[fro-bot]

This PR contains the following updates:

Package	Type	Update	Change	OpenSSF
fro-bot/agent	action	minor	v0.124.0 → v0.125.1

---

Release Notes

fro-bot/agent

v0.125.1

Compare Source

What's new

Long preparation or a stalled heartbeat could leave a run failed or stuck, and a renewed lock could be released with an outdated ETag. The lock path now retries the ACKNOWLEDGED→EXECUTING transition after checking the stored run state, preserving clean cancellation when an operator cancels during that retry.

Heartbeat shutdown is bounded to five seconds and returns the freshest confirmed lock and run-state ETags even when a tick fails, allowing terminal transitions and lock release to use current versions. Malformed lock expiry values now fail as invalid lock records instead of being treated as active holders. #​1892

Full changelog

0.125.1 (2026-10-21)

Build System

• deps: update dependency @​fro.bot/systematic to v3.24.1 (#​1894) (7347b81)

Bug Fixes

• bound heartbeat stop, keep renewed ETags, and stop stale-ETag run failures on the lock path (#​1892) (4dbd557)

v0.125.0

Compare Source

What's new

Features

Object-store settings now follow one validation and loading path across the Action, gateway, and deny-key backfill. This closes gaps where the gateway accepted invalid encryption or endpoint settings and the backfill ignored custom S3-compatible endpoints; the shared rules also cover region fallback, file-based settings, and expected bucket-owner validation. Gateway startup now reports which setting failed without exposing its value, and the deployment guide adds configuration and backfill rollout guidance. #​1883

Bug fixes

Workspace image builds can resolve the currently available Alpine 3.24 ca-certificates package again. The pinned revision had been removed from Alpine’s package index, so builds failed; the pin now matches the revision available for both supported architectures. #​1893

Full changelog

0.125.0 (2026-10-20)

Features

• one object-store settings parser for the Action, gateway and backfill (#​1883) (423fa2f)

Bug Fixes

• deploy: pin workspace ca-certificates to 2026102-r0 (#​1893) (5e35c5b)
• deps: update dependency effect to v3.22.3 (#​1868) (bd3e5fd)

Documentation

• solutions: use major pin for harden-runner action (#​1887) (dc7b01d)

Continuous Integration

• deps: update bfra-me/.github to v4.42.0 (#​1884) (af7469a)
• deps: update step-security/harden-runner action to v2.22.2 (#​1879) (b4acee8)

Code Refactoring

• share the remaining small helpers between runtime, the Action and the gateway (#​1888) (cc35481)

Miscellaneous Chores

• deps: update bfra-me/renovate-config preset to v5.2.8 (#​1874) (1b569d7)

v0.124.1

Compare Source

What's new

S3 endpoint validation now correctly recognizes bracketed IPv6 literals and additional reserved-address forms, closing paths that previously bypassed private-address and cloud-metadata checks. Metadata destinations—including AWS, ECS, Alibaba, and Google metadata targets and their mapped or translated IP forms—are rejected even when s3-allow-insecure-endpoint is enabled; other reserved ranges require that opt-in. Public endpoints and ordinary hostnames retain their prior behavior, and hostnames are not DNS-resolved. #​1877

Provider failures now use one classifier across the Action and gateway, resolving cases where the two surfaces disagreed on whether quota or model errors should stop a run. The gateway now stops on quota retries instead of waiting through OpenCode’s retry budget, while the Action stops on model-not-found retries; ambiguous wording can label an error without prematurely ending retryable work. #​1869

Full changelog

0.124.1 (2026-10-20)

Build System

• deps: update dependency @​fro.bot/systematic to v3.23.0 (#​1870) (cd8752f)
• deps: update dependency @​fro.bot/systematic to v3.24.0 (#​1880) (4081c8f)

Bug Fixes

• runtime: reject IPv6, reserved and metadata S3 endpoints that bypassed validation (#​1877) (515424a)

Documentation

• wiki: update project wiki (#​1866) (0933c81)

Continuous Integration

• deps: update bfra-me/.github action to v4.40.0 (#​1867) (2bd9bf5)

Code Refactoring

• share OpenCode payload helpers between the Action and the gateway (#​1872) (801fc25)
• share provider-failure classification between the Action and the gateway (#​1869) (1c4d5f5)

Miscellaneous Chores

• dev: update dependency eslint to v10.13.0 (#​1871) (dbd2273)
• dev: update dependency vitest to v5.0.5 (#​1862) (9a44e2f)

---

Configuration

📅 Schedule: (in timezone America/Phoenix)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.