, exceptionInfo: EvaluationExceptionInfo]' is not assignable to type '[info?: OtterLikeComponentInfo | undefined]'.\n Source has 2 element(s) but target allows only 1. [plugin angular-compiler]\n\n /home/runner/work/otter/otter/apps/chrome-devtools/src/app-components/app.ts:155:6:\n 155 │ this.updateSelectedComponentInfoCallback\n ╵ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\n\n","remoteTaskSummary","localTaskSummary","apps/chrome-devtools/src/app-components/app.ts","100644","chrome-devtools:build-components",{"_521":519,"_522":523,"_524":-5,"_525":-5,"_526":-5,"_527":-5},"taskName","runLinkId","MoRI4BVeA8","dteExecutionId","agentName","launchTemplates","taskTarget","AmadeusITGroup",["D",1676054118998],["D",1681913345534],"allowedEmailDomains",[590],"planActivationDate",["D",1686144031537],"isEligibleForProTrial","planLimits",{"_576":577,"_578":579,"_580":431,"_581":347,"_582":347,"_583":584,"_585":586,"_587":586,"_588":589},"isAiEnabled","planTransitions",[],"id","memberships",[556,557,558,559,560,561,562,563],"privateCloudInstallationId","hasBillingInformation","hasLicense","isUnclaimed","isOnTrial","isHighPriority","vcsProfileLink","vcsConfiguration","lastMembersSyncedAt","isAiBringYourOwnKey","enterpriseTrial","disabledReasonMessage",{"_564":575,"_566":567},{"_564":574,"_566":569},{"_564":573,"_566":567},{"_564":572,"_566":569},{"_564":571,"_566":569},{"_564":570,"_566":569},{"_564":568,"_566":569},{"_564":565,"_566":567},"userId","63eb8f0c1147ed000ed89147","role","admin","656f2a38d8c7f6f8d5bfdab5","member","64a51a42097e04000dcff5a3","63f5d0d76abadd000e2a636a","63ee2a741147ed000ed892b0","63ecec5bd91fa9000e2ebaa1","63ecec62d91fa9000e2ebaa3","63e68de49bae37000e41c9c6","baseIncludedCredits",300000,"additionalCredits",{},"discountedCreditsMaximum","contributorLimit","concurrentConnectionLimit","runsLimit",1000000,"adminUserLimit",9999,"workspaceLimit","modifiers",[],"amadeus.com",["D",1791220170672],["D",1791221325155],["D",1791221325155],[],[],[],[],{},{},{},{"_77":602,"_79":-5},{"_90":603,"_92":604,"_94":605,"_96":606},{"_129":627,"_131":628,"_133":629},{"_121":621,"_123":622},{"_104":610,"_106":611,"_80":612,"_82":613},{"_98":607},[608],{"_73":101,"_102":609,"_79":-5},[],[620],[],[617],[614],{"_73":111,"_102":615,"_79":-5},{"_113":114,"_86":616},[],{"_73":111,"_102":618,"_79":-5},{"_113":117,"_118":619},[],{"_73":111,"_102":22,"_79":-5},[625],[623],{"_73":111,"_102":624,"_79":-5},[],{"_73":111,"_102":626,"_79":-5},[],[633],[632],[630],{"_73":101,"_102":631,"_79":-5},[],{"_73":101,"_102":22,"_79":-5},{"_73":101,"_102":139,"_79":-5},["D",1791220170672],["D",1791221325484],["D",1791221325155],[651],{"_188":294,"_295":294,"_296":297,"_298":299,"_300":-5,"_301":-5,"_302":303,"_304":305,"_306":307,"_308":309,"_310":311,"_312":313,"_314":315,"_316":317,"_318":-5,"_319":-5},[],[225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,23,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293],[],{"_41":645,"_43":646,"_45":28},{"_219":220,"_221":222,"_223":644},["D",1791220661446],{"_62":-5,"_63":-5},{"_46":22,"_47":22,"_48":22,"_49":28,"_50":22,"_51":647,"_53":-5,"_54":-5,"_55":648,"_57":649,"_59":650,"_61":-5},[],[],[],[],{"_79":146,"_15":147,"_148":591,"_150":592,"_152":593,"_154":155,"_156":-5,"_157":22,"_158":-5,"_159":-5,"_160":-5,"_161":594,"_163":22,"_164":165,"_166":28,"_167":652,"_169":596,"_80":597,"_172":-5,"_173":598,"_175":653,"_177":600,"_179":-5,"_180":28,"_181":182,"_183":601},[],{},["D",1676055838344],"type","PRIMARY","publicCloudCounterpartId","privateCloudCounterpartId","installationSource","user","remoteSourceIntegrationType","GITHUB_EVENTLESS","featureMarkers",{"_697":22,"_698":28,"_699":22},"manualSetAccessLevel","idAccessLevel","READ_ONLY","patAccessLevel",{"_690":317,"_691":692,"_693":694,"_695":696},"flakyTaskConfiguration",{"_686":687,"_688":689},"aiTaskFixingConfiguration",{"_46":22,"_47":22,"_48":22,"_49":28,"_50":22,"_51":682,"_54":-5,"_55":683,"_57":684,"_59":685},"enableWorkspaceDataCaching","showVcsStatusChecks","defaultBranch","main","visibility","ALLOW_UNAUTHENTICATED","sandboxingConfiguration","launchTemplate",[],[],[],[],"threshold","NORMAL","samplePeriodDays",28,"provider","repositoryFullName","AmadeusITGroup/otter","repositoryId","589619867","repositoryVisibility","PUBLIC","isRemoteCachingActive","isDistributedTaskExecutionActive","isVCSIntegrationActive","currentUser","currentHostname","cloud.nx.app","incident",["P",704],"notifications",["P",706],"isSystemAdmin","isSingleTenant","isPATExpiryAfterLoginEnabled","isOrganizationAccessEnabled","isExecutiveReportDisabled","loginas","repositoryAccessProvidersToOffer",[],"redirectTo","/cipes/6ac3d9ca1c888dcf22610581/configurations/config-yaml?runGroup=37345865239-1","deferredUserOrganizations",["P",718],"sidebarCollapsed","toast","currentUserId","currentUserEmail","signedInUser","isImpersonating","isBotRequest","ENV",{"_789":22,"_351":28,"_790":22,"_791":22,"_792":22,"_793":794,"_795":796,"_797":28,"_798":799,"_800":801,"_731":802},"posthogBootstrap",{"_759":760,"_761":762},"ultracacheUiEnabled","pylon",{"_751":752,"_753":754,"_71":755,"_756":-7,"_757":758},"requestInfo",{"_735":736,"_84":350,"_88":737,"_738":739,"_740":741},"hints",{"_744":747,"_749":750},"/cipes/6ac3d9ca1c888dcf22610581/configurations/config-yaml","url","https://cloud.nx.app/cipes/6ac3d9ca1c888dcf22610581/configurations/config-yaml","userPreferences",{"_742":743},"theme",{"_71":182,"_744":745,"_746":747,"_748":747},"variant","system","resolvedVariant","light","clientColorScheme","timeZone","UTC","appId","a1074fe2-8172-4ebd-9889-879f8308a0a2","email","377f7696-9692-4a6c-8eeb-16eaddffd544@nxcloud.invalid","Anonymous Nx Cloud Visitor","avatarUrl","emailHash","16769990ca1e707b6261eb22e7a8d4c4a57d2ca7619e3948a7695700cbffccef","distinctID","377f7696-9692-4a6c-8eeb-16eaddffd544","featureFlags",{"_763":46,"_764":22,"_765":22,"_766":28,"_767":22,"_768":28,"_769":28,"_770":22,"_771":22,"_772":773,"_774":46,"_775":22,"_776":22,"_777":778,"_779":22,"_780":22,"_781":22,"_782":22,"_783":28,"_784":22,"_785":22,"_786":22,"_787":788},"one_page_connect_workspace_github","new_access_control","config_yaml","new_layout","resource_usage_toggle","feature_activation_guide","cipe_execution_timeline","automated_add_ons","workspace_rewind","welcome_view_cnw_experiment","variant-2","one_page_connect_workspace_gitlab","show_setup_self_healing_ci_alert","non_dte_resource_usage","one_page_connect_workspace_manual","test","workspace_sandboxing_toggle","survey-targeting-8e88152ae4-custom","teams_minimum_spend","demo-mode","run_details_polling","workspace_badges","pylon_chat","resource_addon_default","cnw_empty_workspace_position","treatment","isProduction","isAnalyticsEnabled","isPosthogEnabled","isPylonEnabled","privateCloud",{"_821":812,"_349":350},"auth0",{"_815":816,"_817":818,"_819":820},"e2eTestMode","rollbar",{"_807":808,"_809":810,"_46":22,"_811":812,"_813":22,"_814":22},"posthog",{"_803":804,"_805":806},{"_751":752},"apiKey","phc_eTmACxF0EKeNRjAZbfpdszbHYumyKhWqsIpMU4Wi53c","apiHost","https://pha-prx.ops.cloud.nx.app","accessToken","d0e4070ed1d54ed29429808f497ffbab3e77f1c74c2a9427fa5c5e418eea62ca96294bc716a7e8210acf93f0d37b6d29","environment","production","codeVersion","2610.14.0002","captureUncaught","captureUnhandledRejections","domain","auth.nx.app","clientId","Ron6k221B4IaH0QK9hmHuCneTovLLPpX","audience","https://api.nrwl.io/","containerVersionTimestamp"]

Config YAML