release: 0.5.68

[its-miso]

🤖 I have created a release beep boop

0.5.68 (2026-10-04)

Features

• deps: update dependency @modelcontextprotocol/sdk (1.31.0 → 1.32.0) (#1160) (05039a6)
• deps: update dependency eslint (10.11.0 → 10.12.0) (#1161) (ba8217f)
• deps: update dependency lucide-react (1.48.0 → 1.49.0) (#1139) (278135c)
• deps: update dependency lucide-react (1.49.0 → 1.50.0) (#1159) (049cf41)
• deps: update dependency lucide-react (1.50.0 → 1.51.0) (#1170) (9556f61)
• deps: update dependency lucide-react (1.51.0 → 1.52.0) (#1176) (535520c)
• pr-fix: accept an explicit already_addressed settlement without a push (#1142) (889e451)

Bug Fixes

• auth: guard GET /api/automation/repos/[...repo] with authorizeRequest (#1151) (6a9c552)
• ci: pass --include=optional in audit script so --omit=dev survives .npmrc include=dev (#1162) (#1169) (cca5600)
• ci: scope the npm audit gate to production dependencies (#1166) (#1172) (f683575)
• deps: update dependency @types/node (24.19.0 → 24.19.1) (#1155) (b593d4f)
• deps: update dependency jsdom (30.1.1 → 30.1.2) (#1177) (01b6bad)
• deps: update nextjs monorepo (16.3.6 → 16.3.7) (#1136) (edc1afb)
• deps: update nextjs monorepo (16.3.7 → 16.3.8) (#1146) (d6d4db3)
• deps: update vitest monorepo (5.0.2 → 5.0.3) (#1144) (e1e657e)
• groomer: align apply-time head precondition with search-rechecked freshness (#1153) (ba5f607), closes #1116
• groomer: capture repository-context empty searches in the freshness baseline (#1138) (f22dae4)
• groomer: sanitize provider error text before it reaches GroomingRun.errorMessage (#1157) (#1163) (34f0162)
• groomer: strip NUL and C0 control chars from model text before validation and persistence (#1156) (05db272)
• mcp: ship only the runtime closure in the -mcp image (prod deps + tsx layer) (#1175) (752d4a9)
• pr-fix-queue: pin enqueue post-dispatch append to its keys snapshot (#1134) (#1158) (c9dd382)

Chores

• ai-review: upgrade reviewer to v3.2.0 (#1165) (b0863de)

---

This PR was generated with Release Please. See documentation.

Superseded by a newer automated review for this pull request.

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: MiniMax-M3 (anthropic) — primary route · pr-reviewer-action v3.2.0

Partial coverage: required-check coverage is incomplete — this review did not resolve every required check and must not be read as a complete pass.

Recommendation

Approve. This is a release-please generated release PR (release: 0.5.68) that only bumps version metadata across five files. No source code, dependency ranges, or behavioral changes are introduced.

Change-by-change findings

• .release-please-manifest.json: "0.5.67" → "0.5.68". Matches release-please-config.json schema.
• CHANGELOG.md: New 0.5.68 section (2026-10-04) appended at L3, listing Features, Bug Fixes, and Chores sections consistent with changelog-sections in release-please-config.json.
• charts/dispatch/Chart.yaml: version and appVersion both bumped 0.5.67 → 0.5.68. Matches the two extra-files jsonpath entries ($.version, $.appVersion) configured for this package.
• package.json: Top-level "version": "0.5.68". No dependency range changes (e.g. @modelcontextprotocol/sdk stays at ^1.29.0, lucide-react stays at ^1.0.0, next stays at ^16.2.7).
• package-lock.json: Root name.version and packages."".version bumped to 0.5.68. Per the package-lock diff hunks shown, no transitive dep tree reshuffling is visible — only the root version field at L3 and L9 changed. The actual resolved dep tree (e.g. lightningcss 1.32.0, lucide-react 1.52.0, @modelcontextprotocol/sdk 1.32.0) was already at its current state before this PR; this PR only synchronizes the root version label. +2/−2 line totals for a 11k-line file are consistent with metadata-only edits.

All five version references are internally consistent at 0.5.68.

Claims assessment

• Claim 1 (pr-body bullet list): The PR body bullets describe changes already merged on main between v0.5.67 and v0.5.68 (groomer NUL/C0 stripping, mcp image runtime closure, etc.). This release PR does not itself implement those changes — it only documents them in CHANGELOG.md. The diff contains no source code edits, so there is nothing concrete to falsify here. Held as a release-metadata PR that correctly mirrors already-merged commits (verified via git log: each CHANGELOG-cited SHA matches the corresponding feat(deps)/fix(...) commit on main).
• Claim 2 (CHANGELOG.md:L3): A 0.5.68 section exists at L3, precedes the previous 0.5.67 section, and uses the conventional changelog sections from release-please-config.json. Held: 1/1 item.

Standards Compliance

Per .github/ai-review-rules.md, the repository's AI review conventions favor direct, practical reviews that flag only real defects as blocking. This PR introduces no defects: the version bump is consistent, matches release-please-config.json's extra-files, and the CHANGELOG sections match its changelog-sections. No security-sensitive areas (API routes, Prisma migrations, tokens, webhooks) are touched.

Tool Harness Findings

13 tool calls (read_file, git_grep, run_command) returned successful results; the only error was an inadvertent write_file outside the available tool set, which is a harness capability issue, not a code defect. Confirmed: version string 0.5.68 appears in all five expected locations (.release-please-manifest.json:2, CHANGELOG.md:3, charts/dispatch/Chart.yaml:7-8, package.json:3, package-lock.json:3,9); no 0.5.67 reference remains in the bumped files; @modelcontextprotocol/sdk caret range in package.json is unchanged at ^1.29.0; resolved @modelcontextprotocol/sdk in lockfile is already at 1.32.0 (consistent with the changelog's mention of 1.31.0 → 1.32.0 already shipped on main).

Unknowns / Needs Verification

• The truncated package-lock.json diff shows only the root version bump. The package-lock's transitive dep tree state is consistent with the changelog (already-shipped dep updates are at their post-update versions in the lockfile), so no lockfile-integrity concern is visible.
• Release-please PRs are auto-generated and gated by .github/workflows/release-please.yaml. I did not read that workflow's full content; whether the bot's CHANGELOG generation is reliable is a process concern outside the diff, not a defect of this PR.

Requirement Coverage

• req-e589bfe1ad7c (Lint/typecheck blocks CI; must pass): met. CI lint and typecheck both reported success in the CI Check Results table.
• req-ad902b2a08da (Tokens are secrets; never logged/echoed/persisted): not_applicable. The diff touches only version metadata (0.5.67 → 0.5.68) across five files; no code path that handles DISPATCH_AGENT_TOKEN or GITHUB_TOKEN is modified or introduced.

Requirement trace

2 of 2 requirement(s) not fully traced to enforcement and a test:

• req-e589bfe1ad7c — unverifiable (no valid enforcement location)
• req-ad902b2a08da — unverifiable (no valid enforcement location)

Approval withheld: this review's coverage is incomplete — required-check coverage or the tool-loop investigation did not finish, so it is publishing as an advisory comment rather than an approval.