v2.5.4 is a quality-focused release. No new analytics dashboards were added; the work in this version concentrates on correctness, reliability, accessibility, CI enforcement, and developer-tooling cleanup so existing views behave more predictably in real Azure DevOps environments.
Bug Fixes
This release closes several correctness issues that could produce confusing UI behavior or stale data in longer sessions.
Race condition on rapid project switch
Switching projects before the previous team-list request finished could briefly show teams from the wrong project. In-flight requests are now cancelled when the project changes so only the latest team list can render.
Dev tier switcher now uses the correct storage key
The floating development tier switcher wrote to a different localStorage key than TierContext was reading. Both now use `agile-analytics:tier-override`, so switching tiers actually updates the resolved tier.
Notification trigger no longer fires with a blank team name
The notification effect depended on `teams.find(...)` but did not include `teams` in its dependency array. That timing gap could emit notifications before teams finished loading. The dependency list is now correct and no eslint bypass is needed.
Extension data manager duplication removed
The user-scoped and org-scoped data-manager helpers were previously duplicated byte-for-byte. Both now resolve through a single `getExtensionDataManager` factory so persistence fixes apply consistently everywhere.
Session caches now purge expired entries
Sprint and trend session caches previously kept expired entries forever. They now clear stale TTL-based entries on write, preventing unbounded growth during long browser sessions.
ADO user search is now bounded
The ACL user picker no longer risks unexpectedly large payloads from unbounded Graph API results. Search results are capped at 100 entries, matching the expected Azure DevOps page size.
Setup banner can now be dismissed
Admins now get a Dismiss action on the setup-incomplete banner, and that preference is persisted so the banner does not reappear on every reload after it has been reviewed.
Security
The AI settings form now makes the browser-side request path more explicit.
- A clear warning explains that AI API keys are sent directly from the browser to the selected provider.
- The copy advises customers to use minimum-scope keys and rotate them if exposure is suspected.
Accessibility
Several interface controls now provide clearer semantics for keyboard and screen-reader users.
Navigation tabs follow the ARIA tab pattern
Navigation tabs now use `role="tab"`, `aria-selected`, descriptive `aria-label` values, and a labeled `tablist` container. Locked tabs include upgrade messaging in their accessible name, while decorative lock icons are hidden from screen readers.
Theme toggle has an explicit accessible label
The light/dark mode toggle now announces its action with labels such as `Switch to dark mode` and `Switch to light mode`.
CI/CD
The release pipeline now blocks packaging until validation succeeds.
- A test gate now runs unit tests, API contract tests, and smoke tests before packaging.
- `npm run validate:release` is enforced in CI before the VSIX is created.
- The Publish stage is documented to target the `marketplace` environment so teams can add a manual approval check before live release.
Developer Tooling
Release engineering and private distribution got a few cleanup improvements.
- `npm run publish:private:pilot` was added for enterprise pilot distribution.
- `vss-extension.pilot.json` now declares an explicit empty `galleryFlags` array so the pilot build is clearly private-only.
Tests
The suite now reports 179 passing tests across 13 files, including new or expanded coverage for the highest-risk behaviors in this release.
- Tier resolution across all four tiers, feature-flag combinations, and SDK failure fallback.
- Tier gate coverage for 10 authorized and 6 locked combinations.
- Regression coverage for the shared `agile-analytics:tier-override` storage key.
- Rapid project-switch race-condition coverage to ensure stale team lists never render.
- Setup-banner dismissal, ARIA nav-tab semantics, empty-sprint metrics, and no-date cycle-time fallbacks.
- Manager-factory, `openConfigurationTab`, and ACL loading-guard regressions.
Internal Cleanup
- Six stale release-note files were removed from `marketplace/blog/`.
- The `publish:private` script no longer ships with a `YOUR_ORG_NAME` placeholder.