This release includes breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+8 more
Affected surfaces
ReleasePort's take
Light signalRepoProvider.mergeBranch now preserves the source branch by default, avoiding accidental deletion of protected or long‑lived branches.
Why it matters: Prevents unintended loss of critical code paths; all merges automatically retain source branches unless explicitly overridden.
Summary
AI summaryFix: RepoProvider.mergeBranch no longer deletes the source branch by default, preventing accidental deletion of protected or long‑lived branches.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Bugfix | Medium |
RepoProvider.mergeBranch no longer deletes source branch by default; protected branches are never deleted. RepoProvider.mergeBranch no longer deletes source branch by default; protected branches are never deleted. Source: llm_adapter@2026-07-16 Confidence: low |
— |
| Bugfix | Medium |
`RepoProvider.mergeBranch` now leaves the source branch intact by default. `RepoProvider.mergeBranch` now leaves the source branch intact by default. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
Full changelog
Patch Changes
-
c444561: Fix:
RepoProvider.mergeBranchno longer deletes the source branch by default (regression), and never deletes a protected branch even when askedThe GitHub/GitLab providers'
mergeBranchdeleted the merged source branch by default (opt-out viaremoveSourceBranch: false). Because the primitive deletes whateverbranchit is given, a driver merging a long-lived branch —contentrain → main(publish) ormain → contentrain(sync) — would deletecontentrainormain. This was a destructive-default change that shipped in a minor; it is a regression.- Opt-in, not opt-out. Like
git mergeand the platform merge APIs,mergeBranchnow leaves the source branch in place by default. Callers that want the merged branch removed (e.g.cr/*review-branch cleanup) passremoveSourceBranch: true. - Mandatory guard. Even when opted in, the cleanup NEVER deletes the merge target (
into), thecontentraincontent branch, or the repo's default branch (resolved viagetDefaultBranch; fail-safe skips the delete if it can't be resolved). This mirrors the LocalProvider's existingcr/*-only guard and defends against head/base confusion.
Applies to both the GitHub and GitLab providers. The LocalProvider path is unchanged (it already merges only
cr/*branches and guards its remote cleanup). Studio's explicitremoveSourceBranch: falsepin remains valid and harmless. - Opt-in, not opt-out. Like
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Contentrain/ai
Local-first MCP server for AI content governance — 13 tools for model/content CRUD, validation, normalization, and i18n across any framework.
Related context
Earlier breaking changes
- v@contentrain/[email protected] `validateModelDefinition` now returns `{ errors, warnings }` instead of a string array.
- v@contentrain/[email protected] `model_save` rejects models with unknown keys, `min > max`, invalid constraints, and `unique` on singletons.
- v@contentrain/[email protected] `content_save` now validates before committing and rejects invalid content.
- v@contentrain/[email protected] `validateModelDefinition` now returns `{ errors, warnings }` instead of a string array.
- v@contentrain/[email protected] `model_save` rejects models with unknown keys, `min > max`, invalid constraints, and `unique` on singletons.
Beta — feedback welcome: [email protected]