opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-01 14:53:15 +08:00
Code Issues Packages Projects Releases Wiki Activity
15,347 Commits 479 Branches 379 Tags
35ade9e3d2e08036210860538b7d3a7c7a292938
Commit Graph

15347 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Ehab Younes 35ade9e3d2 feat: collect workspace logs in support bundles (#26694) 
Add workspace-side file collection to `coder support bundle` via
repeatable --workspace-file flags. The agent resolves the requested
paths or globs inside the remote workspace and streams back a tar with
a manifest and the collected files; nothing is read from the machine
running the command.

- Add POST /api/v0/bundle-files to the agent's agentfiles package.
- Expand env vars in the agent's environment; paths must then be
  absolute or start with ~/ (the agent user's home directory).
- Support ** globs and tail oversized files.
- Record requested patterns, per-path errors, truncation, and the
  applied limits in a manifest.
- Unpack the archive into the bundle under agent/workspace_files/,
  recording dropped entries in collection_errors.txt.
- Write a manifest-only archive marking collection as unsupported for
  agents that predate the endpoint.
- Bound collection: 64 KB request body, 10000 files, 10 MiB per file,
  100 MiB total including archive overhead, 110 MiB client-side read
  cap, 5 minute timeout.

Closes #26020
 2026-07-16 13:00:32 +03:00
Mathias Fredriksson f997afa220 feat(coderd/x/chatd/chatloop): retain user constraints in compaction summaries (#27230) 
Compaction summaries drop or soften user-stated constraints,
corrections, and prohibitions, so post-compaction assistants repeat
behavior the user already corrected. Add a summary prompt bullet that
instructs the summarizer to quote them, treat them as standing until
revoked, and attribute rules to their true source instead of
defaulting to the user.

Validated offline on unseen human chats: holdout P1 delta +0.175
(arbitrated), 13/18 cases improve. This improves per-compaction
retention only; it does not address deep-chain correction loss.
 2026-07-16 09:18:43 +00:00
Spike Curtis fa4c7c5700 chore: fix replicasync to function for NATS even if no DERP relay address is set (#27235) 
<!--

If you have used AI to produce some or all of this PR, please ensure you have read our [AI Contribution guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING) before submitting.

-->

Fixes `replicasync` so that it keeps peers even if they don't set a RelayAddress. This allows NATS to function even if you are not running a DERP relay on the primay Coderd instances.

Also renames some replicasync functions to make it clear they are for DERP.
 2026-07-16 09:42:23 +02:00
Ethan 21d08241e9 fix(coderd/x/chatd): recover timed out agents (#27254) 
Closes CODAGT-802

Coder Agents only escalated failed workspace dials when the agent had
connected and later disconnected. An agent that never connected and had
already exceeded its `connection_timeout` stayed on the soft retry error
indefinitely, so a chat could keep attempting tools against an unhealthy
workspace.

To fix, we'll classify the latest agent after a failed dial and return
stop/start recovery guidance when its status is `timeout`. Agents still
connecting, including templates with `connection_timeout = 0`, keep the
existing retryable behaviour.

## Before

<img width="843" height="229" alt="image"
src="https://github.com/user-attachments/assets/d659a376-c8d4-4983-b7d7-d1a699770dfb"
/>


## After

<img width="848" height="250" alt="image"
src="https://github.com/user-attachments/assets/26b88f72-f67c-4d9e-87b1-51d701b7352f"
/>
 2026-07-16 12:52:41 +10:00
Bobby Ho de716f89dc fix: normalize path before rate-limit bucket keying (#27273) 
Coder's rate limiter keyed its bucket on the raw, un-normalized request
path (`httprate.KeyByEndpoint` reads `r.URL.Path` directly). The
router's `singleSlashMW` already collapses redundant slashes so a
request like `/api/v2/users//validate-password` reaches the same handler
as the canonical path, but it never touched `r.URL.Path`, so the rate
limiter saw a different key and let a client bypass a limit it had
already hit just by respelling the URL.

`keyByNormalizedEndpoint` replaces `KeyByEndpoint` and runs `path.Clean`
on `r.URL.Path` before using it as the key, so equivalent paths share
one bucket. Includes a unit test at the key-function level and an
integration test (`TestRateLimitPathNormalization`) that reproduces the
bypass against a real server.

Fixes CDM-02-003 (Cure53). Refs
https://github.com/coder/security-disclosures/issues/166.
 2026-07-15 17:07:57 -07:00
dependabot[bot] 0fab0fa0ae chore: bump github.com/DataDog/dd-trace-go/v2 from 2.0.0 to 2.8.1 (#27282) 
Bumps
[github.com/DataDog/dd-trace-go/v2](https://github.com/DataDog/dd-trace-go)
from 2.0.0 to 2.8.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/DataDog/dd-trace-go/releases">github.com/DataDog/dd-trace-go/v2's
releases</a>.</em></p>
<blockquote>
<h2>v2.8.1</h2>
<!-- raw HTML omitted -->
<h3>Application Performance Monitoring (APM)</h3>
<ul>
<li>Revert &quot;fix(ddtrace/tracer): cache trace ID hex encoding (<a
href="https://redirect.github.com/DataDog/dd-trace-go/issues/4481">#4481</a>)&quot;
by <a href="https://github.com/darccio"><code>@​darccio</code></a></li>
<li>fix(tracer): enforce baggage item and byte limits on extraction by
<a href="https://github.com/mtoffl01"><code>@​mtoffl01</code></a> in <a
href="https://redirect.github.com/DataDog/dd-trace-go/issues/4720">#4720</a></li>
<li>fix(tracer): drop dd= list-entries over 256 bytes from incoming
tracestate by <a
href="https://github.com/mtoffl01"><code>@​mtoffl01</code></a> in <a
href="https://redirect.github.com/DataDog/dd-trace-go/issues/4721">#4721</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/DataDog/dd-trace-go/compare/v2.8.0...v2.8.1">https://github.com/DataDog/dd-trace-go/compare/v2.8.0...v2.8.1</a></p>
<h2>v2.8.0</h2>
<!-- raw HTML omitted -->
<h2>Summary</h2>
<p><strong>New integrations.</strong> Two new integrations land in this
release: Azure API Management (APIM) callout processor for security (<a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4620">#4620</a>),
and twmb/franz-go for Kafka (<a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4250">#4250</a>).</p>
<p><strong>Data Streams Monitoring.</strong> All three major Kafka
integrations — confluent-kafka-go (<a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4470">#4470</a>),
segmentio/kafka-go (<a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4477">#4477</a>),
and Sarama (<a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4560">#4560</a>)
— now attach <code>kafka_cluster_id</code> for cluster-level visibility.
<code>TrackDataStreamsTransaction</code> also gains span tagging and
custom timestamp support (<a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4499">#4499</a>).</p>
<p><strong>OpenTelemetry (OTel) and OTLP.</strong> The tracer can now
export traces directly via the OpenTelemetry Protocol (OTLP), bypassing
the Datadog Agent entirely (<a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4600">#4600</a>,
<a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4583">#4583</a>).
OTel process context v2 (OTLP proto format) is supported (<a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4478">#4478</a>),
and the <code>parentbased_always_on</code> sampler works in OTLP mode
(<a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4567">#4567</a>).</p>
<p><strong>Large Language Model (LLM) Observability.</strong> Prompt
tracking is now available for LLMObs spans (<a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4608">#4608</a>).
Experiment scope propagates from APM baggage into spans automatically
(<a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4651">#4651</a>).</p>
<p><strong>Profiler.</strong> An experimental goroutine leak profile is
available as opt-in (<a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4420">#4420</a>).
The goroutine wait profile type has been removed — this is a breaking
change for anyone using it explicitly (<a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4589">#4589</a>).</p>
<p><strong>HTTP and tracing.</strong> A new environment variable
<code>DD_TRACE_HTTP_URL_QUERY_STRING_ALLOWLIST</code> lets you whitelist
query string parameters to keep unredacted (<a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4562">#4562</a>).
A new <code>tracer.StartSpanFromPropagatedContext</code> API simplifies
span creation from propagated contexts (<a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4492">#4492</a>).
AWS EventBridge max payload size is bumped to 1 MB (<a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4458">#4458</a>).
Envoy Service Extensions integration gains Unix Domain Socket (UDS)
support (<a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4463">#4463</a>).</p>
<p><strong>OpenFeature.</strong> Flag evaluation metrics now emit via
OTel Metrics (<a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4489">#4489</a>),
with allocation key tagging (<a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4515">#4515</a>)
and Remote Configuration (RC) integration via <code>FFE_FLAGS</code>
subscription at tracer startup (<a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4495">#4495</a>).</p>
<p><strong>Bug fixes.</strong> gorm now respects
<code>DD_TRACE_REMOVE_INTEGRATION_SERVICE_NAMES_ENABLED</code> (<a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4618">#4618</a>).
Redis and Valkey pipeline commands are joined with newlines, fixing
agent obfuscation (<a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4593">#4593</a>).
A race condition in HTTP client trace timings is resolved (<a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4591">#4591</a>).
AppSec block responses now include a correct <code>Content-Length</code>
header (<a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4496">#4496</a>),
and spurious Remote Configuration errors are silenced when RC is
disabled (<a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4612">#4612</a>).
<code>ContextWithSpan</code> no longer panics on nil context (<a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4313">#4313</a>).
The OTel bridge preserves keep/drop sampling decisions for unsampled
spans (<a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4631">#4631</a>).
User-provided DogStatsD addresses now correctly take priority over
defaults (<a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4575">#4575</a>).</p>
<p><strong>Performance.</strong> Trace ID hex encoding is cached (<a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4481">#4481</a>),
the span metadata map is preallocated (<a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4541">#4541</a>),
and locking is removed from both sampling priority access (<a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4546">#4546</a>)
and the internal logger (<a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4547">#4547</a>)
— reducing allocations and contention on hot paths.</p>
<p><strong>CI Visibility.</strong> Bazel offline cache and payload-file
modes are supported (<a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4503">#4503</a>).
Known test pagination is implemented for large test suites (<a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4509">#4509</a>).</p>
<h2>What's Changed</h2>
<h3>Application Performance Monitoring (APM)</h3>
<ul>
<li>feat: collect service override source by <a
href="https://github.com/raphaelgavache"><code>@​raphaelgavache</code></a>
in <a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4500">DataDog/dd-trace-go#4500</a></li>
<li>feat: support service source for 19 integrations by <a
href="https://github.com/raphaelgavache"><code>@​raphaelgavache</code></a>
in <a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4526">DataDog/dd-trace-go#4526</a></li>
<li>feat: support service source for 13integrations by <a
href="https://github.com/raphaelgavache"><code>@​raphaelgavache</code></a>
in <a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4534">DataDog/dd-trace-go#4534</a></li>
<li>feat: add service source on 10 integrations by <a
href="https://github.com/raphaelgavache"><code>@​raphaelgavache</code></a>
in <a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4540">DataDog/dd-trace-go#4540</a></li>
<li>feat: force usage of ServiceWithSource in contrib by <a
href="https://github.com/raphaelgavache"><code>@​raphaelgavache</code></a>
in <a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4549">DataDog/dd-trace-go#4549</a></li>
<li>fix(eventbridge): update max payload size to 1m by <a
href="https://github.com/Dogbu-cyber"><code>@​Dogbu-cyber</code></a> in
<a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4458">DataDog/dd-trace-go#4458</a></li>
<li>feat(telemetry): add stable session identifier headers by <a
href="https://github.com/khanayan123"><code>@​khanayan123</code></a> in
<a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4574">DataDog/dd-trace-go#4574</a></li>
<li>feat: collect service source in client stats by <a
href="https://github.com/raphaelgavache"><code>@​raphaelgavache</code></a>
in <a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4519">DataDog/dd-trace-go#4519</a></li>
<li>feat: OTel process context v2 (otlp proto) by <a
href="https://github.com/nsavoire"><code>@​nsavoire</code></a> in <a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4478">DataDog/dd-trace-go#4478</a></li>
<li>fix: join redis and valkey pipeline commands with newlines for
correct agent obfuscation by <a
href="https://github.com/rarguelloF"><code>@​rarguelloF</code></a> in <a
href="https://redirect.github.com/DataDog/dd-trace-go/pull/4593">DataDog/dd-trace-go#4593</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/DataDog/dd-trace-go/commit/2b2b2c2c9c420dcc5df24165681ed11c3f1c8438"><code>2b2b2c2</code></a>
chore: make fix-modules &amp;&amp; make generate</li>
<li><a
href="https://github.com/DataDog/dd-trace-go/commit/21438ed81625961b1393806128b142fa7e3829d7"><code>21438ed</code></a>
internal/version: v2.8.1</li>
<li><a
href="https://github.com/DataDog/dd-trace-go/commit/0bc11f30cc930602a07c90a3b106b72bca13ecc0"><code>0bc11f3</code></a>
internal/orchestrion/_integration: v2.8.1-rc.2</li>
<li><a
href="https://github.com/DataDog/dd-trace-go/commit/f17a712cf0ef081a42e1e972da5cb7d0d09fb1b5"><code>f17a712</code></a>
orchestrion/all: v2.8.1-rc.2</li>
<li><a
href="https://github.com/DataDog/dd-trace-go/commit/1b8d8e59ef212bae8097c7025e13fcbb99a0e554"><code>1b8d8e5</code></a>
internal/traceprof/traceproftest: v2.8.1-rc.2</li>
<li><a
href="https://github.com/DataDog/dd-trace-go/commit/7b30b1f0aec1bfd1f7f4a38edaccccd9c691c8fb"><code>7b30b1f</code></a>
contrib/aws/datadog-lambda-go/test/integration_tests/error:
v2.8.1-rc.2</li>
<li><a
href="https://github.com/DataDog/dd-trace-go/commit/96cc2a4c04453a99cba785cafe17ffb6e9a316a9"><code>96cc2a4</code></a>
contrib/aws/datadog-lambda-go/test/integration_tests/hello:
v2.8.1-rc.2</li>
<li><a
href="https://github.com/DataDog/dd-trace-go/commit/f3013b5aed4b2051a3da540cafeedbb05d4b89f9"><code>f3013b5</code></a>
instrumentation/internal/validationtest: v2.8.1-rc.2</li>
<li><a
href="https://github.com/DataDog/dd-trace-go/commit/c9f98439255531363157d4f1b312c594c5ec10e6"><code>c9f9843</code></a>
contrib/labstack/echo.v4: v2.8.1-rc.2</li>
<li><a
href="https://github.com/DataDog/dd-trace-go/commit/e07b30bb083cb5e2aba59f083319f921118d174a"><code>e07b30b</code></a>
contrib/valyala/fasthttp: v2.8.1-rc.2</li>
<li>Additional commits viewable in <a
href="https://github.com/DataDog/dd-trace-go/compare/v2.0.0...v2.8.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/DataDog/dd-trace-go/v2&package-manager=go_modules&previous-version=2.0.0&new-version=2.8.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/coder/coder/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-15 23:40:09 +00:00
Andrew Aquino baf4dfae4d fix(site/src/pages/TemplateBuilder): display TemplateCard/ModuleCard's official badge inline (#27036) 
closes DEVEX-575

There are some screen widths / base template names where the official
badge will break lines by itself as an orphan (see Google Compute Engine
(Linux) in screenshot below). However, I personally prefer this over the
current flex layout (compare with the screenshot in original issue)

<img width="1840" height="1191" alt="image"
src="https://github.com/user-attachments/assets/d5bee310-0202-4d45-aef7-767e457be051"
/>

Unfortunately `&nbsp;` only works if the entities on either side are
both text--not text on the left + image on the right, which is what we
have here.

^One alternative to prevent orphan badges is to split the base template
name by words, then wrap the last word + the official badge in a span
with `white-space: nowrap;`. But that feels a little overwrought to me;
I like the clarity of continuing to just show `{name}` in the JSX. What
do you guys think?
 2026-07-15 15:27:07 -07:00
Callum Styan 15da504cf9 fix: remove excess calls to prepareSQLFilter for workspace and template endpoints (#27248) 2026-07-15 14:23:44 -07:00
Asher 4d4cbd07e6 fix: prevent concurrent token refreshes (#26530) 
This can cause bad refresh token errors, since it can only be used once.

Looks like there was an attempt to fix this by checking the database
after a failed refresh, but of course this depends on the first request
having updated the database in time, so both that and this fix are 
required to fully solve.
 2026-07-15 12:16:25 -08:00
Nick Vigilante c14b4a010a chore(offlinedocs): update low-risk dependencies (#26876) 
## Summary

Updates the `offlinedocs` doc-preview app's dependencies that can move
without code migration, and leaves the heavy framework upgrades for a
separate, deliberate PR.

## Changes

- `react-markdown` 9.1.0 → 10.1.0: used in source
(`pages/[[...slug]].tsx`, the `ReactMarkdown` renderer). The
`components` / `urlTransform` / `remarkPlugins` / `rehypePlugins` API we
rely on is unchanged across the major bump.
- `react-icons` 4.12.0 → 5.7.0: used in source (`MdMenu`, the mobile-nav
hamburger icon). The v5 API is backwards-compatible for our single
import.
- `sanitize-html` 2.17.4 → 2.17.5: used in source
(`sanitizeHtml(body)`); patch bump.
- `prettier` 3.8.3 → 3.9.4 (dev): minor bump, used by the `format`
scripts.
- `@types/node` 20.19.41 → 22.20.0 (dev): types only, capped at the 22.x
line to match the Node 22 runtime rather than tracking latest (26.x).
- `archiver` 6.0.2 → 8.0.0: not imported anywhere in source, so no
render risk (see Notes).

Intentionally **deferred** (coupled breaking migration, touches
component code): Chakra UI v2 → v3, React 18 → 19, Next 15 → 16, ESLint
8 → 10 + flat config, framer-motion 10 → 12.

## Testing

- `tsc --noEmit`: passes.
- `next build` (static export): all 442 pages prerender.
- Dev server launches; `/` and a markdown-rendered page (`/install/`)
both return HTTP 200 and render correctly.
- Verified on Node 22.19.0 / pnpm 10.33.2 (the repo-pinned toolchain);
lockfile `overrides:` block preserved.

## Notes

- `archiver` appears to be a dead dependency (nothing in source imports
it) and could be pruned in a follow-up. It is bumped here only to keep
the lockfile current.

---
🤖 Built with AI assistance.
 2026-07-15 15:04:36 -04:00
Faur Ioan-Aurel 0caaac5d27 fix: prebuild coderd before Playwright startup for e2e tests (#27136) 
The test-e2e job could flake while Playwright waited for its webServer
to become ready. CI already built site/e2e/bin/coder, but that binary
was built before pnpm build and without the embed tag, so Playwright
ignored it and started coderd with go run -tags embed instead. That put
Go compilation, including frontend asset embedding, inside Playwright's
webServer timeout.

Local runs had a similar ordering trap. pnpm playwright:test invoked
Playwright directly, and Playwright starts webServer before globalSetup,
so the existing preflight build could not guarantee a binary existed
before webServer startup.

Build the E2E coder binary with the embed tag and make it depend on
site/out/index.html. In CI, build the frontend first, then build the E2E
binary, then run Playwright. For local runs, have pnpm playwright:test
and pnpm playwright:test-ui run make site/e2e/bin/coder before invoking
Playwright.

Playwright now starts the prebuilt site/e2e/bin/coder binary and waits
on the public /healthz endpoint instead of an authenticated API
endpoint. This keeps compilation outside the webServer readiness timeout
and makes the readiness probe quieter and more direct. I moved to
/healtz because the existing endpoint was returning 401, which still
means “server is up,” but it is a strange readiness signal. /healthz is
explicitly public and returns 200 OK once the HTTP server is accepting
requests.

Caveat: running pnpm exec playwright test
--config=e2e/playwright.config.ts directly bypasses the package script
and therefore bypasses the prebuild. Use pnpm playwright:test or make
test-e2e for the supported local flow.

Because the site package scripts now call make, add make to knip's
ignored
system binaries.

Tests:
- pnpm lint:types
- pnpm exec playwright test --config=e2e/playwright.config.ts --list
-
PATH="/opt/homebrew/opt/make/libexec/gnubin:/opt/homebrew/opt/gnu-getopt/bin:$PATH"
make gen/mark-fresh
-
PATH="/opt/homebrew/opt/make/libexec/gnubin:/opt/homebrew/opt/gnu-getopt/bin:$PATH"
pnpm playwright:test --list

<!--

If you have used AI to produce some or all of this PR, please ensure you
have read our [AI Contribution
guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING)
before submitting.

-->
 2026-07-15 21:21:59 +03:00
Nick Vigilante c84aa564ba docs: normalize code-fence languages for Shiki compatibility (#27161) 
Normalizes non-standard code-fence language tags across `docs/**` so a
strict highlighter (Shiki, used by Fumadocs) won't fail the build on an
unrecognized language, and unifies redundant synonym tags onto one
canonical form per language. The current renderer (Speed-Highlight)
detects the language from the code content, not the fence label, so this
drift wasn't visible until now.

## Changes

- `hcl` -> `tf` (199 fences, including indented ones nested in
numbered/bulleted lists). Shiki ships `hcl` and `terraform` as two
distinct grammars (not aliases); every `hcl`-tagged fence in `docs/**`
is actually Terraform resource/data/provider syntax, so the more
specific `terraform` grammar is correct for all of them. `tf` is Shiki's
own alias for that grammar, and it's also what GitHub's own markdown
renderer resolves to the same HCL/Terraform highlighting.
- `pwsh`/`powershell` -> `ps1`. Both `ps` and `ps1` are registered
PowerShell aliases in Shiki, but on GitHub's renderer only `.ps1` is a
registered file extension (`.ps` isn't), so `ps1` renders identically to
`powershell` there today while bare `ps` would silently lose
highlighting.
- `env` -> `dotenv` (a dedicated Shiki grammar for `KEY=VALUE` files)
- `text`/`output`/`none`/`url` -> `txt`. Same built-in plain-text
fallback either way, just shorter.
- `Dockerfile` -> `dockerfile` (lowercase)
- `bash`/`shell` -> `sh` (732 fences). Shiki and GitHub both alias all
three to a single shell grammar; this was already the style guide's
stated preference, just not enforced across the existing corpus until
now.
- `markdown` -> `md` (4 fences). Alias of the same grammar in both Shiki
and GitHub.
- `jsonc` -> `json` (1 fence). The block has no comments or trailing
commas, so it doesn't need the comments-capable grammar.
- `ts` -> `tsx` (2 fences, `docs/about/contributing/frontend.md`).
Verified the actual content tokenizes identically under both grammars,
and a sibling block in the same file already needs `tsx` for real JSX,
so unifying to one tag is safe for this file. Documented a caveat: `tsx`
mis-tokenizes the legacy angle-bracket type-assertion syntax
(`<Type>value`), which is invalid in real `.tsx` files anyway, so use
`value as Type` instead.
- `yml` -> `yaml` (1 fence)
- Updated `docs/.style/style-guide/formatting.md` to document all
canonical tags

`promql` (2 fences) and `caddyfile` (2 fences) are left as-is. Shiki
doesn't bundle a grammar for either, so they need a custom grammar
registration when the site adopts Shiki, rather than degrading to `txt`.
Tracked as follow-up work under DOCS-118 and
[DOCS-544](https://linear.app/codercom/issue/DOCS-544/vendor-a-local-promql-grammar-for-shiki-syntax-highlighting)
(promql).

Does not touch `offlinedocs/`.

Linear:
[DOCS-476](https://linear.app/codercom/issue/DOCS-476/normalize-docs-code-fence-languages-de-risk-shikifumadocs)

<details>
<summary>How the fence tags were verified</summary>

Each tag was tested against a real `shiki@latest` highlighter instance
(`codeToHtml`/`codeToTokens`) and cross-checked against GitHub's
`@wooorm/starry-night` grammar sources (the renderer that actually
displays these `.md` files today, in repo browsing and PR diffs), since
that's what determines whether brevity is safe before Shiki adoption:

```text
FAIL  env        -- Language `env` is not included in this bundle.
FAIL  Dockerfile -- Language `Dockerfile` is not included in this bundle.
FAIL  promql     -- Language `promql` is not included in this bundle.
FAIL  caddyfile  -- Language `caddyfile` is not included in this bundle.
FAIL  pwsh       -- Language `pwsh` is not included in this bundle.
FAIL  output     -- Language `output` is not included in this bundle.
```

`hcl` doesn't error in Shiki, since it's a real grammar, but that's
exactly the trap: it was silently rendering every fence with the generic
HCL grammar instead of the Terraform-specific one. Every `hcl`-tagged
fence in `docs/**` was manually checked against `origin/main` and is
genuinely Terraform content.

For `ts`/`tsx`, tokenizing the actual doc content confirmed identical
output under both grammars; a synthetic test with the legacy
angle-bracket cast syntax confirmed `tsx` degrades on that specific
construct, which the style guide now calls out.

The first normalization pass only matched fence tags at column 0
(`^```tag$`), missing tags indented inside numbered/bulleted lists. A
follow-up pass caught the remaining occurrences at any indentation
level.

</details>


---

*This PR description and the underlying changes were prepared with Coder
Agents assistance.*
 2026-07-15 14:07:09 -04:00
Jeremy Ruppel d0982e3cc7 fix(coderd/templatebuilder): prompt for DigitalOcean base variables (#27268) 
## Summary

The DigitalOcean template builder base declared Terraform `variable`
blocks for `project_uuid` and `ssh_key_id` that the template builder
never filled. `project_uuid` was required with no default, so the build
broke with no way to supply a value from the wizard (DEVEX-591).

This brings the DigitalOcean base to parity with the GCP bases fixed in
#27015:

- Declare `project_uuid` (required) and `ssh_key_id` (optional, default
`0`) in `base.json` so the wizard prompts for them on the first step.
- Inject the entered values via `default = {{ .Variables.* }}` in
`main.tf.tmpl`, keeping the existing `variable` blocks and validation.
- Drop the `sensitive` flags. The variable-injection path
(`mergeBaseVariables`, `DefaultBaseRenderContext`, and the snapshot test
helper) skips sensitive variables, so a sensitive base variable renders
empty. A project UUID / SSH key ID are not secrets.
- Update the README now that the values are prompted rather than
manually edited.
- Regenerate the `digitalocean-linux.tf.golden` snapshot.

## Testing

- `go test ./coderd/templatebuilder/`

<img width="1048" height="616" alt="Screenshot 2026-07-15 at 12 44
42 PM"
src="https://github.com/user-attachments/assets/89e334ca-e904-4387-9264-6ed1614a40ba"
/>

<details>
<summary>Audit of all template builder bases for unfilled
variables</summary>

| Base | Variable status | Verdict |
|------|-----------------|---------|
| aws-linux | no HCL `variable` blocks; provider env auth | OK |
| aws-windows | same | OK |
| azure-linux | same | OK |
| **digitalocean-linux** | `project_uuid` (required, no default) +
`ssh_key_id`; absent from `base.json` | **Fixed here** |
| docker | `docker_socket` has `default = ""`; `container_image` via `{{
.Variables }}` + declared | OK |
| gcp-linux | fixed in #27015 | OK |
| gcp-windows | fixed in #27015 | OK |
| kubernetes | `namespace` (required), `use_kubeconfig`,
`container_image` all via `{{ .Variables }}` + declared | OK |
| scratch | no variables | OK |

DigitalOcean was the only broken base; all others either have safe
defaults or already declare their variables.

**Mechanism note:** `base.json` `variables[]` drives the first-step
prompts and values are injected as HCL literals via `{{
.Variables.<name> }}` (strings quoted, numbers/bools raw; supported
types: string, number, bool). Sensitive/computed variables are
intentionally skipped everywhere the injection map is built, so they
cannot currently be injected. That is why the `sensitive` flags were
removed here.
</details>

---
*This PR was generated by Coder Agents on behalf of @jeremyruppel.*
 2026-07-15 14:05:18 -04:00
Steven Masley 3b72a3e5dd test(coderd/rbac): add many-orgs authorization benchmark (#27270) 
<!-- Authored with Coder Agents on behalf of @Emyrk -->
Adds `BenchmarkRBACManyOrgs` to measure `Authorize`, `Prepare` (partial
evaluation), and `Prepare`+`CompileToSQL` as a subject's org-membership
count grows (1, 5, 10, 50, 100 orgs).

- Written to evaluate the org set-membership rewrite in #27244, where
partial-eval cost scales with org count.
- Subject uses pre-expanded cached roles (`WithCachedASTValue`), member
+ per-org `organization-member` roles, `ScopeAll`; authorizer has no
cache so each iteration measures a real evaluation.

Results comparing `main` vs #27244 are posted on that PR.

<sub>Coder Agents on behalf of @Emyrk.</sub>
 2026-07-15 12:04:05 -06:00
Bobby Ho 511c3cddc0 fix(testutil/expecter): remove nested pipe from output logging path (#27204) 
## Summary

Partial fix for the flake in
[PLAT-251](https://linear.app/codercom/issue/PLAT-251/flake-test-go-pg-macos-job-timeoutcancelled)
/ [coder/internal#1365](https://github.com/coder/internal/issues/1365)
(`test-go-pg (macos-latest)` timing out and getting cancelled after 25
minutes).

## Problem

`testutil/expecter.Expecter` drains a command's stdout/stderr through
`io.Copy` into an internal buffer, but it also teed every write through
a **second, independent unbuffered `io.Pipe()`**, read by a
`bufio.Scanner`, purely to produce human-readable debug logs:

```go
logr, logw := io.Pipe()
w := io.MultiWriter(logw, out)   // out never blocks; logw is a second unbuffered pipe
go func() { io.Copy(w, r) }()    // drains the command's real stdout/stderr
go func() { bufio.NewScanner(logr).Scan() ... }()  // only reads when scheduled
```

`io.MultiWriter` only returns once **every** writer succeeds. If the
scanner goroutine is ever delayed (GC pause, scheduler contention under
CI's `-parallel=16` test config), the write into `logw` blocks, which
blocks the `io.Copy` write, which stops it from reading the command's
actual output pipe, which means the **command's own write can never
complete either**, since nobody is left reading it. Nothing on this path
has a timeout, so once wedged it stays wedged until `go test`'s own
`-timeout 20m` kills the whole binary.

This reproduced locally in `TestConfigSSH_FileWriteAndOptionsFlow` under
the macOS CI job's exact parallelism, stuck writing a routine
"executable not in `$PATH`" warning (`cli.currentBinPath`) that the test
wasn't actively reading at that instant. It's a flake, not a
deterministic failure, because under light load the scanner always keeps
up trivially.

### Race condition

```mermaid
sequenceDiagram
    participant TG as Test goroutine
    participant CmdG as Command goroutine<br/>(inv.Run)
    participant P1 as Pipe 1<br/>(inv.Stdout)
    participant Copy as io.Copy goroutine
    participant P2 as Pipe 2<br/>(logw/logr, debug logging only)
    participant Scan as Scanner goroutine
    participant Buf as stdbuf (out)<br/>unbounded, never blocks

    CmdG->>P1: Write(warning output)
    P1-->>Copy: Read() unblocks
    Copy->>P2: MultiWriter step 1: write to logw
    Copy->>Buf: MultiWriter step 2: write to out

    rect rgb(255, 230, 230)
    Note over Scan: Under heavy parallel test load,<br/>Scan()'s next Read() is delayed
    P2--xCopy: Write(logw) blocks: nobody reading yet
    end

    Copy--xP1: Read() no longer called: Copy is stuck writing to P2
    CmdG--xP1: Write() can't complete either: nobody reads Pipe 1
    Note over CmdG: Command write blocks FOREVER<br/>(confirmed: 17-18 min in a goroutine dump)

    TG->>TG: ExpectMatch times out (got ""), fails the test
    Note over TG,CmdG: Test goroutine exits, but CmdG is<br/>orphaned and permanently blocked until<br/>go test's own -timeout kills the binary
```

## Fix

Remove the second pipe. `io.Copy` now writes only to the unbounded,
non-blocking `stdbuf`. Debug logging is forwarded via a **bounded,
non-blocking channel** instead of a second unbuffered pipe: a full
channel just drops the chunk rather than propagating backpressure.

This works because the only thing the command's real output pipe depends
on is `io.Copy(out, r)`, and `out.Write()` can never block, so `io.Copy`
always keeps calling `Read()`, so the command's write always has an
active reader. Debug logging becomes provably unable to backpressure the
command under test, since losing an occasional log line under extreme
load is an acceptable tradeoff, unlike losing a whole CI job to a silent
deadlock. The fix lives in the shared harness rather than in
`cli/configssh.go` because the warning it's tripping over is legitimate,
unrelated product behavior; every other test using this harness that
happens to emit output the test isn't actively matching at that instant
was exposed to the same bug.

**Note:** this addresses one of two distinct root causes bundled under
PLAT-251. The other is a Depot `GOCACHEPROG` shutdown hang in CI
infrastructure (outside this repo, previously diagnosed by a maintainer
on the Feb 2026 incident), which this change cannot affect. Locally this
fix measurably improves things, but a residual, load-dependent hang was
still observed under extreme synthetic contention on a shared dev
machine; watching several real CI runs is the next step before
considering the flake fully resolved.

---------

Co-authored-by: Cian Johnston <cian@coder.com>
 2026-07-15 09:08:11 -07:00
Cian Johnston f958727887 chore: update mise.lock (#27258) 
`mise install` now adds more properties to `mise.lock` after running
`mise install`:

- Bare URLs get `checksum` and `url`
- GitHub URLs get an `api_url` to the release asset
 2026-07-15 14:57:23 +01:00
Spike Curtis ac35e0d3d8 test: fix flake in TestServer/Logging (#27263) 
<!--

If you have used AI to produce some or all of this PR, please ensure you have read our [AI Contribution guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING) before submitting.

-->

fixes https://github.com/coder/internal/issues/1618

same underlying issue as https://github.com/coder/internal/issues/946

Test flakes because main test ends before the server can connect to postrgres and this causes the CLI invocation to return an error we don't care about.
 2026-07-15 14:39:45 +02:00
Cian Johnston c57d6fcef0 chore(helm): update logo URL (#27262) 
Updates logo URL to the same referenced by our README.
 2026-07-15 11:05:39 +00:00
Marcin Tojek 2bea8fb382 fix(scripts/releaser/v1): remove doubled "v" in release calendar latest release link (#27260) 
## Problem

The interactive releaser (`scripts/releaser`) renders the "Latest
Release"
cell of the release calendar with a doubled version prefix, e.g.
`[vv2.35.0](.../tag/v2.35.0)`.

`version.String()` already returns a `v`-prefixed string (e.g.
`v2.35.0`),
but `updateCalendar` wrapped it in a `"[v%s]"` template, so the link
label
gained a second `v`. The tag URL was already correct because release
tags
carry the `v` prefix.

## Fix

Drop the extra `v` from the label template (`"[v%s]"` → `"[%s]"`). The
URL is
unchanged.

- Label before: `[vv2.35.0]`
- Label after: `[v2.35.0]`

## Test

Added `scripts/releaser/v1/docs_test.go`:

- `TestUpdateCalendarLatestReleaseVersionPrefix` asserts the
`LatestRelease`
cell for a matching row on both a patch and a minor release. It fails on
the
  old code (`[vv2.35.x]`) and passes with the fix.
- `TestUpdateCalendarNotReleasedRowName` covers the `Not Released` →
`Mainline`
  promotion and the major.minor "Release name" link (patch omitted).

<details>
<summary>Investigation notes</summary>

- Entry path: `scripts/release.sh` → `go run ./scripts/releaser
--legacy` →
  `runRelease` → `promptAndUpdateDocs` → `updateReleaseDocs` →
`updateCalendarFile` → `updateCalendar` (`scripts/releaser/v1/docs.go`).
- Root cause in `updateCalendar`: `fmt.Sprintf("[v%s](%s)",
newVer.String(), ...)`
  combined with `version.String()` returning `v%d.%d.%d`.
- Only the link label was affected; the `releaseTagURLFmt` URL was
correct
  because tags are `v`-prefixed.
- The standalone `scripts/update-release-calendar.sh` is a separate
implementation and is not affected (it strips the `v` before re-adding
one).
- Companion PR for `release/2.35` (file `scripts/releaser/docs.go`):
#27259.

</details>

---
This PR was generated by Coder Agents.
 2026-07-15 12:51:44 +02:00
Ethan 304f127d34 ci(.github): remove the go-cache action (#27250) 
Closes https://github.com/coder/internal/issues/1619
Closes ENG-3039
Closes https://github.com/coder/internal/issues/1002
Closes ENG-3018

The `test-go-pg` Go cache grew until the post-job save could no longer
complete within the job timeout, cancelling the job on every `main` run.

Depot runners already provide remote Go build caching via
[`GOCACHEPROG`](https://depot.dev/docs/cache/integrations/gocache),
which writes every object it serves into `GOCACHE` and never evicts, so
persisting `GOCACHE` with `actions/cache` on top just carries an
ever-growing directory forward. #20510 removed the custom build cache
steps for exactly this reason, and the `go-cache` action introduced in
#25727 unintentionally reinstated them.

The action is now removed entirely, along with its module cache
persistence: a full cache miss plus cold `go mod download` on a Depot
runner takes about 10 seconds, faster than any warm `actions/cache`
restore of the module cache was.

`setup-go-paths` is kept, as it points `GOCACHE` and friends at the
Windows RAM disk, but its now-unused caching-related outputs are
removed.
 2026-07-15 18:35:18 +10:00
Ethan cc11c8a536 feat: surface model content-filter refusals as a blocked chat error (#27118) 
Blocked turns from a provider's content filter (Anthropic's `refusal`
stop reason with empty content) previously ended silently on the
"Thinking" spinner. They now end as a terminal `content_filter` error
that renders as a "Response blocked" message with the provider's
category and explanation.

<img width="888" height="335" alt="image"
src="https://github.com/user-attachments/assets/cef85a59-4091-4e62-9d45-1eb06748db48"
/>


Closes CODAGT-611

Follow-ups will involve implementing fallbacks, but this alone is pretty
important
 2026-07-15 16:36:31 +10:00
Cian Johnston 8eaf4f507b feat: generate the known-models catalog and aigateway prices (#27146) 
- Regenerates `prices.json` from models.dev. The seeder only upserts, so
existing deployments keep delisted models.
- Generate the frontend known-models catalog instead of hand-writing it.
`make gen/aibridge-prices` fetches models.dev once
- Moved patches to model definitions to separate `overrides.jq` which 
  handles both `claude-sonnet-4-5` 200k context and 'aliasing' Fable 5
  as Mythos 5.
- Editorial choices of selection, order, aliases, and reasoning defaults 
  live in `curation.json`.
- Adds golden join tests with one error case per validation, a
no-network drift test comparing curation to the checked-in artifact, and
pinned invariants for the Anthropic thinking-mode split (the wrong side
returns HTTP 400) and the sonnet-4-5 context pin.

Adding a model is now one `curation.json` entry plus `make
gen/aibridge-prices`, assuming it is present on models.dev.

> This PR was authored by Coder Agents on Cian's behalf.

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-07-14 19:36:27 +00:00
Yevhenii Shcherbina 4d884c30e7 fix: validate bedrock protocol at provider construction (#27234) 
Follow-up PR to https://github.com/coder/coder/pull/26745
 2026-07-14 15:30:36 -04:00
Bobby Ho 0207a9824f fix: enforce max body size on CSP violation report endpoint (#27243) 
The `/api/v2/csp/reports` endpoint is unauthenticated and CSRF-exempt,
since it's the browser's `report-uri` target, and decoded request bodies
with no size limit. This let an attacker post arbitrarily large JSON
bodies to force unbounded heap allocation and OOM the server (Cure53
CDM-02-007).

Wraps the request body in `http.MaxBytesReader` before decoding and
returns 413 when the limit is exceeded, matching the existing convention
used by `files.go`, `aitasks.go`, and `exp_chats.go`.

Fixes: https://github.com/coder/security-disclosures/issues/171
 2026-07-14 12:29:38 -07:00
Jon Ayers d99ed85db8 fix: fix test flake in nats subscribe cleanup (#27238) 2026-07-14 14:10:52 -05:00
McKayla はな b377bec5f4 fix(site): replace ansi-to-html in the log viewer (#27206) 2026-07-14 12:54:16 -06:00
Nick Vigilante 61e52532c0 docs: wrap placeholder syntax in backticks in CLI help and swagger annotations (#27194) 
## Problem

Generated reference docs (`docs/reference/cli/*`,
`docs/reference/api/*`) contained raw placeholder and JSON syntax that
came straight from Go CLI help strings and swagger annotations. HTML
renderers treat the angle-bracket tokens (`<team-slug>`, `<uuid>`,
`<KEY>`, etc.) as unknown tags and drop them, so readers see
broken/half-missing text today. The same strings also break MDX parsing.

## Fix

Wrap the placeholder/JSON syntax in backticks **at the source** (Go help
strings and swagger annotation comments), then `make gen`. Rendered docs
now show the placeholders as inline code instead of dropping them.

### Source changes

| File | Placeholder wrapped | Surfaces in |
|------|--------------------|-------------|
| `codersdk/deployment.go` | `` `<organization-name>/<team-slug>` `` |
`cli/server.md`, `coder --help`, settings UI |
| `codersdk/deployment.go` | `` `CODER_AI_GATEWAY_PROVIDER_<N>_*` ``, ``
`CODER_AI_GATEWAY_PROVIDER_<N>_<KEY>` `` | `api/schemas.md` |
| `cli/tokens.go` | `` `<type>:<uuid>` `` | `cli/tokens_create.md`,
`coder --help` |
| `coderd/aitasks.go` | `` `owner:<…>` ``, `` `organization:<…>` ``, ``
`status:<status>` `` | `api/tasks.md` |
| `coderd/exp_chats.go` | `` `pr_status:<…>` `` and sibling filter
tokens | `api/chats.md` |
| `coderd/provisionerdaemons.go`, `coderd/provisionerjobs.go` | ``
`{'tag1':'value1','tag2':'value2'}` `` | `api/organizations.md`,
`api/provisioning.md` |

Everything else in the diff (`coderd/apidoc/*`, `docs/reference/**`,
`*.golden`, `site/src/api/typesGenerated.ts`) is `make gen` output.

## Reviewer notes (the "considered pass" from the ticket)

- **Product-visible:** this changes `coder server --help` and `coder
tokens create --help` output, and the `server-config.yaml` reference
comment. Backticks in terminal help are literal but read fine as
placeholder markers.
- **Settings UI:** the `deployment.go` `Description` also renders in the
deployment settings page. If that field is not Markdown-rendered,
literal backticks will show there. Happy to drop the `deployment.go`
change if you'd rather keep the UI text clean and fix `server.md`
another way.
- **Out of scope here:** `docs/reference/cli/agent-firewall.md`
(`<host>`/`<glob>`) is generated from the external
`github.com/coder/boundary` module, not this repo. It needs an upstream
fix + module bump; not included in this PR.

<details>
<summary>Implementation notes / decision log</summary>

- Scope taken from DOCS-551: source-level backtick pass for generated
reference docs only. Hand-written Markdown fixes are tracked separately
(companion ticket).
- Swagger `@Param` descriptions are Go comments, so the existing `\|`
pipe-escaping in the chats `q` filter is preserved inside the new
backticks (still required for the Markdown table cell to render `|`).
- Verified after `make gen`: generated docs render placeholders as code
spans, table pipes intact; `gofmt` clean; changed Go packages build; no
emdash/endash introduced.
- Deliberately left the `AIProviderConfig` type-level doc comment
untouched because it does not surface in any generated doc (kept the
diff to doc-feeding comments).

</details>

Linear: DOCS-551

---

_Opened by Coder Agents on behalf of @nickvigilante._



---

## Evidence: placeholders dropped on the live docs site

Verified **2026-07-14** against the live site (`coder.com/docs`, i.e.
`main`, pre-merge) by loading each affected page in headless Chrome and
reading the post-hydration DOM (confirmed identical in the raw page
payload). Each simple `<token>` placeholder is parsed as an **empty
custom HTML element**, so the browser renders nothing for it and the
placeholder text disappears from the page.

### What readers see today (before this PR)

| Page (live) | Source Markdown | Rendered on the live site |
|-------------|-----------------|---------------------------|
| [`cli/server`](https://coder.com/docs/reference/cli/server) — OAuth2
GitHub Allowed Teams | `Structured as: <organization-name>/<team-slug>.`
| `Structured as: /.` |
|
[`cli/tokens_create`](https://coder.com/docs/reference/cli/tokens_create)
— `--allow` | `Repeatable allow-list entry (<type>:<uuid>, e.g.
workspace:1234-...).` | `Repeatable allow-list entry (:, e.g.
workspace:1234-...).` |
| [`api/tasks`](https://coder.com/docs/reference/api/tasks) — `q` | `...
status:<status>` | `... status:` (nothing after the colon) |
| [`api/schemas`](https://coder.com/docs/reference/api/schemas) —
AIBridgeConfig (`anthropic`/`bedrock`/`openai`) |
`CODER_AI_GATEWAY_PROVIDER_<N>_*` | `CODER_AI_GATEWAY_PROVIDER__*` |
| [`api/schemas`](https://coder.com/docs/reference/api/schemas) —
AIBridgeConfig (`providers`) | `CODER_AI_GATEWAY_PROVIDER_<N>_<KEY>` |
`CODER_AI_GATEWAY_PROVIDER__` |

[`api/chats`](https://coder.com/docs/reference/api/chats) (`q`) drops
five tokens the same way — `title:<substring>`, `diff_url:<url>`,
`pr:<number>`, `pr_title:<text>`, and the trailing `title:<value>`. The
live parameter description reads (note the dangling `title:`,
`diff_url:`, `pr:`, `pr_title:`):

```text
Search query. Supports title: (case-insensitive, quote multi-word values), archived:bool, has_unread:bool, pr_status:<draft|open|merged|closed> as repeated or comma-separated values, source:<created_by_me|shared_with_me>, diff_url: (quote values containing colons), pr: (exact PR number match), repo:<owner/repo> (case-insensitive substring match against git remote origin or URL), pr_title: (case-insensitive PR title substring). Bare terms are not supported; use title: for title filtering.
```

<details>
<summary>Raw rendered DOM from the live site (headless Chrome,
post-hydration)</summary>

```html
<!-- reference/cli/server -->
Structured as: <organization-name>/<team-slug>.</team-slug></organization-name>

<!-- reference/cli/tokens_create -->
Repeatable allow-list entry (<type>:<uuid>, e.g. workspace:1234-...).</uuid></type>

<!-- reference/api/tasks : only status:<status> drops; the /-containing tokens are escaped and survive -->
Search query for filtering tasks. Supports: owner:&lt;username/uuid/me&gt;, organization:&lt;org-name/uuid&gt;, status:<status></status>

<!-- reference/api/schemas : anthropic / bedrock / openai rows -->
Deprecated: Use Providers with indexed CODER_AI_GATEWAY_PROVIDER_<n>_* env vars instead.</n>

<!-- reference/api/schemas : providers row -->
Providers holds provider instances populated from CODER_AI_GATEWAY_PROVIDER_<n>_<key> env vars and/or the deprecated LegacyOpenAI/LegacyAnthropic/LegacyBedrock fields above.</key></n>
```

The parser auto-inserts closing tags
(`</team-slug></organization-name>`) and lowercases the tag name (`<N>`
becomes `<n>`), leaving `__` where `<N>_` used to be. Every wrapped
placeholder renders correctly as inline code on the [docs preview for
this
branch](https://coder.com/docs/@vigilante%2Fdocs-551-backtick-placeholder-syntax-in-generated-reference-docs-cli/reference/cli/server).

</details>

### Accuracy note — cases that do *not* drop on live

These render fine today, so they are **not** evidence of dropping (the
PR still wraps them for consistency / MDX-safety):

-
[`api/organizations`](https://coder.com/docs/reference/api/organizations)
and
[`api/provisioning`](https://coder.com/docs/reference/api/provisioning):
`{'tag1':'value1','tag2':'value2'}` renders verbatim — curly braces are
not an HTML tag.
- Tokens containing `/` or `|` are escaped by the renderer and stay
visible (as literal `<...>`): `<username/uuid/me>`, `<org-name/uuid>`,
`<owner/repo>`, `<draft|open|merged|closed>`,
`<created_by_me|shared_with_me>`. Backticks still improve their
readability, but they were never dropped.
 2026-07-14 13:39:58 -04:00
Paweł Banaszewski 3126306598 feat: add --aigateway-proxy-target flag (#27122) 
Adds `--aigateway-proxy-target` option to
`deploymentGroupAIGatewayProxy` that defines URL to which intercepted
requests should be forwarded to.
Forward URL used to be hardcoded to `coderAPI.AccessURL` pointing to
embedded Gateway. With addition of standalone AI Gateway this needs to
be configurable.

Renamed `aibridgeproxyd.Server.coderAccessURL` and `coderAccessPort` ->
`gatewayURL` and `gatewayPort` + option to better reflect reality.
 2026-07-14 16:40:22 +00:00
Michael Suchacz a567f6a89f feat: allow admins to override the chat compaction model (#27151) 2026-07-14 16:57:04 +02:00
Jake Howell bf57da58e7 chore(site): replace CircularProgress with Spinner component (#24276) 2026-07-15 00:26:43 +10:00
Jake Howell 57852112a6 chore: unify admin settings menu items (#27209) 
> 🤖 This PR was written by Coder Agents on behalf of Jake Howell.

## Problem

#27191 fixed the mobile menu missing the **AI** / **AI sessions** items,
but did so by duplicating the item list. The desktop
`DeploymentDropdown` and mobile `MobileMenu` each hardcode the same
Admin settings links and permission gates. That duplication is exactly
why the two drifted out of sync in the first place, and it will happen
again the next time an item is added.

## Fix

Extract a single source of truth in `adminSettings.ts`:

- `AdminSettingsPermissions` type shared by both surfaces.
- `getAdminSettingsItems(permissions)` builds the ordered item list
using conditional spreads, e.g.

  ```ts
  ...(canViewAISettings ? [{ label: "AI", to: "/ai/settings" }] : []),
  ```

- `canViewAdminSettings(permissions)` for the desktop visibility gate.

`DeploymentDropdown` and `MobileMenu` now just `.map()` over the shared
list, so adding or changing an item is a one-line edit in one place.

No backend, permission, routing, or user-visible behavior changes. Item
labels, links, and order match the current desktop dropdown (mobile now
inherits the same `linkToAuditing` constant instead of a hardcoded
`/audit`, same value).

<details>
<summary>Rationale / approach</summary>

Following Larry Wall's virtues: laziness (one list to maintain, not
two), impatience (kill the class of bug where the two menus silently
diverge), and hubris (leave a shared module nobody has to apologize
for).

Kept `canViewOrganizations` in the permission type and visibility gate
even though Organizations always renders, preserving prior behavior
rather than changing it as part of a refactor.

Validated with `biome check` and `tsc --noEmit`; existing
`MobileMenu.stories.tsx` args already cover the Admin / Auditor /
OrgAdmin / Member permission matrices.

</details>
 2026-07-14 23:33:56 +10:00
Jake Howell bff7ec7624 refactor(site): de-emotion the DERP health page (#27208) 
> 🤖 This PR was written by Coder Agents on behalf of Jake Howell.

## What

Removes the last `@emotion/react` usage from the DERP health page
(`site/src/pages/HealthPage/DERPPage.tsx`).

- Drops `useTheme` from `@emotion/react`; the page no longer reads the
Emotion theme.
- Replaces the region pin's `style={{ color: healthyColor(theme,
severity) }}` with a Tailwind class derived from severity, matching the
existing pattern in sibling components (`HealthIcon`, `HealthyDot`,
`StatusIcon` in `Content.tsx`).
- Deletes `healthyColor.ts`, which was only consumed by this page and
itself depended on `@emotion/react`.

## Why

The page was already almost entirely Tailwind-based; the theme lookup
was the only Emotion holdout. Aligning it with the surrounding
components keeps the severity colours consistent and removes dead code.

<details>
<summary>Notes</summary>

Severity → class mapping mirrors `Content.tsx`:

| Severity | Class |
| --- | --- |
| `ok` | `text-content-success` |
| `warning` | `text-content-warning` |
| `error` | `text-content-destructive` |

Note: the old helper used `theme.roles.*.fill.solid` tokens, whereas the
surrounding components use the `content-*` tokens — these can differ
slightly in shade. I opted for consistency with the neighbouring health
components. Happy to swap to a dedicated `fill`-equivalent token if
you'd prefer an exact colour match.

</details>
 2026-07-14 23:29:22 +10:00
Jake Howell 3060a40285 refactor(site/src/pages/UserSettingsPage/TokensPage): de-MUI TokensPageView (#27212) 
> 🤖 This PR was written by Coder Agents on behalf of Jake Howell.

Removes the remaining MUI/Emotion dependency from `TokensPageView.tsx`.

## Changes

- Removed `useTheme` from `@emotion/react` and the `const theme =
useTheme()` call.
- Replaced all `style={{ color: theme.palette.text.secondary }}` inline
styles with the `text-content-secondary` Tailwind token, matching
sibling components (`Table.tsx`, other UserSettings pages).
- Preserved `data-pixel="ignore"` and all other attributes/behavior.

## Validation

- `tsc --noEmit`: no errors for the file.
- `biome check`: clean.
 2026-07-14 23:27:08 +10:00
Jeremy Ruppel f2181572cc fix(site): support browser back and forward in template builder wizard (#27104) 
Browser back/forward controls did not work in the template builder
wizard. Using browser navigation sent the user out of the wizard
entirely instead of moving between steps.

The wizard's current step is now driven by a `?step=` search param. Step
transitions push history entries so browser back/forward walks the
steps. Steps that are invalid, skipped, or unreachable given the wizard
state are clamped and the URL is rewritten with a replace, keeping URL
and state in sync in both directions.

`?base=` is accepted as the only entry search param and deep-links to a
preselected base template (superseding #26808). The page container
resolves it against the available bases, holds the wizard behind a
loader until it is consumed and removed from the URL, then mounts the
wizard starting on the first step after base selection.

Closes https://linear.app/codercom/issue/DEVEX-594

> Generated with [Coder](https://coder.com) by @jeremyruppel
 2026-07-14 08:55:36 -04:00
Danielle Maywood 0f55c283f1 fix: use backend-selected chat agent for desktop, git, terminal (#26959) 2026-07-14 13:50:25 +01:00
dependabot[bot] 8c1d8ff149 ci: bump the github-actions group across 1 directory with 26 updates (#27228) 
Bumps the github-actions group with 26 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `6.0.2` |
`7.0.0` |
|
[step-security/harden-runner](https://github.com/step-security/harden-runner)
| `2.17.0` | `2.20.0` |
| [dorny/paths-filter](https://github.com/dorny/paths-filter) | `4.0.1`
| `4.0.2` |
|
[tj-actions/changed-files](https://github.com/tj-actions/changed-files)
| `47.0.5` | `47.0.6` |
| [actions/cache/restore](https://github.com/actions/cache) | `5.0.5` |
`6.1.0` |
| [actions/cache/save](https://github.com/actions/cache) | `5.0.5` |
`6.1.0` |
| [docker/login-action](https://github.com/docker/login-action) |
`4.1.0` | `4.4.0` |
| [actions/setup-java](https://github.com/actions/setup-java) | `5.2.0`
| `5.5.0` |
| [actions/attest](https://github.com/actions/attest) | `4.1.0` |
`4.1.1` |
|
[actions/create-github-app-token](https://github.com/actions/create-github-app-token)
| `3.1.1` | `3.2.0` |
|
[dependabot/fetch-metadata](https://github.com/dependabot/fetch-metadata)
| `3.0.0` | `3.1.0` |
|
[aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials)
| `6.1.0` | `6.2.2` |
| [fluxcd/flux2/action](https://github.com/fluxcd/flux2) | `2.8.5` |
`2.9.1` |
| [depot/build-push-action](https://github.com/depot/build-push-action)
| `1.17.0` | `1.18.0` |
|
[docker/setup-buildx-action](https://github.com/docker/setup-buildx-action)
| `4.0.0` | `4.2.0` |
|
[linear/linear-release-action](https://github.com/linear/linear-release-action)
| `0.7.0` | `0.14.5` |
|
[toshimaru/auto-author-assign](https://github.com/toshimaru/auto-author-assign)
| `3.0.1` | `3.0.3` |
|
[benc-uk/workflow-dispatch](https://github.com/benc-uk/workflow-dispatch)
| `1.3.1` | `1.3.2` |
|
[github/codeql-action/upload-sarif](https://github.com/github/codeql-action)
| `4.35.1` | `4.36.3` |
| [github/codeql-action/init](https://github.com/github/codeql-action) |
`4.35.1` | `4.36.3` |
|
[github/codeql-action/analyze](https://github.com/github/codeql-action)
| `4.35.1` | `4.36.3` |
| [actions/stale](https://github.com/actions/stale) | `10.2.0` |
`10.3.0` |
|
[actions/download-artifact](https://github.com/actions/download-artifact)
| `4.2.1` | `8.0.1` |
|
[peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request)
| `7.0.8` | `8.1.1` |
| [actions/cache](https://github.com/actions/cache) | `5.0.5` | `6.1.0`
|
|
[umbrelladocs/action-linkspector](https://github.com/umbrelladocs/action-linkspector)
| `1.5.2` | `1.5.4` |


Updates `actions/checkout` from 6.0.2 to 7.0.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/releases">actions/checkout's
releases</a>.</em></p>
<blockquote>
<h2>v7.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>block checking out fork pr for pull_request_target and workflow_run
by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
<li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the
minor-actions-dependencies group across 1 directory by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li>
<li>Bump flatted from 3.3.1 to 3.4.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li>
<li>Bump js-yaml from 4.1.0 to 4.2.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li>
<li>Bump <code>@​actions/core</code> and
<code>@​actions/tool-cache</code> and Remove uuid by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li>
<li>upgrade module to esm and update dependencies by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li>
<li>Bump the minor-npm-dependencies group across 1 directory with 3
updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li>
<li>getting ready for checkout v7 release by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2464">actions/checkout#2464</a></li>
<li>update error wording by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2467">actions/checkout#2467</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v6.0.3...v7.0.0">https://github.com/actions/checkout/compare/v6.0.3...v7.0.0</a></p>
<h2>v6.0.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Update changelog by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
<li>Fix checkout init for SHA-256 repositories by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li>
<li>Update changelog for v6.0.3 by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/yaananth"><code>@​yaananth</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>v7.0.0</h2>
<ul>
<li>Block checking out fork PR for pull_request_target and workflow_run
by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
<li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the
minor-actions-dependencies group across 1 directory by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li>
<li>Bump flatted from 3.3.1 to 3.4.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li>
<li>Bump js-yaml from 4.1.0 to 4.2.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li>
<li>Bump <code>@​actions/core</code> and
<code>@​actions/tool-cache</code> and Remove uuid by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li>
<li>upgrade module to esm and update dependencies by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li>
<li>Bump the minor-npm-dependencies group across 1 directory with 3
updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li>
</ul>
<h2>v6.0.3</h2>
<ul>
<li>Fix checkout init for SHA-256 repositories by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
</ul>
<h2>v6.0.2</h2>
<ul>
<li>Fix tag handling: preserve annotations and explicit fetch-tags by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li>
</ul>
<h2>v6.0.1</h2>
<ul>
<li>Add worktree support for persist-credentials includeIf by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li>
</ul>
<h2>v6.0.0</h2>
<ul>
<li>Persist creds to a separate file by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li>
<li>Update README to include Node.js 24 support details and requirements
by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li>
</ul>
<h2>v5.0.1</h2>
<ul>
<li>Port v6 cleanup to v5 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li>
</ul>
<h2>v5.0.0</h2>
<ul>
<li>Update actions checkout to use node 24 by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
</ul>
<h2>v4.3.1</h2>
<ul>
<li>Port v6 cleanup to v4 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li>
</ul>
<h2>v4.3.0</h2>
<ul>
<li>docs: update README.md by <a
href="https://github.com/motss"><code>@​motss</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
<li>Add internal repos for checking out multiple repositories by <a
href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
<li>Documentation update - add recommended permissions to Readme by <a
href="https://github.com/benwells"><code>@​benwells</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
<li>Adjust positioning of user email note and permissions heading by <a
href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li>
<li>Update README.md by <a
href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
<li>Update CODEOWNERS for actions by <a
href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li>
<li>Update package dependencies by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
</ul>
<h2>v4.2.2</h2>
<ul>
<li><code>url-helper.ts</code> now leverages well-known environment
variables by <a href="https://github.com/jww3"><code>@​jww3</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li>
<li>Expand unit test coverage for <code>isGhes</code> by <a
href="https://github.com/jww3"><code>@​jww3</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li>
</ul>
<h2>v4.2.1</h2>
<ul>
<li>Check out other refs/* by commit if provided, fall back to ref by <a
href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/checkout/commit/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"><code>9c091bb</code></a>
update error wording (<a
href="https://redirect.github.com/actions/checkout/issues/2467">#2467</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/1044a6dea927916f2c38ba5aeffbc0a847b1221a"><code>1044a6d</code></a>
getting ready for checkout v7 release (<a
href="https://redirect.github.com/actions/checkout/issues/2464">#2464</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/f0282184c7ce73ab54c7e4ab5a617122602e575f"><code>f028218</code></a>
Bump the minor-npm-dependencies group across 1 directory with 3 updates
(<a
href="https://redirect.github.com/actions/checkout/issues/2462">#2462</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/d914b262ffc244530a203ab40decab34c3abf34d"><code>d914b26</code></a>
upgrade module to esm and update dependencies (<a
href="https://redirect.github.com/actions/checkout/issues/2463">#2463</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/537c7ef99cef6e5ddb5e7ff5d16d14510503801d"><code>537c7ef</code></a>
Bump <code>@​actions/core</code> and <code>@​actions/tool-cache</code>
and Remove uuid (<a
href="https://redirect.github.com/actions/checkout/issues/2459">#2459</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/130a169078a413d3a5246a393625e8e742f387f6"><code>130a169</code></a>
Bump js-yaml from 4.1.0 to 4.2.0 (<a
href="https://redirect.github.com/actions/checkout/issues/2461">#2461</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/7d09575332117a40b46e5e020664df234cd416f3"><code>7d09575</code></a>
Bump flatted from 3.3.1 to 3.4.2 (<a
href="https://redirect.github.com/actions/checkout/issues/2460">#2460</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/0f9f3aa320cb53abeb534aeb54048075d9697a0e"><code>0f9f3aa</code></a>
Bump actions/publish-immutable-action (<a
href="https://redirect.github.com/actions/checkout/issues/2458">#2458</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/f9e715a95fcd1f9253f77dd28f11e88d2d6460c7"><code>f9e715a</code></a>
block checking out fork pr for pull_request_target and workflow_run (<a
href="https://redirect.github.com/actions/checkout/issues/2454">#2454</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/df4cb1c069e1874edd31b4311f1884172cec0e10"><code>df4cb1c</code></a>
Update changelog for v6.0.3 (<a
href="https://redirect.github.com/actions/checkout/issues/2446">#2446</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/checkout/compare/v6.0.2...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0">compare
view</a></li>
</ul>
</details>
<br />

Updates `step-security/harden-runner` from 2.17.0 to 2.20.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/step-security/harden-runner/releases">step-security/harden-runner's
releases</a>.</em></p>
<blockquote>
<h2>v2.20.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Support for block policy for MacOS and Windows GitHub-hosted
runners</li>
<li>Support for Bitrise MacOS GitHub Actions runners</li>
<li>HTTPS monitoring support for Bun for Linux runners (enterprise
tier)</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/step-security/harden-runner/compare/v2.19.4...v2.20.0">https://github.com/step-security/harden-runner/compare/v2.19.4...v2.20.0</a></p>
<h2>v2.19.4</h2>
<h2>What's Changed</h2>
<ul>
<li>Improvements for HTTPS Monitoring for the Enterprise tier of Harden
Runner</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/step-security/harden-runner/compare/v2.19.3...v2.19.4">https://github.com/step-security/harden-runner/compare/v2.19.3...v2.19.4</a></p>
<h2>v2.19.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Default to audit mode when api-key missing with use-policy-store by
<a
href="https://github.com/varunsh-coder"><code>@​varunsh-coder</code></a>
in <a
href="https://redirect.github.com/step-security/harden-runner/pull/665">step-security/harden-runner#665</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/step-security/harden-runner/compare/v2.19.2...v2.19.3">https://github.com/step-security/harden-runner/compare/v2.19.2...v2.19.3</a></p>
<h2>v2.19.2</h2>
<h2>What's Changed</h2>
<ul>
<li>Update the Harden Runner agent for enterprise tier to use go 1.26
and fix minor bugs.</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/step-security/harden-runner/compare/v2.19.1...v2.19.2">https://github.com/step-security/harden-runner/compare/v2.19.1...v2.19.2</a></p>
<h2>v2.19.1</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: detect ubuntu-slim runners early and bail out by <a
href="https://github.com/devantler"><code>@​devantler</code></a> in <a
href="https://redirect.github.com/step-security/harden-runner/pull/657">step-security/harden-runner#657</a></li>
</ul>
<p>What the fix changes</p>
<ul>
<li>Harden-Runner will detect <code>ubuntu-slim</code> runners and exit
cleanly with an informational log message, instead of post harden runner
step failing on chown: invalid user: 'undefined'.</li>
</ul>
<p>What the fix does not do</p>
<ul>
<li>Jobs running on <code>ubuntu-slim</code> will not be monitored by
Harden-Runner. The agent relies on kernel-level features (that require
elevated capabilities).</li>
<li>Per GitHub's docs on <a
href="https://docs.github.com/en/actions/reference/runners/github-hosted-runners#single-cpu-runners">single-CPU
runners</a>: &quot;The container for ubuntu-slim runners runs in
unprivileged mode. This means that some operations requiring elevated
privileges such as mounting file systems, using Docker-in-Docker, or
accessing low-level kernel features are not supported.&quot; Those
low-level kernel features are what the agent needs, so monitoring inside
the unprivileged container is not feasible today.</li>
</ul>
<p>For StepSecurity enterprise customers
If your security posture requires that workflows are always monitored,
you can block the use of <code>ubuntu-slim</code> via workflow run
policies see the <a
href="https://docs.stepsecurity.io/workflow-run-policies/policies#runner-label-policy">Runner
Label Policy</a> docs. This lets you enforce that jobs only run on
monitored runner types.</p>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/devantler"><code>@​devantler</code></a>
made their first contribution in <a
href="https://redirect.github.com/step-security/harden-runner/pull/657">step-security/harden-runner#657</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/step-security/harden-runner/compare/v2.19.0...v2.19.1">https://github.com/step-security/harden-runner/compare/v2.19.0...v2.19.1</a></p>
<h2>v2.19.0</h2>
<h2>What's Changed</h2>
<h3>New Runner Support</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/step-security/harden-runner/commit/bf7454d06d71f1098171f2acdf0cd4708d7b5920"><code>bf7454d</code></a>
Merge pull request <a
href="https://redirect.github.com/step-security/harden-runner/issues/673">#673</a>
from step-security/fix/aggregate-error-startup-hang</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/1188420976b49762617c32cc010cba50a9fd7a71"><code>1188420</code></a>
Update non-TLS agent to v0.16.2</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/162cfeac170141192dc6d57ade86ddf59448ad96"><code>162cfea</code></a>
Update non-TLS agent to v0.16.1</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/eb9e1f4943b602b6f338f6f79468e812c2c6b320"><code>eb9e1f4</code></a>
Bring macOS runner updates from PR 674</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/1a10b01783c147498a6dee4fa4e7122325762720"><code>1a10b01</code></a>
Update Windows agent to v1.0.7</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/8b4a105ef5119b20c97c1566b0275b9399ae188d"><code>8b4a105</code></a>
Apply npm audit fixes with release-age cooldown</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/3626e0327723bef1c4e6b01750518eccd380a5df"><code>3626e03</code></a>
Default TLS status check failures to enabled</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/100e08b39cfd419c292df7becc379b0305ac0628"><code>100e08b</code></a>
Update agent-ebpf to v1.8.12</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/774f75f2c6334606d2d3d910a663f93c9ea49b3b"><code>774f75f</code></a>
Update agent to v1.8.9</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/f312657a64c745fae39c2c66cc7c7f7bc4c804d8"><code>f312657</code></a>
Extend missing-agent-dir guard to Linux and macOS cleanup paths</li>
<li>Additional commits viewable in <a
href="https://github.com/step-security/harden-runner/compare/f808768d1510423e83855289c910610ca9b43176...bf7454d06d71f1098171f2acdf0cd4708d7b5920">compare
view</a></li>
</ul>
</details>
<br />

Updates `dorny/paths-filter` from 4.0.1 to 4.0.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/dorny/paths-filter/releases">dorny/paths-filter's
releases</a>.</em></p>
<blockquote>
<h2>v4.0.2</h2>
<h2>What's Changed</h2>
<ul>
<li>fix warning message by <a
href="https://github.com/cgundy"><code>@​cgundy</code></a> in <a
href="https://redirect.github.com/dorny/paths-filter/pull/282">dorny/paths-filter#282</a></li>
<li>chore: fix GitHub spelling in logs by <a
href="https://github.com/squat"><code>@​squat</code></a> in <a
href="https://redirect.github.com/dorny/paths-filter/pull/278">dorny/paths-filter#278</a></li>
<li>fix: use rev-parse instead of branch --show-current for older git
compat by <a
href="https://github.com/saschabratton"><code>@​saschabratton</code></a>
in <a
href="https://redirect.github.com/dorny/paths-filter/pull/303">dorny/paths-filter#303</a></li>
<li>fix: work around git dubious ownership errors in container jobs by
<a
href="https://github.com/saschabratton"><code>@​saschabratton</code></a>
in <a
href="https://redirect.github.com/dorny/paths-filter/pull/317">dorny/paths-filter#317</a></li>
<li>docs: update changelog for v4.0.2 by <a
href="https://github.com/saschabratton"><code>@​saschabratton</code></a>
in <a
href="https://redirect.github.com/dorny/paths-filter/pull/318">dorny/paths-filter#318</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/cgundy"><code>@​cgundy</code></a> made
their first contribution in <a
href="https://redirect.github.com/dorny/paths-filter/pull/282">dorny/paths-filter#282</a></li>
<li><a href="https://github.com/squat"><code>@​squat</code></a> made
their first contribution in <a
href="https://redirect.github.com/dorny/paths-filter/pull/278">dorny/paths-filter#278</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/dorny/paths-filter/compare/v4.0.1...v4.0.2">https://github.com/dorny/paths-filter/compare/v4.0.1...v4.0.2</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md">dorny/paths-filter's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>v4.0.2</h2>
<ul>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/317">Work
around git dubious ownership errors in container jobs</a></li>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/303">Use
rev-parse instead of branch --show-current for older git compat</a></li>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/282">Fix
warning message</a></li>
</ul>
<h2>v4.0.1</h2>
<ul>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/255">Support
merge queue</a></li>
</ul>
<h2>v4.0.0</h2>
<ul>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/294">Update
action runtime to node24</a></li>
</ul>
<h2>v3.0.3</h2>
<ul>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/279">Add
missing predicate-quantifier</a></li>
</ul>
<h2>v3.0.2</h2>
<ul>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/224">Add
config parameter for predicate quantifier</a></li>
</ul>
<h2>v3.0.1</h2>
<ul>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/133">Compare
base and ref when token is empty</a></li>
</ul>
<h2>v3.0.0</h2>
<ul>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/210">Update to
Node.js 20</a></li>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/215">Update
all dependencies</a></li>
</ul>
<h2>v2.11.1</h2>
<ul>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/167">Update
@​actions/core to v1.10.0 - Fixes warning about deprecated
set-output</a></li>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/168">Document
need for pull-requests: read permission</a></li>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/164">Updating
to actions/checkout@v3</a></li>
</ul>
<h2>v2.11.0</h2>
<ul>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/157">Set
list-files input parameter as not required</a></li>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/161">Update
Node.js</a></li>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/162">Fix
incorrect handling of Unicode characters in exec()</a></li>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/163">Use
Octokit pagination</a></li>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/160">Updates
real world links</a></li>
</ul>
<h2>v2.10.2</h2>
<ul>
<li><a href="https://redirect.github.com/dorny/paths-filter/pull/91">Fix
getLocalRef() returns wrong ref</a></li>
</ul>
<h2>v2.10.1</h2>
<ul>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/85">Improve
robustness of change detection</a></li>
</ul>
<h2>v2.10.0</h2>
<ul>
<li><a href="https://redirect.github.com/dorny/paths-filter/pull/82">Add
ref input parameter</a></li>
<li><a href="https://redirect.github.com/dorny/paths-filter/pull/83">Fix
change detection in PR when pullRequest.changed_files is
incorrect</a></li>
</ul>
<h2>v2.9.3</h2>
<ul>
<li><a href="https://redirect.github.com/dorny/paths-filter/pull/78">Fix
change detection when base is a tag</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/dorny/paths-filter/commit/7b450fff21473bca461d4b92ce414b9d0420d706"><code>7b450ff</code></a>
docs: update changelog for v4.0.2 (<a
href="https://redirect.github.com/dorny/paths-filter/issues/318">#318</a>)</li>
<li><a
href="https://github.com/dorny/paths-filter/commit/928037783a71f24983ea250c6e55290c1b2de54f"><code>9280377</code></a>
fix: work around git dubious ownership errors in container jobs (<a
href="https://redirect.github.com/dorny/paths-filter/issues/317">#317</a>)</li>
<li><a
href="https://github.com/dorny/paths-filter/commit/f3ceefdc7ef57bc2d8560787d4b6c33e44044cec"><code>f3ceefd</code></a>
fix: use rev-parse instead of branch --show-current for older git compat
(<a
href="https://redirect.github.com/dorny/paths-filter/issues/303">#303</a>)</li>
<li><a
href="https://github.com/dorny/paths-filter/commit/61f87a10cd2c304679af17bb73ef192addf33c1c"><code>61f87a1</code></a>
chore: fix GitHub spelling in logs (<a
href="https://redirect.github.com/dorny/paths-filter/issues/278">#278</a>)</li>
<li><a
href="https://github.com/dorny/paths-filter/commit/b82ff81ffbe6fb4b636bb5b47e37fd8d12b32632"><code>b82ff81</code></a>
fix warning message (<a
href="https://redirect.github.com/dorny/paths-filter/issues/282">#282</a>)</li>
<li>See full diff in <a
href="https://github.com/dorny/paths-filter/compare/fbd0ab8f3e69293af611ebaee6363fc25e6d187d...7b450fff21473bca461d4b92ce414b9d0420d706">compare
view</a></li>
</ul>
</details>
<br />

Updates `tj-actions/changed-files` from 47.0.5 to 47.0.6
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/tj-actions/changed-files/releases">tj-actions/changed-files's
releases</a>.</em></p>
<blockquote>
<h2>v47.0.6</h2>
<h2>What's Changed</h2>
<ul>
<li>Upgraded to v47.0.5 by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2816">tj-actions/changed-files#2816</a></li>
<li>Updated README.md by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2817">tj-actions/changed-files#2817</a></li>
<li>chore(deps): bump actions/setup-node from 6.2.0 to 6.3.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2818">tj-actions/changed-files#2818</a></li>
<li>chore(deps-dev): bump <code>@​types/node</code> from 25.3.3 to
25.3.5 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2820">tj-actions/changed-files#2820</a></li>
<li>chore(deps): bump github/codeql-action from 4.32.5 to 4.32.6 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2819">tj-actions/changed-files#2819</a></li>
<li>chore(deps-dev): bump <code>@​types/node</code> from 25.3.5 to
25.5.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2825">tj-actions/changed-files#2825</a></li>
<li>chore(deps): bump actions/download-artifact from 8.0.0 to 8.0.1 by
<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2824">tj-actions/changed-files#2824</a></li>
<li>chore(deps): bump github/codeql-action from 4.32.6 to 4.35.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2834">tj-actions/changed-files#2834</a></li>
<li>chore(deps-dev): bump eslint-plugin-jest from 29.15.0 to 29.15.1 by
<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2831">tj-actions/changed-files#2831</a></li>
<li>chore(deps): bump yaml from 2.8.2 to 2.8.3 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2830">tj-actions/changed-files#2830</a></li>
<li>chore(deps): bump nrwl/nx-set-shas from 4.4.0 to 5.0.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2829">tj-actions/changed-files#2829</a></li>
<li>chore(deps-dev): bump jest from 30.2.0 to 30.3.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2822">tj-actions/changed-files#2822</a></li>
<li>chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2849">tj-actions/changed-files#2849</a></li>
<li>chore(deps-dev): bump prettier from 3.8.1 to 3.8.3 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2848">tj-actions/changed-files#2848</a></li>
<li>chore(deps-dev): bump <code>@​types/node</code> from 25.5.0 to
25.6.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2846">tj-actions/changed-files#2846</a></li>
<li>chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2844">tj-actions/changed-files#2844</a></li>
<li>chore(deps): bump peter-evans/create-pull-request from 8.1.0 to
8.1.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2843">tj-actions/changed-files#2843</a></li>
<li>chore(deps): bump lodash from 4.17.23 to 4.18.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tj-actions/changed-files/pull/2837">tj-actions/changed-files#2837</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/tj-actions/changed-files/compare/v47.0.5...v47.0.6">https://github.com/tj-actions/changed-files/compare/v47.0.5...v47.0.6</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/tj-actions/changed-files/blob/main/HISTORY.md">tj-actions/changed-files's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h1><a
href="https://github.com/tj-actions/changed-files/compare/v47.0.5...v47.0.6">47.0.6</a>
- (2026-04-18)</h1>
<h2><!-- raw HTML omitted -->🔄 Update</h2>
<ul>
<li>Updated README.md (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2817">#2817</a>)</li>
</ul>
<p>Co-authored-by: github-actions[bot]
&lt;41898282+github-actions[bot]<a
href="https://github.com/users"><code>@​users</code></a>.noreply.github.com&gt;
Co-authored-by: Tonye Jack <a
href="mailto:jtonye@ymail.com">jtonye@ymail.com</a> (<a
href="https://github.com/tj-actions/changed-files/commit/c23d52ba6ff8c67273c61e097615eafe88cb8650">c23d52b</a>)
- (github-actions[bot])</p>
<h2><!-- raw HTML omitted -->⚙️ Miscellaneous Tasks</h2>
<ul>
<li><strong>deps:</strong> Bump lodash from 4.17.23 to 4.18.1 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2837">#2837</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/9426d40962ed5378910ee2e21d5f8c6fcbf2dd96">9426d40</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump peter-evans/create-pull-request from
8.1.0 to 8.1.1 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2843">#2843</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/32de080616d8c84d89622770d26b0857f4ce8b49">32de080</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump actions/upload-artifact from 7.0.0 to
7.0.1 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2844">#2844</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/2487d125c6ecf3457228762d50599297a8c80310">2487d12</a>)
- (dependabot[bot])</li>
<li><strong>deps-dev:</strong> Bump <code>@​types/node</code> from
25.5.0 to 25.6.0 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2846">#2846</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/cef85a3eab76d9db9f294de4915d6a31b1dcbfda">cef85a3</a>)
- (dependabot[bot])</li>
<li><strong>deps-dev:</strong> Bump prettier from 3.8.1 to 3.8.3 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2848">#2848</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/7b082dee30a6f42592f70940c0f0a26a72af452c">7b082de</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump github/codeql-action from 4.35.1 to
4.35.2 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2849">#2849</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/07224cab5986b4ce28c5080f4a804e5573422714">07224ca</a>)
- (dependabot[bot])</li>
<li><strong>deps-dev:</strong> Bump jest from 30.2.0 to 30.3.0 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2822">#2822</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/2bb135777322059ee3a3c9239999b159ff49febc">2bb1357</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump nrwl/nx-set-shas from 4.4.0 to 5.0.1 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2829">#2829</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/cc98117d3993777f3babaccc496514b4a65652a9">cc98117</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump yaml from 2.8.2 to 2.8.3 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2830">#2830</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/786e4213eac60d6e2b4492135b46644269fac3db">786e421</a>)
- (dependabot[bot])</li>
<li><strong>deps-dev:</strong> Bump eslint-plugin-jest from 29.15.0 to
29.15.1 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2831">#2831</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/726b41bbed783a50de97829de6d977cd665831f7">726b41b</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump github/codeql-action from 4.32.6 to
4.35.1 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2834">#2834</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/2c3585e584822ed39e27c6c471225dde37991778">2c3585e</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump actions/download-artifact from 8.0.0 to
8.0.1 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2824">#2824</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/3d37a7ff08a7ce64b4cab9669eac39b0709cdac9">3d37a7f</a>)
- (dependabot[bot])</li>
<li><strong>deps-dev:</strong> Bump <code>@​types/node</code> from
25.3.5 to 25.5.0 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2825">#2825</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/445b0eb32849cdd5b22a390bf0568af00ed4ca34">445b0eb</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump github/codeql-action from 4.32.5 to
4.32.6 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2819">#2819</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/4f892cd56345d721bac7139000c4b4a22c8f138f">4f892cd</a>)
- (dependabot[bot])</li>
<li><strong>deps-dev:</strong> Bump <code>@​types/node</code> from
25.3.3 to 25.3.5 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2820">#2820</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/611865116d9f223a0ca640071aec29292c81978f">6118651</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump actions/setup-node from 6.2.0 to 6.3.0
(<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2818">#2818</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/e517d7a5ca34a5d08bbe5c949e59381bd6d7cce2">e517d7a</a>)
- (dependabot[bot])</li>
</ul>
<h2><!-- raw HTML omitted -->⬆️ Upgrades</h2>
<ul>
<li>Upgraded to v47.0.5 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2816">#2816</a>)</li>
</ul>
<p>Co-authored-by: github-actions[bot]
&lt;41898282+github-actions[bot]<a
href="https://github.com/users"><code>@​users</code></a>.noreply.github.com&gt;
Co-authored-by: Tonye Jack <a
href="mailto:jtonye@ymail.com">jtonye@ymail.com</a> (<a
href="https://github.com/tj-actions/changed-files/commit/4750530ff4e020eafc769c56c2fa8376ca8ad8e9">4750530</a>)
- (github-actions[bot])</p>
<h1><a
href="https://github.com/tj-actions/changed-files/compare/v47.0.4...v47.0.5">47.0.5</a>
- (2026-03-03)</h1>
<h2><!-- raw HTML omitted -->🔄 Update</h2>
<ul>
<li>Updated README.md (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2805">#2805</a>)</li>
</ul>
<p>Co-authored-by: github-actions[bot]
&lt;41898282+github-actions[bot]<a
href="https://github.com/users"><code>@​users</code></a>.noreply.github.com&gt;
(<a
href="https://github.com/tj-actions/changed-files/commit/35dace0375d89e25e78db5f0a44127b61f4e5c20">35dace0</a>)
- (github-actions[bot])</p>
<ul>
<li>Updated README.md (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2803">#2803</a>)</li>
</ul>
<p>Co-authored-by: github-actions[bot]
&lt;41898282+github-actions[bot]<a
href="https://github.com/users"><code>@​users</code></a>.noreply.github.com&gt;
Co-authored-by: Tonye Jack <a
href="mailto:jtonye@ymail.com">jtonye@ymail.com</a> (<a
href="https://github.com/tj-actions/changed-files/commit/9ee99eb5bda5d6a67fedcd50ecd24fb10add2f41">9ee99eb</a>)
- (github-actions[bot])</p>
<h2><!-- raw HTML omitted -->⚙️ Miscellaneous Tasks</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/tj-actions/changed-files/commit/9426d40962ed5378910ee2e21d5f8c6fcbf2dd96"><code>9426d40</code></a>
chore(deps): bump lodash from 4.17.23 to 4.18.1 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2837">#2837</a>)</li>
<li><a
href="https://github.com/tj-actions/changed-files/commit/32de080616d8c84d89622770d26b0857f4ce8b49"><code>32de080</code></a>
chore(deps): bump peter-evans/create-pull-request from 8.1.0 to 8.1.1
(<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2843">#2843</a>)</li>
<li><a
href="https://github.com/tj-actions/changed-files/commit/2487d125c6ecf3457228762d50599297a8c80310"><code>2487d12</code></a>
chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2844">#2844</a>)</li>
<li><a
href="https://github.com/tj-actions/changed-files/commit/cef85a3eab76d9db9f294de4915d6a31b1dcbfda"><code>cef85a3</code></a>
chore(deps-dev): bump <code>@​types/node</code> from 25.5.0 to 25.6.0
(<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2846">#2846</a>)</li>
<li><a
href="https://github.com/tj-actions/changed-files/commit/7b082dee30a6f42592f70940c0f0a26a72af452c"><code>7b082de</code></a>
chore(deps-dev): bump prettier from 3.8.1 to 3.8.3 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2848">#2848</a>)</li>
<li><a
href="https://github.com/tj-actions/changed-files/commit/07224cab5986b4ce28c5080f4a804e5573422714"><code>07224ca</code></a>
chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2849">#2849</a>)</li>
<li><a
href="https://github.com/tj-actions/changed-files/commit/2bb135777322059ee3a3c9239999b159ff49febc"><code>2bb1357</code></a>
chore(deps-dev): bump jest from 30.2.0 to 30.3.0 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2822">#2822</a>)</li>
<li><a
href="https://github.com/tj-actions/changed-files/commit/cc98117d3993777f3babaccc496514b4a65652a9"><code>cc98117</code></a>
chore(deps): bump nrwl/nx-set-shas from 4.4.0 to 5.0.1 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2829">#2829</a>)</li>
<li><a
href="https://github.com/tj-actions/changed-files/commit/786e4213eac60d6e2b4492135b46644269fac3db"><code>786e421</code></a>
chore(deps): bump yaml from 2.8.2 to 2.8.3 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2830">#2830</a>)</li>
<li><a
href="https://github.com/tj-actions/changed-files/commit/726b41bbed783a50de97829de6d977cd665831f7"><code>726b41b</code></a>
chore(deps-dev): bump eslint-plugin-jest from 29.15.0 to 29.15.1 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2831">#2831</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/tj-actions/changed-files/compare/22103cc46bda19c2b464ffe86db46df6922fd323...9426d40962ed5378910ee2e21d5f8c6fcbf2dd96">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/cache/restore` from 5.0.5 to 6.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/cache/releases">actions/cache/restore's
releases</a>.</em></p>
<blockquote>
<h2>v6.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump <code>@​actions/cache</code> to v6.1.0 - handle read-only cache
access by <a
href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1768">actions/cache#1768</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v6...v6.1.0">https://github.com/actions/cache/compare/v6...v6.1.0</a></p>
<h2>v6.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update packages, migrate to ESM by <a
href="https://github.com/Samirat"><code>@​Samirat</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1760">actions/cache#1760</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v6.0.0">https://github.com/actions/cache/compare/v5...v6.0.0</a></p>
<h2>v5.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump <code>@​actions/cache</code> to v5.1.0 - handle read-only cache
access by <a
href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1775">actions/cache#1775</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v5.1.0">https://github.com/actions/cache/compare/v5...v5.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/cache/blob/main/RELEASES.md">actions/cache/restore's
changelog</a>.</em></p>
<blockquote>
<h1>Releases</h1>
<h2>How to prepare a release</h2>
<blockquote>
<p>[!NOTE]
Relevant for maintainers with write access only.</p>
</blockquote>
<ol>
<li>Switch to a new branch from <code>main</code>.</li>
<li>Run <code>npm test</code> to ensure all tests are passing.</li>
<li>Update the version in <a
href="https://github.com/actions/cache/blob/main/package.json"><code>https://github.com/actions/cache/blob/main/package.json</code></a>.</li>
<li>Run <code>npm run build</code> to update the compiled files.</li>
<li>Update this <a
href="https://github.com/actions/cache/blob/main/RELEASES.md"><code>https://github.com/actions/cache/blob/main/RELEASES.md</code></a>
with the new version and changes in the <code>## Changelog</code>
section.</li>
<li>Run <code>licensed cache</code> to update the license report.</li>
<li>Run <code>licensed status</code> and resolve any warnings by
updating the <a
href="https://github.com/actions/cache/blob/main/.licensed.yml"><code>https://github.com/actions/cache/blob/main/.licensed.yml</code></a>
file with the exceptions.</li>
<li>Commit your changes and push your branch upstream.</li>
<li>Open a pull request against <code>main</code> and get it reviewed
and merged.</li>
<li>Draft a new release <a
href="https://github.com/actions/cache/releases">https://github.com/actions/cache/releases</a>
use the same version number used in <code>package.json</code>
<ol>
<li>Create a new tag with the version number.</li>
<li>Auto generate release notes and update them to match the changes you
made in <code>RELEASES.md</code>.</li>
<li>Toggle the set as the latest release option.</li>
<li>Publish the release.</li>
</ol>
</li>
<li>Navigate to <a
href="https://github.com/actions/cache/actions/workflows/release-new-action-version.yml">https://github.com/actions/cache/actions/workflows/release-new-action-version.yml</a>
<ol>
<li>There should be a workflow run queued with the same version
number.</li>
<li>Approve the run to publish the new version and update the major tags
for this action.</li>
</ol>
</li>
</ol>
<h2>Changelog</h2>
<h3>6.1.0</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v6.1.0 to pick up <a
href="https://redirect.github.com/actions/toolkit/pull/2435">actions/toolkit#2435
Handle cache write error due to read-only token</a></li>
<li>Switch redundant &quot;Cache save failed&quot; warning to debug log
in save-only</li>
</ul>
<h3>6.0.0</h3>
<ul>
<li>Updated <code>@actions/cache</code> to ^6.0.1,
<code>@actions/core</code> to ^3.0.1, <code>@actions/exec</code> to
^3.0.0, <code>@actions/io</code> to ^3.0.2</li>
<li>Migrated to ESM module system</li>
<li>Upgraded Jest to v30 and test infrastructure to be ESM
compatible</li>
</ul>
<h3>5.0.4</h3>
<ul>
<li>Bump <code>minimatch</code> to v3.1.5 (fixes ReDoS via globstar
patterns)</li>
<li>Bump <code>undici</code> to v6.24.1 (WebSocket decompression bomb
protection, header validation fixes)</li>
<li>Bump <code>fast-xml-parser</code> to v5.5.6</li>
</ul>
<h3>5.0.3</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a
href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li>
<li>Bump <code>@actions/core</code> to v2.0.3</li>
</ul>
<h3>5.0.2</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/cache/commit/55cc8345863c7cc4c66a329aec7e433d2d1c52a9"><code>55cc834</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/cache/issues/1768">#1768</a>
from jasongin/readonly-cache</li>
<li><a
href="https://github.com/actions/cache/commit/d8cd72f230726cdf4457ebb61ec1b593a8d12337"><code>d8cd72f</code></a>
Bump <code>@​actions/cache</code> to v6.1.0 - handle cache write error
due to RO token</li>
<li><a
href="https://github.com/actions/cache/commit/2c8a9bd7457de244a408f35966fab2fb45fda9c8"><code>2c8a9bd</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/cache/issues/1760">#1760</a>
from actions/samirat/esm_migration_and_package_update</li>
<li><a
href="https://github.com/actions/cache/commit/e9b91fdc3fea7d79165fceb79042ef45c2d51023"><code>e9b91fd</code></a>
Prettier fixes</li>
<li><a
href="https://github.com/actions/cache/commit/e4884b8ff7f92ef6b52c79eda480bbc86e685adb"><code>e4884b8</code></a>
Rebuild dist</li>
<li><a
href="https://github.com/actions/cache/commit/10baf0191a3c426ea0fa4a3253a5c04233b6e18f"><code>10baf01</code></a>
Fixed licenses</li>
<li><a
href="https://github.com/actions/cache/commit/e39b386c9004d72a15d864ade8c0b3a702d47a37"><code>e39b386</code></a>
Fix test mock return order</li>
<li><a
href="https://github.com/actions/cache/commit/b6928203372a8571ff984c0c883ef3a1adfb0c06"><code>b692820</code></a>
PR feedback</li>
<li><a
href="https://github.com/actions/cache/commit/60749128a44d25d3c520a489e576380cf00ff3f1"><code>6074912</code></a>
Rebuild dist bundles as ESM to match type:module</li>
<li><a
href="https://github.com/actions/cache/commit/5a912e8b4af820fa082a0e75cfd2c782f8fbfe0e"><code>5a912e8</code></a>
Fix lint and jest issues</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/cache/save` from 5.0.5 to 6.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/cache/releases">actions/cache/save's
releases</a>.</em></p>
<blockquote>
<h2>v6.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump <code>@​actions/cache</code> to v6.1.0 - handle read-only cache
access by <a
href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1768">actions/cache#1768</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v6...v6.1.0">https://github.com/actions/cache/compare/v6...v6.1.0</a></p>
<h2>v6.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update packages, migrate to ESM by <a
href="https://github.com/Samirat"><code>@​Samirat</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1760">actions/cache#1760</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v6.0.0">https://github.com/actions/cache/compare/v5...v6.0.0</a></p>
<h2>v5.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump <code>@​actions/cache</code> to v5.1.0 - handle read-only cache
access by <a
href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1775">actions/cache#1775</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v5.1.0">https://github.com/actions/cache/compare/v5...v5.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/cache/blob/main/RELEASES.md">actions/cache/save's
changelog</a>.</em></p>
<blockquote>
<h1>Releases</h1>
<h2>How to prepare a release</h2>
<blockquote>
<p>[!NOTE]
Relevant for maintainers with write access only.</p>
</blockquote>
<ol>
<li>Switch to a new branch from <code>main</code>.</li>
<li>Run <code>npm test</code> to ensure all tests are passing.</li>
<li>Update the version in <a
href="https://github.com/actions/cache/blob/main/package.json"><code>https://github.com/actions/cache/blob/main/package.json</code></a>.</li>
<li>Run <code>npm run build</code> to update the compiled files.</li>
<li>Update this <a
href="https://github.com/actions/cache/blob/main/RELEASES.md"><code>https://github.com/actions/cache/blob/main/RELEASES.md</code></a>
with the new version and changes in the <code>## Changelog</code>
section.</li>
<li>Run <code>licensed cache</code> to update the license report.</li>
<li>Run <code>licensed status</code> and resolve any warnings by
updating the <a
href="https://github.com/actions/cache/blob/main/.licensed.yml"><code>https://github.com/actions/cache/blob/main/.licensed.yml</code></a>
file with the exceptions.</li>
<li>Commit your changes and push your branch upstream.</li>
<li>Open a pull request against <code>main</code> and get it reviewed
and merged.</li>
<li>Draft a new release <a
href="https://github.com/actions/cache/releases">https://github.com/actions/cache/releases</a>
use the same version number used in <code>package.json</code>
<ol>
<li>Create a new tag with the version number.</li>
<li>Auto generate release notes and update them to match the changes you
made in <code>RELEASES.md</code>.</li>
<li>Toggle the set as the latest release option.</li>
<li>Publish the release.</li>
</ol>
</li>
<li>Navigate to <a
href="https://github.com/actions/cache/actions/workflows/release-new-action-version.yml">https://github.com/actions/cache/actions/workflows/release-new-action-version.yml</a>
<ol>
<li>There should be a workflow run queued with the same version
number.</li>
<li>Approve the run to publish the new version and update the major tags
for this action.</li>
</ol>
</li>
</ol>
<h2>Changelog</h2>
<h3>6.1.0</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v6.1.0 to pick up <a
href="https://redirect.github.com/actions/toolkit/pull/2435">actions/toolkit#2435
Handle cache write error due to read-only token</a></li>
<li>Switch redundant &quot;Cache save failed&quot; warning to debug log
in save-only</li>
</ul>
<h3>6.0.0</h3>
<ul>
<li>Updated <code>@actions/cache</code> to ^6.0.1,
<code>@actions/core</code> to ^3.0.1, <code>@actions/exec</code> to
^3.0.0, <code>@actions/io</code> to ^3.0.2</li>
<li>Migrated to ESM module system</li>
<li>Upgraded Jest to v30 and test infrastructure to be ESM
compatible</li>
</ul>
<h3>5.0.4</h3>
<ul>
<li>Bump <code>minimatch</code> to v3.1.5 (fixes ReDoS via globstar
patterns)</li>
<li>Bump <code>undici</code> to v6.24.1 (WebSocket decompression bomb
protection, header validation fixes)</li>
<li>Bump <code>fast-xml-parser</code> to v5.5.6</li>
</ul>
<h3>5.0.3</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a
href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li>
<li>Bump <code>@actions/core</code> to v2.0.3</li>
</ul>
<h3>5.0.2</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/cache/commit/55cc8345863c7cc4c66a329aec7e433d2d1c52a9"><code>55cc834</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/cache/issues/1768">#1768</a>
from jasongin/readonly-cache</li>
<li><a
href="https://github.com/actions/cache/commit/d8cd72f230726cdf4457ebb61ec1b593a8d12337"><code>d8cd72f</code></a>
Bump <code>@​actions/cache</code> to v6.1.0 - handle cache write error
due to RO token</li>
<li><a
href="https://github.com/actions/cache/commit/2c8a9bd7457de244a408f35966fab2fb45fda9c8"><code>2c8a9bd</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/cache/issues/1760">#1760</a>
from actions/samirat/esm_migration_and_package_update</li>
<li><a
href="https://github.com/actions/cache/commit/e9b91fdc3fea7d79165fceb79042ef45c2d51023"><code>e9b91fd</code></a>
Prettier fixes</li>
<li><a
href="https://github.com/actions/cache/commit/e4884b8ff7f92ef6b52c79eda480bbc86e685adb"><code>e4884b8</code></a>
Rebuild dist</li>
<li><a
href="https://github.com/actions/cache/commit/10baf0191a3c426ea0fa4a3253a5c04233b6e18f"><code>10baf01</code></a>
Fixed licenses</li>
<li><a
href="https://github.com/actions/cache/commit/e39b386c9004d72a15d864ade8c0b3a702d47a37"><code>e39b386</code></a>
Fix test mock return order</li>
<li><a
href="https://github.com/actions/cache/commit/b6928203372a8571ff984c0c883ef3a1adfb0c06"><code>b692820</code></a>
PR feedback</li>
<li><a
href="https://github.com/actions/cache/commit/60749128a44d25d3c520a489e576380cf00ff3f1"><code>6074912</code></a>
Rebuild dist bundles as ESM to match type:module</li>
<li><a
href="https://github.com/actions/cache/commit/5a912e8b4af820fa082a0e75cfd2c782f8fbfe0e"><code>5a912e8</code></a>
Fix lint and jest issues</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9">compare
view</a></li>
</ul>
</details>
<br />

Updates `docker/login-action` from 4.1.0 to 4.4.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/docker/login-action/releases">docker/login-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.4.0</h2>
<ul>
<li>Skip empty <code>registry-auth</code> secret mask by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/1035">docker/login-action#1035</a></li>
<li>Bump <code>@​aws-sdk/client-ecr</code> and
<code>@​aws-sdk/client-ecr-public</code> to 3.1077.0 <a
href="https://redirect.github.com/docker/login-action/pull/1034">docker/login-action#1034</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/login-action/compare/v4.3.0...v4.4.0">https://github.com/docker/login-action/compare/v4.3.0...v4.4.0</a></p>
<h2>v4.3.0</h2>
<ul>
<li>Preserve names in esbuild bundle by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/1022">docker/login-action#1022</a></li>
<li>Bump <code>@​aws-sdk/client-ecr</code> and
<code>@​aws-sdk/client-ecr-public</code> to 3.1076.0 <a
href="https://redirect.github.com/docker/login-action/pull/999">docker/login-action#999</a>
<a
href="https://redirect.github.com/docker/login-action/pull/1030">docker/login-action#1030</a></li>
<li>Bump <code>@​docker/actions-toolkit</code> from 0.90.0 to 0.92.0 in
<a
href="https://redirect.github.com/docker/login-action/pull/1004">docker/login-action#1004</a>
<a
href="https://redirect.github.com/docker/login-action/pull/1027">docker/login-action#1027</a></li>
<li>Bump <code>@​sigstore/core</code> from 3.1.0 to 3.2.1 in <a
href="https://redirect.github.com/docker/login-action/pull/1023">docker/login-action#1023</a></li>
<li>Bump <code>@​sigstore/verify</code> from 3.1.0 to 3.1.1 in <a
href="https://redirect.github.com/docker/login-action/pull/1029">docker/login-action#1029</a></li>
<li>Bump http-proxy-agent and https-proxy-agent to 9.1.0 in <a
href="https://redirect.github.com/docker/login-action/pull/1017">docker/login-action#1017</a></li>
<li>Bump js-yaml from 4.1.1 to 5.2.0 in <a
href="https://redirect.github.com/docker/login-action/pull/1028">docker/login-action#1028</a></li>
<li>Bump sigstore from 4.1.0 to 4.1.1 in <a
href="https://redirect.github.com/docker/login-action/pull/1031">docker/login-action#1031</a></li>
<li>Bump tmp from 0.2.5 to 0.2.7 in <a
href="https://redirect.github.com/docker/login-action/pull/1002">docker/login-action#1002</a></li>
<li>Bump undici from 6.24.1 to 6.27.0 in <a
href="https://redirect.github.com/docker/login-action/pull/1020">docker/login-action#1020</a></li>
<li>Bump vite from 7.3.3 to 7.3.6 in <a
href="https://redirect.github.com/docker/login-action/pull/1019">docker/login-action#1019</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/login-action/compare/v4.2.0...v4.3.0">https://github.com/docker/login-action/compare/v4.2.0...v4.3.0</a></p>
<h2>v4.2.0</h2>
<ul>
<li>Bump <code>@​actions/core</code> from 3.0.0 to 3.0.1 in <a
href="https://redirect.github.com/docker/login-action/pull/976">docker/login-action#976</a></li>
<li>Bump <code>@​aws-sdk/client-ecr</code> and
<code>@​aws-sdk/client-ecr-public</code> to 3.1050.0 in <a
href="https://redirect.github.com/docker/login-action/pull/960">docker/login-action#960</a></li>
<li>Bump <code>@​docker/actions-toolkit</code> from 0.86.0 to 0.90.0 in
<a
href="https://redirect.github.com/docker/login-action/pull/970">docker/login-action#970</a></li>
<li>Bump brace-expansion from 2.0.1 to 5.0.6 in <a
href="https://redirect.github.com/docker/login-action/pull/993">docker/login-action#993</a></li>
<li>Bump fast-xml-builder from 1.1.4 to 1.2.0 in <a
href="https://redirect.github.com/docker/login-action/pull/985">docker/login-action#985</a></li>
<li>Bump fast-xml-parser from 5.3.6 to 5.8.0 in <a
href="https://redirect.github.com/docker/login-action/pull/963">docker/login-action#963</a></li>
<li>Bump http-proxy-agent and https-proxy-agent to 9.0.0 in <a
href="https://redirect.github.com/docker/login-action/pull/961">docker/login-action#961</a></li>
<li>Bump postcss from 8.5.6 to 8.5.10 in <a
href="https://redirect.github.com/docker/login-action/pull/979">docker/login-action#979</a></li>
<li>Bump tar from 6.2.1 to 7.5.15 in <a
href="https://redirect.github.com/docker/login-action/pull/991">docker/login-action#991</a></li>
<li>Bump vite from 7.3.1 to 7.3.3 in <a
href="https://redirect.github.com/docker/login-action/pull/986">docker/login-action#986</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/login-action/compare/v4.1.0...v4.2.0">https://github.com/docker/login-action/compare/v4.1.0...v4.2.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/docker/login-action/commit/af1e73f918a031802d376d3c8bbc3fe56130a9b0"><code>af1e73f</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1034">#1034</a>
from docker/dependabot/npm_and_yarn/aws-sdk-dependen...</li>
<li><a
href="https://github.com/docker/login-action/commit/da722bde43bacb027adfc67d42dbaa4c0f9e550b"><code>da722bd</code></a>
[dependabot skip] chore: update generated content</li>
<li><a
href="https://github.com/docker/login-action/commit/2916ad60bd5cb72f07aa54c69fdcc61749c09b7a"><code>2916ad6</code></a>
build(deps): bump the aws-sdk-dependencies group across 1 directory with
2 up...</li>
<li><a
href="https://github.com/docker/login-action/commit/ca0a662f786e4cfddce972005bd68f3dafc3a903"><code>ca0a662</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1035">#1035</a>
from crazy-max/fix-registry-auth-empty-mask</li>
<li><a
href="https://github.com/docker/login-action/commit/c455755a579833bf0d2e4e54e3beb413ef10cc80"><code>c455755</code></a>
chore: update generated content</li>
<li><a
href="https://github.com/docker/login-action/commit/48351901f89581a7c12870c787d3f06d1f498438"><code>4835190</code></a>
skip empty registry-auth secret mask</li>
<li><a
href="https://github.com/docker/login-action/commit/992421c6e6806a7f6df609d1bfff374f9eca3004"><code>992421c</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1033">#1033</a>
from docker/dependabot/github_actions/docker/bake-ac...</li>
<li><a href="https://github.com/docker/...

_Description has been truncated_

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-14 11:31:45 +00:00
dependabot[bot] 295bce2611 chore: bump github.com/hashicorp/terraform-json from 0.27.2 to 0.28.0 (#27227) 
Bumps
[github.com/hashicorp/terraform-json](https://github.com/hashicorp/terraform-json)
from 0.27.2 to 0.28.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/hashicorp/terraform-json/releases">github.com/hashicorp/terraform-json's
releases</a>.</em></p>
<blockquote>
<h2>v0.28.0</h2>
<p>ENHANCEMENTS:</p>
<ul>
<li><code>plan</code>: Added &quot;action_reason&quot; data to resource
changes described in a plan by <a
href="https://github.com/renescheepers"><code>@​renescheepers</code></a>
in <a
href="https://redirect.github.com/hashicorp/terraform-json/pull/200">hashicorp/terraform-json#200</a></li>
<li><code>provider schema</code>: Added ability to parse state store
schemas from a provider's schema by <a
href="https://github.com/SarahFrench"><code>@​SarahFrench</code></a> in
<a
href="https://redirect.github.com/hashicorp/terraform-json/pull/190">hashicorp/terraform-json#190</a>
<ul>
<li>This is related to an experimental feature that's still in
development in Terraform core.</li>
</ul>
</li>
<li><code>validate</code>: Added <code>Diagnostic.Address</code> data to
diagnostics returned when validating configuration by <a
href="https://github.com/bbasata"><code>@​bbasata</code></a> in <a
href="https://redirect.github.com/hashicorp/terraform-json/pull/204">hashicorp/terraform-json#204</a></li>
</ul>
<p>INTERNAL:</p>
<ul>
<li>test: Add tests for parsing logs from init commands, tests for
parsing of RFC3339 timestamps with different levels of precision by <a
href="https://github.com/SarahFrench"><code>@​SarahFrench</code></a> in
<a
href="https://redirect.github.com/hashicorp/terraform-json/pull/180">hashicorp/terraform-json#180</a></li>
<li>build(deps): bump actions/checkout from 5.0.0 to 6.0.0 in the
github-actions-breaking group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/hashicorp/terraform-json/pull/182">hashicorp/terraform-json#182</a></li>
<li>build(deps): bump actions/setup-go from 6.0.0 to 6.1.0 in the
github-actions-backward-compatible group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/hashicorp/terraform-json/pull/183">hashicorp/terraform-json#183</a></li>
<li>build(deps): bump github.com/hashicorp/go-version from 1.7.0 to
1.8.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/hashicorp/terraform-json/pull/184">hashicorp/terraform-json#184</a></li>
<li>build(deps): bump actions/checkout from 6.0.0 to 6.0.1 in the
github-actions-backward-compatible group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/hashicorp/terraform-json/pull/186">hashicorp/terraform-json#186</a></li>
<li>build(deps): bump the github-actions-backward-compatible group
across 1 directory with 2 updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/hashicorp/terraform-json/pull/189">hashicorp/terraform-json#189</a></li>
<li>Update copyright headers to IBM by <a
href="https://github.com/radeksimko"><code>@​radeksimko</code></a> in <a
href="https://redirect.github.com/hashicorp/terraform-json/pull/192">hashicorp/terraform-json#192</a></li>
<li>build(deps): bump actions/setup-go from 6.2.0 to 6.3.0 in the
github-actions-backward-compatible group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/hashicorp/terraform-json/pull/194">hashicorp/terraform-json#194</a></li>
<li>build(deps): bump actions/setup-go from 6.3.0 to 6.4.0 in the
github-actions-backward-compatible group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/hashicorp/terraform-json/pull/195">hashicorp/terraform-json#195</a></li>
<li>build(deps): bump github.com/hashicorp/go-version from 1.8.0 to
1.9.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/hashicorp/terraform-json/pull/196">hashicorp/terraform-json#196</a></li>
<li>build(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the
github-actions-backward-compatible group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/hashicorp/terraform-json/pull/199">hashicorp/terraform-json#199</a></li>
<li>build(deps): bump actions/checkout from 6.0.3 to 7.0.0 in the
github-actions-breaking group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/hashicorp/terraform-json/pull/201">hashicorp/terraform-json#201</a></li>
<li>build(deps): bump actions/setup-go from 6.4.0 to 6.5.0 in the
github-actions-backward-compatible group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/hashicorp/terraform-json/pull/202">hashicorp/terraform-json#202</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/helenjw"><code>@​helenjw</code></a> made
their first contribution in <a
href="https://redirect.github.com/hashicorp/terraform-json/pull/179">hashicorp/terraform-json#179</a></li>
<li><a
href="https://github.com/renescheepers"><code>@​renescheepers</code></a>
made their first contribution in <a
href="https://redirect.github.com/hashicorp/terraform-json/pull/200">hashicorp/terraform-json#200</a></li>
<li><a href="https://github.com/bbasata"><code>@​bbasata</code></a> made
their first contribution in <a
href="https://redirect.github.com/hashicorp/terraform-json/pull/204">hashicorp/terraform-json#204</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/hashicorp/terraform-json/compare/v0.27.2...v0.28.0">https://github.com/hashicorp/terraform-json/compare/v0.27.2...v0.28.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/hashicorp/terraform-json/commit/1e0dcb8caaf6c22e21bc6c042cb85b5467b670cf"><code>1e0dcb8</code></a>
validate: add <code>Diagnostic.Address</code> (<a
href="https://redirect.github.com/hashicorp/terraform-json/issues/204">#204</a>)</li>
<li><a
href="https://github.com/hashicorp/terraform-json/commit/34ea8d07cdb50ef7f326f3b448c847d83aa6543d"><code>34ea8d0</code></a>
build(deps): bump actions/setup-go from 6.4.0 to 6.5.0 in the
github-actions-...</li>
<li><a
href="https://github.com/hashicorp/terraform-json/commit/ff68feb930e6e451efa6a0d3a12814c6e6914b90"><code>ff68feb</code></a>
Merge pull request <a
href="https://redirect.github.com/hashicorp/terraform-json/issues/201">#201</a>
from hashicorp/dependabot/github_actions/github-actio...</li>
<li><a
href="https://github.com/hashicorp/terraform-json/commit/f3efae01e492b24275fb33ca93c6130ee479c48f"><code>f3efae0</code></a>
build(deps): bump actions/checkout in the github-actions-breaking
group</li>
<li><a
href="https://github.com/hashicorp/terraform-json/commit/09661535096ac52ee85bc4d4968c0a629f1c60e8"><code>0966153</code></a>
Merge pull request <a
href="https://redirect.github.com/hashicorp/terraform-json/issues/200">#200</a>
from renescheepers/rs/add-action-reason</li>
<li><a
href="https://github.com/hashicorp/terraform-json/commit/b4487cdd6112b7d1d0a4e270ec0f953ac9718d57"><code>b4487cd</code></a>
Link ActionReason constants to Terraform's canonical enum</li>
<li><a
href="https://github.com/hashicorp/terraform-json/commit/eefb8b2ce8d8e1de832e1033408b3ccb122f73b5"><code>eefb8b2</code></a>
Add ActionReason to ResourceChange</li>
<li><a
href="https://github.com/hashicorp/terraform-json/commit/5738e0ad057af2f241a1d79cbaeb9e52c451bfb3"><code>5738e0a</code></a>
build(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the
github-actions-...</li>
<li><a
href="https://github.com/hashicorp/terraform-json/commit/e77c39ee5a16d93861c6e3e99fd2aea148399e6d"><code>e77c39e</code></a>
Merge pull request <a
href="https://redirect.github.com/hashicorp/terraform-json/issues/196">#196</a>
from hashicorp/dependabot/go_modules/github.com/hashi...</li>
<li><a
href="https://github.com/hashicorp/terraform-json/commit/703bd74a48e5461b40eeb5b5663f7f58be3fad52"><code>703bd74</code></a>
build(deps): bump github.com/hashicorp/go-version from 1.8.0 to
1.9.0</li>
<li>Additional commits viewable in <a
href="https://github.com/hashicorp/terraform-json/compare/v0.27.2...v0.28.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/hashicorp/terraform-json&package-manager=go_modules&previous-version=0.27.2&new-version=0.28.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-14 11:20:24 +00:00
dependabot[bot] 20435f9f43 chore: bump the x group with 8 updates (#27223) 
Bumps the x group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.53.0` |
`0.54.0` |
| [golang.org/x/mod](https://github.com/golang/mod) | `0.37.0` |
`0.38.0` |
| [golang.org/x/net](https://github.com/golang/net) | `0.56.0` |
`0.57.0` |
| [golang.org/x/sync](https://github.com/golang/sync) | `0.21.0` |
`0.22.0` |
| [golang.org/x/sys](https://github.com/golang/sys) | `0.46.0` |
`0.47.0` |
| [golang.org/x/term](https://github.com/golang/term) | `0.44.0` |
`0.45.0` |
| [golang.org/x/text](https://github.com/golang/text) | `0.39.0` |
`0.40.0` |
| [golang.org/x/tools](https://github.com/golang/tools) | `0.47.0` |
`0.48.0` |

Updates `golang.org/x/crypto` from 0.53.0 to 0.54.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/crypto/commit/cdce021fa6c7d9c7eb2743bfbe551f0a98fd5d62"><code>cdce021</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="https://github.com/golang/crypto/commit/d9474cc4853d9ef1a29356975408d4771e5770c6"><code>d9474cc</code></a>
openpgp: make the deprecation message more explicit</li>
<li><a
href="https://github.com/golang/crypto/commit/7626c5025624025bb44739a805f431cf93c06d6e"><code>7626c50</code></a>
ssh: verify declared key type matches decoded key in
authorized_keys</li>
<li><a
href="https://github.com/golang/crypto/commit/0471e7969e6740594dfe354646bf03e5e89de52d"><code>0471e79</code></a>
ssh/agent: enforce strict limits on DSA key parameters</li>
<li><a
href="https://github.com/golang/crypto/commit/6435c37ab681759aff37ba751d0f2238b3043767"><code>6435c37</code></a>
ssh: sanitize client disconnect messages</li>
<li><a
href="https://github.com/golang/crypto/commit/7d695da948bfa44ed6eedcebc8f43bcb50e94a57"><code>7d695da</code></a>
ssh/agent: drain channel stderr in agent forwarders</li>
<li><a
href="https://github.com/golang/crypto/commit/5b7f84159940519e89df4d95465538c1797cee8b"><code>5b7f841</code></a>
acme/autocert: fix data race in Manager.createCert</li>
<li><a
href="https://github.com/golang/crypto/commit/0b316e7ee409f8e5789a0535679d34155cecc75e"><code>0b316e7</code></a>
argon2: update RFC 9106 parameter recommendations</li>
<li><a
href="https://github.com/golang/crypto/commit/55aec0a86b4c522b4f7366e69db55349e9f7ff5c"><code>55aec0a</code></a>
x509roots/fallback: update bundle</li>
<li><a
href="https://github.com/golang/crypto/commit/5f2de1a9f1e29059fbb9f3d34321bd0da935556b"><code>5f2de1a</code></a>
internal: remove wycheproof tests</li>
<li>See full diff in <a
href="https://github.com/golang/crypto/compare/v0.53.0...v0.54.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `golang.org/x/mod` from 0.37.0 to 0.38.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/mod/commit/792ac169a90372d88fb14e712cb793061ba0c104"><code>792ac16</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="https://github.com/golang/mod/commit/fe2ec04f7c3c3aa6fad97631aafcff6e49e2d1db"><code>fe2ec04</code></a>
all: fix some comments to improve readability</li>
<li>See full diff in <a
href="https://github.com/golang/mod/compare/v0.37.0...v0.38.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `golang.org/x/net` from 0.56.0 to 0.57.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/net/commit/b8f09f6f062ceb4531b7af4bd17a5c8fe9c4b2b5"><code>b8f09f6</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="https://github.com/golang/net/commit/f05f21be5927155a88b371674c298ada54b71cf5"><code>f05f21b</code></a>
idna: reject all-ASCII xn-- labels on all Go versions</li>
<li><a
href="https://github.com/golang/net/commit/0f748cfbba95084c87723e3b7eb7dad9241fc2dd"><code>0f748cf</code></a>
internal/http3: clean up stream I/O methods usages in tests</li>
<li><a
href="https://github.com/golang/net/commit/0bb961e45132c680e2a0117e1df951538a19da61"><code>0bb961e</code></a>
internal/http3: add net/http.ResponseController support</li>
<li><a
href="https://github.com/golang/net/commit/0ca694d2a5adcce7f36d4d65e5f8d72390d94051"><code>0ca694d</code></a>
webdav: document Dir's lack of defense against filesystem
modification</li>
<li><a
href="https://github.com/golang/net/commit/bd5f1dcf71cf0d6d2424021d0a04f191396a46a7"><code>bd5f1dc</code></a>
http2: initialize Transport on NewClientConn</li>
<li><a
href="https://github.com/golang/net/commit/488ff63197ffddbcef2d01107f8a89906a4f28d1"><code>488ff63</code></a>
bpf: add security considerations to package docs</li>
<li><a
href="https://github.com/golang/net/commit/93d1f25be95961edfdf488b9398e53fb9f05f193"><code>93d1f25</code></a>
xsrftoken: avoid token collisions</li>
<li><a
href="https://github.com/golang/net/commit/5a3baee349e65853c34b4377bebe7676a64dbc87"><code>5a3baee</code></a>
internal/http3: prevent panic in QPACK decoder due to overflow</li>
<li>See full diff in <a
href="https://github.com/golang/net/compare/v0.56.0...v0.57.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `golang.org/x/sync` from 0.21.0 to 0.22.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/sync/commit/1eb64d4bc0cde6da1bb8ebc7f178bb577508e5d0"><code>1eb64d4</code></a>
semaphore: panic on negative weights</li>
<li>See full diff in <a
href="https://github.com/golang/sync/compare/v0.21.0...v0.22.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `golang.org/x/sys` from 0.46.0 to 0.47.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/sys/commit/9e7e939dcafac07e8ab4cffa6e5fc74908413f00"><code>9e7e939</code></a>
cpu: handle vendor suffixes in parseRelease</li>
<li><a
href="https://github.com/golang/sys/commit/f6fb8a1e42b1731ca8f87ace29c3307429ecdb5a"><code>f6fb8a1</code></a>
unix: use epoll_pwait rather than epoll_wait</li>
<li><a
href="https://github.com/golang/sys/commit/f3eeabfcab6a9a0585ddee7337d5ccfeebe576ed"><code>f3eeabf</code></a>
windows: avoid length overflow in NewNTString</li>
<li><a
href="https://github.com/golang/sys/commit/3cb66475f895724679601e2580be904c8aaa5f7a"><code>3cb6647</code></a>
unix: update glibc to 2.43</li>
<li><a
href="https://github.com/golang/sys/commit/c507910bb52510a2ae06048a4246ad0fe210a872"><code>c507910</code></a>
windows: document safe usage of TrusteeValue</li>
<li>See full diff in <a
href="https://github.com/golang/sys/compare/v0.46.0...v0.47.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `golang.org/x/term` from 0.44.0 to 0.45.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/term/commit/9f69229da31ca6a34b522f59dbe07cad5ea21587"><code>9f69229</code></a>
go.mod: update golang.org/x dependencies</li>
<li>See full diff in <a
href="https://github.com/golang/term/compare/v0.44.0...v0.45.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `golang.org/x/text` from 0.39.0 to 0.40.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/text/commit/724af9c35838492dcaacc1ac51a8a0187c994c54"><code>724af9c</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="https://github.com/golang/text/commit/bf5b9d658a03d36bd3459b3babdb23a9f56038cb"><code>bf5b9d6</code></a>
internal/export/idna: always treat Punycode encoding pure ASCII as an
error</li>
<li>See full diff in <a
href="https://github.com/golang/text/compare/v0.39.0...v0.40.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `golang.org/x/tools` from 0.47.0 to 0.48.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/tools/commit/05f9cb5d358503005bd6f82b17916d226ca7b210"><code>05f9cb5</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="https://github.com/golang/tools/commit/745d7ae955f815a23f71eea6c5825e1a60308578"><code>745d7ae</code></a>
gopls: add CompiledAsmFiles in cache.Package</li>
<li><a
href="https://github.com/golang/tools/commit/797ee67e8547c21742c14f38d01bf3e54dad6aad"><code>797ee67</code></a>
go/ssa: make Const(unsafe.Pointer, nil).IsNil() true</li>
<li><a
href="https://github.com/golang/tools/commit/9751125d7187ef7b7f3e66c20925c2099be7e934"><code>9751125</code></a>
gopls/internal/test: Completion benchmarks use empty range</li>
<li><a
href="https://github.com/golang/tools/commit/8786a967dbbb73b985c6345d652594422f995717"><code>8786a96</code></a>
internal/stdlib: update stdlib index for Go 1.27 Release Candidate
2</li>
<li><a
href="https://github.com/golang/tools/commit/425085f6dee3cf40e111b5d2e8cc139ff52c55ee"><code>425085f</code></a>
gopls/internal/server: modify return of parseAction</li>
<li><a
href="https://github.com/golang/tools/commit/30c4f871093496f7e4492bad5d49cac24587eeda"><code>30c4f87</code></a>
go/analysis/passes/nilness: skip magic cgo functions</li>
<li><a
href="https://github.com/golang/tools/commit/9e6441dfc70bdc98114c748afe34d7cd49b2d0b0"><code>9e6441d</code></a>
gopls/internal/protocol/generate: remove manual rename overwritten</li>
<li><a
href="https://github.com/golang/tools/commit/df9684197301c2e2c2a34a56a329f667fd93637b"><code>df96841</code></a>
gopls/internal/protocol: use Debug log level</li>
<li><a
href="https://github.com/golang/tools/commit/278f0628682b5732f29a5ef0083c860de88c5b94"><code>278f062</code></a>
gopls/internal/protocol: update to LSP 3.18</li>
<li>Additional commits viewable in <a
href="https://github.com/golang/tools/compare/v0.47.0...v0.48.0">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-14 11:20:11 +00:00
dependabot[bot] 26c8fc85a2 chore: bump github.com/prometheus/common from 0.69.0 to 0.70.0 (#27225) 
Bumps
[github.com/prometheus/common](https://github.com/prometheus/common)
from 0.69.0 to 0.70.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/prometheus/common/releases">github.com/prometheus/common's
releases</a>.</em></p>
<blockquote>
<h2>v0.70.0</h2>
<h2>What's Changed</h2>
<ul>
<li>config: fix TLSVersion.String() printing pointer address by <a
href="https://github.com/s3onghyun"><code>@​s3onghyun</code></a> in <a
href="https://redirect.github.com/prometheus/common/pull/929">prometheus/common#929</a></li>
<li>build(deps): bump golang.org/x/net from 0.55.0 to 0.56.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/prometheus/common/pull/933">prometheus/common#933</a></li>
<li>Manually go mod tidy by <a
href="https://github.com/SuperQ"><code>@​SuperQ</code></a> in <a
href="https://redirect.github.com/prometheus/common/pull/934">prometheus/common#934</a></li>
<li>Synchronize common files from prometheus/prometheus by <a
href="https://github.com/prombot"><code>@​prombot</code></a> in <a
href="https://redirect.github.com/prometheus/common/pull/937">prometheus/common#937</a></li>
<li>route: add support for the QUERY HTTP method by <a
href="https://github.com/roidelapluie"><code>@​roidelapluie</code></a>
in <a
href="https://redirect.github.com/prometheus/common/pull/932">prometheus/common#932</a></li>
<li>Combine and extend Prometheus text and OpenMetrics 1.0 encoder
benchmarks by <a
href="https://github.com/dashpole"><code>@​dashpole</code></a> in <a
href="https://redirect.github.com/prometheus/common/pull/943">prometheus/common#943</a></li>
<li>build(deps): bump the codeql group with 4 updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/prometheus/common/pull/938">prometheus/common#938</a></li>
<li>build(deps): bump actions/setup-go from 6.2.0 to 6.5.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/prometheus/common/pull/940">prometheus/common#940</a></li>
<li>build(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/prometheus/common/pull/942">prometheus/common#942</a></li>
<li>build(deps): bump ossf/scorecard-action from 2.1.2 to 2.4.3 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/prometheus/common/pull/939">prometheus/common#939</a></li>
<li>build(deps): bump actions/checkout from 3.1.0 to 7.0.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/prometheus/common/pull/941">prometheus/common#941</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/s3onghyun"><code>@​s3onghyun</code></a>
made their first contribution in <a
href="https://redirect.github.com/prometheus/common/pull/929">prometheus/common#929</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/prometheus/common/compare/v0.69.0...v0.70.0">https://github.com/prometheus/common/compare/v0.69.0...v0.70.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/prometheus/common/blob/main/CHANGELOG.md">github.com/prometheus/common's
changelog</a>.</em></p>
<blockquote>
<h2>v0.70.0 / 2026-07-10</h2>
<h3>Enhancements</h3>
<ul>
<li>route: add support for the QUERY HTTP method. <a
href="https://redirect.github.com/prometheus/common/issues/932">#932</a></li>
</ul>
<h3>Bugfixes</h3>
<ul>
<li>config: fix <code>TLSVersion.String()</code> printing a pointer
address instead of the numeric version for unknown TLS versions. <a
href="https://redirect.github.com/prometheus/common/issues/929">#929</a></li>
</ul>
<h3>Internal</h3>
<ul>
<li>expfmt: add <code>BenchmarkConvertMetricFamily</code> comparing the
Prometheus text and OpenMetrics 1.0 encoders. <a
href="https://redirect.github.com/prometheus/common/issues/943">#943</a></li>
<li>Update Go dependencies. <a
href="https://redirect.github.com/prometheus/common/issues/933">#933</a>
<a
href="https://redirect.github.com/prometheus/common/issues/934">#934</a></li>
<li>Synchronize common files from prometheus/prometheus. <a
href="https://redirect.github.com/prometheus/common/issues/923">#923</a>
<a
href="https://redirect.github.com/prometheus/common/issues/927">#927</a>
<a
href="https://redirect.github.com/prometheus/common/issues/930">#930</a>
<a
href="https://redirect.github.com/prometheus/common/issues/937">#937</a></li>
<li>Update GitHub Actions. <a
href="https://redirect.github.com/prometheus/common/issues/938">#938</a>
<a
href="https://redirect.github.com/prometheus/common/issues/939">#939</a>
<a
href="https://redirect.github.com/prometheus/common/issues/940">#940</a>
<a
href="https://redirect.github.com/prometheus/common/issues/941">#941</a>
<a
href="https://redirect.github.com/prometheus/common/issues/942">#942</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/prometheus/common/compare/v0.69.0...v0.70.0">https://github.com/prometheus/common/compare/v0.69.0...v0.70.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/prometheus/common/commit/5eff7a827920b6f175ea02b222f7c827a0fe80ad"><code>5eff7a8</code></a>
Merge pull request <a
href="https://redirect.github.com/prometheus/common/issues/941">#941</a>
from prometheus/dependabot/github_actions/actions/che...</li>
<li><a
href="https://github.com/prometheus/common/commit/a23c5b344ad9200c0073133920fe60a9882c9d28"><code>a23c5b3</code></a>
Merge pull request <a
href="https://redirect.github.com/prometheus/common/issues/939">#939</a>
from prometheus/dependabot/github_actions/ossf/scorec...</li>
<li><a
href="https://github.com/prometheus/common/commit/9e1eb871ced38b03648a38558ac3de66edeff2b5"><code>9e1eb87</code></a>
Merge pull request <a
href="https://redirect.github.com/prometheus/common/issues/942">#942</a>
from prometheus/dependabot/github_actions/actions/upl...</li>
<li><a
href="https://github.com/prometheus/common/commit/ab2736d28a9fce77b0186e36b5d3318b74115298"><code>ab2736d</code></a>
Merge pull request <a
href="https://redirect.github.com/prometheus/common/issues/940">#940</a>
from prometheus/dependabot/github_actions/actions/set...</li>
<li><a
href="https://github.com/prometheus/common/commit/e596873192a72855876b1c38cdb634bb73f5ba00"><code>e596873</code></a>
Merge pull request <a
href="https://redirect.github.com/prometheus/common/issues/938">#938</a>
from prometheus/dependabot/github_actions/codeql-ac07...</li>
<li><a
href="https://github.com/prometheus/common/commit/97c066a87b2345f146b345141f0f14aaab7ad387"><code>97c066a</code></a>
Add BenchmarkConvertMetricFamily comparing Prometheus text and
OpenMetrics 1....</li>
<li><a
href="https://github.com/prometheus/common/commit/62e9d0f61d355b574225f66628a5f94be2bc1c29"><code>62e9d0f</code></a>
Merge pull request <a
href="https://redirect.github.com/prometheus/common/issues/932">#932</a>
from roidelapluie/roidelapluie/route-query</li>
<li><a
href="https://github.com/prometheus/common/commit/6c312397a5da723c995ee9c16263f252c1d6b4a1"><code>6c31239</code></a>
build(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1</li>
<li><a
href="https://github.com/prometheus/common/commit/755e9d686dec00400191cc8483872831aff1b9cd"><code>755e9d6</code></a>
build(deps): bump actions/checkout from 3.1.0 to 7.0.0</li>
<li><a
href="https://github.com/prometheus/common/commit/556d7402ea9a80cab60297e4dc98149b5410e24f"><code>556d740</code></a>
build(deps): bump actions/setup-go from 6.2.0 to 6.5.0</li>
<li>Additional commits viewable in <a
href="https://github.com/prometheus/common/compare/v0.69.0...v0.70.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/prometheus/common&package-manager=go_modules&previous-version=0.69.0&new-version=0.70.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-14 11:20:04 +00:00
dependabot[bot] 7470f072a2 chore: bump github.com/coreos/go-oidc/v3 from 3.19.0 to 3.20.0 (#27224) 
Bumps [github.com/coreos/go-oidc/v3](https://github.com/coreos/go-oidc)
from 3.19.0 to 3.20.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/coreos/go-oidc/releases">github.com/coreos/go-oidc/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.20.0</h2>
<h2>What's Changed</h2>
<ul>
<li>oidc: modernize with new Go APIs by <a
href="https://github.com/ericchiang"><code>@​ericchiang</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/487">coreos/go-oidc#487</a></li>
<li>oidc: improve documentation for APIs by <a
href="https://github.com/ericchiang"><code>@​ericchiang</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/488">coreos/go-oidc#488</a></li>
<li>SECURITY.md: add a security policy and point to project-level
reporting by <a
href="https://github.com/ericchiang"><code>@​ericchiang</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/489">coreos/go-oidc#489</a></li>
<li>oidc: ignore JWKs with unknown signing algorithms rather than
failing by <a
href="https://github.com/ericchiang"><code>@​ericchiang</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/491">coreos/go-oidc#491</a></li>
<li>readme: update README and docs by <a
href="https://github.com/ericchiang"><code>@​ericchiang</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/492">coreos/go-oidc#492</a></li>
<li>oidc: add API for determining when issuer URLs mismatch by <a
href="https://github.com/ericchiang"><code>@​ericchiang</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/493">coreos/go-oidc#493</a></li>
<li>oidc: add constants for &quot;email&quot; and &quot;profile&quot;
scopes by <a
href="https://github.com/ericchiang"><code>@​ericchiang</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/494">coreos/go-oidc#494</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/coreos/go-oidc/compare/v3.19.0...v3.20.0">https://github.com/coreos/go-oidc/compare/v3.19.0...v3.20.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/coreos/go-oidc/commit/75dfa5c0626c48e0ad8b761fdd9e1dc51cb8498a"><code>75dfa5c</code></a>
oidc: add constants for &quot;email&quot; and &quot;profile&quot;
scopes</li>
<li><a
href="https://github.com/coreos/go-oidc/commit/a89f0468ccc8e531b54f469053674a12c2258c72"><code>a89f046</code></a>
oidc: add API for determining when issuer URLs mismatch</li>
<li><a
href="https://github.com/coreos/go-oidc/commit/6a69b6d27e137b9919e468417e438b02c51a54b2"><code>6a69b6d</code></a>
readme: update README and docs</li>
<li><a
href="https://github.com/coreos/go-oidc/commit/f9049c99079786740d492714fb33b671464312dd"><code>f9049c9</code></a>
oidc: ignore JWKs with unknown signing algorithms rather than
failing</li>
<li><a
href="https://github.com/coreos/go-oidc/commit/2f178e0a9df71f65464a9a8d25c388e798303323"><code>2f178e0</code></a>
SECURITY.md: add a security policy and point to project-level
reporting</li>
<li><a
href="https://github.com/coreos/go-oidc/commit/b3bc7daa5743acd0b6c604ad7e5c9b609b6d39f4"><code>b3bc7da</code></a>
oidc: improve documentation for APIs</li>
<li><a
href="https://github.com/coreos/go-oidc/commit/0db90530b3f5ab1808b26365441e366926b86f0b"><code>0db9053</code></a>
oidc: modernize with new Go APIs</li>
<li>See full diff in <a
href="https://github.com/coreos/go-oidc/compare/v3.19.0...v3.20.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/coreos/go-oidc/v3&package-manager=go_modules&previous-version=3.19.0&new-version=3.20.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-14 11:19:52 +00:00
dependabot[bot] ce846fc401 chore: bump google.golang.org/api from 0.287.0 to 0.288.0 (#27226) 
Bumps
[google.golang.org/api](https://github.com/googleapis/google-api-go-client)
from 0.287.0 to 0.288.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's
releases</a>.</em></p>
<blockquote>
<h2>v0.288.0</h2>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.287.1...v0.288.0">0.288.0</a>
(2026-07-09)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3647">#3647</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/510a0c19483ea5631b7b0a453f9d6df1b9ef596a">510a0c1</a>)</li>
</ul>
<h2>v0.287.1</h2>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.287.0...v0.287.1">0.287.1</a>
(2026-07-07)</h2>
<h3>Documentation</h3>
<ul>
<li>Remove old TODO file (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3645">#3645</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/9d7a6b8ba7ca7fda1fda4373714a8aff1e930e6f">9d7a6b8</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.287.1...v0.288.0">0.288.0</a>
(2026-07-09)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3647">#3647</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/510a0c19483ea5631b7b0a453f9d6df1b9ef596a">510a0c1</a>)</li>
</ul>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.287.0...v0.287.1">0.287.1</a>
(2026-07-07)</h2>
<h3>Documentation</h3>
<ul>
<li>Remove old TODO file (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3645">#3645</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/9d7a6b8ba7ca7fda1fda4373714a8aff1e930e6f">9d7a6b8</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/31d2afed7eb393f33e56bdbaf0b17bc7c5345abc"><code>31d2afe</code></a>
chore(main): release 0.288.0 (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3648">#3648</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/510a0c19483ea5631b7b0a453f9d6df1b9ef596a"><code>510a0c1</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3647">#3647</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/93d63e8234f46095c363aff86b433c750ccd7332"><code>93d63e8</code></a>
chore(main): release 0.287.1 (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3646">#3646</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/9d7a6b8ba7ca7fda1fda4373714a8aff1e930e6f"><code>9d7a6b8</code></a>
docs: remove old TODO file (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3645">#3645</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/576018ff14470f5cf33aa1a1d388d219a5291e40"><code>576018f</code></a>
chore(all): update all (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3644">#3644</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/cc70265cdfbc6c3d6ccbd7b068ff70a9c3695893"><code>cc70265</code></a>
chore(deps): bump golang.org/x/net in /internal/kokoro/discogen (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3642">#3642</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/9858f66b46ba1fdea7dacf1a02b47c0881e2c27a"><code>9858f66</code></a>
chore: downgrade go version in go.work (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3641">#3641</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/3cb00c0ab3ced21614ceb1f8e3e664f6d8ff7712"><code>3cb00c0</code></a>
chore: downgrade min Go version (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3640">#3640</a>)</li>
<li>See full diff in <a
href="https://github.com/googleapis/google-api-go-client/compare/v0.287.0...v0.288.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/api&package-manager=go_modules&previous-version=0.287.0&new-version=0.288.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-14 11:19:41 +00:00
Denis Afonso 553c9ecbc8 fix: bump Go version from 1.26.4 to 1.26.5 (#27157) 
## Summary

Bump Go toolchain from 1.26.4 to 1.26.5.

Go 1.26.5 ([released
2026-07-07](https://go.dev/doc/devel/release#go1.26.5)) includes
security fixes addressing:

- [CVE-2026-39822](https://nvd.nist.gov/vuln/detail/CVE-2026-39822) —
`os` package
- [CVE-2026-42505](https://nvd.nist.gov/vuln/detail/CVE-2026-42505) —
`crypto/tls` package

These were flagged by the IronBank scan of
`coder/coder-enterprise/coder-service-2:2.34.5`.

## Changes

- `go.mod`: `go 1.26.4` to `go 1.26.5` (language version floor)
- `mise.toml` / `mise.lock`: Go toolchain pin 1.26.4 to 1.26.5 (this is
what actually compiles the scanned artifact and clears the CVEs)

## Related

- #27159 — backport to `release/2.35`
- #27158 — backport to `release/2.34`

Linear: ENT-129
 2026-07-14 12:49:05 +02:00
Michael Suchacz 55b06f14a3 feat: allow overriding advisor reasoning effort (#27196) 2026-07-14 11:01:51 +02:00
Marcin Tojek 162bd0e015 chore(docs): update release docs for v2.34.6 (#27215) 
Automated docs update for v2.34.6 release.

Created by `releasetui`.
 2026-07-14 10:50:29 +02:00
Marcin Tojek ec52dd274c chore(docs): update release docs for v2.35.2 (#27214) 
Automated docs update for v2.35.2 release.

Created by `releasetui`.
 2026-07-14 10:30:16 +02:00
Ehab Younes 2261f26ead fix(vpn): remove unused success field from WakeResponse (#27202) 
WakeResponse.success was always set to true regardless of whether a
rebind actually happened (e.g. when debounced or the tunnel isn't
running yet), so it carried no useful information. Remove it,
mirroring the earlier removal of the unused error_message field from
the same message.
 2026-07-14 11:26:16 +03:00
Ethan d0e67a74d5 chore: report Coder Agents experiments in telemetry (#27042) 
Closes CODAGT-352

This adds the Coder Agents experiments (virtual desktop with computer
use, and the advisor) to telemetry, so they finally show up in each
deployment snapshot. Everything stays inside `coderd/telemetry/`.

## Shape received by the telemetry server

The experiments are reported as a single `agents_experiments` field on
the deployment record, alongside the other config-derived deployment
fields. Its value is one JSON blob with one top-level key per
experiment:

```json
{
  "virtual_desktop": {
    "enabled": false,
    "computer_use": {"provider": "anthropic", "provider_source": "default"}
  },
  "advisor": {"enabled": true, "max_uses_per_run": 5, "max_output_tokens": 4096, "provider": "openai", "model": "gpt-5.2"}
}
```

When the advisor falls back to the chat model, either because no
override is set or because the configured override is inactive (its
config or provider was deleted or disabled), the provider and model
carry a sentinel instead:

```json
"advisor": {"enabled": true, "max_uses_per_run": 5, "max_output_tokens": 4096, "provider": "advisor_reuse_chat_model", "model": "advisor_reuse_chat_model"}
```

- `virtual_desktop.enabled` and `advisor.enabled` track the
`chat-virtual-desktop` and `chat-advisor` deployment experiments, not
the stored config. We ignore the stored advisor `enabled` flag on
purpose: since #26809 the runtime gates on the experiment, and the
stored flag ends up permanently true for any deployment that ever opened
the settings form.
- Computer use sits under `virtual_desktop` rather than as its own
top-level key because it isn't a separate experiment; the same
`chat-virtual-desktop` flag gates both the desktop and the computer-use
provider. `provider_source` says whether an admin picked the provider
(`configured`) or we fell back to the default (`default`).
- `advisor.provider` is the `ai_providers` type (e.g. `openai`,
`anthropic`, `azure`) and `advisor.model` is the configured model
string. Two sentinels stand in when there's no concrete value:
`advisor_reuse_chat_model` when the advisor has no active override and
falls back to the chat model (matching the runtime), and `unknown` when
we genuinely couldn't tell, e.g. a query failed or the stored config
wouldn't parse.
- `advisor.max_uses_per_run` and `advisor.max_output_tokens` are clamped
to 0 before reporting, matching how the API normalizes these values on
read.

## Why this shape

Putting the data on the deployment record keeps it next to the other
config-derived fields, and leaves `telemetry_items` as a faithful mirror
of the `telemetry_items` table rather than a place we inject synthetic
rows. Adding or removing an experiment is a one-line edit to the
`agentsExperiments` registry. The `agents_experiments` field itself
never changes; only the JSON inside it does. The field is `omitempty`,
so older Coder versions that don't emit it are distinguishable from a
real absence, and when an experiment isn't reported in a snapshot its
JSON path is simply missing, so queries can tell "not reported" apart
from a real `false`.

One key holding one JSON blob is also easier to query than many separate
fields. Because everything lives in one blob, a question like "of the
deployments running the desktop, how many changed the computer-use
provider?" is one query with no join:

```sql
SELECT
  JSON_VALUE(agents_experiments, '$.virtual_desktop.computer_use.provider_source') AS src,
  COUNT(*) AS deployments
FROM deployments
WHERE JSON_VALUE(agents_experiments, '$.virtual_desktop.enabled') = 'true'
GROUP BY src
```
 2026-07-14 14:18:39 +10:00
Ethan 535c775f2a fix(coderd): serialize chat model config default election with advisory lock (#27114) 
Closes CODAGT-736

Concurrent chat model config writes on a deployment with no default all
elect themselves default: at READ COMMITTED neither transaction sees the
other's uncommitted default, so both self-promote and
`idx_chat_model_configs_single_default` rejects the loser as a spurious
409. The coderd Terraform provider hits this routinely, since a single
`terraform apply` creates or deletes many configs in parallel by design.

The fix serializes the election with a transaction-scoped advisory lock:
the create, update, and delete handlers run their default election
inside a transaction that first takes `pg_advisory_xact_lock` on a
dedicated `LockIDChatModelConfigDefault`, so elections run one at a time
and the index is never contended. The partial unique index stays in
place as the schema-level invariant, and the existing 409 mapping
remains as a backstop for any writer that bypasses the lock.

We considered a singleton pointer table (one row holding a
`model_config_id` FK, making a second default unrepresentable), which
would remove the race outright, but it needs a migration, new queries,
dbauthz rules, and handler/read-path rework. Not proportionate for an
experimental endpoint.
 2026-07-14 13:51:47 +10:00
Ethan b0f0a54ab7 feat(codersdk): add strict unmarshalling for ChatModelCallConfig (#27187) 
Adds `ChatModelCallConfig.UnmarshalStrict`: `UnmarshalJSON` except
unknown fields and trailing data are errors instead of being silently
dropped.

`model_config` is free-form JSON at its edges (Terraform config, API
bodies), so a typo'd setting is dropped with no signal;
coder/terraform-provider-coderd#388 uses this for plan-time validation.
It has to live in codersdk because the custom `UnmarshalJSON` and its
unexported aux struct (which defines the accepted key set, including
legacy pricing aliases) make strict decoding impossible from outside the
package. `UnmarshalJSON` stays lenient since it is on the read path for
stored configs and older clients, where unknown keys mean version skew
rather than user error.

_Opened by Coder Agents on behalf of @ethanndickson._

Relates to CODAGT-797
 2026-07-14 03:32:03 +00:00
Jake Howell 0c3c65d85b fix: stabilize latest workspace app status ordering (DEVEX-381) (#27041) 
> 🤖 This PR was written by Coder Agents on behalf of Jake Howell.

Closes
[DEVEX-381](https://linear.app/codercom/issue/DEVEX-381/flake-test-tasksendwaitsforworkingappstate).
Follow-up to #25648 and #25858, which addressed a different symptom of
the same test.

## Symptom

```
task_send_test.go:348: context expired while waiting for trap: context deadline exceeded
--- FAIL: Test_TaskSend/WaitsForWorkingAppState (26.02s)
```

Windows-only, on `test-go-pg (windows-2022)`. Reported four times since
#25648 landed (2026-06-02, 2026-06-10, 2026-07-01).

## Root cause

The test:

1. `setupCLITaskTest` inserts `workspace_app_status(state=idle)` at the
end of setup.
2. `WaitsForWorkingAppState` then inserts
`workspace_app_status(state=working)` before starting the CLI.
3. Both are persisted via `dbtime.Now()`, which rounds to microseconds.
Windows `time.Now()` resolution is coarser than that (often ~1 ms or
worse), so back-to-back calls frequently round to the same microsecond.
4. `GetLatestWorkspaceAppStatusesByWorkspaceIDs` has no tiebreaker:

   ```sql
   ORDER BY workspace_id, created_at DESC
   ```

Its sibling `GetLatestWorkspaceAppStatusByAppID` already uses `ORDER BY
created_at DESC, id DESC` for exactly this reason. When the two rows
collide, Postgres picks either.
5. On the failing runs, the query returned the `idle` row.
`waitForTaskIdle` saw idle on the first poll, returned nil, `TaskSend`
proceeded, and the CLI completed successfully in ~5 s.
6. But the test was blocked at `resetTrap.MustWait(ctx)` waiting for a
**second** `ticker.Reset` that never happened. `WaitLong = 25s` elapsed,
line 348 failed.

CI log confirms the sequence: only one `Ticker.Reset(5s)` is caught,
then `Ticker.Stop([]) call, matched 0 traps` (from `defer
ticker.Stop()`), then the trap wait times out.

This is the same class of flake Spike documented in #15923 and #21332
("Windows in particular doesn't have high-resolution timers"), just
hidden behind a SQL `ORDER BY`.

## Fix

Two changes:

1. **`coderd/database/queries/workspaceapps.sql`**: add an `id DESC`
tiebreaker to `GetLatestWorkspaceAppStatusesByWorkspaceIDs`, matching
`GetLatestWorkspaceAppStatusByAppID`. Makes the query deterministic when
`created_at` collides.
2. **`cli/task_test.go` / `cli/task_send_test.go`**: add a
`withoutInitialAppStatus()` option to `setupCLITaskTest` and use it from
`WaitsForWorkingAppState`. The test now inserts a single `working` row,
so the collision cannot happen in the first place. Belt-and-braces with
change 1.

Comments in both places reference DEVEX-381 and #21332 so the next agent
doesn't have to re-derive this.

## Verification

- `go test ./cli -run 'Test_TaskSend' -count=1`: all 12 subtests pass,
`WaitsForWorkingAppState` completes in ~5.6 s (was ~16 s previously due
to a longer poll loop).
- Stress: 20 sequential runs of `WaitsForWorkingAppState` on Linux,
race-enabled binary, all pass in ~5.5 s each.
- `go test ./coderd -run 'AppStatus|Task' -count=1` passes.
- `go vet ./coderd/database/... ./cli/...` clean.
- `make lint/emdash` clean.
- `gofmt` clean.

Not reproducible on Linux (real time between the two patches is orders
of magnitude larger than microsecond); the Windows path is fixed by
making the ordering deterministic and by not creating the collision in
the first place.

<details>
<summary>Implementation plan & decision log</summary>

### Investigation

1. Pulled the failing job log for run `28483879823/job/84428355669`.
2. Traced the mock-clock trap sequence: one `NewTicker` and exactly one
`Ticker.Reset(5s)` were caught, then `Ticker.Stop([]) call, matched 0
traps` fires (the `defer ticker.Stop()` on `waitForTaskIdle` return).
This proves `waitForTaskIdle` returned after a single poll, not that the
trap machinery hung.
3. The command exited with `<nil>` (`clitest.go:299: command "coder task
send" exited with error: <nil>`) and a `POST /send` completed in 5.4 s.
So the CLI succeeded; the test's own trap wait is what timed out.
4. The only `waitForTaskIdle` return-nil paths are `Active +
CurrentState.State in {Idle, Complete, Failed}` and `Active +
CurrentState == nil past 30s grace`. First observation of nil cannot be
past 30s. So `TaskByID` must have returned `State == Idle`.
5. Traced `TaskByID` → `taskGet` → `workspaceData` →
`GetLatestWorkspaceAppStatusesByWorkspaceIDs`. Found the missing
tiebreaker; the sibling query one line above
(`GetLatestWorkspaceAppStatusByAppID`) already had it.
6. Confirmed the two `PATCH /app-status` calls in the Windows log
happened at `00:26:13.077` and `00:26:13.093`, well within Windows timer
resolution.
7. Confirmed `dbtime.Now()` rounds to microseconds; Windows `time.Now()`
doesn't have that precision, so `Round(time.Microsecond)` on two calls
close together frequently produces equal values.

### Prior art from Spike

- #15923: loosened `HeartbeatPeriod * 9/10` to `3/4` for Windows.
- #21332: switched `assert.After` to `assert.NotBefore` because
timestamps can equal on Windows.

Both explicitly cite "Windows doesn't always have high-resolution timers
available."

### Considered alternatives

- **Only fix the test.** Works today but leaves the SQL query
non-deterministic; another test that relies on
`GetLatestWorkspaceAppStatusesByWorkspaceIDs` could hit the same
collision.
- **Only fix the SQL query.** Would give a stable answer but not
necessarily the *right* one. If both patches share a `created_at`, `id
DESC` picks whichever UUID sorted higher, still random with respect to
insertion order.
- **Make `dbtime.Now()` monotonic per process.** Cleanest at the source,
but affects every timestamp in the database and has broader implications
than a targeted flake fix.

Going with both the query fix (defense in depth, matches existing
pattern) and the test fix (eliminates the collision at the source) is
the smallest change that closes the flake and hardens the query.

### Rejected commit-message scopes

Changes touch both `cli/` and `coderd/database/`, so per AGENTS.md the
scope is omitted for the cross-cutting commit and PR title.

</details>
 2026-07-14 11:48:31 +10:00