redwoodjs__local-ci/CHANGELOG.md

Changelog

Unreleased

• Hardened the DTU mock server by requiring a cryptographically secure per-run control token for internal seed/start-runner/dump endpoints (including trailing-slash routes), failing closed if secure randomness is unavailable, constraining runner log paths to the real run log root, and removing shell interpolation from compare handling.
• Updated direct and transitive dependencies to remediate security advisories, including replacing the unpatched decompress transitive dependency.
• Fixed parallel dependency-install races by giving every job private writable node_modules. Completed pnpm, Yarn, and Bun dependency trees are now atomically published as lockfile-keyed Agent CI snapshots and copied into jobs with copy-on-write when available; npm keeps private installs while reusing its shared download cache. --prewarm-through now populates this safe dependency cache instead of exposing a shared writable tree.
• Hardened opt-in Rust orchestration so matrix legs are keyed by schedule key, matrix needs results are aggregated, reusable workflows and workflow-call outputs are expanded, worker failures preserve sibling outcomes, DTU cleanup/security is enforced, cyclic dependencies error during planning, pull request branch filters use the actual branch, detached pause handling is covered directly, nested ephemeral DTU servers advertise the container IP to sibling runners, nested runner containers join the parent Docker network, Rust cleanup removes nested containers attached to per-job networks, and the Rust smoke parity gate exercises the expanded smoke suite with per-workflow timeouts, duration summaries, heartbeats, status ledgers, failure diagnostics, and timeout cleanup.