opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-22 13:10:21 +08:00
Code Issues Packages Projects Releases Wiki Activity
15,280 Commits 479 Branches 387 Tags
27ed052d86b5c8a630ccaff45ca39632da2c419c
Commit Graph
1367 Commits
Author SHA1 Message Date
Michael Suchacz f84801eecf chore: bump coder/fantasy for gpt-5.6 Responses routing (#27132) 
gpt-5.6 models were unusable with agents: fantasy's Responses allowlist
did not include the new family, so `IsResponsesModel` returned false and
chatd fell back to the Chat Completions path (no reasoning params, no
encrypted reasoning continuity).

## Changes

- Bump the `charm.land/fantasy` replace pin to coder/fantasy
`6da0c3b10237` (coder_2_33), pulling in:
- coder/fantasy#46: route `gpt-5.6-sol`, `gpt-5.6-terra`, `gpt-5.6-luna`
through the OpenAI Responses API as reasoning models.
- coder/fantasy#41: surface Anthropic refusal stop_reason as
content-filter (already on coder_2_33, rides along with the bump).
- Update the fork changelog comment in go.mod.

## Verification

- Probed all three gpt-5.6 models through the ai-gateway:
`/v1/responses` with `reasoning.effort`, `include:
["reasoning.encrypted_content"]`, and `store: false` completes for each.
- `go build ./coderd/...` and `go test ./coderd/x/chatd/chatopenai/
./coderd/x/chatd/chatprovider/` pass against the new pin.

> This PR was authored by Mux on Mike's behalf.
 2026-07-09 18:25:34 +00:00
Danny Kopping f2e8d72100 chore: apply openai-go bugfix to fix openrouter response parsing (#27092) 
Applies https://github.com/coder/openai-go/pull/3
Closes https://github.com/coder/coder/issues/26469

`kylecarbs/openai-go` was renamed to `coder/openai-go`

I've created a
[branch](https://github.com/coder/openai-go/tree/coder/pinned) to track
the changes we've made.
We're far behind `main` now, so we should make an effort to update this
as some point.

I've manually tested using OpenRouter + GLM 5.2 as the bug report states
and it works fine.

<img width="824" height="321" alt="image"
src="https://github.com/user-attachments/assets/804c527a-3a59-43bd-91c8-3b9bfb48df81"
/>
<img width="927" height="149" alt="image"
src="https://github.com/user-attachments/assets/35829bc2-5597-430c-8ede-bb2ebabc73a5"
/>

<details>

```
: OPENROUTER PROCESSING

: OPENROUTER PROCESSING

: OPENROUTER PROCESSING

: OPENROUTER PROCESSING

: OPENROUTER PROCESSING

: OPENROUTER PROCESSING

: OPENROUTER PROCESSING

: OPENROUTER PROCESSING

: OPENROUTER PROCESSING

: OPENROUTER PROCESSING

: OPENROUTER PROCESSING

: OPENROUTER PROCESSING

: OPENROUTER PROCESSING

: OPENROUTER PROCESSING

: OPENROUTER PROCESSING

: OPENROUTER PROCESSING

data: {"id":"gen-1783515596-pm90JeoPBXFHqVq3dDlL","object":"chat.completion.chunk","created":1783515596,"model":"z-ai/glm-5.2-20260616","provider":"Novita","choices":[{"index":0,"delta":{"content":"Yep","role":"assistant"},"finish_reason":null,"native_finish_reason":null}]}

data: {"id":"gen-1783515596-pm90JeoPBXFHqVq3dDlL","object":"chat.completion.chunk","created":1783515596,"model":"z-ai/glm-5.2-20260616","provider":"Novita","choices":[{"index":0,"delta":{"content":", I","role":"assistant"},"finish_reason":null,"native_finish_reason":null}]}

data: {"id":"gen-1783515596-pm90JeoPBXFHqVq3dDlL","object":"chat.completion.chunk","created":1783515596,"model":"z-ai/glm-5.2-20260616","provider":"Novita","choices":[{"index":0,"delta":{"content":"'m here","role":"assistant"},"finish_reason":null,"native_finish_reason":null}]}

data: {"id":"gen-1783515596-pm90JeoPBXFHqVq3dDlL","object":"chat.completion.chunk","created":1783515596,"model":"z-ai/glm-5.2-20260616","provider":"Novita","choices":[{"index":0,"delta":{"content":". What","role":"assistant"},"finish_reason":null,"native_finish_reason":null}]}

data: {"id":"gen-1783515596-pm90JeoPBXFHqVq3dDlL","object":"chat.completion.chunk","created":1783515596,"model":"z-ai/glm-5.2-20260616","provider":"Novita","choices":[{"index":0,"delta":{"content":" do you","role":"assistant"},"finish_reason":null,"native_finish_reason":null}]}

: OPENROUTER PROCESSING

data: {"id":"gen-1783515596-pm90JeoPBXFHqVq3dDlL","object":"chat.completion.chunk","created":1783515596,"model":"z-ai/glm-5.2-20260616","provider":"Novita","choices":[{"index":0,"delta":{"content":" need?","role":"assistant"},"finish_reason":null,"native_finish_reason":null}]}

data: {"id":"gen-1783515596-pm90JeoPBXFHqVq3dDlL","object":"chat.completion.chunk","created":1783515596,"model":"z-ai/glm-5.2-20260616","provider":"Novita","choices":[{"index":0,"delta":{"content":"","role":"assistant"},"finish_reason":"stop","native_finish_reason":"stop"}]}

data: {"id":"gen-1783515596-pm90JeoPBXFHqVq3dDlL","object":"chat.completion.chunk","created":1783515596,"model":"z-ai/glm-5.2-20260616","provider":"Novita","service_tier":null,"choices":[{"index":0,"delta":{"content":"","role":"assistant"},"finish_reason":"stop","native_finish_reason":"stop"}],"usage":{"prompt_tokens":4855,"completion_tokens":13,"total_tokens":4868,"cost":0.00479794,"is_byok":false,"prompt_tokens_details":{"cached_tokens":0,"cache_write_tokens":0,"audio_tokens":0,"video_tokens":0},"cost_details":{"upstream_inference_cost":0.00479794,"upstream_inference_prompt_cost":0.0047579,"upstream_inference_completions_cost":0.00004004},"completion_tokens_details":{"reasoning_tokens":0,"image_tokens":0,"audio_tokens":0}}}

data: [DONE]


```
</details>

Signed-off-by: Danny Kopping <danny@coder.com>
 2026-07-08 13:36:42 +00:00
dependabot[bot] fd77652993 chore: bump github.com/zclconf/go-cty from 1.18.1 to 1.19.0 (#27053) 
Bumps [github.com/zclconf/go-cty](https://github.com/zclconf/go-cty)
from 1.18.1 to 1.19.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/zclconf/go-cty/blob/main/CHANGELOG.md">github.com/zclconf/go-cty's
changelog</a>.</em></p>
<blockquote>
<h1>1.19.0 (July 6, 2026)</h1>
<ul>
<li>When building with Go 1.27 or later, the various string operations
that are defined in terms of UAX#29 grapheme cluster segmentation will
now use the Unicode 17 character properties and rules. For older
versions of Go, Unicode 15 is still used.</li>
<li>The <code>cty.ValueMarks</code> type, which represents a set of
value marks separately from any value, now has method <code>Has</code>
for concisely testing if a specific mark is present, and
<code>Insert</code> for inserting elements from an
<code>iter.Seq[any]</code> into an existing set of marks for easier
gradual construction without creating any temporary mark sets.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/zclconf/go-cty/commit/749fb01316b34f996526dc0a799b54ee008436a8"><code>749fb01</code></a>
v1.19.0</li>
<li><a
href="https://github.com/zclconf/go-cty/commit/f6d59fa6af526d7ef9a296ee0fee01ccd3c64840"><code>f6d59fa</code></a>
ValueMarks.Has and ValueMarks.Insert</li>
<li><a
href="https://github.com/zclconf/go-cty/commit/db1a4101f6f4a1ecd63bf25bfd53e7709a2e7e0b"><code>db1a410</code></a>
Use Unicode 17 text segmentation rules on Go 1.27</li>
<li><a
href="https://github.com/zclconf/go-cty/commit/c8df66764124f2e53f491d4d4a4620c13e3b914d"><code>c8df667</code></a>
json: Compensate for different JSON error message in Go1.27</li>
<li><a
href="https://github.com/zclconf/go-cty/commit/9d8f06e30ed204b49a68845101c48c8d439f598b"><code>9d8f06e</code></a>
convert: Fix incorrect format string in TestSortTypes</li>
<li>See full diff in <a
href="https://github.com/zclconf/go-cty/compare/v1.18.1...v1.19.0">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-07 11:36:29 +00:00
dependabot[bot] 7b5efe0e14 chore: bump google.golang.org/api from 0.286.0 to 0.287.0 (#27056) 
Bumps
[google.golang.org/api](https://github.com/googleapis/google-api-go-client)
from 0.286.0 to 0.287.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's
releases</a>.</em></p>
<blockquote>
<h2>v0.287.0</h2>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.286.0...v0.287.0">0.287.0</a>
(2026-06-30)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3635">#3635</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/504873e45d4a0993065311ed3f6a0467f2c41ab1">504873e</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3637">#3637</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/5c975bee9f05d3c570eb0d95be248f3cb418739f">5c975be</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3639">#3639</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/9737c4bf678023b300958b55d1548a902ff36c5d">9737c4b</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.286.0...v0.287.0">0.287.0</a>
(2026-06-30)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3635">#3635</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/504873e45d4a0993065311ed3f6a0467f2c41ab1">504873e</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3637">#3637</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/5c975bee9f05d3c570eb0d95be248f3cb418739f">5c975be</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3639">#3639</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/9737c4bf678023b300958b55d1548a902ff36c5d">9737c4b</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/1a444d6fac14a1652ec4a1e0d9eba6fb1bda7045"><code>1a444d6</code></a>
chore(main): release 0.287.0 (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3636">#3636</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/9737c4bf678023b300958b55d1548a902ff36c5d"><code>9737c4b</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3639">#3639</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/f0d27e84fd7323958b8700c2da4b496d96561a3d"><code>f0d27e8</code></a>
chore(all): update all (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3638">#3638</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/5c975bee9f05d3c570eb0d95be248f3cb418739f"><code>5c975be</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3637">#3637</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/504873e45d4a0993065311ed3f6a0467f2c41ab1"><code>504873e</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3635">#3635</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/8f8eab49770458a0890a0dde6780568a99057776"><code>8f8eab4</code></a>
chore(all): update all to 87f3d3e (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3633">#3633</a>)</li>
<li>See full diff in <a
href="https://github.com/googleapis/google-api-go-client/compare/v0.286.0...v0.287.0">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-07 11:36:20 +00:00
dependabot[bot] c9109247e9 chore: bump google.golang.org/grpc from 1.81.1 to 1.82.0 (#27054) 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from
1.81.1 to 1.82.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/grpc/grpc-go/releases">google.golang.org/grpc's
releases</a>.</em></p>
<blockquote>
<h2>Release 1.82.0</h2>
<h1>Behavior Changes</h1>
<ul>
<li>server: Remove support for
<code>GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING</code>
environment varibale. Strict incoming RPC path validation (which has
been the default since <code>v1.79.3</code>) can no longer be disabled.
(<a
href="https://redirect.github.com/grpc/grpc-go/issues/9112">#9112</a>)</li>
<li>transport: Add environment variable to change the default max header
list size from <code>16MB</code> to <code>8KB</code>. This may be
enabled by setting
<code>GRPC_GO_EXPERIMENTAL_ENABLE_8KB_DEFAULT_HEADER_LIST_SIZE=true</code>.
This will be enabled by default in a subsequent release. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9019">#9019</a>)</li>
<li>balancer: Load Balancing policy registry is now case-sensitive. Set
<code>GRPC_GO_EXPERIMENTAL_CASE_SENSITIVE_BALANCER_REGISTRIES=false</code>
(and file an issue) to revert to case-insensitive behavior. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9017">#9017</a>)</li>
</ul>
<h1>New Features</h1>
<ul>
<li>experimental/stats: Expose a new API,
<code>NewContextWithLabelCallback</code>, to register a callback that is
invoked when telemetry labels are added. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8877">#8877</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/seth-epps"><code>@​seth-epps</code></a></li>
</ul>
</li>
<li>client: Return a portion of the response body in the error message,
when the client receives an unexpected non-gRPC HTTP response, to make
debugging easier. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8929">#8929</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/chengxilo"><code>@​chengxilo</code></a></li>
</ul>
</li>
<li>server: Add environment variable
<code>GRPC_GO_SERVER_GOROUTINE_LABELS</code> that controls setting
<code>runtime/pprof.Labels</code> on goroutines spawned by the server.
Set <code>GRPC_GO_SERVER_GOROUTINE_LABELS=grpc.method=true</code> to add
the <code>grpc.method</code> label on goroutines spawned to handle
incoming requests. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9082">#9082</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/dfinkel"><code>@​dfinkel</code></a></li>
</ul>
</li>
</ul>
<h1>Bug Fixes</h1>
<ul>
<li>xds/server: Fix a memory leak of HTTP filter instances occurring
when route configurations are updated in-place during a Route Discovery
Service (RDS) update. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9138">#9138</a>)</li>
<li>grpc: In the deprecated <code>gzip</code> Compressor (used via the
deprecated <code>WithCompressor</code> dial option), enforce the
<code>MaxRecvMsgSize</code> limit on the decompressed message buffer,
preventing excessive memory allocation from highly compressed payloads.
(<a
href="https://redirect.github.com/grpc/grpc-go/issues/9114">#9114</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/evilgensec"><code>@​evilgensec</code></a></li>
</ul>
</li>
<li>stats/opentelemetry: Record retry attempts,
<code>grpc.previous-rpc-attempts</code>, at the call level and not the
attempt level. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8923">#8923</a>)</li>
<li>encoding: Ensure <code>Close()</code> is always called on readers
returned from <code>Compressor.Decompress</code> if possible. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9135">#9135</a>)</li>
<li>channelz: Fix the <code>LastMessageSentTimestamp</code> and
<code>LastMessageReceivedTimestamp</code> fields in
<code>SocketMetrics</code> to ensure they contain correct timestamp
values. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9109">#9109</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/grpc/grpc-go/commit/bd239854f0ab7f1ee63457d47f7c1d2675e1f736"><code>bd23985</code></a>
Change version to 1.82.0 (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9170">#9170</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/0f3086db7a755b6af83a90809471dd7f645b345a"><code>0f3086d</code></a>
Fix minor issues not covered by PR <a
href="https://redirect.github.com/grpc/grpc-go/issues/9137">#9137</a>
(<a
href="https://redirect.github.com/grpc/grpc-go/issues/9147">#9147</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/fef07fbb2b94b668e8daca1f6b70433dcd36c1c8"><code>fef07fb</code></a>
internal: Split v3procservicepb import into pb and grpc for extproc (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9163">#9163</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/91dd64f4b83cb5134e279d1126ebb1ccf47d4d31"><code>91dd64f</code></a>
transport: surface subsequent data when receiving non-gRPC header (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8929">#8929</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/adc97de9521a9f377dab5e911039842dc4de23e5"><code>adc97de</code></a>
test/kokoro: add config for regional-td test (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9158">#9158</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/57c9ff14e05b535ee6995ba49bc882b287a175de"><code>57c9ff1</code></a>
xds: ensure full-string matching for RBAC Filter rules (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9148">#9148</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/b58f32d9ff07c612d64e677bd826bcbec88af9bd"><code>b58f32d</code></a>
server: Set a pprof label on new stream goroutines (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9082">#9082</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/6c98be31ce0aec1592b783b0edb16916eb5acd89"><code>6c98be3</code></a>
refactor(transport): extract shared stream state handling logic in
`loopyWrit...</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/bcaa6f4df4546c86e12ef3e95852c7baf7a08d67"><code>bcaa6f4</code></a>
rls: only reset backoff on recovery from TRANSIENT_FAILURE (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9137">#9137</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/429e6e06363a01f0dd9f9b6b9cf0c0e6617cda12"><code>429e6e0</code></a>
balancer: expose endpoint weight and hostname as experimental APIs (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9074">#9074</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/grpc/grpc-go/compare/v1.81.1...v1.82.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/grpc&package-manager=go_modules&previous-version=1.81.1&new-version=1.82.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-07 11:20:21 +00:00
dependabot[bot] 10d9ad0fc0 chore: bump github.com/go-chi/httprate from 0.15.0 to 0.16.0 (#27055) 
[//]: # (dependabot-start)
⚠️  **Dependabot is rebasing this PR** ⚠️ 

Rebasing might not happen immediately, so don't worry if this takes some
time.

Note: if you make any changes to this PR yourself, they will take
precedence over the rebase.

---

[//]: # (dependabot-end)

Bumps [github.com/go-chi/httprate](https://github.com/go-chi/httprate)
from 0.15.0 to 0.16.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/go-chi/httprate/releases">github.com/go-chi/httprate's
releases</a>.</em></p>
<blockquote>
<h2>v0.16.0</h2>
<h2>What's Changed</h2>
<ul>
<li>perf: replace fmt with strconv to reduce allocations by <a
href="https://github.com/EricGusmao"><code>@​EricGusmao</code></a> in <a
href="https://redirect.github.com/go-chi/httprate/pull/55">go-chi/httprate#55</a></li>
<li>local counter: align windows to reset at sub-millisecond counter
start by <a
href="https://github.com/VojtechVitek"><code>@​VojtechVitek</code></a>
in <a
href="https://redirect.github.com/go-chi/httprate/pull/58">go-chi/httprate#58</a></li>
<li>test: drop golang.org/x/sync dependency (errgroup → sync.WaitGroup)
by <a
href="https://github.com/VojtechVitek"><code>@​VojtechVitek</code></a>
in <a
href="https://redirect.github.com/go-chi/httprate/pull/59">go-chi/httprate#59</a></li>
<li>perf: use zero-alloc xxh3.HashString on the local counter hot path
by <a
href="https://github.com/VojtechVitek"><code>@​VojtechVitek</code></a>
in <a
href="https://redirect.github.com/go-chi/httprate/pull/60">go-chi/httprate#60</a></li>
<li>Deprecate spoofable RealIP rate-limiting; add LimitBy +
KeyFromContext and modernize the key API by <a
href="https://github.com/VojtechVitek"><code>@​VojtechVitek</code></a>
in <a
href="https://redirect.github.com/go-chi/httprate/pull/61">go-chi/httprate#61</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/EricGusmao"><code>@​EricGusmao</code></a> made
their first contribution in <a
href="https://redirect.github.com/go-chi/httprate/pull/55">go-chi/httprate#55</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/go-chi/httprate/compare/v0.15.0...v0.16.0">https://github.com/go-chi/httprate/compare/v0.15.0...v0.16.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/go-chi/httprate/commit/741b4a550f982dab146dee10f2b154b01c06facd"><code>741b4a5</code></a>
Deprecate spoofable RealIP rate-limiting; add LimitBy + KeyFromContext
and mo...</li>
<li><a
href="https://github.com/go-chi/httprate/commit/81255de73f43306ad57c9cf01693a7d5172678df"><code>81255de</code></a>
perf: use zero-alloc xxh3.HashString on the local counter hot path (<a
href="https://redirect.github.com/go-chi/httprate/issues/60">#60</a>)</li>
<li><a
href="https://github.com/go-chi/httprate/commit/0c2093ae43d739627fba9eb197280f97f460c611"><code>0c2093a</code></a>
test: replace golang.org/x/sync/errgroup with sync.WaitGroup (<a
href="https://redirect.github.com/go-chi/httprate/issues/59">#59</a>)</li>
<li><a
href="https://github.com/go-chi/httprate/commit/89e5cca2fbfd6645307b73a15b69a979d4c1dcf4"><code>89e5cca</code></a>
local counter: align windows to reset at sub-millisecond counter start
(<a
href="https://redirect.github.com/go-chi/httprate/issues/58">#58</a>)</li>
<li><a
href="https://github.com/go-chi/httprate/commit/be2ba84c12680b356b271bdf6104c9b465f3c1de"><code>be2ba84</code></a>
replace fmt with strconv to reduce allocations (<a
href="https://redirect.github.com/go-chi/httprate/issues/55">#55</a>)</li>
<li>See full diff in <a
href="https://github.com/go-chi/httprate/compare/v0.15.0...v0.16.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-chi/httprate&package-manager=go_modules&previous-version=0.15.0&new-version=0.16.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-07 11:20:04 +00:00
dependabot[bot] dfef6ae0a7 chore: bump github.com/aws/aws-sdk-go-v2/service/sts from 1.43.3 to 1.44.0 (#27052) 
Bumps
[github.com/aws/aws-sdk-go-v2/service/sts](https://github.com/aws/aws-sdk-go-v2)
from 1.43.3 to 1.44.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/fa3ee1a83b9edac9669159650622bcfe3003b44c"><code>fa3ee1a</code></a>
Release 2023-11-21</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/6e0c553b49b1fd84753d3ea440be93011d36cf40"><code>6e0c553</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/32fa00b32e99f9004aadc5750d508a9393d03d57"><code>32fa00b</code></a>
Update endpoints model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/72eae5c284e11b1f167fe17282ae1ee821a11659"><code>72eae5c</code></a>
Update API model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/1c69d08daccf94d9114d2463adc02e59e85b4deb"><code>1c69d08</code></a>
fix: don't expect response to be json in endpointcreds provider (<a
href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/2381">#2381</a>)</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/3bd97c063d962a34ca496720a3ce00ef4affe5fd"><code>3bd97c0</code></a>
fix: don't send 0 max items for object version and multipart upload
paginator...</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/b3e07aa0a0dd26ec46095c28ce65301da2e78dba"><code>b3e07aa</code></a>
Release 2023-11-20</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/2fc1c0dab14dff82fc2c2465cb7c40a4157196a0"><code>2fc1c0d</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/1a6bd026243230178e775059d27038c0ced194ea"><code>1a6bd02</code></a>
Update endpoints model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/ac2c871bff4a9fbb6284f1dcc061fdcabea346f3"><code>ac2c871</code></a>
Update API model</li>
<li>Additional commits viewable in <a
href="https://github.com/aws/aws-sdk-go-v2/compare/service/amp/v1.43.3...service/s3/v1.44.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/aws/aws-sdk-go-v2/service/sts&package-manager=go_modules&previous-version=1.43.3&new-version=1.44.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-07 11:19:17 +00:00
dependabot[bot] 4dade44e72 chore: bump github.com/go-chi/chi/v5 from 5.2.4 to 5.3.1 (#27051) 
Bumps [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) from
5.2.4 to 5.3.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/go-chi/chi/releases">github.com/go-chi/chi/v5's
releases</a>.</em></p>
<blockquote>
<h2>v5.3.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Honor Discard() in httpFancyWriter.ReadFrom by <a
href="https://github.com/DucMinhNe"><code>@​DucMinhNe</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/1110">go-chi/chi#1110</a></li>
<li>Tidy build directives by <a
href="https://github.com/JRaspass"><code>@​JRaspass</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/1113">go-chi/chi#1113</a></li>
<li>feat(middleware): add text/xml and application/xml to default
compressible types by <a
href="https://github.com/VojtechVitek"><code>@​VojtechVitek</code></a>
in <a
href="https://redirect.github.com/go-chi/chi/pull/1127">go-chi/chi#1127</a></li>
<li>Fix defaultLogEntry.Panic not respecting NoColor setting by <a
href="https://github.com/doganarif"><code>@​doganarif</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/1050">go-chi/chi#1050</a></li>
<li>middleware: document printPrettyStack and harden NoColor panic test
by <a
href="https://github.com/VojtechVitek"><code>@​VojtechVitek</code></a>
in <a
href="https://redirect.github.com/go-chi/chi/pull/1131">go-chi/chi#1131</a></li>
<li>feat(mux): support http QUERY method ietf rfc10008 by <a
href="https://github.com/VojtechVitek"><code>@​VojtechVitek</code></a>
in <a
href="https://redirect.github.com/go-chi/chi/pull/1132">go-chi/chi#1132</a></li>
<li>ci: pin GitHub Actions to full commit SHAs by <a
href="https://github.com/XananasX7"><code>@​XananasX7</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/1116">go-chi/chi#1116</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/DucMinhNe"><code>@​DucMinhNe</code></a>
made their first contribution in <a
href="https://redirect.github.com/go-chi/chi/pull/1110">go-chi/chi#1110</a></li>
<li><a href="https://github.com/doganarif"><code>@​doganarif</code></a>
made their first contribution in <a
href="https://redirect.github.com/go-chi/chi/pull/1050">go-chi/chi#1050</a></li>
<li><a href="https://github.com/XananasX7"><code>@​XananasX7</code></a>
made their first contribution in <a
href="https://redirect.github.com/go-chi/chi/pull/1116">go-chi/chi#1116</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/go-chi/chi/compare/v5.3.0...v5.3.1">https://github.com/go-chi/chi/compare/v5.3.0...v5.3.1</a></p>
<h2>v5.3.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Use strings.ReplaceAll where applicable by <a
href="https://github.com/JRaspass"><code>@​JRaspass</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/1046">go-chi/chi#1046</a></li>
<li>Propagate inline middlewares across mounted subrouters by <a
href="https://github.com/LukasJenicek"><code>@​LukasJenicek</code></a>
in <a
href="https://redirect.github.com/go-chi/chi/pull/1049">go-chi/chi#1049</a></li>
<li>add go 1.26 to ci by <a
href="https://github.com/pkieltyka"><code>@​pkieltyka</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/1052">go-chi/chi#1052</a></li>
<li>Remove last uses of io/ioutil by <a
href="https://github.com/JRaspass"><code>@​JRaspass</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/1054">go-chi/chi#1054</a></li>
<li>Simplify chi.walk with slices.Concat by <a
href="https://github.com/JRaspass"><code>@​JRaspass</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/1053">go-chi/chi#1053</a></li>
<li>Apply the stringscutprefix modernizer by <a
href="https://github.com/JRaspass"><code>@​JRaspass</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/1051">go-chi/chi#1051</a></li>
<li>Bump minimum Go to 1.23, always use request.Pattern by <a
href="https://github.com/JRaspass"><code>@​JRaspass</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/1048">go-chi/chi#1048</a></li>
<li>middleware: fix httpFancyWriter.ReadFrom double-counting bytes with
Tee by <a
href="https://github.com/alliasgher"><code>@​alliasgher</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/1085">go-chi/chi#1085</a></li>
<li>Fix typo in Route doc comment by <a
href="https://github.com/gouwazi"><code>@​gouwazi</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/1073">go-chi/chi#1073</a></li>
<li>fix: set Request.Pattern from RoutePattern() by <a
href="https://github.com/leno23"><code>@​leno23</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/1097">go-chi/chi#1097</a></li>
<li>feat: middleware.ClientIP, a replacement for middleware.RealIP by <a
href="https://github.com/VojtechVitek"><code>@​VojtechVitek</code></a>
in <a
href="https://redirect.github.com/go-chi/chi/pull/967">go-chi/chi#967</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/LukasJenicek"><code>@​LukasJenicek</code></a>
made their first contribution in <a
href="https://redirect.github.com/go-chi/chi/pull/1049">go-chi/chi#1049</a></li>
<li><a
href="https://github.com/alliasgher"><code>@​alliasgher</code></a> made
their first contribution in <a
href="https://redirect.github.com/go-chi/chi/pull/1085">go-chi/chi#1085</a></li>
<li><a href="https://github.com/gouwazi"><code>@​gouwazi</code></a> made
their first contribution in <a
href="https://redirect.github.com/go-chi/chi/pull/1073">go-chi/chi#1073</a></li>
<li><a href="https://github.com/leno23"><code>@​leno23</code></a> made
their first contribution in <a
href="https://redirect.github.com/go-chi/chi/pull/1097">go-chi/chi#1097</a></li>
</ul>
<h2>SECURITY: middleware.ClientIP, a replacement for
middleware.RealIP</h2>
<p><a
href="https://github.com/VojtechVitek"><code>@​VojtechVitek</code></a>
submitted PR <a
href="https://redirect.github.com/go-chi/chi/issues/967">#967</a>, which
introduces middleware.ClientIP — a replacement for middleware.RealIP
that closes the three open spoofing advisories:</p>
<ul>
<li><a
href="https://github.com/go-chi/chi/security/advisories/GHSA-9g5q-2w5x-hmxf">GHSA-9g5q-2w5x-hmxf</a>
— IP spoofing via XFF in <code>RemoteAddr</code> resolution
(convto)</li>
<li><a
href="https://github.com/go-chi/chi/security/advisories/GHSA-rjr7-jggh-pgcp">GHSA-rjr7-jggh-pgcp</a>
— RealIP allows IP spoofing via unvalidated XFF (rezmoss)</li>
<li><a
href="https://github.com/go-chi/chi/security/advisories/GHSA-3fxj-6jh8-hvhx">GHSA-3fxj-6jh8-hvhx</a>
— IP spoofing in <code>middleware.RealIP</code> (Saku0512, Critical /
9.3)</li>
</ul>
<p>It also addresses issues outlined at:</p>
<ul>
<li><a
href="https://redirect.github.com/go-chi/chi/issues/708">go-chi/chi#708</a></li>
<li><a
href="https://adam-p.ca/blog/2022/03/x-forwarded-for/">https://adam-p.ca/blog/2022/03/x-forwarded-for/</a></li>
<li><a
href="https://redirect.github.com/go-chi/chi/issues/711">go-chi/chi#711</a></li>
<li><a
href="https://redirect.github.com/go-chi/chi/issues/453">go-chi/chi#453</a></li>
<li><a
href="https://redirect.github.com/go-chi/chi/pull/908">go-chi/chi#908</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/go-chi/chi/commit/8b258c7bb28f97a5f2a856ff7ef962578fec9215"><code>8b258c7</code></a>
ci: pin GitHub Actions to full commit SHAs (<a
href="https://redirect.github.com/go-chi/chi/issues/1116">#1116</a>)</li>
<li><a
href="https://github.com/go-chi/chi/commit/caf87e6e1bd9f29326f2ffdb93d8098139f08e4f"><code>caf87e6</code></a>
feat(mux): support http QUERY method ietf rfc10008 (<a
href="https://redirect.github.com/go-chi/chi/issues/1132">#1132</a>)</li>
<li><a
href="https://github.com/go-chi/chi/commit/7fcb8a20364d7b72e2d5a0e413ae80346e1c99c8"><code>7fcb8a2</code></a>
middleware: document printPrettyStack and harden NoColor panic test (<a
href="https://redirect.github.com/go-chi/chi/issues/1131">#1131</a>)</li>
<li><a
href="https://github.com/go-chi/chi/commit/878fe71fc9e506a63ea6957ed09c9ce84f789e97"><code>878fe71</code></a>
Fix defaultLogEntry.Panic not respecting NoColor setting (<a
href="https://redirect.github.com/go-chi/chi/issues/1050">#1050</a>)</li>
<li><a
href="https://github.com/go-chi/chi/commit/d7b767bcbea51e486bdc9fd06d25136767ec14b5"><code>d7b767b</code></a>
feat(middleware): add text/xml and application/xml to default
compressible ty...</li>
<li><a
href="https://github.com/go-chi/chi/commit/3b50c7cc35ff25f384202409733c3332c150e0ec"><code>3b50c7c</code></a>
Tidy build directives (<a
href="https://redirect.github.com/go-chi/chi/issues/1113">#1113</a>)</li>
<li><a
href="https://github.com/go-chi/chi/commit/2b9fca258f92830fc8232582e9e05a4d4a572a5d"><code>2b9fca2</code></a>
Honor Discard() in httpFancyWriter.ReadFrom (<a
href="https://redirect.github.com/go-chi/chi/issues/1110">#1110</a>)</li>
<li><a
href="https://github.com/go-chi/chi/commit/3b171578ca44dfd75ca3c5cbddc7b44c600a7b49"><code>3b17157</code></a>
feat: middleware.ClientIP, a replacement for middleware.RealIP (<a
href="https://redirect.github.com/go-chi/chi/issues/967">#967</a>)</li>
<li><a
href="https://github.com/go-chi/chi/commit/818fdcfc4786168651768377ba647cf9dd5b3953"><code>818fdcf</code></a>
fix: set Request.Pattern from RoutePattern() (<a
href="https://redirect.github.com/go-chi/chi/issues/1097">#1097</a>)</li>
<li><a
href="https://github.com/go-chi/chi/commit/f975af0cb10cbefaccf0422385420fe62722d648"><code>f975af0</code></a>
Fix typo in Route doc comment (<a
href="https://redirect.github.com/go-chi/chi/issues/1073">#1073</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/go-chi/chi/compare/v5.2.4...v5.3.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-chi/chi/v5&package-manager=go_modules&previous-version=5.2.4&new-version=5.3.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-07 11:18:07 +00:00
dependabot[bot] 242a10585c chore: bump github.com/klauspost/compress from 1.18.6 to 1.19.0 (#27050) 
Bumps
[github.com/klauspost/compress](https://github.com/klauspost/compress)
from 1.18.6 to 1.19.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/klauspost/compress/releases">github.com/klauspost/compress's
releases</a>.</em></p>
<blockquote>
<h2>v1.19.0</h2>
<h2>What's Changed</h2>
<ul>
<li>zstd: Add true concurrent stream encoding by <a
href="https://github.com/klauspost"><code>@​klauspost</code></a> in <a
href="https://redirect.github.com/klauspost/compress/pull/1136">klauspost/compress#1136</a></li>
<li>zstd: arm64 decoder asm by <a
href="https://github.com/lizthegrey"><code>@​lizthegrey</code></a> in <a
href="https://redirect.github.com/klauspost/compress/pull/1160">klauspost/compress#1160</a></li>
<li>zstd: avoid unused BuildDict encoder allocation by <a
href="https://github.com/snissn"><code>@​snissn</code></a> in <a
href="https://redirect.github.com/klauspost/compress/pull/1147">klauspost/compress#1147</a></li>
<li>flate: Add inflate checkpoints by <a
href="https://github.com/klauspost"><code>@​klauspost</code></a> in <a
href="https://redirect.github.com/klauspost/compress/pull/1154">klauspost/compress#1154</a></li>
<li>snappy/s2: Limit length of varint in <code>decodedLen</code> by <a
href="https://github.com/eustas"><code>@​eustas</code></a> in <a
href="https://redirect.github.com/klauspost/compress/pull/1148">klauspost/compress#1148</a></li>
<li>gzhttp: match qvalue parameter case-insensitively (RFC 7231) by <a
href="https://github.com/z9z"><code>@​z9z</code></a> in <a
href="https://redirect.github.com/klauspost/compress/pull/1149">klauspost/compress#1149</a></li>
<li>zip: add NameDecoder callback for legacy encoding rewrite by <a
href="https://github.com/SAY-5"><code>@​SAY-5</code></a> in <a
href="https://redirect.github.com/klauspost/compress/pull/1150">klauspost/compress#1150</a></li>
<li>huff0: Allow building tables from histogram. by <a
href="https://github.com/klauspost"><code>@​klauspost</code></a> in <a
href="https://redirect.github.com/klauspost/compress/pull/1155">klauspost/compress#1155</a></li>
<li>huff0: Allow building table from oversized histogram. by <a
href="https://github.com/klauspost"><code>@​klauspost</code></a> in <a
href="https://redirect.github.com/klauspost/compress/pull/1156">klauspost/compress#1156</a></li>
<li>s2sx: Clean symlink targets by <a
href="https://github.com/klauspost"><code>@​klauspost</code></a> in <a
href="https://redirect.github.com/klauspost/compress/pull/1163">klauspost/compress#1163</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/snissn"><code>@​snissn</code></a> made
their first contribution in <a
href="https://redirect.github.com/klauspost/compress/pull/1147">klauspost/compress#1147</a></li>
<li><a href="https://github.com/eustas"><code>@​eustas</code></a> made
their first contribution in <a
href="https://redirect.github.com/klauspost/compress/pull/1148">klauspost/compress#1148</a></li>
<li><a href="https://github.com/z9z"><code>@​z9z</code></a> made their
first contribution in <a
href="https://redirect.github.com/klauspost/compress/pull/1149">klauspost/compress#1149</a></li>
<li><a href="https://github.com/SAY-5"><code>@​SAY-5</code></a> made
their first contribution in <a
href="https://redirect.github.com/klauspost/compress/pull/1150">klauspost/compress#1150</a></li>
<li><a
href="https://github.com/HNO3Miracle"><code>@​HNO3Miracle</code></a>
made their first contribution in <a
href="https://redirect.github.com/klauspost/compress/pull/1165">klauspost/compress#1165</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/klauspost/compress/compare/v1.18.6...v1.19.0">https://github.com/klauspost/compress/compare/v1.18.6...v1.19.0</a></p>
<h2>v1.18.7</h2>
<ul>
<li>Fix s2.NewDict OOB read.</li>
</ul>
<p>Security release without other changes.</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/klauspost/compress/compare/v1.18.6...v1.18.7">https://github.com/klauspost/compress/compare/v1.18.6...v1.18.7</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/klauspost/compress/commit/f0953f938f77977980c3b9f8c09eec06f2e88a69"><code>f0953f9</code></a>
flate: fix buffer formatting in tests (<a
href="https://redirect.github.com/klauspost/compress/issues/1165">#1165</a>)</li>
<li><a
href="https://github.com/klauspost/compress/commit/ab2e3cc7ab261c8f287639760d8532afb7125425"><code>ab2e3cc</code></a>
zstd: Add arm64 decoder asm (<a
href="https://redirect.github.com/klauspost/compress/issues/1160">#1160</a>)</li>
<li><a
href="https://github.com/klauspost/compress/commit/bb2723d55de85353fd5a1817cbc382997a6a75aa"><code>bb2723d</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536"><code>539243b</code></a>
s2sx: Clean symlink targets (<a
href="https://redirect.github.com/klauspost/compress/issues/1163">#1163</a>)</li>
<li><a
href="https://github.com/klauspost/compress/commit/bd9228c884559c21e572a0eaf827ee903bca805c"><code>bd9228c</code></a>
Apply go fix and check in CI (<a
href="https://redirect.github.com/klauspost/compress/issues/1158">#1158</a>)</li>
<li><a
href="https://github.com/klauspost/compress/commit/4cc176c3325ba1d87aacfdea015a3a2038fefb08"><code>4cc176c</code></a>
zstd: Add true concurrent stream encoding (<a
href="https://redirect.github.com/klauspost/compress/issues/1136">#1136</a>)</li>
<li><a
href="https://github.com/klauspost/compress/commit/4705fcbaf5155f466ca877527f66e88634cdf1c2"><code>4705fcb</code></a>
build(deps): bump the github-actions group with 3 updates (<a
href="https://redirect.github.com/klauspost/compress/issues/1157">#1157</a>)</li>
<li><a
href="https://github.com/klauspost/compress/commit/e9c2e569c112ecc1ad8ab818ed7328e7178973e4"><code>e9c2e56</code></a>
huff0: Allow building table from oversized histogram. (<a
href="https://redirect.github.com/klauspost/compress/issues/1156">#1156</a>)</li>
<li><a
href="https://github.com/klauspost/compress/commit/ecdb779d8745b0b074dcee75d9f7fd2bd524aff8"><code>ecdb779</code></a>
huff0: Allow building tables from histogram. (<a
href="https://redirect.github.com/klauspost/compress/issues/1155">#1155</a>)</li>
<li><a
href="https://github.com/klauspost/compress/commit/38efa458d47cc5555ce4a08796ddf2bf5ca22d87"><code>38efa45</code></a>
zip: add NameDecoder callback for legacy encoding rewrite (<a
href="https://redirect.github.com/klauspost/compress/issues/1150">#1150</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/klauspost/compress/compare/v1.18.6...v1.19.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/klauspost/compress&package-manager=go_modules&previous-version=1.18.6&new-version=1.19.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-07 11:17:50 +00:00
dependabot[bot] a575899f47 chore: bump golang.org/x/text from 0.38.0 to 0.39.0 in the x group (#27049) 
Bumps the x group with 1 update:
[golang.org/x/text](https://github.com/golang/text).

Updates `golang.org/x/text` from 0.38.0 to 0.39.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/text/commit/b326f3d3c814ab79b3c516f4ac03c2314d8df65f"><code>b326f3d</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="https://github.com/golang/text/commit/5ae8e578e495731553eddba11b2d0e86c91a00ce"><code>5ae8e57</code></a>
unicode/norm: avoid infinite loop on invalid input</li>
<li><a
href="https://github.com/golang/text/commit/0dc94a239c8bc3b7ef3aa0d059e54af960f459f4"><code>0dc94a2</code></a>
all: fix some comments</li>
<li>See full diff in <a
href="https://github.com/golang/text/compare/v0.38.0...v0.39.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/text&package-manager=go_modules&previous-version=0.38.0&new-version=0.39.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-07 11:17:43 +00:00
Sas Swart fc188fdaee fix: create agent firewall sessions without requiring agent read access (#26990) 
## Overview

Part of the **boundary correlation** feature. Fixes lazy creation of
`boundary_sessions` rows so it works within the agent's RBAC
constraints, and consumes the new `ConfinedProcessName` field reported
by boundary.

Pairs with coder/boundary#206, which adds `ConfinedProcessName` to
`ReportBoundaryLogsRequest`. This branch bumps the
`github.com/coder/boundary` module to pick up that work.

## Problem

`ensureSession` did a pre-insert existence check via
`GetBoundarySessionByID`. Agents are **not permitted to read boundary
sessions**, so that read path is not viable when the session is created
from an agent-reported log batch.

## Changes

- **Remove the pre-insert read.** `ensureSession` now inserts directly
and treats a primary-key unique violation as success, covering sessions
already created by a prior batch, a reconnection, or another coderd
replica — without requiring read access.
- **Per-connection guard.** Add a mutex-protected `ensuredSessions` set
so repeated log batches on the same connection skip the existence check
and insert entirely, touching the database only for the logs. On a
transient insert failure the session is left unmarked so the next batch
retries.
- **Consume `ConfinedProcessName`.** Pass `req.GetConfinedProcessName()`
through to the session insert.
- **Bump boundary module** from `v0.9.0` to
`v0.9.1-0.20260706095856-35ba90f9e8b2`.
- **Tests.**
- Add `TestReportBoundaryLogsAgentRBAC`
(`coderd/boundary_logs_test.go`), an integration test that connects as a
real workspace agent, verifies the session and log are persisted under
agent RBAC, and asserts the agent subject cannot read boundary sessions
— guarding against reintroducing a pre-insert read.
- Add `TestReportBoundaryLogsSessionGuard` (session inserted once across
two batches, logs inserted per batch) and
`TestReportBoundaryLogsSessionRetriedOnError` (insert retried after a
transient error).
- Regenerate `agent-firewall` CLI docs/golden files and adjust the
clidocgen template to render the YAML path when a flag has no long name.

> 🤖 This PR was opened by Coder Agents on behalf of @SasSwart.
 2026-07-07 10:42:01 +00:00
Denis Afonso f77d0065ed fix: correct gvisor replace directive to match module path (#26822) 
## Summary

Fixes the gvisor `replace` directive in `go.mod` to target the correct
module path.

## Problem

PR #23055 added a replace directive to use the coder/gvisor fork (which
fixes an integer overflow causing `panic: length < 0` crashes). However,
the directive targeted the wrong module path:

```
replace gvisor.dev => github.com/coder/gvisor v0.0.0-20260313164934-7a658db7b714
```

The actual module path declared in gvisor's `go.mod` is
`gvisor.dev/gvisor`, not `gvisor.dev`. Go module replace directives
require an exact module path match, so the previous directive was a
no-op and the patched fork was never used.

## Fix

```diff
-replace gvisor.dev => github.com/coder/gvisor v0.0.0-20260313164934-7a658db7b714
+replace gvisor.dev/gvisor => github.com/coder/gvisor v0.0.0-20260313164934-7a658db7b714
```

## Validation

Verified locally with `go list -m`:

**Before (no-op replace):**
```
$ go list -m gvisor.dev/gvisor
gvisor.dev/gvisor v0.0.0-20240509041132-65b30f7869dc
```

**After (correct replace):**
```
$ go list -m gvisor.dev/gvisor
gvisor.dev/gvisor v0.0.0-20240509041132-65b30f7869dc => github.com/coder/gvisor v0.0.0-20260313164934-7a658db7b714
```

The `=>` confirms the fork is now applied.


Fixes https://github.com/coder/coder/issues/20885

---

<details>
<summary>Investigation context</summary>

- The coder/gvisor fork (commit `7a658db7b714`) declares `module
gvisor.dev/gvisor` in its go.mod
- Customer runtime stack traces show
`gvisor.dev/gvisor@v0.0.0-20240509041132-65b30f7869dc` (unpatched
upstream), confirming the fork was not applied
- The crash is `panic: length < 0` in
`gvisor.dev/gvisor/pkg/tcpip/transport/tcp.(*sender).splitSeg`
- Related Linear ticket: ENT-118

</details>

---
*Generated by [Coder Agents](https://coder.com/agents) on behalf of
@denisra*
 2026-07-01 17:11:47 +01:00
dependabot[bot] 681d77154b chore: bump github.com/valyala/fasthttp from 1.71.0 to 1.72.0 (#26859) 
Bumps [github.com/valyala/fasthttp](https://github.com/valyala/fasthttp)
from 1.71.0 to 1.72.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/valyala/fasthttp/releases">github.com/valyala/fasthttp's
releases</a>.</em></p>
<blockquote>
<h2>v1.72.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update to go1.25 as minimal version by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2205">valyala/fasthttp#2205</a></li>
<li>client: add aggregate connection count metrics by <a
href="https://github.com/z9z"><code>@​z9z</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2201">valyala/fasthttp#2201</a></li>
<li>fix(server): return ErrMissingFile when MultipartForm.File is nil by
<a href="https://github.com/u5surf"><code>@​u5surf</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2260">valyala/fasthttp#2260</a></li>
<li>bug: FS cache cleaner goroutine leaks when CleanStop is nil
(default) (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2218">#2218</a>),
<a
href="https://redirect.github.com/valyala/fasthttp/issues/2247">#2247</a>
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2271">valyala/fasthttp#2271</a></li>
<li>bug: data race on pipeline client c.chR during worker drain (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2220">#2220</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2272">valyala/fasthttp#2272</a></li>
<li>bug: TCPDialer.tcpAddrsClean() goroutine leaks — no shutdown
mechanism (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2222">#2222</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2273">valyala/fasthttp#2273</a></li>
<li>bug: double concurrency counter increment in ServeConn causes
counter leak (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2238">#2238</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2275">valyala/fasthttp#2275</a></li>
<li>bug: body stream leak in compression methods when response is
discarded (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2244">#2244</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2276">valyala/fasthttp#2276</a></li>
<li>bug: InMemoryListener deadlock under high concurrency (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2245">#2245</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2277">valyala/fasthttp#2277</a></li>
<li>bug: fasthttpadaptor writer leak, data race, and crash on handler
panic (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2246">#2246</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2278">valyala/fasthttp#2278</a></li>
<li>bug: fasthttpproxy dialers return nil DialFunc on error, causing
panic (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2248">#2248</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2279">valyala/fasthttp#2279</a></li>
<li>bug: closeIdleConns TOCTOU race with serveConn idle timestamp (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2250">#2250</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2280">valyala/fasthttp#2280</a></li>
<li>bug: AppendCert/AppendCertEmbed not thread-safe (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2251">#2251</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2281">valyala/fasthttp#2281</a></li>
<li>bug: SetBodySizePoolLimit data race — plain int written without
synchronization (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2252">#2252</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2282">valyala/fasthttp#2282</a></li>
<li>bug: file descriptor leak in prefork parent process (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2253">#2253</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2283">valyala/fasthttp#2283</a></li>
<li>security: SO_REUSEADDR on Windows enables port hijacking (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2254">#2254</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2284">valyala/fasthttp#2284</a></li>
<li>bug: file descriptor leak on z/OS s390x when FcntlInt fails (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2255">#2255</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2285">valyala/fasthttp#2285</a></li>
<li>bug: filesLockMap grows unboundedly, leaking memory (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2256">#2256</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2286">valyala/fasthttp#2286</a></li>
<li>security: TLS verification silently disabled for malformed addresses
(<a
href="https://redirect.github.com/valyala/fasthttp/issues/2236">#2236</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2274">valyala/fasthttp#2274</a></li>
<li>fix(fs): remove temporary file when compression fails by <a
href="https://github.com/u5surf"><code>@​u5surf</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2264">valyala/fasthttp#2264</a></li>
<li>fix double release of streamed client response body by <a
href="https://github.com/Mereng"><code>@​Mereng</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2211">valyala/fasthttp#2211</a></li>
<li>fix(client): switch to GET on 303 redirect per RFC 9110 by <a
href="https://github.com/u5surf"><code>@​u5surf</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2265">valyala/fasthttp#2265</a></li>
<li>ci: re-enable gocritic deferInLoop check for non-test code by <a
href="https://github.com/u5surf"><code>@​u5surf</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2288">valyala/fasthttp#2288</a></li>
<li>Fix flaky race tests by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2292">valyala/fasthttp#2292</a></li>
<li>fix(lbclient): prevent deadlock when all clients are removed by <a
href="https://github.com/u5surf"><code>@​u5surf</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2287">valyala/fasthttp#2287</a></li>
<li>reject duplicate Content-Length in response header parser by <a
href="https://github.com/alhudz"><code>@​alhudz</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2294">valyala/fasthttp#2294</a></li>
<li>strip cr/lf from header keys in normalizeHeaderKey by <a
href="https://github.com/alhudz"><code>@​alhudz</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2295">valyala/fasthttp#2295</a></li>
<li>fix(client): guard nil waiter in decConnsCount by <a
href="https://github.com/SAY-5"><code>@​SAY-5</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2266">valyala/fasthttp#2266</a></li>
<li>strip semicolons from cookie setters to block attribute injection by
<a href="https://github.com/alhudz"><code>@​alhudz</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2298">valyala/fasthttp#2298</a></li>
<li>feat(prefork): graceful shutdown, leak fixes, hook robustness
(re-open of <a
href="https://redirect.github.com/valyala/fasthttp/issues/2180">#2180</a>
follow-up) by <a
href="https://github.com/ReneWerner87"><code>@​ReneWerner87</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2199">valyala/fasthttp#2199</a></li>
<li>fix: prevent data race on FSCompressedFileSuffixes map by <a
href="https://github.com/xbrxr03"><code>@​xbrxr03</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2300">valyala/fasthttp#2300</a></li>
<li>reject duplicate Transfer-Encoding in request header parser by <a
href="https://github.com/alhudz"><code>@​alhudz</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2303">valyala/fasthttp#2303</a></li>
<li>preserve duplicate request headers in ConvertRequest by <a
href="https://github.com/alhudz"><code>@​alhudz</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2305">valyala/fasthttp#2305</a></li>
<li>fix(server): close listener on serve error in ListenAndServe helpers
by <a href="https://github.com/fereidani"><code>@​fereidani</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2304">valyala/fasthttp#2304</a></li>
<li>validate trailer values in parseTrailer by <a
href="https://github.com/alhudz"><code>@​alhudz</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2301">valyala/fasthttp#2301</a></li>
<li>Avoid default content type for empty requests by <a
href="https://github.com/nkgotcode"><code>@​nkgotcode</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2296">valyala/fasthttp#2296</a></li>
<li>chore(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2210">valyala/fasthttp#2210</a></li>
<li>chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2209">valyala/fasthttp#2209</a></li>
<li>chore(deps): bump golang.org/x/sys from 0.44.0 to 0.45.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2208">valyala/fasthttp#2208</a></li>
<li>chore(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2207">valyala/fasthttp#2207</a></li>
<li>chore(deps): bump securego/gosec from 2.26.1 to 2.27.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2261">valyala/fasthttp#2261</a></li>
<li>chore(deps): bump securego/gosec from 2.27.0 to 2.27.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2267">valyala/fasthttp#2267</a></li>
<li>chore(deps): bump golang.org/x/sys from 0.45.0 to 0.46.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2289">valyala/fasthttp#2289</a></li>
<li>chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2290">valyala/fasthttp#2290</a></li>
<li>chore(deps): bump golang.org/x/net from 0.55.0 to 0.56.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2291">valyala/fasthttp#2291</a></li>
<li>chore(deps): bump actions/checkout from 6 to 7 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2297">valyala/fasthttp#2297</a></li>
</ul>
<h2>New Contributors</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/valyala/fasthttp/commit/37a31d78c5d221b24b9cb6652481b5acd4dd674f"><code>37a31d7</code></a>
Avoid default content type for empty requests (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2296">#2296</a>)</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/d93cb94af2c31641d00025140785609ddd746eb3"><code>d93cb94</code></a>
validate trailer values in parseTrailer (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2301">#2301</a>)</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/9d21d3546ab1d8422b0b5b2801e46aef568619ce"><code>9d21d35</code></a>
Remove unused uint322ip, inline ip2uint32</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/eb82c9a13addbe488f69cbf530444bb2561fd083"><code>eb82c9a</code></a>
Reject invalid cookie values during parsing</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/598e2e06218dbcaf4da6b3723477effd9d7b6233"><code>598e2e0</code></a>
fix(server): close listener on serve error in ListenAndServe helpers (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2304">#2304</a>)</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/134a8fedab6eb02fda4b8d96c48d2a72082d2e0c"><code>134a8fe</code></a>
preserve duplicate request headers in ConvertRequest (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2305">#2305</a>)</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/7bca504536636cf77726f3018365626a8b975b5f"><code>7bca504</code></a>
reject duplicate Transfer-Encoding in request header parser (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2303">#2303</a>)</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/9ee3c15997f8ab21519c2728017e9fbff03fe142"><code>9ee3c15</code></a>
docs: document FSCompressedFileSuffixes is not safe for concurrent
modificati...</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/2c1590038fa5d0e04896c8b0aafc138ce286bfa7"><code>2c15900</code></a>
feat(prefork): graceful shutdown, leak fixes, hook robustness (re-open
of <a
href="https://redirect.github.com/valyala/fasthttp/issues/21">#21</a>...</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/ec58c6e67ee8f608a673cc01f07f045d04fa17b5"><code>ec58c6e</code></a>
strip semicolons from cookie setters to block attribute injection (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2298">#2298</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/valyala/fasthttp/compare/v1.71.0...v1.72.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/valyala/fasthttp&package-manager=go_modules&previous-version=1.71.0&new-version=1.72.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-30 11:18:33 +00:00
dependabot[bot] 33780758c1 chore: bump github.com/open-policy-agent/opa from 1.17.0 to 1.18.1 (#26858) 
Bumps
[github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa)
from 1.17.0 to 1.18.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/open-policy-agent/opa/releases">github.com/open-policy-agent/opa's
releases</a>.</em></p>
<blockquote>
<h2>v1.18.1</h2>
<p>This release fixes a memory leak introduced in OPA v1.17.0. It is
advised to update if you notice excess memory usage when running OPA
server.</p>
<h3>Fixes</h3>
<ul>
<li>ast: fix AnnotationSet memory leak via runtime.AddCleanup cycle (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8817">#8817</a>)
authored by <a
href="https://github.com/srenatus"><code>@​srenatus</code></a> reported
by <a href="https://github.com/keydon"><code>@​keydon</code></a> and <a
href="https://github.com/gorsr01"><code>@​gorsr01</code></a></li>
</ul>
<h2>v1.18.0</h2>
<p>This release contains a mix of bugfixes and small features.
Notably:</p>
<ul>
<li>A breaking fix to the outbound <code>User-Agent</code> header so it
conforms to RFC 9110 (see below)</li>
<li>Container-aware resource limits: automatic <code>GOMAXPROCS</code>
is restored and automatic <code>GOMEMLIMIT</code> is now supported</li>
<li>Several <code>opa fmt</code> correctness fixes</li>
<li>Improvements to <code>opa test --coverage</code> (ranges in report,
inline rule head tracking, conjunction-expression coverage)</li>
</ul>
<h3>Breaking: Fix User-Agent according to RFC9110 (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8792">#8792</a>)</h3>
<p>OPA's outbound HTTP requests (bundle, discovery, decision log,
status, <code>http.send</code>, AWS KMS/ECR)
previously sent <code>User-Agent: Open Policy Agent/&lt;version&gt;
(&lt;os&gt;, &lt;arch&gt;)</code>, which is not a valid
RFC 9110 <code>User-Agent</code> value because the <code>product</code>
token cannot contain spaces. The header is now
<code>Open-Policy-Agent/&lt;version&gt; (&lt;os&gt;,
&lt;arch&gt;)</code>. Server-side log filters or WAF rules that
exact-match the old string will need to be updated.</p>
<p>Authored by <a
href="https://github.com/sspaink"><code>@​sspaink</code></a>, reported
by <a href="https://github.com/SpecLad"><code>@​SpecLad</code></a></p>
<h3>Runtime, SDK, Tooling</h3>
<ul>
<li>bundle: fix per-module rego version lookup (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8797">#8797</a>)
authored by <a
href="https://github.com/sspaink"><code>@​sspaink</code></a>, reported
by <a
href="https://github.com/xubinzheng"><code>@​xubinzheng</code></a></li>
<li>bundle: improve determinism of <code>file_rego_versions</code>
patterns with overlap (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8733">#8733</a>)
authored by <a
href="https://github.com/philipaconrad"><code>@​philipaconrad</code></a></li>
<li>cover: Track inline rule head in post trace walk (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/6531">#6531</a>)
authored by <a
href="https://github.com/charlieegan3"><code>@​charlieegan3</code></a>,
reported by <a
href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li>
<li>cover: Update report to include ranges (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8748">#8748</a>)
reported and authored by <a
href="https://github.com/charlieegan3"><code>@​charlieegan3</code></a></li>
<li>cover: Add support for coverage of conjunction exprs (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8809">#8809</a>)
authored by <a
href="https://github.com/charlieegan3"><code>@​charlieegan3</code></a></li>
<li>download/oci: Set Accept headers (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8720">#8720</a>)
authored by <a
href="https://github.com/charlieegan3"><code>@​charlieegan3</code></a></li>
<li>fmt: preserve the multiline but single entry iterables (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8557">#8557</a>)
authored by <a
href="https://github.com/unichronic"><code>@​unichronic</code></a>,
reported by <a
href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li>
<li>format: Fix dropped with-clause after comment in object value (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8765">#8765</a>)
authored by <a
href="https://github.com/sspaink"><code>@​sspaink</code></a>, reported
by <a
href="https://github.com/srabraham"><code>@​srabraham</code></a></li>
<li>format: keep lone <code>with</code> on the closing-bracket line of
multi-line expressions (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8804">#8804</a>)
authored by <a
href="https://github.com/anneheartrecord"><code>@​anneheartrecord</code></a>,
reported by <a
href="https://github.com/burnster"><code>@​burnster</code></a></li>
<li>oracle: Fix find-definition on expressions inside
<code>ast.Not</code> nodes (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8731">#8731</a>)
authored by <a
href="https://github.com/johanfylling"><code>@​johanfylling</code></a></li>
<li>runtime: Restore goautomaxprocs, add automemlimit (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8784">#8784</a>)
authored by <a
href="https://github.com/charlieegan3"><code>@​charlieegan3</code></a></li>
</ul>
<h3>Compiler, Topdown and Rego</h3>
<ul>
<li>ast: Apply location to inner <code>ast.Not</code> expressions (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8717">#8717</a>)
authored by <a
href="https://github.com/johanfylling"><code>@​johanfylling</code></a>,
reported by <a
href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li>
<li>ast: Clean up code for value comparisons (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8737">#8737</a>)
authored by <a
href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li>
<li>ast: Fix PE regression for <code>future.keywords.not</code> negation
inside <code>every</code> (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8781">#8781</a>)
authored by <a
href="https://github.com/johanfylling"><code>@​johanfylling</code></a></li>
<li>internal/edittree: Add recursive tree node recycling (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8693">#8693</a>)
authored by <a
href="https://github.com/philipaconrad"><code>@​philipaconrad</code></a></li>
<li>internal: compile,planner: improve determinism of
<code>plan</code>/<code>wasm</code> bundle builds (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8732">#8732</a>)
authored by <a
href="https://github.com/philipaconrad"><code>@​philipaconrad</code></a></li>
<li>perf: avoid allocations in <code>object.get</code> (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8729">#8729</a>)
authored by <a
href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li>
<li>topdown: Fix PE not namespacing vars in comprehensions nested inside
<code>every</code> (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8816">#8816</a>)
authored by <a
href="https://github.com/johanfylling"><code>@​johanfylling</code></a></li>
<li>topdown: remove <code>dst.Compare(src)</code> shortcut (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8739">#8739</a>)
authored by <a
href="https://github.com/srenatus"><code>@​srenatus</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md">github.com/open-policy-agent/opa's
changelog</a>.</em></p>
<blockquote>
<h1>Change Log</h1>
<p>All notable changes to this project will be documented in this file.
This
project adheres to <a href="http://semver.org/">Semantic
Versioning</a>.</p>
<h2>Unreleased</h2>
<h2>1.18.0</h2>
<p>This release contains a mix of bugfixes and small features.
Notably:</p>
<ul>
<li>A breaking fix to the outbound <code>User-Agent</code> header so it
conforms to RFC 9110 (see below)</li>
<li>Container-aware resource limits: automatic <code>GOMAXPROCS</code>
is restored and automatic <code>GOMEMLIMIT</code> is now supported</li>
<li>Several <code>opa fmt</code> correctness fixes</li>
<li>Improvements to <code>opa test --coverage</code> (ranges in report,
inline rule head tracking, conjunction-expression coverage)</li>
</ul>
<h3>Breaking: Fix User-Agent according to RFC9110 (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8792">#8792</a>)</h3>
<p>OPA's outbound HTTP requests (bundle, discovery, decision log,
status, <code>http.send</code>, AWS KMS/ECR)
previously sent <code>User-Agent: Open Policy Agent/&lt;version&gt;
(&lt;os&gt;, &lt;arch&gt;)</code>, which is not a valid
RFC 9110 <code>User-Agent</code> value because the <code>product</code>
token cannot contain spaces. The header is now
<code>Open-Policy-Agent/&lt;version&gt; (&lt;os&gt;,
&lt;arch&gt;)</code>. Server-side log filters or WAF rules that
exact-match the old string will need to be updated.</p>
<p>Authored by <a
href="https://github.com/sspaink"><code>@​sspaink</code></a>, reported
by <a href="https://github.com/SpecLad"><code>@​SpecLad</code></a></p>
<h3>Runtime, SDK, Tooling</h3>
<ul>
<li>bundle: fix per-module rego version lookup (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8797">#8797</a>)
authored by <a
href="https://github.com/sspaink"><code>@​sspaink</code></a>, reported
by <a
href="https://github.com/xubinzheng"><code>@​xubinzheng</code></a></li>
<li>bundle: improve determinism of <code>file_rego_versions</code>
patterns with overlap (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8733">#8733</a>)
authored by <a
href="https://github.com/philipaconrad"><code>@​philipaconrad</code></a></li>
<li>cover: Track inline rule head in post trace walk (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/6531">#6531</a>)
authored by <a
href="https://github.com/charlieegan3"><code>@​charlieegan3</code></a>,
reported by <a
href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li>
<li>cover: Update report to include ranges (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8748">#8748</a>)
reported and authored by <a
href="https://github.com/charlieegan3"><code>@​charlieegan3</code></a></li>
<li>cover: Add support for coverage of conjunction exprs (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8809">#8809</a>)
authored by <a
href="https://github.com/charlieegan3"><code>@​charlieegan3</code></a></li>
<li>download/oci: Set Accept headers (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8720">#8720</a>)
authored by <a
href="https://github.com/charlieegan3"><code>@​charlieegan3</code></a></li>
<li>fmt: preserve the multiline but single entry iterables (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8557">#8557</a>)
authored by <a
href="https://github.com/unichronic"><code>@​unichronic</code></a>,
reported by <a
href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li>
<li>format: Fix dropped with-clause after comment in object value (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8765">#8765</a>)
authored by <a
href="https://github.com/sspaink"><code>@​sspaink</code></a>, reported
by <a
href="https://github.com/srabraham"><code>@​srabraham</code></a></li>
<li>format: keep lone <code>with</code> on the closing-bracket line of
multi-line expressions (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8804">#8804</a>)
authored by <a
href="https://github.com/anneheartrecord"><code>@​anneheartrecord</code></a>,
reported by <a
href="https://github.com/burnster"><code>@​burnster</code></a></li>
<li>oracle: Fix find-definition on expressions inside
<code>ast.Not</code> nodes (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8731">#8731</a>)
authored by <a
href="https://github.com/johanfylling"><code>@​johanfylling</code></a></li>
<li>runtime: Restore goautomaxprocs, add automemlimit (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8784">#8784</a>)
authored by <a
href="https://github.com/charlieegan3"><code>@​charlieegan3</code></a></li>
</ul>
<h3>Compiler, Topdown and Rego</h3>
<ul>
<li>ast: Apply location to inner <code>ast.Not</code> expressions (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8717">#8717</a>)
authored by <a
href="https://github.com/johanfylling"><code>@​johanfylling</code></a>,
reported by <a
href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li>
<li>ast: Clean up code for value comparisons (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8737">#8737</a>)
authored by <a
href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li>
<li>ast: Fix PE regression for <code>future.keywords.not</code> negation
inside <code>every</code> (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8781">#8781</a>)
authored by <a
href="https://github.com/johanfylling"><code>@​johanfylling</code></a></li>
<li>internal/edittree: Add recursive tree node recycling (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8693">#8693</a>)
authored by <a
href="https://github.com/philipaconrad"><code>@​philipaconrad</code></a></li>
<li>internal: compile,planner: improve determinism of
<code>plan</code>/<code>wasm</code> bundle builds (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8732">#8732</a>)
authored by <a
href="https://github.com/philipaconrad"><code>@​philipaconrad</code></a></li>
<li>perf: avoid allocations in <code>object.get</code> (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8729">#8729</a>)
authored by <a
href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li>
<li>topdown: Fix PE not namespacing vars in comprehensions nested inside
<code>every</code> (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8816">#8816</a>)
authored by <a
href="https://github.com/johanfylling"><code>@​johanfylling</code></a></li>
<li>topdown: remove <code>dst.Compare(src)</code> shortcut (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8739">#8739</a>)
authored by <a
href="https://github.com/srenatus"><code>@​srenatus</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/open-policy-agent/opa/commit/acc8bf9f88bbef57c500dbdd7231509e48ade525"><code>acc8bf9</code></a>
Release v1.18.1</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/713dc6a42757e4b175ec8f74d58e341f89004467"><code>713dc6a</code></a>
ast: fix AnnotationSet memory leak via runtime.AddCleanup cycle</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/cc2c5c60a4c486f15a5e8de457e96ed0fefaf5fe"><code>cc2c5c6</code></a>
Prepare v1.18 release (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8820">#8820</a>)</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/e72a98fb10b43cfc4067568de8909c669e8a1b79"><code>e72a98f</code></a>
format: keep lone <code>with</code> on the closing-bracket line of
multi-line expression...</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/03646dde18924c2c74a13526e4cea408dcbb4481"><code>03646dd</code></a>
topdown: Fix PE not namespacing vars in comprehensions nested inside
<code>every</code> ...</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/bf2bb5261cf84958c295dd74e763837e2c021fd8"><code>bf2bb52</code></a>
benchmarks: split off script, emit markdown table</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/02ce276093b85d101172045f0307d53f5f9cc89d"><code>02ce276</code></a>
version: fix ill-formed User-Agent header (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8796">#8796</a>)</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/1fdbb77dd6b7aaf65dffd8c23563df72a59639a3"><code>1fdbb77</code></a>
build(deps): bump the dependencies group across 2 directories with 6
updates</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/954196aaa43841958547b1a0ba564e591d342a67"><code>954196a</code></a>
cover: Add support for coverage of conjunction exprs (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8809">#8809</a>)</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/dec8333b32aed9189721220f3e8101460ebb170f"><code>dec8333</code></a>
deduplicate change-detection output in pr CI checks (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8808">#8808</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-policy-agent/opa/compare/v1.17.0...v1.18.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/open-policy-agent/opa&package-manager=go_modules&previous-version=1.17.0&new-version=1.18.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-30 11:17:30 +00:00
dependabot[bot] d440e71109 chore: bump golang.org/x/tools from 0.46.0 to 0.47.0 in the x group (#26857) 
Bumps the x group with 1 update:
[golang.org/x/tools](https://github.com/golang/tools).

Updates `golang.org/x/tools` from 0.46.0 to 0.47.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/tools/commit/fbf9f2e2c8124fbe1877f5ed2857111038d9fe12"><code>fbf9f2e</code></a>
gopls/internal/cmd: add tests of 'gopls help'</li>
<li><a
href="https://github.com/golang/tools/commit/e891f79e03c0d60a806f959113eb8a748a3dd3fe"><code>e891f79</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="https://github.com/golang/tools/commit/0602b30930e307645a5b43697b316a5599dea9a1"><code>0602b30</code></a>
gopls: revert CLI usability revamp to stabilize release</li>
<li><a
href="https://github.com/golang/tools/commit/60c2434eca161a47c4697fdf65718dc259c1cf5b"><code>60c2434</code></a>
gopls/internal/cmd: fix regression in initialization</li>
<li><a
href="https://github.com/golang/tools/commit/29e158310c709074e3cc2f7f1cd5ab9af11eb13b"><code>29e1583</code></a>
gopls/internal/mcp: go_diagnostics: use idiomatic iterators</li>
<li><a
href="https://github.com/golang/tools/commit/0772d6a918b878bf9983d765a65af011d84483b4"><code>0772d6a</code></a>
go/ssa: add test for fix of <a
href="https://redirect.github.com/golang/go/issues/73871">golang/go#73871</a>
in go/types@go1.25</li>
<li><a
href="https://github.com/golang/tools/commit/0fdde844aba91691351f38a7f1da04354170017e"><code>0fdde84</code></a>
gopls/internal/tool: rename Application to Command and embed in
SubCommand</li>
<li><a
href="https://github.com/golang/tools/commit/bd9e76d9f0ec7faf1dc77d440463c182ac9c348c"><code>bd9e76d</code></a>
go/callgraph/vta: document ssa.InstantiateGenerics requirement</li>
<li><a
href="https://github.com/golang/tools/commit/d711ac7849d4f5456228745090323144c4c2d190"><code>d711ac7</code></a>
go/ssa: remove incorrect hasTypeParams check</li>
<li><a
href="https://github.com/golang/tools/commit/439decda73f3e6449050bcb3a0241ed96d5e74e1"><code>439decd</code></a>
gopls/internal/cache/xrefs: avoid materializing Inspector</li>
<li>Additional commits viewable in <a
href="https://github.com/golang/tools/compare/v0.46.0...v0.47.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/tools&package-manager=go_modules&previous-version=0.46.0&new-version=0.47.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-30 11:15:40 +00:00
Yevhenii Shcherbina 8bf6f43016 feat: support cross-account Bedrock AssumeRole in AI Bridge (#26527) 
# Support IAM role assumption for AWS Bedrock in AI Bridge

## Summary

Implements
https://linear.app/codercom/issue/AIGOV-371/support-dynamic-bedrock-assumerole-across-aws-accounts-for-ai-gateway

A Bedrock provider can now be configured with an IAM role to assume.
Before calling Bedrock, the gateway assumes that role via STS and signs
requests with the resulting temporary credentials. Whether the role
lives in the same account or another one is entirely a matter of the
role's trust policy.

## Problem

Many organizations prohibit long-lived AWS access keys and expect
workloads to authenticate through assumed IAM roles instead. A common
case is an organization that runs Bedrock across several AWS accounts,
one per business unit, and needs each unit's usage billed to its own
account by assuming a role there. AI Bridge previously authenticated a
Bedrock provider only with static keys or the gateway's own ambient AWS
identity, which is shared by every provider, with no way to assume a
role. These deployments had no clean path.

## How it works

When a provider is configured with a role ARN, the gateway uses its base
identity to assume that role via STS and signs Bedrock requests with the
temporary credentials it returns. The base identity is whatever the AWS
default credential chain resolves, IRSA, EKS Pod Identity, EC2 Instance
Profile, or static keys.

Credentials are resolved once when the provider is set up and are then
cached and rotated, so individual requests are served from the cache
rather than triggering a new STS call. A deployment that needs several
roles configures several providers, each pointing at its own role.

## Configuration

The role ARN is part of the Bedrock provider settings and is set through
the AI provider API. It is optional: a provider with no role ARN behaves
exactly as before.

## Scope and trade-offs

- This PR is backend only. The settings UI for the role ARN ships in a
follow-up.
- Configuration is not exposed through environment variables.
Environment-based provider configuration is being phased out in favor of
database-managed providers, so the role ARN is intentionally database
and API only.

Follow-up PR: https://github.com/coder/coder/pull/26578
 2026-06-24 12:03:27 -04:00
Cian Johnston 2d28c1b396 feat: surface template README to agent template tools (#26334) 
Fixes CODAGT-447.

Alternative implementation of https://github.com/coder/coder/pull/26212
and https://github.com/coder/coder/pull/25978

- Adds up to the first 1000 characters of `README.md` (with leading
frontmatter stripped) to `chattool.list_templates` output
- Adds up to 800 characters of `README.md` to `chattool.read_template`.

**Note:** skipping `toolsdk` versions to keep scope small.

> 🤖 Generated by Coder Agents
 2026-06-24 12:32:46 +01:00
Sas Swart cec1b4e886 fix: upgrade coder/boundary to v0.9.0 (#26651) 
Bumps `github.com/coder/boundary` from pseudo-version
`v0.8.4-0.20260304164748-566aeea939ab` to `v0.9.0`.

This picks up the fixes included in the [v0.9.0
release](https://github.com/coder/boundary/releases/tag/v0.9.0),
notably:
- feat: report drop counts to agent via BoundaryStatus
- fix: preserve percent-encoded path when forwarding

Relates to https://linear.app/codercom/issue/AIGOV-424

> Generated by Coder Agents on behalf of @SasSwart
 2026-06-24 10:42:12 +02:00
dependabot[bot] eb4bea6e94 chore: bump github.com/coreos/go-oidc/v3 from 3.18.0 to 3.19.0 (#26608) 
Bumps [github.com/coreos/go-oidc/v3](https://github.com/coreos/go-oidc)
from 3.18.0 to 3.19.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/coreos/go-oidc/releases">github.com/coreos/go-oidc/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.19.0</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: Key refresh should set <code>no-cache</code> to get most up to
date keys by <a
href="https://github.com/Yanni8"><code>@​Yanni8</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/485">coreos/go-oidc#485</a></li>
<li>oidc: add support for validating back-channel logout tokens by <a
href="https://github.com/ericchiang"><code>@​ericchiang</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/486">coreos/go-oidc#486</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Yanni8"><code>@​Yanni8</code></a> made
their first contribution in <a
href="https://redirect.github.com/coreos/go-oidc/pull/485">coreos/go-oidc#485</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/coreos/go-oidc/compare/v3.18.0...v3.19.0">https://github.com/coreos/go-oidc/compare/v3.18.0...v3.19.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/coreos/go-oidc/commit/4204f0b2b0f903070de5f51a459fe5e23faca113"><code>4204f0b</code></a>
oidc: add support for validating back-channel logout tokens</li>
<li><a
href="https://github.com/coreos/go-oidc/commit/f77e01c50994c6ad4f4c3a6ed3e2380bab1f1ff2"><code>f77e01c</code></a>
fix: Key refresh should set no-cache to get most up to date keys</li>
<li>See full diff in <a
href="https://github.com/coreos/go-oidc/compare/v3.18.0...v3.19.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/coreos/go-oidc/v3&package-manager=go_modules&previous-version=3.18.0&new-version=3.19.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-23 11:19:00 +00:00
dependabot[bot] e2333ebd29 chore: bump github.com/prometheus/common from 0.68.1 to 0.69.0 (#26607) 
Bumps
[github.com/prometheus/common](https://github.com/prometheus/common)
from 0.68.1 to 0.69.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/prometheus/common/releases">github.com/prometheus/common's
releases</a>.</em></p>
<blockquote>
<h2>v0.69.0</h2>
<h2>What's Changed</h2>
<ul>
<li>config: strip credentials on cross-host redirects by <a
href="https://github.com/roidelapluie"><code>@​roidelapluie</code></a>
in <a
href="https://redirect.github.com/prometheus/common/pull/901">prometheus/common#901</a></li>
<li>Modernize Go by <a
href="https://github.com/SuperQ"><code>@​SuperQ</code></a> in <a
href="https://redirect.github.com/prometheus/common/pull/919">prometheus/common#919</a></li>
<li>config: make isCrossHostRedirect sticky across the redirect chain by
<a
href="https://github.com/roidelapluie"><code>@​roidelapluie</code></a>
in <a
href="https://redirect.github.com/prometheus/common/pull/920">prometheus/common#920</a></li>
<li>config: check cross-host redirect before OAuth2 token fetch by <a
href="https://github.com/roidelapluie"><code>@​roidelapluie</code></a>
in <a
href="https://redirect.github.com/prometheus/common/pull/921">prometheus/common#921</a></li>
<li>expfmt: fix nil pointer panic when parsing empty braces
&quot;{}&quot; by <a
href="https://github.com/roidelapluie"><code>@​roidelapluie</code></a>
in <a
href="https://redirect.github.com/prometheus/common/pull/922">prometheus/common#922</a></li>
<li>model: reduce allocations in Time.UnmarshalJSON by <a
href="https://github.com/bboreham"><code>@​bboreham</code></a> in <a
href="https://redirect.github.com/prometheus/common/pull/918">prometheus/common#918</a></li>
<li>config: resolve LoadHTTPConfigFile paths relative to the config file
by <a
href="https://github.com/roidelapluie"><code>@​roidelapluie</code></a>
in <a
href="https://redirect.github.com/prometheus/common/pull/925">prometheus/common#925</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/prometheus/common/compare/v0.68.1...v0.69.0">https://github.com/prometheus/common/compare/v0.68.1...v0.69.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/prometheus/common/blob/main/CHANGELOG.md">github.com/prometheus/common's
changelog</a>.</em></p>
<blockquote>
<h2>v0.69.0 / 2026-06-17</h2>
<h3>Security / behavior changes</h3>
<ul>
<li><strong>config: credentials are no longer forwarded across
cross-host redirects.</strong> When <code>FollowRedirects</code> is
enabled, the HTTP client now strips <code>Authorization</code>,
<code>Cookie</code>, <code>Proxy-Authorization</code> and other
sensitive headers, and skips basic-auth, bearer-token and OAuth2
credentials, when a redirect points to a different host. This aligns
with Go's <code>net/http</code> behavior. Callers that relied on
credentials being sent to a redirect target on another host will need to
target that host directly. <a
href="https://redirect.github.com/prometheus/common/issues/901">#901</a>
<a
href="https://redirect.github.com/prometheus/common/issues/920">#920</a>
<a
href="https://redirect.github.com/prometheus/common/issues/921">#921</a></li>
<li>config: <code>LoadHTTPConfigFile</code> now resolves relative file
paths (e.g. <code>*_file</code> credentials, <code>http_headers</code>
files) against the config file's own directory instead of its parent
directory. Configs that worked around the old behavior by prefixing
paths with the config's directory name must drop that prefix. <a
href="https://redirect.github.com/prometheus/common/issues/925">#925</a></li>
</ul>
<h3>Bugfixes</h3>
<ul>
<li>expfmt: fix nil pointer panic when parsing empty braces
<code>{}</code>. <a
href="https://redirect.github.com/prometheus/common/issues/922">#922</a></li>
<li>model: fix <code>Time.UnmarshalJSON</code> for larger negative
numbers. <a
href="https://redirect.github.com/prometheus/common/issues/918">#918</a></li>
</ul>
<h3>Performance</h3>
<ul>
<li>model: reduce allocations in <code>Time.UnmarshalJSON</code>. <a
href="https://redirect.github.com/prometheus/common/issues/918">#918</a></li>
</ul>
<h3>Internal</h3>
<ul>
<li>Synchronize common files from prometheus/prometheus. <a
href="https://redirect.github.com/prometheus/common/issues/917">#917</a></li>
<li>Modernize Go. <a
href="https://redirect.github.com/prometheus/common/issues/919">#919</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/prometheus/common/compare/v0.68.1...v0.69.0">https://github.com/prometheus/common/compare/v0.68.1...v0.69.0</a></p>
<h2>v0.67.2 / 2025-10-28</h2>
<h2>What's Changed</h2>
<ul>
<li>config: Fix panic in <code>tlsRoundTripper</code> when CA file is
absent by <a href="https://github.com/ndk"><code>@​ndk</code></a> in <a
href="https://redirect.github.com/prometheus/common/pull/792">prometheus/common#792</a></li>
<li>Cleanup linting issues by <a
href="https://github.com/SuperQ"><code>@​SuperQ</code></a> in <a
href="https://redirect.github.com/prometheus/common/pull/860">prometheus/common#860</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/ndk"><code>@​ndk</code></a> made their
first contribution in <a
href="https://redirect.github.com/prometheus/common/pull/792">prometheus/common#792</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/prometheus/common/compare/v0.67.1...v0.67.2">https://github.com/prometheus/common/compare/v0.67.1...v0.67.2</a></p>
<h2>v0.67.1 / 2025-10-07</h2>
<h2>What's Changed</h2>
<ul>
<li>Remove VERSION file to avoid Go conflict error in <a
href="https://redirect.github.com/prometheus/common/pull/853">prometheus/common#853</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/prometheus/common/compare/v0.67.0...v0.67.1">https://github.com/prometheus/common/compare/v0.67.0...v0.67.1</a></p>
<h2>v0.67.0 / 2025-10-07</h2>
<h2>What's Changed</h2>
<ul>
<li>Create CHANGELOG.md for easier communication of library changes,
especially possible breaking changes. by <a
href="https://github.com/ywwg"><code>@​ywwg</code></a> in <a
href="https://redirect.github.com/prometheus/common/pull/833">prometheus/common#833</a></li>
<li>model: New test for validation with dots by <a
href="https://github.com/m1k1o"><code>@​m1k1o</code></a> in <a
href="https://redirect.github.com/prometheus/common/pull/759">prometheus/common#759</a></li>
<li>expfmt: document NewTextParser as required by <a
href="https://github.com/burgerdev"><code>@​burgerdev</code></a> in <a
href="https://redirect.github.com/prometheus/common/pull/842">prometheus/common#842</a></li>
<li>expfmt: Add support for float histograms and gauge histograms by <a
href="https://github.com/beorn7"><code>@​beorn7</code></a> in <a
href="https://redirect.github.com/prometheus/common/pull/843">prometheus/common#843</a></li>
<li>Updated minimum Go version to 1.24.0, updated Go dependecies by <a
href="https://github.com/SuperQ"><code>@​SuperQ</code></a> in <a
href="https://redirect.github.com/prometheus/common/pull/849">prometheus/common#849</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/prometheus/common/commit/e3c14a039d494d866242b36ac253dfecf9c7210b"><code>e3c14a0</code></a>
Merge pull request <a
href="https://redirect.github.com/prometheus/common/issues/925">#925</a>
from roidelapluie/roidelapluie/fix-loadhttpconfigfile...</li>
<li><a
href="https://github.com/prometheus/common/commit/a7b791d0a0cd8e7be164d7f3fdb33450c1868b1c"><code>a7b791d</code></a>
config: resolve LoadHTTPConfigFile paths relative to the config
file</li>
<li><a
href="https://github.com/prometheus/common/commit/f84efec4e4deb31a8afd39c4f4f7ba2b30f39df3"><code>f84efec</code></a>
Merge pull request <a
href="https://redirect.github.com/prometheus/common/issues/918">#918</a>
from prometheus/time-split</li>
<li><a
href="https://github.com/prometheus/common/commit/2269d3d1af9a40c9324bb523087f7704fabe7f1d"><code>2269d3d</code></a>
Merge pull request <a
href="https://redirect.github.com/prometheus/common/issues/922">#922</a>
from roidelapluie/roidelapluie/fix-textparse-empty-br...</li>
<li><a
href="https://github.com/prometheus/common/commit/a1600af967b7eaa77360339b402b447855c24915"><code>a1600af</code></a>
expfmt: fix nil pointer panic when parsing empty braces
&quot;{}&quot;</li>
<li><a
href="https://github.com/prometheus/common/commit/56fe3954537fa60da94055f19172fafa25347948"><code>56fe395</code></a>
Merge pull request <a
href="https://redirect.github.com/prometheus/common/issues/921">#921</a>
from roidelapluie/roidelapluie/oauth2-cross-host-check</li>
<li><a
href="https://github.com/prometheus/common/commit/0fcda471410c91d285776092b7d768d8ac199bc9"><code>0fcda47</code></a>
Merge pull request <a
href="https://redirect.github.com/prometheus/common/issues/920">#920</a>
from roidelapluie/roidelapluie/cross-host-sticky</li>
<li><a
href="https://github.com/prometheus/common/commit/30ba470f4f55107af9dbe7fbe9c95c0617c13f43"><code>30ba470</code></a>
Merge pull request <a
href="https://redirect.github.com/prometheus/common/issues/919">#919</a>
from prometheus/superq/modernize</li>
<li><a
href="https://github.com/prometheus/common/commit/2b55b3e9e7e899f2cbcbcb7afdcb55c2db6a1754"><code>2b55b3e</code></a>
config: check cross-host redirect before OAuth2 token fetch</li>
<li><a
href="https://github.com/prometheus/common/commit/428856f9a5d0d790dacdf03e789c2ef87b03fc40"><code>428856f</code></a>
config: make isCrossHostRedirect sticky across the redirect chain</li>
<li>Additional commits viewable in <a
href="https://github.com/prometheus/common/compare/v0.68.1...v0.69.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/prometheus/common&package-manager=go_modules&previous-version=0.68.1&new-version=0.69.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-23 11:18:52 +00:00
dependabot[bot] 8cf394d145 chore: bump google.golang.org/api from 0.284.0 to 0.286.0 (#26606) 
Bumps
[google.golang.org/api](https://github.com/googleapis/google-api-go-client)
from 0.284.0 to 0.286.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's
releases</a>.</em></p>
<blockquote>
<h2>v0.286.0</h2>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.285.0...v0.286.0">0.286.0</a>
(2026-06-22)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3629">#3629</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/f25a08b7bd916e0719cc9e0d003454a8aaa8caf9">f25a08b</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3631">#3631</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/b3bb97ff046401ce738b4e6830642b2e6c712536">b3bb97f</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3632">#3632</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/7332dd74f142bba59a27778f115eac98cc254bfb">7332dd7</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3634">#3634</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/36081a00df42df1ca3e3228067737839aa905c9e">36081a0</a>)</li>
</ul>
<h2>v0.285.0</h2>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.284.0...v0.285.0">0.285.0</a>
(2026-06-16)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3618">#3618</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/5c008a7963c278aff6be6c839cbf20bd0b8ae231">5c008a7</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3620">#3620</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/21a12ed9dc47cb8d9b9aa4e1f5759ac2044063a5">21a12ed</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3622">#3622</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/17394ca1afffb6d740e134a0bc148d79106c4c80">17394ca</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3623">#3623</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/087611c9a9b2c0e68f429641a012a43396afb4ce">087611c</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3624">#3624</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/72b67889b20325f1a09222d62b3184a68ad30ee2">72b6788</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3626">#3626</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/4f1d165677d35c4caecd7faf93eec27cb2fd25cd">4f1d165</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3628">#3628</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/894cccb170d1ea81f8bf49ddd072a3ef52df3d25">894cccb</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.285.0...v0.286.0">0.286.0</a>
(2026-06-22)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3629">#3629</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/f25a08b7bd916e0719cc9e0d003454a8aaa8caf9">f25a08b</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3631">#3631</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/b3bb97ff046401ce738b4e6830642b2e6c712536">b3bb97f</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3632">#3632</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/7332dd74f142bba59a27778f115eac98cc254bfb">7332dd7</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3634">#3634</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/36081a00df42df1ca3e3228067737839aa905c9e">36081a0</a>)</li>
</ul>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.284.0...v0.285.0">0.285.0</a>
(2026-06-16)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3618">#3618</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/5c008a7963c278aff6be6c839cbf20bd0b8ae231">5c008a7</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3620">#3620</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/21a12ed9dc47cb8d9b9aa4e1f5759ac2044063a5">21a12ed</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3622">#3622</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/17394ca1afffb6d740e134a0bc148d79106c4c80">17394ca</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3623">#3623</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/087611c9a9b2c0e68f429641a012a43396afb4ce">087611c</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3624">#3624</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/72b67889b20325f1a09222d62b3184a68ad30ee2">72b6788</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3626">#3626</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/4f1d165677d35c4caecd7faf93eec27cb2fd25cd">4f1d165</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3628">#3628</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/894cccb170d1ea81f8bf49ddd072a3ef52df3d25">894cccb</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/94e4ed985051ce54267a5f938e57b8d77963c101"><code>94e4ed9</code></a>
chore(main): release 0.286.0 (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3630">#3630</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/36081a00df42df1ca3e3228067737839aa905c9e"><code>36081a0</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3634">#3634</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/7332dd74f142bba59a27778f115eac98cc254bfb"><code>7332dd7</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3632">#3632</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/b3bb97ff046401ce738b4e6830642b2e6c712536"><code>b3bb97f</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3631">#3631</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/f25a08b7bd916e0719cc9e0d003454a8aaa8caf9"><code>f25a08b</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3629">#3629</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/182ae992632d7ba19b5d3c60c71bda28fbfabca1"><code>182ae99</code></a>
chore(main): release 0.285.0 (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3619">#3619</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/894cccb170d1ea81f8bf49ddd072a3ef52df3d25"><code>894cccb</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3628">#3628</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/50adedd746e19a1fa5302c5b47dbd6f269bd8c14"><code>50adedd</code></a>
chore(all): update all (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3625">#3625</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/4f1d165677d35c4caecd7faf93eec27cb2fd25cd"><code>4f1d165</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3626">#3626</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/72b67889b20325f1a09222d62b3184a68ad30ee2"><code>72b6788</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3624">#3624</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/googleapis/google-api-go-client/compare/v0.284.0...v0.286.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/api&package-manager=go_modules&previous-version=0.284.0&new-version=0.286.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-23 11:17:13 +00:00
dependabot[bot] 3fb402cd82 chore: bump github.com/gohugoio/hugo from 0.163.0 to 0.163.3 (#26579) 
Bumps [github.com/gohugoio/hugo](https://github.com/gohugoio/hugo) from
0.163.0 to 0.163.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/gohugoio/hugo/releases">github.com/gohugoio/hugo's
releases</a>.</em></p>
<blockquote>
<h2>v0.163.3</h2>
<h2>What's Changed</h2>
<ul>
<li>markup/highlight: Escape lang in default code block rendering
ce1a7e0b <a href="https://github.com/bep"><code>@​bep</code></a> thanks
to <a href="https://github.com/k0ngj1"><code>@​k0ngj1</code></a> for
reporting this issue.</li>
<li>parser/pageparser: Preserve non-ASCII whitespace after e.g. summary
divider 70a9068a <a
href="https://github.com/bep"><code>@​bep</code></a></li>
<li>resources: Support babel/postcss config variants 9d66d513 <a
href="https://github.com/jmooring"><code>@​jmooring</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/15039">#15039</a>
<a
href="https://redirect.github.com/gohugoio/hugo/issues/15040">#15040</a>
<a
href="https://redirect.github.com/gohugoio/hugo/issues/15043">#15043</a></li>
<li>hugolib: Fix page/section name collision regression f0133466 <a
href="https://github.com/jmooring"><code>@​jmooring</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/15046">#15046</a></li>
</ul>
<h2>v0.163.2</h2>
<h2>What's Changed</h2>
<ul>
<li>Continue resolving on ERR_ACCESS_DENIED in Node's resolver 134674f0
<a href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/15041">#15041</a></li>
<li>markup: Standardize behavior when external converters are missing
147f605f <a
href="https://github.com/jmooring"><code>@​jmooring</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14222">#14222</a></li>
</ul>
<h2>v0.163.1</h2>
<p>The majority of the fixes in this release are security related
(including the upstream fix in 93c8c7d3 (golang.org/x/image)). Thanks to
<a href="https://github.com/vnth4nhnt"><code>@​vnth4nhnt</code></a> for
finding the issues fixed in a00b5c72 and cf9c8f93 (I will do the CVE
work on this later). There has been a uptick in security reports lately,
which doesn't mean that Hugo has gotten less secure, this is mostly the
work of the new and powerful AI tools using Hugo's restrictive <a
href="https://gohugo.io/about/security/">security model</a> as their
baseline. Just take a look at Go's recent <a
href="https://github.com/golang/go/issues?q=is%3Aissue%20label%3ASecurity">security
issue list</a> to see a demonstration of this.</p>
<h2>What's Changed</h2>
<ul>
<li>build(deps): bump golang.org/x/image from 0.41.0 to 0.42.0 93c8c7d3
<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]</li>
<li>Fix multi --renderSegments merge behavior 95e5e9f4 <a
href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/15024">#15024</a></li>
<li>security: Normalize integer IPv4 host encodings in http.urls check
a00b5c72 <a href="https://github.com/bep"><code>@​bep</code></a></li>
<li>Drop symlinks in os.ReadDir, os.ReadFile, os.Stat and os.FileExists
cf9c8f93 <a href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/15019">#15019</a></li>
<li>commands: Fix convert command 2602796c <a
href="https://github.com/jmooring"><code>@​jmooring</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/15012">#15012</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/gohugoio/hugo/commit/4d22555aebf458d5d150500c9ac4bee5b24cf0d3"><code>4d22555</code></a>
releaser: Bump versions for release of 0.163.3</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/ce1a7e0bce3713af40496ded3c2c0ceeed49231d"><code>ce1a7e0</code></a>
markup/highlight: Escape lang in default code block rendering</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/e8988c31412249897a2e6805b61c37ed5c82a10c"><code>e8988c3</code></a>
Merge commit 'c86d9f4aa8a58931f52df6516f10b67c807505fb'</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/c86d9f4aa8a58931f52df6516f10b67c807505fb"><code>c86d9f4</code></a>
Squashed 'docs/' changes from 1f8ddb8a52..e17426e2b6</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/70a9068aa67c67a9eb2ab5fe062faf5a99e6b650"><code>70a9068</code></a>
parser/pageparser: Preserve non-ASCII whitespace after e.g. summary
divider</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/9d66d513cee02e77c96c78059d5c3ae6b1c5dde9"><code>9d66d51</code></a>
resources: Support babel/postcss config variants</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/f01334666790f328e222f67c278396ee77003021"><code>f013346</code></a>
hugolib: Fix page/section name collision regression</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/96e06e1ab8484327dcbb521b8445a52d0c022cf3"><code>96e06e1</code></a>
releaser: Prepare repository for 0.164.0-DEV</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/19a5cec0b9618163bb519487382e861d29edf383"><code>19a5cec</code></a>
releaser: Bump versions for release of 0.163.2</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/134674f00df2c2c0db24f0674de2263298d33eb7"><code>134674f</code></a>
Continue resolving on ERR_ACCESS_DENIED in Node's resolver</li>
<li>Additional commits viewable in <a
href="https://github.com/gohugoio/hugo/compare/v0.163.0...v0.163.3">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/gohugoio/hugo&package-manager=go_modules&previous-version=0.163.0&new-version=0.163.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/coder/coder/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-22 18:28:02 +00:00
dependabot[bot] 2f3285ebe7 chore: bump the x group across 1 directory with 2 updates (#26521) 
Bumps the x group with 2 updates in the / directory:
[golang.org/x/mod](https://github.com/golang/mod) and
[golang.org/x/tools](https://github.com/golang/tools).

Updates `golang.org/x/mod` from 0.36.0 to 0.37.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/mod/commit/deb1dfcdb7c7fd98fb5afddc3e95dd36d5880874"><code>deb1dfc</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="https://github.com/golang/mod/commit/087f6515dd3ba3e8b06918fa425ffe7732321a7a"><code>087f651</code></a>
modfile: use slices.Backward</li>
<li><a
href="https://github.com/golang/mod/commit/343ee60345a1f2ff0692be9dd068c0778dba985c"><code>343ee60</code></a>
x/mod: allow for aggressively conslidating requires</li>
<li>See full diff in <a
href="https://github.com/golang/mod/compare/v0.36.0...v0.37.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `golang.org/x/tools` from 0.45.0 to 0.46.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/tools/commit/3d6f8dfd4853c8b323940b931f1170c6d0df8d23"><code>3d6f8df</code></a>
go/packages: propagate PATH in
TestConfigEnvDoesNotInheritProcessEnv</li>
<li><a
href="https://github.com/golang/tools/commit/47abf61fcbb4abdcf37a986ce23e20dc140fd018"><code>47abf61</code></a>
gopls: move internal/tool into gopls/internal/tool</li>
<li><a
href="https://github.com/golang/tools/commit/19cebc548e6c35b3bf20bd09490e7db258183507"><code>19cebc5</code></a>
go/packages/gopackages: use standard flag package instead of
internal/tool</li>
<li><a
href="https://github.com/golang/tools/commit/e965c10097987837d9805f8069f4a8278de7180f"><code>e965c10</code></a>
gopls/internal/test/marker: update hover test</li>
<li><a
href="https://github.com/golang/tools/commit/96efd3d65c18f9f8d66bc94ec5d709db0b7e72f0"><code>96efd3d</code></a>
gopls/internal/golang/stubmethods: support generic interfaces</li>
<li><a
href="https://github.com/golang/tools/commit/83be7b7739a3e73db55876c5d396c8d891f61a51"><code>83be7b7</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="https://github.com/golang/tools/commit/bf05c11f9ba6f0ed70931bf0a302e9099897d726"><code>bf05c11</code></a>
internal/typesinternal: ForEachElement: test generic methods</li>
<li><a
href="https://github.com/golang/tools/commit/99df0abf1ba525779b731d2f9ef358c1b8a1b633"><code>99df0ab</code></a>
go/callgraph/static: support generic methods</li>
<li><a
href="https://github.com/golang/tools/commit/6942095782f864dadecfb2839bf2371d676bfb48"><code>6942095</code></a>
go/ssa: fix instantiation of generic methods on non-generic
receivers</li>
<li><a
href="https://github.com/golang/tools/commit/070e85daf671b972397e181b13cd7a0be55fa6b0"><code>070e85d</code></a>
go/callgraph/rta: skip generic methods in fingerprinting</li>
<li>Additional commits viewable in <a
href="https://github.com/golang/tools/compare/v0.45.0...v0.46.0">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-18 15:13:50 +00:00
Ethan 0fcd9c2005 chore: bump fantasy to sync from upstream (#26440) 
Closes CODAGT-572

## Overview

Bumps `charm.land/fantasy` to the head of `coder_2_33`
(`v0.0.0-20260617050554-2e3ddbca75dd`) and adapts `chatd` to it.

The fantasy bump:
- Syncs upstream `charmbracelet/fantasy` main (v0.31.0) into
`coder_2_33` (coder/fantasy#42).
- Mirrors the request region when prefixing cross-region inference
profiles, so a legacy (un-qualified) Bedrock model ID is prefixed for
the same region the request is actually signed for.

Pulling in the new fantasy version propagates its required transitive
dependency upgrades (aws-sdk-go-v2, OpenTelemetry, google genai,
`golang.org/x/*`, etc.) through MVS, which accounts for the bulk of the
`go.mod`/`go.sum` churn.

## chatd changes

- Thread a per-provider `Region` through `ConfiguredProvider` and
`ProviderAPIKeys` (`RegionByProvider`), and merge/prune/resolve it
alongside API keys and base URLs.
- Source the Bedrock region from AI provider settings in `chatd` and
pass `fantasybedrock.WithRegion` when a region is configured.
- Migrate the runtime Bedrock title-generation model ID to a
fully-qualified `global.anthropic.*` ID.
- Emit a `finish_reason` in the test OpenAI streaming server so streams
close on a terminal event, matching fantasy's fail-closed stream
handling.

## Heads-up: most of this is short-lived

Almost all of the `chatd` code in this PR only executes on the **direct
(non-gateway) routing path** — the branch taken when
`AIGatewayRoutingEnabled` is `false`. That flag was a transition crutch
for AI Gateway routing, and it (plus the entire direct path /
`x/chatd/chatprovider` package that backs it) is slated for removal in
CODAGT-598. Under AI Gateway routing — which is the path every
deployment is expected to run — the Bedrock region is resolved by
aibridge directly from provider settings (`cli/aibridged.go` builds
`aibridge.AWSBedrockConfig{Region: settings.Bedrock.Region}`), so none
of the region plumbing added here is reached.

Concretely, expect the following to be deleted alongside the direct
path:
- The `RegionByProvider` map, the `Region()` accessor, and the region
preservation in merge/resolve plus the region pruning in
`PruneDisabledProviderKeys` (`chatprovider.go`).
- The `fantasybedrock.WithRegion(region)` branch in `ModelFromConfig` —
only reachable on the direct path; the gateway path builds a
`fantasyanthropic` client with no region key.
- Reading `settings.Bedrock.Region` in `aiProviderConfigFromKeys`
(`chatd.go`).
- The region-specific tests in `chatprovider_test.go`, and the
`chattest`/`model_coverage` adjustments that support direct-path
testing.

What survives the cleanup (independent of routing):
- The `charm.land/fantasy` bump and its `go.mod`/`go.sum` transitive
churn.
- The fully-qualified `global.anthropic.*` Bedrock title-generation
model ID in `quickgen.go` (a runtime-valid model identifier, not
direct-path-specific).

We're landing the full change anyway so the direct path stays correct
for the remaining transition window; just don't be surprised when
CODAGT-598 reclaims most of it.

## Notes

Depends on coder/fantasy `coder_2_33` already containing the upstream
sync and Bedrock region fix (merged via coder/fantasy#42 and
coder/fantasy#43).
 2026-06-19 00:53:59 +10:00
dependabot[bot] a6559a8b00 chore: bump github.com/prometheus-community/pro-bing from 0.8.0 to 0.9.0 (#26404) 
Bumps
[github.com/prometheus-community/pro-bing](https://github.com/prometheus-community/pro-bing)
from 0.8.0 to 0.9.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/prometheus-community/pro-bing/releases">github.com/prometheus-community/pro-bing's
releases</a>.</em></p>
<blockquote>
<h2>v0.9.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Synchronize common files from prometheus/prometheus by <a
href="https://github.com/prombot"><code>@​prombot</code></a> in <a
href="https://redirect.github.com/prometheus-community/pro-bing/pull/185">prometheus-community/pro-bing#185</a></li>
<li>Synchronize common files from prometheus/prometheus by <a
href="https://github.com/prombot"><code>@​prombot</code></a> in <a
href="https://redirect.github.com/prometheus-community/pro-bing/pull/186">prometheus-community/pro-bing#186</a></li>
<li>Synchronize common files from prometheus/prometheus by <a
href="https://github.com/prombot"><code>@​prombot</code></a> in <a
href="https://redirect.github.com/prometheus-community/pro-bing/pull/190">prometheus-community/pro-bing#190</a></li>
<li>Synchronize common files from prometheus/prometheus by <a
href="https://github.com/prombot"><code>@​prombot</code></a> in <a
href="https://redirect.github.com/prometheus-community/pro-bing/pull/191">prometheus-community/pro-bing#191</a></li>
<li>Synchronize common files from prometheus/prometheus by <a
href="https://github.com/prombot"><code>@​prombot</code></a> in <a
href="https://redirect.github.com/prometheus-community/pro-bing/pull/193">prometheus-community/pro-bing#193</a></li>
<li>Synchronize common files from prometheus/prometheus by <a
href="https://github.com/prombot"><code>@​prombot</code></a> in <a
href="https://redirect.github.com/prometheus-community/pro-bing/pull/197">prometheus-community/pro-bing#197</a></li>
<li>Add required make step by <a
href="https://github.com/ArthurSens"><code>@​ArthurSens</code></a> in <a
href="https://redirect.github.com/prometheus-community/pro-bing/pull/201">prometheus-community/pro-bing#201</a></li>
<li>Synchronize common files from prometheus/prometheus by <a
href="https://github.com/prombot"><code>@​prombot</code></a> in <a
href="https://redirect.github.com/prometheus-community/pro-bing/pull/199">prometheus-community/pro-bing#199</a></li>
<li>Fix ping test by <a
href="https://github.com/SuperQ"><code>@​SuperQ</code></a> in <a
href="https://redirect.github.com/prometheus-community/pro-bing/pull/203">prometheus-community/pro-bing#203</a></li>
<li>Replace CircleCI with Github Actions by <a
href="https://github.com/ArthurSens"><code>@​ArthurSens</code></a> in <a
href="https://redirect.github.com/prometheus-community/pro-bing/pull/200">prometheus-community/pro-bing#200</a></li>
<li>Migrate to PromCI by <a
href="https://github.com/SuperQ"><code>@​SuperQ</code></a> in <a
href="https://redirect.github.com/prometheus-community/pro-bing/pull/205">prometheus-community/pro-bing#205</a></li>
<li>Bump actions/checkout from 6.0.2 to 6.0.3 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/prometheus-community/pro-bing/pull/206">prometheus-community/pro-bing#206</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/ArthurSens"><code>@​ArthurSens</code></a> made
their first contribution in <a
href="https://redirect.github.com/prometheus-community/pro-bing/pull/201">prometheus-community/pro-bing#201</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/prometheus-community/pro-bing/compare/v0.8.0...v0.9.0">https://github.com/prometheus-community/pro-bing/compare/v0.8.0...v0.9.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/prometheus-community/pro-bing/commit/945b9010a1de9b190bd7cc76fd6b667305f7604c"><code>945b901</code></a>
Bump actions/checkout from 6.0.2 to 6.0.3 (<a
href="https://redirect.github.com/prometheus-community/pro-bing/issues/206">#206</a>)</li>
<li><a
href="https://github.com/prometheus-community/pro-bing/commit/8ad48a3a4494524d283a80cf2586c922c34996e2"><code>8ad48a3</code></a>
Migrate to PromCI (<a
href="https://redirect.github.com/prometheus-community/pro-bing/issues/205">#205</a>)</li>
<li><a
href="https://github.com/prometheus-community/pro-bing/commit/1194d691ed5ef6e95d0f7c86f03280c50cecaad6"><code>1194d69</code></a>
Replace CircleCI with Github Actions (<a
href="https://redirect.github.com/prometheus-community/pro-bing/issues/200">#200</a>)</li>
<li><a
href="https://github.com/prometheus-community/pro-bing/commit/5b8ff3d3e855d8917a58ddd7f0952fd6d2995375"><code>5b8ff3d</code></a>
Merge pull request <a
href="https://redirect.github.com/prometheus-community/pro-bing/issues/203">#203</a>
from prometheus-community/superq/localhost_ping_test</li>
<li><a
href="https://github.com/prometheus-community/pro-bing/commit/9e6b9559f3c8a5120fbdd70f42e99bb7ff143810"><code>9e6b955</code></a>
Fix ping test</li>
<li><a
href="https://github.com/prometheus-community/pro-bing/commit/9e7ca651df21a1bb2af84a3b3f7f9f0aa9d2779d"><code>9e7ca65</code></a>
Merge pull request <a
href="https://redirect.github.com/prometheus-community/pro-bing/issues/199">#199</a>
from prombot/repo_sync</li>
<li><a
href="https://github.com/prometheus-community/pro-bing/commit/0657089f4960412c2809c3c3c82244e5cff5b126"><code>0657089</code></a>
Merge pull request <a
href="https://redirect.github.com/prometheus-community/pro-bing/issues/201">#201</a>
from prometheus-community/fix-golangcilint</li>
<li><a
href="https://github.com/prometheus-community/pro-bing/commit/b42280d67499a58ed879f827db4e28a05d12e381"><code>b42280d</code></a>
Add required make step</li>
<li><a
href="https://github.com/prometheus-community/pro-bing/commit/f8995dd68ba40d6d7656d67d7d56b5f8ea8f487a"><code>f8995dd</code></a>
Update common Prometheus files</li>
<li><a
href="https://github.com/prometheus-community/pro-bing/commit/f4241153b56afdc77511329e0cdffd95142d0658"><code>f424115</code></a>
Merge pull request <a
href="https://redirect.github.com/prometheus-community/pro-bing/issues/197">#197</a>
from prometheus-community/repo_sync</li>
<li>Additional commits viewable in <a
href="https://github.com/prometheus-community/pro-bing/compare/v0.8.0...v0.9.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/prometheus-community/pro-bing&package-manager=go_modules&previous-version=0.8.0&new-version=0.9.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-16 11:18:26 +00:00
dependabot[bot] 1def9c693e chore: bump google.golang.org/api from 0.283.0 to 0.284.0 (#26403) 
Bumps
[google.golang.org/api](https://github.com/googleapis/google-api-go-client)
from 0.283.0 to 0.284.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's
releases</a>.</em></p>
<blockquote>
<h2>v0.284.0</h2>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.283.0...v0.284.0">0.284.0</a>
(2026-06-09)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3613">#3613</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/5f021536107adde3063487a75aa9f46078490191">5f02153</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3616">#3616</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/25b429a5431a77dd95eb00466661c1447eab6d16">25b429a</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3617">#3617</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/1ef362535b2f2f3afbc1408adbf6d3b69e58ad26">1ef3625</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.283.0...v0.284.0">0.284.0</a>
(2026-06-09)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3613">#3613</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/5f021536107adde3063487a75aa9f46078490191">5f02153</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3616">#3616</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/25b429a5431a77dd95eb00466661c1447eab6d16">25b429a</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3617">#3617</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/1ef362535b2f2f3afbc1408adbf6d3b69e58ad26">1ef3625</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/5c6a0b03b25a64955922133a4486f9632f381e88"><code>5c6a0b0</code></a>
chore(main): release 0.284.0 (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3614">#3614</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/1ef362535b2f2f3afbc1408adbf6d3b69e58ad26"><code>1ef3625</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3617">#3617</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/4dd580d53ff4585321810eaddf5c65d6d6b9d893"><code>4dd580d</code></a>
chore(all): update all (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3615">#3615</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/25b429a5431a77dd95eb00466661c1447eab6d16"><code>25b429a</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3616">#3616</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/5f021536107adde3063487a75aa9f46078490191"><code>5f02153</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3613">#3613</a>)</li>
<li>See full diff in <a
href="https://github.com/googleapis/google-api-go-client/compare/v0.283.0...v0.284.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/api&package-manager=go_modules&previous-version=0.283.0&new-version=0.284.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-16 11:18:17 +00:00
Ethan deb6eec68b fix: forward attached filenames to Anthropic chat models (#26051) 
Previously, fantasy's Anthropic provider adapter accepted PDF and text
FileParts but dropped the filename on the floor, so Claude (direct or
via Bedrock) saw the document bytes without any handle and could not
answer questions like "what's in foo.pdf". Other providers (OpenAI,
Gemini, OpenRouter, Vercel) already forwarded filenames.

Bumps `coder/fantasy` past
[coder/fantasy#38](https://github.com/coder/fantasy/pull/38), which
sanitizes `FilePart.Filename` and sets it as the Anthropic
`DocumentBlockParam.Title` for both `application/pdf` and `text/*`
attachments, and emits a `CallWarning` for unsupported `FilePart` media
types instead of silently dropping them.

On this side, plumbs the resolved filename through `partsToMessageParts`
so the `FilePart` literal carries it into the provider. The existing
`TestModelFromConfig_AnthropicPDFFilePartReachesProvider` regression
test is extended to assert the outbound Anthropic request includes the
sanitized title (`quarterly_report.v1.pdf` becomes `quarterly report v1
pdf`).

Closes CODAGT-545
 2026-06-10 11:37:33 +10:00
dependabot[bot] 9408b9d89b chore: bump github.com/gohugoio/hugo from 0.162.0 to 0.163.0 (#26157) 
Bumps [github.com/gohugoio/hugo](https://github.com/gohugoio/hugo) from
0.162.0 to 0.163.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/gohugoio/hugo/releases">github.com/gohugoio/hugo's
releases</a>.</em></p>
<blockquote>
<h2>v0.163.0</h2>
<p>The main topic in this release is improvements to the AVIF image
handling that we introduced in <code>v0.162.0</code>. See <a
href="https://gohugo.io/configuration/imaging/#avif">the docs</a> for
details, but:</p>
<ul>
<li>We have turned down the default <code>quality</code> for AVIF to 60.
Turns out, JPEG/WebP with quality 75 is comparable to AVIF with quality
60. You can now also set quality per image format in your project config
(and also per image processed if needed).</li>
<li>We have added a <code>hint</code> to the AVIF with the same values
as for <code>WEBP</code>. For <code>lossy</code> compression, the
photo/picture hints (and the default) encodes with YUV420 chroma
subsampling instead of YUV444, keeping 444 for text/icon/drawing. This
greatly reduces the memory needed to encode these images.</li>
</ul>
<h2>Improvements</h2>
<ul>
<li>resources/jsconfig: Remove deprecated baseUrl setting ff2903a9 <a
href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14991">#14991</a>
<a
href="https://redirect.github.com/gohugoio/hugo/issues/14996">#14996</a></li>
<li>all: Adjust tests for deprecated link and image render hook settings
ca68936d <a
href="https://github.com/jmooring"><code>@​jmooring</code></a></li>
<li>all: Run go fix ./... 781fabf4 <a
href="https://github.com/bep"><code>@​bep</code></a></li>
<li>pagesfromdata: Use relative path for content adapter template
metrics 1d018ef8 <a
href="https://github.com/anupamojha-eng"><code>@​anupamojha-eng</code></a>
<a
href="https://redirect.github.com/gohugoio/hugo/issues/14999">#14999</a></li>
<li>ci: Re-add macos-latest to the test matrix 121bc6ce <a
href="https://github.com/bep"><code>@​bep</code></a></li>
<li>images: Deprecate Imaging.Compression and move it down to webp and
avif configs cf18b827 <a
href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14998">#14998</a></li>
<li>Only support the latest Go version 98ad9b3c <a
href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14997">#14997</a></li>
<li>page: Add IsBranch and deprecate IsNode b89e7fe6 <a
href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/11574">#11574</a></li>
<li>images: Force cache invalidation for AVIF target e8fefc83 <a
href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14990">#14990</a></li>
<li>images: Add a per-format AVIF hint setting a043d3ec <a
href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14992">#14992</a></li>
<li>images: Make AVIF chroma subsampling content-aware via the hint
341f575d <a href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14987">#14987</a></li>
<li>Cap AVIF lossy quality at 99 248241b6 <a
href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14981">#14981</a></li>
<li>config: Deprecate the glogal imaging quality setting 4e47d95d <a
href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14979">#14979</a></li>
<li>images: Make 60 the default quality for AVIF 03b4b542 <a
href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14979">#14979</a></li>
<li>livereload: Disconnect from websocket server on pageswap 79be0532 <a
href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14983">#14983</a></li>
<li>tpl/tplimpl/embedded: Prevent leading newline in sitemap template
0f440460 <a href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14977">#14977</a></li>
<li>images: Recover from memory alloc errors in WASM image processors
4e17421e <a href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14985">#14985</a></li>
<li>images: Add quality setting per image format b01ecd4c <a
href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14957">#14957</a></li>
<li>misc: Remove duplicate words in comments 45c00b7c <a
href="https://github.com/jmooring"><code>@​jmooring</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14936">#14936</a>
<a
href="https://redirect.github.com/gohugoio/hugo/issues/14950">#14950</a>
<a
href="https://redirect.github.com/gohugoio/hugo/issues/14965">#14965</a></li>
<li>Add some PNG to AVIF golden test cases 28d882ab <a
href="https://github.com/bep"><code>@​bep</code></a></li>
</ul>
<h2>Dependency Updates</h2>
<ul>
<li>build(deps): bump github.com/bits-and-blooms/bitset 0d29fc81 <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]</li>
<li>build(deps): bump github.com/tetratelabs/wazero bb57404f <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]</li>
<li>build(deps): bump github.com/rogpeppe/go-internal from 1.14.1 to
1.15.0 7d1b1fb3 <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]</li>
<li>build(deps): bump github.com/getkin/kin-openapi from 0.138.0 to
0.139.0 77a11470 <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]</li>
</ul>
<h2>v0.162.1</h2>
<h2>What's Changed</h2>
<ul>
<li>modules/npm: Fix false stale warning after npm pack 59f35cd9 <a
href="https://github.com/jmooring"><code>@​jmooring</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14959">#14959</a></li>
<li>Revert &quot;tpl/collections: Make dict return nil when no values
are provided&quot; c2709750 <a
href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14958">#14958</a></li>
<li>tpl/time: Fix locale-specific month abbreviations ea8b48af <a
href="https://github.com/jmooring"><code>@​jmooring</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14948">#14948</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/gohugoio/hugo/commit/4a9485336a3ff2cea07ab88e2a17ec34d5baaa6e"><code>4a94853</code></a>
releaser: Bump versions for release of 0.163.0</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/1d018ef8573e1cbeca6c05b6df0792cb5f672541"><code>1d018ef</code></a>
pagesfromdata: Use relative path for content adapter template
metrics</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/121bc6ceb232effd98a85a5fec357181be8ff01e"><code>121bc6c</code></a>
ci: Re-add macos-latest to the test matrix</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/0d29fc81bb559750644bc163ec67f21f3c36ed1b"><code>0d29fc8</code></a>
build(deps): bump github.com/bits-and-blooms/bitset</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/bb57404f3d93cd588e98f34c742b8b7c2741a4c7"><code>bb57404</code></a>
build(deps): bump github.com/tetratelabs/wazero</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/781fabf4e406aae6b888d4f9f68331e7f13e89aa"><code>781fabf</code></a>
all: Run go fix ./...</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/cf18b827e2bebe95f87b36bff9937218348a55ca"><code>cf18b82</code></a>
images: Deprecate Imaging.Compression and move it down to webp and avif
configs</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/98ad9b3c03278d0af3ebd13f8ec9fc1a71d46745"><code>98ad9b3</code></a>
Only support the latest Go version</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/ff2903a9317ba45a65f9963f837c66cc6bce3c0e"><code>ff2903a</code></a>
resources/jsconfig: Remove deprecated baseUrl setting</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/7d1b1fb33dd7bdbb0d16dde9509ce15d93f7d894"><code>7d1b1fb</code></a>
build(deps): bump github.com/rogpeppe/go-internal from 1.14.1 to
1.15.0</li>
<li>Additional commits viewable in <a
href="https://github.com/gohugoio/hugo/compare/v0.162.0...v0.163.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/gohugoio/hugo&package-manager=go_modules&previous-version=0.162.0&new-version=0.163.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-09 11:14:22 +00:00
dependabot[bot] 5d8cd2ea7c chore: bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.68.0 to 0.69.0 (#26042) 
Bumps
[go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp](https://github.com/open-telemetry/opentelemetry-go-contrib)
from 0.68.0 to 0.69.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/releases">go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp's
releases</a>.</em></p>
<blockquote>
<h2>v1.44.0/v2.5.1/v0.69.0/v0.37.1/v0.24.0/v0.19.0/v0.16.1/v0.16.0</h2>
<h3>Added</h3>
<ul>
<li>Add <code>error.type</code> attribute to
<code>http.client.request.duration</code> for transport failures in
<code>otelhttp</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8801">#8801</a>)</li>
<li>Add examples for prometheus compatibility document. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8716">#8716</a>)</li>
<li>Add support for <code>cardinality_limits</code> in
<code>PeriodicMetricReader</code> in <code>otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8885">#8885</a>)</li>
<li>Add <code>Resource</code> method to <code>SDK</code> in
<code>go.opentelemetry.io/contrib/otelconf/x</code> to expose the
resolved SDK resource from declarative configuration. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8913">#8913</a>)</li>
<li>Add <code>go.opentelemetry.io/contrib/detectors/hetzner</code>, a
new resource detector for Hetzner Cloud servers, ported from
<code>github.com/open-telemetry/opentelemetry-collector-contrib/processor/resourcedetectionprocessor/internal/hetzner</code>.
Detects <code>cloud.provider</code>, <code>cloud.platform</code>,
<code>cloud.region</code>, <code>cloud.availability_zone</code>,
<code>host.id</code>, and <code>host.name</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8979">#8979</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Set error field as <code>record.SetErr</code> instead of a plain
attribute in
<code>go.opentelemetry.io/contrib/bridges/otellogrus</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8776">#8776</a>)</li>
<li>Set the &quot;error&quot; field (e.g. created via
<code>zap.Error</code>) as <code>record.SetErr</code> instead of a plain
attribute in <code>go.opentelemetry.io/contrib/bridges/otelzap</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8719">#8719</a>)</li>
<li>Set fields implementing <code>error</code> interface from
<code>slog</code> records as <code>record.SetErr</code> instead of plain
attributes in <code>go.opentelemetry.io/contrib/bridges/otelslog</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8774">#8774</a>)</li>
<li>Set emitted errors in
<code>go.opentelemetry.io/contrib/bridges/otellogr</code> as record
errors (<code>Record.SetErr</code>) instead of
<code>exception.message</code> attributes. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8775">#8775</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix header attributes lost when using sub-spans in
<code>go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8797">#8797</a>)</li>
<li>Validate <code>encoding</code> configuration for OTLP HTTP exporters
in <code>go.opentelemetry.io/contrib/otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8772">#8772</a>)</li>
<li>Remove the custom body wrapper from the request's body after the
request is processed to allow body type comparisons with the original
type in
<code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code>
and
<code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/6914">#6914</a>)</li>
<li>Unknown or empty HTTP methods now report &quot;_OTHER&quot; instead
of &quot;GET&quot; across all HTTP instrumentations to align with
OpenTelemetry semantic conventions. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8868">#8868</a>)</li>
<li>The default span name formatter in
<code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code>
now conforms to the OpenTelemetry HTTP semantic conventions for server
span names. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8871">#8871</a>)
<ul>
<li>The default span name is now <code>{method} {route}</code> (e.g.
<code>GET /foo/{id}</code>) when a route pattern is available, or
<code>{method}</code> (e.g. <code>GET</code>) otherwise.</li>
</ul>
</li>
</ul>
<h3>Removed</h3>
<ul>
<li>Remove the deprecated <code>WithSpanOptions</code> option in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8991">#8991</a>)</li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>otelconf: validate encoding configuration for OTLP HTTP exporters by
<a href="https://github.com/sonalgaud12"><code>@​sonalgaud12</code></a>
in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8772">open-telemetry/opentelemetry-go-contrib#8772</a></li>
<li>fix(deps): update module github.com/aws/aws-sdk-go-v2/service/s3 to
v1.99.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8780">open-telemetry/opentelemetry-go-contrib#8780</a></li>
<li>chore(deps): update prom/prometheus docker tag to v3.11.1 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8779">open-telemetry/opentelemetry-go-contrib#8779</a></li>
<li>otellogrus: Set error field as <code>record.SetErr</code> by <a
href="https://github.com/sonalgaud12"><code>@​sonalgaud12</code></a> in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8778">open-telemetry/opentelemetry-go-contrib#8778</a></li>
<li>chore(deps): update module golang.org/x/sys to v0.43.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8783">open-telemetry/opentelemetry-go-contrib#8783</a></li>
<li>chore(deps): update golang.org/x/telemetry digest to 93c7c8a by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8786">open-telemetry/opentelemetry-go-contrib#8786</a></li>
<li>chore(deps): update module github.com/mattn/go-isatty to v0.0.21 by
<a href="https://github.com/renovate"><code>@​renovate</code></a>[bot]
in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8787">open-telemetry/opentelemetry-go-contrib#8787</a></li>
<li>chore(deps): update module github.com/mattn/go-runewidth to v0.0.23
by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8788">open-telemetry/opentelemetry-go-contrib#8788</a></li>
<li>chore(deps): update golang.org/x by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8791">open-telemetry/opentelemetry-go-contrib#8791</a></li>
<li>chore(deps): update actions/github-script action to v9 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8795">open-telemetry/opentelemetry-go-contrib#8795</a></li>
<li>fix(deps): update golang.org/x by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8794">open-telemetry/opentelemetry-go-contrib#8794</a></li>
<li>otelzap: set error field as record.SetErr by <a
href="https://github.com/iblancasa"><code>@​iblancasa</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8719">open-telemetry/opentelemetry-go-contrib#8719</a></li>
<li>fix(deps): update golang.org/x to 746e56f by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8796">open-telemetry/opentelemetry-go-contrib#8796</a></li>
<li>chore(deps): update module golang.org/x/arch to v0.26.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8798">open-telemetry/opentelemetry-go-contrib#8798</a></li>
<li>Check if otelgrpc metrics are enabled by <a
href="https://github.com/dashpole"><code>@​dashpole</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8792">open-telemetry/opentelemetry-go-contrib#8792</a></li>
<li>chore(deps): update actions/upload-artifact action to v7.0.1 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8800">open-telemetry/opentelemetry-go-contrib#8800</a></li>
<li>Check instrument enabled in deprecatedruntime by <a
href="https://github.com/dashpole"><code>@​dashpole</code></a> in <a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8793">open-telemetry/opentelemetry-go-contrib#8793</a></li>
<li>chore(deps): update module github.com/ashanbrown/forbidigo/v2 to
v2.3.1 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8804">open-telemetry/opentelemetry-go-contrib#8804</a></li>
<li>chore(deps): update module github.com/ashanbrown/makezero/v2 to
v2.2.1 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8802">open-telemetry/opentelemetry-go-contrib#8802</a></li>
<li>chore(deps): update module github.com/manuelarte/funcorder to v0.6.0
by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8803">open-telemetry/opentelemetry-go-contrib#8803</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md">go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp's
changelog</a>.</em></p>
<blockquote>
<h2>[1.44.0/2.5.1/0.69.0/0.37.1/0.24.0/0.19.0/0.16.1/0.16.0] -
2026-05-28</h2>
<h3>Added</h3>
<ul>
<li>Add <code>error.type</code> attribute to
<code>http.client.request.duration</code> for transport failures in
<code>otelhttp</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8801">#8801</a>)</li>
<li>Add examples for prometheus compatibility document. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8716">#8716</a>)</li>
<li>Add support for <code>cardinality_limits</code> in
<code>PeriodicMetricReader</code> in <code>otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8885">#8885</a>)</li>
<li>Add <code>Resource</code> method to <code>SDK</code> in
<code>go.opentelemetry.io/contrib/otelconf/x</code> to expose the
resolved SDK resource from declarative configuration. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8913">#8913</a>)</li>
<li>Add <code>go.opentelemetry.io/contrib/detectors/hetzner</code>, a
new resource detector for Hetzner Cloud servers, ported from
<code>github.com/open-telemetry/opentelemetry-collector-contrib/processor/resourcedetectionprocessor/internal/hetzner</code>.
Detects <code>cloud.provider</code>, <code>cloud.platform</code>,
<code>cloud.region</code>, <code>cloud.availability_zone</code>,
<code>host.id</code>, and <code>host.name</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8979">#8979</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Set error field as <code>record.SetErr</code> instead of a plain
attribute in
<code>go.opentelemetry.io/contrib/bridges/otellogrus</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8776">#8776</a>)</li>
<li>Set the &quot;error&quot; field (e.g. created via
<code>zap.Error</code>) as <code>record.SetErr</code> instead of a plain
attribute in <code>go.opentelemetry.io/contrib/bridges/otelzap</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8719">#8719</a>)</li>
<li>Set fields implementing <code>error</code> interface from
<code>slog</code> records as <code>record.SetErr</code> instead of plain
attributes in <code>go.opentelemetry.io/contrib/bridges/otelslog</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8774">#8774</a>)</li>
<li>Set emitted errors in
<code>go.opentelemetry.io/contrib/bridges/otellogr</code> as record
errors (<code>Record.SetErr</code>) instead of
<code>exception.message</code> attributes. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8775">#8775</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix header attributes lost when using sub-spans in
<code>go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8797">#8797</a>)</li>
<li>Validate <code>encoding</code> configuration for OTLP HTTP exporters
in <code>go.opentelemetry.io/contrib/otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8772">#8772</a>)</li>
<li>Remove the custom body wrapper from the request's body after the
request is processed to allow body type comparisons with the original
type in
<code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code>
and
<code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/6914">#6914</a>)</li>
<li>Unknown or empty HTTP methods now report &quot;_OTHER&quot; instead
of &quot;GET&quot; across all HTTP instrumentations to align with
OpenTelemetry semantic conventions. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8868">#8868</a>)</li>
<li>The default span name formatter in
<code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code>
now conforms to the OpenTelemetry HTTP semantic conventions for server
span names. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8871">#8871</a>)
<ul>
<li>The default span name is now <code>{method} {route}</code> (e.g.
<code>GET /foo/{id}</code>) when a route pattern is available, or
<code>{method}</code> (e.g. <code>GET</code>) otherwise.</li>
</ul>
</li>
</ul>
<h3>Removed</h3>
<ul>
<li>Remove the deprecated <code>WithSpanOptions</code> option in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8991">#8991</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/03b2bcdb54b3dde73c9ff91ae216aec262f6c8f5"><code>03b2bcd</code></a>
Release v1.44.0/v2.5.1/v0.69.0/v0.37.1/v0.24.0/v0.19.0/v0.16.1/v0.16.0
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9033">#9033</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/80c46d4037d5991ce324216a52cf7e8d7f2d81fa"><code>80c46d4</code></a>
chore(deps): update module github.com/alecthomas/chroma/v2 to v2.26.0
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9034">#9034</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/51f292197d33b84a21b3c70ae21cb185a2570d5e"><code>51f2921</code></a>
fix(deps): update module github.com/hetznercloud/hcloud-go/v2 to v2.41.2
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9026">#9026</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/db82162f1b642bb6dca7fa5be48045315bb466d6"><code>db82162</code></a>
fix(deps): update aws-sdk-go-v2 monorepo (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9031">#9031</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/5a3e533d8cd4045128e61a966f6dad58964a78ea"><code>5a3e533</code></a>
fix(deps): update module github.com/aws/smithy-go to v1.26.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9032">#9032</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/c67843c753a924faef17bc4aa63c138aa9472477"><code>c67843c</code></a>
otelhttp: Remove custom wrapper after handling request (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/6914">#6914</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/c0a41352283151ab6655e88120e4ff4f0a917a2e"><code>c0a4135</code></a>
docs(otelhttptrace): add performance guidance for WithoutSubSpans (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8785">#8785</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/a51a86790e1f4df231a70bb5fecc72b95d3c1bf0"><code>a51a867</code></a>
otelconf: implement cardinality_limits support in PeriodicMetricReader
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8885">#8885</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/dead6e50fc0b5b3dc4aea288df207953dae5afe7"><code>dead6e5</code></a>
chore(deps): update module go.yaml.in/yaml/v2 to v2.4.4 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8994">#8994</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/979ce1857524394d0884fd7c491722c5bcb43d50"><code>979ce18</code></a>
chore(deps): update module github.com/jgautheron/goconst to v1.10.2 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9030">#9030</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.68.0...zpages/v0.69.0">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-05 12:37:40 +00:00
dependabot[bot] 7e3ac4a85e chore: bump google.golang.org/api from 0.280.0 to 0.283.0 (#26045) 
Bumps
[google.golang.org/api](https://github.com/googleapis/google-api-go-client)
from 0.280.0 to 0.283.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's
releases</a>.</em></p>
<blockquote>
<h2>v0.283.0</h2>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.282.0...v0.283.0">0.283.0</a>
(2026-06-01)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3609">#3609</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/ed84bb800c56d3f7fee4c11f96673114e94a8cc2">ed84bb8</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3611">#3611</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/3855346eda7f4ba6c844d86de5de493d3e395f00">3855346</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3612">#3612</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/32624d32240ec8e5997810fb9cb54f8000b6c7f8">32624d3</a>)</li>
</ul>
<h2>v0.282.0</h2>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.281.0...v0.282.0">0.282.0</a>
(2026-05-27)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3607">#3607</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/3c139a07f71096667d5a623591ddb37dacd38d55">3c139a0</a>)</li>
</ul>
<h2>v0.281.0</h2>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.280.0...v0.281.0">0.281.0</a>
(2026-05-26)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3600">#3600</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/bcaee85f93824a21f5441c2ccd3b4d4811d97de7">bcaee85</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3602">#3602</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/f0071d379f4443ffdae9994fe141b1b5e0c18a62">f0071d3</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3603">#3603</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/b1aa9dea8c3c0e539c8d9687c99c55ec3679c996">b1aa9de</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3604">#3604</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/711e008d9caf16e6fb68c860f83a28fd0a8c0f98">711e008</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3606">#3606</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/3ad8e8e2ab4ae50862c0fc5b17efa2d3cda33d9a">3ad8e8e</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.282.0...v0.283.0">0.283.0</a>
(2026-06-01)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3609">#3609</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/ed84bb800c56d3f7fee4c11f96673114e94a8cc2">ed84bb8</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3611">#3611</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/3855346eda7f4ba6c844d86de5de493d3e395f00">3855346</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3612">#3612</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/32624d32240ec8e5997810fb9cb54f8000b6c7f8">32624d3</a>)</li>
</ul>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.281.0...v0.282.0">0.282.0</a>
(2026-05-27)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3607">#3607</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/3c139a07f71096667d5a623591ddb37dacd38d55">3c139a0</a>)</li>
</ul>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.280.0...v0.281.0">0.281.0</a>
(2026-05-26)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3600">#3600</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/bcaee85f93824a21f5441c2ccd3b4d4811d97de7">bcaee85</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3602">#3602</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/f0071d379f4443ffdae9994fe141b1b5e0c18a62">f0071d3</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3603">#3603</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/b1aa9dea8c3c0e539c8d9687c99c55ec3679c996">b1aa9de</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3604">#3604</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/711e008d9caf16e6fb68c860f83a28fd0a8c0f98">711e008</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3606">#3606</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/3ad8e8e2ab4ae50862c0fc5b17efa2d3cda33d9a">3ad8e8e</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/f6726366ff2f0b8fc82cec6f063dc9beb3ab1377"><code>f672636</code></a>
chore(main): release 0.283.0 (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3610">#3610</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/32624d32240ec8e5997810fb9cb54f8000b6c7f8"><code>32624d3</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3612">#3612</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/3855346eda7f4ba6c844d86de5de493d3e395f00"><code>3855346</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3611">#3611</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/ed84bb800c56d3f7fee4c11f96673114e94a8cc2"><code>ed84bb8</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3609">#3609</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/60aebbd7406af09eb63866ff79f0dbd40cccecbb"><code>60aebbd</code></a>
chore(main): release 0.282.0 (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3608">#3608</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/3c139a07f71096667d5a623591ddb37dacd38d55"><code>3c139a0</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3607">#3607</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/8f434ff91fe8dc299942ecd7c87ebab151ff38e5"><code>8f434ff</code></a>
chore(main): release 0.281.0 (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3601">#3601</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/57f4b28d8c80b464f7f0b486a555de528fb89c4e"><code>57f4b28</code></a>
chore(all): update all (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3605">#3605</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/3ad8e8e2ab4ae50862c0fc5b17efa2d3cda33d9a"><code>3ad8e8e</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3606">#3606</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/711e008d9caf16e6fb68c860f83a28fd0a8c0f98"><code>711e008</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3604">#3604</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/googleapis/google-api-go-client/compare/v0.280.0...v0.283.0">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-05 12:37:19 +00:00
Ehab Younes 38ae92b6b7 chore: upgrade slog to 3.1.0 (#26096) 
Changes from https://github.com/coder/slog/releases/tag/v3.1.0

This also carries the transitive dependency versions required by
`cdr.dev/slog/v3@v3.1.0`, including OpenTelemetry `v1.44.0`, Cloud
Logging `v1.18.0`, and the updated `google.golang.org/genproto` modules.
 2026-06-05 15:23:04 +03:00
Michael Suchacz c4792cf104 fix: show Anthropic Opus 4.7+ thinking (#26026) 
## Summary

- Updates Coder's pinned `github.com/coder/fantasy` fork to include
coder/fantasy#39.
- Exposes Anthropic `thinking_display` as a typed chat model provider
option with `summarized` and `omitted` values.
- Validates configured `thinking_display` values and maps them to
`fantasyanthropic.ProviderOptions.ThinkingDisplay`.
- Regenerates the API/UI option schemas so the admin model config form
gets a generated select field.

## Tests

- `go mod tidy`
- `make gen`
- `go test ./codersdk ./coderd/x/chatd/chatprovider ./coderd -run
'TestChatModelProviderOptions|TestAnthropicThinkingDisplayFromChat|TestProviderOptionsFromChatModelConfig_AnthropicThinkingDisplay|TestMergeMissingProviderOptions_AnthropicThinkingDisplay|TestValidateChatModelProviderOptions_AnthropicThinkingDisplay'`
- `go test ./coderd/x/chatd/... ./codersdk`
- `go test ./coderd -run
'TestValidateChatModelProviderOptions_AnthropicThinkingDisplay'`
- `pnpm --dir site exec -- biome lint --error-on-warnings
src/api/chatModelOptionsGenerated.json src/api/typesGenerated.ts`
- pre-commit hook, including fmt, lint, and slim build

> Mux working on behalf of Mike.
 2026-06-05 08:37:54 +02:00
Seth Shelnutt 61a35185cf fix: upgrade Go toolchain from 1.26.2 to 1.26.4 (#26066) 
Upgrades the Go toolchain from 1.26.2 to 1.26.4 to address two stdlib
CVEs:

- **CVE-2026-27145** (Low): `crypto/x509` `VerifyHostname` has quadratic
cost with large DNS SAN lists, enabling DoS with untrusted certificates.
- **CVE-2026-42507** (Low): `net/textproto` includes attacker-controlled
input in errors without escaping, enabling log injection.

### Changes

- `go.mod`: Bump `go` directive from 1.26.2 to 1.26.4
- `mise.toml`: Bump `go` tool version from 1.26.2 to 1.26.4
- `mise.lock`: Regenerated with updated Go checksums

Resolves ENT-104

> Generated by Coder Agents on behalf of @Shelnutt2
 2026-06-04 11:22:28 -04:00
dependabot[bot] a67f53870f chore: bump github.com/nats-io/nats-server/v2 from 2.12.8 to 2.14.2 (#26046) 
Bumps
[github.com/nats-io/nats-server/v2](https://github.com/nats-io/nats-server)
from 2.12.8 to 2.14.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/nats-io/nats-server/releases">github.com/nats-io/nats-server/v2's
releases</a>.</em></p>
<blockquote>
<h2>Release v2.14.2</h2>
<h2>Changelog</h2>
<p>Refer to the <a
href="https://docs.nats.io/release-notes/whats_new/whats_new_214">2.14
Upgrade Guide</a> for backwards compatibility notes with 2.12.x. Please
note that the 2.13.x version was skipped.</p>
<h3>Go Version</h3>
<ul>
<li>1.26.3</li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>golang.org/x/crypto v0.52.0</li>
<li>golang.org/x/sys v0.45.0</li>
<li>github.com/nats-io/jwt/v2 v2.8.2</li>
<li>github.com/nats-io/nkeys v0.4.16</li>
</ul>
<h3>Improved</h3>
<p>General</p>
<ul>
<li>The client ID is now available through the embedded
<code>ClientAuthentication</code> API (<a
href="https://redirect.github.com/nats-io/nats-server/issues/8217">#8217</a>)</li>
</ul>
<h3>Fixed</h3>
<p>General</p>
<ul>
<li>A race condition when handling subscription interest over routes has
been fixed (<a
href="https://redirect.github.com/nats-io/nats-server/issues/8235">#8235</a>)</li>
<li>Potential protocol-level corruption from rewriting
<code>$JS.ACK</code> subjects has been fixed (<a
href="https://redirect.github.com/nats-io/nats-server/issues/8242">#8242</a>)</li>
<li>Potential protocol-level corruption from buffer misuse in compressed
WebSocket clients has been fixed (<a
href="https://redirect.github.com/nats-io/nats-server/issues/8244">#8244</a>)</li>
<li>The <code>/accstatz</code> monitoring endpoint no longer omits
accounts with only leaf connections (<a
href="https://redirect.github.com/nats-io/nats-server/issues/8252">#8252</a>)</li>
</ul>
<p>JetStream</p>
<ul>
<li>Fixed a case where Raft peers were not correctly tracked after an
inactivity stall during catchup (<a
href="https://redirect.github.com/nats-io/nats-server/issues/8226">#8226</a>)</li>
<li>Quorum needed is now calculated correctly when bootstrapping the
metalayer when gateway URLs resolve to multiple IP addresses (<a
href="https://redirect.github.com/nats-io/nats-server/issues/8238">#8238</a>)</li>
<li>The filestore no longer performs a block skip check on streams with
extremely high subject counts, as it could result in runaway CPU usage
(<a
href="https://redirect.github.com/nats-io/nats-server/issues/8227">#8227</a>)</li>
<li>Fixed a case where the filestore would not release a lock after
handling a write error (<a
href="https://redirect.github.com/nats-io/nats-server/issues/8232">#8232</a>)</li>
<li>Purge operations on both file and memory stores are now more
consistent with each other (<a
href="https://redirect.github.com/nats-io/nats-server/issues/8241">#8241</a>)</li>
<li>Fixed a case where the consumer lock would not release a lock after
handling a start sequence error (<a
href="https://redirect.github.com/nats-io/nats-server/issues/8230">#8230</a>)</li>
<li>Counter streams and message schedules now have configuration
constraints applied to prevent incorrect usage patterns (<a
href="https://redirect.github.com/nats-io/nats-server/issues/8240">#8240</a>)</li>
<li>Improved stream and consumer scale down behaviour consistency (<a
href="https://redirect.github.com/nats-io/nats-server/issues/8253">#8253</a>)</li>
<li>Fixed an issue where the per-subject state last block was not stored
correctly with a max messages per subject limit of 1 (<a
href="https://redirect.github.com/nats-io/nats-server/issues/8254">#8254</a>)</li>
<li>Fixed a drift that could occur in the peer sets after a peer remove
of an online node (<a
href="https://redirect.github.com/nats-io/nats-server/issues/8258">#8258</a>)</li>
</ul>
<h3>Complete Changes</h3>
<p><a
href="https://github.com/nats-io/nats-server/compare/v2.14.1...v2.14.2">https://github.com/nats-io/nats-server/compare/v2.14.1...v2.14.2</a></p>
<h2>Release v2.14.2-RC.1</h2>
<h2>Changelog</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/nats-io/nats-server/commit/1d065926bb99ed14ebe9cf6a21529d28310fc8d3"><code>1d06592</code></a>
Release v2.14.2</li>
<li><a
href="https://github.com/nats-io/nats-server/commit/4e1aefa11412f699f6e31549ea215389824d4c07"><code>4e1aefa</code></a>
Cherry-picks for v2.14.2 (<a
href="https://redirect.github.com/nats-io/nats-server/issues/8256">#8256</a>)</li>
<li><a
href="https://github.com/nats-io/nats-server/commit/ac092ff7c60aa4a0fa3f466198aa89d58bd15f47"><code>ac092ff</code></a>
Update dependencies</li>
<li><a
href="https://github.com/nats-io/nats-server/commit/01e589d49a512276adfa9f60699560c5be63bfd5"><code>01e589d</code></a>
[FIXED] Peer set desync/re-add after stream peer-remove</li>
<li><a
href="https://github.com/nats-io/nats-server/commit/3d122e82432917c2e4395523a33e929cc71ec5ca"><code>3d122e8</code></a>
De-flake TestJetStreamConsumerPrioritized</li>
<li><a
href="https://github.com/nats-io/nats-server/commit/3836d96692a7b9d1405ea404161e6a7f48ba3115"><code>3836d96</code></a>
[FIXED] Initial MaxMsgsPerSubject update not enforced</li>
<li><a
href="https://github.com/nats-io/nats-server/commit/92cf2e314fe7ef38f3ac6223f874efa0f58819e0"><code>92cf2e3</code></a>
[FIXED] Filestore only stores last block when MaxMsgsPerSubject 1</li>
<li><a
href="https://github.com/nats-io/nats-server/commit/3288b4fe279b6f689dc985758add443acb9095db"><code>3288b4f</code></a>
(2.14) [IMPROVED] Remove redundant error check in filestore</li>
<li><a
href="https://github.com/nats-io/nats-server/commit/6ea46d54029a662ae3545da70b01c32976f6cdbc"><code>6ea46d5</code></a>
[FIXED] Stream and consumer scale down consistency</li>
<li><a
href="https://github.com/nats-io/nats-server/commit/5edd91c01a32945e1a4837a104c59114972c9bfb"><code>5edd91c</code></a>
[FIXED] AccountStatz omits accounts with only leaf connections</li>
<li>Additional commits viewable in <a
href="https://github.com/nats-io/nats-server/compare/v2.12.8...v2.14.2">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-04 00:27:26 +00:00
dependabot[bot] dc6202f7da chore: bump github.com/prometheus/common from 0.67.5 to 0.68.1 (#26041) 
Bumps
[github.com/prometheus/common](https://github.com/prometheus/common)
from 0.67.5 to 0.68.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/prometheus/common/releases">github.com/prometheus/common's
releases</a>.</em></p>
<blockquote>
<h2>v0.68.1</h2>
<h2>What's Changed</h2>
<ul>
<li>build(deps): bump golang.org/x/net from 0.52.0 to 0.53.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/prometheus/common/pull/903">prometheus/common#903</a></li>
<li>build(deps): bump golang.org/x/net from 0.53.0 to 0.55.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/prometheus/common/pull/914">prometheus/common#914</a></li>
<li>Synchronize common files from prometheus/prometheus by <a
href="https://github.com/prombot"><code>@​prombot</code></a> in <a
href="https://redirect.github.com/prometheus/common/pull/915">prometheus/common#915</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/prometheus/common/compare/v0.68.0...v0.68.1">https://github.com/prometheus/common/compare/v0.68.0...v0.68.1</a></p>
<h2>v0.68.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Synchronize common files from prometheus/prometheus by <a
href="https://github.com/prombot"><code>@​prombot</code></a> in <a
href="https://redirect.github.com/prometheus/common/pull/873">prometheus/common#873</a></li>
<li>Synchronize common files from prometheus/prometheus by <a
href="https://github.com/prombot"><code>@​prombot</code></a> in <a
href="https://redirect.github.com/prometheus/common/pull/874">prometheus/common#874</a></li>
<li>build(deps): bump github.com/golang-jwt/jwt/v5 from 5.3.0 to 5.3.1
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/prometheus/common/pull/879">prometheus/common#879</a></li>
<li>build(deps): bump golang.org/x/net from 0.48.0 to 0.49.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/prometheus/common/pull/878">prometheus/common#878</a></li>
<li>Synchronize common files from prometheus/prometheus by <a
href="https://github.com/prombot"><code>@​prombot</code></a> in <a
href="https://redirect.github.com/prometheus/common/pull/875">prometheus/common#875</a></li>
<li>Synchronize common files from prometheus/prometheus by <a
href="https://github.com/prombot"><code>@​prombot</code></a> in <a
href="https://redirect.github.com/prometheus/common/pull/880">prometheus/common#880</a></li>
<li>Remove logic adding unit to metrics name by <a
href="https://github.com/vesari"><code>@​vesari</code></a> in <a
href="https://redirect.github.com/prometheus/common/pull/877">prometheus/common#877</a></li>
<li>Synchronize common files from prometheus/prometheus by <a
href="https://github.com/prombot"><code>@​prombot</code></a> in <a
href="https://redirect.github.com/prometheus/common/pull/881">prometheus/common#881</a></li>
<li>Update for Go 1.26 by <a
href="https://github.com/SuperQ"><code>@​SuperQ</code></a> in <a
href="https://redirect.github.com/prometheus/common/pull/883">prometheus/common#883</a></li>
<li>build(deps): bump golang.org/x/net from 0.49.0 to 0.51.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/prometheus/common/pull/882">prometheus/common#882</a></li>
<li>version: Add a slog helper by <a
href="https://github.com/SuperQ"><code>@​SuperQ</code></a> in <a
href="https://redirect.github.com/prometheus/common/pull/886">prometheus/common#886</a></li>
<li>Remove Arthur from maintainers list by <a
href="https://github.com/ArthurSens"><code>@​ArthurSens</code></a> in <a
href="https://redirect.github.com/prometheus/common/pull/885">prometheus/common#885</a></li>
<li>Synchronize common files from prometheus/prometheus by <a
href="https://github.com/prombot"><code>@​prombot</code></a> in <a
href="https://redirect.github.com/prometheus/common/pull/895">prometheus/common#895</a></li>
<li>Synchronize common files from prometheus/prometheus by <a
href="https://github.com/prombot"><code>@​prombot</code></a> in <a
href="https://redirect.github.com/prometheus/common/pull/896">prometheus/common#896</a></li>
<li>config: change NewOAuth2RoundTripper to accept variadic
HTTPClientOption by <a
href="https://github.com/alliasgher"><code>@​alliasgher</code></a> in <a
href="https://redirect.github.com/prometheus/common/pull/898">prometheus/common#898</a></li>
<li>config: guard against nil oauth2 credential in RoundTrip by <a
href="https://github.com/alliasgher"><code>@​alliasgher</code></a> in <a
href="https://redirect.github.com/prometheus/common/pull/897">prometheus/common#897</a></li>
<li>build(deps): bump golang.org/x/net from 0.51.0 to 0.52.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/prometheus/common/pull/890">prometheus/common#890</a></li>
<li>build(deps): bump go.yaml.in/yaml/v2 from 2.4.3 to 2.4.4 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/prometheus/common/pull/891">prometheus/common#891</a></li>
<li>build(deps): bump golang.org/x/oauth2 from 0.34.0 to 0.36.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/prometheus/common/pull/892">prometheus/common#892</a></li>
<li>Move interface assertions to a test file by <a
href="https://github.com/msiegen"><code>@​msiegen</code></a> in <a
href="https://redirect.github.com/prometheus/common/pull/839">prometheus/common#839</a></li>
<li>fix(http_config): fix client cert rotation when no CA is configured
by <a href="https://github.com/machine424"><code>@​machine424</code></a>
in <a
href="https://redirect.github.com/prometheus/common/pull/908">prometheus/common#908</a></li>
<li>Remove CircleCI by <a
href="https://github.com/ArthurSens"><code>@​ArthurSens</code></a> in <a
href="https://redirect.github.com/prometheus/common/pull/910">prometheus/common#910</a></li>
<li>Fix: apply DialContextFunc to OAuth2 token-fetch transport by <a
href="https://github.com/yuri-tceretian"><code>@​yuri-tceretian</code></a>
in <a
href="https://redirect.github.com/prometheus/common/pull/911">prometheus/common#911</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/alliasgher"><code>@​alliasgher</code></a> made
their first contribution in <a
href="https://redirect.github.com/prometheus/common/pull/898">prometheus/common#898</a></li>
<li><a href="https://github.com/msiegen"><code>@​msiegen</code></a> made
their first contribution in <a
href="https://redirect.github.com/prometheus/common/pull/839">prometheus/common#839</a></li>
<li><a
href="https://github.com/machine424"><code>@​machine424</code></a> made
their first contribution in <a
href="https://redirect.github.com/prometheus/common/pull/908">prometheus/common#908</a></li>
<li><a
href="https://github.com/yuri-tceretian"><code>@​yuri-tceretian</code></a>
made their first contribution in <a
href="https://redirect.github.com/prometheus/common/pull/911">prometheus/common#911</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/prometheus/common/compare/v0.67.5...v0.68.0">https://github.com/prometheus/common/compare/v0.67.5...v0.68.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/prometheus/common/commit/212057321e897d625d07379aaddaca01afca7710"><code>2120573</code></a>
Update common Prometheus files (<a
href="https://redirect.github.com/prometheus/common/issues/915">#915</a>)</li>
<li><a
href="https://github.com/prometheus/common/commit/228386adfe1e9c8ede570fbca47782a9abca1a35"><code>228386a</code></a>
build(deps): bump golang.org/x/net from 0.53.0 to 0.55.0 (<a
href="https://redirect.github.com/prometheus/common/issues/914">#914</a>)</li>
<li><a
href="https://github.com/prometheus/common/commit/b8c88b4866403159e523c588dc7563b0f78c0418"><code>b8c88b4</code></a>
build(deps): bump golang.org/x/net from 0.52.0 to 0.53.0 (<a
href="https://redirect.github.com/prometheus/common/issues/903">#903</a>)</li>
<li><a
href="https://github.com/prometheus/common/commit/1e0ae832fb26a2c20c2c0d6ee1289111c668be18"><code>1e0ae83</code></a>
config: apply DialContextFunc to OAuth2 token-fetch transport (<a
href="https://redirect.github.com/prometheus/common/issues/911">#911</a>)</li>
<li><a
href="https://github.com/prometheus/common/commit/b51d01ba2175d103309dcee11f6c01bd03487a64"><code>b51d01b</code></a>
Remove CircleCI (<a
href="https://redirect.github.com/prometheus/common/issues/910">#910</a>)</li>
<li><a
href="https://github.com/prometheus/common/commit/0f3c348807322ea84d92fc7688b1b37a08e17d1f"><code>0f3c348</code></a>
Merge pull request <a
href="https://redirect.github.com/prometheus/common/issues/908">#908</a>
from machine424/ttlsco</li>
<li><a
href="https://github.com/prometheus/common/commit/732a9cf781621a8d8f895ef933b78cf4e9f5d6af"><code>732a9cf</code></a>
fix(http_config): fix client cert rotation when no CA is configured</li>
<li><a
href="https://github.com/prometheus/common/commit/ce9215c53d8c8e507c5f72a69d80568c072be3d9"><code>ce9215c</code></a>
Move interface assertions to a test file (<a
href="https://redirect.github.com/prometheus/common/issues/839">#839</a>)</li>
<li><a
href="https://github.com/prometheus/common/commit/1ba5ed78ffdaf199c6dded3ff8ac88edbdb53712"><code>1ba5ed7</code></a>
build(deps): bump golang.org/x/oauth2 from 0.34.0 to 0.36.0 (<a
href="https://redirect.github.com/prometheus/common/issues/892">#892</a>)</li>
<li><a
href="https://github.com/prometheus/common/commit/8f8ada69df73ad76cabef710856070a42ef420c0"><code>8f8ada6</code></a>
build(deps): bump go.yaml.in/yaml/v2 from 2.4.3 to 2.4.4 (<a
href="https://redirect.github.com/prometheus/common/issues/891">#891</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/prometheus/common/compare/v0.67.5...v0.68.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/prometheus/common&package-manager=go_modules&previous-version=0.67.5&new-version=0.68.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-04 00:13:22 +00:00
dependabot[bot] 02ffd456d1 chore: bump github.com/aws/smithy-go from 1.25.1 to 1.27.0 (#26043) 
Bumps [github.com/aws/smithy-go](https://github.com/aws/smithy-go) from
1.25.1 to 1.27.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/aws/smithy-go/blob/main/CHANGELOG.md">github.com/aws/smithy-go's
changelog</a>.</em></p>
<blockquote>
<h1>Release (2026-06-02)</h1>
<h2>General Highlights</h2>
<ul>
<li><strong>Dependency Update</strong>: Updated to the latest SDK module
versions</li>
</ul>
<h2>Module Highlights</h2>
<ul>
<li><code>github.com/aws/smithy-go</code>: v1.27.0
<ul>
<li><strong>Feature</strong>: Add APIs for schema-based
serialization.</li>
<li><strong>Feature</strong>: Add support for all current AWS and Smithy
protocols.</li>
<li><strong>Bug Fix</strong>: Enforce max nesting depth of 128 on CBOR
payloads.</li>
</ul>
</li>
<li><code>github.com/aws/smithy-go/aws-http-auth</code>: <a
href="https://github.com/aws/smithy-go/blob/main/aws-http-auth/CHANGELOG.md#v120-2026-06-02">v1.2.0</a>
<ul>
<li><strong>Feature</strong>: Add event stream signer.</li>
</ul>
</li>
</ul>
<h1>Release (2026-05-27)</h1>
<h2>General Highlights</h2>
<ul>
<li><strong>Dependency Update</strong>: Updated to the latest SDK module
versions</li>
</ul>
<h2>Module Highlights</h2>
<ul>
<li><code>github.com/aws/smithy-go</code>: v1.26.0
<ul>
<li><strong>Feature</strong>: Add StringSlice to endpoint rulesfn.</li>
</ul>
</li>
</ul>
<h1>Release (2026-04-23)</h1>
<h2>General Highlights</h2>
<ul>
<li><strong>Dependency Update</strong>: Updated to the latest SDK module
versions</li>
</ul>
<h2>Module Highlights</h2>
<ul>
<li><code>github.com/aws/smithy-go</code>: v1.25.1
<ul>
<li><strong>Bug Fix</strong>: Fixed a memory leak in the LRU cache
implementation used by some AWS services.</li>
</ul>
</li>
</ul>
<h1>Release (2026-04-15)</h1>
<h2>General Highlights</h2>
<ul>
<li><strong>Dependency Update</strong>: Updated to the latest SDK module
versions</li>
</ul>
<h2>Module Highlights</h2>
<ul>
<li><code>github.com/aws/smithy-go</code>: v1.25.0
<ul>
<li><strong>Feature</strong>: Add support for endpointBdd trait</li>
</ul>
</li>
</ul>
<h1>Release (2026-04-02)</h1>
<h2>General Highlights</h2>
<ul>
<li><strong>Dependency Update</strong>: Updated to the latest SDK module
versions</li>
</ul>
<h2>Module Highlights</h2>
<ul>
<li><code>github.com/aws/smithy-go</code>: v1.24.3
<ul>
<li><strong>Bug Fix</strong>: Add additional sigv4 configuration.</li>
</ul>
</li>
<li><code>github.com/aws/smithy-go/aws-http-auth</code>: <a
href="https://github.com/aws/smithy-go/blob/main/aws-http-auth/CHANGELOG.md#v113-2026-04-02">v1.1.3</a>
<ul>
<li><strong>Bug Fix</strong>: Add additional sigv4 configuration.</li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/aws/smithy-go/commit/3f6ece24dd0646e1f43ce05d980bcb4880a6e7fe"><code>3f6ece2</code></a>
Release 2026-06-02</li>
<li><a
href="https://github.com/aws/smithy-go/commit/3432807d26fd8d74013bd20d7d4c56ff379e2e16"><code>3432807</code></a>
Revert &quot;changelog&quot;</li>
<li><a
href="https://github.com/aws/smithy-go/commit/9663ed6253396a37d3cca9e37a9410118a370bc1"><code>9663ed6</code></a>
changelog</li>
<li><a
href="https://github.com/aws/smithy-go/commit/bcd9f540477b856423b2a8f679574df8026a5dbe"><code>bcd9f54</code></a>
enforce a max nesting depth of 128 on cbor payloads (<a
href="https://redirect.github.com/aws/smithy-go/issues/670">#670</a>)</li>
<li><a
href="https://github.com/aws/smithy-go/commit/ff093e96647027be14e7079a03359bc8c80d6b6f"><code>ff093e9</code></a>
changelog</li>
<li><a
href="https://github.com/aws/smithy-go/commit/1db7cb38af94cbdbf000a31a56f5a1d20191fa68"><code>1db7cb3</code></a>
hold off on unsafe string for now</li>
<li><a
href="https://github.com/aws/smithy-go/commit/473b1947c03deea1898ffd01fbba8de765d5eed7"><code>473b194</code></a>
update README again</li>
<li><a
href="https://github.com/aws/smithy-go/commit/6620de4fc429f2553f793bb170a997e6c9d2e439"><code>6620de4</code></a>
update README</li>
<li><a
href="https://github.com/aws/smithy-go/commit/22c5357d5d20fd4262b62ca7bb3530d7759a79bf"><code>22c5357</code></a>
introduce schema-based serialization (<a
href="https://redirect.github.com/aws/smithy-go/issues/666">#666</a>)</li>
<li><a
href="https://github.com/aws/smithy-go/commit/6857390fd160b416d0e369dc9dc5c2b3736178fc"><code>6857390</code></a>
fix: remove deprecated io/ioutil from codegen templates (<a
href="https://redirect.github.com/aws/smithy-go/issues/669">#669</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/aws/smithy-go/compare/v1.25.1...v1.27.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/aws/smithy-go&package-manager=go_modules&previous-version=1.25.1&new-version=1.27.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-04 00:13:19 +00:00
dependabot[bot] 3ffccf38ac chore: bump github.com/jedib0t/go-pretty/v6 from 6.7.1 to 6.8.0 (#26047) 
Bumps
[github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty)
from 6.7.1 to 6.8.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/jedib0t/go-pretty/releases">github.com/jedib0t/go-pretty/v6's
releases</a>.</em></p>
<blockquote>
<h2>v6.8.0</h2>
<h2>What's Changed</h2>
<ul>
<li>progress: fix speed decay on done trackers and log overwrite; fixes
<a
href="https://redirect.github.com/jedib0t/go-pretty/issues/405">#405</a>
by <a href="https://github.com/jedib0t"><code>@​jedib0t</code></a> in <a
href="https://redirect.github.com/jedib0t/go-pretty/pull/406">jedib0t/go-pretty#406</a></li>
<li>fix: wrap wide runes when wrapLen is odd in WrapHard by <a
href="https://github.com/koriyoshi2041"><code>@​koriyoshi2041</code></a>
in <a
href="https://redirect.github.com/jedib0t/go-pretty/pull/408">jedib0t/go-pretty#408</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/koriyoshi2041"><code>@​koriyoshi2041</code></a>
made their first contribution in <a
href="https://redirect.github.com/jedib0t/go-pretty/pull/408">jedib0t/go-pretty#408</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/jedib0t/go-pretty/compare/v6.7.10...v6.8.0">https://github.com/jedib0t/go-pretty/compare/v6.7.10...v6.8.0</a></p>
<h2>v6.7.10</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix panic on text align with unicode by <a
href="https://github.com/edznux-dd"><code>@​edznux-dd</code></a> in <a
href="https://redirect.github.com/jedib0t/go-pretty/pull/404">jedib0t/go-pretty#404</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/edznux-dd"><code>@​edznux-dd</code></a>
made their first contribution in <a
href="https://redirect.github.com/jedib0t/go-pretty/pull/404">jedib0t/go-pretty#404</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/jedib0t/go-pretty/compare/v6.7.9...v6.7.10">https://github.com/jedib0t/go-pretty/compare/v6.7.9...v6.7.10</a></p>
<h2>v6.7.9</h2>
<h2>What's Changed</h2>
<ul>
<li>table: markdown padding for human-friendly output; fixes <a
href="https://redirect.github.com/jedib0t/go-pretty/issues/402">#402</a>
by <a href="https://github.com/jedib0t"><code>@​jedib0t</code></a> in <a
href="https://redirect.github.com/jedib0t/go-pretty/pull/403">jedib0t/go-pretty#403</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/jedib0t/go-pretty/compare/v6.7.8...v6.7.9">https://github.com/jedib0t/go-pretty/compare/v6.7.8...v6.7.9</a></p>
<h2>v6.7.8</h2>
<h2>What's Changed</h2>
<ul>
<li>progress: SortByIndex for better control of sorting by <a
href="https://github.com/jedib0t"><code>@​jedib0t</code></a> in <a
href="https://redirect.github.com/jedib0t/go-pretty/pull/398">jedib0t/go-pretty#398</a></li>
<li>progress: address race conditions in render/stop/trackers; fixes 399
by <a href="https://github.com/jedib0t"><code>@​jedib0t</code></a> in <a
href="https://redirect.github.com/jedib0t/go-pretty/pull/401">jedib0t/go-pretty#401</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/jedib0t/go-pretty/compare/v6.7.7...v6.7.8">https://github.com/jedib0t/go-pretty/compare/v6.7.7...v6.7.8</a></p>
<h2>v6.7.7</h2>
<h2>What's Changed</h2>
<ul>
<li>table: fix border with no data rows (original behavior) by <a
href="https://github.com/jedib0t"><code>@​jedib0t</code></a> in <a
href="https://redirect.github.com/jedib0t/go-pretty/pull/397">jedib0t/go-pretty#397</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/jedib0t/go-pretty/compare/v6.7.6...v6.7.7">https://github.com/jedib0t/go-pretty/compare/v6.7.6...v6.7.7</a></p>
<h2>v6.7.6</h2>
<h2>What's Changed</h2>
<ul>
<li>text: fix alignment issues with box/block chars by <a
href="https://github.com/jedib0t"><code>@​jedib0t</code></a> in <a
href="https://redirect.github.com/jedib0t/go-pretty/pull/389">jedib0t/go-pretty#389</a></li>
<li>table: FilterBy: add row filtering support by <a
href="https://github.com/jedib0t"><code>@​jedib0t</code></a> in <a
href="https://redirect.github.com/jedib0t/go-pretty/pull/390">jedib0t/go-pretty#390</a></li>
<li>table: split style.go into individual files by <a
href="https://github.com/jedib0t"><code>@​jedib0t</code></a> in <a
href="https://redirect.github.com/jedib0t/go-pretty/pull/392">jedib0t/go-pretty#392</a></li>
<li>table: fix border with no data rows; fixes <a
href="https://redirect.github.com/jedib0t/go-pretty/issues/395">#395</a>
by <a href="https://github.com/jedib0t"><code>@​jedib0t</code></a> in <a
href="https://redirect.github.com/jedib0t/go-pretty/pull/396">jedib0t/go-pretty#396</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/jedib0t/go-pretty/compare/v6.7.5...v6.7.6">https://github.com/jedib0t/go-pretty/compare/v6.7.5...v6.7.6</a></p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/jedib0t/go-pretty/commit/45fb00d043b710d670b9e921f9e9c58111460522"><code>45fb00d</code></a>
text: wrap wide runes when wrapLen is odd in WrapHard (<a
href="https://redirect.github.com/jedib0t/go-pretty/issues/408">#408</a>)</li>
<li><a
href="https://github.com/jedib0t/go-pretty/commit/ad1754989240b73f22b3f4911dd5d3d40b7c22c8"><code>ad17549</code></a>
progress: fix speed decay on done trackers and log overwrite; fixes <a
href="https://redirect.github.com/jedib0t/go-pretty/issues/405">#405</a>
(<a
href="https://redirect.github.com/jedib0t/go-pretty/issues/406">#406</a>)</li>
<li><a
href="https://github.com/jedib0t/go-pretty/commit/66563fd9a0aa2096db65417e9cb0b5841957d8aa"><code>66563fd</code></a>
text: fix panic on align with unicode (<a
href="https://redirect.github.com/jedib0t/go-pretty/issues/404">#404</a>)</li>
<li><a
href="https://github.com/jedib0t/go-pretty/commit/017a359e50d97a9f5ed869ceed4b2e23acdea9de"><code>017a359</code></a>
table: markdown padding for human-friendly output; fixes <a
href="https://redirect.github.com/jedib0t/go-pretty/issues/402">#402</a>
(<a
href="https://redirect.github.com/jedib0t/go-pretty/issues/403">#403</a>)</li>
<li><a
href="https://github.com/jedib0t/go-pretty/commit/f05e1de9926ede0af62f680829a87133a0ad5fd7"><code>f05e1de</code></a>
progress: address race conditions in render/stop/trackers; fixes 399 (<a
href="https://redirect.github.com/jedib0t/go-pretty/issues/401">#401</a>)</li>
<li><a
href="https://github.com/jedib0t/go-pretty/commit/1cebbc5ded6de0bb3419c7d0bc34abaa97f389f4"><code>1cebbc5</code></a>
progress: SortByIndex for better control of sorting (<a
href="https://redirect.github.com/jedib0t/go-pretty/issues/398">#398</a>)</li>
<li><a
href="https://github.com/jedib0t/go-pretty/commit/b0a2ab976f5d85d1368824a904e645a636c1b3c8"><code>b0a2ab9</code></a>
table: fix border with no data rows (original behavior) (<a
href="https://redirect.github.com/jedib0t/go-pretty/issues/397">#397</a>)</li>
<li><a
href="https://github.com/jedib0t/go-pretty/commit/73867ddb662b6ce805252e910c4922548f0fd337"><code>73867dd</code></a>
table: fix border with no data rows; fixes <a
href="https://redirect.github.com/jedib0t/go-pretty/issues/395">#395</a>
(<a
href="https://redirect.github.com/jedib0t/go-pretty/issues/396">#396</a>)</li>
<li><a
href="https://github.com/jedib0t/go-pretty/commit/b2eda901ed06554942e31e54ab28af675494291a"><code>b2eda90</code></a>
table: split style.go into individual files (<a
href="https://redirect.github.com/jedib0t/go-pretty/issues/392">#392</a>)</li>
<li><a
href="https://github.com/jedib0t/go-pretty/commit/0b7174f7b48136ba1bf9e59679f18e88571b6e31"><code>0b7174f</code></a>
README.me: link to package README.md instead of folder (<a
href="https://redirect.github.com/jedib0t/go-pretty/issues/391">#391</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/jedib0t/go-pretty/compare/v6.7.1...v6.8.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/jedib0t/go-pretty/v6&package-manager=go_modules&previous-version=6.7.1&new-version=6.8.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-04 00:12:36 +00:00
dependabot[bot] 62338f3f08 chore: bump github.com/nats-io/nats.go from 1.51.0 to 1.52.0 (#26044) 
Bumps [github.com/nats-io/nats.go](https://github.com/nats-io/nats.go)
from 1.51.0 to 1.52.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/nats-io/nats.go/releases">github.com/nats-io/nats.go's
releases</a>.</em></p>
<blockquote>
<h2>Release v1.52.0</h2>
<h2>Changelog</h2>
<p>This release focuses on 2.14 nats-server features support.</p>
<h3>ADDED</h3>
<ul>
<li>JetStream:
<ul>
<li>Added fast batch stream config field (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2052">#2052</a>)</li>
<li>Added message scheduling headers and publish opts (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2051">#2051</a>)</li>
<li>Updated <code>StreamConfig</code> with <code>Consumer</code> field
and added <code>AckFlowControlPolicy</code> (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2070">#2070</a>)</li>
<li>Added reset consumer API (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2069">#2069</a>)</li>
</ul>
</li>
</ul>
<h3>FIXED</h3>
<ul>
<li>Core NATS:
<ul>
<li>Fix Subscription.StatusChanged channel closure on Closed
Subscription. Thanks <a
href="https://github.com/nithimani38-prog"><code>@​nithimani38-prog</code></a>
for the contribution (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2034">#2034</a>)</li>
</ul>
</li>
</ul>
<h3>IMPROVED</h3>
<ul>
<li>Fixed Flaky JS cluster tests (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2062">#2062</a>)</li>
</ul>
<h3>Complete Changes</h3>
<p><a
href="https://github.com/nats-io/nats.go/compare/v1.51.0...v1.52.0">https://github.com/nats-io/nats.go/compare/v1.51.0...v1.52.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/nats-io/nats.go/commit/e9f2a36e31b1065f69b252ea090c01e8869eab0b"><code>e9f2a36</code></a>
Release v1.52.0 (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2074">#2074</a>)</li>
<li><a
href="https://github.com/nats-io/nats.go/commit/609274f8c57b65c9d11b01b008b0e40fadfc9d5b"><code>609274f</code></a>
[FIXED] Subscription.StatusChanged channel closure on Closed
Subscription (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2">#2</a>...</li>
<li><a
href="https://github.com/nats-io/nats.go/commit/f7cde748abc86c2981cb1391ca828fceea02af66"><code>f7cde74</code></a>
[IMPROVED] Use latest release build for badge in README (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2064">#2064</a>)</li>
<li><a
href="https://github.com/nats-io/nats.go/commit/c7476ea556818d561945e78863adab422f00de03"><code>c7476ea</code></a>
[IMPROVED] Reject empty consumer info in CONSUMER.RESET response (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2072">#2072</a>)</li>
<li><a
href="https://github.com/nats-io/nats.go/commit/8fde36fd10a34224e22f4f8a8ad1f61ecaedd18f"><code>8fde36f</code></a>
[ADDED] ResetConsumer JetStream API (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2069">#2069</a>)</li>
<li><a
href="https://github.com/nats-io/nats.go/commit/dcfd0fcc6f63c4a2e4436e5aa3ecd4e1dcc598df"><code>dcfd0fc</code></a>
[ADDED] StreamSource.Consumer config field and AckFlowControlPolicy (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2070">#2070</a>)</li>
<li><a
href="https://github.com/nats-io/nats.go/commit/7a28503b5d5d633d2caaa2639571e5f19c8eebec"><code>7a28503</code></a>
[ADDED] Publish options and consts for message scheduling (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2051">#2051</a>)</li>
<li><a
href="https://github.com/nats-io/nats.go/commit/6c91a518e305e56c6481cf63ba52416300b7f5d3"><code>6c91a51</code></a>
[ADDED] AllowBatchPublish stream config field (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2052">#2052</a>)</li>
<li><a
href="https://github.com/nats-io/nats.go/commit/a614d0be24c7e9a22a406572bee44d897cff27c3"><code>a614d0b</code></a>
[FIXED] Flaky JS cluster tests due to race in setupJSClusterWithSize (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2062">#2062</a>)</li>
<li>See full diff in <a
href="https://github.com/nats-io/nats.go/compare/v1.51.0...v1.52.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/nats-io/nats.go&package-manager=go_modules&previous-version=1.51.0&new-version=1.52.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-04 00:10:17 +00:00
Ethan 9fe75587ae fix: forward user-uploaded PDFs to Anthropic and Bedrock (#25946) 
Previously, user-uploaded PDFs were silently dropped by fantasy's
Anthropic provider adapter, so Claude (direct or via Bedrock) only saw
the user's text and replied as if no document had been attached. Other
providers (OpenAI, Gemini, OpenRouter, Vercel) were unaffected.

Bumps `coder/fantasy` past
[coder/fantasy#37](https://github.com/coder/fantasy/pull/37)
(cherry-pick of upstream
[charmbracelet/fantasy#197](https://github.com/charmbracelet/fantasy/pull/197)),
which emits an Anthropic `document` content block with a base64 PDF
source for `fantasy.FilePart{MediaType: "application/pdf"}` and counts
`OfDocument` as user-visible so a PDF-only user message is no longer
culled as empty.

Adds a regression test
(`TestModelFromConfig_AnthropicPDFFilePartReachesProvider`) that drives
a `fantasy.FilePart` through the real Anthropic provider against a
`chattest.NewAnthropic` stub and asserts the outbound request contains a
base64 document block. The test was verified to fail on the previous
fantasy pin (the request leaves with zero messages and `Generate`
returns EOF) and pass on the new one.

Manually verified end-to-end with `./scripts/develop.sh`: uploading a
PDF to a Claude-backed Coder Agents chat now lets the model read it.

Closes CODAGT-540
 2026-06-03 00:16:01 +10:00
Thomas Kosiewski fe257666d7 ci: refactor CI to use mise for shared tool setup (#25727) 2026-06-01 15:55:19 +02:00
Mathias Fredriksson 60f0bfe94c fix: update tailscale fork to fix goroutine leak in TestRun (#25838) 
Update the coder/tailscale fork to include the fix for goroutine leaks
in measureHTTPLatency. The function creates an http.Transport per DERP
probe for a single HTTP request but did not disable keep-alives,
causing readLoop/writeLoop goroutines to persist after the function
returns. These were detected by goleak in support/TestRun.

The fork fix sets DisableKeepAlives: true on the transport.

Closes PLAT-289
 2026-05-29 11:15:21 +00:00
dependabot[bot] df929467f6 chore: bump github.com/open-policy-agent/opa from 1.11.0 to 1.17.0 (#25200) 
Bumps
[github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa)
from 1.11.0 to 1.17.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/open-policy-agent/opa/releases">github.com/open-policy-agent/opa's
releases</a>.</em></p>
<blockquote>
<h2>v1.16.2</h2>
<p>This release updates the version of Go used to build the OPA binaries
and images to 1.26.3;
addressing <a
href="https://groups.google.com/g/golang-announce/c/qcCIEXso47M">a
number of vulnerabilities</a>.</p>
<h2>v1.16.1</h2>
<p>This is a patch release addressing a regression in the plugin manager
that may cause the service to hang on shutdown (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8590">#8590</a>).</p>
<h2>v1.16.0</h2>
<blockquote>
<p>[!WARNING]</p>
<p>A regression has been found in the plugin manager, which may cause
the service to hang on shutdown.
Users are advised to go directly to v1.16.1.</p>
</blockquote>
<p>This release contains a mix of new features, performance
improvements, and bugfixes. Notably:</p>
<ul>
<li>New <code>uri.parse</code> and <code>uri.is_valid</code> built-in
functions</li>
<li>Data API Request/Response Metadata</li>
<li>Prometheus metrics exported via OTLP</li>
<li>Formatter improvements</li>
</ul>
<blockquote>
<p><strong><em>NOTE:</em></strong></p>
<p>In v1.15.x, OPA was dropping logs for bundle downloads,
<code>print()</code> calls and other plugin-originated logs.
Users are advised to update, v1.16.0 fixes this bug in (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8544">#8544</a>).</p>
</blockquote>
<h3>New <code>uri.parse</code> and <code>uri.is_valid</code> built-in
functions (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8263">#8263</a>)</h3>
<p>Two new <a
href="https://www.openpolicyagent.org/docs/policy-reference/builtins">built-in
functions</a> have been added: <code>uri.parse</code> for parsing a
given URI, and <code>uri.is_valid</code> for verifying the structure of
a given URI.</p>
<h4>uri.parse</h4>
<p>Parses a URI and returns an object containing its components
according to <a href="https://www.rfc-editor.org/rfc/rfc3986.html">RFC
3986</a>. Empty components are omitted.</p>
<pre lang="rego"><code>package example
<p>test_uri if {
uri.parse(&quot;<a
href="https://example.com:8080/api?q=1#top">https://example.com:8080/api?q=1#top</a>&quot;)
== {
&quot;scheme&quot;: &quot;https&quot;,
&quot;hostname&quot;: &quot;example.com&quot;,
&quot;port&quot;: &quot;8080&quot;,
&quot;path&quot;: &quot;/api&quot;,
&quot;raw_path&quot;: &quot;/api&quot;,
&quot;raw_query&quot;: &quot;q=1&quot;,
&quot;fragment&quot;: &quot;top&quot;,
}
}
</code></pre></p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md">github.com/open-policy-agent/opa's
changelog</a>.</em></p>
<blockquote>
<h2>1.17.0</h2>
<p>This release contains a mix of new features, performance
improvements, and bugfixes. Notably:</p>
<ul>
<li>A new <code>future.keywords.not</code> import that adds improved
semantics to the <code>not</code> keyword.</li>
<li>Rule Labels in Decision Logs</li>
<li>Published json schema for IR and bundle manifest</li>
<li>Dropped automaxprocs and x/net dependencies</li>
</ul>
<h3>Improved Negation Semantics (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8387">#8387</a>)</h3>
<p>This OPA release introduces a new <a
href="https://www.openpolicyagent.org/docs/policy-reference/keywords/not#improved-negation-semantics"><code>future.keywords.not</code>
import</a>
that fixes a long-standing semantic issue with negation in Rego.</p>
<p>Without the import, the compiler expands a negated composite
expression like
<code>not f(g(input.x))</code> into a series of sub-expressions
evaluated <em>before</em> the
<code>not</code>:</p>
<pre><code>__local0__ = input.x
g(__local0__, __local1__)
not f(__local1__)
</code></pre>
<p>If any sub-expression fails — for example, <code>input.x</code> is
undefined or <code>g</code>
produces an undefined result — the entire rule fails rather than the
<code>not</code> succeeding.
This is unintuitive: the user's intent is &quot;the condition does not
hold,&quot; but
an undefined intermediate value causes a silent failure instead of the
expected
<code>not</code> result.</p>
<p>With <code>import future.keywords.not</code>, composite-expression
negation wraps the full compiler
expansion in an implicit body:</p>
<pre><code>not { __local0__ = input.x; g(__local0__, __local1__);
f(__local1__) }
</code></pre>
<p>Now, if <em>any</em> sub-expression is undefined or fails, the body
is unsatisfiable
and the <code>not</code> expression succeeds; matching the intuition
that &quot;the condition does not hold.&quot;</p>
<blockquote>
<p><strong><em>NOTE:</em></strong></p>
<p>Users are recommended to import <code>future.keywords.not</code>
whenever the <code>not</code> keyword is used in a policy.</p>
</blockquote>
<p>Authored by <a
href="https://github.com/johanfylling"><code>@​johanfylling</code></a></p>
<h3>Rule Labels in Decision Logs (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/2089">#2089</a>)</h3>
<p>Rule annotations now support a <code>labels</code> field. Labels from
all successfully evaluated
rules are collected and included in each decision log entry as a
top-level <code>rule_labels</code></p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/open-policy-agent/opa/commit/64a3625d33bc6ad8e7c40df03b76ce2fb3ab4d21"><code>64a3625</code></a>
Release v1.17.0 (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8710">#8710</a>)</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/68c9de5da00ea9d631c50327c709d5d7e8844bba"><code>68c9de5</code></a>
benchmarks: tweak per-PR benchmark regression check based on
pr-check</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/7fe3066154b7780eac16c290475f8506573a427f"><code>7fe3066</code></a>
server: remove dead code (s.partials) (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8708">#8708</a>)</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/37830be801a9ce4ec6d23df33f645bb6095f3043"><code>37830be</code></a>
ast,storage/inmem: Add <code>inmem.NewFromASTObject</code> and add
missing string case t...</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/1661f22ba399e94d08d8fb85218580a61779bdc4"><code>1661f22</code></a>
ast: add some schema $ref tests</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/3e22f562f1e370973c1b6750eff11d06fe554c70"><code>3e22f56</code></a>
benchmarks: only run for go changes</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/13aaeabce2221217cb6c175b269475803740fad2"><code>13aaeab</code></a>
benchmarks: move env vars, remove zizmor-ignore comment</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/93e170868ac37f87696adfc2d7f672a0f1814936"><code>93e1708</code></a>
benchmarks: fix PR message, skip tests</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/4ce3991901eed5b622a21f2f629029727e192ba7"><code>4ce3991</code></a>
benchmarks: use go tool machinery, add benchstat</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/41df8df4a26d8de7a81bf4c5d78cb94f10a108d5"><code>41df8df</code></a>
benchmarks: use benchlab for per-PR feedback</li>
<li>Additional commits viewable in <a
href="https://github.com/open-policy-agent/opa/compare/v1.11.0...v1.17.0">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-28 15:20:56 +00:00
Steven Masley 4591212482 feat: implement SCIM handler for SCIM 2.0 compliance (#25572) 
Rewrites the SCIM 2.0 user provisioning handler to be RFC 7644
compliant. Verified against an external IdP Okta.

Behavior is OPT IN
 2026-05-28 10:00:37 -05:00
Jon Ayers f6f284ea51 feat: add initial NATS implementation (#25602) 2026-05-27 12:57:20 -05:00
dependabot[bot] d03986e3f6 chore: bump the x group with 3 updates (#25696) 
[//]: # (dependabot-start)
⚠️  **Dependabot is rebasing this PR** ⚠️ 

Rebasing might not happen immediately, so don't worry if this takes some
time.

Note: if you make any changes to this PR yourself, they will take
precedence over the rebase.

---

[//]: # (dependabot-end)

Bumps the x group with 3 updates:
[golang.org/x/crypto](https://github.com/golang/crypto),
[golang.org/x/net](https://github.com/golang/net) and
[golang.org/x/sys](https://github.com/golang/sys).

Updates `golang.org/x/crypto` from 0.51.0 to 0.52.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/crypto/commit/a1c0d9929856c8aba2b31f079340f00578eda803"><code>a1c0d99</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="https://github.com/golang/crypto/commit/3c7c86938f4541c333d506f719388d9c42d4763d"><code>3c7c869</code></a>
ssh: fix deadlock on unexpected channel responses</li>
<li><a
href="https://github.com/golang/crypto/commit/533fb3f7e4a5ae23f69d1837cd851d35ff5b76ce"><code>533fb3f</code></a>
ssh: fix source-address critical option bypass</li>
<li><a
href="https://github.com/golang/crypto/commit/abbc44d451a6f9236a2bbd26cbcd4d0fec473da3"><code>abbc44d</code></a>
ssh: fix incorrect operator order</li>
<li><a
href="https://github.com/golang/crypto/commit/e052873987615dc96fe67607a9a6adb76311344f"><code>e052873</code></a>
ssh: fix infinite loop on large channel writes due to integer
overflow</li>
<li><a
href="https://github.com/golang/crypto/commit/b61cf853a89d82cad68da5e12a6beca2116f8456"><code>b61cf85</code></a>
ssh: enforce user presence verification for security keys</li>
<li><a
href="https://github.com/golang/crypto/commit/9c2cd33e8d96a96133fd6ff732510ebba539c2bd"><code>9c2cd33</code></a>
ssh: enforce strict limits on DSA key parameters</li>
<li><a
href="https://github.com/golang/crypto/commit/890731877d85f71cfdc9554e7a27fec4684fc4c4"><code>8907318</code></a>
ssh: reject RSA keys with excessively large moduli</li>
<li><a
href="https://github.com/golang/crypto/commit/ffd87b4878fa98ca2908ec534e1a410bf095a35e"><code>ffd87b4</code></a>
ssh: fix panic when authority callbacks are nil</li>
<li><a
href="https://github.com/golang/crypto/commit/4e7a7384ecbc8d519f6f4c11b36fa9d761fc8946"><code>4e7a738</code></a>
ssh: fix deadlock on unexpected global responses</li>
<li>Additional commits viewable in <a
href="https://github.com/golang/crypto/compare/v0.51.0...v0.52.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `golang.org/x/net` from 0.54.0 to 0.55.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/net/commit/7770ec48d03fec35e378665337b4faca93c38423"><code>7770ec4</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="https://github.com/golang/net/commit/4ece7b612ad44ad6c4d5e0d5d4df9c18cc211905"><code>4ece7b6</code></a>
html: escape greater-than symbol in doctype identifiers</li>
<li><a
href="https://github.com/golang/net/commit/08be507abce89191d78cd49da60f4501fc910472"><code>08be507</code></a>
html: improve Noah's Ark clause performance</li>
<li><a
href="https://github.com/golang/net/commit/a8fb2fe4f7378f816302b9f2f7b8290ce512e5dd"><code>a8fb2fe</code></a>
html: properly render fostered elements in foreign content</li>
<li><a
href="https://github.com/golang/net/commit/0dc5b7a5f81d7155ade6d5e9db35992998679932"><code>0dc5b7a</code></a>
html: properly check namespace in &quot;in body&quot; any other end
tag</li>
<li><a
href="https://github.com/golang/net/commit/a452f3cc17168a60bc3f439a3ae0fcffc32eca0e"><code>a452f3c</code></a>
html: ignore duplicate attributes during tokenization</li>
<li><a
href="https://github.com/golang/net/commit/f8651996b24ba47d89dd9eb97fd47758e6d1886f"><code>f865199</code></a>
quic: fix appendMaxDataFrame erroneously accumulating sentLimit</li>
<li><a
href="https://github.com/golang/net/commit/210ed3cb901cb549818aefa04b71dadaf149d05d"><code>210ed3c</code></a>
quic: establish a &quot;happened-before&quot; relationship between
stream write and read</li>
<li><a
href="https://github.com/golang/net/commit/ad8140e0aa2ec41b37ea478b4525a423bcc21af9"><code>ad8140e</code></a>
quic: fix buffer slicing when handling overlapping stream data</li>
<li><a
href="https://github.com/golang/net/commit/23ee2efe81a3ff183b4eca46c42f749af7efca45"><code>23ee2ef</code></a>
http2: avoid API changes when built with go1.27</li>
<li>See full diff in <a
href="https://github.com/golang/net/compare/v0.54.0...v0.55.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `golang.org/x/sys` from 0.44.0 to 0.45.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/sys/commit/397d5f80920585bc27433d878aba498d062f81e1"><code>397d5f8</code></a>
unix: update to Linux kernel 7.0</li>
<li><a
href="https://github.com/golang/sys/commit/0a387f7a07d7a0e9811f00603c10b4e5a94ab79c"><code>0a387f7</code></a>
cpu: detect zbc extension on riscv64</li>
<li><a
href="https://github.com/golang/sys/commit/758f71cb839d131daf0ba4befa6a2c6ceb21a649"><code>758f71c</code></a>
cpu: add LLACQ_SCREL, SCQ, DBAR_HINTS detection for loong64</li>
<li><a
href="https://github.com/golang/sys/commit/99666ae32e07f6403182a79cb5df0c417cbbf25f"><code>99666ae</code></a>
unix: merge Linux readv/writev implementation with Darwin/OpenBSD</li>
<li><a
href="https://github.com/golang/sys/commit/e4444cbaaaf61cecff8e635874066fcd5c841575"><code>e4444cb</code></a>
windows: add NtSetEaFile, NtQueryEaFile and NtQueryInformationFile</li>
<li><a
href="https://github.com/golang/sys/commit/04396e85d470b7f990a9a1df5c1a44dc8e30c292"><code>04396e8</code></a>
unix: add Readv, Writev, Preadv, Pwritev for OpenBSD</li>
<li>See full diff in <a
href="https://github.com/golang/sys/compare/v0.44.0...v0.45.0">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-26 18:57:15 +00:00
dependabot[bot] 089ae2411e chore: bump github.com/gohugoio/hugo from 0.161.1 to 0.162.0 (#25698) 
Bumps [github.com/gohugoio/hugo](https://github.com/gohugoio/hugo) from
0.161.1 to 0.162.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/gohugoio/hugo/releases">github.com/gohugoio/hugo's
releases</a>.</em></p>
<blockquote>
<h2>v0.162.0</h2>
<p>The notable new feature in this release is support for <a
href="https://gohugo.io/configuration/imaging/#avif-images">AVIF
images</a> (both encoder and decoder). There's a <a
href="https://github.com/bep/hdrsdr.com">demo site</a> set up that
demonstrates the difference between HDR AVIF and SDR JPEG images. Note
that that demo is only really interesting if viewed on an HDR capable
screen (e.g. Apple Retina).</p>
<h2>Security fixes</h2>
<p>There are some notable security fixes in this release.</p>
<h3>Security fixes in Go</h3>
<p>This release upgrades from Go 1.26.1 to 126.3, which brings a set of
security fixes. Some relevant for Hugo are:</p>
<ul>
<li>XSS in html/template (CVE-2026-39826 &amp; CVE-2026-39823): Two
separate vulnerabilities where escaper bypasses in html/template could
lead to Cross-Site Scripting (XSS).</li>
<li>html/template: Fixes an issue where JS template literal contexts
were incorrectly tracked across template branches, which could lead to
improper content escaping.</li>
</ul>
<h3>Security fixes and hardening in Hugo</h3>
<p>The following changes either fix a concrete issue or reduce the
default attack surface of <code>hugo</code> builds.</p>
<ul>
<li><strong>Disallow <code>text/html</code> content files by
default</strong> (<a
href="https://github.com/gohugoio/hugo/commit/e41a06447d">e41a064</a>).
A new <code>security.allowContent</code> policy gates which content
media types may be used for pages under <code>/content</code>.
<code>text/html</code> is denied by default; sites that rely on
hand-authored or adapter-emitted HTML content can opt back in with
<code>security.allowContent = ['.*']</code>.</li>
<li><strong>Re-check <code>security.http.urls</code> on every redirect
hop in <code>resources.GetRemote</code></strong> (<a
href="https://github.com/gohugoio/hugo/commit/86fbb0f7a8">86fbb0f</a>).</li>
<li><strong>Reject symlinked entries in
<code>resources.Get</code></strong> (<a
href="https://github.com/gohugoio/hugo/commit/f8b5fa09a6">f8b5fa0</a>).</li>
</ul>
<p><strong>We will update this section later with links to CVEs where
applicable.</strong></p>
<h2>All changes</h2>
<ul>
<li>hugolib: Fix Page.GitInfo for modules with go.mod in a repo
subdirectory df542191 <a
href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14942">#14942</a></li>
<li>Fix typo in CONTRIBUTING.md 4bc7caea <a
href="https://github.com/bep"><code>@​bep</code></a></li>
<li>resources: Fix the :counter placeholder 5d51b82a <a
href="https://github.com/jmooring"><code>@​jmooring</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14921">#14921</a></li>
<li>commands: Fix import from Jekyll 81d77620 <a
href="https://github.com/jmooring"><code>@​jmooring</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14795">#14795</a>
<a
href="https://redirect.github.com/gohugoio/hugo/issues/14906">#14906</a></li>
<li>Fix prevention of direct symlink reads in resources.Get f8b5fa09 <a
href="https://github.com/bep"><code>@​bep</code></a></li>
<li>commands: Fix github-dark chromastyles 88d838a9 <a
href="https://github.com/xndvaz"><code>@​xndvaz</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14831">#14831</a></li>
<li>Disallow HTML content by default e41a0644 <a
href="https://github.com/bep"><code>@​bep</code></a></li>
<li>Add image processing support for AVIF 90d9f812 <a
href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/7837">#7837</a></li>
<li>config: Preserve intentionally empty maps 80e60847 <a
href="https://github.com/jmooring"><code>@​jmooring</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14944">#14944</a></li>
<li>hugolib: Merge existing hugo_stats.json when renderSegments is set
aeb9a5cc <a href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14939">#14939</a></li>
<li>all: Replace RWMutex struct caches with ConcurrentMap c4bbc280 <a
href="https://github.com/bep"><code>@​bep</code></a></li>
<li>tpl/tplimpl: Consolidate and improve embedded template integration
tests d8c70218 <a
href="https://github.com/jmooring"><code>@​jmooring</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14932">#14932</a></li>
<li>parser: Drop empty sub maps from hugo config output ee4f1acd <a
href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14855">#14855</a></li>
<li>markup/highlight: Allow overriding type and code via options
b6133657 <a href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/11872">#11872</a></li>
<li>Update AI assistance disclosure requirements d2c821b5 <a
href="https://github.com/bep"><code>@​bep</code></a></li>
<li>hugolib: Use AllTranslated in IsTranslated 4ed7600f <a
href="https://github.com/bep"><code>@​bep</code></a></li>
<li>tpl: Simplify sitemap template cbe4339a <a
href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14912">#14912</a></li>
<li>tpl: Use AllTranslations in sitemap template 6475d308 <a
href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14912">#14912</a>
<a
href="https://redirect.github.com/gohugoio/hugo/issues/14917">#14917</a></li>
<li>tpl/collections: Make dict return nil when no values are provided
67aede43 <a href="https://github.com/bep"><code>@​bep</code></a></li>
<li>Sync Go template package to 1.26.3 87f194b2 <a
href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14897">#14897</a></li>
<li>Upgrade to Go 1.26.3 d81e3c29 <a
href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14897">#14897</a></li>
<li>ci: Check embedded template formatting with gotmplfmt 7c65a4db <a
href="https://github.com/bep"><code>@​bep</code></a></li>
<li>tpl: Run gotmplfmt -w . d31a9275 <a
href="https://github.com/bep"><code>@​bep</code></a></li>
<li>markup/goldmark/codeblocks: Always split Chroma options into
.Options c36608c5 <a
href="https://github.com/jmooring"><code>@​jmooring</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14909">#14909</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/gohugoio/hugo/commit/076dfe13d0f789e3d9586b192f8f7f3329c26990"><code>076dfe1</code></a>
releaser: Bump versions for release of 0.162.0</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/e41a06447daa3071a01f333fdcec0a5153c3c8d1"><code>e41a064</code></a>
Disallow HTML content by default</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/90d9f812b2cafc79ca125a829936dec9654aec64"><code>90d9f81</code></a>
Add image processing support for AVIF</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/80e60847fb5d12f6a54fae782cb643a1772c38b6"><code>80e6084</code></a>
config: Preserve intentionally empty maps</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/df5421918a987cedaba42a050b0e4dde9c88ba3f"><code>df54219</code></a>
hugolib: Fix Page.GitInfo for modules with go.mod in a repo
subdirectory</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/aeb9a5cc02fad527220d6a40b1450661c6a56503"><code>aeb9a5c</code></a>
hugolib: Merge existing hugo_stats.json when renderSegments is set</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/c4bbc2805c7092deafabae01e71ff2dda37bd877"><code>c4bbc28</code></a>
all: Replace RWMutex struct caches with ConcurrentMap</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/d8c70218b7385125d807784534af5e5491bc30df"><code>d8c7021</code></a>
tpl/tplimpl: Consolidate and improve embedded template integration
tests</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/ee4f1acd93b417078715693fb22ce1fd2bab2684"><code>ee4f1ac</code></a>
parser: Drop empty sub maps from hugo config output</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/b6133657e006290375e587bfb6566469a14911af"><code>b613365</code></a>
markup/highlight: Allow overriding type and code via options</li>
<li>Additional commits viewable in <a
href="https://github.com/gohugoio/hugo/compare/v0.161.1...v0.162.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/gohugoio/hugo&package-manager=go_modules&previous-version=0.161.1&new-version=0.162.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-26 18:55:33 +00:00
Cian Johnston 579daaff70 feat: add GitLab support to coderd/externalauth/gitprovider 
Fixes CODAGT-146

Add GitLab support to the gitprovider package for gitsync/chatd PR
diff flows. This is a squashed stack of 3 PRs:

#25651 - refactor(coderd/externalauth): prepare gitprovider for multi-provider support
- Change gitprovider.New to return (Provider, error)
- Extract shared helpers (parseRetryAfter, checkRateLimitError,
  countDiffLines, escapePathPreserveSlashes) from github.go
- Update all callers (db2sdk, exp_chats, gitsync) for new signature
- Add error logging for provider construction failures
- Thread context through provider resolution

#25652 - feat(coderd/externalauth/gitprovider): add GitLab provider
- Implement full Provider interface: FetchPullRequestStatus,
  FetchPullRequestDiff, FetchBranchDiff, ResolveBranchPullRequest
- Handle nested groups, forks, and self-hosted instances
- Rate limit detection on both library and raw HTTP paths
- URL parsing/building with NormalizePullRequestURL support
- Unit tests covering error paths, URL parsing, state mapping
- Document GitLab configuration and known limitations

#25653 - test(coderd/externalauth/gitprovider): add GitLab VCR integration tests
- FetchPullRequestStatus: 4 fixtures (open, conflicts, merged, closed)
- FetchPullRequestDiff: 4 fixtures
- FetchBranchDiff: 3 fixtures (open, deleted, fork)
- ResolveBranchPullRequest: 3 fixtures
- go-vcr cassettes with sanitized GitLab API responses
 2026-05-25 17:41:02 +01:00
Cian Johnston a4afb9dfc6 feat: add --env-file flag to develop.sh (#25621) 
Adds `--env-file` to `scripts/develop.sh` to allow reading environment 
from a given file. This makes it easier to configure things like external 
auth providers, access URLs, and other dev-time settings without 
exporting a wall of environment variables in every shell session.

> Generated with [Coder Agents](https://coder.com/agents)
 2026-05-25 11:54:57 +01:00
Zach 8d0a73f0b1 chore: bump terraform-provider-coder and coder/preview for coder_secret removal (#25590) 
We decided to remove secret requirements and go a different direction
for secrets in Coder (see PLAT-243). As a result, we removed the code in
terraform-provider-coder and coder/preview to handle this resource. This
PR pulls in said updated versions.

Generated with assistance by Coder Agents.
 2026-05-22 07:57:54 -06:00
Mathias Fredriksson f1b772928d feat: parse execute tool commands and render them in the chat UI (#25478) 
When the execute tool runs a chained shell command, the UI previously
rendered the raw string. Long chains like "cd /repo && git pull &&
git add . && git commit -m fix" were hard to scan.

A new ChatMessagePart.ParsedCommands [][]string field on tool-call
parts carries one entry per simple command, parsed in chatd from args
via mvdan.cc/sh/v3/syntax. The frontend renders the joined list ("cd,
git pull, git add, git commit") in place of the raw command, and falls
back to the raw command when the field is absent.

Closes CODAGT-446
 2026-05-21 08:12:34 +00:00