Promote nightly to main (2026-10-05)

[github-actions]

🚀 Nightly to Main Promotion

Date: 2026-10-05
Trigger: Scheduled weekly promotion
Commits: 70 commits to promote
Changes: 171 files changed, 8750 insertions(+), 1287 deletions(-)

---

Commits Being Promoted

Showing first 50 of 70 commits:

68a8d2f7 chore: remove Aikido API key from tracked Claude settings
4da6d869 docs: scrub example emergency token from archived docs
82cc160b test: use obviously fake token in emergency server redaction test
c1f9bf0d docs: replace example emergency tokens with placeholders
735549c7 docs: add Aikido security audit report badge to README
518526be chore(docs-site): override feed to ^6.0.0 and add update script
4e5c7b51 chore(deps): bump lucide-react from 1.51.0 to 1.52.0
37210e21 chore(docker): update GeoLite2-Country.mmdb checksum (#1487)
b4dac5a7 chore(deps): bump http-cache-semantics override to 4.3.0
4a714509 chore: move serialize-javascript script to docs-site directory
80aab864 chore(ci): drop workflow_run trigger from PR security scan
d77293e9 chore(ci): scope package write permissions to the jobs that publish
3b4f00b4 chore(ci): scope workflow token permissions per job and guard workflow_run against forks
cd644662 Merge branch 'development' into bot/update-geolite2-checksum
bfc19875 chore(ci): push with an explicit token instead of persisted checkout credentials
e4e69479 chore(ci): stop persisting git credentials in build and release workflow checkouts
07a8e68e chore(ci): stop persisting git credentials in test and scan workflow checkouts
c7b284c4 chore: update dependency uuid to v14 (#1485)
78b0026a chore(docker): update GeoLite2-Country.mmdb checksum
66cb560c Merge branch 'development' into renovate/uuid-14.x
2f4d88d5 chore(docker): refresh bundled proxy toolchain image (#1486)
3d88540a chore(docker): refresh bundled proxy toolchain image
937a7199 chore: update dependency uuid to v14
7eb6181c fix(security): pin pgproto3/v2 to v2.3.3 in crowdsec build
c34e060d chore: update dependency anchore/grype to v0.120.0 (#1484)
dc66f2c9 chore(deps): allowlist unpatched braces and http-cache-semantics advisories in docs site
b70837d5 docs: fix broken links to contributor-only pages in the docs site
9353d7e9 chore(deps): override sitemap and uuid in docs site
faea809d chore(deps): bump lucide-react from 1.50.0 to 1.51.0
34653e6c chore(deps): bump eslint-plugin-unicorn to v77
4312d881 chore: update dependency anchore/grype to v0.120.0
08047942 fix(security): harden URL handling in provider integrations (#1476)
16351cbf chore(deps): bump otelhttp to v0.72.0 and add powerdns to updater
11b9792c chore: ignore plugin build leftovers in the powerdns module
13152899 test: handle ignored errors flagged by the full linter set
88440b7f chore(docker): set ownership at copy time instead of recursive chown of /app
b8470470 chore: teach code scanning about the shared outbound request helpers
afcc35bf docs: document stricter address checks for provider integrations
4cfb0820 fix: validate DNS provider endpoint addresses
febd3cd4 fix(security): harden URL handling in provider integrations
f15fd842 refactor: add shared helper for outbound provider requests
328b6f46 chore: build and test the powerdns plugin in the workspace
f6c85c6e chore(docker): refresh bundled proxy toolchain image (#1475)
dba3150d chore(docker): refresh bundled proxy toolchain image
98a872e4 fix: apply dnsimple-go pin via go get instead of xcaddy --with
e69da964 deps: pin dnsimple-go to v8.3.1 in Caddy build
a8e7d5e8 chore: harden workflow triggers and checkout credentials
52d63f03 chore: add Aikido API key env to Claude settings
9e72b821 fix(security): harden request validation in the API layer (#1471)
1b1e7038 chore: merge development into fix/security-hardening-3

...and 20 more commits

---

Pre-Merge Checklist

• All status checks pass
• No critical security issues identified
• Changelog is up-to-date (auto-generated via workflow)
• Version bump is appropriate (if applicable)

⚠️ Merge Instructions — CRITICAL

You MUST use "Create a merge commit" — NOT squash or rebase.

Squash merging collapses all feat:/fix: commits into a single bullet-list body.
The auto-versioning workflow cannot parse these bullets, so minor version bumps are
silently skipped and release notes only show the weekly PR title instead of real changes.

Once all checks pass:

1. Review the commit summary above
2. Approve if changes look correct
3. Merge → click the dropdown arrow → select "Create a merge commit"

---

This PR was automatically created by the Weekly Nightly Promotion workflow.

[codecov]

Codecov Report

❌ Patch coverage is 98.88199% with 9 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
backend/internal/api/handlers/security_handler.go	86.66%	2 Missing ⚠️
backend/internal/network/safeclient.go	95.55%	2 Missing ⚠️
backend/cmd/api/main.go	83.33%	1 Missing ⚠️
...ackend/internal/api/handlers/encryption_handler.go	80.00%	1 Missing ⚠️
backend/internal/security/url_validator.go	85.71%	1 Missing ⚠️
backend/internal/services/auth_service.go	98.52%	1 Missing ⚠️
backend/pkg/safehttp/safehttp.go	99.14%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[github-actions]

✅ Supply Chain Verification Results

✅ PASSED

📦 SBOM Summary

• Components: 1870

🔍 Vulnerability Scan

Severity	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	0
🟢 Low	0
Total	0

📎 Artifacts

• SBOM (CycloneDX JSON) and Grype results available in workflow artifacts

---

_{Generated by Supply Chain Verification workflow • View Details}