test(deps): update dependency apm to v0.28.0 (main)

[renovate]

This PR contains the following updates:

Package	Update	Change
apm	minor	0.26.0 → 0.28.0

---

Release Notes

microsoft/apm (apm)

v0.28.0

Compare Source

What's Changed

🔧 Other Changes

• feat(kiro): deploy agents primitive to .kiro/agents/ (#​2089) by @​danielmeppiel in #​2440
• fix(marketplace): accept plugin collection versions by @​danielmeppiel in #​2454
• fix(compilation): preserve applyTo lists for hidden tool placement by @​danielmeppiel in #​2441
• fix(marketplace): allow nested HTTPS source paths by @​danielmeppiel in #​2439
• fix(hooks): anchor Claude project commands to project root by @​danielmeppiel in #​2442
• fix: audit contained local plugin sources (supersedes #​2444, closes #​2428) by @​danielmeppiel in #​2460
• fix(pack): route empty dependencies bundle (supersedes #​2447, closes #​2431) by @​danielmeppiel in #​2458
• fix(marketplace): effective output path (supersedes #​2448, closes #​2427) by @​danielmeppiel in #​2461
• fix(mcp): resolve runtime variables consistently by @​danielmeppiel in #​2455
• Add experimental Grok Cloud target support by @​sergio-sisternes-epam with @​Copilot in #​2420
• refactor(performance): eliminate repeated I/O and lockfile scans by @​danielmeppiel in #​2472
• feat(registry): align object-form registry deps with git skills: by @​nadav-y in #​2166
• fix(init): reject empty/whitespace project names by @​nadav-y in #​2200
• fix(compile): preserve nested worktree files (supersedes #​2453) by @​danielmeppiel in #​2473
• chore: release v0.28.0 by @​danielmeppiel in #​2477
• fix(tests): make local marketplace canonical assertions platform-native by @​danielmeppiel in #​2480
• fix(install): re-download aliased deps after a manifest ref bump by @​danielmeppiel in #​2484
• fix(outdated): degrade gracefully when Rich progress rendering fails by @​danielmeppiel in #​2507

Full Changelog: microsoft/apm@v0.27.0...v0.28.0

v0.27.0

Compare Source

What's Changed

🔧 Other Changes

• fix(dashboard): enforce POST body size limits by @​fallintoplace in #​2029
• fix(install): exclude self-entry from dry-run orphan preview by @​mia106dev in #​2069
• fix(deps): preserve inherited git config when injecting auth headers by @​edenfunf in #​2382
• Defer disk deletion in apm lock to avoid removing dropped deployed files by @​atulya-singh in #​2312
• [BUG] fix(audit): self-hydrate cold-cache ci audit from lock pins by @​hugoguitton-lucca in #​2329
• fix(dashboard): harden static path traversal checks by @​fallintoplace in #​2027
• fix(auth): try public GitHub anonymously before resolving credentials by @​danielmeppiel in #​2406
• fix(integration): make MCP targets deterministic (supersedes #​2302, closes #​2298) by @​danielmeppiel in #​2307
• fix(self-update): pin installer ref to latest version by @​fallintoplace in #​2026
• fix: skip package.json sidecar for Copilot/VSCode hook deployment (#​2322) by @​sergio-sisternes-epam in #​2363
• fix(audit): report deployed files that no lockfile entry claims by @​salpers in #​2380
• fix(mcp): create the lockfile for MCP-only projects by @​edenfunf in #​2390
• fix(install): preserve MCP target mappings (supersedes #​2301, closes #​2297) by @​danielmeppiel in #​2306
• fix(audit): scan the deploy trees for hidden Unicode, not just recorded files by @​salpers in #​2381
• Fix dep devDependencies.mcp leaking into consumer MCP config (#​2340) by @​sergio-sisternes-epam in #​2361
• fix(deps): exclude stale bare-repo cache from resolver stack during apm update by @​sergio-sisternes-epam in #​2364
• fix(mcp): render a docker launcher for v0.1 oci container packages by @​edenfunf in #​2385
• fix(vscode): build container run args from v0.1 registry arguments by @​edenfunf in #​2387
• fix(hooks): enforce restriction-only package targets by @​sergio-sisternes-epam in #​2362
• fix(uninstall): accept portable local dependency keys by @​danielmeppiel in #​2412
• fix(hooks): normalize Copilot lifecycle event aliases by @​danielmeppiel in #​2405
• fix(auth): on-prem ADO Server hosts misclassified as GHES when GITHUB_HOST is set by @​sergio-sisternes-epam in #​2365
• fix: write IntelliJ MCP config to plugin-read path by @​danielmeppiel in #​2410
• fix(install): honor saved targets across MCP and LSP by @​danielmeppiel in #​2414
• fix(marketplace): honour producer tag_pattern in consumer semver range resolution by @​sergio-sisternes-epam in #​2366
• fix(deps): preserve mixed-case materialization paths by @​danielmeppiel in #​2409
• fix(mcp): preserve non-container registry arguments by @​danielmeppiel in #​2407
• chore: release v0.27.0 by @​danielmeppiel in #​2416
• fix(release): repair v0.27 integration contracts by @​danielmeppiel in #​2417
• fix(release): preserve Git isolation across auth fallback by @​danielmeppiel in #​2422
• fix(release): bound macOS Intel integration coverage by @​danielmeppiel in #​2423
• fix(release): decouple live ADO acceptance by @​danielmeppiel in #​2426

New Contributors

• @​salpers made their first contribution in #​2380

Full Changelog: microsoft/apm@v0.26.0...v0.27.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.