Issues

• User-scope (-g) org policy source: govern global installs consistently

  area/audit-policyarea/enterprisepillar/governstatus/needs-designtype/feature
  microsoft/apm#3703 · Filter by author danielmeppiel opened on Nov 12, 2026 · 0.37.0

• Spec proposal: frozen install fails when the lockfile has undeclared direct dependencies (npm ci parity)

  area/lockfilepillar/ecosystemstatus/needs-designtype/feature
  microsoft/apm#3702 · Filter by author danielmeppiel opened on Nov 12, 2026 · 0.37.0

• [BUG] Stale cleanup still trusts a lockfile hash that matches a file APM never deployed

  area/content-securityarea/lockfilepillar/consumetype/bug
  microsoft/apm#3701 · Filter by author danielmeppiel opened on Nov 12, 2026 · 0.36.0

• [BUG] Local plugin bundle installs do not register plugin hooks

  area/hooksarea/package-authoringpillar/producetype/bug
  microsoft/apm#3700 · Filter by author danielmeppiel opened on Nov 12, 2026 · 0.36.0

• [BUG] Declaring a repository and one of its own subdirectory packages together breaks deps list, deps why and uninstall

  area/dependenciespillar/consumestatus/acceptedtype/bug
  microsoft/apm#3699 · Filter by author danielmeppiel opened on Nov 12, 2026 · 0.36.0
  1

• [BUG] A dependency declared with mixed-case owner/repo records a non-canonical parent, so deps tree and deps why lose its transitive dependencies

  area/dependenciesarea/lockfilepillar/consumetype/bug
  microsoft/apm#3698 · Filter by author danielmeppiel opened on Nov 12, 2026 · 0.36.0

• [BUG] Targeted apm install PKG and apm update PKG re-read every local package, so a sibling mid-edit breaks or leaks into the install

  area/dependenciespillar/consumepriority/hightype/bug
  microsoft/apm#3697 · Filter by author danielmeppiel opened on Nov 12, 2026 · 0.36.0

• [BUG] The same owner/repo from two hosts collides in apm_modules with "Path already has a replacement in progress"

  area/dependenciespillar/consumepriority/lowtype/bug
  microsoft/apm#3696 · Filter by author danielmeppiel opened on Nov 12, 2026 · 0.36.0

• [BUG] apm deps list exits 0 on a lockfile with merge conflict markers, and apm prune blames apm.yml

  area/lockfilepillar/foundationspriority/lowtype/bug
  microsoft/apm#3695 · Filter by author danielmeppiel opened on Nov 12, 2026 · 0.36.0

• [BUG] apm config get/set with an unknown key says "This error may indicate a bug in command routing" and omits documented keys

  area/clipillar/foundationspriority/lowtype/bug
  microsoft/apm#3694 · Filter by author danielmeppiel opened on Nov 12, 2026 · 0.36.0

• [BUG] A dependency declared twice in apm.yml (including via apm install --dev) cannot be removed with apm uninstall

  area/dependenciespillar/consumestatus/acceptedtype/bug
  microsoft/apm#3693 · Filter by author danielmeppiel opened on Nov 12, 2026 · 0.36.0
  1

• [BUG] An unquoted lockfile_version: 1 fails with "Unsupported lockfile version 1; supported versions: 1, 2, 3"

  area/lockfilepillar/foundationspriority/lowtype/bug
  microsoft/apm#3692 · Filter by author danielmeppiel opened on Nov 12, 2026 · 0.36.0

• [BUG] A duplicate top-level key in apm.yml makes apm install drop the first block and delete its deployed files

  area/dependenciespillar/consumestatus/acceptedtype/bug
  microsoft/apm#3691 · Filter by author danielmeppiel opened on Nov 12, 2026 · 0.36.0
  1

• [BUG] apm approve, apm deny and apm install --mcp strip comments and expand anchors in apm.yml

  area/clipillar/consumetype/bug
  microsoft/apm#3690 · Filter by author danielmeppiel opened on Nov 12, 2026 · 0.36.0

• [BUG] apm approve never takes effect for github.com dependencies: hooks, bin, MCP and other executables stay gated

  area/audit-policyarea/securitypillar/governtype/bug
  microsoft/apm#3689 · Filter by author danielmeppiel opened on Nov 12, 2026 · 0.36.0

• [BUG] apm audit --ci run from a project subdirectory passes without checking the project

  area/audit-policypillar/governstatus/acceptedtype/bug
  microsoft/apm#3688 · Filter by author danielmeppiel opened on Nov 12, 2026 · 0.36.0
  1

• [BUG] apm view --file does not find a recorded file when the path is given in NFD form (macOS Finder drag-and-drop)

  area/clipillar/consumepriority/lowtype/bug
  microsoft/apm#3687 · Filter by author danielmeppiel opened on Nov 12, 2026 · 0.36.0

• [BUG] apm pack --format plugin for a multi-target producer ships one primitive in several renderings, and a Claude consumer keeps the wrong one

  area/distributionpillar/producestatus/needs-designtype/bug
  microsoft/apm#3686 · Filter by author danielmeppiel opened on Nov 12, 2026 · 0.37.0
  1

• [BUG] apm export-patch writes two packages whose names differ only by case to the same patch file on macOS and Windows

  area/clipillar/consumepriority/lowtype/bug
  microsoft/apm#3685 · Filter by author danielmeppiel opened on Nov 12, 2026 · 0.36.0

• [BUG] On macOS and Windows, apm update after a case-only rename in a package deletes the renamed files and drops them from the lockfile

  area/lockfilearea/multi-targetpillar/consumetype/bug
  microsoft/apm#3684 · Filter by author danielmeppiel opened on Nov 12, 2026 · 0.36.0

• [BUG] apm view -g --file reports no provenance for user-scope files of Claude, Cursor and other non-Copilot targets

  area/clipillar/consumetype/bug
  microsoft/apm#3683 · Filter by author danielmeppiel opened on Nov 12, 2026 · 0.36.0

• [BUG] apm audit --ci reports a skipped user-authored same-name file as a local edit and recommends apm export-patch

  area/audit-policypillar/consumestatus/acceptedtype/bug
  microsoft/apm#3682 · Filter by author danielmeppiel opened on Nov 12, 2026 · 0.36.0
  1

• [BUG] A dependency's MCP server is reported as "already configured" when a user server with the same name but a different command exists (non-Claude/Codex targets)

  area/mcp-configpillar/consumestatus/acceptedtype/bug
  microsoft/apm#3681 · Filter by author danielmeppiel opened on Nov 12, 2026 · 0.36.0
  1

• [BUG] apm uninstall without a lockfile deletes user-authored .cursor/rules/*.mdc and .github/instructions/*.instructions.md files

  area/lockfilearea/multi-targetpillar/consumetype/bug
  microsoft/apm#3680 · Filter by author danielmeppiel opened on Nov 12, 2026 · 0.36.0

• [BUG] apm install overwrites a user-authored rule file with the same name in .claude/rules, .cursor/rules, .windsurf/rules or .kiro/steering

  area/multi-targetpillar/consumetype/bug
  microsoft/apm#3679 · Filter by author danielmeppiel opened on Nov 12, 2026 · 0.36.0