chore(release): v0.11.0

Merged
SA
2mo ago
+247-0

Issue for this PR

Closes #

This is the release PR promoting v0.11.0-beta.1 through beta.5 to stable. It doesn't close a single issue — the review findings from this promotion are tracked separately as #1283–#1289 (already filed, not blocking this PR).

Type of change

  • Bug fix
  • New feature
  • Refactor / code improvement
  • Documentation

What does this PR do?

Everything in this release (Altimate Base, the opt-in dbt validators, driver/redaction fixes, etc.) already merged to main across the 26 commits since v0.10.0 — none of that is new in this diff. This PR adds only the two things that couldn't land before the tag: the stable ## [0.11.0] CHANGELOG entry (rolling the five beta entries into one coherent narrative for a first-time reader, per the PM review), and one adversarial test file covering two boundary cases the multi-persona release review flagged as untested (symlinked warehouse store paths, and adversarial content in the Altimate Base gateway's error messages).

It needs a PR because main's branch ruleset requires one for any push — no review is actually required to merge (required_approving_review_count: 0), I just don't have bypass rights on the ruleset myself. Once this merges, I'll tag v0.11.0 off the new main tip directly (tags aren't covered by the ruleset).

How did you verify your code works?

  • Full bun test suite: 13,390 pass. 6 failures on the first run turned out to be pre-existing flaky timeouts in test files that predate this release and aren't touched by its diff — confirmed by re-running just those 6 in isolation, where they pass clean.
  • The new adversarial test file: 17/17 pass.
  • Full monorepo typecheck (bun turbo typecheck --force): 13/13 packages clean.
  • Marker guard: clean.
  • Built the actual dist binary with OPENCODE_VERSION=0.11.0 and smoke-tested it by exact path (not $PATH) — reports 0.11.0 correctly.
  • Ran the Verdaccio sanity suite locally against a genuine cross-built linux-arm64 binary (per #1231 — bun install --os='*' --cpu='*' then build.ts --target-index=0, which produces a real ELF executable, not the cross-build myth the docs used to claim). All phases passed: install 13/0, extended install 22/0, resilience 3/0+8skip, extended resilience 14/0+1skip, security 16/0. Also chased down an apparent ~2x package-size jump this surfaced — traced it to testing with a non-release build (Script.release=false skips the bin/altimate/bin/altimate-code de-dupe step in build.ts, which only runs for real tagged releases); confirmed against the actual v0.10.0 published tarball that the real single-binary size is unchanged (242.5MB uncompressed / 89.5MB compressed, well under npm's E413 ceiling) — no real regression.
  • The five-persona release review (CTO, PM, End User, Tech Lead, and a Chaos Gremlin doing a privacy/compliance pass) is what surfaced the two things fixed in this PR (a ConnectionConfig typecheck gap and a couple of literal control-byte characters in the test file that made git treat it as binary) and the six items now tracked as #1283–#1289.

Screenshots / recordings

N/A — this PR itself only touches CHANGELOG.md and one test file.

Checklist

  • I have tested my changes locally
  • I have not included unrelated changes in this PR

Summary by cubic

Promotes v0.11.0 from beta to stable. All 26 release commits already landed on main; this PR adds the stable [0.11.0] CHANGELOG entry (consolidating five beta entries) and an adversarial test file covering symlinked warehouse store paths and malformed Altimate Base gateway error text.

Once merged, tag v0.11.0 off the main tip.

Summary by CodeRabbit

  • New Features

    • Altimate Base is now the latest free, no-signup hosted model, with consent controls and configurable header timeouts.
    • Added opt-in shadow-mode completion validation and extension-type support for integration listings.

  • Changes

    • Big Pickle is no longer offered to new users.
    • Updated consent messaging, agent naming, and builder prompt organization.

  • Breaking Changes

    • DuckDB and SQLite connections now require an explicit storage path.

  • Bug Fixes

    • Improved credential, telemetry, and safety-message redaction; API error handling; warehouse-store reads; authentication; driver installation; and environment handling.