mirror of
https://github.com/coder/coder.git
synced 2026-10-31 02:43:21 +08:00
2ac2295b1eb02c978e4e75708a9b6bd2d596f154
15361
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Asher
|
2ac2295b1e |
fix: do not send or use stale init dynamic parameter state (#27283)
In summary, we use the init message if we have no autofill params. If we do, then we ignore the init message, send another message with the autofilled values, and then when we get *that* response, finally we render the form since we know we have good state. This eliminates the possibility of temporarily rendering with stale state. This is the same fix that was applied to the edit page, but on the create page this time. The only difference is that the create page does not need to wait on a build parameters query, instead it has to wait on the first message from the socket (to get defaults). This also makes one change where we would send the defaults in the init message. The server already knows the defaults so there is no need to send them. The advantage here is that we no longer need to wait for the first message, and it also fixes an issue where fields with blank values were getting validation errors because they were not filled out, before the user had a chance to actually fill them out. |
||
|
Yevhenii Shcherbina
|
1453b4b1fc |
docs: document Bedrock mantle protocol (#27296)
Implements: https://linear.app/codercom/issue/AIGOV-518/add-docs-for-bedrock-mantle Follow-up to: https://github.com/coder/coder/pull/26745 |
||
|
Michael Suchacz
|
3dd9265fa6 |
feat: add UI option to disconnect OAuth2 MCP credentials (#27299)
Closes [CODAGT-804](https://linear.app/codercom/issue/CODAGT-804/add-ui-option-to-revoke-oauth-mcp-credentials). Users could authenticate with an OAuth2 MCP server from the chat input, but there was no UI to disconnect those per-user credentials. The backend endpoint (`DELETE /api/experimental/mcp/servers/{id}/oauth2/disconnect`) already existed. ## Changes - Connected OAuth2 MCP rows in the chat input plus menu now show a disconnect icon button next to the enable switch. It opens a confirmation dialog; confirming calls the disconnect endpoint, shows a toast, and refetches MCP configs so the row reverts to the `Auth` button without a reload. - New `disconnectMCPServerOAuth2` API client method and react-query mutation that invalidates `mcp-server-configs`. - Storybook interaction tests: control visibility per auth state, cancel makes no API call, confirm calls the endpoint once, failed disconnect keeps the dialog open. - Hardened `TestMCPServerConfigsOAuth2Disconnect`: seeded tokens flip `auth_connected`, disconnect only removes the calling user's token, and repeat disconnect stays idempotent. The endpoint removes the token stored in Coder; it does not revoke the upstream OAuth grant, so the UI copy says "disconnect" rather than "revoke". Validated with the targeted Go test, Storybook tests (51 passed), tsc, biome, the react-compiler check, and a manual dogfood run (seeded token, disconnect/cancel/reconnect flows verified in the UI). > This PR was authored by Mux, an AI coding agent, on Mike's behalf. |
||
|
Susana Ferreira
|
101aee8ee0 |
refactor: use Options struct in aibridgedserver.NewServer (#27200)
Refactor `aibridgedserver.NewServer` to take an `Options` struct instead of a long list of positional arguments. Follow-up to review feedback in https://github.com/coder/coder/pull/27117#discussion_r3571535760 |
||
|
Nick Vigilante
|
77582be805 |
fix: close <b> tag in generated audit log table header (#27293)
## What The audit log resource table header in `docs/admin/security/audit-logs.md` was emitted as `<b>Resource<b>`: a second opening `<b>` instead of a closing `</b>`. Because the bold element never closes, Markdown/HTML renderers can bold content well beyond the header cell. The page is generated (`<!-- Code generated by 'make docs/admin/security/audit-logs.md'. DO NOT EDIT -->`), so the fix belongs in the generator, `scripts/auditdocgen/main.go`, with the doc regenerated from it. ## Changes - `scripts/auditdocgen/main.go`: emit a closing `</b>` instead of a second `<b>` in the table header row. - `docs/admin/security/audit-logs.md`: regenerated with `make docs/admin/security/audit-logs.md`; only the header cell changes. ## Verification <details> <summary>Regenerated doc and local checks</summary> Header cell before (unclosed tag): ```text | <b>Resource<b> | ... ``` Header cell after (balanced tag): ```text | <b>Resource</b> | ... ``` - `make docs/admin/security/audit-logs.md` regenerates the page from the fixed generator and changes only the header cell (single line; the table stays aligned). - Local `make pre-commit` passed with `GEN_SKIP_GOLDEN=1` (this workspace has no Docker daemon for the golden-file gen step, which this change does not touch): `gen`, `fmt`, `lint/go`, `lint/ts`, `lint/markdown`, `lint/typos`, `lint/emdash`, and the slim binary build all green. </details> ## Linear DOCS-580: https://linear.app/codercom/issue/DOCS-580/fix-unclosed-b-tag-in-generated-audit-logs-table-header --- This PR was created using AI (Coder Agents) on behalf of @nickvigilante, who is accountable for its contents. See the [AI Contribution guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING). |
||
|
Cian Johnston
|
f7481c5d08 |
feat: Add full text search over chat messages (#27126)
Closes CODAGT-721 Closes CODAGT-722 Closes CODAGT-723 Closes CODAGT-724 Closes CODAGT-725 This PR adds the database and API pieces necessary to support full-text chat message search. - Adds required chat schema for full-text search - Adds dbpurge job to populate search_tsv in the background - Adds `search` parameter to GetChats query - Adds `search` filter to `searchquery.Chats` - Wires chat search filter into chats API > Implemented by Coder Agents, reviewed and tested by a human. |
||
|
Yevhenii ShcherbinaandJake Howell
|
9862f10484 |
feat(site): add Bedrock mantle protocol selector to provider form (#27156)
Implements: https://linear.app/codercom/issue/AIGOV-517/add-ui-for-bedrock-mantle Follow-up to https://github.com/coder/coder/pull/26745, which added AWS Bedrock **mantle** support to the backend and modeled it as a `protocol` field on the Bedrock provider settings. ## What changed - Adds a **Protocol** selector to the Bedrock provider form: InvokeModel (default) or Mantle. - The form is now protocol-aware: - **Model** / **Small-fast model** fields are shown only for InvokeModel. Mantle is a passthrough (the client sends the model at request time), so the fields are hidden and omitted from the saved settings. - **Endpoint** validation, placeholder, and hint switch per protocol. Mantle requires a `https://bedrock-mantle.{region}.api.aws/anthropic` URL; InvokeModel keeps the `https://bedrock-runtime.{region}.amazonaws.com` shape. The `/anthropic` suffix is required for mantle because the SDK appends `/v1/messages` to the base URL. ## Manual Testing Tested the following scenarios: 1. Creating a new Mantle provider — works. 2. Creating a new InvokeModel provider — works. 3. Verifying that an existing InvokeModel provider continues to work. 4. Upgrading an existing InvokeModel provider to Mantle — works. ## Screenshots ### InvokeModel <img width="1085" height="474" alt="image" src="https://github.com/user-attachments/assets/4c36b9b0-0eb8-4b17-80b7-e2112325f8d1" /> ### Mantle <img width="1082" height="357" alt="image" src="https://github.com/user-attachments/assets/e8caef26-83d1-4b7e-8f96-79079949e8f1" /> --------- Co-authored-by: Jake Howell <jake@hwll.me> |
||
|
Jeremy Ruppel
|
b3ff4baeb9 |
fix: smooth compose loader to files page transition (#27277)
## Summary During the template builder compose flow, the transition into the template files page briefly flashed the wizard form again before the files page settled. Root cause: the loader was gated on `createMutation.isPending`. When the compose POST resolved, `isPending` flipped to `false` in the same commit that `onSuccess` navigated to the files page, so `TemplateBuilderPageView` repainted the wizard form for a frame before the route change committed and unmounted it. Fix: keep the loader mounted while the mutation is pending **or** succeeded (`createMutation.isPending || createMutation.isSuccess`). Since `onSuccess` always navigates away, the loader stays until the component unmounts, so the form never reflashes. The error path is unaffected (`isSuccess` stays false). Resolves DEVEX-561. https://github.com/user-attachments/assets/6d5ec04e-9f97-4864-bd18-e1e75055f079 ## Scope Targets the wizard form reflash only. Two adjacent items were identified during investigation and intentionally left out: - The destination files page briefly shows its own `<Loader />` while it fetches template files. Smoothing that requires prefetching before navigation and is a larger change. - The `justCreated` "Awesome, you just created a template!" alert is cleared by a mount effect, so it renders one frame then disappears. Arguably its own bug. Happy to follow up on either if wanted. ## Testing - Biome clean on the changed file. - Manual: build a template through the wizard and confirm the loader holds straight through to the files page with no form flash. ## Stack Stacked on top of #27276 (DEVEX-593). --- Generated by Coder Agents. |
||
|
Jeremy Ruppel
|
3ddf7d3baa |
fix: stop the template builder build progress bar from looping (#27276)
## Summary The template builder's "Building your template" loader had a progress bar that animated 0→100% every 5s with an infinite repeat, so it visibly restarted over and over while a template built. It looked broken and was frustrating to watch. This replaces the looping fill with a single ease-out fill that decelerates toward 90% and holds until the request resolves and the loader unmounts. Since the loader is intentionally indeterminate and no progress is streamed to the browser, this also removes the now-dead `onUpdate` callback plumbing from the backend `waitForProvisionerJob` (its only caller passed `nil`). Resolves DEVEX-593. https://github.com/user-attachments/assets/6d5ec04e-9f97-4864-bd18-e1e75055f079 ## Commits - `refactor(coderd): drop unused onUpdate callback from waitForProvisionerJob` - `fix(site/src/pages/TemplateBuilder): stop build progress bar from looping` ## Testing - `go build ./coderd/` passes with the reduced `waitForProvisionerJob` signature. - Biome clean on the changed frontend file. - Storybook: `pages/TemplateBuilder/BuildingTemplateLoader` shows the bar fill once and hold, with no restart. <details> <summary>Implementation plan</summary> # DEVEX-593: Stop the build progress bar from looping repeatedly ## Problem While the template builder composes and imports a template, the FE shows `BuildingTemplateLoader`. Its progress bar animates from 0% to 100% over 5s with `repeat: Number.POSITIVE_INFINITY`, so it visibly restarts over and over. Users report this looks broken and is frustrating to watch while waiting. ## Decision (scope) Minimal fix only: **stop the loop**, plus remove the now-dead `onUpdate` plumbing from the backend. Since the UI is intentionally indeterminate and no progress signal is streamed, the callback serves no purpose and should be deleted rather than left as dead code. ### Why not "real sync" now - `POST /api/v2/templatebuilder/compose/template` is a single blocking request. It composes, bundles, inserts the provisioner job, then calls `waitForProvisionerJob(jobCtx, provisionerJob.ID, nil)` and only responds once the job completes. - The `onUpdate` callback runs server-side only. Nothing is streamed to the browser during the wait, so the FE has no progress signal to bind to. - A provisioner job exposes no numeric percentage. Only status transitions (`pending -> running -> succeeded`) and coarse log stages (`init/plan/graph/apply`) exist. Real sync would require converting the endpoint to a streaming protocol (SSE/WebSocket) plus FE rework, which is disproportionate for this 1-point ticket. ### Keep polling (do not switch to pubsub-block) The wait could technically block instead of poll: on completion `CompleteJob` publishes `ProvisionerJobLogsNotifyMessage{EndOfLogs: true}` on the job logs notify channel, so we could subscribe and wait for that message with the context timeout as a fallback. We deliberately do not do that here: correctness would require subscribe-before-completion plus an initial DB completion check to avoid a race, and Postgres LISTEN/NOTIFY is at-most-once (can drop under load), so a poll fallback would still be needed. The existing backoff poll (100ms -> 200ms -> 500ms -> 1s) is simple and robust for a short-lived synchronous request. ## Approach Replace the looping fill with a single, non-repeating ease-out fill that decelerates and approaches (but never reaches) ~90%, holding there until the request resolves and the loader unmounts. This reads as continuous forward progress for an unknown-duration operation and never restarts. The floating-icon animation is intentional ambient motion and is not in scope. ## Out of scope - Any behavioral change to how the endpoint waits (it still blocks on the job). - Streaming real job progress to the browser. - Changes to the floating-icon animation. </details> --- Generated by Coder Agents. |
||
|
TJandCoder Agents
|
529b2ead78 |
feat(site/src/pages/AgentsPage): show "Archived chats" sidebar heading when viewing archived chats (#26926)
In the agents sidebar, show "Archived chats" instead of "Chats" when the archive filter is set to `archived`. The heading reads the existing `sidebarFilters.archiveStatus` state, the same condition already used for the archived empty-state message. --- _This PR was opened by [Coder Agents](https://coder.com/) on behalf of @tracyjohnsonux._ --------- Co-authored-by: Coder Agents <noreply@coder.com> |
||
|
Michael Suchacz
|
e489092154 |
feat: handle revoked OAuth grants for MCP servers gracefully (#27264)
Closes [CODAGT-792](https://linear.app/codercom/issue/CODAGT-792/handle-revoked-oauth-grants-for-mcp-servers-gracefully). When a user revokes an upstream OAuth grant for an MCP server used by Coder Agents, Coder kept treating the cached token as valid: `invalid_grant` refresh failures were logged and swallowed, the dead bearer token kept being attached, the list endpoints re-attempted the refresh on every call, and the UI kept showing the server as authenticated. ## Changes Backend, mirroring the `external_auth_links` prior art: - New migration adds `mcp_server_user_tokens.oauth_refresh_failure_reason`. `UpsertMCPServerUserToken` clears it, so completing the OAuth flow again recovers the row. - New `MarkMCPServerUserTokenRefreshFailure` query records the failure and clears all token material, guarded by an `updated_at` optimistic lock so a stale failure never clobbers a concurrently refreshed token (on a lock miss the winner's row is used). - `mcpclient.IsPermanentRefreshError` classifies `*oauth2.RetrieveError` codes: only `invalid_grant` and `bad_refresh_token` are permanent. Client/config errors (`invalid_client`, `unauthorized_client`, ...) stay transient for the user row since reconnecting cannot fix them. - chatd token refresh and the MCP list/get endpoints persist permanent failures, return cleared tokens for the in-flight request, and skip provider calls for already-failed rows. - `buildAuthHeaders` no longer attaches an Authorization header for failed tokens, so chat degrades by omitting that server's tools instead of sending a dead bearer. API and UI: - No new API surface. A permanently failed token simply reports `auth_connected: false`, so the existing "Auth" button and "Not authenticated" tooltip appear and the user re-runs the same OAuth flow to recover. An earlier revision added an `auth_status` enum (`connected` / `not_connected` / `reconnect_required`) with a dedicated "Reconnect" button; it was collapsed to keep the API minimal since both states lead to the identical re-auth action. Out of scope (follow-up): typed 401-on-connect detection and forced refresh. mcp-go exposes no stable typed 401 signal in the static-header path, so a revocation while the access token still looks valid locally stays undetected until expiry triggers a refresh. ## Testing - Unit and integration tests: classifier, chatd refresh paths (permanent/transient/race/persist-failure), API endpoints (revoked, transient, no-retry caching, re-auth recovery, stale-lock), dbauthz, dbcrypt, migrations. - Dogfood UAT against a dev instance with a mock IdP returning `invalid_grant`: revoked grant detected on refresh and persisted once (no repeated IdP calls), chat with the revoked server selected completes with the server's tools omitted, and re-auth restores the connected state. > This PR was authored by Mux, working on Mike's behalf. |
||
|
Danielle Maywood
|
213f5ce606 | fix(site): redesign provider tri-state controls (#27288) | ||
|
Danielle Maywood
|
457fa5afa3 | fix(site): move thinking settings to provider configuration (#27287) | ||
|
Danielle Maywood
|
9d1e881093 | refactor(site/src/pages/AgentsPage): use model selector for personal overrides (#27229) | ||
|
Ehab Younes
|
35ade9e3d2 |
feat: collect workspace logs in support bundles (#26694)
Add workspace-side file collection to `coder support bundle` via repeatable --workspace-file flags. The agent resolves the requested paths or globs inside the remote workspace and streams back a tar with a manifest and the collected files; nothing is read from the machine running the command. - Add POST /api/v0/bundle-files to the agent's agentfiles package. - Expand env vars in the agent's environment; paths must then be absolute or start with ~/ (the agent user's home directory). - Support ** globs and tail oversized files. - Record requested patterns, per-path errors, truncation, and the applied limits in a manifest. - Unpack the archive into the bundle under agent/workspace_files/, recording dropped entries in collection_errors.txt. - Write a manifest-only archive marking collection as unsupported for agents that predate the endpoint. - Bound collection: 64 KB request body, 10000 files, 10 MiB per file, 100 MiB total including archive overhead, 110 MiB client-side read cap, 5 minute timeout. Closes #26020 |
||
|
Mathias Fredriksson
|
f997afa220 |
feat(coderd/x/chatd/chatloop): retain user constraints in compaction summaries (#27230)
Compaction summaries drop or soften user-stated constraints, corrections, and prohibitions, so post-compaction assistants repeat behavior the user already corrected. Add a summary prompt bullet that instructs the summarizer to quote them, treat them as standing until revoked, and attribute rules to their true source instead of defaulting to the user. Validated offline on unseen human chats: holdout P1 delta +0.175 (arbitrated), 13/18 cases improve. This improves per-compaction retention only; it does not address deep-chain correction loss. |
||
|
Spike Curtis
|
fa4c7c5700 |
chore: fix replicasync to function for NATS even if no DERP relay address is set (#27235)
<!-- If you have used AI to produce some or all of this PR, please ensure you have read our [AI Contribution guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING) before submitting. --> Fixes `replicasync` so that it keeps peers even if they don't set a RelayAddress. This allows NATS to function even if you are not running a DERP relay on the primay Coderd instances. Also renames some replicasync functions to make it clear they are for DERP. |
||
|
Ethan
|
21d08241e9 |
fix(coderd/x/chatd): recover timed out agents (#27254)
Closes CODAGT-802 Coder Agents only escalated failed workspace dials when the agent had connected and later disconnected. An agent that never connected and had already exceeded its `connection_timeout` stayed on the soft retry error indefinitely, so a chat could keep attempting tools against an unhealthy workspace. To fix, we'll classify the latest agent after a failed dial and return stop/start recovery guidance when its status is `timeout`. Agents still connecting, including templates with `connection_timeout = 0`, keep the existing retryable behaviour. ## Before <img width="843" height="229" alt="image" src="https://github.com/user-attachments/assets/d659a376-c8d4-4983-b7d7-d1a699770dfb" /> ## After <img width="848" height="250" alt="image" src="https://github.com/user-attachments/assets/26b88f72-f67c-4d9e-87b1-51d701b7352f" /> |
||
|
Bobby Ho
|
de716f89dc |
fix: normalize path before rate-limit bucket keying (#27273)
Coder's rate limiter keyed its bucket on the raw, un-normalized request path (`httprate.KeyByEndpoint` reads `r.URL.Path` directly). The router's `singleSlashMW` already collapses redundant slashes so a request like `/api/v2/users//validate-password` reaches the same handler as the canonical path, but it never touched `r.URL.Path`, so the rate limiter saw a different key and let a client bypass a limit it had already hit just by respelling the URL. `keyByNormalizedEndpoint` replaces `KeyByEndpoint` and runs `path.Clean` on `r.URL.Path` before using it as the key, so equivalent paths share one bucket. Includes a unit test at the key-function level and an integration test (`TestRateLimitPathNormalization`) that reproduces the bypass against a real server. Fixes CDM-02-003 (Cure53). Refs https://github.com/coder/security-disclosures/issues/166. |
||
|
dependabot[bot]
|
0fab0fa0ae |
chore: bump github.com/DataDog/dd-trace-go/v2 from 2.0.0 to 2.8.1 (#27282)
Bumps [github.com/DataDog/dd-trace-go/v2](https://github.com/DataDog/dd-trace-go) from 2.0.0 to 2.8.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/DataDog/dd-trace-go/releases">github.com/DataDog/dd-trace-go/v2's releases</a>.</em></p> <blockquote> <h2>v2.8.1</h2> <!-- raw HTML omitted --> <h3>Application Performance Monitoring (APM)</h3> <ul> <li>Revert "fix(ddtrace/tracer): cache trace ID hex encoding (<a href="https://redirect.github.com/DataDog/dd-trace-go/issues/4481">#4481</a>)" by <a href="https://github.com/darccio"><code>@darccio</code></a></li> <li>fix(tracer): enforce baggage item and byte limits on extraction by <a href="https://github.com/mtoffl01"><code>@mtoffl01</code></a> in <a href="https://redirect.github.com/DataDog/dd-trace-go/issues/4720">#4720</a></li> <li>fix(tracer): drop dd= list-entries over 256 bytes from incoming tracestate by <a href="https://github.com/mtoffl01"><code>@mtoffl01</code></a> in <a href="https://redirect.github.com/DataDog/dd-trace-go/issues/4721">#4721</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/DataDog/dd-trace-go/compare/v2.8.0...v2.8.1">https://github.com/DataDog/dd-trace-go/compare/v2.8.0...v2.8.1</a></p> <h2>v2.8.0</h2> <!-- raw HTML omitted --> <h2>Summary</h2> <p><strong>New integrations.</strong> Two new integrations land in this release: Azure API Management (APIM) callout processor for security (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4620">#4620</a>), and twmb/franz-go for Kafka (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4250">#4250</a>).</p> <p><strong>Data Streams Monitoring.</strong> All three major Kafka integrations — confluent-kafka-go (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4470">#4470</a>), segmentio/kafka-go (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4477">#4477</a>), and Sarama (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4560">#4560</a>) — now attach <code>kafka_cluster_id</code> for cluster-level visibility. <code>TrackDataStreamsTransaction</code> also gains span tagging and custom timestamp support (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4499">#4499</a>).</p> <p><strong>OpenTelemetry (OTel) and OTLP.</strong> The tracer can now export traces directly via the OpenTelemetry Protocol (OTLP), bypassing the Datadog Agent entirely (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4600">#4600</a>, <a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4583">#4583</a>). OTel process context v2 (OTLP proto format) is supported (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4478">#4478</a>), and the <code>parentbased_always_on</code> sampler works in OTLP mode (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4567">#4567</a>).</p> <p><strong>Large Language Model (LLM) Observability.</strong> Prompt tracking is now available for LLMObs spans (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4608">#4608</a>). Experiment scope propagates from APM baggage into spans automatically (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4651">#4651</a>).</p> <p><strong>Profiler.</strong> An experimental goroutine leak profile is available as opt-in (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4420">#4420</a>). The goroutine wait profile type has been removed — this is a breaking change for anyone using it explicitly (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4589">#4589</a>).</p> <p><strong>HTTP and tracing.</strong> A new environment variable <code>DD_TRACE_HTTP_URL_QUERY_STRING_ALLOWLIST</code> lets you whitelist query string parameters to keep unredacted (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4562">#4562</a>). A new <code>tracer.StartSpanFromPropagatedContext</code> API simplifies span creation from propagated contexts (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4492">#4492</a>). AWS EventBridge max payload size is bumped to 1 MB (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4458">#4458</a>). Envoy Service Extensions integration gains Unix Domain Socket (UDS) support (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4463">#4463</a>).</p> <p><strong>OpenFeature.</strong> Flag evaluation metrics now emit via OTel Metrics (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4489">#4489</a>), with allocation key tagging (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4515">#4515</a>) and Remote Configuration (RC) integration via <code>FFE_FLAGS</code> subscription at tracer startup (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4495">#4495</a>).</p> <p><strong>Bug fixes.</strong> gorm now respects <code>DD_TRACE_REMOVE_INTEGRATION_SERVICE_NAMES_ENABLED</code> (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4618">#4618</a>). Redis and Valkey pipeline commands are joined with newlines, fixing agent obfuscation (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4593">#4593</a>). A race condition in HTTP client trace timings is resolved (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4591">#4591</a>). AppSec block responses now include a correct <code>Content-Length</code> header (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4496">#4496</a>), and spurious Remote Configuration errors are silenced when RC is disabled (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4612">#4612</a>). <code>ContextWithSpan</code> no longer panics on nil context (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4313">#4313</a>). The OTel bridge preserves keep/drop sampling decisions for unsampled spans (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4631">#4631</a>). User-provided DogStatsD addresses now correctly take priority over defaults (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4575">#4575</a>).</p> <p><strong>Performance.</strong> Trace ID hex encoding is cached (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4481">#4481</a>), the span metadata map is preallocated (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4541">#4541</a>), and locking is removed from both sampling priority access (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4546">#4546</a>) and the internal logger (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4547">#4547</a>) — reducing allocations and contention on hot paths.</p> <p><strong>CI Visibility.</strong> Bazel offline cache and payload-file modes are supported (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4503">#4503</a>). Known test pagination is implemented for large test suites (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4509">#4509</a>).</p> <h2>What's Changed</h2> <h3>Application Performance Monitoring (APM)</h3> <ul> <li>feat: collect service override source by <a href="https://github.com/raphaelgavache"><code>@raphaelgavache</code></a> in <a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4500">DataDog/dd-trace-go#4500</a></li> <li>feat: support service source for 19 integrations by <a href="https://github.com/raphaelgavache"><code>@raphaelgavache</code></a> in <a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4526">DataDog/dd-trace-go#4526</a></li> <li>feat: support service source for 13integrations by <a href="https://github.com/raphaelgavache"><code>@raphaelgavache</code></a> in <a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4534">DataDog/dd-trace-go#4534</a></li> <li>feat: add service source on 10 integrations by <a href="https://github.com/raphaelgavache"><code>@raphaelgavache</code></a> in <a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4540">DataDog/dd-trace-go#4540</a></li> <li>feat: force usage of ServiceWithSource in contrib by <a href="https://github.com/raphaelgavache"><code>@raphaelgavache</code></a> in <a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4549">DataDog/dd-trace-go#4549</a></li> <li>fix(eventbridge): update max payload size to 1m by <a href="https://github.com/Dogbu-cyber"><code>@Dogbu-cyber</code></a> in <a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4458">DataDog/dd-trace-go#4458</a></li> <li>feat(telemetry): add stable session identifier headers by <a href="https://github.com/khanayan123"><code>@khanayan123</code></a> in <a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4574">DataDog/dd-trace-go#4574</a></li> <li>feat: collect service source in client stats by <a href="https://github.com/raphaelgavache"><code>@raphaelgavache</code></a> in <a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4519">DataDog/dd-trace-go#4519</a></li> <li>feat: OTel process context v2 (otlp proto) by <a href="https://github.com/nsavoire"><code>@nsavoire</code></a> in <a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4478">DataDog/dd-trace-go#4478</a></li> <li>fix: join redis and valkey pipeline commands with newlines for correct agent obfuscation by <a href="https://github.com/rarguelloF"><code>@rarguelloF</code></a> in <a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4593">DataDog/dd-trace-go#4593</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/DataDog/dd-trace-go/commit/2b2b2c2c9c420dcc5df24165681ed11c3f1c8438"><code>2b2b2c2</code></a> chore: make fix-modules && make generate</li> <li><a href="https://github.com/DataDog/dd-trace-go/commit/21438ed81625961b1393806128b142fa7e3829d7"><code>21438ed</code></a> internal/version: v2.8.1</li> <li><a href="https://github.com/DataDog/dd-trace-go/commit/0bc11f30cc930602a07c90a3b106b72bca13ecc0"><code>0bc11f3</code></a> internal/orchestrion/_integration: v2.8.1-rc.2</li> <li><a href="https://github.com/DataDog/dd-trace-go/commit/f17a712cf0ef081a42e1e972da5cb7d0d09fb1b5"><code>f17a712</code></a> orchestrion/all: v2.8.1-rc.2</li> <li><a href="https://github.com/DataDog/dd-trace-go/commit/1b8d8e59ef212bae8097c7025e13fcbb99a0e554"><code>1b8d8e5</code></a> internal/traceprof/traceproftest: v2.8.1-rc.2</li> <li><a href="https://github.com/DataDog/dd-trace-go/commit/7b30b1f0aec1bfd1f7f4a38edaccccd9c691c8fb"><code>7b30b1f</code></a> contrib/aws/datadog-lambda-go/test/integration_tests/error: v2.8.1-rc.2</li> <li><a href="https://github.com/DataDog/dd-trace-go/commit/96cc2a4c04453a99cba785cafe17ffb6e9a316a9"><code>96cc2a4</code></a> contrib/aws/datadog-lambda-go/test/integration_tests/hello: v2.8.1-rc.2</li> <li><a href="https://github.com/DataDog/dd-trace-go/commit/f3013b5aed4b2051a3da540cafeedbb05d4b89f9"><code>f3013b5</code></a> instrumentation/internal/validationtest: v2.8.1-rc.2</li> <li><a href="https://github.com/DataDog/dd-trace-go/commit/c9f98439255531363157d4f1b312c594c5ec10e6"><code>c9f9843</code></a> contrib/labstack/echo.v4: v2.8.1-rc.2</li> <li><a href="https://github.com/DataDog/dd-trace-go/commit/e07b30bb083cb5e2aba59f083319f921118d174a"><code>e07b30b</code></a> contrib/valyala/fasthttp: v2.8.1-rc.2</li> <li>Additional commits viewable in <a href="https://github.com/DataDog/dd-trace-go/compare/v2.0.0...v2.8.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/coder/coder/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Andrew Aquino
|
baf4dfae4d |
fix(site/src/pages/TemplateBuilder): display TemplateCard/ModuleCard's official badge inline (#27036)
closes DEVEX-575 There are some screen widths / base template names where the official badge will break lines by itself as an orphan (see Google Compute Engine (Linux) in screenshot below). However, I personally prefer this over the current flex layout (compare with the screenshot in original issue) <img width="1840" height="1191" alt="image" src="https://github.com/user-attachments/assets/d5bee310-0202-4d45-aef7-767e457be051" /> Unfortunately ` ` only works if the entities on either side are both text--not text on the left + image on the right, which is what we have here. ^One alternative to prevent orphan badges is to split the base template name by words, then wrap the last word + the official badge in a span with `white-space: nowrap;`. But that feels a little overwrought to me; I like the clarity of continuing to just show `{name}` in the JSX. What do you guys think? |
||
|
Callum Styan
|
15da504cf9 |
fix: remove excess calls to prepareSQLFilter for workspace and template endpoints (#27248)
|
||
|
Asher
|
4d4cbd07e6 |
fix: prevent concurrent token refreshes (#26530)
This can cause bad refresh token errors, since it can only be used once. Looks like there was an attempt to fix this by checking the database after a failed refresh, but of course this depends on the first request having updated the database in time, so both that and this fix are required to fully solve. |
||
|
Nick Vigilante
|
c14b4a010a |
chore(offlinedocs): update low-risk dependencies (#26876)
## Summary
Updates the `offlinedocs` doc-preview app's dependencies that can move
without code migration, and leaves the heavy framework upgrades for a
separate, deliberate PR.
## Changes
- `react-markdown` 9.1.0 → 10.1.0: used in source
(`pages/[[...slug]].tsx`, the `ReactMarkdown` renderer). The
`components` / `urlTransform` / `remarkPlugins` / `rehypePlugins` API we
rely on is unchanged across the major bump.
- `react-icons` 4.12.0 → 5.7.0: used in source (`MdMenu`, the mobile-nav
hamburger icon). The v5 API is backwards-compatible for our single
import.
- `sanitize-html` 2.17.4 → 2.17.5: used in source
(`sanitizeHtml(body)`); patch bump.
- `prettier` 3.8.3 → 3.9.4 (dev): minor bump, used by the `format`
scripts.
- `@types/node` 20.19.41 → 22.20.0 (dev): types only, capped at the 22.x
line to match the Node 22 runtime rather than tracking latest (26.x).
- `archiver` 6.0.2 → 8.0.0: not imported anywhere in source, so no
render risk (see Notes).
Intentionally **deferred** (coupled breaking migration, touches
component code): Chakra UI v2 → v3, React 18 → 19, Next 15 → 16, ESLint
8 → 10 + flat config, framer-motion 10 → 12.
## Testing
- `tsc --noEmit`: passes.
- `next build` (static export): all 442 pages prerender.
- Dev server launches; `/` and a markdown-rendered page (`/install/`)
both return HTTP 200 and render correctly.
- Verified on Node 22.19.0 / pnpm 10.33.2 (the repo-pinned toolchain);
lockfile `overrides:` block preserved.
## Notes
- `archiver` appears to be a dead dependency (nothing in source imports
it) and could be pruned in a follow-up. It is bumped here only to keep
the lockfile current.
---
🤖 Built with AI assistance.
|
||
|
Faur Ioan-Aurel
|
0caaac5d27 |
fix: prebuild coderd before Playwright startup for e2e tests (#27136)
The test-e2e job could flake while Playwright waited for its webServer to become ready. CI already built site/e2e/bin/coder, but that binary was built before pnpm build and without the embed tag, so Playwright ignored it and started coderd with go run -tags embed instead. That put Go compilation, including frontend asset embedding, inside Playwright's webServer timeout. Local runs had a similar ordering trap. pnpm playwright:test invoked Playwright directly, and Playwright starts webServer before globalSetup, so the existing preflight build could not guarantee a binary existed before webServer startup. Build the E2E coder binary with the embed tag and make it depend on site/out/index.html. In CI, build the frontend first, then build the E2E binary, then run Playwright. For local runs, have pnpm playwright:test and pnpm playwright:test-ui run make site/e2e/bin/coder before invoking Playwright. Playwright now starts the prebuilt site/e2e/bin/coder binary and waits on the public /healthz endpoint instead of an authenticated API endpoint. This keeps compilation outside the webServer readiness timeout and makes the readiness probe quieter and more direct. I moved to /healtz because the existing endpoint was returning 401, which still means “server is up,” but it is a strange readiness signal. /healthz is explicitly public and returns 200 OK once the HTTP server is accepting requests. Caveat: running pnpm exec playwright test --config=e2e/playwright.config.ts directly bypasses the package script and therefore bypasses the prebuild. Use pnpm playwright:test or make test-e2e for the supported local flow. Because the site package scripts now call make, add make to knip's ignored system binaries. Tests: - pnpm lint:types - pnpm exec playwright test --config=e2e/playwright.config.ts --list - PATH="/opt/homebrew/opt/make/libexec/gnubin:/opt/homebrew/opt/gnu-getopt/bin:$PATH" make gen/mark-fresh - PATH="/opt/homebrew/opt/make/libexec/gnubin:/opt/homebrew/opt/gnu-getopt/bin:$PATH" pnpm playwright:test --list <!-- If you have used AI to produce some or all of this PR, please ensure you have read our [AI Contribution guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING) before submitting. --> |
||
|
Nick Vigilante
|
c84aa564ba |
docs: normalize code-fence languages for Shiki compatibility (#27161)
Normalizes non-standard code-fence language tags across `docs/**` so a strict highlighter (Shiki, used by Fumadocs) won't fail the build on an unrecognized language, and unifies redundant synonym tags onto one canonical form per language. The current renderer (Speed-Highlight) detects the language from the code content, not the fence label, so this drift wasn't visible until now. ## Changes - `hcl` -> `tf` (199 fences, including indented ones nested in numbered/bulleted lists). Shiki ships `hcl` and `terraform` as two distinct grammars (not aliases); every `hcl`-tagged fence in `docs/**` is actually Terraform resource/data/provider syntax, so the more specific `terraform` grammar is correct for all of them. `tf` is Shiki's own alias for that grammar, and it's also what GitHub's own markdown renderer resolves to the same HCL/Terraform highlighting. - `pwsh`/`powershell` -> `ps1`. Both `ps` and `ps1` are registered PowerShell aliases in Shiki, but on GitHub's renderer only `.ps1` is a registered file extension (`.ps` isn't), so `ps1` renders identically to `powershell` there today while bare `ps` would silently lose highlighting. - `env` -> `dotenv` (a dedicated Shiki grammar for `KEY=VALUE` files) - `text`/`output`/`none`/`url` -> `txt`. Same built-in plain-text fallback either way, just shorter. - `Dockerfile` -> `dockerfile` (lowercase) - `bash`/`shell` -> `sh` (732 fences). Shiki and GitHub both alias all three to a single shell grammar; this was already the style guide's stated preference, just not enforced across the existing corpus until now. - `markdown` -> `md` (4 fences). Alias of the same grammar in both Shiki and GitHub. - `jsonc` -> `json` (1 fence). The block has no comments or trailing commas, so it doesn't need the comments-capable grammar. - `ts` -> `tsx` (2 fences, `docs/about/contributing/frontend.md`). Verified the actual content tokenizes identically under both grammars, and a sibling block in the same file already needs `tsx` for real JSX, so unifying to one tag is safe for this file. Documented a caveat: `tsx` mis-tokenizes the legacy angle-bracket type-assertion syntax (`<Type>value`), which is invalid in real `.tsx` files anyway, so use `value as Type` instead. - `yml` -> `yaml` (1 fence) - Updated `docs/.style/style-guide/formatting.md` to document all canonical tags `promql` (2 fences) and `caddyfile` (2 fences) are left as-is. Shiki doesn't bundle a grammar for either, so they need a custom grammar registration when the site adopts Shiki, rather than degrading to `txt`. Tracked as follow-up work under DOCS-118 and [DOCS-544](https://linear.app/codercom/issue/DOCS-544/vendor-a-local-promql-grammar-for-shiki-syntax-highlighting) (promql). Does not touch `offlinedocs/`. Linear: [DOCS-476](https://linear.app/codercom/issue/DOCS-476/normalize-docs-code-fence-languages-de-risk-shikifumadocs) <details> <summary>How the fence tags were verified</summary> Each tag was tested against a real `shiki@latest` highlighter instance (`codeToHtml`/`codeToTokens`) and cross-checked against GitHub's `@wooorm/starry-night` grammar sources (the renderer that actually displays these `.md` files today, in repo browsing and PR diffs), since that's what determines whether brevity is safe before Shiki adoption: ```text FAIL env -- Language `env` is not included in this bundle. FAIL Dockerfile -- Language `Dockerfile` is not included in this bundle. FAIL promql -- Language `promql` is not included in this bundle. FAIL caddyfile -- Language `caddyfile` is not included in this bundle. FAIL pwsh -- Language `pwsh` is not included in this bundle. FAIL output -- Language `output` is not included in this bundle. ``` `hcl` doesn't error in Shiki, since it's a real grammar, but that's exactly the trap: it was silently rendering every fence with the generic HCL grammar instead of the Terraform-specific one. Every `hcl`-tagged fence in `docs/**` was manually checked against `origin/main` and is genuinely Terraform content. For `ts`/`tsx`, tokenizing the actual doc content confirmed identical output under both grammars; a synthetic test with the legacy angle-bracket cast syntax confirmed `tsx` degrades on that specific construct, which the style guide now calls out. The first normalization pass only matched fence tags at column 0 (`^```tag$`), missing tags indented inside numbered/bulleted lists. A follow-up pass caught the remaining occurrences at any indentation level. </details> --- *This PR description and the underlying changes were prepared with Coder Agents assistance.* |
||
|
Jeremy Ruppel
|
d0982e3cc7 |
fix(coderd/templatebuilder): prompt for DigitalOcean base variables (#27268)
## Summary The DigitalOcean template builder base declared Terraform `variable` blocks for `project_uuid` and `ssh_key_id` that the template builder never filled. `project_uuid` was required with no default, so the build broke with no way to supply a value from the wizard (DEVEX-591). This brings the DigitalOcean base to parity with the GCP bases fixed in #27015: - Declare `project_uuid` (required) and `ssh_key_id` (optional, default `0`) in `base.json` so the wizard prompts for them on the first step. - Inject the entered values via `default = {{ .Variables.* }}` in `main.tf.tmpl`, keeping the existing `variable` blocks and validation. - Drop the `sensitive` flags. The variable-injection path (`mergeBaseVariables`, `DefaultBaseRenderContext`, and the snapshot test helper) skips sensitive variables, so a sensitive base variable renders empty. A project UUID / SSH key ID are not secrets. - Update the README now that the values are prompted rather than manually edited. - Regenerate the `digitalocean-linux.tf.golden` snapshot. ## Testing - `go test ./coderd/templatebuilder/` <img width="1048" height="616" alt="Screenshot 2026-07-15 at 12 44 42 PM" src="https://github.com/user-attachments/assets/89e334ca-e904-4387-9264-6ed1614a40ba" /> <details> <summary>Audit of all template builder bases for unfilled variables</summary> | Base | Variable status | Verdict | |------|-----------------|---------| | aws-linux | no HCL `variable` blocks; provider env auth | OK | | aws-windows | same | OK | | azure-linux | same | OK | | **digitalocean-linux** | `project_uuid` (required, no default) + `ssh_key_id`; absent from `base.json` | **Fixed here** | | docker | `docker_socket` has `default = ""`; `container_image` via `{{ .Variables }}` + declared | OK | | gcp-linux | fixed in #27015 | OK | | gcp-windows | fixed in #27015 | OK | | kubernetes | `namespace` (required), `use_kubeconfig`, `container_image` all via `{{ .Variables }}` + declared | OK | | scratch | no variables | OK | DigitalOcean was the only broken base; all others either have safe defaults or already declare their variables. **Mechanism note:** `base.json` `variables[]` drives the first-step prompts and values are injected as HCL literals via `{{ .Variables.<name> }}` (strings quoted, numbers/bools raw; supported types: string, number, bool). Sensitive/computed variables are intentionally skipped everywhere the injection map is built, so they cannot currently be injected. That is why the `sensitive` flags were removed here. </details> --- *This PR was generated by Coder Agents on behalf of @jeremyruppel.* |
||
|
Steven Masley
|
3b72a3e5dd |
test(coderd/rbac): add many-orgs authorization benchmark (#27270)
<!-- Authored with Coder Agents on behalf of @Emyrk --> Adds `BenchmarkRBACManyOrgs` to measure `Authorize`, `Prepare` (partial evaluation), and `Prepare`+`CompileToSQL` as a subject's org-membership count grows (1, 5, 10, 50, 100 orgs). - Written to evaluate the org set-membership rewrite in #27244, where partial-eval cost scales with org count. - Subject uses pre-expanded cached roles (`WithCachedASTValue`), member + per-org `organization-member` roles, `ScopeAll`; authorizer has no cache so each iteration measures a real evaluation. Results comparing `main` vs #27244 are posted on that PR. <sub>Coder Agents on behalf of @Emyrk.</sub> |
||
|
Bobby HoandCian Johnston
|
511c3cddc0 |
fix(testutil/expecter): remove nested pipe from output logging path (#27204)
## Summary Partial fix for the flake in [PLAT-251](https://linear.app/codercom/issue/PLAT-251/flake-test-go-pg-macos-job-timeoutcancelled) / [coder/internal#1365](https://github.com/coder/internal/issues/1365) (`test-go-pg (macos-latest)` timing out and getting cancelled after 25 minutes). ## Problem `testutil/expecter.Expecter` drains a command's stdout/stderr through `io.Copy` into an internal buffer, but it also teed every write through a **second, independent unbuffered `io.Pipe()`**, read by a `bufio.Scanner`, purely to produce human-readable debug logs: ```go logr, logw := io.Pipe() w := io.MultiWriter(logw, out) // out never blocks; logw is a second unbuffered pipe go func() { io.Copy(w, r) }() // drains the command's real stdout/stderr go func() { bufio.NewScanner(logr).Scan() ... }() // only reads when scheduled ``` `io.MultiWriter` only returns once **every** writer succeeds. If the scanner goroutine is ever delayed (GC pause, scheduler contention under CI's `-parallel=16` test config), the write into `logw` blocks, which blocks the `io.Copy` write, which stops it from reading the command's actual output pipe, which means the **command's own write can never complete either**, since nobody is left reading it. Nothing on this path has a timeout, so once wedged it stays wedged until `go test`'s own `-timeout 20m` kills the whole binary. This reproduced locally in `TestConfigSSH_FileWriteAndOptionsFlow` under the macOS CI job's exact parallelism, stuck writing a routine "executable not in `$PATH`" warning (`cli.currentBinPath`) that the test wasn't actively reading at that instant. It's a flake, not a deterministic failure, because under light load the scanner always keeps up trivially. ### Race condition ```mermaid sequenceDiagram participant TG as Test goroutine participant CmdG as Command goroutine<br/>(inv.Run) participant P1 as Pipe 1<br/>(inv.Stdout) participant Copy as io.Copy goroutine participant P2 as Pipe 2<br/>(logw/logr, debug logging only) participant Scan as Scanner goroutine participant Buf as stdbuf (out)<br/>unbounded, never blocks CmdG->>P1: Write(warning output) P1-->>Copy: Read() unblocks Copy->>P2: MultiWriter step 1: write to logw Copy->>Buf: MultiWriter step 2: write to out rect rgb(255, 230, 230) Note over Scan: Under heavy parallel test load,<br/>Scan()'s next Read() is delayed P2--xCopy: Write(logw) blocks: nobody reading yet end Copy--xP1: Read() no longer called: Copy is stuck writing to P2 CmdG--xP1: Write() can't complete either: nobody reads Pipe 1 Note over CmdG: Command write blocks FOREVER<br/>(confirmed: 17-18 min in a goroutine dump) TG->>TG: ExpectMatch times out (got ""), fails the test Note over TG,CmdG: Test goroutine exits, but CmdG is<br/>orphaned and permanently blocked until<br/>go test's own -timeout kills the binary ``` ## Fix Remove the second pipe. `io.Copy` now writes only to the unbounded, non-blocking `stdbuf`. Debug logging is forwarded via a **bounded, non-blocking channel** instead of a second unbuffered pipe: a full channel just drops the chunk rather than propagating backpressure. This works because the only thing the command's real output pipe depends on is `io.Copy(out, r)`, and `out.Write()` can never block, so `io.Copy` always keeps calling `Read()`, so the command's write always has an active reader. Debug logging becomes provably unable to backpressure the command under test, since losing an occasional log line under extreme load is an acceptable tradeoff, unlike losing a whole CI job to a silent deadlock. The fix lives in the shared harness rather than in `cli/configssh.go` because the warning it's tripping over is legitimate, unrelated product behavior; every other test using this harness that happens to emit output the test isn't actively matching at that instant was exposed to the same bug. **Note:** this addresses one of two distinct root causes bundled under PLAT-251. The other is a Depot `GOCACHEPROG` shutdown hang in CI infrastructure (outside this repo, previously diagnosed by a maintainer on the Feb 2026 incident), which this change cannot affect. Locally this fix measurably improves things, but a residual, load-dependent hang was still observed under extreme synthetic contention on a shared dev machine; watching several real CI runs is the next step before considering the flake fully resolved. --------- Co-authored-by: Cian Johnston <cian@coder.com> |
||
|
Cian Johnston
|
f958727887 |
chore: update mise.lock (#27258)
`mise install` now adds more properties to `mise.lock` after running `mise install`: - Bare URLs get `checksum` and `url` - GitHub URLs get an `api_url` to the release asset |
||
|
Spike Curtis
|
ac35e0d3d8 |
test: fix flake in TestServer/Logging (#27263)
<!-- If you have used AI to produce some or all of this PR, please ensure you have read our [AI Contribution guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING) before submitting. --> fixes https://github.com/coder/internal/issues/1618 same underlying issue as https://github.com/coder/internal/issues/946 Test flakes because main test ends before the server can connect to postrgres and this causes the CLI invocation to return an error we don't care about. |
||
|
Cian Johnston
|
c57d6fcef0 |
chore(helm): update logo URL (#27262)
Updates logo URL to the same referenced by our README. |
||
|
Marcin Tojek
|
2bea8fb382 |
fix(scripts/releaser/v1): remove doubled "v" in release calendar latest release link (#27260)
## Problem
The interactive releaser (`scripts/releaser`) renders the "Latest
Release"
cell of the release calendar with a doubled version prefix, e.g.
`[vv2.35.0](.../tag/v2.35.0)`.
`version.String()` already returns a `v`-prefixed string (e.g.
`v2.35.0`),
but `updateCalendar` wrapped it in a `"[v%s]"` template, so the link
label
gained a second `v`. The tag URL was already correct because release
tags
carry the `v` prefix.
## Fix
Drop the extra `v` from the label template (`"[v%s]"` → `"[%s]"`). The
URL is
unchanged.
- Label before: `[vv2.35.0]`
- Label after: `[v2.35.0]`
## Test
Added `scripts/releaser/v1/docs_test.go`:
- `TestUpdateCalendarLatestReleaseVersionPrefix` asserts the
`LatestRelease`
cell for a matching row on both a patch and a minor release. It fails on
the
old code (`[vv2.35.x]`) and passes with the fix.
- `TestUpdateCalendarNotReleasedRowName` covers the `Not Released` →
`Mainline`
promotion and the major.minor "Release name" link (patch omitted).
<details>
<summary>Investigation notes</summary>
- Entry path: `scripts/release.sh` → `go run ./scripts/releaser
--legacy` →
`runRelease` → `promptAndUpdateDocs` → `updateReleaseDocs` →
`updateCalendarFile` → `updateCalendar` (`scripts/releaser/v1/docs.go`).
- Root cause in `updateCalendar`: `fmt.Sprintf("[v%s](%s)",
newVer.String(), ...)`
combined with `version.String()` returning `v%d.%d.%d`.
- Only the link label was affected; the `releaseTagURLFmt` URL was
correct
because tags are `v`-prefixed.
- The standalone `scripts/update-release-calendar.sh` is a separate
implementation and is not affected (it strips the `v` before re-adding
one).
- Companion PR for `release/2.35` (file `scripts/releaser/docs.go`):
#27259.
</details>
---
This PR was generated by Coder Agents.
|
||
|
Ethan
|
304f127d34 |
ci(.github): remove the go-cache action (#27250)
Closes https://github.com/coder/internal/issues/1619 Closes ENG-3039 Closes https://github.com/coder/internal/issues/1002 Closes ENG-3018 The `test-go-pg` Go cache grew until the post-job save could no longer complete within the job timeout, cancelling the job on every `main` run. Depot runners already provide remote Go build caching via [`GOCACHEPROG`](https://depot.dev/docs/cache/integrations/gocache), which writes every object it serves into `GOCACHE` and never evicts, so persisting `GOCACHE` with `actions/cache` on top just carries an ever-growing directory forward. #20510 removed the custom build cache steps for exactly this reason, and the `go-cache` action introduced in #25727 unintentionally reinstated them. The action is now removed entirely, along with its module cache persistence: a full cache miss plus cold `go mod download` on a Depot runner takes about 10 seconds, faster than any warm `actions/cache` restore of the module cache was. `setup-go-paths` is kept, as it points `GOCACHE` and friends at the Windows RAM disk, but its now-unused caching-related outputs are removed. |
||
|
Ethan
|
cc11c8a536 |
feat: surface model content-filter refusals as a blocked chat error (#27118)
Blocked turns from a provider's content filter (Anthropic's `refusal` stop reason with empty content) previously ended silently on the "Thinking" spinner. They now end as a terminal `content_filter` error that renders as a "Response blocked" message with the provider's category and explanation. <img width="888" height="335" alt="image" src="https://github.com/user-attachments/assets/cef85a59-4091-4e62-9d45-1eb06748db48" /> Closes CODAGT-611 Follow-ups will involve implementing fallbacks, but this alone is pretty important |
||
|
Cian JohnstonandCopilot Autofix powered by AI
|
8eaf4f507b |
feat: generate the known-models catalog and aigateway prices (#27146)
- Regenerates `prices.json` from models.dev. The seeder only upserts, so existing deployments keep delisted models. - Generate the frontend known-models catalog instead of hand-writing it. `make gen/aibridge-prices` fetches models.dev once - Moved patches to model definitions to separate `overrides.jq` which handles both `claude-sonnet-4-5` 200k context and 'aliasing' Fable 5 as Mythos 5. - Editorial choices of selection, order, aliases, and reasoning defaults live in `curation.json`. - Adds golden join tests with one error case per validation, a no-network drift test comparing curation to the checked-in artifact, and pinned invariants for the Anthropic thinking-mode split (the wrong side returns HTTP 400) and the sonnet-4-5 context pin. Adding a model is now one `curation.json` entry plus `make gen/aibridge-prices`, assuming it is present on models.dev. > This PR was authored by Coder Agents on Cian's behalf. --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> |
||
|
Yevhenii Shcherbina
|
4d884c30e7 |
fix: validate bedrock protocol at provider construction (#27234)
Follow-up PR to https://github.com/coder/coder/pull/26745 |
||
|
Bobby Ho
|
0207a9824f |
fix: enforce max body size on CSP violation report endpoint (#27243)
The `/api/v2/csp/reports` endpoint is unauthenticated and CSRF-exempt, since it's the browser's `report-uri` target, and decoded request bodies with no size limit. This let an attacker post arbitrarily large JSON bodies to force unbounded heap allocation and OOM the server (Cure53 CDM-02-007). Wraps the request body in `http.MaxBytesReader` before decoding and returns 413 when the limit is exceeded, matching the existing convention used by `files.go`, `aitasks.go`, and `exp_chats.go`. Fixes: https://github.com/coder/security-disclosures/issues/171 |
||
|
Jon Ayers
|
d99ed85db8 | fix: fix test flake in nats subscribe cleanup (#27238) | ||
|
McKayla はな
|
b377bec5f4 | fix(site): replace ansi-to-html in the log viewer (#27206) | ||
|
Nick Vigilante
|
61e52532c0 |
docs: wrap placeholder syntax in backticks in CLI help and swagger annotations (#27194)
## Problem
Generated reference docs (`docs/reference/cli/*`,
`docs/reference/api/*`) contained raw placeholder and JSON syntax that
came straight from Go CLI help strings and swagger annotations. HTML
renderers treat the angle-bracket tokens (`<team-slug>`, `<uuid>`,
`<KEY>`, etc.) as unknown tags and drop them, so readers see
broken/half-missing text today. The same strings also break MDX parsing.
## Fix
Wrap the placeholder/JSON syntax in backticks **at the source** (Go help
strings and swagger annotation comments), then `make gen`. Rendered docs
now show the placeholders as inline code instead of dropping them.
### Source changes
| File | Placeholder wrapped | Surfaces in |
|------|--------------------|-------------|
| `codersdk/deployment.go` | `` `<organization-name>/<team-slug>` `` |
`cli/server.md`, `coder --help`, settings UI |
| `codersdk/deployment.go` | `` `CODER_AI_GATEWAY_PROVIDER_<N>_*` ``, ``
`CODER_AI_GATEWAY_PROVIDER_<N>_<KEY>` `` | `api/schemas.md` |
| `cli/tokens.go` | `` `<type>:<uuid>` `` | `cli/tokens_create.md`,
`coder --help` |
| `coderd/aitasks.go` | `` `owner:<…>` ``, `` `organization:<…>` ``, ``
`status:<status>` `` | `api/tasks.md` |
| `coderd/exp_chats.go` | `` `pr_status:<…>` `` and sibling filter
tokens | `api/chats.md` |
| `coderd/provisionerdaemons.go`, `coderd/provisionerjobs.go` | ``
`{'tag1':'value1','tag2':'value2'}` `` | `api/organizations.md`,
`api/provisioning.md` |
Everything else in the diff (`coderd/apidoc/*`, `docs/reference/**`,
`*.golden`, `site/src/api/typesGenerated.ts`) is `make gen` output.
## Reviewer notes (the "considered pass" from the ticket)
- **Product-visible:** this changes `coder server --help` and `coder
tokens create --help` output, and the `server-config.yaml` reference
comment. Backticks in terminal help are literal but read fine as
placeholder markers.
- **Settings UI:** the `deployment.go` `Description` also renders in the
deployment settings page. If that field is not Markdown-rendered,
literal backticks will show there. Happy to drop the `deployment.go`
change if you'd rather keep the UI text clean and fix `server.md`
another way.
- **Out of scope here:** `docs/reference/cli/agent-firewall.md`
(`<host>`/`<glob>`) is generated from the external
`github.com/coder/boundary` module, not this repo. It needs an upstream
fix + module bump; not included in this PR.
<details>
<summary>Implementation notes / decision log</summary>
- Scope taken from DOCS-551: source-level backtick pass for generated
reference docs only. Hand-written Markdown fixes are tracked separately
(companion ticket).
- Swagger `@Param` descriptions are Go comments, so the existing `\|`
pipe-escaping in the chats `q` filter is preserved inside the new
backticks (still required for the Markdown table cell to render `|`).
- Verified after `make gen`: generated docs render placeholders as code
spans, table pipes intact; `gofmt` clean; changed Go packages build; no
emdash/endash introduced.
- Deliberately left the `AIProviderConfig` type-level doc comment
untouched because it does not surface in any generated doc (kept the
diff to doc-feeding comments).
</details>
Linear: DOCS-551
---
_Opened by Coder Agents on behalf of @nickvigilante._
---
## Evidence: placeholders dropped on the live docs site
Verified **2026-07-14** against the live site (`coder.com/docs`, i.e.
`main`, pre-merge) by loading each affected page in headless Chrome and
reading the post-hydration DOM (confirmed identical in the raw page
payload). Each simple `<token>` placeholder is parsed as an **empty
custom HTML element**, so the browser renders nothing for it and the
placeholder text disappears from the page.
### What readers see today (before this PR)
| Page (live) | Source Markdown | Rendered on the live site |
|-------------|-----------------|---------------------------|
| [`cli/server`](https://coder.com/docs/reference/cli/server) — OAuth2
GitHub Allowed Teams | `Structured as: <organization-name>/<team-slug>.`
| `Structured as: /.` |
|
[`cli/tokens_create`](https://coder.com/docs/reference/cli/tokens_create)
— `--allow` | `Repeatable allow-list entry (<type>:<uuid>, e.g.
workspace:1234-...).` | `Repeatable allow-list entry (:, e.g.
workspace:1234-...).` |
| [`api/tasks`](https://coder.com/docs/reference/api/tasks) — `q` | `...
status:<status>` | `... status:` (nothing after the colon) |
| [`api/schemas`](https://coder.com/docs/reference/api/schemas) —
AIBridgeConfig (`anthropic`/`bedrock`/`openai`) |
`CODER_AI_GATEWAY_PROVIDER_<N>_*` | `CODER_AI_GATEWAY_PROVIDER__*` |
| [`api/schemas`](https://coder.com/docs/reference/api/schemas) —
AIBridgeConfig (`providers`) | `CODER_AI_GATEWAY_PROVIDER_<N>_<KEY>` |
`CODER_AI_GATEWAY_PROVIDER__` |
[`api/chats`](https://coder.com/docs/reference/api/chats) (`q`) drops
five tokens the same way — `title:<substring>`, `diff_url:<url>`,
`pr:<number>`, `pr_title:<text>`, and the trailing `title:<value>`. The
live parameter description reads (note the dangling `title:`,
`diff_url:`, `pr:`, `pr_title:`):
```text
Search query. Supports title: (case-insensitive, quote multi-word values), archived:bool, has_unread:bool, pr_status:<draft|open|merged|closed> as repeated or comma-separated values, source:<created_by_me|shared_with_me>, diff_url: (quote values containing colons), pr: (exact PR number match), repo:<owner/repo> (case-insensitive substring match against git remote origin or URL), pr_title: (case-insensitive PR title substring). Bare terms are not supported; use title: for title filtering.
```
<details>
<summary>Raw rendered DOM from the live site (headless Chrome,
post-hydration)</summary>
```html
<!-- reference/cli/server -->
Structured as: <organization-name>/<team-slug>.</team-slug></organization-name>
<!-- reference/cli/tokens_create -->
Repeatable allow-list entry (<type>:<uuid>, e.g. workspace:1234-...).</uuid></type>
<!-- reference/api/tasks : only status:<status> drops; the /-containing tokens are escaped and survive -->
Search query for filtering tasks. Supports: owner:<username/uuid/me>, organization:<org-name/uuid>, status:<status></status>
<!-- reference/api/schemas : anthropic / bedrock / openai rows -->
Deprecated: Use Providers with indexed CODER_AI_GATEWAY_PROVIDER_<n>_* env vars instead.</n>
<!-- reference/api/schemas : providers row -->
Providers holds provider instances populated from CODER_AI_GATEWAY_PROVIDER_<n>_<key> env vars and/or the deprecated LegacyOpenAI/LegacyAnthropic/LegacyBedrock fields above.</key></n>
```
The parser auto-inserts closing tags
(`</team-slug></organization-name>`) and lowercases the tag name (`<N>`
becomes `<n>`), leaving `__` where `<N>_` used to be. Every wrapped
placeholder renders correctly as inline code on the [docs preview for
this
branch](https://coder.com/docs/@vigilante%2Fdocs-551-backtick-placeholder-syntax-in-generated-reference-docs-cli/reference/cli/server).
</details>
### Accuracy note — cases that do *not* drop on live
These render fine today, so they are **not** evidence of dropping (the
PR still wraps them for consistency / MDX-safety):
-
[`api/organizations`](https://coder.com/docs/reference/api/organizations)
and
[`api/provisioning`](https://coder.com/docs/reference/api/provisioning):
`{'tag1':'value1','tag2':'value2'}` renders verbatim — curly braces are
not an HTML tag.
- Tokens containing `/` or `|` are escaped by the renderer and stay
visible (as literal `<...>`): `<username/uuid/me>`, `<org-name/uuid>`,
`<owner/repo>`, `<draft|open|merged|closed>`,
`<created_by_me|shared_with_me>`. Backticks still improve their
readability, but they were never dropped.
|
||
|
Paweł Banaszewski
|
3126306598 |
feat: add --aigateway-proxy-target flag (#27122)
Adds `--aigateway-proxy-target` option to `deploymentGroupAIGatewayProxy` that defines URL to which intercepted requests should be forwarded to. Forward URL used to be hardcoded to `coderAPI.AccessURL` pointing to embedded Gateway. With addition of standalone AI Gateway this needs to be configurable. Renamed `aibridgeproxyd.Server.coderAccessURL` and `coderAccessPort` -> `gatewayURL` and `gatewayPort` + option to better reflect reality. |
||
|
Michael Suchacz
|
a567f6a89f | feat: allow admins to override the chat compaction model (#27151) | ||
|
Jake Howell
|
bf57da58e7 | chore(site): replace CircularProgress with Spinner component (#24276) | ||
|
Jake Howell
|
57852112a6 |
chore: unify admin settings menu items (#27209)
> 🤖 This PR was written by Coder Agents on behalf of Jake Howell. ## Problem #27191 fixed the mobile menu missing the **AI** / **AI sessions** items, but did so by duplicating the item list. The desktop `DeploymentDropdown` and mobile `MobileMenu` each hardcode the same Admin settings links and permission gates. That duplication is exactly why the two drifted out of sync in the first place, and it will happen again the next time an item is added. ## Fix Extract a single source of truth in `adminSettings.ts`: - `AdminSettingsPermissions` type shared by both surfaces. - `getAdminSettingsItems(permissions)` builds the ordered item list using conditional spreads, e.g. ```ts ...(canViewAISettings ? [{ label: "AI", to: "/ai/settings" }] : []), ``` - `canViewAdminSettings(permissions)` for the desktop visibility gate. `DeploymentDropdown` and `MobileMenu` now just `.map()` over the shared list, so adding or changing an item is a one-line edit in one place. No backend, permission, routing, or user-visible behavior changes. Item labels, links, and order match the current desktop dropdown (mobile now inherits the same `linkToAuditing` constant instead of a hardcoded `/audit`, same value). <details> <summary>Rationale / approach</summary> Following Larry Wall's virtues: laziness (one list to maintain, not two), impatience (kill the class of bug where the two menus silently diverge), and hubris (leave a shared module nobody has to apologize for). Kept `canViewOrganizations` in the permission type and visibility gate even though Organizations always renders, preserving prior behavior rather than changing it as part of a refactor. Validated with `biome check` and `tsc --noEmit`; existing `MobileMenu.stories.tsx` args already cover the Admin / Auditor / OrgAdmin / Member permission matrices. </details> |
||
|
Jake Howell
|
bff7ec7624 |
refactor(site): de-emotion the DERP health page (#27208)
> 🤖 This PR was written by Coder Agents on behalf of Jake Howell.
## What
Removes the last `@emotion/react` usage from the DERP health page
(`site/src/pages/HealthPage/DERPPage.tsx`).
- Drops `useTheme` from `@emotion/react`; the page no longer reads the
Emotion theme.
- Replaces the region pin's `style={{ color: healthyColor(theme,
severity) }}` with a Tailwind class derived from severity, matching the
existing pattern in sibling components (`HealthIcon`, `HealthyDot`,
`StatusIcon` in `Content.tsx`).
- Deletes `healthyColor.ts`, which was only consumed by this page and
itself depended on `@emotion/react`.
## Why
The page was already almost entirely Tailwind-based; the theme lookup
was the only Emotion holdout. Aligning it with the surrounding
components keeps the severity colours consistent and removes dead code.
<details>
<summary>Notes</summary>
Severity → class mapping mirrors `Content.tsx`:
| Severity | Class |
| --- | --- |
| `ok` | `text-content-success` |
| `warning` | `text-content-warning` |
| `error` | `text-content-destructive` |
Note: the old helper used `theme.roles.*.fill.solid` tokens, whereas the
surrounding components use the `content-*` tokens — these can differ
slightly in shade. I opted for consistency with the neighbouring health
components. Happy to swap to a dedicated `fill`-equivalent token if
you'd prefer an exact colour match.
</details>
|
||
|
Jake Howell
|
3060a40285 |
refactor(site/src/pages/UserSettingsPage/TokensPage): de-MUI TokensPageView (#27212)
> 🤖 This PR was written by Coder Agents on behalf of Jake Howell.
Removes the remaining MUI/Emotion dependency from `TokensPageView.tsx`.
## Changes
- Removed `useTheme` from `@emotion/react` and the `const theme =
useTheme()` call.
- Replaced all `style={{ color: theme.palette.text.secondary }}` inline
styles with the `text-content-secondary` Tailwind token, matching
sibling components (`Table.tsx`, other UserSettings pages).
- Preserved `data-pixel="ignore"` and all other attributes/behavior.
## Validation
- `tsc --noEmit`: no errors for the file.
- `biome check`: clean.
|
||
|
Jeremy Ruppel
|
f2181572cc |
fix(site): support browser back and forward in template builder wizard (#27104)
Browser back/forward controls did not work in the template builder wizard. Using browser navigation sent the user out of the wizard entirely instead of moving between steps. The wizard's current step is now driven by a `?step=` search param. Step transitions push history entries so browser back/forward walks the steps. Steps that are invalid, skipped, or unreachable given the wizard state are clamped and the URL is rewritten with a replace, keeping URL and state in sync in both directions. `?base=` is accepted as the only entry search param and deep-links to a preselected base template (superseding #26808). The page container resolves it against the available bases, holds the wizard behind a loader until it is consumed and removed from the URL, then mounts the wizard starting on the first step after base selection. Closes https://linear.app/codercom/issue/DEVEX-594 > Generated with [Coder](https://coder.com) by @jeremyruppel |
||
|
Danielle Maywood
|
0f55c283f1 | fix: use backend-selected chat agent for desktop, git, terminal (#26959) | ||
|
dependabot[bot]
|
8c1d8ff149 |
ci: bump the github-actions group across 1 directory with 26 updates (#27228)
Bumps the github-actions group with 26 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `6.0.2` | `7.0.0` | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.17.0` | `2.20.0` | | [dorny/paths-filter](https://github.com/dorny/paths-filter) | `4.0.1` | `4.0.2` | | [tj-actions/changed-files](https://github.com/tj-actions/changed-files) | `47.0.5` | `47.0.6` | | [actions/cache/restore](https://github.com/actions/cache) | `5.0.5` | `6.1.0` | | [actions/cache/save](https://github.com/actions/cache) | `5.0.5` | `6.1.0` | | [docker/login-action](https://github.com/docker/login-action) | `4.1.0` | `4.4.0` | | [actions/setup-java](https://github.com/actions/setup-java) | `5.2.0` | `5.5.0` | | [actions/attest](https://github.com/actions/attest) | `4.1.0` | `4.1.1` | | [actions/create-github-app-token](https://github.com/actions/create-github-app-token) | `3.1.1` | `3.2.0` | | [dependabot/fetch-metadata](https://github.com/dependabot/fetch-metadata) | `3.0.0` | `3.1.0` | | [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) | `6.1.0` | `6.2.2` | | [fluxcd/flux2/action](https://github.com/fluxcd/flux2) | `2.8.5` | `2.9.1` | | [depot/build-push-action](https://github.com/depot/build-push-action) | `1.17.0` | `1.18.0` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.0.0` | `4.2.0` | | [linear/linear-release-action](https://github.com/linear/linear-release-action) | `0.7.0` | `0.14.5` | | [toshimaru/auto-author-assign](https://github.com/toshimaru/auto-author-assign) | `3.0.1` | `3.0.3` | | [benc-uk/workflow-dispatch](https://github.com/benc-uk/workflow-dispatch) | `1.3.1` | `1.3.2` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.35.1` | `4.36.3` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.35.1` | `4.36.3` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.35.1` | `4.36.3` | | [actions/stale](https://github.com/actions/stale) | `10.2.0` | `10.3.0` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `4.2.1` | `8.0.1` | | [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) | `7.0.8` | `8.1.1` | | [actions/cache](https://github.com/actions/cache) | `5.0.5` | `6.1.0` | | [umbrelladocs/action-linkspector](https://github.com/umbrelladocs/action-linkspector) | `1.5.2` | `1.5.4` | Updates `actions/checkout` from 6.0.2 to 7.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v7.0.0</h2> <h2>What's Changed</h2> <ul> <li>block checking out fork pr for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li> <li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li> <li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li> <li>Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li> <li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li> <li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li> <li>getting ready for checkout v7 release by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2464">actions/checkout#2464</a></li> <li>update error wording by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2467">actions/checkout#2467</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.3...v7.0.0">https://github.com/actions/checkout/compare/v6.0.3...v7.0.0</a></p> <h2>v6.0.3</h2> <h2>What's Changed</h2> <ul> <li>Update changelog by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>Update changelog for v6.0.3 by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/yaananth"><code>@yaananth</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v7.0.0</h2> <ul> <li>Block checking out fork PR for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li> <li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li> <li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li> <li>Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li> <li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li> <li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li> </ul> <h2>v6.0.3</h2> <ul> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <h2>v6.0.2</h2> <ul> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <h2>v6.0.1</h2> <ul> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> </ul> <h2>v6.0.0</h2> <ul> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> </ul> <h2>v5.0.1</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <h2>v5.0.0</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> </ul> <h2>v4.3.1</h2> <ul> <li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li> </ul> <h2>v4.3.0</h2> <ul> <li>docs: update README.md by <a href="https://github.com/motss"><code>@motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li> <li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li> <li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li> <li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li> <li>Update README.md by <a href="https://github.com/nebuk89"><code>@nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li> <li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li> <li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li> </ul> <h2>v4.2.2</h2> <ul> <li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li> <li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li> </ul> <h2>v4.2.1</h2> <ul> <li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"><code>9c091bb</code></a> update error wording (<a href="https://redirect.github.com/actions/checkout/issues/2467">#2467</a>)</li> <li><a href="https://github.com/actions/checkout/commit/1044a6dea927916f2c38ba5aeffbc0a847b1221a"><code>1044a6d</code></a> getting ready for checkout v7 release (<a href="https://redirect.github.com/actions/checkout/issues/2464">#2464</a>)</li> <li><a href="https://github.com/actions/checkout/commit/f0282184c7ce73ab54c7e4ab5a617122602e575f"><code>f028218</code></a> Bump the minor-npm-dependencies group across 1 directory with 3 updates (<a href="https://redirect.github.com/actions/checkout/issues/2462">#2462</a>)</li> <li><a href="https://github.com/actions/checkout/commit/d914b262ffc244530a203ab40decab34c3abf34d"><code>d914b26</code></a> upgrade module to esm and update dependencies (<a href="https://redirect.github.com/actions/checkout/issues/2463">#2463</a>)</li> <li><a href="https://github.com/actions/checkout/commit/537c7ef99cef6e5ddb5e7ff5d16d14510503801d"><code>537c7ef</code></a> Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid (<a href="https://redirect.github.com/actions/checkout/issues/2459">#2459</a>)</li> <li><a href="https://github.com/actions/checkout/commit/130a169078a413d3a5246a393625e8e742f387f6"><code>130a169</code></a> Bump js-yaml from 4.1.0 to 4.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2461">#2461</a>)</li> <li><a href="https://github.com/actions/checkout/commit/7d09575332117a40b46e5e020664df234cd416f3"><code>7d09575</code></a> Bump flatted from 3.3.1 to 3.4.2 (<a href="https://redirect.github.com/actions/checkout/issues/2460">#2460</a>)</li> <li><a href="https://github.com/actions/checkout/commit/0f9f3aa320cb53abeb534aeb54048075d9697a0e"><code>0f9f3aa</code></a> Bump actions/publish-immutable-action (<a href="https://redirect.github.com/actions/checkout/issues/2458">#2458</a>)</li> <li><a href="https://github.com/actions/checkout/commit/f9e715a95fcd1f9253f77dd28f11e88d2d6460c7"><code>f9e715a</code></a> block checking out fork pr for pull_request_target and workflow_run (<a href="https://redirect.github.com/actions/checkout/issues/2454">#2454</a>)</li> <li><a href="https://github.com/actions/checkout/commit/df4cb1c069e1874edd31b4311f1884172cec0e10"><code>df4cb1c</code></a> Update changelog for v6.0.3 (<a href="https://redirect.github.com/actions/checkout/issues/2446">#2446</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/checkout/compare/v6.0.2...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0">compare view</a></li> </ul> </details> <br /> Updates `step-security/harden-runner` from 2.17.0 to 2.20.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/step-security/harden-runner/releases">step-security/harden-runner's releases</a>.</em></p> <blockquote> <h2>v2.20.0</h2> <h2>What's Changed</h2> <ul> <li>Support for block policy for MacOS and Windows GitHub-hosted runners</li> <li>Support for Bitrise MacOS GitHub Actions runners</li> <li>HTTPS monitoring support for Bun for Linux runners (enterprise tier)</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/step-security/harden-runner/compare/v2.19.4...v2.20.0">https://github.com/step-security/harden-runner/compare/v2.19.4...v2.20.0</a></p> <h2>v2.19.4</h2> <h2>What's Changed</h2> <ul> <li>Improvements for HTTPS Monitoring for the Enterprise tier of Harden Runner</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/step-security/harden-runner/compare/v2.19.3...v2.19.4">https://github.com/step-security/harden-runner/compare/v2.19.3...v2.19.4</a></p> <h2>v2.19.3</h2> <h2>What's Changed</h2> <ul> <li>Default to audit mode when api-key missing with use-policy-store by <a href="https://github.com/varunsh-coder"><code>@varunsh-coder</code></a> in <a href="https://redirect.github.com/step-security/harden-runner/pull/665">step-security/harden-runner#665</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/step-security/harden-runner/compare/v2.19.2...v2.19.3">https://github.com/step-security/harden-runner/compare/v2.19.2...v2.19.3</a></p> <h2>v2.19.2</h2> <h2>What's Changed</h2> <ul> <li>Update the Harden Runner agent for enterprise tier to use go 1.26 and fix minor bugs.</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/step-security/harden-runner/compare/v2.19.1...v2.19.2">https://github.com/step-security/harden-runner/compare/v2.19.1...v2.19.2</a></p> <h2>v2.19.1</h2> <h2>What's Changed</h2> <ul> <li>fix: detect ubuntu-slim runners early and bail out by <a href="https://github.com/devantler"><code>@devantler</code></a> in <a href="https://redirect.github.com/step-security/harden-runner/pull/657">step-security/harden-runner#657</a></li> </ul> <p>What the fix changes</p> <ul> <li>Harden-Runner will detect <code>ubuntu-slim</code> runners and exit cleanly with an informational log message, instead of post harden runner step failing on chown: invalid user: 'undefined'.</li> </ul> <p>What the fix does not do</p> <ul> <li>Jobs running on <code>ubuntu-slim</code> will not be monitored by Harden-Runner. The agent relies on kernel-level features (that require elevated capabilities).</li> <li>Per GitHub's docs on <a href="https://docs.github.com/en/actions/reference/runners/github-hosted-runners#single-cpu-runners">single-CPU runners</a>: "The container for ubuntu-slim runners runs in unprivileged mode. This means that some operations requiring elevated privileges such as mounting file systems, using Docker-in-Docker, or accessing low-level kernel features are not supported." Those low-level kernel features are what the agent needs, so monitoring inside the unprivileged container is not feasible today.</li> </ul> <p>For StepSecurity enterprise customers If your security posture requires that workflows are always monitored, you can block the use of <code>ubuntu-slim</code> via workflow run policies see the <a href="https://docs.stepsecurity.io/workflow-run-policies/policies#runner-label-policy">Runner Label Policy</a> docs. This lets you enforce that jobs only run on monitored runner types.</p> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/devantler"><code>@devantler</code></a> made their first contribution in <a href="https://redirect.github.com/step-security/harden-runner/pull/657">step-security/harden-runner#657</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/step-security/harden-runner/compare/v2.19.0...v2.19.1">https://github.com/step-security/harden-runner/compare/v2.19.0...v2.19.1</a></p> <h2>v2.19.0</h2> <h2>What's Changed</h2> <h3>New Runner Support</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/step-security/harden-runner/commit/bf7454d06d71f1098171f2acdf0cd4708d7b5920"><code>bf7454d</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/673">#673</a> from step-security/fix/aggregate-error-startup-hang</li> <li><a href="https://github.com/step-security/harden-runner/commit/1188420976b49762617c32cc010cba50a9fd7a71"><code>1188420</code></a> Update non-TLS agent to v0.16.2</li> <li><a href="https://github.com/step-security/harden-runner/commit/162cfeac170141192dc6d57ade86ddf59448ad96"><code>162cfea</code></a> Update non-TLS agent to v0.16.1</li> <li><a href="https://github.com/step-security/harden-runner/commit/eb9e1f4943b602b6f338f6f79468e812c2c6b320"><code>eb9e1f4</code></a> Bring macOS runner updates from PR 674</li> <li><a href="https://github.com/step-security/harden-runner/commit/1a10b01783c147498a6dee4fa4e7122325762720"><code>1a10b01</code></a> Update Windows agent to v1.0.7</li> <li><a href="https://github.com/step-security/harden-runner/commit/8b4a105ef5119b20c97c1566b0275b9399ae188d"><code>8b4a105</code></a> Apply npm audit fixes with release-age cooldown</li> <li><a href="https://github.com/step-security/harden-runner/commit/3626e0327723bef1c4e6b01750518eccd380a5df"><code>3626e03</code></a> Default TLS status check failures to enabled</li> <li><a href="https://github.com/step-security/harden-runner/commit/100e08b39cfd419c292df7becc379b0305ac0628"><code>100e08b</code></a> Update agent-ebpf to v1.8.12</li> <li><a href="https://github.com/step-security/harden-runner/commit/774f75f2c6334606d2d3d910a663f93c9ea49b3b"><code>774f75f</code></a> Update agent to v1.8.9</li> <li><a href="https://github.com/step-security/harden-runner/commit/f312657a64c745fae39c2c66cc7c7f7bc4c804d8"><code>f312657</code></a> Extend missing-agent-dir guard to Linux and macOS cleanup paths</li> <li>Additional commits viewable in <a href="https://github.com/step-security/harden-runner/compare/f808768d1510423e83855289c910610ca9b43176...bf7454d06d71f1098171f2acdf0cd4708d7b5920">compare view</a></li> </ul> </details> <br /> Updates `dorny/paths-filter` from 4.0.1 to 4.0.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/dorny/paths-filter/releases">dorny/paths-filter's releases</a>.</em></p> <blockquote> <h2>v4.0.2</h2> <h2>What's Changed</h2> <ul> <li>fix warning message by <a href="https://github.com/cgundy"><code>@cgundy</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/282">dorny/paths-filter#282</a></li> <li>chore: fix GitHub spelling in logs by <a href="https://github.com/squat"><code>@squat</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/278">dorny/paths-filter#278</a></li> <li>fix: use rev-parse instead of branch --show-current for older git compat by <a href="https://github.com/saschabratton"><code>@saschabratton</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/303">dorny/paths-filter#303</a></li> <li>fix: work around git dubious ownership errors in container jobs by <a href="https://github.com/saschabratton"><code>@saschabratton</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/317">dorny/paths-filter#317</a></li> <li>docs: update changelog for v4.0.2 by <a href="https://github.com/saschabratton"><code>@saschabratton</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/318">dorny/paths-filter#318</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/cgundy"><code>@cgundy</code></a> made their first contribution in <a href="https://redirect.github.com/dorny/paths-filter/pull/282">dorny/paths-filter#282</a></li> <li><a href="https://github.com/squat"><code>@squat</code></a> made their first contribution in <a href="https://redirect.github.com/dorny/paths-filter/pull/278">dorny/paths-filter#278</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/dorny/paths-filter/compare/v4.0.1...v4.0.2">https://github.com/dorny/paths-filter/compare/v4.0.1...v4.0.2</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md">dorny/paths-filter's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v4.0.2</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/317">Work around git dubious ownership errors in container jobs</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/303">Use rev-parse instead of branch --show-current for older git compat</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/282">Fix warning message</a></li> </ul> <h2>v4.0.1</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/255">Support merge queue</a></li> </ul> <h2>v4.0.0</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/294">Update action runtime to node24</a></li> </ul> <h2>v3.0.3</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/279">Add missing predicate-quantifier</a></li> </ul> <h2>v3.0.2</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/224">Add config parameter for predicate quantifier</a></li> </ul> <h2>v3.0.1</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/133">Compare base and ref when token is empty</a></li> </ul> <h2>v3.0.0</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/210">Update to Node.js 20</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/215">Update all dependencies</a></li> </ul> <h2>v2.11.1</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/167">Update @actions/core to v1.10.0 - Fixes warning about deprecated set-output</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/168">Document need for pull-requests: read permission</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/164">Updating to actions/checkout@v3</a></li> </ul> <h2>v2.11.0</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/157">Set list-files input parameter as not required</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/161">Update Node.js</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/162">Fix incorrect handling of Unicode characters in exec()</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/163">Use Octokit pagination</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/160">Updates real world links</a></li> </ul> <h2>v2.10.2</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/91">Fix getLocalRef() returns wrong ref</a></li> </ul> <h2>v2.10.1</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/85">Improve robustness of change detection</a></li> </ul> <h2>v2.10.0</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/82">Add ref input parameter</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/83">Fix change detection in PR when pullRequest.changed_files is incorrect</a></li> </ul> <h2>v2.9.3</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/78">Fix change detection when base is a tag</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/dorny/paths-filter/commit/7b450fff21473bca461d4b92ce414b9d0420d706"><code>7b450ff</code></a> docs: update changelog for v4.0.2 (<a href="https://redirect.github.com/dorny/paths-filter/issues/318">#318</a>)</li> <li><a href="https://github.com/dorny/paths-filter/commit/928037783a71f24983ea250c6e55290c1b2de54f"><code>9280377</code></a> fix: work around git dubious ownership errors in container jobs (<a href="https://redirect.github.com/dorny/paths-filter/issues/317">#317</a>)</li> <li><a href="https://github.com/dorny/paths-filter/commit/f3ceefdc7ef57bc2d8560787d4b6c33e44044cec"><code>f3ceefd</code></a> fix: use rev-parse instead of branch --show-current for older git compat (<a href="https://redirect.github.com/dorny/paths-filter/issues/303">#303</a>)</li> <li><a href="https://github.com/dorny/paths-filter/commit/61f87a10cd2c304679af17bb73ef192addf33c1c"><code>61f87a1</code></a> chore: fix GitHub spelling in logs (<a href="https://redirect.github.com/dorny/paths-filter/issues/278">#278</a>)</li> <li><a href="https://github.com/dorny/paths-filter/commit/b82ff81ffbe6fb4b636bb5b47e37fd8d12b32632"><code>b82ff81</code></a> fix warning message (<a href="https://redirect.github.com/dorny/paths-filter/issues/282">#282</a>)</li> <li>See full diff in <a href="https://github.com/dorny/paths-filter/compare/fbd0ab8f3e69293af611ebaee6363fc25e6d187d...7b450fff21473bca461d4b92ce414b9d0420d706">compare view</a></li> </ul> </details> <br /> Updates `tj-actions/changed-files` from 47.0.5 to 47.0.6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tj-actions/changed-files/releases">tj-actions/changed-files's releases</a>.</em></p> <blockquote> <h2>v47.0.6</h2> <h2>What's Changed</h2> <ul> <li>Upgraded to v47.0.5 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/tj-actions/changed-files/pull/2816">tj-actions/changed-files#2816</a></li> <li>Updated README.md by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/tj-actions/changed-files/pull/2817">tj-actions/changed-files#2817</a></li> <li>chore(deps): bump actions/setup-node from 6.2.0 to 6.3.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/tj-actions/changed-files/pull/2818">tj-actions/changed-files#2818</a></li> <li>chore(deps-dev): bump <code>@types/node</code> from 25.3.3 to 25.3.5 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/tj-actions/changed-files/pull/2820">tj-actions/changed-files#2820</a></li> <li>chore(deps): bump github/codeql-action from 4.32.5 to 4.32.6 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/tj-actions/changed-files/pull/2819">tj-actions/changed-files#2819</a></li> <li>chore(deps-dev): bump <code>@types/node</code> from 25.3.5 to 25.5.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/tj-actions/changed-files/pull/2825">tj-actions/changed-files#2825</a></li> <li>chore(deps): bump actions/download-artifact from 8.0.0 to 8.0.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/tj-actions/changed-files/pull/2824">tj-actions/changed-files#2824</a></li> <li>chore(deps): bump github/codeql-action from 4.32.6 to 4.35.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/tj-actions/changed-files/pull/2834">tj-actions/changed-files#2834</a></li> <li>chore(deps-dev): bump eslint-plugin-jest from 29.15.0 to 29.15.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/tj-actions/changed-files/pull/2831">tj-actions/changed-files#2831</a></li> <li>chore(deps): bump yaml from 2.8.2 to 2.8.3 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/tj-actions/changed-files/pull/2830">tj-actions/changed-files#2830</a></li> <li>chore(deps): bump nrwl/nx-set-shas from 4.4.0 to 5.0.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/tj-actions/changed-files/pull/2829">tj-actions/changed-files#2829</a></li> <li>chore(deps-dev): bump jest from 30.2.0 to 30.3.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/tj-actions/changed-files/pull/2822">tj-actions/changed-files#2822</a></li> <li>chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/tj-actions/changed-files/pull/2849">tj-actions/changed-files#2849</a></li> <li>chore(deps-dev): bump prettier from 3.8.1 to 3.8.3 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/tj-actions/changed-files/pull/2848">tj-actions/changed-files#2848</a></li> <li>chore(deps-dev): bump <code>@types/node</code> from 25.5.0 to 25.6.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/tj-actions/changed-files/pull/2846">tj-actions/changed-files#2846</a></li> <li>chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/tj-actions/changed-files/pull/2844">tj-actions/changed-files#2844</a></li> <li>chore(deps): bump peter-evans/create-pull-request from 8.1.0 to 8.1.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/tj-actions/changed-files/pull/2843">tj-actions/changed-files#2843</a></li> <li>chore(deps): bump lodash from 4.17.23 to 4.18.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/tj-actions/changed-files/pull/2837">tj-actions/changed-files#2837</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/tj-actions/changed-files/compare/v47.0.5...v47.0.6">https://github.com/tj-actions/changed-files/compare/v47.0.5...v47.0.6</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/tj-actions/changed-files/blob/main/HISTORY.md">tj-actions/changed-files's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h1><a href="https://github.com/tj-actions/changed-files/compare/v47.0.5...v47.0.6">47.0.6</a> - (2026-04-18)</h1> <h2><!-- raw HTML omitted -->🔄 Update</h2> <ul> <li>Updated README.md (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2817">#2817</a>)</li> </ul> <p>Co-authored-by: github-actions[bot] <41898282+github-actions[bot]<a href="https://github.com/users"><code>@users</code></a>.noreply.github.com> Co-authored-by: Tonye Jack <a href="mailto:jtonye@ymail.com">jtonye@ymail.com</a> (<a href="https://github.com/tj-actions/changed-files/commit/c23d52ba6ff8c67273c61e097615eafe88cb8650">c23d52b</a>) - (github-actions[bot])</p> <h2><!-- raw HTML omitted -->⚙️ Miscellaneous Tasks</h2> <ul> <li><strong>deps:</strong> Bump lodash from 4.17.23 to 4.18.1 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2837">#2837</a>) (<a href="https://github.com/tj-actions/changed-files/commit/9426d40962ed5378910ee2e21d5f8c6fcbf2dd96">9426d40</a>) - (dependabot[bot])</li> <li><strong>deps:</strong> Bump peter-evans/create-pull-request from 8.1.0 to 8.1.1 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2843">#2843</a>) (<a href="https://github.com/tj-actions/changed-files/commit/32de080616d8c84d89622770d26b0857f4ce8b49">32de080</a>) - (dependabot[bot])</li> <li><strong>deps:</strong> Bump actions/upload-artifact from 7.0.0 to 7.0.1 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2844">#2844</a>) (<a href="https://github.com/tj-actions/changed-files/commit/2487d125c6ecf3457228762d50599297a8c80310">2487d12</a>) - (dependabot[bot])</li> <li><strong>deps-dev:</strong> Bump <code>@types/node</code> from 25.5.0 to 25.6.0 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2846">#2846</a>) (<a href="https://github.com/tj-actions/changed-files/commit/cef85a3eab76d9db9f294de4915d6a31b1dcbfda">cef85a3</a>) - (dependabot[bot])</li> <li><strong>deps-dev:</strong> Bump prettier from 3.8.1 to 3.8.3 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2848">#2848</a>) (<a href="https://github.com/tj-actions/changed-files/commit/7b082dee30a6f42592f70940c0f0a26a72af452c">7b082de</a>) - (dependabot[bot])</li> <li><strong>deps:</strong> Bump github/codeql-action from 4.35.1 to 4.35.2 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2849">#2849</a>) (<a href="https://github.com/tj-actions/changed-files/commit/07224cab5986b4ce28c5080f4a804e5573422714">07224ca</a>) - (dependabot[bot])</li> <li><strong>deps-dev:</strong> Bump jest from 30.2.0 to 30.3.0 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2822">#2822</a>) (<a href="https://github.com/tj-actions/changed-files/commit/2bb135777322059ee3a3c9239999b159ff49febc">2bb1357</a>) - (dependabot[bot])</li> <li><strong>deps:</strong> Bump nrwl/nx-set-shas from 4.4.0 to 5.0.1 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2829">#2829</a>) (<a href="https://github.com/tj-actions/changed-files/commit/cc98117d3993777f3babaccc496514b4a65652a9">cc98117</a>) - (dependabot[bot])</li> <li><strong>deps:</strong> Bump yaml from 2.8.2 to 2.8.3 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2830">#2830</a>) (<a href="https://github.com/tj-actions/changed-files/commit/786e4213eac60d6e2b4492135b46644269fac3db">786e421</a>) - (dependabot[bot])</li> <li><strong>deps-dev:</strong> Bump eslint-plugin-jest from 29.15.0 to 29.15.1 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2831">#2831</a>) (<a href="https://github.com/tj-actions/changed-files/commit/726b41bbed783a50de97829de6d977cd665831f7">726b41b</a>) - (dependabot[bot])</li> <li><strong>deps:</strong> Bump github/codeql-action from 4.32.6 to 4.35.1 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2834">#2834</a>) (<a href="https://github.com/tj-actions/changed-files/commit/2c3585e584822ed39e27c6c471225dde37991778">2c3585e</a>) - (dependabot[bot])</li> <li><strong>deps:</strong> Bump actions/download-artifact from 8.0.0 to 8.0.1 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2824">#2824</a>) (<a href="https://github.com/tj-actions/changed-files/commit/3d37a7ff08a7ce64b4cab9669eac39b0709cdac9">3d37a7f</a>) - (dependabot[bot])</li> <li><strong>deps-dev:</strong> Bump <code>@types/node</code> from 25.3.5 to 25.5.0 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2825">#2825</a>) (<a href="https://github.com/tj-actions/changed-files/commit/445b0eb32849cdd5b22a390bf0568af00ed4ca34">445b0eb</a>) - (dependabot[bot])</li> <li><strong>deps:</strong> Bump github/codeql-action from 4.32.5 to 4.32.6 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2819">#2819</a>) (<a href="https://github.com/tj-actions/changed-files/commit/4f892cd56345d721bac7139000c4b4a22c8f138f">4f892cd</a>) - (dependabot[bot])</li> <li><strong>deps-dev:</strong> Bump <code>@types/node</code> from 25.3.3 to 25.3.5 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2820">#2820</a>) (<a href="https://github.com/tj-actions/changed-files/commit/611865116d9f223a0ca640071aec29292c81978f">6118651</a>) - (dependabot[bot])</li> <li><strong>deps:</strong> Bump actions/setup-node from 6.2.0 to 6.3.0 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2818">#2818</a>) (<a href="https://github.com/tj-actions/changed-files/commit/e517d7a5ca34a5d08bbe5c949e59381bd6d7cce2">e517d7a</a>) - (dependabot[bot])</li> </ul> <h2><!-- raw HTML omitted -->⬆️ Upgrades</h2> <ul> <li>Upgraded to v47.0.5 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2816">#2816</a>)</li> </ul> <p>Co-authored-by: github-actions[bot] <41898282+github-actions[bot]<a href="https://github.com/users"><code>@users</code></a>.noreply.github.com> Co-authored-by: Tonye Jack <a href="mailto:jtonye@ymail.com">jtonye@ymail.com</a> (<a href="https://github.com/tj-actions/changed-files/commit/4750530ff4e020eafc769c56c2fa8376ca8ad8e9">4750530</a>) - (github-actions[bot])</p> <h1><a href="https://github.com/tj-actions/changed-files/compare/v47.0.4...v47.0.5">47.0.5</a> - (2026-03-03)</h1> <h2><!-- raw HTML omitted -->🔄 Update</h2> <ul> <li>Updated README.md (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2805">#2805</a>)</li> </ul> <p>Co-authored-by: github-actions[bot] <41898282+github-actions[bot]<a href="https://github.com/users"><code>@users</code></a>.noreply.github.com> (<a href="https://github.com/tj-actions/changed-files/commit/35dace0375d89e25e78db5f0a44127b61f4e5c20">35dace0</a>) - (github-actions[bot])</p> <ul> <li>Updated README.md (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2803">#2803</a>)</li> </ul> <p>Co-authored-by: github-actions[bot] <41898282+github-actions[bot]<a href="https://github.com/users"><code>@users</code></a>.noreply.github.com> Co-authored-by: Tonye Jack <a href="mailto:jtonye@ymail.com">jtonye@ymail.com</a> (<a href="https://github.com/tj-actions/changed-files/commit/9ee99eb5bda5d6a67fedcd50ecd24fb10add2f41">9ee99eb</a>) - (github-actions[bot])</p> <h2><!-- raw HTML omitted -->⚙️ Miscellaneous Tasks</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tj-actions/changed-files/commit/9426d40962ed5378910ee2e21d5f8c6fcbf2dd96"><code>9426d40</code></a> chore(deps): bump lodash from 4.17.23 to 4.18.1 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2837">#2837</a>)</li> <li><a href="https://github.com/tj-actions/changed-files/commit/32de080616d8c84d89622770d26b0857f4ce8b49"><code>32de080</code></a> chore(deps): bump peter-evans/create-pull-request from 8.1.0 to 8.1.1 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2843">#2843</a>)</li> <li><a href="https://github.com/tj-actions/changed-files/commit/2487d125c6ecf3457228762d50599297a8c80310"><code>2487d12</code></a> chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2844">#2844</a>)</li> <li><a href="https://github.com/tj-actions/changed-files/commit/cef85a3eab76d9db9f294de4915d6a31b1dcbfda"><code>cef85a3</code></a> chore(deps-dev): bump <code>@types/node</code> from 25.5.0 to 25.6.0 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2846">#2846</a>)</li> <li><a href="https://github.com/tj-actions/changed-files/commit/7b082dee30a6f42592f70940c0f0a26a72af452c"><code>7b082de</code></a> chore(deps-dev): bump prettier from 3.8.1 to 3.8.3 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2848">#2848</a>)</li> <li><a href="https://github.com/tj-actions/changed-files/commit/07224cab5986b4ce28c5080f4a804e5573422714"><code>07224ca</code></a> chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2849">#2849</a>)</li> <li><a href="https://github.com/tj-actions/changed-files/commit/2bb135777322059ee3a3c9239999b159ff49febc"><code>2bb1357</code></a> chore(deps-dev): bump jest from 30.2.0 to 30.3.0 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2822">#2822</a>)</li> <li><a href="https://github.com/tj-actions/changed-files/commit/cc98117d3993777f3babaccc496514b4a65652a9"><code>cc98117</code></a> chore(deps): bump nrwl/nx-set-shas from 4.4.0 to 5.0.1 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2829">#2829</a>)</li> <li><a href="https://github.com/tj-actions/changed-files/commit/786e4213eac60d6e2b4492135b46644269fac3db"><code>786e421</code></a> chore(deps): bump yaml from 2.8.2 to 2.8.3 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2830">#2830</a>)</li> <li><a href="https://github.com/tj-actions/changed-files/commit/726b41bbed783a50de97829de6d977cd665831f7"><code>726b41b</code></a> chore(deps-dev): bump eslint-plugin-jest from 29.15.0 to 29.15.1 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2831">#2831</a>)</li> <li>Additional commits viewable in <a href="https://github.com/tj-actions/changed-files/compare/22103cc46bda19c2b464ffe86db46df6922fd323...9426d40962ed5378910ee2e21d5f8c6fcbf2dd96">compare view</a></li> </ul> </details> <br /> Updates `actions/cache/restore` from 5.0.5 to 6.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/cache/releases">actions/cache/restore's releases</a>.</em></p> <blockquote> <h2>v6.1.0</h2> <h2>What's Changed</h2> <ul> <li>Bump <code>@actions/cache</code> to v6.1.0 - handle read-only cache access by <a href="https://github.com/jasongin"><code>@jasongin</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1768">actions/cache#1768</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v6...v6.1.0">https://github.com/actions/cache/compare/v6...v6.1.0</a></p> <h2>v6.0.0</h2> <h2>What's Changed</h2> <ul> <li>Update packages, migrate to ESM by <a href="https://github.com/Samirat"><code>@Samirat</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1760">actions/cache#1760</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v6.0.0">https://github.com/actions/cache/compare/v5...v6.0.0</a></p> <h2>v5.1.0</h2> <h2>What's Changed</h2> <ul> <li>Bump <code>@actions/cache</code> to v5.1.0 - handle read-only cache access by <a href="https://github.com/jasongin"><code>@jasongin</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1775">actions/cache#1775</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v5.1.0">https://github.com/actions/cache/compare/v5...v5.1.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/cache/blob/main/RELEASES.md">actions/cache/restore's changelog</a>.</em></p> <blockquote> <h1>Releases</h1> <h2>How to prepare a release</h2> <blockquote> <p>[!NOTE] Relevant for maintainers with write access only.</p> </blockquote> <ol> <li>Switch to a new branch from <code>main</code>.</li> <li>Run <code>npm test</code> to ensure all tests are passing.</li> <li>Update the version in <a href="https://github.com/actions/cache/blob/main/package.json"><code>https://github.com/actions/cache/blob/main/package.json</code></a>.</li> <li>Run <code>npm run build</code> to update the compiled files.</li> <li>Update this <a href="https://github.com/actions/cache/blob/main/RELEASES.md"><code>https://github.com/actions/cache/blob/main/RELEASES.md</code></a> with the new version and changes in the <code>## Changelog</code> section.</li> <li>Run <code>licensed cache</code> to update the license report.</li> <li>Run <code>licensed status</code> and resolve any warnings by updating the <a href="https://github.com/actions/cache/blob/main/.licensed.yml"><code>https://github.com/actions/cache/blob/main/.licensed.yml</code></a> file with the exceptions.</li> <li>Commit your changes and push your branch upstream.</li> <li>Open a pull request against <code>main</code> and get it reviewed and merged.</li> <li>Draft a new release <a href="https://github.com/actions/cache/releases">https://github.com/actions/cache/releases</a> use the same version number used in <code>package.json</code> <ol> <li>Create a new tag with the version number.</li> <li>Auto generate release notes and update them to match the changes you made in <code>RELEASES.md</code>.</li> <li>Toggle the set as the latest release option.</li> <li>Publish the release.</li> </ol> </li> <li>Navigate to <a href="https://github.com/actions/cache/actions/workflows/release-new-action-version.yml">https://github.com/actions/cache/actions/workflows/release-new-action-version.yml</a> <ol> <li>There should be a workflow run queued with the same version number.</li> <li>Approve the run to publish the new version and update the major tags for this action.</li> </ol> </li> </ol> <h2>Changelog</h2> <h3>6.1.0</h3> <ul> <li>Bump <code>@actions/cache</code> to v6.1.0 to pick up <a href="https://redirect.github.com/actions/toolkit/pull/2435">actions/toolkit#2435 Handle cache write error due to read-only token</a></li> <li>Switch redundant "Cache save failed" warning to debug log in save-only</li> </ul> <h3>6.0.0</h3> <ul> <li>Updated <code>@actions/cache</code> to ^6.0.1, <code>@actions/core</code> to ^3.0.1, <code>@actions/exec</code> to ^3.0.0, <code>@actions/io</code> to ^3.0.2</li> <li>Migrated to ESM module system</li> <li>Upgraded Jest to v30 and test infrastructure to be ESM compatible</li> </ul> <h3>5.0.4</h3> <ul> <li>Bump <code>minimatch</code> to v3.1.5 (fixes ReDoS via globstar patterns)</li> <li>Bump <code>undici</code> to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)</li> <li>Bump <code>fast-xml-parser</code> to v5.5.6</li> </ul> <h3>5.0.3</h3> <ul> <li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li> <li>Bump <code>@actions/core</code> to v2.0.3</li> </ul> <h3>5.0.2</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/cache/commit/55cc8345863c7cc4c66a329aec7e433d2d1c52a9"><code>55cc834</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1768">#1768</a> from jasongin/readonly-cache</li> <li><a href="https://github.com/actions/cache/commit/d8cd72f230726cdf4457ebb61ec1b593a8d12337"><code>d8cd72f</code></a> Bump <code>@actions/cache</code> to v6.1.0 - handle cache write error due to RO token</li> <li><a href="https://github.com/actions/cache/commit/2c8a9bd7457de244a408f35966fab2fb45fda9c8"><code>2c8a9bd</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1760">#1760</a> from actions/samirat/esm_migration_and_package_update</li> <li><a href="https://github.com/actions/cache/commit/e9b91fdc3fea7d79165fceb79042ef45c2d51023"><code>e9b91fd</code></a> Prettier fixes</li> <li><a href="https://github.com/actions/cache/commit/e4884b8ff7f92ef6b52c79eda480bbc86e685adb"><code>e4884b8</code></a> Rebuild dist</li> <li><a href="https://github.com/actions/cache/commit/10baf0191a3c426ea0fa4a3253a5c04233b6e18f"><code>10baf01</code></a> Fixed licenses</li> <li><a href="https://github.com/actions/cache/commit/e39b386c9004d72a15d864ade8c0b3a702d47a37"><code>e39b386</code></a> Fix test mock return order</li> <li><a href="https://github.com/actions/cache/commit/b6928203372a8571ff984c0c883ef3a1adfb0c06"><code>b692820</code></a> PR feedback</li> <li><a href="https://github.com/actions/cache/commit/60749128a44d25d3c520a489e576380cf00ff3f1"><code>6074912</code></a> Rebuild dist bundles as ESM to match type:module</li> <li><a href="https://github.com/actions/cache/commit/5a912e8b4af820fa082a0e75cfd2c782f8fbfe0e"><code>5a912e8</code></a> Fix lint and jest issues</li> <li>Additional commits viewable in <a href="https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9">compare view</a></li> </ul> </details> <br /> Updates `actions/cache/save` from 5.0.5 to 6.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/cache/releases">actions/cache/save's releases</a>.</em></p> <blockquote> <h2>v6.1.0</h2> <h2>What's Changed</h2> <ul> <li>Bump <code>@actions/cache</code> to v6.1.0 - handle read-only cache access by <a href="https://github.com/jasongin"><code>@jasongin</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1768">actions/cache#1768</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v6...v6.1.0">https://github.com/actions/cache/compare/v6...v6.1.0</a></p> <h2>v6.0.0</h2> <h2>What's Changed</h2> <ul> <li>Update packages, migrate to ESM by <a href="https://github.com/Samirat"><code>@Samirat</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1760">actions/cache#1760</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v6.0.0">https://github.com/actions/cache/compare/v5...v6.0.0</a></p> <h2>v5.1.0</h2> <h2>What's Changed</h2> <ul> <li>Bump <code>@actions/cache</code> to v5.1.0 - handle read-only cache access by <a href="https://github.com/jasongin"><code>@jasongin</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1775">actions/cache#1775</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v5.1.0">https://github.com/actions/cache/compare/v5...v5.1.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/cache/blob/main/RELEASES.md">actions/cache/save's changelog</a>.</em></p> <blockquote> <h1>Releases</h1> <h2>How to prepare a release</h2> <blockquote> <p>[!NOTE] Relevant for maintainers with write access only.</p> </blockquote> <ol> <li>Switch to a new branch from <code>main</code>.</li> <li>Run <code>npm test</code> to ensure all tests are passing.</li> <li>Update the version in <a href="https://github.com/actions/cache/blob/main/package.json"><code>https://github.com/actions/cache/blob/main/package.json</code></a>.</li> <li>Run <code>npm run build</code> to update the compiled files.</li> <li>Update this <a href="https://github.com/actions/cache/blob/main/RELEASES.md"><code>https://github.com/actions/cache/blob/main/RELEASES.md</code></a> with the new version and changes in the <code>## Changelog</code> section.</li> <li>Run <code>licensed cache</code> to update the license report.</li> <li>Run <code>licensed status</code> and resolve any warnings by updating the <a href="https://github.com/actions/cache/blob/main/.licensed.yml"><code>https://github.com/actions/cache/blob/main/.licensed.yml</code></a> file with the exceptions.</li> <li>Commit your changes and push your branch upstream.</li> <li>Open a pull request against <code>main</code> and get it reviewed and merged.</li> <li>Draft a new release <a href="https://github.com/actions/cache/releases">https://github.com/actions/cache/releases</a> use the same version number used in <code>package.json</code> <ol> <li>Create a new tag with the version number.</li> <li>Auto generate release notes and update them to match the changes you made in <code>RELEASES.md</code>.</li> <li>Toggle the set as the latest release option.</li> <li>Publish the release.</li> </ol> </li> <li>Navigate to <a href="https://github.com/actions/cache/actions/workflows/release-new-action-version.yml">https://github.com/actions/cache/actions/workflows/release-new-action-version.yml</a> <ol> <li>There should be a workflow run queued with the same version number.</li> <li>Approve the run to publish the new version and update the major tags for this action.</li> </ol> </li> </ol> <h2>Changelog</h2> <h3>6.1.0</h3> <ul> <li>Bump <code>@actions/cache</code> to v6.1.0 to pick up <a href="https://redirect.github.com/actions/toolkit/pull/2435">actions/toolkit#2435 Handle cache write error due to read-only token</a></li> <li>Switch redundant "Cache save failed" warning to debug log in save-only</li> </ul> <h3>6.0.0</h3> <ul> <li>Updated <code>@actions/cache</code> to ^6.0.1, <code>@actions/core</code> to ^3.0.1, <code>@actions/exec</code> to ^3.0.0, <code>@actions/io</code> to ^3.0.2</li> <li>Migrated to ESM module system</li> <li>Upgraded Jest to v30 and test infrastructure to be ESM compatible</li> </ul> <h3>5.0.4</h3> <ul> <li>Bump <code>minimatch</code> to v3.1.5 (fixes ReDoS via globstar patterns)</li> <li>Bump <code>undici</code> to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)</li> <li>Bump <code>fast-xml-parser</code> to v5.5.6</li> </ul> <h3>5.0.3</h3> <ul> <li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li> <li>Bump <code>@actions/core</code> to v2.0.3</li> </ul> <h3>5.0.2</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/cache/commit/55cc8345863c7cc4c66a329aec7e433d2d1c52a9"><code>55cc834</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1768">#1768</a> from jasongin/readonly-cache</li> <li><a href="https://github.com/actions/cache/commit/d8cd72f230726cdf4457ebb61ec1b593a8d12337"><code>d8cd72f</code></a> Bump <code>@actions/cache</code> to v6.1.0 - handle cache write error due to RO token</li> <li><a href="https://github.com/actions/cache/commit/2c8a9bd7457de244a408f35966fab2fb45fda9c8"><code>2c8a9bd</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1760">#1760</a> from actions/samirat/esm_migration_and_package_update</li> <li><a href="https://github.com/actions/cache/commit/e9b91fdc3fea7d79165fceb79042ef45c2d51023"><code>e9b91fd</code></a> Prettier fixes</li> <li><a href="https://github.com/actions/cache/commit/e4884b8ff7f92ef6b52c79eda480bbc86e685adb"><code>e4884b8</code></a> Rebuild dist</li> <li><a href="https://github.com/actions/cache/commit/10baf0191a3c426ea0fa4a3253a5c04233b6e18f"><code>10baf01</code></a> Fixed licenses</li> <li><a href="https://github.com/actions/cache/commit/e39b386c9004d72a15d864ade8c0b3a702d47a37"><code>e39b386</code></a> Fix test mock return order</li> <li><a href="https://github.com/actions/cache/commit/b6928203372a8571ff984c0c883ef3a1adfb0c06"><code>b692820</code></a> PR feedback</li> <li><a href="https://github.com/actions/cache/commit/60749128a44d25d3c520a489e576380cf00ff3f1"><code>6074912</code></a> Rebuild dist bundles as ESM to match type:module</li> <li><a href="https://github.com/actions/cache/commit/5a912e8b4af820fa082a0e75cfd2c782f8fbfe0e"><code>5a912e8</code></a> Fix lint and jest issues</li> <li>Additional commits viewable in <a href="https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9">compare view</a></li> </ul> </details> <br /> Updates `docker/login-action` from 4.1.0 to 4.4.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/docker/login-action/releases">docker/login-action's releases</a>.</em></p> <blockquote> <h2>v4.4.0</h2> <ul> <li>Skip empty <code>registry-auth</code> secret mask by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/login-action/pull/1035">docker/login-action#1035</a></li> <li>Bump <code>@aws-sdk/client-ecr</code> and <code>@aws-sdk/client-ecr-public</code> to 3.1077.0 <a href="https://redirect.github.com/docker/login-action/pull/1034">docker/login-action#1034</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/login-action/compare/v4.3.0...v4.4.0">https://github.com/docker/login-action/compare/v4.3.0...v4.4.0</a></p> <h2>v4.3.0</h2> <ul> <li>Preserve names in esbuild bundle by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/login-action/pull/1022">docker/login-action#1022</a></li> <li>Bump <code>@aws-sdk/client-ecr</code> and <code>@aws-sdk/client-ecr-public</code> to 3.1076.0 <a href="https://redirect.github.com/docker/login-action/pull/999">docker/login-action#999</a> <a href="https://redirect.github.com/docker/login-action/pull/1030">docker/login-action#1030</a></li> <li>Bump <code>@docker/actions-toolkit</code> from 0.90.0 to 0.92.0 in <a href="https://redirect.github.com/docker/login-action/pull/1004">docker/login-action#1004</a> <a href="https://redirect.github.com/docker/login-action/pull/1027">docker/login-action#1027</a></li> <li>Bump <code>@sigstore/core</code> from 3.1.0 to 3.2.1 in <a href="https://redirect.github.com/docker/login-action/pull/1023">docker/login-action#1023</a></li> <li>Bump <code>@sigstore/verify</code> from 3.1.0 to 3.1.1 in <a href="https://redirect.github.com/docker/login-action/pull/1029">docker/login-action#1029</a></li> <li>Bump http-proxy-agent and https-proxy-agent to 9.1.0 in <a href="https://redirect.github.com/docker/login-action/pull/1017">docker/login-action#1017</a></li> <li>Bump js-yaml from 4.1.1 to 5.2.0 in <a href="https://redirect.github.com/docker/login-action/pull/1028">docker/login-action#1028</a></li> <li>Bump sigstore from 4.1.0 to 4.1.1 in <a href="https://redirect.github.com/docker/login-action/pull/1031">docker/login-action#1031</a></li> <li>Bump tmp from 0.2.5 to 0.2.7 in <a href="https://redirect.github.com/docker/login-action/pull/1002">docker/login-action#1002</a></li> <li>Bump undici from 6.24.1 to 6.27.0 in <a href="https://redirect.github.com/docker/login-action/pull/1020">docker/login-action#1020</a></li> <li>Bump vite from 7.3.3 to 7.3.6 in <a href="https://redirect.github.com/docker/login-action/pull/1019">docker/login-action#1019</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/login-action/compare/v4.2.0...v4.3.0">https://github.com/docker/login-action/compare/v4.2.0...v4.3.0</a></p> <h2>v4.2.0</h2> <ul> <li>Bump <code>@actions/core</code> from 3.0.0 to 3.0.1 in <a href="https://redirect.github.com/docker/login-action/pull/976">docker/login-action#976</a></li> <li>Bump <code>@aws-sdk/client-ecr</code> and <code>@aws-sdk/client-ecr-public</code> to 3.1050.0 in <a href="https://redirect.github.com/docker/login-action/pull/960">docker/login-action#960</a></li> <li>Bump <code>@docker/actions-toolkit</code> from 0.86.0 to 0.90.0 in <a href="https://redirect.github.com/docker/login-action/pull/970">docker/login-action#970</a></li> <li>Bump brace-expansion from 2.0.1 to 5.0.6 in <a href="https://redirect.github.com/docker/login-action/pull/993">docker/login-action#993</a></li> <li>Bump fast-xml-builder from 1.1.4 to 1.2.0 in <a href="https://redirect.github.com/docker/login-action/pull/985">docker/login-action#985</a></li> <li>Bump fast-xml-parser from 5.3.6 to 5.8.0 in <a href="https://redirect.github.com/docker/login-action/pull/963">docker/login-action#963</a></li> <li>Bump http-proxy-agent and https-proxy-agent to 9.0.0 in <a href="https://redirect.github.com/docker/login-action/pull/961">docker/login-action#961</a></li> <li>Bump postcss from 8.5.6 to 8.5.10 in <a href="https://redirect.github.com/docker/login-action/pull/979">docker/login-action#979</a></li> <li>Bump tar from 6.2.1 to 7.5.15 in <a href="https://redirect.github.com/docker/login-action/pull/991">docker/login-action#991</a></li> <li>Bump vite from 7.3.1 to 7.3.3 in <a href="https://redirect.github.com/docker/login-action/pull/986">docker/login-action#986</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/login-action/compare/v4.1.0...v4.2.0">https://github.com/docker/login-action/compare/v4.1.0...v4.2.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/docker/login-action/commit/af1e73f918a031802d376d3c8bbc3fe56130a9b0"><code>af1e73f</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1034">#1034</a> from docker/dependabot/npm_and_yarn/aws-sdk-dependen...</li> <li><a href="https://github.com/docker/login-action/commit/da722bde43bacb027adfc67d42dbaa4c0f9e550b"><code>da722bd</code></a> [dependabot skip] chore: update generated content</li> <li><a href="https://github.com/docker/login-action/commit/2916ad60bd5cb72f07aa54c69fdcc61749c09b7a"><code>2916ad6</code></a> build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...</li> <li><a href="https://github.com/docker/login-action/commit/ca0a662f786e4cfddce972005bd68f3dafc3a903"><code>ca0a662</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1035">#1035</a> from crazy-max/fix-registry-auth-empty-mask</li> <li><a href="https://github.com/docker/login-action/commit/c455755a579833bf0d2e4e54e3beb413ef10cc80"><code>c455755</code></a> chore: update generated content</li> <li><a href="https://github.com/docker/login-action/commit/48351901f89581a7c12870c787d3f06d1f498438"><code>4835190</code></a> skip empty registry-auth secret mask</li> <li><a href="https://github.com/docker/login-action/commit/992421c6e6806a7f6df609d1bfff374f9eca3004"><code>992421c</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1033">#1033</a> from docker/dependabot/github_actions/docker/bake-ac...</li> <li><a href="https://github.com/docker/... _Description has been truncated_ Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |