[release] Release highlights for v0.4.11

[github-actions]

🌟 Release Highlights

This release focuses on strengthening security primitives (capability-bound enclave reads, Rust guard hardening) and improving OpenTelemetry configuration validation, alongside a substantial wave of internal test coverage and logging improvements across the codebase.

✨ What's New

• Capability-bound enclave issue reads (Add capability-bound enclave issue reads #11813): Adds scoped, capability-bound read access for GitHub issues within enclave contexts, tightening the security boundary for data reads.
• OpenTelemetry endpoint validation aligned with MCP Gateway spec 1.16.0 (Align OpenTelemetry endpoint validation with MCP Gateway spec 1.16.0 (HTTP or HTTPS) #11588): OTEL_EXPORTER_OTLP_ENDPOINT validation now correctly accepts both HTTP and HTTPS endpoints per spec — see the OTel/Sentry guide.
• OpenTelemetry baggage propagation verified in noop mode (Test OpenTelemetry baggage propagation in noop mode #11637): Added regression coverage ensuring trace baggage propagates correctly even when tracing is disabled.
• Rust guard consolidation ([Repo Assist] refactor(rust-guard): dedupe MCP-wrapped text extraction + add IS_ERROR constant #11848, Deduplicate Rust guard MCP response extraction #11853, [Repo Assist] fix(rust-guard): use field_names::OWNER constant in owner_type_from_repo_object #11627, [Repo Assist] Rust Guard: consolidate remaining split_once('/') call sites to use split_repo_id() #11555): Deduplicated MCP-wrapped text extraction, consolidated repo-ID parsing helpers, and reduced code duplication in the WASM guard for more consistent, maintainable enforcement behavior.
• Removed deprecated DIFC Resource API (Remove deprecated DIFC resource API and colocate schema cache #11685, [Repo Assist] refactor(difc): remove deprecated Resource type and its constructors #11677): Cleaned up the legacy DIFC Resource type and constructors in favor of the current API — internal consumers should migrate to the supported DIFC interfaces if not already done.

🐛 Bug Fixes & Improvements

• Deduplicated gojq filter cache error messages now include the cached type, making cache-related debugging clearer (Add gojq iteration-after-error regression tests and include cached type in filter cache error #11788).
• Bumped golang.org/x/text to v0.41.0 and stretchr/testify to v1.12.1 for dependency freshness and security hygiene (chore(deps): bump golang.org/x/text to v0.41.0 #11789, Bump stretchr/testify from v1.11.1 to v1.12.1 #11574).

📚 Documentation

• Documented the reviewed MCP SDK version for easier tracking of SDK compatibility (Document reviewed MCP SDK version #11854).

🔧 Internal

This release also includes extensive debug logging additions (server middleware, config helpers, tracing, envutil, HTTP helpers, auth middleware) and a large number of test-improver passes (guard, launcher mount policy, tool policy, envutil, server package, circuit breaker, session handling) that improve maintainability without changing user-facing behavior.

🐳 Docker Image

The Docker image for this release is available at:

docker pull ghcr.io/github/gh-aw-mcpg:v0.4.11
# or
docker pull ghcr.io/github/gh-aw-mcpg:latest

Supported platforms: linux/amd64, linux/arm64

---

For complete details, see the full release notes.

Generated by Release · auto · 21.4 AIC · ⊞ 11.1K · ◷