opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-10-16 14:48:56 +08:00
Code Issues Packages Projects Releases Wiki Activity
16,642 Commits 479 Branches 395 Tags
117e728b337ed99bfc530e117473b8088594819f
Commit Graph
16642 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Paweł Banaszewski 117e728b33 feat: restore AI Provider key checks (#29677) 
Adds key validation to the AI Providers API that was present in env
variables path.

* Reject duplicate API keys on create and update, including duplicates
between new keys and retained keys.
* Enforce a maximum of five keys per provider, counting retained and new
keys on update.
* Require Bedrock access keys and secrets to be both set or both
absent/empty. Validate merged settings on update to allow partial
rotations but reject unpaired credentials and partial clears.

Extends and consolidates SDK/API tests covering these checks and
unchanged state after rejected updates.

> Generated with Coder Agents.
 2026-09-23 09:24:46 +00:00
Ethan 0ca7b6af58 ci(.github/workflows): run check-build with make -j (#29776) 
`check-build` runs `make build`, which compiles 7 slim and 7 fat
cross-platform binaries one at a time. The `build` job on `main` already
runs the same targets with `make -j`. This change adds `-j` so the slim
builds overlap with the site build and each other.

Measured on this PR (Depot `ubuntu-22.04-8`): the Build step went from
336-370s to 305s. The 7 fat builds still take about 210s because each
one recompiles the server packages for its platform, which already
saturates the 8 cores when run serially. Every fat binary is still
built, so cross-compilation of the server code stays verified for all 7
platforms.
 2026-09-23 17:08:09 +10:00
Danny Kopping 07c24d6021 docs: document OpenCode custom models through Bedrock Mantle (#29734) 
Document OpenCode custom model IDs through an AI Gateway Bedrock Mantle
provider. Explain Coder token authentication, model aliases, optional
default/small-model selection, and SDK selection for Responses, Chat
Completions, and Anthropic Messages.

<details>
<summary>Configuration context and verification</summary>

Based on a working Astra configuration supplied and live-tested by
@dannykopping. Keep Astra as a concrete example while using
vendor-neutral provider naming and instructions. Use `coder.example.com`
and `bedrock-provider-name` as placeholders and omit unrelated MCP
configuration. Readers must substitute an available model ID and select
the matching SDK package.

Gateway routes and model routing were checked against the
implementation, and OpenCode settings against its documentation/schema.
Local Markdown/table checks, Vale, JSON parsing, and repository
lightweight pre-commit checks passed. The agent did not repeat the live
AWS request; OpenCode is not installed in this workspace.

</details>

Generated by Coder Agents on behalf of @dannykopping.
 2026-09-23 07:03:28 +01:00
Jake Howell 22a6d3496d chore(docs): update kube-region-picker.png (#29693) 
> 🤖 This PR was written by Coder Agents on behalf of Jake Howell.

Replaces `kube-region-picker.png` with a 1792px (2x) capture of the
current New workspace form, showing the immutable `Cluster` parameter
(US Central / Europe West) from the doc's own `coder_parameter` example.
The old image was added with the original additional-clusters docs
(#7019, April 2023) and predates the current form.

Image-only change; no docs text or paths were modified. Referenced once,
from `docs/admin/integrations/multiple-kube-clusters.md`.

| Old | New |
|---|---|
| <img width="448" alt="kube-region-picker (old)"
src="https://raw.githubusercontent.com/coder/coder/47d3e1c52b144664e72544b733b3b5a2f9e68876/docs/images/admin/integrations/kube-region-picker.png"
/> | <img width="448" alt="kube-region-picker (new)"
src="https://raw.githubusercontent.com/coder/coder/refs/heads/jakehwll/docs-kube-region-picker/docs/images/admin/integrations/kube-region-picker.png"
/> |

<details>
<summary>Verification</summary>

- Committed bytes match the image supplied for this change (SHA256
`81601e0e5a0e…`), 1792x1024 PNG (2x the earlier 896x512 preview).
- Parameter display name, `mutable = false` (Immutable badge), option
names, and emoji icons match the `kube_context` parameter block in
`multiple-kube-clusters.md`.
- Fixture data only (`my-workspace`, `beige-ermine-42`); no real users
or deployment URLs.

</details>
 2026-09-23 00:31:48 +00:00
Jake Howell 9079fc41ec chore(docs): update logstream-kube.png (#29694) 
> 🤖 This PR was written by Coder Agents on behalf of Jake Howell.

Replaces `logstream-kube.png` with a 1792px (2x) capture of the current
workspace page, showing `coder-logstream-kube` pod events (pod created
and scheduled, image pulled, container started, node low on memory,
container stopped) streamed into the agent's All Logs tab. The old image
was a 2222x1049 screenshot of the previous workspace page layout.

Image-only change; no docs text or paths were modified. Referenced once,
from `docs/admin/monitoring/logs.md` under "Kubernetes Event Logs".

| Old | New |
|---|---|
| <img width="448" alt="logstream-kube (old)"
src="https://raw.githubusercontent.com/coder/coder/47d3e1c52b144664e72544b733b3b5a2f9e68876/docs/images/admin/monitoring/logstream-kube.png"
/> | <img width="448" alt="logstream-kube (new)"
src="https://raw.githubusercontent.com/coder/coder/refs/heads/jakehwll/docs-logstream-kube/docs/images/admin/monitoring/logstream-kube.png"
/> |

<details>
<summary>Verification</summary>

- Committed bytes match the image supplied for this change (SHA256
`73a5a52e0f0d…`), 1792x1024 PNG (2x the earlier 896x512 preview).
- Log content matches the doc's description of the feature: events "such
as a node being out of resources" streamed to the Coder UI.
- Fixture data only (`TestUser` / `demo`, `hello-world` container); no
real users or deployment URLs.

</details>
 2026-09-23 00:31:28 +00:00
Jake Howell 8c736839e6 chore(docs): update appearance images (#29695) 
> 🤖 This PR was written by Coder Agents on behalf of Jake Howell.

Replaces the five screenshots in `docs/admin/setup/appearance.md` with
1792px (2x) captures of the current UI: the Appearance branding form,
the Announcement Banners settings table, two stacked announcement
banners over the dashboard, a "SECRET" classification banner, and the
user dropdown with support links. The old images dated from before the
current admin settings layout.

`multiple-banners.PNG` is renamed to `multiple-banners.png` to match its
siblings and the markdown reference is updated accordingly; the other
four paths are unchanged.

| Old | New |
|---|---|
| <img width="448" alt="application-name-logo-url (old)"
src="https://raw.githubusercontent.com/coder/coder/47d3e1c52b144664e72544b733b3b5a2f9e68876/docs/images/admin/setup/appearance/application-name-logo-url.png"
/> | <img width="448" alt="application-name-logo-url (new)"
src="https://raw.githubusercontent.com/coder/coder/refs/heads/jakehwll/docs-appearance-images/docs/images/admin/setup/appearance/application-name-logo-url.png"
/> |
| <img width="448" alt="announcement_banner_settings (old)"
src="https://raw.githubusercontent.com/coder/coder/47d3e1c52b144664e72544b733b3b5a2f9e68876/docs/images/admin/setup/appearance/announcement_banner_settings.png"
/> | <img width="448" alt="announcement_banner_settings (new)"
src="https://raw.githubusercontent.com/coder/coder/refs/heads/jakehwll/docs-appearance-images/docs/images/admin/setup/appearance/announcement_banner_settings.png"
/> |
| <img width="448" alt="multiple-banners (old)"
src="https://raw.githubusercontent.com/coder/coder/47d3e1c52b144664e72544b733b3b5a2f9e68876/docs/images/admin/setup/appearance/multiple-banners.PNG"
/> | <img width="448" alt="multiple-banners (new)"
src="https://raw.githubusercontent.com/coder/coder/refs/heads/jakehwll/docs-appearance-images/docs/images/admin/setup/appearance/multiple-banners.png"
/> |
| <img width="448" alt="service-banner-secret (old)"
src="https://raw.githubusercontent.com/coder/coder/47d3e1c52b144664e72544b733b3b5a2f9e68876/docs/images/admin/setup/appearance/service-banner-secret.png"
/> | <img width="448" alt="service-banner-secret (new)"
src="https://raw.githubusercontent.com/coder/coder/refs/heads/jakehwll/docs-appearance-images/docs/images/admin/setup/appearance/service-banner-secret.png"
/> |
| <img width="448" alt="support-links (old)"
src="https://raw.githubusercontent.com/coder/coder/47d3e1c52b144664e72544b733b3b5a2f9e68876/docs/images/admin/setup/appearance/support-links.png"
/> | <img width="448" alt="support-links (new)"
src="https://raw.githubusercontent.com/coder/coder/refs/heads/jakehwll/docs-appearance-images/docs/images/admin/setup/appearance/support-links.png"
/> |

<details>
<summary>Verification</summary>

- Committed bytes match the images supplied for this change (all 1792px
wide PNGs, 2x the earlier 896px previews).
- `rg multiple-banners` confirms `appearance.md:37` was the only
reference to the renamed file.
- Fixture data only (`TestUser` / `test@coder.com`, application name
`Foobar`); no real users or deployment URLs.

</details>
 2026-09-23 00:31:08 +00:00
Jake Howell 9771e3d6cf chore(docs): update prebuilds and preset images (#29696) 
> 🤖 This PR was written by Coder Agents on behalf of Jake Howell.

Replaces three screenshots under
`docs/images/admin/templates/extend-templates/` with 1792px (2x)
captures of the current UI: the Workspaces list filtered by
`owner:prebuilds`, the inbox notification for a prebuilt workspace claim
that triggered a resource replacement, and the Preset dropdown on the
New workspace form. The old images dated from the original prebuilds
(#17580) and presets (#16612) docs in 2025.

Image-only change; no docs text or paths were modified. Referenced once
each, from
`docs/admin/templates/extending-templates/prebuilt-workspaces.md` (two
images) and `docs/admin/templates/extending-templates/parameters.md`
under "Workspace presets".

| Old | New |
|---|---|
| <img width="448" alt="prebuilt-workspaces (old)"
src="https://raw.githubusercontent.com/coder/coder/47d3e1c52b144664e72544b733b3b5a2f9e68876/docs/images/admin/templates/extend-templates/prebuilt/prebuilt-workspaces.png"
/> | <img width="448" alt="prebuilt-workspaces (new)"
src="https://raw.githubusercontent.com/coder/coder/refs/heads/jakehwll/docs-prebuilds-preset-images/docs/images/admin/templates/extend-templates/prebuilt/prebuilt-workspaces.png"
/> |
| <img width="448" alt="replacement-notification (old)"
src="https://raw.githubusercontent.com/coder/coder/47d3e1c52b144664e72544b733b3b5a2f9e68876/docs/images/admin/templates/extend-templates/prebuilt/replacement-notification.png"
/> | <img width="448" alt="replacement-notification (new)"
src="https://raw.githubusercontent.com/coder/coder/refs/heads/jakehwll/docs-prebuilds-preset-images/docs/images/admin/templates/extend-templates/prebuilt/replacement-notification.png"
/> |
| <img width="448" alt="template-preset-dropdown (old)"
src="https://raw.githubusercontent.com/coder/coder/47d3e1c52b144664e72544b733b3b5a2f9e68876/docs/images/admin/templates/extend-templates/template-preset-dropdown.png"
/> | <img width="448" alt="template-preset-dropdown (new)"
src="https://raw.githubusercontent.com/coder/coder/refs/heads/jakehwll/docs-prebuilds-preset-images/docs/images/admin/templates/extend-templates/template-preset-dropdown.png"
/> |

<details>
<summary>Verification</summary>

- Committed bytes match the images supplied for this change (all 1792px
wide PNGs, 2x the earlier 896px previews).
- The prebuilds list shows the `owner:prebuilds` search term that the
doc's caption calls out; the notification wording matches the
`TemplateWorkspaceResourceReplaced` template
(`000324_resource_replacements_notification.up.sql`).
- Fixture data only (`prebuilds` owner, `blue-locust-51`, `admin`); no
real users or deployment URLs.

</details>
 2026-09-23 00:31:05 +00:00
Bobby Ho 395e8032dc fix: reject client_secret in the OAuth2 token and revocation URL (#29508) 
Reject non-empty `client_secret` query parameters on token and revocation endpoints with `400 invalid_request`, enforcing OAuth 2.1 §2.4.1 (D6-04).

- **Breaking:** Send secrets in the request body or `Authorization` header, and rotate any previously sent in URLs. Rejections consume nothing, so clients can retry without reauthorization.
- Empty query secrets count as absent, but token requests also supplying a body secret still fail duplicate-parameter validation. Authorize ignores query secrets and logs a warning without the value.
- Sanitize and cap revocation parse errors, correctly report repeated token parameters, and update tests and API docs. Refusal logs include the app ID, never the secret.
- Other query parameters (`client_id`, `refresh_token`, `code`, and revocation tokens) remain accepted; body-only credential parsing is tracked in PLAT-660.

No migration or new error codes.

Refs PLAT-602.
 2026-09-22 23:20:24 +00:00
J. Scott Miller fb61a1fc64 fix(site/src): swap Stop for Queue once a draft exists while streaming (#29507) 
On viewports below 640 px, Enter inserts a newline, so once a turn was
streaming the footer offered only Stop and there was no way to queue a
follow-up message from touch.

The rightmost footer slot now follows one rule while a turn streams:
Stop while the draft is empty, and the send button labelled Queue once
the draft has sendable text, an active upload, or a live voice
recording. Editing a history message while streaming keeps Stop. When
not streaming, nothing changes. Exactly one of Stop or the send button
renders in the slot at any time.

Two fixes from the UAT report are included:

- Below 640 px, the send button omits `aria-keyshortcuts` and the
tooltip shortcut suffix, and the queued list hides its Enter hint
(`hidden sm:flex`), since Enter does not send there.
- Voice input is available while a turn streams. The mic renders
whenever speech recognition is supported, so a recording can start
mid-stream; Accept holds the primary slot while recording, then Queue
once the transcript lands, and Cancel with an empty draft returns to
Stop. Accept and Cancel refocus the editor on non-mobile viewports.

UAT report:
https://github.com/coder/scott-misc/blob/main/uat/mobile-queue-send-uat/README.md

**Merge point with #29216:** that PR changes the label to
`isEditingMessage ? "Save Edit" : isChatPaused ? "Queue" : "Send"` and
renames `isEditingHistoryMessage` to `isEditingMessage`. Whichever lands
second should resolve the label to `isEditingMessage ? "Save Edit" :
isStreaming || isChatPaused ? "Queue" : "Send"`.

<details>
<summary>UAT findings disposition</summary>

| # | Finding | Disposition |
|---|---------|-------------|
| 1 | Stop unreachable while a draft exists; live Stop returns under
thumb after Queue | Accepted as designed (single-slot rule) |
| 2 | Queue tooltip and `aria-keyshortcuts` say Enter below 640 px;
queued-list hint mismatches | Fixed here |
| 3 | Focus lands on `body` after Queue on phone | Deferred until #29216
lands (rewrites the same button block) |
| 4 | Interrupt with queued messages promotes the queue instead of
stopping | Skipped; pre-existing chatd behavior, needs design atop
#29215 hold semantics |
| 5 | Voice recording loses Accept and Cancel when a turn starts | Fixed
here, extended: the mic is available throughout a stream, not only for a
recording already in progress |
| 6 | 384 px attachment-error toast covers the footer on a 390 px phone
| Skipped; global `Toaster` width, needs design sign-off |

</details>

<details>
<summary>Implementation plan</summary>

Repository: /home/coder/coder, branch `scott/mobile-queue-send` off
`origin/main`.

**Confirmed reading**

- `AgentChatInput.tsx`: `handleSubmit` does not check `isStreaming`; the
editor's `onEnter={handleSubmit}` therefore queues a message while a
turn streams, and the page's send path handles `response.queued`. Footer
right group: voice input hidden while streaming, context usage visible,
Stop under `isStreaming && onInterrupt`, send button only under
`!isStreaming`. `sendButtonLabel` is `"Save Edit" | "Send"`; open PR
#29216 changes it to `isEditingMessage ? "Save Edit" : isChatPaused ?
"Queue" : "Send"`.
- Gap: on touch/narrow viewports Enter inserts a newline, so there is no
way to queue.

**Decisions and constraints**

- Do not add a Queue button beside Stop. Render one primary footer
button whose role depends on the composer draft while a turn streams:
draft empty shows Stop; draft non-empty shows the send button labelled
"Queue", submitting through the existing `handleSubmit` path. Not
streaming: unchanged. The button stays in the rightmost footer slot.
- "Draft non-empty" is `draftOccupiesSlot = hasSendableContent ||
hasActiveUploads`: an attachment still uploading shows a transiently
disabled Queue, an errored-only attachment keeps Stop. Stop is also kept
while a history message is being edited during a stream; Enter still
saves the edit.
- While streaming with an empty draft and no `onInterrupt`, nothing
renders in the slot (same as `main`).
- Smallest change, Vitest for behaviour, setup-only stories with a
narrow-viewport streaming story.

**Scope**

Single component change plus test and story. No page wiring, no server
change.

**Changes**

1. `AgentChatInput.tsx`: label `isEditingHistoryMessage ? "Save Edit" :
isStreaming ? "Queue" : "Send"`; footer slot shows Stop when
`isStreaming && onInterrupt && !draftOccupiesSlot`, the send button when
`!isStreaming || draftOccupiesSlot`; spinner only when `isLoading &&
!isInterruptPending`; tooltip `Queue: <shortcut>` follows from the
label.
2. `AgentChatInput.test.tsx`: Stop -> Queue -> Stop after draft clear,
with callback assertions; interrupt-pending with a draft renders a
disabled Queue that does not call `onSend`.
3. `AgentChatInput.stories.tsx`: narrow-viewport streaming story with a
draft so the 390 px footer with Queue in the Stop slot is captured.
4. `ChatPageContent.stories.tsx` `InterruptingShowsBusyComposer`: the
absent-send-button assertion queries the streaming label "Queue".

**UAT follow-up (this PR)**

- Item 2: `mobileViewportMediaQuery` constant in `utils/mobile.ts`;
`useMediaQuery` in `AgentChatInput` drops `aria-keyshortcuts` and the
tooltip suffix below 640 px; queued-list hint `hidden sm:flex`.
- Item 5: mic cluster rendered whenever `speech.isSupported`;
`speech.isRecording` added to `draftOccupiesSlot`; a live recording
takes precedence over history editing in the slot.

</details>

---

This PR was generated by Coder Agents on behalf of @jscottmiller.
 2026-09-22 17:12:55 -05:00
dylanhuff-at-coder 8b3f032ca1 test(agent): isolate session environment checks from host shells (#29747) 
The environment-variable and secret-injection tests still ran each SSH
command through the host's configured shell after #27803 gave each check
its own session. Startup files could stop the command before it printed
a value. Use noninteractive `/bin/sh` or `cmd.exe /d` for these fixtures
and print values directly, preserving real SSH execution, parallel
sessions, and environment precedence checks.

Controlled startup-file experiments failed all nine checks before this
change and passed afterward. The updated tests also passed 50
repetitions on Linux and macOS. This removes a demonstrated host-shell
dependency, though the exact cause of the September Linux timeout was
not reproduced.

Closes
https://linear.app/codercom/issue/PLAT-310/flake-testagent-session-environmentvariables.

Generated with Coder Agents.
 2026-09-22 14:49:36 -07:00
Michael Suchacz 96b0bdc7bc refactor(coderd/x/chatd): unify model override resolution (#28754) 2026-09-22 23:25:58 +02:00
Bobby Ho fc707a15d1 fix: rate limit the OAuth2 endpoints (#29510) 
Apply the login rate limit to OAuth2 authorization, token, revocation, registration, client configuration, and discovery endpoints, closing the brute-force protection gap (D6-01) and bounding database work.

- Limit requests per IP without a Coder session and per user otherwise.
- Use independent, fixed-key endpoint buckets to prevent path-based bypasses; unmatched routes consume no budget.
- Return HTTP 429 with `temporarily_unavailable` and a `message` matching `error_description` for dashboard/SDK compatibility.
- Preserve `X-Coder-Bypass-Ratelimit` and `--dangerous-disable-rate-limits`.
- Add documentation and tests for route coverage, variable paths, and endpoint/user isolation.

No migrations or new configuration.

Refs PLAT-624
 2026-09-22 21:02:42 +00:00
Callum Styan 83bef8a12d fix: consolidate pg and nats pubsub metrics generation into one (#26843) 2026-09-22 14:00:44 -07:00
Bobby Ho 8a3352079e docs(docs/.style/style-guide): update word choice rule counts (#29758) 
- main fails lint and the Go test jobs on the style claims check.
- #28960 added a documentation-only rule to the word choice page.
- #29299 added a check that the README table matches the rules.
- They merged 19 seconds apart, so neither ran against the other.
- This updates the word choice row and the total row.
- The style claims check and its test pass.
 2026-09-22 20:53:04 +00:00
Michael Suchacz 2872e88827 perf(coderd/database): aggregate AI spend before joining user profiles (#29737) 
The organization spend query joined user profile fields onto every usage
row before aggregating. On dogfood's September window, this sorted 1.23
million rows and wrote about 1.5 GiB of temporary data per request.
Aggregate by user first, then join profiles and apply ordering and
pagination.

A counterbalanced production-data benchmark (six runs each, AB/BA order,
September 1 through September 22 15:00 UTC cutoff, 1,233,784 usage rows)
measured median database execution time of 6.08 s before and 3.12 s
after this change. Ranges were 5.74 to 8.32 s and 2.52 to 4.06 s,
respectively; median per-pair speedup was 2.10x. Median temporary writes
fell from 1,610 MiB to 329 MiB. Both queries had zero shared-buffer
reads in every run. These are EXPLAIN ANALYZE timings on a busy
database, not API/page-load latency. A same-snapshot, unlimited-page
comparison found zero differing rows in either direction, including row
order, across all 88 users.

Refs #28964. This is a one-layer performance stack; further optimization
experiments are not included here. No schema, API, or frontend changes.

<details>
<summary>Delivery record</summary>

Head: `41a179a17464bb54bbc9b3886e9c3ea6b7bda7ef`. SQLC generation,
targeted database/HTTP/export/authorization tests, and the full
pre-commit hook passed before publication and again before requesting
Codex review. The existing query test now covers usage across two groups
in one organization.

Remote browser UAT: not run. Production SQL evidence covers a prototype
verified identical to the committed query; this head is not deployed.
Frontend checks were not run because no frontend or response type
changed. Local pre-push checks were skipped as requested.

Codex:
[OK](https://github.com/coder/coder/pull/29737#issuecomment-5780120712)
at 2026-09-22 16:27:06 UTC for `41a179a174`, after the
[request](https://github.com/coder/coder/pull/29737#issuecomment-5780086039)
at 16:24:34 UTC. No findings or unresolved threads. Completed
independent review passes: 1/6. CI: all current-head check runs passed
or were skipped, including the required gate. The non-required `Pixel /
Review` status remains pending. Codex reports its current-head review
completed; one trigger, no retriggers, no code changes requested.

</details>

> Xum opened and manages this PR on behalf of @ibetitsmike.
 2026-09-22 21:58:18 +02:00
Nick Vigilante ccffab23a0 feat: fail CI when the style guide claims enforcement it doesn't have (#29299) 
## Summary

PR 1 corrected 9 annotations that claimed enforcement the config doesn't
provide. This adds the check that keeps them correct, because the same
drift will recur: annotations are prose, `.vale.ini` is config, and
nothing tied them together.

`scripts/styleclaims` reconciles three sources and fails `make lint`. It
also runs in `lint-light`, so the fast pre-commit hook covers docs-only
changes: the checker's inputs all live under `docs/.style/`, and leaving
it out would let this drift land through the hook that docs changes
actually use. It is the only `lint-light` entry that compiles Go, which
costs one small build on first run and nothing after.

What it reports:

1. `.vale.ini` plus `docs/.style/styles/Coder/`, which is the truth.
2. The per-rule annotations in the style guide subpages.
3. The two coverage tables on the style guide landing page.

### What it reports

| Finding | Example it would have caught |
|---|---|
| A `Coder.*` rule cited as active with no rule file |
`Coder.FirstPersonSingular`, `Coder.FirstPersonPlural` |
| A third-party rule cited as active while `BasedOnStyles = Coder` | the
8 `Google.*` citations |
| A rule file that no section cites as active | a rule landing without
the section the per-rule PR pattern requires |
| Checks-table severity, scope, or membership drift | a rule re-scoped
in `.vale.ini` without updating the table |
| Coverage-count drift | the per-section and total rows |

### Also in this PR

- One annotation reworded so each planned citation is marked
individually (`Google.Gender` and `Google.GenderBias`). A trailing
`(both planned)` covering several citations isn't machine-readable, and
the checker depends on that precision.
- The annotation format documented in `scripts/styleclaims/README.md`,
with the per-rule PR pattern in `docs/.style/README.md` pointing at it.
- `make lint/prose` prints a coverage pointer after running, so the
advisory result doesn't read as a pass.

## Verification

- `go test ./scripts/styleclaims/` covers the parser and each finding
class, including the mixed `scripts/check_emdash.sh` plus `Coder.EmDash`
(planned) annotation and the "rule mentioned but not claimed" case that
`Google.Passive` represents.
- `go run ./scripts/styleclaims` is clean on the branch.
- Regression check: reverting `Coder.FirstPersonSingular` to its
pre-PR-1 wording reproduces 3 findings (the false claim plus the 2 count
rows). Restoring it returns to clean.
- `golangci-lint run scripts/styleclaims/...` reports 0 issues; `gofmt`
clean.
- `make lint/markdown`, `make lint/emdash` clean.

<details>
<summary>Design notes</summary>

### Why Go, not bash

`scripts/` is mostly bash, but this parses Markdown tables and
multi-line annotations, which bash does badly. `scripts/docshtmlcheck`
sets the precedent for a Go checker invoked from a lint target, so this
follows its layout: `main.go`, `main_test.go`, `README.md`, and a `go
run ./scripts/...` target.

### Why not generate the tables

Considered and rejected. Generation and checking need the same parse, so
once the checker exists the table's correctness is guaranteed either
way. Generation would only save a one-row edit in a PR that already
edits the guide by doctrine, at the cost of a generated block inside
prose contributors are invited to edit. The checker also catches a case
generation can't: a rule enabled in `.vale.ini` with no style guide
section at all.

### Parsing tradeoff

The checker reads prose annotations, so it depends on their format
staying regular: start with a recognized keyword, and mark each planned
citation individually. That regularity is enforced by the checker
itself, which is the point, but it does mean an author who invents a new
annotation phrasing gets a failure rather than silent acceptance. If
that proves annoying in practice, the fallback is a small YAML manifest
of rule status that both the tables and the checker read. I'd rather not
add that until the prose form actually hurts.

### Scope validation

Scope cells are checked against `.vale.ini` section globs: every glob
that sets a rule to `YES` must appear in the cell, and a rule with no
`NO` toggle must claim `docs/**`. That's how the `OneSentencePerLine`
row stays honest about running on contributor docs only.

</details>

---

Linear:
[DOCS-887](https://linear.app/codercom/issue/DOCS-887/make-clear-that-vale-passing-is-not-style-guide-conformance)

🤖 Generated with Coder Agents on behalf of @nickvigilante.
 2026-09-22 19:18:59 +00:00
Nick Vigilante 5e41baf73c docs: normalize control plane, coderd, and coder server terminology (#28960) 
Normalizes the three overlapping names for the thing that serves the
Coder API and dashboard. This is step 1 of the Install/Deploy and
Administration refactor
([DOCS-685](https://linear.app/codercom/issue/DOCS-685),
[DOCS-738](https://linear.app/codercom/issue/DOCS-738)) and lands first
because every later page depends on settled terminology.

Resolves [DOCS-871](https://linear.app/codercom/issue/DOCS-871).

## The rule

| Term | Means | Use when |
|---|---|---|
| control plane | The component that serves the Coder API and dashboard,
brokers connections, and coordinates provisioners | Default in prose,
diagrams, planning, sizing, security |
| `coderd` | The process that implements it | Architecture internals,
metrics, logs, flags, troubleshooting |
| `coder server` | The literal CLI command | Only when the reader will
type it |

Retired: "the Coder server" as a name for the component, and "a service"
as a standalone description of it.

## What changed

- **`docs/.style/style-guide/word-choice.md`**: new "Naming Coder's
components" rule, with do/don't examples. Also fixes a "Do" example on
that page that itself used "the Coder server".
- **`docs/reference/glossary.md`**: rewrote `coderd` and Control plane,
added a `coder server` entry. The existing Control plane entry defined
it as "the collective term for `coderd`, its provisioners, and its
database", which made it indistinguishable from the Deployment entry two
sections later. Control plane is now the component; Deployment remains
the whole installation.
- **65 pages** across `docs/admin`, `docs/install`, `docs/get-started`,
`docs/tutorials`, `docs/user-guides`, `docs/ai-coder`, and `docs/about`:
roughly 154 component-sense "Coder server" usages, 21 bare "the server"
usages meaning the control plane, 3 "a service" descriptions, and 43
unbackticked `coderd` mentions in prose.
- One real bug caught in passing:
`docs/tutorials/best-practices/security-best-practices.md` documented
`coderd server --disable-path-apps`, which is not a command. Now `coder
server`.

Generated files were not touched: `configuration-reference.md`,
`prometheus.md`, `audit-logs.md`, `reference/cli/*`, `reference/api/*`,
and the generated blocks inside `feature-stages.md`. Those still contain
the retired term and need generator-side changes; see the deferred list
below.

## Reviewer attention, please

**Anchor changes.** 11 headings were renamed, so their fragments change.
No in-repo link targets any of them (the one internal link that did was
updated), but external deep links from tickets or blog posts would
break, and fragments cannot be fixed with a redirect. Happy to revert
any of these if you would rather they ride along with the page moves in
[DOCS-869](https://linear.app/codercom/issue/DOCS-869), which changes
those URLs anyway.

<details>
<summary>Renamed headings and their old fragments</summary>

| File | Old fragment | New heading |
|---|---|---|
| `admin/networking/index.md` | `#coder-server` | `## Control plane` |
| `install/index.md` | `#starting-the-coder-server` | `## Starting the
control plane` |
| `install/uninstall.md` | `#the-coder-server-binary-and-cli` | `## The
Coder binary and CLI` |
| `install/registry-mirror-artifactory.md` |
`#step-5-configure-coder-server-or-provisioners` | `## Step 5: Configure
the control plane or provisioners` |
| `install/cloud/compute-engine.md` | `#configuring-coder-server` | `##
Configuring the control plane` |
| `get-started/index.md` |
`#cant-start-coder-server-address-already-in-use` | ``### Can't start
`coder server`: Address already in use`` |
| `tutorials/external-database.md` |
`#coder-server-fails-startup-with-...` | ``### `coder server` fails
startup with ...`` |
| `tutorials/faqs.md` |
`#how-do-i-change-the-access-url-for-my-coder-server` | `## How do I
change the access URL for my control plane?` |
| `tutorials/best-practices/security-best-practices.md` |
`#coder-server` | `## Control plane` |
| `tutorials/best-practices/security-best-practices.md` |
`#server-logs-and-audit-logs` | `### Control plane logs and audit logs`
|
| `tutorials/best-practices/scale-coder.md` | `#coder-server`,
`#how-to-capture-coder-server-metrics-with-prometheus` | `## Control
plane`, `### How to capture control plane metrics with Prometheus` |

</details>

**One deliberate deviation from the issue.** DOCS-871 proposed reserving
"sub-agent" for the Coder Agents sense and using "devcontainer agent"
for the workspace sense. I did not make that change. The glossary
already disambiguates with "Sub-agent (Coder Agents)" and "Sub-agent
(dev containers)", and "devcontainer agent" would violate the existing
dev container spelling rule in the same style guide, which requires "dev
container" as two lowercase words. The current split reads correctly and
costs no churn. Happy to revisit if you disagree.

<details>
<summary>Deferred, with reasons</summary>

- **Generated content still says "Coder server".** `reference/cli/*`
comes from Go command help text, `configuration-reference.md` from
`configdocgen`, and `reference/api/*` from Swagger annotations. Fixing
those means changing Go source, which belongs in its own PR so a docs
review does not turn into a backend review.
- **`validated-architectures/index.md` "also known as `coderd`"** is
fixed here, but the page's larger problem is that it holds four
documents in one file. That split is
[DOCS-868](https://linear.app/codercom/issue/DOCS-868).
- **"server flag" phrasing** in `admin/users/idp-sync.md` and
`admin/users/oidc-auth/index.md` means `coder server` flags. Left alone;
rewording those sentences is a copy edit, not a substitution.
- **Metric and UI labels** such as "Dashboard-to-server latency" in
`admin/networking/index.md`. Renaming risks diverging from what the
dashboard shows.
- **Pre-existing `Coder.GerundHeading` warnings** on headings this PR
touches, and a "from from" typo in `scale-coder.md`. Out of scope for a
terminology pass.
- **Peer-sense "server"** in NAT traversal prose, where "client or
server" describes the connection roles rather than the control plane.
Needs restructuring, not substitution.

</details>

## Verification

| Check | Result |
|---|---|
| `make lint/emdash` | pass |
| `make lint/markdown` | pass, 504 files, 0 errors |
| `make lint/docs-html` | pass |
| `make lint/prose` | pass, findings identical to the `main` baseline (1
intentional demo error, 145 warnings, 1 suggestion; only Vale's file
ordering and one line-number shift in `glossary.md` differ) |
| `make gen` | clean, no drift |
| `make fmt/markdown` | applied |

No redirects needed: no page moved or was renamed in this PR.

<details>
<summary>Merged main, 2026-09-14</summary>

One conflict, in `docs/ai-coder/ai-gateway/providers.md`. Both hunks
were text this PR had edited and `main` had since deleted in #29053,
which removed env-based AI provider configuration:

- The deprecated provider seeding note, which held a `coderd` backtick
fix, is gone. Took `main`.
- The failure-mode table lost its env-drift row. Took `main`'s two rows
and reapplied the `coderd` logs wording.

`main` also landed new prose carrying the retired terms, so the pass was
extended to cover it:

- `docs/admin/integrations/oauth2-provider.md`: two "the server log(s)"
in the scope-enforcement sections added by #29144 are now "the `coderd`
log(s)"; "a `scope` the server will not grant" is now "the control
plane".
- `docs/reference/cli/index.md` gained "the server" from #29104, and
stays deferred as generated content.

The new `docs/ai-coder/agent-relay/claude-code.md` needed no change, and
no page `main` added links to a heading this PR renamed.

</details>

<details>
<summary>Decision log for the wider refactor</summary>

Agreed with @nickvigilante before implementation, recorded on DOCS-685
and in the Notion outline:

1. Feature stages and release channels move to Reference; ESR upgrade
guides move under Operate. No new top-level Releases section.
2. `data-retention.md` moves to Administration > Security;
`chat-lifecycle-hooks.md` moves into the Coder Agents docs.
`admin/setup/` therefore survives as "Deployment configuration" and
`configdocgen` is not touched.
3. Prepare is advisory, not a gate, framed as "don't know where to
start? Start here", with lead times and owners per item.
4. One actor table, on the Install overview, spanning all five phases,
noting that one person can be several actors and several people can be
one actor.
5. The quickstart stays independent and is mentioned once, on the
Install overview. The proposed `server/single-machine` page is dropped.
6. Coder Validated Architecture keeps its name in nav, defined in-page,
with a glossary entry.
7. PR 3 is split: moves only, then prose, so the riskiest change reads
as a pure rename diff.
8. For every PR that moves a page, the coder.com `redirects.json` change
merges first.
9. There is no Download section and no CLI page in docs. Per-OS CLI
steps live on coder.com/download and the Install overview links to it.

</details>

Generated with Coder Agents on behalf of @nickvigilante.
 2026-09-22 15:18:40 -04:00
Bobby Ho 9fd0131d04 feat: accept redirect_uris on the OAuth2 app admin API and deprecate callback_url (#29502) 
- Add `redirect_uris` to admin OAuth2 app responses and create/update requests.
- Deprecate `callback_url` while preserving compatibility; it maps to the first redirect URI.
- Reject empty `redirect_uris` lists instead of silently ignoring them.
- Update fixtures, tests, and docs.

Part of PLAT-619. Builds on #29440; admin UI support follows in #29603.
 2026-09-22 19:12:27 +00:00
Andrew Aquino 674166077c chore(site): enable prefer-function-type oxlint rule (#29749) 
Moves
[prefer-function-type](https://oxc.rs/docs/guide/usage/linter/rules/typescript/prefer-function-type)
out of the Oxlint migration backlog and sets it to `error`.

Just one violation, autofixed with `pnpm oxlint --fix`

Verified with:
- `pnpm oxlint --deny-warnings`
- `pnpm biome lint --error-on-warnings`
- `pnpm tsc -p .`
 2026-09-22 18:46:35 +00:00
McKayla はな 5b58daa573 feat: default the workspaces page to the user filter (#29586) 2026-09-22 12:41:13 -06:00
Andrew Aquino b051d4c9ef chore(site): enable no-empty-interface oxlint rule (#29748) 
Moves
[no-empty-interface](https://oxc.rs/docs/guide/usage/linter/rules/typescript/no-empty-interface)
out of the Oxlint migration backlog and sets it to `error`.

We had no violations of this rule to begin with, so this PR doesn't
change anything besides .oxlintrc.jsonc

Verified with:
- `pnpm oxlint --deny-warnings`
- `pnpm biome lint --error-on-warnings`
- `pnpm tsc -p .`
 2026-09-22 18:28:00 +00:00
Nick Vigilante 6dd2e95692 docs: describe organization roles and correct the roles permission claims (#29303) 
## Summary

The roles reference documented deployment-wide roles only.
Organization-scoped roles were named in passing on three other pages but
defined nowhere, and two statements on the page contradicted the RBAC
code.

Closes
[DOCS-891](https://linear.app/codercom/issue/DOCS-891/organization-scoped-roles-are-defined-only-in-code-not-in-the-docs)

## Problem

`coderd/rbac/roles.go` and `coderd/rbac/rolestore/rolestore.go` define
eight organization-scoped roles. `docs/` defined none of them. Searching
`docs/` for `organization-auditor`, `organization-user-admin`,
`organization-service-account`, and
`organization-workspace-creation-ban` returns nothing, and
`organization-admin` appears only inside an IdP sync JSON example.

That produced three concrete defects:

- **Dead-end cross-reference.** The AI Gateway group budget prerequisite
named the Organization Admin and Organization User Admin roles and
linked to a page that defines neither.
- **Incorrect Member claim.** The page said all users hold an implicit
Member role "that may use personal workspaces." The site `member` role
grants no workspace permissions, and `OrgMemberPermissions` grants none
either. Workspace access comes from `organization-workspace-access`,
which organizations attach through their default member roles.
- **Unqualified Owner row.** The table asserts Owner can execute and use
all workspaces. `CODER_DISABLE_OWNER_WORKSPACE_ACCESS` removes SSH and
application access from the role, and the flag was documented only in
the generated CLI and configuration references.

## Fix

Adds an Organization roles section to the roles page covering the six
assignable organization roles, where to assign them, and the implicit
membership role the dashboard doesn't display. It also records that
Organization Admin excludes SSH, application, and terminal access to
other members' workspaces, which is the least discoverable part of the
model.

Corrects the Member and Owner statements, retargets the group budget
prerequisite at the new section, notes that the Disabled workspace
sharing policy overrides the sharing permission of any role an
organization member holds, and fixes the built-in roles and custom roles
glossary entries.

The deployment roles table is deliberately untouched.
[ENG-873](https://linear.app/codercom/issue/ENG-873/autogenerate-roles-documentation)
replaces it with a generated table, so correcting the Auditor row or
adding an organization matrix by hand now would be churn. The new
section is prose a generator won't emit, so the two changes compose.

<details>
<summary>Verification and scope notes</summary>

**Claims verified against source, not assumed:**

| Claim | Source |
|---|---|
| Six assignable organization roles and their display names |
`builtInRoles` in `coderd/rbac/roles.go` |
| Organization Admin lacks `ssh` and `application_connect` | `orgAdmin`
role, `slice.Omit(ResourceWorkspace.AvailableActions(), ...)` |
| Member role grants no workspace permissions | `memberRole.User`
excludes `ResourceWorkspace` with no add-back |
| Workspace access comes from the default member roles |
`DefaultOrgMemberRoles()` and `orgWorkspaceAccessMemberPerms()` |
| `organization-member` and `organization-service-account` have no
display name, so the dashboard never shows them | `systemRoles` in
`rolestore.go`, `DisplayName: ""` |
| Disabled sharing overrides other roles | org-level negative
`workspace:share` permission in `OrgMemberPermissions` |
| Roles are assigned on the organization Members page | `Edit roles`
action in `OrganizationMembersTable.tsx` |
| Flag, environment variable, and YAML names | `codersdk/deployment.go`
|

**Scoped out deliberately:**

- The Disabled-sharing note says "any role held by a member of that
organization" rather than naming Owner. The negation rides on the
organization membership role, so it doesn't reach an Owner who isn't a
member of that organization.
- Pre-existing gerund headings on the touched pages (`Creating custom
roles`, `Getting Started`, `Sharing your Workspace`, `Using a shared
workspace`, `Accessing workspace apps in shared workspaces`) are left
alone to keep the diff scoped. Vale reports them as warnings on `main`
today.
- `## Custom Roles` is retitled to sentence case. The GitHub anchor slug
is unchanged, so inbound links still resolve.

**Checks run:** `make fmt/markdown`, `make lint/markdown`, `make
lint/emdash`, and `vale` on the four changed files. Vale reports zero
findings from the new text. Every link added or changed was resolved to
its file and heading anchor.

**Also worth knowing:** three en dashes in the workspace sharing policy
list are replaced with colons. `scripts/check_emdash.sh` only scans
changed files, so they survived on `main` and would have failed this
PR's CI once the surrounding lines were touched.

</details>

---

Opened by Coder Agents on behalf of @nickvigilante.
 2026-09-22 14:17:00 -04:00
Nick Vigilante 25a6bf56c9 docs: state what the style guide tooling actually checks (#29298) 
## Summary

The style guide documents 77 rules. Tooling checks 8 of them, one of
which doesn't run on published pages, and Vale runs advisory so no
finding fails a build. Nothing said so, and several annotations said the
opposite.

This corrects the false claims and states the coverage where authors and
agents actually read.

### The false claims

Nine annotations read as active enforcement with no `(planned)` marker:

- `Google.Gender`, `Google.GenderBias`, `Google.Headings`,
`Google.HeadingPunctuation`, `Google.OxfordComma`, `Google.Quotes`,
`Google.Exclamation`, `Google.Ranges`. The repo-root `.vale.ini` sets
`BasedOnStyles = Coder`, and the doctrine in `docs/.style/README.md`
deliberately excludes third-party rules.
- `Coder.FirstPersonSingular` and `Coder.FirstPersonPlural`. No YAML
exists for either in the rule package.

All are now marked planned, matching the 17 annotations that already
were.

### What changed

| File | Change |
|---|---|
| `docs/.style/style-guide/README.md` | New "What the tooling checks,
and what it doesn't" section: per-rule table with tool, severity, and
scope, per-section coverage counts, and the enumeration and
classification rules that reproduce them |
| `docs/.style/style-guide/capitalization-and-punctuation.md`,
`voice-and-tone.md`, `accessibility-and-inclusion.md` | Mark the 9 false
enforcement claims planned |
| `docs/.style/style-guide/audience-and-scope.md` | Give each rule its
own enforcement footer, so the page's 6 rules stop counting as 1 |
| `docs/.style/style-guide/word-choice.md` | Say that `Coder.BrandNames`
covers `HashiCorp` casing only, and give the What's next? sub-rule its
own footer |
| `docs/about/contributing/documentation.md` | Drop "to enforce prose
style"; state that Vale covers a subset and a clean run isn't
conformance |
| `AGENTS.md`, `.claude/docs/DOCS_STYLE_GUIDE.md`,
`.claude/skills/write-docs/SKILL.md` | Same statement for agents; split
the skill checklist item so applying the guide and passing linters are
separate gates |

## Why

An agent (me) wrote a new install page, ran `make lint/prose` and
markdownlint clean, and shipped a draft that violated
one-sentence-per-line, the "refer to" rule, `sh` fence tags, H3 tab
headings, and the Learn more heading. None of those are enforced. The
single checklist item that bundled "style guide applied with it open"
with "Vale passes" made the substitution easy to miss.

<details>
<summary>Verification and method</summary>

### Empirical probe

A scratch file violating 12 documented rules (gerund heading, trailing
heading punctuation, first person singular and plural, `Click`,
`Github`, `Hashicorp`, `VSCode`, Oxford comma, US quotation, numeric
range, exclamation point, one-sentence-per-line, `Simply`, navigational
`See`, `Next steps`) produced exactly 3 findings: `Coder.GerundHeading`,
`Coder.SelectClick`, `Coder.BrandNames`.

### Counts

One rule section is one heading with an enforcement footer (`*Enforced
by ...*`, `*Documentation-only ...*`, `*Adapted from ASD-STE100 ...*`).
Sections are classified against `.vale.ini` and
`docs/.style/styles/Coder/` by an ordered test: a stated
**Documentation-only** wins, then a check that runs today, then planned.
77 total: 8 tool-checked, 25 planned, 44 documentation-only. PR 2 in
this stack adds a script that reconciles those three sources in CI so
the table and the annotations can't drift from the config again.

### Two findings recorded but not fixed here

- `Coder.BrandNames` ships at `error` but swaps only `Hashicorp` and
`HASHICORP`, though the table it's cited under lists 8 brands. `Github`
and `VSCode` pass clean. The footer now says so; widening the rule is
tracked in DOCS-889.
- `Coder.OneSentencePerLine` is set to `NO` repo-wide and re-enabled
only for `docs/.style/*.md` and `docs/.style/styles/Coder/*.md`. Rollout
tracked in DOCS-888.

### Note for the reviewer

`make lint/prose` over `docs/` currently reports a backlog of
`Coder.GerundHeading` warnings, plus the intentional `Coder.Demo*`
findings in the annotation demo. That backlog is the advisory channel
working as designed and is out of scope here, but it's the concrete
evidence behind the new sentence about findings accumulating rather than
blocking. Worth a separate cleanup decision: fix the headings, or
re-scope the rule.

</details>

---

Linear:
[DOCS-887](https://linear.app/codercom/issue/DOCS-887/make-clear-that-vale-passing-is-not-style-guide-conformance)

PR 2 of this stack adds the CI guard that keeps these claims true.

🤖 Generated with Coder Agents on behalf of @nickvigilante.
 2026-09-22 14:16:27 -04:00
Bobby Ho b9e3de8403 fix: make redirect_uris the source of truth for OAuth2 redirect URIs (#29440) 
Fix OAuth2 callback edits retaining stale redirect URIs

- Make `redirect_uris` the sole source of truth, with the first entry as primary and `callback_url` retained as a synchronized, deprecated copy.
- Backfill existing apps and unify all writers. Callback-only admin updates now replace the previous primary while preserving alternate URIs.
- Share redirect URI validation, reject fragments, and add limits of 32 URIs and 2048 bytes per URI.
- Add regression coverage for migration, callback edits, validation, and rejection of removed URIs during authorization and token exchange.

One data migration; no schema or request/response shape changes. Admin API and UI list editing follow separately.

Rollout: Drain old replicas before upgrading; callback edits handled by old code are not reflected on new replicas.

Refs PLAT-619.
 2026-09-22 10:49:19 -07:00
dylanhuff-at-coder 056c3e4f55 ci(.github): collect Windows PostgreSQL diagnostics (#29362) 
Add bounded Windows PostgreSQL listener, connection, process, memory and
disk diagnostics alongside the existing server logs. Retain timestamped
samples and sanitized failures as an artifact on unsuccessful runs. This
gathers evidence for PLAT-307 without claiming its cause or a fix.

A concrete runner preserves make's exit status and the caller's
module-path environment, and cleans up only its owned sampler. Windows
concurrency remains 8 packages and 16 tests per package; the sampler's
500 ms connection deadline, PostgreSQL settings, retries and production
telemetry are unchanged.

Focused checks cover a strict native Windows sample, connection and
memory boundaries, sampling limits, cleanup, make exits and environment
preservation. Full local pre-commit, action validation and focused
checks pass, including LF and CRLF harness copies. Current-head Windows
native smoke, reduced harness and Go tests pass. All applicable CI
checks pass, including the required check.

Related:
[PLAT-307](https://linear.app/codercom/issue/PLAT-307/flake-testtelemetry-multiple-variants-postgres-connection-refused).

<details>
<summary>Implementation approach</summary>

Run an isolated, bounded sampler around make. Select diagnostic fields
without credentials, command lines or raw error messages. Validate a
completed native sample before Go tests, including cached runs, and keep
that sample in the failure-artifact directory.

</details>

Generated with Coder Agents.
 2026-09-22 10:14:02 -07:00
Michael Suchacz 926e4afc39 fix(coderd/aibridged): ignore empty response body writes (#29728) 2026-09-22 19:02:06 +02:00
Jeremy Ruppel 17abc3f093 fix(site/src/components/TableToolbar): keep toolbar text at 12px (#29738) 
The workspace table toolbar count changed typography when bulk actions
replaced pagination.

Keep the shared toolbar text at the 12px typography token in both
states.

Refs DES-22114

Before


https://github.com/user-attachments/assets/63b80503-bd9f-4c5b-92c1-a3c4a8351d5b

After


https://github.com/user-attachments/assets/b201ece2-e20f-4cf1-9e60-7ce1863fb5b0


_Generated by Coder Agents on behalf of @jeremyruppel._
 2026-09-22 12:58:34 -04:00
Andrew Aquino 6869e4b95a feat(site): show exact day counts for last login on UsersPage (#29688) 
ref CLIENT-192

Make `LastSeen` display an exact number of days on `UsersPage` only.

see Status column on the right of these screenshots:

before|after
---|---
<img width="1840" height="1191" alt="image"
src="https://github.com/user-attachments/assets/c125ae05-cf05-4ad7-aa74-c44b575f2d69"
/>|<img width="1796" height="1147" alt="image"
src="https://github.com/user-attachments/assets/d73eaa2d-634c-4ab6-9d74-1027309bd79d"
/>
 2026-09-22 09:45:29 -07:00
dylanhuff-at-coder ae76be47d3 fix: prevent tailnet coordination panics (#29300) 
Malformed coordinate requests can panic per-connection coordinator
goroutines and terminate coderd. Disconnect requests and nested cleanup
of peers with full response buffers can also attempt to send on or close
an already-closed channel.

Validate request structure before authorization or state mutation in
both tailnet coordinators, stop processing after disconnect, and avoid
removing a peer twice during nested cleanup. Unexpected per-connection
panics close the affected connection through the existing lost-peer
cleanup.


https://linear.app/codercom/issue/PLAT-595/security-nil-node-in-tailnet-updateself-crashes-entire-coderd-process
 2026-09-22 09:31:49 -07:00
Nick Vigilante c1286707bf ci(.github/workflows): bump agents-chat-action to v0.5.1 for the /api/v2 fix (#29732) 
## Summary

Bump the pinned `coder/agents-chat-action` SHA so doc-check actually
runs the `/api/v2` fix.

[coder/coder#29548](https://github.com/coder/coder/pull/29548) removed
the `/api/experimental` chat mounts, and the action still called them.

[coder/agents-chat-action#43](https://github.com/coder/agents-chat-action/pull/43)
repointed the client at `/api/v2` and is merged, but this workflow pins
the action by commit SHA, so doc-check kept running the broken v0.5.0
bundle.

## Changes

- `.github/workflows/doc-check.yaml`: `coder/agents-chat-action@3e20636`
(v0.5.0) to `@9b3ac42` (v0.5.1).

`v0.5.1` is a new tag cut at the post-merge commit of
coder/agents-chat-action#43.
The pin is the commit SHA, matching the existing convention for every
pinned action in this workflow.

## Evidence

Of the eight most recent `doc-check.yaml` runs, seven failed with the
stale action:

```
Failed to look up chats by reuse labels [...]: Coder API error: Not Found
```

## This does not fix every doc-check failure

The eighth recent failure has a different cause and survives this
change:

```
doc-check-pr-29440 is dormant since 2026-09-18T20:25:12Z. The review cannot run,
because a chat cannot start its own dormant workspace
```

That is the `Check the review workspace is usable` step failing per
[CODAGT-1025](https://linear.app/codercom/issue/CODAGT-1025), which is
deliberate: the step fails loudly rather than letting a review silently
read nothing.
Individual pull requests whose review workspace has gone dormant will
keep going red until CODAGT-1025 is addressed.

## Testing

- `make lint/actions/actionlint`: pass (via pre-commit).
- Full `pre-commit-light` suite: pass.
- Verified `v0.5.1` dereferences to commit
`9b3ac42d568e9206f9cd51a97789820d6935cc8d`, which is the SHA pinned
here.

End-to-end verification needs this merged, since the workflow runs the
pinned SHA from the base branch.

<details>
<summary>Investigation notes</summary>

### Why the earlier fix did not take effect

The action fix merged at 14:39 UTC, but GitHub Actions resolves `uses:`
against the pinned SHA, not the default branch.
Nothing in coder/coder changed when the action merged, so every
subsequent run still executed the v0.5.0 bundle.

### Failure classification, eight most recent runs

| Run | Failing step | Cause |
| --- | --- | --- |
| 35742517848 | Check the review workspace is usable | CODAGT-1025,
dormant workspace |
| 35741492350 | Run doc-check via Coder Agent Chat | stale pin, reuse
label 404 |
| 35741372081 | Run doc-check via Coder Agent Chat | stale pin, reuse
label 404 |
| 35741334633 | Run doc-check via Coder Agent Chat | stale pin, reuse
label 404 |
| 35741253070 | Run doc-check via Coder Agent Chat | stale pin, reuse
label 404 |
| 35740876746 | Run doc-check via Coder Agent Chat | stale pin, reuse
label 404 |
| 35740802233 | Run doc-check via Coder Agent Chat | stale pin, reuse
label 404 |
| 35740674362 | Run doc-check via Coder Agent Chat | stale pin, reuse
label 404 |

### Note on the floating tag

The repository also carries a `v0` tag, but it still points at `v0.1.0`
and is unmaintained.
This workflow pins exact SHAs, so that tag is not used here and was left
alone.

</details>

Refs
[DOCS-987](https://linear.app/codercom/issue/DOCS-987/bump-the-pinned-agents-chat-action-sha-in-doc-checkyaml-to-pick-up-the).

> [!NOTE]
> Coder Agents generated this pull request on Nick Vigilante's behalf.
 2026-09-22 11:05:30 -04:00
Michael Suchacz c2f2c1708e feat: route and link the User spend page for its viewers (#28964) 
Routes `/ai/settings/spend` to the spend page and opens it to its
viewers: a **User spend** entry in the AI settings sidebar, the **AI**
entry in the Admin settings menu, and the AI settings index redirect all
admit anyone who can read some organization's group members
(`canViewAISpend`, the same `group_member:read` check the endpoint
applies), so Owners, Auditors, Template Admins, User Admins, and
organization admins reach it the way organization MCP sharers already
do. Documents the page in the AI Gateway cost controls and spend
management guides.

## Why

This is the PR that makes the feature reachable; the spend page remains
unreachable until this merges. It also carries the head branch and
delivery record of the original single PR.

## What to scrutinize

- `canViewAISpend` is a pure entitlement-and-organization predicate.
Each of its three callers owns its query and loading/error behavior. The
Navbar and index redirect skip that query for viewers with site-wide AI
settings permissions. This repeats the short query wiring rather than
introducing a shared hook.
- `AISettingsSidebarView` keeps User spend as a direct navigation entry.
- The index redirect checks spend access last, after every existing
destination.

## Rework note

Rewritten in place on 2026-09-20 as the ninth layer of a nine-PR stack;
the head branch name predates the split. The original description and
the UAT delivery record through round 13 (PASS on
`e830cbf9937d17a0693909bd027cc142393ceef3`) are preserved in the first
comment below. That verdict applies to the pre-split head, not to this
rewritten commit.

## Validation

`pnpm test src/modules/management/AISettingsSidebar.test.tsx
src/modules/dashboard/DashboardLayout.test.tsx
src/pages/AISettingsPage/AISettingsIndexRedirect.test.tsx`, Storybook
`AISettingsSidebarView` (`SpendVisible`, `UserSpendActive`), repository
pre-commit (includes markdown lint for the docs).

## Delivery record

Composed head `d899228f798` passed format, check, full frontend lint,
125 targeted unit tests, and 86 story tests. Every layer passed
integration checks and the commit hooks. Pre-push hooks were skipped as
requested.

The eight-role frontend audit covered `2cb8fb35b12..1adb58ecbd6`.
Findings were fixed before publication: the picker stays mounted after
the initial retention load; its skeleton uses utility classes; vacuous
test loops and the unnecessary predicate comment were removed; and the
entitlement fixture was simplified. RO3 query-wiring duplication is
intentionally retained to keep the access check a pure function, as
requested.

| Audit role | Task | Disposition |
|---|---|---|
| Simplicity and frontend contract | `fff065b7b7` | No findings |
| Reuse | `30b7fde9ac` | RO3 nit accepted above |
| Accessibility | `3bfd41ce80` | SA1 and SA6 fixed |
| Comments | `4eacb22ea8` | CD2, CD3, CD5 fixed |
| Tests | `1b03411670` | Test coverage corrected; literal-model API
regressions pass |
| Types | `7ef176f55d` | Fixture cleanup and picker regression fixes
integrated |
| React | `4d259f8821` | No findings |
| Data flow | `2a897df255` | No findings |

The follow-up fixes were validated by the implementing agents and the
composed-tip checks, not a new independent review of this exact head. No
further Codex or human re-review was requested because the review budget
is exhausted. Live UAT has not been rerun on this head; round 14
exercised `926d489db6c` and remained BLOCKED on the spend-only
entitlement cycle. Round 15 was halted after shared-deployment contact.
No UAT pass is claimed for the current stack.

## Stack context

PR 9 of 9. The stack adds a **User spend** page under **Admin settings**
> **AI** > **User spend**: total and per-user AI Gateway spend for one
organization over a reporting period, read from `GET
/api/v2/organizations/{organization}/ai/spend/users` (#29129, merged).
It is #28964 split into one-concern PRs. Historical UAT covers earlier
heads only; live UAT has not been rerun after these review fixes. Bottom
to top: DateRangePicker limits, shared dimension badge, API client
method, spend table, page view, page container, reporting period,
dimension filters, route and navigation (#28964).

> Xum prepared this PR on behalf of @ibetitsmike.
 2026-09-22 13:42:10 +00:00
Michael Suchacz 4f78bb8535 feat(site/src): filter spend by provider, model, and client (#29632) 
Wires the provider, model, and client filter menus shared with the
sessions page into the spend page, in the same order as the table
columns. Their options come from deployment-wide AI Gateway endpoints,
so only viewers with `viewAnyAIBridgeInterception` get the menus; for
anyone else the URL parameters are ignored and no option request is
made.

## Why

Organization-scoped filter options need a new endpoint and are a
follow-up; gating on the deployment-wide permission keeps the page open
to organization readers without leaking filter options they cannot list.

## What to scrutinize

- `shows spend without dimension filters to viewers who cannot read AI
sessions` asserts no provider, model, or client request and no
`provider_name` in the report request.
- The pending-report test drives the offered presets and checks their
request boundaries against the retained cutoff. The keyboard test
applies a second range after the first request without moving focus back
to the trigger.
- The shared model menu sends raw identifiers through `model`,
introduced in #29627. Quoting and SQL LIKE escaping no longer live in
the frontend.

## Validation

`pnpm test src/pages/AISettingsPage/SpendPage/SpendPage.test.tsx
src/pages/AIBridgePage/filters/ModelFilter.test.tsx`, `pnpm
test:storybook` on `SpendPage.stories.tsx` (`ProviderMenu`,
`FilteredByProvider`), repository pre-commit.

## Delivery record

Published head `ece31d4795d` passed per-layer integration checks and
commit hooks. The composed head `d899228f798` passed format, check, full
frontend lint, 125 unit tests, and 86 story tests. Pre-push hooks were
skipped as requested. See #28964 for audit findings, their disposition,
and historical UAT limits. No exact-head live UAT or new independent
re-review is claimed.

## Stack context

PR 8 of 9. The stack adds a **User spend** page under **Admin settings**
> **AI** > **User spend**: total and per-user AI Gateway spend for one
organization over a reporting period, read from `GET
/api/v2/organizations/{organization}/ai/spend/users` (#29129, merged).
It is #28964 split into one-concern PRs. Historical UAT covers earlier
heads only; live UAT has not been rerun after these review fixes. Bottom
to top: DateRangePicker limits, shared dimension badge, API client
method, spend table, page view, page container, reporting period,
dimension filters, route and navigation (#28964).

> Xum prepared this PR on behalf of @ibetitsmike.
 2026-09-22 13:33:50 +00:00
Michael Suchacz d532b40ed0 feat(site/src): map the spend reporting period to selectable days within retention (#29631) 
Without URL dates the server applies the current budget period narrowed
to retention; this PR maps that echoed window (`period_start`,
`period_end`, `retention_start`) onto local picker days so the picker
shows the applied range, bounds it below by the first whole day within
retention, and stays off when less than a day of retention leaves
nothing selectable. Exports `toBoundary` from the picker for that
mapping and adds the page's stories.

## Why

Usage before the retention cutoff has been purged, so the picker must
not offer those days or presets; the cutoff moves, so it is read from
each real report rather than computed client side. Because retention is
deployment-wide, the page keeps the last reported cutoff while a new
report loads. Only the initial load replaces the picker with a skeleton,
preserving keyboard focus on later requests.

## What to scrutinize

- `appliedWindowToDateRange` returns undefined when the first selectable
day is after today; `SpendPage.period.test.ts` covers UTC/local day
mapping, a clamped start, and sub-day retention, and pins a
positive-offset zone so it cannot pass vacuously on UTC hosts.
- `SpendPage.stories.tsx` is new in this split at this layer; the
12-user fixture is generated with `Array.from` (same values as #28964's
hand-written list).

## Validation

`pnpm test src/pages/AISettingsPage/SpendPage/SpendPage.period.test.ts
src/pages/AISettingsPage/SpendPage/SpendPage.test.tsx`, `pnpm
test:storybook` on `SpendPage.stories.tsx`, repository pre-commit.

## Delivery record

Published head `78d974d61f1` passed per-layer integration checks and
commit hooks. The composed head `d899228f798` passed format, check, full
frontend lint, 125 unit tests, and 86 story tests. Pre-push hooks were
skipped as requested. See #28964 for audit findings, their disposition,
and historical UAT limits. No exact-head live UAT or new independent
re-review is claimed.

## Stack context

PR 7 of 9. The stack adds a **User spend** page under **Admin settings**
> **AI** > **User spend**: total and per-user AI Gateway spend for one
organization over a reporting period, read from `GET
/api/v2/organizations/{organization}/ai/spend/users` (#29129, merged).
It is #28964 split into one-concern PRs. Historical UAT covers earlier
heads only; live UAT has not been rerun after these review fixes. Bottom
to top: DateRangePicker limits, shared dimension badge, API client
method, spend table, page view, page container, reporting period,
dimension filters, route and navigation (#28964).

> Xum prepared this PR on behalf of @ibetitsmike.
 2026-09-22 13:24:53 +00:00
Michael Suchacz ed69bad4ff feat(site/src): add the organization spend page (#29630) 
Adds the `SpendPage` container: it lists the organizations whose group
members the viewer can read, selects one from the `org` search parameter
(falling back to the default, then the first) and refuses to show
another organization's spend when the requested one is denied, forwards
`startDate`/`endDate` from the URL as the reporting period, and reads
the report through a paginated query. `paginatedOrganizationAISpend`
keeps previous rows only across page changes, never across organizations
or filters, which needs `usePaginatedQuery` to accept a
`placeholderData` override.

## Why

Organization scoping, denied-organization handling, and cache isolation
across organizations belong with the first usable report. The
retention-aware period mapping and the dimension filters follow in the
next two PRs; until then the container passes `minDate` and
`filterMenus` as undefined, which the view already supports.

## What to scrutinize

- `placeholderData` in `api/queries/aiBridge.ts` compares the hashed
scope key (organization plus filter) of the previous query; `keeps the
loaded rows while paging but not across organizations` pins it.
- Changing organization or period clears `page`.

## Validation

`pnpm test src/pages/AISettingsPage/SpendPage/SpendPage.test.tsx`,
repository pre-commit.

## Delivery record

Published head `b732429b75b` passed per-layer integration checks and
commit hooks. The composed head `d899228f798` passed format, check, full
frontend lint, 125 unit tests, and 86 story tests. Pre-push hooks were
skipped as requested. See #28964 for audit findings, their disposition,
and historical UAT limits. No exact-head live UAT or new independent
re-review is claimed.

## Stack context

PR 6 of 9. The stack adds a **User spend** page under **Admin settings**
> **AI** > **User spend**: total and per-user AI Gateway spend for one
organization over a reporting period, read from `GET
/api/v2/organizations/{organization}/ai/spend/users` (#29129, merged).
It is #28964 split into one-concern PRs. Historical UAT covers earlier
heads only; live UAT has not been rerun after these review fixes. Bottom
to top: DateRangePicker limits, shared dimension badge, API client
method, spend table, page view, page container, reporting period,
dimension filters, route and navigation (#28964).

> Xum prepared this PR on behalf of @ibetitsmike.
 2026-09-22 13:11:37 +00:00
Michael Suchacz e101ceb4f5 feat(site/src/pages/AISettingsPage/SpendPage): compose the spend page view (#29629) 
Adds `SpendPageView`, the presentational page: paywall and not-enabled
states, the organizations loading, error, and empty states, a warning
when the requested organization is unavailable, and the filters row
(`SpendFilters`: organization picker hidden with a single organization,
optional provider, model, and client menus, and the date range picker or
a non-interactive **Current budget period** label when no explicit range
is applied).

## Why

Keeping the view stateless lets its stories cover every page-level state
without network mocks; the container PR above wires the data.

## What to scrutinize

- `SpendFilters` passes `MaxAISpendPeriodDays` and `minDate` to the
picker. This layer shows a skeleton while the report is loading; #29631
separates the initial retention-bound load from subsequent report loads
so the picker stays mounted. The container decides when `dateRange` is
undefined.
- `SpendPageView.stories.tsx` holds only page-level states; table states
moved to the table PR below.

## Validation

`pnpm test:storybook` on `SpendPageView.stories.tsx`, repository
pre-commit.

## Delivery record

Published head `c462e135906` passed per-layer integration checks and
commit hooks. The composed head `d899228f798` passed format, check, full
frontend lint, 125 unit tests, and 86 story tests. Pre-push hooks were
skipped as requested. See #28964 for audit findings, their disposition,
and historical UAT limits. No exact-head live UAT or new independent
re-review is claimed.

## Stack context

PR 5 of 9. The stack adds a **User spend** page under **Admin settings**
> **AI** > **User spend**: total and per-user AI Gateway spend for one
organization over a reporting period, read from `GET
/api/v2/organizations/{organization}/ai/spend/users` (#29129, merged).
It is #28964 split into one-concern PRs. Historical UAT covers earlier
heads only; live UAT has not been rerun after these review fixes. Bottom
to top: DateRangePicker limits, shared dimension badge, API client
method, spend table, page view, page container, reporting period,
dimension filters, route and navigation (#28964).

> Xum prepared this PR on behalf of @ibetitsmike.
 2026-09-22 13:02:57 +00:00
Michael Suchacz 6d22b8a186 feat(site/src): add the spend by user table (#29628) 
Adds `SpendUsersTable`: the period total, a paginated table of users
with the providers, models, and clients each spent through and their
cost, plus loading, empty, error, and refetch states. `SpendAmount`
renders a cost with a compact warning icon (tooltip on hover and focus)
when some usage had no price; `ModelsBadge` gives models the shared
dimension badge; `InfoTooltip` takes an `ariaLabel` so the two warning
icons have distinct names.

## Why

The table is the page's main content and the largest piece; it lands
with its own stories so the page PRs stay small.

## What to scrutinize

- `SpendUsersTable.stories.tsx` is new in this split: the table-state
stories that #28964 kept in `SpendPageView.stories.tsx` (loading, empty,
errors, refreshing, unpriced tooltips, badge lists) now render the table
directly. The view PR keeps only page-level states.
- Column widths use a container query (`@container`) because beside the
settings sidebar the table is far narrower than the viewport.

## Validation

`pnpm test:storybook` on `SpendUsersTable.stories.tsx`, repository
pre-commit.

## Delivery record

Published head `137809400e0` passed per-layer integration checks and
commit hooks. The composed head `d899228f798` passed format, check, full
frontend lint, 125 unit tests, and 86 story tests. Pre-push hooks were
skipped as requested. See #28964 for audit findings, their disposition,
and historical UAT limits. No exact-head live UAT or new independent
re-review is claimed.

## Stack context

PR 4 of 9. The stack adds a **User spend** page under **Admin settings**
> **AI** > **User spend**: total and per-user AI Gateway spend for one
organization over a reporting period, read from `GET
/api/v2/organizations/{organization}/ai/spend/users` (#29129, merged).
It is #28964 split into one-concern PRs. Historical UAT covers earlier
heads only; live UAT has not been rerun after these review fixes. Bottom
to top: DateRangePicker limits, shared dimension badge, API client
method, spend table, page view, page container, reporting period,
dimension filters, route and navigation (#28964).

> Xum prepared this PR on behalf of @ibetitsmike.
 2026-09-22 12:54:29 +00:00
Michael Suchacz 80eee58d1d feat: add the organization AI spend client method and report fixture (#29627) 
Adds `API.getOrganizationAISpendUsers(organizationId, params)` for `GET
/api/v2/organizations/{organization}/ai/spend/users` (period, provider,
model, client filters plus `limit`/`offset`), the
`MockOrganizationAISpendReport` fixture, and a shared
`codersdk.MaxAISpendPeriodDays` constant that the enterprise export
handler now reads and that `make gen` emits into `typesGenerated.ts`.

The model-list endpoint also accepts a literal `model` prefix. The
backend escapes SQL LIKE characters, while `q` keeps its existing search
syntax. Supplying both nonempty parameters returns 400. The filter menu
adopts this parameter in #29632.

## Why

The frontend caps custom ranges at the same 31-day limit the server
enforces; one SDK constant keeps the two from drifting. The fixture is
what every later test and story renders. Literal model identifiers
should not require search-language quoting or SQL escaping in the
frontend.

## What to scrutinize

- `enterprise/coderd/aibridge.go`: `maxAISpendExportPeriod` is now
derived from the SDK constant, same value as before.
- `MockOrganizationAISpendUser` is not exported yet; the table PR
exports it for its stories (knip fails on exports without a consumer).

## Generated files

`site/src/api/typesGenerated.ts`, `coderd/apidoc/docs.go`,
`coderd/apidoc/swagger.json`, and `docs/reference/api/aigateway.md` via
`make gen`.

## Validation

`pnpm test src/api/api.test.ts -t getOrganizationAISpendUsers` (new
case), `go test ./enterprise/coderd/ -run TestAIBridgeListModels
-count=1 -v`, repository pre-commit including `make gen` with no drift.
Model tests cover literal punctuation, prefix matching, existing `q`
behavior, and conflicting parameters.

## Delivery record

Published head `8d9a4faa0aa` passed per-layer integration checks and
commit hooks. The composed head `d899228f798` passed format, check, full
frontend lint, 125 unit tests, and 86 story tests. Pre-push hooks were
skipped as requested. See #28964 for audit findings, their disposition,
and historical UAT limits. No exact-head live UAT or new independent
re-review is claimed.

## Stack context

PR 3 of 9. The stack adds a **User spend** page under **Admin settings**
> **AI** > **User spend**: total and per-user AI Gateway spend for one
organization over a reporting period, read from `GET
/api/v2/organizations/{organization}/ai/spend/users` (#29129, merged).
It is #28964 split into one-concern PRs. Historical UAT covers earlier
heads only; live UAT has not been rerun after these review fixes. Bottom
to top: DateRangePicker limits, shared dimension badge, API client
method, spend table, page view, page container, reporting period,
dimension filters, route and navigation (#28964).

> Xum prepared this PR on behalf of @ibetitsmike.
 2026-09-22 12:45:18 +00:00
Danielle Maywood f7b93d341b fix(site): use a template literal in the OAuth2 app name fixture (#29729) 2026-09-22 12:30:05 +00:00
Michael Suchacz f204307971 refactor(site/src/pages/AIBridgePage): share one dimension badge across providers and clients (#29626) 
Moves the provider and client badges out of `ListSessionsRow` into
`ProvidersBadge` and `ClientsBadge`, thin wrappers over one
`ItemsBadge`: one item renders a labeled badge with its icon, several
collapse into a count badge whose tooltip lists them.

## Why

The spend table higher in this stack shows the providers, models, and
clients each user spent through and must render them exactly like the
sessions list. Extracting the badge first keeps that PR to the table.
`ModelsBadge` arrives with the table, its first consumer.

## What to scrutinize

- The count badge is now a real `button` (keyboard reachable, tooltip on
focus) that stops click propagation so opening the list does not also
open the clickable session row; `ListSessionsRow.test.tsx` pins that.
- The single-item badge gains a `title` so a truncated label is still
readable.

## Validation

`pnpm test
src/pages/AIBridgePage/ListSessionsPage/ListSessionsRow.test.tsx` (new),
Storybook `ListSessionsRow` stories (count-badge tooltip added),
repository pre-commit.

## Delivery record

Published head `1f2b0af070f` passed per-layer integration checks and
commit hooks. The composed head `d899228f798` passed format, check, full
frontend lint, 125 unit tests, and 86 story tests. Pre-push hooks were
skipped as requested. See #28964 for audit findings, their disposition,
and historical UAT limits. No exact-head live UAT or new independent
re-review is claimed.

## Stack context

PR 2 of 9. The stack adds a **User spend** page under **Admin settings**
> **AI** > **User spend**: total and per-user AI Gateway spend for one
organization over a reporting period, read from `GET
/api/v2/organizations/{organization}/ai/spend/users` (#29129, merged).
It is #28964 split into one-concern PRs. Historical UAT covers earlier
heads only; live UAT has not been rerun after these review fixes. Bottom
to top: DateRangePicker limits, shared dimension badge, API client
method, spend table, page view, page container, reporting period,
dimension filters, route and navigation (#28964).

> Xum prepared this PR on behalf of @ibetitsmike.
 2026-09-22 12:28:05 +00:00
Michael Suchacz 4c84dca4f6 feat(site/src/components/DateRangePicker): add maxDays and minDate props (#29625) 
Adds `maxDays` and `minDate` to `DateRangePicker`, and labels the
trigger with the committed inclusive days rather than the exclusive API
boundary.

## Why

The spend page higher in this stack must cap a custom range at the
endpoint's 31-day limit and hide days and presets that start before the
retention cutoff the report echoes. The page shows a skeleton until the
first retention bound arrives, then keeps the picker mounted during
report reloads. The picker does not need a disabled prop. `toBoundary`
stays private here; the reporting-period PR exports it when the page
first needs it.

## What to scrutinize

- `selectableDaysFrom`: when the maximal range of `maxDays` local days
crosses a fall daylight-saving shift, the committed interval runs long
by the shift, so the calendar allows one day less from that start
instead of trimming the committed range.
- `excludeDisabled` restarts a calendar selection if its previously
committed start has fallen behind `minDate`.
- The trigger label now shows `fromBoundary(value)`, so a midnight
exclusive end displays the previous day. `TemplateInsightsPage` is the
other caller and is affected by that label change.

## Validation

`pnpm test src/components/DateRangePicker/DateRangePicker.test.tsx`
(new: maxDays restart, DST shave, minDate), `pnpm test:storybook` on
`DateRangePicker.stories.tsx` (new `ClosedExclusiveEnd` and
`RetentionLimited`), repository pre-commit (biome, tsc, knip).

## Delivery record

Published head `d1fc9334360` passed per-layer integration checks and
commit hooks. The composed head `d899228f798` passed format, check, full
frontend lint, 125 unit tests, and 86 story tests. Pre-push hooks were
skipped as requested. See #28964 for audit findings, their disposition,
and historical UAT limits. No exact-head live UAT or new independent
re-review is claimed.

## Stack context

PR 1 of 9. The stack adds a **User spend** page under **Admin settings**
> **AI** > **User spend**: total and per-user AI Gateway spend for one
organization over a reporting period, read from `GET
/api/v2/organizations/{organization}/ai/spend/users` (#29129, merged).
It is #28964 split into one-concern PRs. Historical UAT covers earlier
heads only; live UAT has not been rerun after these review fixes. Bottom
to top: DateRangePicker limits, shared dimension badge, API client
method, spend table, page view, page container, reporting period,
dimension filters, route and navigation (#28964).

> Xum prepared this PR on behalf of @ibetitsmike.
 2026-09-22 12:15:20 +00:00
dependabot[bot] 956eafbb75 chore: bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.70.0 to 0.71.0 (#28835) 
Bumps
[go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp](https://github.com/open-telemetry/opentelemetry-go-contrib)
from 0.70.0 to 0.71.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md">go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp's
changelog</a>.</em></p>
<blockquote>
<h2>[1.46.0/2.5.3/0.71.0/0.37.3/0.26.0/0.20.1/0.16.3/0.18.0] -
2026-08-25</h2>
<p>This release is the last to support [Go 1.25].
The next release will require at least [Go 1.26].</p>
<h3>Added</h3>
<ul>
<li>Add support for the <code>aws.ec2</code> resource detector in
<code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9139">#9139</a>)</li>
<li>Support testing of [Go 1.27]. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9524">#9524</a>)</li>
<li>Add <code>go.opentelemetry.io/contrib/detectors/docker</code>, a
resource detector for Docker, ported from
<code>processor/resourcedetectionprocessor/internal/docker</code> in
opentelemetry-collector-contrib. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9001">#9001</a>)</li>
<li>Add <code>S3AttributeBuilder</code> to
<code>go.opentelemetry.io/contrib/instrumentation/github.com/aws/aws-sdk-go-v2/otelaws</code>
that sets S3-specific span attributes following the OpenTelemetry S3
semantic conventions. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9292">#9292</a>)</li>
</ul>
<h3>Deprecated</h3>
<ul>
<li>Deprecate
<code>go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho</code>.
Use <code>github.com/labstack/echo-opentelemetry</code> instead. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9136">#9136</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Record <code>error.type</code> attribute on server spans in
<code>go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful</code>
when a request is cancelled or ends in a 5xx error. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9387">#9387</a>)</li>
<li>Report <code>ot-baggage-*</code> extraction errors from
<code>go.opentelemetry.io/contrib/propagators/ot</code> to
<code>otel.Handle</code> instead of silently discarding them, while
still attaching the successfully parsed baggage members to the context.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9395">#9395</a>)</li>
<li>Set <code>error.type</code> on the
<code>rpc.client.call.duration</code> and
<code>rpc.server.call.duration</code> metrics in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>
when the RPC fails with a non-OK status, per the RPC semantic
conventions. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9429">#9429</a>)</li>
<li>Reject OTLP exporter headers with an empty <code>name</code> in
<code>go.opentelemetry.io/contrib/otelconf</code>,
<code>go.opentelemetry.io/contrib/otelconf/x</code>, and
<code>go.opentelemetry.io/contrib/otelconf/v0.3.0</code>, instead of
forwarding invalid header names to OTLP exporters. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9102">#9102</a>)</li>
<li><code>go.opentelemetry.io/contrib/detectors/aws/lambda</code> no
longer returns an error when run outside of an AWS Lambda environment,
matching the no-op behavior of other resource detectors. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9464">#9464</a>)</li>
<li>Convert Prometheus untyped metrics to OTLP Gauges in
<code>go.opentelemetry.io/contrib/bridges/prometheus</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9099">#9099</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/c4c6248ec2289133b6a51f554ca9367ece1de8e7"><code>c4c6248</code></a>
Release v1.46.0/v2.5.3/v0.71.0/v0.37.3/v0.26.0/v0.20.1/v0.16.3/v0.18.0
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9563">#9563</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/11c8a13e60e734bb02185e78b1ad16c38c3e4d6d"><code>11c8a13</code></a>
fix(deps): update aws-sdk-go-v2 monorepo</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/0458b9df1d1ea87bb7d156d3065a4626506daa22"><code>0458b9d</code></a>
chore(deps): update module
go.opentelemetry.io/contrib/instrumentation/net/ht...</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/638a0d5944d4f80d6d8d9dc17df30cf9f73a1e4c"><code>638a0d5</code></a>
fix(deps): update module github.com/moby/moby/api to v1.55.0</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/5089aa5de995dcdc7bd96d7e8b36ce4be1ec3cbf"><code>5089aa5</code></a>
chore(deps): update googleapis to da73d73</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/a50857b305dfa06fe469ff7bad5f22db0ecde3bb"><code>a50857b</code></a>
chore(deps): update jaegertracing/jaeger docker tag to v2.20.0</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/aa4f4a577cec952b0444a0faeb98be04b13023a2"><code>aa4f4a5</code></a>
chore(deps): update open-telemetry/shared-workflows action to
v0.11.0</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/ccbbc14b559c3878fa017d1036ae8feb636ec4a5"><code>ccbbc14</code></a>
fix(deps): update module github.com/aws/smithy-go to v1.28.0</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/9312464aaff2f556a115ab7a416566dc00c830f4"><code>9312464</code></a>
chore(deps): update module github.com/docker/go-connections to
v0.8.1</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/36c3b006602a1e74f95eac0db1cefb5c423e1b4d"><code>36c3b00</code></a>
chore(deps): update module github.com/felixge/httpsnoop to v1.1.0</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.70.0...zpages/v0.71.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp&package-manager=go_modules&previous-version=0.70.0&new-version=0.71.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-22 12:02:56 +00:00
dependabot[bot] 8f89e24142 chore: bump github.com/nats-io/nats.go from 1.53.1 to 1.54.0 (#29712) 
Bumps [github.com/nats-io/nats.go](https://github.com/nats-io/nats.go)
from 1.53.1 to 1.54.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/nats-io/nats.go/releases">github.com/nats-io/nats.go's
releases</a>.</em></p>
<blockquote>
<h2>Release v1.54.0</h2>
<h2>Changelog</h2>
<p>This release raises the minimum supported Go version to 1.26 and adds
support for nats-server v2.15 stream and consumer info fields.</p>
<h3>ADDED</h3>
<ul>
<li>Core NATS:
<ul>
<li><code>nats.MultipathTCP()</code> option to enable or disable MPTCP
for outbound connections (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2145">#2145</a>)</li>
<li><code>Conn.ConnectedDomain()</code> to read the JetStream domain
advertised by the connected server (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2139">#2139</a>)</li>
</ul>
</li>
<li>JetStream:
<ul>
<li><code>ClusterInfo.Desired</code>, <code>PeerInfo.Peer</code>,
<code>PeerInfo.Pending</code> and <code>StreamSourceInfo.Seq</code> in
stream and consumer info, reported by nats-server v2.15 (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2144">#2144</a>)</li>
<li><code>Nats-Schedule-Rollup</code> header const and
<code>WithScheduleRollup()</code> publish option (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2142">#2142</a>)</li>
</ul>
</li>
</ul>
<h3>FIXED</h3>
<ul>
<li>Core NATS:
<ul>
<li>Panic in <code>DecodeHeadersMsg</code> on inline status tokens
shorter than 3 characters. Thanks <a
href="https://github.com/nikitha-m"><code>@​nikitha-m</code></a> for the
contribution (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2101">#2101</a>)</li>
<li>Data race on <code>Subscription.sid</code> between
<code>applyNewSID</code> and <code>removeSub</code> (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2122">#2122</a>)</li>
</ul>
</li>
<li>JetStream:
<ul>
<li><code>Messages()</code> iterator going silent after a reconnect that
completes between <code>Next()</code> calls. Thanks <a
href="https://github.com/1995parham"><code>@​1995parham</code></a> for
the contribution (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2135">#2135</a>)</li>
<li>Legacy ordered consumer silently losing messages when the
subscription hits its pending limits (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2137">#2137</a>)</li>
<li>Legacy ordered consumer reset resurrecting an unsubscribed or
draining subscription (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2133">#2133</a>)</li>
</ul>
</li>
</ul>
<h3>IMPROVED</h3>
<ul>
<li>Core NATS:
<ul>
<li>Avoid allocation when parsing header message arguments with a fifth
token. Thanks <a
href="https://github.com/0xAozora"><code>@​0xAozora</code></a> for the
contribution (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2130">#2130</a>)</li>
<li>Preallocate reply subject buffers. Thanks <a
href="https://github.com/0xAozora"><code>@​0xAozora</code></a> for the
contribution (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2123">#2123</a>)</li>
</ul>
</li>
<li>JetStream:
<ul>
<li>Prevent <code>doErr</code> closure escaping to the heap in async
publish reply handling. Thanks <a
href="https://github.com/0xAozora"><code>@​0xAozora</code></a> for the
contribution (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2127">#2127</a>)</li>
<li>Fix typo in <code>Publisher</code> interface methods comment. Thanks
<a href="https://github.com/sreeram77"><code>@​sreeram77</code></a> for
the contribution (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2120">#2120</a>)</li>
</ul>
</li>
<li>Minimum Go version is now 1.26 (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2146">#2146</a>)</li>
<li>Bump <code>klauspost/compress</code> to v1.20.0 and
<code>nkeys</code> to v0.4.16 (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2117">#2117</a>,
<a
href="https://redirect.github.com/nats-io/nats.go/issues/2146">#2146</a>)</li>
<li>Tests run locally without docker via an in-process ntf tester (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2131">#2131</a>),
and CI now runs against nats-server v2.15.0 (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2146">#2146</a>)</li>
<li>Fix flaky cluster restart tests (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2141">#2141</a>)
and list consumers test against latest server (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2138">#2138</a>)</li>
</ul>
<h3>Complete Changes</h3>
<p><a
href="https://github.com/nats-io/nats.go/compare/v1.53.1...v1.54.0">https://github.com/nats-io/nats.go/compare/v1.53.1...v1.54.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/nats-io/nats.go/commit/7a8404ab9b1721cf1eddf3a26474e6925c322d73"><code>7a8404a</code></a>
Release v1.54.0 (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2148">#2148</a>)</li>
<li><a
href="https://github.com/nats-io/nats.go/commit/240fb1f70e767827b452d6a84c7fd91154087abc"><code>240fb1f</code></a>
[IMPROVED] Bump dependencies and update server version in CI (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2146">#2146</a>)</li>
<li><a
href="https://github.com/nats-io/nats.go/commit/203d828938c8fca0c4fb237827bfe5442c70b955"><code>203d828</code></a>
[FIXED] Panic in DecodeHeadersMsg on status tokens shorter than 3
characters ...</li>
<li><a
href="https://github.com/nats-io/nats.go/commit/dc92fca74760375f8b39af7d876f20db822e115f"><code>dc92fca</code></a>
[FIXED] Ordered consumer silently losing messages on slow consumer (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2137">#2137</a>)</li>
<li><a
href="https://github.com/nats-io/nats.go/commit/e18cea8856fac7a4edf0771e0ec21a449400d266"><code>e18cea8</code></a>
[IMPROVED] Prevent doErr closure escaping to heap (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2127">#2127</a>)</li>
<li><a
href="https://github.com/nats-io/nats.go/commit/d8d8c09b40bc5aec7220cee84a83f4bcab1e6dd0"><code>d8d8c09</code></a>
[ADDED] <code>nats.MultipathTCP()</code> for enabling or disabling MPTCP
(<a
href="https://redirect.github.com/nats-io/nats.go/issues/2145">#2145</a>)</li>
<li><a
href="https://github.com/nats-io/nats.go/commit/e95c424b2c8d91fe16fd3426b80c88f13261761a"><code>e95c424</code></a>
[FIXED] Flaky cluster restart tests: waitForStream must see a stream
leader (...</li>
<li><a
href="https://github.com/nats-io/nats.go/commit/e3abbf43eccdb37ef7c4bd2d777d57bc44e09955"><code>e3abbf4</code></a>
[ADDED] Nats-Schedule-Rollup header const and publish options (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2142">#2142</a>)</li>
<li><a
href="https://github.com/nats-io/nats.go/commit/f1289db0bb7a5a560b26ddc7c8f29665b6341c90"><code>f1289db</code></a>
[ADDED] Desired state, peer ID/pending and source seq in stream and
consumer ...</li>
<li><a
href="https://github.com/nats-io/nats.go/commit/b84f783a7b99e1c54e5a5ebc83936a3a72dc2fd8"><code>b84f783</code></a>
Ignore Claude Code local files and .worktrees (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2140">#2140</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/nats-io/nats.go/compare/v1.53.1...v1.54.0">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-22 11:58:58 +00:00
dependabot[bot] b132f709a8 chore: bump github.com/hashicorp/hcl/v2 from 2.24.0 to 2.25.0 (#29711) 
Bumps [github.com/hashicorp/hcl/v2](https://github.com/hashicorp/hcl)
from 2.24.0 to 2.25.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/hashicorp/hcl/releases">github.com/hashicorp/hcl/v2's
releases</a>.</em></p>
<blockquote>
<h2>v2.25.0</h2>
<h2>Enhancements</h2>
<ul>
<li>Go: Upgrade compatibility from 1.24 to 1.25 (<a
href="https://redirect.github.com/hashicorp/hcl/pull/798">#798</a>)</li>
<li>hclwrite: Export
<code>LeadComments()</code>/<code>LineComments()</code> (<a
href="https://redirect.github.com/hashicorp/hcl/pull/807">#807</a>)</li>
<li>hclwrite: <code>body.SetAttribute*</code> return new attribute (<a
href="https://redirect.github.com/hashicorp/hcl/pull/806">#806</a>)</li>
<li>hclwrite: <code>Block.SetType</code> sets type (<a
href="https://redirect.github.com/hashicorp/hcl/pull/808">#808</a>)</li>
<li>Prepare for Unicode 17 support in Go 1.27 (<a
href="https://redirect.github.com/hashicorp/hcl/pull/814">#814</a>)</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li><code>DiagnosticWriter</code>: Skip marked values when writing
diagnostics (<a
href="https://redirect.github.com/hashicorp/hcl/pull/739">#739</a>)</li>
<li>hclsyntax: Set <code>CloseBraceRange</code> to last label in
error-recovered blocks (<a
href="https://redirect.github.com/hashicorp/hcl/pull/786">#786</a>)</li>
<li>hclsyntax: Add partially complete items in nested
<code>ObjectConsItem</code> on error (<a
href="https://redirect.github.com/hashicorp/hcl/pull/785">#785</a>)</li>
</ul>
<h2>Internal</h2>
<ul>
<li>deps: bump golang.org/x/crypto from 0.38.0 to 0.45.0 (<a
href="https://redirect.github.com/hashicorp/hcl/pull/774">#774</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/hashicorp/hcl/blob/main/CHANGELOG.md">github.com/hashicorp/hcl/v2's
changelog</a>.</em></p>
<blockquote>
<h1>HCL Changelog</h1>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/hashicorp/hcl/commit/00057cf06d7b38a3f89e6e54d622eee98322b314"><code>00057cf</code></a>
Prepare for Unicode 17 support in Go 1.27 (<a
href="https://redirect.github.com/hashicorp/hcl/issues/814">#814</a>)</li>
<li><a
href="https://github.com/hashicorp/hcl/commit/7338a7d5fb8dbf1fd7ec6fdcd66fea202916bb38"><code>7338a7d</code></a>
github: Add consistency test for generated code (<a
href="https://redirect.github.com/hashicorp/hcl/issues/834">#834</a>)</li>
<li><a
href="https://github.com/hashicorp/hcl/commit/2f8831b8351c51cd74365975bbb1d2c28f91de7b"><code>2f8831b</code></a>
github: Filter out Ragel files from coverage report (<a
href="https://redirect.github.com/hashicorp/hcl/issues/833">#833</a>)</li>
<li><a
href="https://github.com/hashicorp/hcl/commit/d9882d1b450069e3a0eaeefd74fe47e9c0a8d660"><code>d9882d1</code></a>
hclsyntax: Update copyright year in generated files (<a
href="https://redirect.github.com/hashicorp/hcl/issues/832">#832</a>)</li>
<li><a
href="https://github.com/hashicorp/hcl/commit/60329236815b0d902d0be274a4441e58a5341ea0"><code>6032923</code></a>
hclsyntax: Re-run stringer to update generated comments (<a
href="https://redirect.github.com/hashicorp/hcl/issues/831">#831</a>)</li>
<li><a
href="https://github.com/hashicorp/hcl/commit/6abbb088cdb82416d1b3d9fcbaab29534133567a"><code>6abbb08</code></a>
Merge pull request <a
href="https://redirect.github.com/hashicorp/hcl/issues/827">#827</a>
from hashicorp/james-warren0/security-doc-tweaks</li>
<li><a
href="https://github.com/hashicorp/hcl/commit/425fdf944aa10f277d353c49f5eb7a73200c711e"><code>425fdf9</code></a>
Implement feedback provided in <a
href="https://redirect.github.com/hashicorp/hcl/pull/826">hashicorp/hcl#826</a></li>
<li><a
href="https://github.com/hashicorp/hcl/commit/2a3b67226841b8c4c2132068c8fb74947fe2e0b3"><code>2a3b672</code></a>
Merge pull request <a
href="https://redirect.github.com/hashicorp/hcl/issues/826">#826</a>
from hashicorp/james-warren0/security-model</li>
<li><a
href="https://github.com/hashicorp/hcl/commit/42ccbc0e16b343d3768544e0db9450e0b8e6cb96"><code>42ccbc0</code></a>
Add security model documentation</li>
<li><a
href="https://github.com/hashicorp/hcl/commit/6bf1a67a9381988ec9d660b405a83dfc8b5fcf2a"><code>6bf1a67</code></a>
Merge pull request <a
href="https://redirect.github.com/hashicorp/hcl/issues/808">#808</a>
from hashicorp/bbasata/set-type</li>
<li>Additional commits viewable in <a
href="https://github.com/hashicorp/hcl/compare/v2.24.0...v2.25.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/hashicorp/hcl/v2&package-manager=go_modules&previous-version=2.24.0&new-version=2.25.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-22 11:55:39 +00:00
dependabot[bot] 43d63b1091 ci: bump the github-actions group with 3 updates (#29717) 
Bumps the github-actions group with 3 updates:
[aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials),
[docker/setup-buildx-action](https://github.com/docker/setup-buildx-action)
and
[linear/linear-release-action](https://github.com/linear/linear-release-action).

Updates `aws-actions/configure-aws-credentials` from 6.2.4 to 6.3.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/aws-actions/configure-aws-credentials/releases">aws-actions/configure-aws-credentials's
releases</a>.</em></p>
<blockquote>
<h2>v6.3.0</h2>
<h2><a
href="https://github.com/aws-actions/configure-aws-credentials/compare/v6.2.4...v6.3.0">6.3.0</a>
(2026-09-11)</h2>
<h3>Features</h3>
<ul>
<li>add translate-env-variables option (<a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1961">#1961</a>)
(<a
href="https://github.com/aws-actions/configure-aws-credentials/commit/57b83659c2db2eb3b9c655186bef9a6a8f6620cb">57b8365</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md">aws-actions/configure-aws-credentials's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<p>All notable changes to this project will be documented in this file.
See <a
href="https://github.com/conventional-changelog/standard-version">standard-version</a>
for commit guidelines.</p>
<h2><a
href="https://github.com/aws-actions/configure-aws-credentials/compare/v6.2.4...v6.3.0">6.3.0</a>
(2026-09-11)</h2>
<h3>Features</h3>
<ul>
<li>add translate-env-variables option (<a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1961">#1961</a>)
(<a
href="https://github.com/aws-actions/configure-aws-credentials/commit/57b83659c2db2eb3b9c655186bef9a6a8f6620cb">57b8365</a>)</li>
</ul>
<h2><a
href="https://github.com/aws-actions/configure-aws-credentials/compare/v6.2.3...v6.2.4">6.2.4</a>
(2026-08-31)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>account-ids handling, mask proxy as secret in logs (<a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1943">#1943</a>)
(<a
href="https://github.com/aws-actions/configure-aws-credentials/commit/aa6526434b08748f8776b29964e3f1f5d90e7b63">aa65264</a>)</li>
<li>skip backoff sleep after the final retryAndBackoff attempt (<a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1937">#1937</a>)
(<a
href="https://github.com/aws-actions/configure-aws-credentials/commit/3852440c21363386b7b790605685d08a7c1a4876">3852440</a>)</li>
</ul>
<h2><a
href="https://github.com/aws-actions/configure-aws-credentials/compare/v6.2.2...v6.2.3">6.2.3</a>
(2026-07-22)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>attach git credentials before Tag Major Version push (<a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1877">#1877</a>)
(<a
href="https://github.com/aws-actions/configure-aws-credentials/commit/9ae780b171afa8c5a3a6a2d154a765b709492482">9ae780b</a>)</li>
<li>PackedPolicyTooLarge detection in STS tags (<a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1899">#1899</a>)
(<a
href="https://github.com/aws-actions/configure-aws-credentials/commit/fa8d6a57bbf44b34439fb080bbdadc7c92c285eb">fa8d6a5</a>)</li>
</ul>
<h2><a
href="https://github.com/aws-actions/configure-aws-credentials/compare/v6.2.1...v6.2.2">6.2.2</a>
(2026-07-07)</h2>
<h3>Miscellaneous Chores</h3>
<ul>
<li>release 6.2.2 (<a
href="https://github.com/aws-actions/configure-aws-credentials/commit/d01d678e65d6d2bd9d5ca7a95d6f07b00e25f2c2">d01d678</a>)</li>
</ul>
<h2><a
href="https://github.com/aws-actions/configure-aws-credentials/compare/v6.2.0...v6.2.1">6.2.1</a>
(2026-06-26)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>enforce allowed-account-ids on all auth paths (<a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1847">#1847</a>)
(<a
href="https://github.com/aws-actions/configure-aws-credentials/commit/4d281fbc56a82e63c3fc14f2cc22361f34c97493">4d281fb</a>)</li>
</ul>
<h2><a
href="https://github.com/aws-actions/configure-aws-credentials/compare/v6.1.3...v6.2.0">6.2.0</a>
(2026-06-01)</h2>
<h3>Features</h3>
<ul>
<li>add additional session tags by default (<a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1775">#1775</a>)
(<a
href="https://github.com/aws-actions/configure-aws-credentials/commit/e0ba7685077379a14a82d01fefd511490344ebfc">e0ba768</a>)</li>
<li>add more retry logic and better logging (<a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1764">#1764</a>)
(<a
href="https://github.com/aws-actions/configure-aws-credentials/commit/540d0c13aedb8d55501d220bd2f0b3cdedfe84e8">540d0c1</a>)</li>
<li>add regex validation to role-session-name (<a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1765">#1765</a>)
(<a
href="https://github.com/aws-actions/configure-aws-credentials/commit/e35449909c6ede5083a48ba4b8bbfaaa1cf09ba1">e354499</a>)</li>
<li>Allow custom session tags to be passed when assuming a role (<a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1759">#1759</a>)
(<a
href="https://github.com/aws-actions/configure-aws-credentials/commit/61f50f630f383628add73c1eab3f1935ba07da2b">61f50f6</a>)</li>
<li>expose run id in STS client user-agent (<a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1774">#1774</a>)
(<a
href="https://github.com/aws-actions/configure-aws-credentials/commit/29d1be30273e7ef371d59fccf6ec54572c64ec89">29d1be3</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/aws-actions/configure-aws-credentials/commit/e1253824e5c10ff9df46874f81ed3ec929e19cfd"><code>e125382</code></a>
chore(main): release 6.3.0 (<a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1963">#1963</a>)</li>
<li><a
href="https://github.com/aws-actions/configure-aws-credentials/commit/438100a0eb37d9180319c727b1e108d9a112a27a"><code>438100a</code></a>
chore: add link to GH security docs (<a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1962">#1962</a>)</li>
<li><a
href="https://github.com/aws-actions/configure-aws-credentials/commit/e92ebccf3986be80a7535da17f1ed57aec450139"><code>e92ebcc</code></a>
chore: Update dist</li>
<li><a
href="https://github.com/aws-actions/configure-aws-credentials/commit/57b83659c2db2eb3b9c655186bef9a6a8f6620cb"><code>57b8365</code></a>
feat: add translate-env-variables option (<a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1961">#1961</a>)</li>
<li><a
href="https://github.com/aws-actions/configure-aws-credentials/commit/cc49fa741eb53f7c83be6fce8f9b4df000cd3af7"><code>cc49fa7</code></a>
chore(docs): README main branch guidance (<a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1960">#1960</a>)</li>
<li><a
href="https://github.com/aws-actions/configure-aws-credentials/commit/866cb167f1d1a75ae9c75cdb39377cfd9c0f794e"><code>866cb16</code></a>
chore(deps-dev): bump smol-toml from 1.7.0 to 1.7.2 (<a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1958">#1958</a>)</li>
<li><a
href="https://github.com/aws-actions/configure-aws-credentials/commit/6782cb1b6df5d32e9354c1e6d6da4f956c0d61c4"><code>6782cb1</code></a>
chore(deps-dev): bump generate-license-file from 4.2.4 to 4.2.5 (<a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1951">#1951</a>)</li>
<li><a
href="https://github.com/aws-actions/configure-aws-credentials/commit/c20509ac5cba30e782e34cf33a0067e67c746cf0"><code>c20509a</code></a>
chore: Update dist</li>
<li><a
href="https://github.com/aws-actions/configure-aws-credentials/commit/7a41fc6cd2b4970e71974e29fb3f0979f4eb20cb"><code>7a41fc6</code></a>
chore(deps): bump <code>@​aws-sdk/client-sts</code> from 3.1121.0 to
3.1127.0 (<a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1954">#1954</a>)</li>
<li><a
href="https://github.com/aws-actions/configure-aws-credentials/commit/726b71346f7761addb59879a6c73e0c64ec8f959"><code>726b713</code></a>
chore(deps-dev): bump <code>@​biomejs/biome</code> from 2.5.11 to 2.5.12
(<a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1957">#1957</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/aws-actions/configure-aws-credentials/compare/cbe3b392738ccf3f987d68400dafcf4b0624a56c...e1253824e5c10ff9df46874f81ed3ec929e19cfd">compare
view</a></li>
</ul>
</details>
<br />

Updates `docker/setup-buildx-action` from 4.3.0 to 4.4.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/docker/setup-buildx-action/releases">docker/setup-buildx-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.4.0</h2>
<ul>
<li>Use official Buildx releases for cloud driver by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/setup-buildx-action/pull/606">docker/setup-buildx-action#606</a></li>
<li>Pull BuildKit image before builder creation by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/setup-buildx-action/pull/609">docker/setup-buildx-action#609</a></li>
<li>Use shared error helpers for Buildx and Docker commands by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/setup-buildx-action/pull/620">docker/setup-buildx-action#620</a></li>
<li>Bump <code>@​docker/actions-toolkit</code> from 0.95.0 to 0.100.0 in
<a
href="https://redirect.github.com/docker/setup-buildx-action/pull/610">docker/setup-buildx-action#610</a>
<a
href="https://redirect.github.com/docker/setup-buildx-action/pull/618">docker/setup-buildx-action#618</a>
<a
href="https://redirect.github.com/docker/setup-buildx-action/pull/619">docker/setup-buildx-action#619</a></li>
<li>Bump <code>@​humanfs/node</code> from 0.16.7 to 0.16.8 in <a
href="https://redirect.github.com/docker/setup-buildx-action/pull/614">docker/setup-buildx-action#614</a></li>
<li>Bump js-yaml from 5.3.0 to 5.4.2 in <a
href="https://redirect.github.com/docker/setup-buildx-action/pull/608">docker/setup-buildx-action#608</a>
<a
href="https://redirect.github.com/docker/setup-buildx-action/pull/617">docker/setup-buildx-action#617</a></li>
<li>Bump postcss-selector-parser from 7.1.1 to 7.1.5 in <a
href="https://redirect.github.com/docker/setup-buildx-action/pull/611">docker/setup-buildx-action#611</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/setup-buildx-action/compare/v4.3.0...v4.4.0">https://github.com/docker/setup-buildx-action/compare/v4.3.0...v4.4.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/docker/setup-buildx-action/commit/594f3bf4285d9ea8dc53c9a0c9c4092420091003"><code>594f3bf</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/setup-buildx-action/issues/609">#609</a>
from crazy-max/pull-buildkit-image-before-create</li>
<li><a
href="https://github.com/docker/setup-buildx-action/commit/bd6e702fc33b636671900d5b5edfab64698c9c25"><code>bd6e702</code></a>
chore: update generated content</li>
<li><a
href="https://github.com/docker/setup-buildx-action/commit/6268c9da9abbd1309c8a16a75f92a878715c3032"><code>6268c9d</code></a>
pull BuildKit image before builder creation</li>
<li><a
href="https://github.com/docker/setup-buildx-action/commit/e8235251b82e23c90e6fad50016f0a78b7f28f11"><code>e823525</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/setup-buildx-action/issues/621">#621</a>
from docker/dependabot/github_actions/codeql-actions-...</li>
<li><a
href="https://github.com/docker/setup-buildx-action/commit/533ed8ed095b0b133ef16fb495aad119524e220d"><code>533ed8e</code></a>
build(deps): bump the codeql-actions group with 2 updates</li>
<li><a
href="https://github.com/docker/setup-buildx-action/commit/bedaf135699075c88620cd30772b9b6eadc9ba99"><code>bedaf13</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/setup-buildx-action/issues/620">#620</a>
from crazy-max/shared-error-helpers</li>
<li><a
href="https://github.com/docker/setup-buildx-action/commit/d5079fba84d5edd23d25ba7f3045122175ca6ee2"><code>d5079fb</code></a>
chore: update generated content</li>
<li><a
href="https://github.com/docker/setup-buildx-action/commit/226a61612ab71c26bbd805f955834049a4a9772f"><code>226a616</code></a>
use shared error helpers for Buildx and Docker commands</li>
<li><a
href="https://github.com/docker/setup-buildx-action/commit/77ce7f4bab9bc462d825001cde7f82d409ee474c"><code>77ce7f4</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/setup-buildx-action/issues/619">#619</a>
from docker/dependabot/npm_and_yarn/docker/actions-to...</li>
<li><a
href="https://github.com/docker/setup-buildx-action/commit/0dc1dc94f0f7c064e93fda72884ca71e054c0354"><code>0dc1dc9</code></a>
[dependabot skip] chore: update generated content</li>
<li>Additional commits viewable in <a
href="https://github.com/docker/setup-buildx-action/compare/37fe631027851001ddb9b187196cc803df7f5f0e...594f3bf4285d9ea8dc53c9a0c9c4092420091003">compare
view</a></li>
</ul>
</details>
<br />

Updates `linear/linear-release-action` from 0.17.2 to 0.18.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/linear/linear-release-action/releases">linear/linear-release-action's
releases</a>.</em></p>
<blockquote>
<h2>v0.18.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Add no_branch_ref_detection action input by <a
href="https://github.com/axelniklasson"><code>@​axelniklasson</code></a>
in <a
href="https://redirect.github.com/linear/linear-release-action/pull/68">linear/linear-release-action#68</a></li>
<li>Release v0.18.0 by <a
href="https://github.com/axelniklasson"><code>@​axelniklasson</code></a>
in <a
href="https://redirect.github.com/linear/linear-release-action/pull/69">linear/linear-release-action#69</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/linear/linear-release-action/compare/v0.17.2...v0.18.0">https://github.com/linear/linear-release-action/compare/v0.17.2...v0.18.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/linear/linear-release-action/commit/d4af10092984f9bc6d5efa075b242bdf01333463"><code>d4af100</code></a>
Release v0.18.0 (<a
href="https://redirect.github.com/linear/linear-release-action/issues/69">#69</a>)</li>
<li><a
href="https://github.com/linear/linear-release-action/commit/b0926c73eb90042bc522f79007b785ad1ceae1ae"><code>b0926c7</code></a>
Add branch ref detection opt-out input (<a
href="https://redirect.github.com/linear/linear-release-action/issues/68">#68</a>)</li>
<li>See full diff in <a
href="https://github.com/linear/linear-release-action/compare/53ad0f863963e7f8e270fba18426bbb55ef55384...d4af10092984f9bc6d5efa075b242bdf01333463">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-22 11:41:15 +00:00
dependabot[bot] 5f0d070c6d chore: bump github.com/aws/aws-sdk-go-v2/service/bedrock from 1.72.0 to 1.73.0 (#29713) 
Bumps
[github.com/aws/aws-sdk-go-v2/service/bedrock](https://github.com/aws/aws-sdk-go-v2)
from 1.72.0 to 1.73.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/8fac7d48b4707a8fdd9cb23b34b928fc83e38777"><code>8fac7d4</code></a>
Release 2025-01-15</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/9eff8acbf1cc8bb294171b969a8e2803bf235a07"><code>9eff8ac</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/f47aa72637a4492512213811a314dda0b9c9a189"><code>f47aa72</code></a>
Update endpoints model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/5934dd36b8ecbc42a321216e8da721e1258ae8a8"><code>5934dd3</code></a>
Update API model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/6636822440828c3eebaacfe9a182c9eb47895236"><code>6636822</code></a>
feat: flexible checksum updates (<a
href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/2808">#2808</a>)</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/4ffbb7cbe6bfeebb50a773d45df57d3fd126cafb"><code>4ffbb7c</code></a>
Release 2025-01-14</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/2f70ff490c3474a59ca29dc2661ec5e4f13ec2f7"><code>2f70ff4</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/434159f5c088eb7b484fea9179d6c5e6302e4610"><code>434159f</code></a>
Update endpoints model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/a80fac9aee1efaac1d16f4005ccc93fed22c62c3"><code>a80fac9</code></a>
Update API model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/44e779abca3ec6dfdc9415ced6af0aa684149bd1"><code>44e779a</code></a>
fix several waiter issues (<a
href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/2953">#2953</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/aws/aws-sdk-go-v2/compare/service/s3/v1.72.0...service/s3/v1.73.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/aws/aws-sdk-go-v2/service/bedrock&package-manager=go_modules&previous-version=1.72.0&new-version=1.73.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-22 11:34:45 +00:00
dependabot[bot] ea7e67ffc6 chore: bump github.com/dustin/go-humanize from 1.0.1 to 1.1.0 (#29709) 
Bumps
[github.com/dustin/go-humanize](https://github.com/dustin/go-humanize)
from 1.0.1 to 1.1.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/dustin/go-humanize/commit/40736da3e8ed16369b5e6f109548f243d43a7e34"><code>40736da</code></a>
Fix <a
href="https://redirect.github.com/dustin/go-humanize/issues/105">#105</a></li>
<li><a
href="https://github.com/dustin/go-humanize/commit/528b6f774c2b2dee6e5b25ab302774b530ae6bd0"><code>528b6f7</code></a>
Fix <a
href="https://redirect.github.com/dustin/go-humanize/issues/85">#85</a></li>
<li><a
href="https://github.com/dustin/go-humanize/commit/2ccb40ff40263df6ede3d42093de3b7b0eaeb4ae"><code>2ccb40f</code></a>
Fix <a
href="https://redirect.github.com/dustin/go-humanize/issues/103">#103</a></li>
<li><a
href="https://github.com/dustin/go-humanize/commit/0509d5bf3e4a84cd3c8d15e7cd5fdb929da99cb4"><code>0509d5b</code></a>
feat: add ParseComma and ParseCommaf with doc comments and epsilon
test</li>
<li><a
href="https://github.com/dustin/go-humanize/commit/0a173b2bf17e0d69adb87075a5d4be6ed1778569"><code>0a173b2</code></a>
Increase big coverage</li>
<li><a
href="https://github.com/dustin/go-humanize/commit/ca34c614782166f4f18ebda2220821345d1120d1"><code>ca34c61</code></a>
Bump actions/setup-go from 6.1.0 to 6.3.0</li>
<li><a
href="https://github.com/dustin/go-humanize/commit/da71bb0bb0c53c256cc7b7327f6cf67543482bd8"><code>da71bb0</code></a>
Bump actions/checkout from 5.0.1 to 6.0.2</li>
<li><a
href="https://github.com/dustin/go-humanize/commit/d02cffb61101b0ade0441980df6caac451df52a5"><code>d02cffb</code></a>
si: accept the Greek letter mu as an alias for µ in ParseSI</li>
<li><a
href="https://github.com/dustin/go-humanize/commit/0f3681d75bde8bf3ec92c1e93ced08db194b9ba3"><code>0f3681d</code></a>
Round off coverage of big</li>
<li><a
href="https://github.com/dustin/go-humanize/commit/ed9405309df9d8e81a3aef835fde2271c8342128"><code>ed94053</code></a>
Increase bytes parsing coverage</li>
<li>Additional commits viewable in <a
href="https://github.com/dustin/go-humanize/compare/v1.0.1...v1.1.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/dustin/go-humanize&package-manager=go_modules&previous-version=1.0.1&new-version=1.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-22 11:33:33 +00:00
dependabot[bot] 734674d91f chore: bump go.uber.org/atomic from 1.11.0 to 1.12.0 (#29708) 
Bumps [go.uber.org/atomic](https://github.com/uber-go/atomic) from
1.11.0 to 1.12.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/uber-go/atomic/releases">go.uber.org/atomic's
releases</a>.</em></p>
<blockquote>
<h2>v1.12.0</h2>
<h3>Added</h3>
<ul>
<li>Add <code>MarshalJSON</code> and <code>UnmarshalJSON</code> method
to <code>atomic.Pointer[T]</code> type
allowing users to use pointer with json.</li>
<li>Add <code>MarshalJSON</code> and <code>UnmarshalJSON</code> methods
to <code>atomic.Time</code> so it
encodes and decodes the wrapped <code>time.Time</code> instead of an
empty struct.</li>
</ul>
<h3>Updated</h3>
<ul>
<li>Bumped <a
href="https://github.com/stretchr/testify">https://github.com/stretchr/testify</a>
to v1.12.1.</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/uber-go/atomic/compare/v1.11.0...v1.12.0">https://github.com/uber-go/atomic/compare/v1.11.0...v1.12.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/uber-go/atomic/blob/master/CHANGELOG.md">go.uber.org/atomic's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/uber-go/atomic/compare/v1.11.0...v1.12.0">1.12.0</a>
- 2026-09-17</h2>
<h3>Added</h3>
<ul>
<li>Add <code>MarshalJSON</code> and <code>UnmarshalJSON</code> method
to <code>atomic.Pointer[T]</code> type
allowing users to use pointer with json.</li>
<li>Add <code>MarshalJSON</code> and <code>UnmarshalJSON</code> methods
to <code>atomic.Time</code> so it
encodes and decodes the wrapped <code>time.Time</code> instead of an
empty struct.</li>
</ul>
<h3>Updated</h3>
<ul>
<li>Bumped <a
href="https://github.com/stretchr/testify">https://github.com/stretchr/testify</a>
to v1.12.1.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/uber-go/atomic/commit/786022ac59d00afe247630b7a419ccb224d4cd21"><code>786022a</code></a>
Preparing release v1.12.0 (<a
href="https://redirect.github.com/uber-go/atomic/issues/214">#214</a>)</li>
<li><a
href="https://github.com/uber-go/atomic/commit/cf206eda0552c915e021a75c8f01e8a258d93cd1"><code>cf206ed</code></a>
atomic.Time: add MarshalJSON / UnmarshalJSON (<a
href="https://redirect.github.com/uber-go/atomic/issues/208">#208</a>)</li>
<li><a
href="https://github.com/uber-go/atomic/commit/c8c46988a7cb9be0f75f49d63c4872aaf08b2866"><code>c8c4698</code></a>
test: assert Value.Store(nil) panics in value_test.go (<a
href="https://redirect.github.com/uber-go/atomic/issues/211">#211</a>)</li>
<li><a
href="https://github.com/uber-go/atomic/commit/92e5b30da4154d19ed04db1187f401c711a936a8"><code>92e5b30</code></a>
test(string): add Text/MarshalUnmarshal subtest to TestString (<a
href="https://redirect.github.com/uber-go/atomic/issues/212">#212</a>)</li>
<li><a
href="https://github.com/uber-go/atomic/commit/db66dadd56cd30bd19e038d6313369a6c38b3339"><code>db66dad</code></a>
use CompareAndSwap instead of the deprecated CAS shim internally (<a
href="https://redirect.github.com/uber-go/atomic/issues/209">#209</a>)</li>
<li><a
href="https://github.com/uber-go/atomic/commit/3ffc65932333b1469e85d835a39ac434bc04061c"><code>3ffc659</code></a>
Bump actions/setup-go from 5.2.0 to 7.0.0 (<a
href="https://redirect.github.com/uber-go/atomic/issues/204">#204</a>)</li>
<li><a
href="https://github.com/uber-go/atomic/commit/73e4e6db86f0b501ba396f0043d0544512e7b22d"><code>73e4e6d</code></a>
Bump actions/cache from 4.2.0 to 6.1.0 (<a
href="https://redirect.github.com/uber-go/atomic/issues/205">#205</a>)</li>
<li><a
href="https://github.com/uber-go/atomic/commit/a6550e5e77b7de2f48c8bed227536bd3d342768b"><code>a6550e5</code></a>
Bump codecov/codecov-action from 4.6.0 to 7.1.0 (<a
href="https://redirect.github.com/uber-go/atomic/issues/206">#206</a>)</li>
<li><a
href="https://github.com/uber-go/atomic/commit/a1b118def3d78f368f04de0f03fe4d21c6aa4be1"><code>a1b118d</code></a>
chore(deps): update stretchr/testify to 1.12.1 (<a
href="https://redirect.github.com/uber-go/atomic/issues/213">#213</a>)</li>
<li><a
href="https://github.com/uber-go/atomic/commit/703f34c27411b863572156a97e9b659ff96e1d36"><code>703f34c</code></a>
Fix typos in test and gen-atomicwrapper (<a
href="https://redirect.github.com/uber-go/atomic/issues/190">#190</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/uber-go/atomic/compare/v1.11.0...v1.12.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=go.uber.org/atomic&package-manager=go_modules&previous-version=1.11.0&new-version=1.12.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-22 11:32:57 +00:00
dependabot[bot] 41ff82336e chore: bump github.com/nats-io/nats-server/v2 from 2.14.2 to 2.15.0 (#29714) 
Bumps
[github.com/nats-io/nats-server/v2](https://github.com/nats-io/nats-server)
from 2.14.2 to 2.15.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/nats-io/nats-server/releases">github.com/nats-io/nats-server/v2's
releases</a>.</em></p>
<blockquote>
<h2>Release v2.15.0</h2>
<h2>Changelog</h2>
<p>Refer to the <a
href="https://docs.nats.io/release-notes/upgrade-to-2.15">2.15 Upgrade
Guide</a> for backwards compatibility notes with 2.14.x. This release
also contains all changes up to and including <a
href="https://github.com/nats-io/nats-server/releases/tag/v2.14.7">v2.14.7</a>.</p>
<h3>Go Version</h3>
<ul>
<li>1.27.1 (<a
href="https://redirect.github.com/nats-io/nats-server/issues/8551">#8551</a>)</li>
</ul>
<h3>Added</h3>
<p>JetStream</p>
<ul>
<li>Desired state metalayer (<a
href="https://redirect.github.com/nats-io/nats-server/issues/8432">#8432</a>,
<a
href="https://redirect.github.com/nats-io/nats-server/issues/8437">#8437</a>,
<a
href="https://redirect.github.com/nats-io/nats-server/issues/8439">#8439</a>,
<a
href="https://redirect.github.com/nats-io/nats-server/issues/8443">#8443</a>,
<a
href="https://redirect.github.com/nats-io/nats-server/issues/8452">#8452</a>,
<a
href="https://redirect.github.com/nats-io/nats-server/issues/8460">#8460</a>,
<a
href="https://redirect.github.com/nats-io/nats-server/issues/8476">#8476</a>,
<a
href="https://redirect.github.com/nats-io/nats-server/issues/8576">#8576</a>,
<a
href="https://redirect.github.com/nats-io/nats-server/issues/8598">#8598</a>,
<a
href="https://redirect.github.com/nats-io/nats-server/issues/8602">#8602</a>,
<a
href="https://redirect.github.com/nats-io/nats-server/issues/8603">#8603</a>)
<ul>
<li>A new desired state reconciliation engine for streams and consumers
considerably improves the safety and reliability of asset moves and
scales</li>
<li>Updating the placement or replication factor midway through an
existing scale/move operation, cancelling an in-flight scale/move, or
peer-removing is now much safer</li>
<li>ADR: <a
href="https://github.com/nats-io/nats-architecture-and-design/blob/main/adr/ADR-62.md">https://github.com/nats-io/nats-architecture-and-design/blob/main/adr/ADR-62.md</a></li>
</ul>
</li>
<li>Cancel stream move endpoint (<a
href="https://redirect.github.com/nats-io/nats-server/issues/8476">#8476</a>)
<ul>
<li>An in-flight scale/move operation on a stream can be cancelled and
the asset returned to its original placement using the new
<code>$JS.API.STREAM.CANCEL_MOVE</code> endpoint</li>
<li>ADR: <a
href="https://github.com/nats-io/nats-architecture-and-design/blob/main/adr/ADR-62.md">https://github.com/nats-io/nats-architecture-and-design/blob/main/adr/ADR-62.md</a></li>
</ul>
</li>
<li>Evacuate endpoints (<a
href="https://redirect.github.com/nats-io/nats-server/issues/8443">#8443</a>)
<ul>
<li>The new <code>$JS.API.SERVER.EVACUATE</code> endpoint can safely
evacuate streams, and any consumers on those streams, from a node</li>
<li>The new <code>$JS.API.STREAM.PEER.EVACUATE.*</code> endpoint can
safely evacuate a peer, and any consumers on that peer, from a
stream</li>
<li>These operations combined allow for maintenance operations with full
transfer of data and state without having to peer-remove first</li>
<li>ADR: <a
href="https://github.com/nats-io/nats-architecture-and-design/blob/main/adr/ADR-62.md">https://github.com/nats-io/nats-architecture-and-design/blob/main/adr/ADR-62.md</a></li>
</ul>
</li>
<li>Metalayer rescue for disaster recovery (<a
href="https://redirect.github.com/nats-io/nats-server/issues/8408">#8408</a>)
<ul>
<li>The new <code>$JS.API.META.RESCUE</code> endpoint can temporarily
lower the quorum-needed for the metalayer, in order to facilitate the
recovery of a system where nodes have been permanently lost and the
metalayer cannot reach quorum</li>
<li>ADR: <a
href="https://github.com/nats-io/nats-architecture-and-design/blob/main/adr/ADR-61.md">https://github.com/nats-io/nats-architecture-and-design/blob/main/adr/ADR-61.md</a></li>
</ul>
</li>
<li>Stream backup and restore v2 (<a
href="https://redirect.github.com/nats-io/nats-server/issues/7882">#7882</a>,
<a
href="https://redirect.github.com/nats-io/nats-server/issues/8584">#8584</a>,
<a
href="https://redirect.github.com/nats-io/nats-server/issues/8591">#8591</a>,
<a
href="https://redirect.github.com/nats-io/nats-server/issues/8604">#8604</a>)
<ul>
<li>A new backup format for stream snapshots which reads out per-message
rather than per-block</li>
<li>The new backup format also now correctly includes non-replicated
consumers on follower nodes</li>
<li>ADR: <a
href="https://github.com/nats-io/nats-architecture-and-design/blob/main/adr/ADR-63.md">https://github.com/nats-io/nats-architecture-and-design/blob/main/adr/ADR-63.md</a></li>
</ul>
</li>
<li>Detect source stream recreation (<a
href="https://redirect.github.com/nats-io/nats-server/issues/8384">#8384</a>)
<ul>
<li>The server now detects a source stream being recreated, restarting
the sourcing back from the beginning, ensuring new messages are
sourced</li>
</ul>
</li>
<li>Stream source indexing (<a
href="https://redirect.github.com/nats-io/nats-server/issues/8282">#8282</a>,
<a
href="https://redirect.github.com/nats-io/nats-server/issues/8516">#8516</a>,
<a
href="https://redirect.github.com/nats-io/nats-server/issues/8283">#8283</a>)
<ul>
<li>Restarts and leader changes previously required expensive backward
scans through the stream to find the last sourced indices. These are now
persisted in an index for instant lookup.</li>
</ul>
</li>
<li>Domain-prefixed JS API in system account (<a
href="https://redirect.github.com/nats-io/nats-server/issues/8429">#8429</a>)
<ul>
<li>When a system account is bridged between the hub and a leaf node,
the domain-prefixed JS API can now be used to operate on the leaf node
while directly connected to the hub</li>
</ul>
</li>
</ul>
<h3>Changed</h3>
<p>JetStream</p>
<ul>
<li>Streams now have a default limit of 1000 consumers, unless
<code>max_consumers</code> is specified in the stream config or account
limits (<a
href="https://redirect.github.com/nats-io/nats-server/issues/8337">#8337</a>,
<a
href="https://redirect.github.com/nats-io/nats-server/issues/8566">#8566</a>)
<ul>
<li>Applications planning to use a large number of consumers on a stream
should configure <code>max_consumers</code> in the stream config or
account limits to an appropriately high number</li>
<li>The server-wide default of 1000 can be overridden by setting
<code>default_max_consumers</code> in the JetStream limits, or can be
disabled by setting to <code>-1</code></li>
<li>This limit does not affect existing consumers and will not result in
consumer deletions, only the creation of new consumers is prevented</li>
</ul>
</li>
<li>Sync changes for replicated streams (<a
href="https://redirect.github.com/nats-io/nats-server/issues/8447">#8447</a>)
<ul>
<li>When the <code>sync_interval</code> is set to <code>always</code>,
replicated streams now sync their WAL entries but no longer sync upper
stream layer writes</li>
<li>The synced log allows the stream to recover safely, but removing
unnecessary syncs from the upper stream layer dramatically improves
performance</li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/nats-io/nats-server/commit/eb763679aa3c24a40dcd3012aa046ad1996d851c"><code>eb76367</code></a>
Release v2.15.0</li>
<li><a
href="https://github.com/nats-io/nats-server/commit/8f3f31b0366eca0d855d0750b7ca547eadd10eff"><code>8f3f31b</code></a>
[FIXED] Config reload disconnects operator mode clients sending an nkey
(<a
href="https://redirect.github.com/nats-io/nats-server/issues/8609">#8609</a>)</li>
<li><a
href="https://github.com/nats-io/nats-server/commit/7d7724070d088d44e9da2ec74fffc040277f6af8"><code>7d77240</code></a>
[FIXED] Stream scale down into a missing account tier was accepted (<a
href="https://redirect.github.com/nats-io/nats-server/issues/8608">#8608</a>)</li>
<li><a
href="https://github.com/nats-io/nats-server/commit/e46d21fcfa6720c6ca0b7ed17070dd172b011a8a"><code>e46d21f</code></a>
[FIXED] Concurrent account updates invalidating stream imports (<a
href="https://redirect.github.com/nats-io/nats-server/issues/8610">#8610</a>)</li>
<li><a
href="https://github.com/nats-io/nats-server/commit/2ecd77a6fef7b35ebb229d0b401645a2f79ce1b4"><code>2ecd77a</code></a>
De-flake TestJetStreamClusterHardKillAfterStreamAdd</li>
<li><a
href="https://github.com/nats-io/nats-server/commit/901df7858b812ee5896cb018e8b134167f6158e7"><code>901df78</code></a>
De-flake TestJetStreamClusterAccountMaxConnectionsReconnect</li>
<li><a
href="https://github.com/nats-io/nats-server/commit/e133a1ffb04661d0d862c1ab65f37b930acb01bb"><code>e133a1f</code></a>
De-flake TestJetStreamClusterMessageTTLCatchup</li>
<li><a
href="https://github.com/nats-io/nats-server/commit/2990f6c065b9b3013eb8f60f5f5b96d4b9f55a03"><code>2990f6c</code></a>
[FIXED] Concurrent account updates invalidating stream imports</li>
<li><a
href="https://github.com/nats-io/nats-server/commit/51fd55fdbb2b1569cdb67be742295235f14bc4da"><code>51fd55f</code></a>
De-flake TestJWTImportsOnServerRestartAndClientsReconnect</li>
<li><a
href="https://github.com/nats-io/nats-server/commit/6a82cf9beb53f37e1f9a91e7707a04bb0f8709b4"><code>6a82cf9</code></a>
De-flake TestNoRaceRouteSendSubs</li>
<li>Additional commits viewable in <a
href="https://github.com/nats-io/nats-server/compare/v2.14.2...v2.15.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/nats-io/nats-server/v2&package-manager=go_modules&previous-version=2.14.2&new-version=2.15.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-22 11:26:52 +00:00
dependabot[bot] 005029a916 chore: bump google.golang.org/grpc from 1.83.2 to 1.84.0 (#29710) 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from
1.83.2 to 1.84.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/grpc/grpc-go/releases">google.golang.org/grpc's
releases</a>.</em></p>
<blockquote>
<h2>Release 1.84.0</h2>
<h1>Behavior Changes</h1>
<ul>
<li>stats/otel: The <code>grpc.lb.pick_first.*</code> metrics have been
removed and replaced with <code>grpc.subchannel.*</code> metrics. See <a
href="https://github.com/grpc/proposal/blob/master/A94-subchannel-otel-metrics.md">gRFC
A94</a> for more details. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9215">#9215</a>)</li>
</ul>
<h1>New Features</h1>
<ul>
<li>xds: Add support for <code>contains_match</code> in route header
matchers. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9223">#9223</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/nvxbug"><code>@​nvxbug</code></a></li>
</ul>
</li>
</ul>
<h1>Bug Fixes</h1>
<ul>
<li>client: Fix a bug where a <code>ClientConn</code> could get
permanently stuck in IDLE when an RPC was canceled during stream
creation. Previously, such cancellations triggered stream cleanup twice,
corrupting the channel's idleness state and causing subsequent RPCs to
fail with deadline exceeded errors. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9191">#9191</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/utkuozdemir"><code>@​utkuozdemir</code></a></li>
</ul>
</li>
<li>client: Fix a bug where non-gRPC HTTP responses ending with an empty
DATA frame failed the RPC with status code <code>Internal</code> instead
of preserving the HTTP-mapped status code and response body. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9217">#9217</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/chengxilo"><code>@​chengxilo</code></a></li>
</ul>
</li>
<li>credentials: Validate metadata returned by per-RPC credentials,
failing the RPC with status code <code>Internal</code> if invalid keys
or values are found. Previously, invalid metadata from credentials was
sent to the server in outgoing HTTP/2 requests. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9202">#9202</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/buger"><code>@​buger</code></a></li>
</ul>
</li>
<li>credentials/sts: Prevent potential token leakage by disallowing HTTP
redirects during STS token exchange. Previously, 3xx redirects were
followed automatically, replaying the request body containing
authentication tokens to the redirect destination. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9299">#9299</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/nvxbug"><code>@​nvxbug</code></a></li>
</ul>
</li>
<li>randomsubsetting: Ignore endpoints that contain no addresses.
Previously, this could cause the policy to panic while computing hashes.
(<a
href="https://redirect.github.com/grpc/grpc-go/issues/9259">#9259</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/fallintoplace"><code>@​fallintoplace</code></a></li>
</ul>
</li>
<li>stats/otel: Ensure method names are populated in trace spans when
metrics are disabled. Previously, running with tracing enabled and
metrics disabled resulted in server trace spans lacking the RPC method
name (recording only &quot;Recv.&quot;). (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9262">#9262</a>)</li>
<li>transport: Return <code>io.ErrUnexpectedEOF</code> when EOF is
encountered after partial header or message body reads. Previously,
partial reads could return a plain <code>io.EOF</code>, failing to
distinguish truncated data from a clean end of stream. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9204">#9204</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/buger"><code>@​buger</code></a></li>
</ul>
</li>
<li>transport: Validate metadata supplied by balancers (in
<code>PickResult.Metadata</code>) and resolver addresses, failing the
RPC with status code <code>Internal</code> if invalid keys or values are
found. Previously, invalid metadata from these sources was sent to the
server in outgoing HTTP/2 requests. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9203">#9203</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/buger"><code>@​buger</code></a></li>
</ul>
</li>
<li>xds: Fix a rare corner case that could prevent a cluster from being
removed when it is no longer in use. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9140">#9140</a>)</li>
<li>xds: Fix panic during route matching for routes containing header
matchers with empty <code>exact_match</code> strings. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9223">#9223</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/nvxbug"><code>@​nvxbug</code></a></li>
</ul>
</li>
<li>xds: Reject routes containing header matchers with empty
<code>prefix_match</code> or <code>suffix_match</code> strings.
Previously, this caused a panic during route matching. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9223">#9223</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/nvxbug"><code>@​nvxbug</code></a></li>
</ul>
</li>
<li>xds: Fix EDS drop policies being applied at a much lower rate than
configured due to an integer overflow. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9257">#9257</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/nvxbug"><code>@​nvxbug</code></a></li>
</ul>
</li>
<li>xds: Reject EDS resources containing drop policies with unsupported
denominators. Previously, such resources caused the client to panic when
calculating drop rates. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9218">#9218</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/nvxbug"><code>@​nvxbug</code></a></li>
</ul>
</li>
<li>xds/rbac: Reject RBAC configurations containing nested
<code>Principal</code> or <code>Permission</code> rules with
<code>:scheme</code> or <code>grpc-</code> prefixed header matchers.
Previously, such configurations could cause DENY policies to fail open.
(<a
href="https://redirect.github.com/grpc/grpc-go/issues/9258">#9258</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/nvxbug"><code>@​nvxbug</code></a></li>
</ul>
</li>
<li>xds/rbac: Rewrite <code>host</code> header matchers to
<code>:authority</code> in nested <code>Principal</code> and
<code>Permission</code> rules. Previously, this rewrite only applied to
top-level rules, causing nested <code>host</code> matchers to never
match incoming requests and DENY policies to fail open. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9258">#9258</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/nvxbug"><code>@​nvxbug</code></a></li>
</ul>
</li>
<li>xds/rbac: Reject <code>CidrRanges</code> with an unset prefix
length. Previously, an omitted <code>prefix_len</code> field caused a
panic during RBAC configuration parsing. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9250">#9250</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/nvxbug"><code>@​nvxbug</code></a></li>
</ul>
</li>
</ul>
<h1>Performance Improvements</h1>
<ul>
<li>transport: Avoid a heap allocation when flushing shared write
buffers. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9233">#9233</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/zaidoon1"><code>@​zaidoon1</code></a></li>
</ul>
</li>
<li>credentials/alts: Support dynamic frame size negotiation and add the
<code>GRPC_GO_EXPERIMENTAL_ALTS_MAX_FRAME_SIZE</code> environment
variable (default 4KiB, max 512KiB) to configure the maximum ALTS record
frame size. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9268">#9268</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/grpc/grpc-go/commit/e84aa5ab15d1d2b29d54f838312ad490cb7551a8"><code>e84aa5a</code></a>
Change version to 1.84.0 (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9324">#9324</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/c5ae88df420fcc0c24c6267bdf8cdd3b2711ba2c"><code>c5ae88d</code></a>
Cherrypick <a
href="https://redirect.github.com/grpc/grpc-go/issues/9204">#9204</a>
and <a
href="https://redirect.github.com/grpc/grpc-go/issues/9321">#9321</a> to
v1.84.x (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9407">#9407</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/a592f6a8d26237b5476eb18b08ee1203393e27b9"><code>a592f6a</code></a>
Cherrypick <a
href="https://redirect.github.com/grpc/grpc-go/issues/9351">#9351</a>
and <a
href="https://redirect.github.com/grpc/grpc-go/issues/9404">#9404</a> to
v1.84.x (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9408">#9408</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/d5a41119e0e3189ea913cf839586ce34a44f1a3f"><code>d5a4111</code></a>
cherry-pick <a
href="https://redirect.github.com/grpc/grpc-go/issues/9365">#9365</a> to
v1.84.x (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9370">#9370</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/89d55e04f9f3213a2de543e00df15f1468ea9d9a"><code>89d55e0</code></a>
cherry-pick <a
href="https://redirect.github.com/grpc/grpc-go/issues/9346">#9346</a> to
v1.84.x (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9372">#9372</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/8a9f866584e36f0adb8c60a779581ab4bb486d1b"><code>8a9f866</code></a>
Cherry-pick <a
href="https://redirect.github.com/grpc/grpc-go/issues/9332">#9332</a> to
v1.84.x (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9338">#9338</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/f8b54e7c913347537e168f5219d8f6cbaeb8860b"><code>f8b54e7</code></a>
Cherry-pick <a
href="https://redirect.github.com/grpc/grpc-go/issues/9331">#9331</a> to
v1.84.x (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9334">#9334</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/30ce1d594fa9d7b86ff9d3d7dd7873ef0c161acf"><code>30ce1d5</code></a>
xds: support injecting bootstrap and server config into HTTP filter
config pa...</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/54c743e4e9829208f264e092160d2b0768a01bf2"><code>54c743e</code></a>
extproc : wait for async RPC to complete in test (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9311">#9311</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/538bb2f7af6e36be46ec1d2ae90f65b972f14083"><code>538bb2f</code></a>
endpointsharding: decouple locking, and simplify ChildState API (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9290">#9290</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/grpc/grpc-go/compare/v1.83.2...v1.84.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/grpc&package-manager=go_modules&previous-version=1.83.2&new-version=1.84.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-22 11:17:31 +00:00
dependabot[bot] 96e97a4061 chore: bump alpine from 31b6477 to 294b683 in /scripts (#29707) 
Bumps alpine from `31b6477` to `294b683`.


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=alpine&package-manager=docker&previous-version=3.24.2&new-version=3.24.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-22 11:07:06 +00:00