crashes (11)

• dynatrace-oss/koney#65 fix: do not panic when a trap annotation does not match the resource type
• paulscherrerinstitute/scilog#680 fix(api): guard websocket message parsing and default config
• ProtonMail/go-crypto#325 restrict embedding to embeddable signature types
• ProtonMail/go-crypto#322 Don't panic on unknown AEAD mode in v5/v6 SKESK packets
• ProtonMail/go-crypto#319 guard nil issuer key id on v2 message read path
• ProtonMail/go-crypto#320 guard nil issuer key id when checking trailing signature
• dynatrace-oss/dtctl#404 fix: don't panic when .content.content is not an object
• microsoft/openvmm#4145 virtio: reject regions whose address and length overflow
• dynatrace-oss/koney#61 fix: do not panic when a trap matches resources by namespace only
• NVIDIA/NeMo-Agent-Toolkit#2135 fix(core): guard bare generic type args in recursive_componentref_discovery
• dynatrace-oss/terraform-provider-dynatrace#1183 fix: avoid panic parsing array-shaped REST error bodies

access & secrets (13)

• dynatrace-oss/koney#72 fix: authenticate the callers of the alert forwarder webhooks
• platformio/platformio-core#5499 prevent path traversal via chmod and mtime in zip unpacking
• SciCatProject/backend#2888 fix: authorize target dataset when creating/updating datablocks
• SciCatProject/backend#2886 fix: add access filter and status guard to v3 publisheddata operations
• SciCatProject/backend#2885 fix: apply access filter to samples findOne
• SciCatProject/backend#2884 fix: enforce dataset permissions on v3 publisheddata register
• SciCatProject/backend#2887 fix: check dataset read permission in publisheddata formpopulate
• dynatrace-oss/dtctl#403 fix: strip the account token from a plugin's environment
• dynatrace-oss/dtmgd#27 fix: stop writing expanded env vars back into the config
• dynatrace-oss/koney#60 fix: prevent command injection through FilesystemHoneytoken file paths
• neuroinformatics-unit/datashuttle#717 clear password from TUI input after use
• bitpanda-labs/bitpanda-mcp#57 fix: bind env api key only in stdio transport mode
• LayerPay-org/backend-v2#2 add brute force protection and rate limiting

reliability (12)

• Dynatrace/dynatrace-operator#6533 fix: return error from installAgentFromImage when extraction fails
• dynatrace-oss/koney#67 fix: keep the honeytoken secret when other deployments still mount it
• dynatrace-oss/koney#66 fix: skip resources with unparsable trap annotations instead of failing
• getsentry/sentry-go#1387 fix: keep http.Hijacker when wrapping a response writer
• paulscherrerinstitute/scilog#678 fix(api): await restoreDeletedId in snippet controllers
• dynatrace-oss/koney#62 fix: react to label changes on pods again
• dynatrace-oss/dtctl#399 fix: report CSV write errors instead of dropping them
• dynatrace-oss/dtctl#398 fix: rewind multipart bodies before a retry
• google/go-containerregistry#2373 remote: release pull limiter slot when body is read to EOF
• kubernetes/git-sync#980 add --init-period and --init-max-failures flags
• aws/aws-sdk-pandas#3294 fix(iceberg): too many open partitions by sorting inserts
• anza-xyz/agave#11760 fix toctou in program statistics merge_from

wrong data (24)

• aws/aws-sdk-pandas#3447 fix: align oracle upsert placeholders with dataframe column order
• google/osv-scalibr#2313 fix(sbom): strip platform suffix from RubyGems versions in CycloneDX
• dynatrace-oss/koney#71 fix: honor matchExpressions in resource selectors
• ClickHouse/mcp-clickhouse#210 stringify integers outside JavaScript's safe range in JSON results
• anexia/go-anxsdk#1 fix resource tags endpoint dropping the identifier
• speechbrain/speechbrain#3043 fix float columns being converted to string in from_csv
• dynatrace-oss/eBPF-Discovery#130 accept colon and double quote in header values
• NVIDIA/NeMo-Agent-Toolkit#2141 fix: do not forward the unknown-model sentinel as a per-request model override
• dynatrace-oss/dtctl#405 fix: paginate direct shares so unshare --all sees every page
• dynatrace-oss/hash4j#637 fix deduplicateTokens for ranges not starting at the beginning
• ClickHouse/clickhouse-connect#901 fix: do not shift naive datetime query parameters by the host timezone
• microsoft/openvmm#4144 openhcl_boot: derive the hw id chunk size from the page size
• dynatrace-oss/koney#63 fix: identify matched workloads by namespace and name
• dynatrace-oss/dtctl#387 fix: read direct shares from the correct API response key
• Dynatrace/dynatrace-otel-collector#1110 fix: escape the word boundary in the IPv4 redaction example
• dynatrace-oss/dtctl#366 fix(query): surface Grail metadata in the agent envelope
• dynatrace-oss/dtctl#365 fix(config): normalize environment URL scheme on context creation
• Dynatrace/dynatrace-operator#6536 fix: preserve TelemetryIngest spec in v1beta5 ConvertFrom
• stripe/stripe-cli#1549 fix fixture path losing suffix after dynamic ID substitution
• ton-blockchain/ton#2278 fix wrong getoriginalfwdfee formula in docs
• ClickHouse/mcp-clickhouse#154 return json strings from query results instead of dicts
• stripe/stripe-cli#1534 fix skip-verify not applying to thin event forwarding
• ga4gh/vrs-python#621 Fix copies=0 producing wrong VRS object type
• platformio/platformio-core#5412 fix integrity.dat not being cleaned on version string typo

tooling (15)

• ethereum/execution-specs#3191 chore(ci): deduplicate temp-dir creation across Justfile recipes
• microsoft/openvmm#3975 underhill_core: capture additional meminfo/status fields for OOM diagnosis
• dynatrace-oss/ai-config-manager#17 fix(resource): improve YAML mapping-error suggestion for nested permissions (#12)
• neuroinformatics-unit/datashuttle#716 replace bare except clauses with except Exception
• neuroinformatics-unit/datashuttle#715 remove duplicate fancylog dependency
• dynatrace-oss/dtctl#202 feat: expose Document API filter/sort/add-fields/admin-access flags
• mostly-ai/mostlyai-mock#130 feat: add api_base parameter for OpenAI-compatible endpoints
• dynatrace-oss/dtctl#198 fix: doctor warns instead of fails on platform tokens (#190)
• apple/container#1418 improve error message when image save platform is not available
• apple/container#1392 Fall back to simple text output when stdout is not a TTY
• OpenZeppelin/stellar-contracts#680 add stellar metadata section to contract cargo.toml files
• LayerPay-org/backend-v2#1 integrate blockchain listeners for solana, ethereum, bsc
• ethereum/execution-specs#2621 feat(ci,tooling): add vulture dead code detection to just & ci
• ga4gh/vrs-python#619 build!: Split dev deps into dev, tests, lint, docs groups
• xonsh/xonsh#6181 feat(Xontrib): Show xontrib description in xontrib list output