Skip to content

Release 2.1.26 (2026-06-10)

Bug fixes

  • omit allow_forking for public org repos (#1585) GitHub only accepts the allow_forking field on org-owned private repos; sending it for a public repo returns 422 ("Allow forks setting can only be changed on org-owned private repositories"), failing the GitHub-config step when adopting public repos like an org .github repo.

Gate allow_forking on visibility: set it only for private org repos and leave it unmanaged (None) for public org repos and user-owned repos. compute_desired_state already has visibility in scope and threads it into desired_repo_settings; the existing None handling in _diff_dataclass and _apply_repo_settings then omits the field from the PATCH body. Private org behaviour and the members_can_fork_private_repositories 422 handler are unchanged.

Features

  • mechanized dependency-update workflow (Phase 1) (#1586)
  • docs(specs): add vrg-update-deps design and phase 1 plan (#1379)

Mechanized, human-run dependency-update tool: generic driver + updater registry, managed-worktree execution, Python/uv updater, full PR lifecycle. Phase 1 plan covers the Python end-to-end slice; other updaters and the vrg-release worktree retrofit (#1578) follow. Ref #1379

  • feat(update-deps): add pipeline context and error types

UpdateDepsContext carries repo, repo_root, branch, worktree_path, pr_url, any_changes, and per-updater results through the stage pipeline. UpdateDepsError mirrors ReleaseError. Ref #1379

  • feat(update-deps): add updater protocol, result type, registry

Updater is a runtime-checkable Protocol (applies/apply); UpdateResult reports changed/summary/commit_message/warnings; applicable_updaters filters a registry by applies(). Ref #1379

  • feat(update-deps): add Python/uv language updater

PythonUvUpdater applies when pyproject.toml and uv.lock exist; apply() runs 'uv lock --upgrade' in the dev container and reports changed iff uv.lock is dirty. Ref #1379

  • feat(update-deps): add managed-worktree create/remove helper

create_worktree makes a worktree under .worktrees/ on a new branch off a base ref and rejects an existing path; remove_worktree force-removes it. Shared mechanism for automated workflows (vrg-release retrofit tracked in #1578). Ref #1379

  • feat(update-deps): add preflight with synced-develop checks and worktree creation

Preflight asserts on develop, clean tree, and local develop in sync with origin/develop, then creates the managed worktree off develop and chdirs into it. Ref #1379

  • feat(update-deps): add single-shot validation stage

run_validation runs 'vrg-container-run -- vrg-validate' in the cwd (the worktree) and raises UpdateDepsError with captured output on failure. Ref #1379

  • feat(update-deps): add PR create/merge and worktree-cleanup helpers

prepare_pr pushes the worktree branch and opens the PR to develop; merge_pr reuses pr_merge.wait_and_merge; cleanup_worktree chdirs to the root, removes the worktree, and deletes the local branch (used by both no-op and success paths). Ref #1379

  • feat(update-deps): add stage pipeline with no-op/abort and worktree cleanup

build_stages wires preflight -> update -> validate -> prepare-pr -> merge -> finalize. Updaters commit per category; downstream stages no-op when nothing changed; validate is fail_fast (abort leaves the worktree); finalize removes the worktree on both no-op and success. Ref #1379

  • feat(update-deps): add vrg-update-deps CLI entry point and console script

main() refuses agent identities (human-only), captures repo_root before any worktree chdir, and drives the stage pipeline via progress.run_pipeline. Registers the vrg-update-deps console script. Ref #1379

  • test(update-deps): satisfy lint, typecheck, and 100% coverage gates

Mark Protocol stub bodies and the unused ctx arg with pragma/noqa; move annotation-only Path imports under TYPE_CHECKING; narrow optional ctx in orchestrator tests; add branch/error-path tests so the new modules reach 100% branch coverage under vrg-validate. Ref #1379