This release includes 1 breaking change for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+5 more
Affected surfaces
ReleasePort's take
Moderate signalIn version v0.7.2, PR-receipt refs are now stored under `refs/aireceipts/*` instead of the previous `refs/receipts/*` location.
Why it matters: The reference change breaks any workflow or script that reads or writes to `refs/receipts/*`; update configurations before upgrading to v0.7.2.
Summary
AI summaryPR-receipt refs are now written under refs/aireceipts/* instead of colliding with refs/receipts/*.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Breaking | High |
PR-receipt refs now written under `refs/aireceipts/*` instead of `refs/receipts/*`. PR-receipt refs now written under `refs/aireceipts/*` instead of `refs/receipts/*`. Source: llm_adapter@2026-07-16 Confidence: high |
— |
Full changelog
Patch: PR-receipt refs are now written under refs/aireceipts/* instead of the generic
refs/receipts/*. The old namespace collided with other tools that also publish to
refs/receipts/<slug> (e.g. an attestation producer storing an in-toto receipt.json at
the same path). In a repo running both, the namespace was occupied by the other tool's
payloads, so CI pr-check fetched a foreign ref, failed its schemaVersion check, and
silently posted nothing — the auto-attach hook fired and pushed refs, yet no receipt ever
appeared. aireceipts now owns refs/aireceipts/* and never reads or writes
refs/receipts/*, so the two coexist; the push classifier still recognizes both namespaces
so a foreign receipt-ref push is never mis-counted as a branch commit (PR #204). No
migration: aireceipts had never written a refs/receipts/* ref. Hooks and CI on @latest
adopt the new namespace together on this release. Rendered receipt output is byte-identical
(goldens unchanged); the only user-visible surface change is the ref name in pr --help.
Breaking Changes
- PR-receipt refs moved from `refs/receipts/*` to `refs/aireceipts/*`
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Aireceipts
All releases →Related context
Related tools
Earlier breaking changes
- v0.9.0 `--json` export schema moves to version 2, changing `totalUsd` semantics.
Beta — feedback welcome: [email protected]