headroom/.github
JD Davis 37faf2f247
chore: release 0.36.1 (#3152)
## Description

Release 0.36.1, generated by Release Please, containing the security
fixes from #2207 (WEB-01–07). This updates the changelog and keeps
Python, TypeScript SDK, plugin package, marketplace, server, and release
metadata versions aligned at 0.36.1.

## Type of Change

- [x] Release / version metadata

## Changes Made

- Updated the release manifest and generated changelog for 0.36.1.
- Synchronized `pyproject.toml`, TypeScript SDK, OpenClaw, OpenCode,
agent-hook plugin, marketplace, server, and release metadata versions.
- Included the 0.36.1 changelog entry for the security assessment fixes
merged in #2207.

## Testing

- [x] CI and release validation pass

### Test Output

All current required checks are complete and passing, including version
sync, package builds, wheel smoke imports, security scans, Python test
shards, native wrapper checks, and devcontainer validation.

## Real Behavior Proof

- Environment: GitHub Actions release and CI workflows for commit
`52c0a0c61dce0af81af3ff73a34efe8b451501cb`.
- Observed result: all generated version-bearing files report 0.36.1;
build and smoke-import jobs produced and validated the release
artifacts.
- Not exercised: publishing jobs are intentionally skipped for a pull
request and run only after the release receives final human approval and
is merged.

## Runtime Rollout Safety

- Rollout-managed features: none; this PR packages already-merged
behavior.
- Stable/default behavior changed: no additional runtime behavior beyond
the included, already-reviewed security fixes.
- Kill switch / disable path: not applicable to generated release
metadata.
- Qualification impact: release artifact construction and smoke-import
validation are green.
- Rollback path: do not merge the release PR, or revert the release
commit before publishing.

## Review Readiness

- [x] I have performed a self-review
- [x] This PR is ready for human review

## Release Notes

### Bug Fixes

- **security:** address u9up assessment findings (WEB-01–07) (#2207)

This PR was generated with Release Please and then its description was
expanded to document review and qualification evidence. It still
requires final human review; no publishing or merge has been performed.

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-08-20 17:20:18 -07:00
..
act feat: add deterministic runtime rollout controls (#1490) 2026-08-12 23:16:54 -05:00
actions/headroom-e2e-setup fix(windows): pin UTF-8 encoding on text-mode subprocess calls (#1311) 2026-06-23 12:52:49 -05:00
ISSUE_TEMPLATE docs: fix dead contact links in issue templates and troubleshooting guide (#910) 2026-06-12 14:47:10 -07:00
plugin chore: release 0.36.1 (#3152) 2026-08-20 17:20:18 -07:00
pr-images fix(install): consolidate Windows fallback and cleanup safety (#2980) 2026-08-13 15:05:45 -05:00
scripts fix(codex): PR health label check state (#986) 2026-06-15 16:52:26 -05:00
workflows fix(docker): give :latest exactly one writer (#3154) 2026-08-20 11:45:59 -07:00
CODEOWNERS chore: add CODEOWNERS with maintainer catch-all (#1622) 2026-06-30 21:52:29 -07:00
copilot-instructions.md Fix CI lint failure by formatting PR governance scripts (#933) 2026-06-12 17:11:39 -05:00
dependabot.yml feat(security): pilot hardening — stateless guarantee, model pinning, CI security gate (#1515) 2026-06-27 17:44:10 -07:00
PULL_REQUEST_TEMPLATE.md feat: add deterministic runtime rollout controls (#1490) 2026-08-12 23:16:54 -05:00