opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-10-16 14:48:56 +08:00
Code Issues Packages Projects Releases Wiki Activity
17,187 Commits 479 Branches 395 Tags
3b283eb0474b22a091cd5971045ec0791d6f1001
Commit Graph
17187 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Jake Howell 3b283eb047 fix(site): preserve personal instructions drafts (#30626) 
> 🤖 This PR was modified by Coder Agents on behalf of Jake Howell.

Prevent personal instructions drafts from being overwritten by delayed
query results. Block editing until instructions load, show initial-load
errors distinctly from empty prompts, and preserve dirty edits during
later query updates.

Reset successful saves from the server response and cache it before
refetching so a failed refresh cannot restore stale instructions.
Includes behavioral tests and loading, error, and empty Storybook
states.

Reproduction:

1. The user already has a nonempty saved personal-instructions prompt.
2. Open settings with the initial GET delayed.
3. Type a new draft into the enabled textarea.
4. The GET returns the existing saved prompt.
5. Formik replaces the draft with that prompt.
6. Further typing and Save submit the saved prompt plus subsequent
edits, losing the original draft.

<details>
<summary>Implementation decisions</summary>

- Keep Formik reinitialization for initial hydration and pristine
updates, guarded by the existing personal-model form draft pattern.
- Use the confirmed mutation response as the clean form baseline and
cache value.
- Leave the existing Saved-indicator behavior unchanged; no additional
retry UI.

</details>
 2026-10-16 09:13:28 +11:00
Andrew Aquino 5261723186 fix(site/src): replace role="application" on recharts charts (#30375) 
> [!NOTE]
> This PR was generated by Coder Agents on behalf of @aqandrew.

Fixes DEQ-408 (axe `custom-role-application` on the user engagement
chart). Also fixes DEQ-342

recharts' `accessibilityLayer` sets `role="application"` on the chart
`<svg>` by default. This PR overrides it on all three charts that use it
(user engagement, template active users, license seat consumption) with
`role="group"` and `aria-roledescription="chart"`. It also gives each
chart an accessible name and description through recharts'
`title`/`desc` props.

`accessibilityLayer` stays, so keyboard users can still move the tooltip
with the arrow keys. To make that work for screen readers,
`ChartContainer` now renders a polite `role="status"` live region that
is always mounted. `ChartTooltipContent` builds the announcement during
render from the same label and item values the tooltip shows, and an
effect keyed on that string pushes it into the live region. Each point
is announced, for example "175 users January 02".

Not verified: NVDA behaviour (whether Tab focus switches to focus mode
so the arrows reach the chart), and an axe re-run on
`/deployment/overview`.

Frontend-review notes:
- **FE1:** the assertions live in story `play` functions. recharts'
keyboard navigation depends on real layout (`getBoundingClientRect`), so
jsdom unit tests can't exercise it.
- **FE10:** `<desc>` is checked with a selector. `dom-accessibility-api`
doesn't compute descriptions from SVG `<desc>`, although Chromium does
per SVG-AAM.
- **FE8:** the announcement string is derived during render. The one
remaining effect only pushes it into `ChartContainer`'s state, because a
component can't update another component's state while rendering.

<details>
<summary>Implementation plan</summary>

## Findings (recharts 2.15.4, verified in `node_modules`)

- `generateCategoricalChart.js:1937-1953`: with `accessibilityLayer`,
the `<svg>` gets `tabIndex = props.tabIndex ?? 0`, `role = props.role ??
"application"`, and `onKeyDown`/`onFocus` handlers. The handlers are
attached whatever the role is, so `role="group"` keeps
ArrowLeft/ArrowRight working.
- Keyboard navigation (`AccessibilityManager.spoofMouse`) goes through
the same `triggeredAfterMouseMove` path as the mouse, so the tooltip
shows the same content for both.
- `container/Surface.js:41`: the `title` and `desc` props render as
`<title>` and `<desc>` children of the `<svg>`. These give the SVG its
accessible name and description.
- `component/Tooltip.js`: `content` is always rendered and receives an
`active` prop. The tooltip wrapper (`TooltipBoundingBox`, `tabIndex=-1`)
is a sibling of the `<svg>` and is `visibility: hidden` when inactive.
That makes it unreliable as a live region, so announcements need their
own element that is always mounted.
- Three charts use `accessibilityLayer`: `UserEngagementChart`
(flagged), `ActiveUserChart`, `LicenseSeatConsumptionChart`. All three
are fixed.

## Changes

1. **Shared live region in `Chart.tsx`:** `ChartContainer` holds the
announcement state and renders an always-mounted `sr-only` live region
next to `ResponsiveContainer`. `ChartTooltipContent` sets the
announcement while active and clears it when inactive.
2. **Per-chart props:** keep `accessibilityLayer`; add `role="group"`,
`aria-roledescription="chart"`, `title` (the section name), and `desc`
(date range plus "Use the left and right arrow keys to read each day.").

## Tests (red, then green)

`play` functions on the existing stories, which run in Chromium through
`@storybook/addon-vitest`:
- **User engagement:** the chart is a named group with roledescription
"chart" and the expected `<desc>`. There is no `application` role.
Focusing the chart and pressing ArrowRight updates the live region.
- **The other two charts:** role and name only.
- **`components/Chart` default story:** without formatters, the
announcement is built from the label, the item name and the value
("January Users 186").

With the source changes reverted, all three tests fail.

## Decision log

- **Role:** `group` rather than `img`, because `img` hides the content
and conflicts with the focusable, arrow-key-driven chart. `figure` has
no interaction meaning, and `graphics-document` has poor screen-reader
support.
- **Keep the arrow-key tooltip** for keyboard users without a screen
reader, and announce changes through a live region.
- **Add `aria-roledescription="chart"`**, so screen readers say "chart"
rather than "grouping".
- **Memoize the `ChartContext` value** in `ChartContainer`, so
announcement updates don't re-render every `useChart` consumer.
`components/Chart` isn't covered by the React Compiler.
- **Deviations from the plan:**
- The live region gained `role="status"`, so it can be queried by role.
- The plan keyed the announcement effect on `active` and `payload`. The
first version instead ran on every render and read the text from the
DOM. Following review, the string is now derived from the label and item
values (strings and numbers only), and the effect depends on that
string.
- The test focuses the chart directly instead of pressing Tab, because
the first Tab stop is the "How we calculate" button.
- The description is checked on `<desc>` rather than with
`toHaveAccessibleDescription` (see FE10 above).
- The planned "live region empties on leave" assertion was dropped,
because recharts doesn't clear the tooltip on blur.

## Known tradeoffs

- **Mouse hover:** moving the mouse over the chart also triggers
announcements for screen-reader users, once per point.
- **NVDA:** NVDA users need to be in focus mode for the arrow keys to
reach the chart. The `desc` hint covers this.
- **No data table:** this PR doesn't add a table alternative to the
chart, so the WCAG 1.1.1 risk for the data itself remains.

</details>
 2026-10-15 14:02:57 -07:00
Bobby Ho 4d1f95e73e feat: order lifecycle scripts by their dependencies (#30765) 
feat(agent): enforce lifecycle script ordering

Honor `coder_script_order` dependencies for startup and shutdown scripts
using the existing outcome-aware unit manager. Cron, legacy scripts,
and scripts without dependencies retain their existing behavior.

- Wait for all prerequisites before running. `success` requires a
  successful prerequisite; `completion` also accepts failure, timeout,
  or skip. Skip dependents as soon as a required success becomes
  impossible, preserving the original failure as the lifecycle error.
- Reject invalid dependency graphs before any scripts start and write
  the reason to every selected script's log.
- Log unmet dependencies every 30 seconds and explain skips. Populate
  display names in the manifest so skip messages use readable names,
  falling back to Terraform addresses.
- Exclude dependency waits from script timeouts, record an outcome on
  every exit, and use fresh state per execution. Cancellation stops
  waiters without starting dependents or emitting skip messages.

Add regression coverage for ordering, skip propagation, timeouts,
cancellation, invalid graphs, and unchanged unordered execution.

Refs https://linear.app/codercom/issue/PLAT-549/phase-3-enforce-lifecycle-script-ordering
 2026-10-15 20:33:48 +00:00
Steven Masley fa926fcc77 docs(docs/admin/security): document workspace secrets (#30252) 
Adds a short "Workspace secrets" section to the secrets security page, explaining what workspace secrets are and how they differ from template parameters. Part of [RELAY-7](https://linear.app/codercom/issue/RELAY-7/agent-relay-deliver-provider-credentials-via-coder-secrets-instead-of).

**Stack** (design decisions in #30248)
1. #30248 Database schema, queries, and RBAC
2. #30249 Encryption at rest
3. #30250 Set secrets on workspace builds
4. #30251 Deliver secrets to the agent
5. **#30252 Docs (this PR)**
6. #30388 List a build's secrets
7. #30459 Audit a build's secrets

- Workspace secrets are set on the create workspace or create build request.
- They never reach the provisioner, so they stay out of build parameters, Terraform state, insights, and metrics.
- The agent delivers them the same way as user secrets, and they can't be read back through the API.

The section is intentionally brief. The API reference covers the request fields.

---

*Created by Coder Agents on behalf of @Emyrk.*
 2026-10-15 14:45:42 -05:00
Steven Masley 7d75210abf feat: deliver workspace secrets in the agent manifest (#30251) 
Delivers workspace secrets to the agent, so they show up as env vars and files in the workspace. Part of [RELAY-7](https://linear.app/codercom/issue/RELAY-7/agent-relay-deliver-provider-credentials-via-coder-secrets-instead-of).

**Stack** (design decisions in #30248)
1. #30248 Database schema, queries, and RBAC
2. #30249 Encryption at rest
3. #30250 Set secrets on workspace builds
4. **#30251 Deliver secrets to the agent (this PR)**
5. #30252 Docs
6. #30388 List a build's secrets
7. #30459 Audit a build's secrets

- The agent receives the secrets of the build that created it, alongside the owner's user secrets.
- A workspace secret wins over a user secret on the same env var or file path.
- An agent from an older build gets no workspace secrets.
- The agent itself needs no changes.

<details>
<summary>Implementation details</summary>

- `GetManifest` finds the agent's build through its resource and provisioner job, then lists that build's live secrets as `AsWorkspaceSecretManager`.
- In this PR, precedence comes from order: user secrets are emitted first and workspace secrets after, so the agent applies the workspace value last. #30388 replaces this with `workspacesecrets.Resolve`, which decides one winner per target and is shared with the build secrets API.
- The deployment's file path policy applies to both kinds of secret. When file delivery is blocked, a file-only secret is dropped.

</details>

---

*Created by Coder Agents on behalf of @Emyrk.*
 2026-10-15 14:38:42 -05:00
coder[bot]andDmitry Makovey 116660193e chore: bump bundled terraform to 1.16.6 (#30516) 
Bump the bundled Terraform binary from 1.16.2 to 1.16.6 (latest stable,
[released
2026-10-14](https://github.com/hashicorp/terraform/releases/tag/v1.16.6)),
following the same file set as #29331:

- `provisioner/terraform/install.go`: `TerraformVersion`
(`maxTerraformVersion` stays at 1.16.9 since this is a patch bump)
- `install.sh`, `scripts/Dockerfile.base`
- `mise.toml`, `mise.lock` (checksums from HashiCorp's
`terraform_1.16.6_SHA256SUMS`)
- `flake.nix` (fetchurl SRI hashes derived from the same SHA256SUMS)
- `docs/install/prepare/airgap.md`: the example Dockerfile `ARG
TERRAFORM_VERSION` had drifted back to 1.11.0 after the docs move;
updated to 1.16.6

Verified locally with `go test ./provisioner/terraform/ -run
'TestInstall|Version'`.

Opened by Superblink on behalf of @droopy4096.

_Updated from 1.16.5 to 1.16.6 (adds an HTTP/2 resource-exhaustion fix).
Branch name still says 1.16.5. Fixture fingerprint (`generation.sha1`)
regenerated; `go test ./provisioner/terraform/ -run
'TestInstall|Version|Golden'` passes._

---------

Co-authored-by: coder[bot] <137810501+coder[bot]@users.noreply.github.com>
Co-authored-by: Dmitry Makovey <dmakovey@yahoo.com>
 2026-10-15 12:33:45 -07:00
Steven Masley f25b6294b6 feat: set workspace secrets on workspace builds (#30250) 
Lets clients set secrets when creating a workspace or a build. Secrets are saved with the build and are never sent to the provisioner. Part of [RELAY-7](https://linear.app/codercom/issue/RELAY-7/agent-relay-deliver-provider-credentials-via-coder-secrets-instead-of).

**Stack** (design decisions in #30248)
1. #30248 Database schema, queries, and RBAC
2. #30249 Encryption at rest
3. **#30250 Set secrets on workspace builds (this PR)**
4. #30251 Deliver secrets to the agent
5. #30252 Docs
6. #30388 List a build's secrets
7. #30459 Audit a build's secrets

- `secrets` is a new field on the create workspace and create build requests.
- Each secret is delivered as an env var, a file, or both. `ephemeral` secrets last for one build only.
- Secrets carry forward to every later build until a request replaces or removes them.
- A secret set on another secret's env var or file path replaces that secret entirely.
- A null `value` removes a secret, which needs `update` permission on the owner's workspace secrets.
- Deleting a workspace clears its secret values.

Secrets are stored but not delivered to the agent until #30251.

<details>
<summary>Example request</summary>

```json
POST /api/v2/workspaces/{workspace}/builds
{
  "transition": "start",
  "secrets": [
    { "name": "openai-key", "value": "sk-...", "env_name": "OPENAI_API_KEY" },
    { "name": "kubeconfig", "value": "apiVersion: v1 ...", "file_path": "~/.kube/config" },
    { "name": "session-jwt", "value": "eyJ...", "env_name": "SESSION_JWT", "ephemeral": true },
    { "name": "old-token", "value": null }
  ]
}
```

</details>

<details>
<summary>Implementation details</summary>

- Validation reuses the user secret field rules and the file path delivery policy. It rejects:
  - duplicate names, env names, or file paths within one request
  - a removal that also sets a target or `ephemeral`
- In the build transaction, the builder:
  1. copies the previous build's live, non-ephemeral secrets that the request does not name or take over
  2. inserts the requested secrets
  3. "Earlier builds' rows are cleared when the new build's job completes
- Copying and clearing run as `AsWorkspaceSecretManager`, so autostart and other system-initiated builds work without secret permissions. Requested secrets are authorized as the build's actor.
- Each row records `source` (`request` or `carry_forward`).
- Per-build limit violations return a 400.
- A completed delete in `provisionerdserver`, or an orphan delete in the builder, clears the workspace's values and keeps the rows.

</details>

---

*Created by Coder Agents on behalf of @Emyrk.*
 2026-10-15 14:20:44 -05:00
Spike Curtis 5cd67a418d chore: johnstcn -> mafredri as code owner for protobufs (#30852) 
Replace Cian with maf as a code owner for our protobufs.
 2026-10-15 21:08:22 +02:00
Steven Masley 58a71f6238 feat(enterprise/dbcrypt): encrypt workspace secrets (#30249) 
Encrypts workspace secret values at rest with the existing database encryption keys, and adds workspace secrets to the `coder server dbcrypt` commands. Part of [RELAY-7](https://linear.app/codercom/issue/RELAY-7/agent-relay-deliver-provider-credentials-via-coder-secrets-instead-of).

**Stack** (design decisions in #30248)
1. #30248 Database schema, queries, and RBAC
2. **#30249 Encryption at rest (this PR)**
3. #30250 Set secrets on workspace builds
4. #30251 Deliver secrets to the agent
5. #30252 Docs
6. #30388 List a build's secrets
7. #30459 Audit a build's secrets

- Values are encrypted when a secret is written and decrypted when it is read.
- `dbcrypt rotate` and `dbcrypt decrypt` re-encrypt or decrypt workspace secrets, 1,000 at a time.
- `dbcrypt delete` clears workspace secret values instead of deleting the rows, so build history is kept.

<details>
<summary>Implementation details</summary>

- `InsertWorkspaceSecret` and `UpdateEncryptedWorkspaceSecretValue` encrypt, and `ListActiveWorkspaceSecrets` and `GetWorkspaceSecrets` decrypt. Only live rows reach these paths, so there is no NULL handling.
- Rotate and decrypt page through `GetWorkspaceSecrets` by `id`, so memory is bounded on large deployments. Only live rows are listed, about one set per workspace.
- If a build clears a row between the list and the update, the update matches no row and that row is skipped.
- Secret size limits count stored ciphertext bytes, the same as user secrets. Fixing that for both is tracked in #30441.

</details>

---

*Created by Coder Agents on behalf of @Emyrk.*
 2026-10-15 14:01:16 -05:00
Dmitry Makovey d36c1535d5 fix: bump Go version from 1.26.5 to 1.26.9 (#30807) 
Bump the Go toolchain from 1.26.5 to 1.26.9 ([released
2026-10-02](https://go.dev/doc/devel/release#go1.26.9)).

Tracked in Linear:
[ENT-210](https://linear.app/codercom/issue/ENT-210/ironbank-critical-bump-go-to-1269-fix-by-2026-10-29).
Iron Bank fix-by date for the Critical finding is **2026-10-29**.

Go 1.26.9 includes fixes for the findings Iron Bank reported against
`coder/coder-enterprise/coder-service-2:2.38.0`. Of the 19 still-valid
advisories, 12 are only fixed in 1.26.9, including the Critical one:

- Critical: [GO-2026-6612](https://pkg.go.dev/vuln/GO-2026-6612) /
CVE-2026-78663 (HTTP/2 server double flow-control refund)
- High: GO-2026-6603, -6605, -6607, -6608, -6609, -6610, -6611, -6613
- Low: GO-2026-6599, -6600, -6617

The other 7 (GO-2026-5026, -5942, -6088, -6089, -6090 High; -6091, -6218
Medium) are fixed since 1.26.6. The full list with links is in ENT-210.

## Changes

Same file set as #27157:

- `go.mod`: `go 1.26.5` to `go 1.26.9`
- `mise.toml` / `mise.lock`: Go toolchain pin and the archive URLs and
SHA-256 checksums for each platform (taken from the official `go.dev/dl`
release list)

## Verification

- `go build ./enterprise/cmd/coder` with go1.26.9 succeeds; `go mod tidy
-diff` is clean.
- `govulncheck -mode binary` on the resulting binary reports none of the
19 advisories above. The same scan of the released 2.38.0 binary
(go1.26.5) reports all 19.

## Not in this PR

`golang.org/x/net` v0.60.0 (the module-side half of GO-2026-6603, -6610,
-6611, -6612 and -6617) is already on `main` via #30772 and is
backported to the release branches in #30814 (2.38), #30815 (2.37),
#30816 (2.36), #30817 (2.35) and #30818 (2.34), tracked in
[ENT-211](https://linear.app/codercom/issue/ENT-211/ironbank-critical-bump-golangorgxnet-to-v0600-on-release-branches-fix).
The Go 1.27.1 bump (#30288) stays a separate, larger change. Go
backports: #30808 (2.38), #30809 (2.37), #30810 (2.36), #30813 (2.35),
#30811 (2.34).

Opened by Superblink on behalf of @droopy4096.
 2026-10-15 11:58:14 -07:00
Nick Vigilante 9eba637584 docs(docs/ai-coder/agents): reformat to one sentence per line (#30700) 
Reformats the Coder Agents docs under `docs/ai-coder/agents` to one
sentence per line, as the [docs style
guide](https://github.com/coder/coder/blob/main/docs/.style/style-guide/formatting.md#one-sentence-per-line)
requires. Hard-wrapped paragraphs are unwrapped and lines holding
several sentences are split, so a later edit to one sentence shows up as
a one-line diff.

Apart from the exception below, only whitespace inside paragraphs and
list items changes, and the rendered pages are the same. Comparing the
changed files against `main` word for word, ignoring whitespace and
blockquote `>` markers, finds differences only on the reworded lines.
`git diff --word-diff` is easier to read than the line diff.

59 lines that already contained an em or en dash were reworded by hand,
because `lint/emdash` treats every reflowed line as newly added. Each
uses a parenthetical, a separate sentence, or a colon after a lead-in.
Dashes on lines the reflow did not touch are left alone.

Applied with an in-progress formatter, limited to pages listed in
`docs/manifest.json` and excluding generated reference docs. This is one
of a batch of PRs that split the docs by area (21 files changed, 870
insertions(+), 1294 deletions(-)).

---
🤖 Built with AI assistance.
 2026-10-15 14:38:40 -04:00
Steven Masley 7aef110ca2 feat: add workspace secrets table, queries, and RBAC (#30248) 
Adds the database table, queries, and permissions for workspace secrets: secrets set on a workspace build and delivered to the agent, never to Terraform. 

Each secret belongs to one workspace build. A new build copies the previous build's secrets, then the old copies lose their values but stay as history.
 2026-10-15 13:32:40 -05:00
coder[bot]andDmitry Makovey 17ec9459c0 fix(scripts/dogfood): pass GO_LINT_NEW_CODE_BASE to the image lint run (#30851) 
Fixes the `build_image (26.04)` failure in the `dogfood` workflow on PRs
into `main` (seen on #30807). Tracked in
[ENT-213](https://linear.app/codercom/issue/ENT-213).

## Problem

`lint/go/new-code` (added in #30622) runs `.golangci.new-code.yaml` with
`--new-from-merge-base=$(GO_LINT_NEW_CODE_BASE)`, which defaults to
`origin/main`. `ci.yaml` sets `GO_LINT_NEW_CODE_BASE` to `HEAD^1` for
PRs and `HEAD` otherwise. `scripts/dogfood/test_image.sh` doesn't pass
it into the container, and the dogfood checkout (depth 2) has no
`origin/main`. So `make lint` inside the image reports the whole tree
(1263 issues: errcheck 437, forbidigo 42, nolintlint 784) and fails
"Test image tooling".

Pushes to `main` run the same validation before pushing the image, so
the next dogfood-triggering merge to `main` would also fail and skip the
Docker Hub push.

## Change

`scripts/dogfood/test_image.sh` only:

- Under GitHub Actions, and when `GO_LINT_NEW_CODE_BASE` isn't already
set, default it to `HEAD^1` for `pull_request` and `HEAD` otherwise,
mirroring `ci.yaml`.
- Forward it into the container with `--env GO_LINT_NEW_CODE_BASE`.
- Local runs are unchanged: the variable stays unset unless you set it,
so the Makefile default (`origin/main`) applies.

This PR touches `scripts/dogfood/**`, which triggers the `dogfood`
workflow, so its own `build_image (26.04)` run is the end-to-end test.

Opened by Superblink on behalf of @droopy4096.

Co-authored-by: coder[bot] <137810501+coder[bot]@users.noreply.github.com>
Co-authored-by: Dmitry Makovey <dmakovey@yahoo.com>
 2026-10-15 11:11:10 -07:00
Nick Vigilante c6a47c4428 docs: replace references to the retired Enterprise license tier (#30853) 
## Summary

Coder has only Community and Premium license tiers, but several docs
pages, CLI help strings, and SDK field comments still called features
"Enterprise" or "enterprise-only".
This PR changes them to say Premium and regenerates the reference docs
built from those strings.

Resolves
[DOCS-1298](https://linear.app/codercom/issue/DOCS-1298/remove-references-to-the-retired-enterprise-license-tier).

## Changes

- `docs/admin/users/quotas.md`: Replace "scoped to Groups in Enterprise
and organizations in Premium" with a correct sentence. Quotas are
Premium, allowances are set on groups, and each user's budget is
calculated separately in each organization (per
`GetQuotaAllowanceForUser`).
- `docs/user-guides/workspace-lifecycle.md`: Replace "Enterprise" with
Premium, and correct the quotas sentence to match the quotas page.
- `docs/ai-coder/agents/platform-controls/mcp-servers.md`: Replace
"enterprise entitlement" with Premium license.
- `cli/templatecreate.go`, `cli/templateedit.go`: Update
`--require-active-version`, `--allow-user-autostart`, and
`--allow-user-autostop` help text. Point the `--require-active-version`
help at the renamed `#template-update-policies` section, because the old
`#require-automatic-updates-enterprise` anchor is broken. Make the
errors for these flags tier-neutral.
- `enterprise/cli/features.go`: `coder features` now says "List license
features and entitlements", and its AGPL error no longer names a tier.
- `codersdk/templates.go`, `codersdk/organizations.go`: Update field
comments that feed the API reference and TypeScript types.
- `docs/reference/glossary.md`: The Premium entry now says "paid license
tier" instead of "paid enterprise tier".
- `docs/.style/style-guide/voice-and-tone.md`: The example sentence now
says "Premium licensing".
- Regenerated: CLI golden files, `docs/reference/cli/`,
`docs/manifest.json`, `docs/manifest/generated/cli.json`,
`docs/reference/api/`, `coderd/apidoc/`, and
`site/src/api/typesGenerated.ts`.

## Testing

- `go test ./cli -run 'TestCommandHelp|TestCliTemplateCreate'` and `go
test ./enterprise/cli -run
'TestEnterpriseCommandHelp|TestTemplateCreate|TestTemplateEdit|TestFeaturesList'`
pass.
- The pre-commit hook passed, including `make gen`, `fmt`, `lint/go`,
`lint/ts`, `lint/markdown`, and a slim build.

<details>
<summary>Decisions and out-of-scope items</summary>

### Decisions

- **Premium wording and legacy Enterprise licenses:** Coder still
accepts existing Enterprise licenses, and `FeatureSetEnterprise`
includes the features labeled Premium here. Docs and help text say
"Premium" because that is the tier sold today, and about 25 other docs
pages already use "Premium feature". Error strings are tier-neutral, so
they're accurate for every license holder.
- **Glossary and style guide:** The issue marked these as borderline.
Both were one-word changes, so I made them.

### Not changed

- `docs/reference/api/enterprise.md` keeps the "Enterprise" sidebar
title. It comes from the swagger tag on the `enterprise/` Go package, so
renaming it is a larger change.
- Other "Enterprise" references the review flagged as out of scope: the
`coder server --help` option group, quiet hours SDK comments, internal
`coderd` comments, and the dashboard's "Enterprise" badge on the
require-active-version option.
- No docs page says that legacy Enterprise licenses are still valid.
- Uses that don't refer to the license tier: GitHub Enterprise, Red Hat
Enterprise Linux, "enterprise environments", and `enterprise/` package
paths.

</details>

---

_This PR was generated by Coder Agents on behalf of @nickvigilante._
 2026-10-15 17:46:05 +00:00
Nick Vigilante 4ae1b7bd28 docs(docs/user-guides): fix tab block class typo on the remote desktops page (#30862) 
## Summary

The VNC section of the Remote desktops page opened its nested tab block
with `<div class="tab">` instead of `<div class="tabs">`.

The new docs site converts only `class="tabs"` blocks into tabs, so
**Coder Desktop** and **CLI** rendered as `<h4>` headings directly under
the `## VNC` heading. The outer tab's **Desktop Client** label isn't a
heading, so the page skipped from h2 to h4, and axe reports
`heading-order`.

This was the only occurrence of the typo in `docs/`.

## QA

| Page | Production | Expected after merge |
| --- | --- | --- |
| Remote desktops, VNC section | [beta-docs
@main](https://coder.com/beta-docs/@main/user-guides/workspace-access/remote-desktops/#vnc)
| **Coder Desktop** and **CLI** render as tabs inside **Desktop
Client**, with no h4 headings |

The default version on beta-docs (v2.37.4) has the same typo, so the fix
shows there only after the next release.

A docs-engine change that warns on `class="tab"` at build time is
tracked separately.

Linear:
[DOCS-1306](https://linear.app/codercom/issue/DOCS-1306/fix-div-classtab-typo-that-leaves-stray-h4-headings-on-remote-desktops)

---

🤖 Built with AI assistance.
 2026-10-15 13:33:27 -04:00
Nick Vigilante 0dc36786de docs(docs/.style): add compliance-claims wording rule to the style guide (DOCS-1256) (#30778) 
Adds a "Describe what Coder does, not compliance outcomes" rule to the
docs style guide's word-choice page, so writers and reviewers have one
place for compliance-claim wording.

- The rule says to describe Coder's controls, not the reader's
compliance status, and to back every certification, audit, validation,
or authorization claim with a current artifact.
- A Do/Don't table covers SOC 2, ISO/IEC 27001, FIPS 140-3, FedRAMP and
DoD Impact Levels, DISA STIG, Iron Bank, CMMC, HIPAA, GDPR, DORA, and
the AI Act, with the reason behind each entry.
- The style guide README coverage counts move from 79 to 80 rules (Word
choice: 17 rules, 10 planned), and the Vale README lists the planned
`Coder.ComplianceClaims` rule.

Resolves DOCS-1256.

<details>
<summary>Decision log</summary>

- **Self-contained phrasing.** The approved phrasing comes from an
internal assessment that can't be linked from public docs, so the rule
states each term directly instead of pointing to it.
- **Facts checked before writing:**
- The AICPA issues no SOC 2 certificate; a CPA firm issues an
attestation report.
- ISO doesn't certify; a certification body certifies a management
system within a scope.
- CMVP validates modules under a certificate number; FIPS 140-2
certificates moved to the Historical list in September 2026.
- FedRAMP authorizes cloud service offerings, which a self-hosted
deployment isn't.
  - CMMC certifies organizations; HIPAA has no certification program.
- **Scope limits:** protocol conformance ("specification-compliant OIDC
provider") and sentences where the reader is the subject stay allowed,
so the planned lint rule doesn't flag them.
- **Enforcement:** the footer marks `Coder.ComplianceClaims` as planned.
The Vale rule itself is separate work.
- Checks: `make lint/style-claims`, `markdownlint-cli2`, `vale`,
`check_emdash.sh`, and the pre-commit hook pass locally.

</details>

<details>
<summary>CI note: Storybook failure is unrelated</summary>

The `Storybook` job failed when the Pixel snapshot service marked its
build as failed (31 snapshots awaiting review). This PR changes only
Markdown under `docs/.style/` and touches no `site/` code or stories.

</details>

---

_Generated by Coder Agents on behalf of @nickvigilante._
 2026-10-15 11:33:15 -04:00
Nick Vigilante 1f61a290e7 docs(docs/ai-coder): reformat AI Gateway client and Agent Firewall docs to one sentence per line (#30702) 
Reformats the AI Gateway client and proxy docs, the Agent Firewall docs,
and the top-level pages under `docs/ai-coder` to one sentence per line,
as the [docs style
guide](https://github.com/coder/coder/blob/main/docs/.style/style-guide/formatting.md#one-sentence-per-line)
requires. Hard-wrapped paragraphs are unwrapped and lines holding
several sentences are split, so a later edit to one sentence shows up as
a one-line diff.

Apart from the exception below, only whitespace inside paragraphs and
list items changes, and the rendered pages are the same. Comparing the
changed files against `main` word for word, ignoring whitespace and
blockquote `>` markers, finds differences only on the reworded lines.
`git diff --word-diff` is easier to read than the line diff.

1 lines that already contained an em or en dash were reworded by hand,
because `lint/emdash` treats every reflowed line as newly added. Each
uses a parenthetical, a separate sentence, or a colon after a lead-in.
Dashes on lines the reflow did not touch are left alone.

Applied with an in-progress formatter, limited to pages listed in
`docs/manifest.json` and excluding generated reference docs. This is one
of a batch of PRs that split the docs by area (27 files changed, 414
insertions(+), 513 deletions(-)).

---
🤖 Built with AI assistance.
 2026-10-15 15:31:32 +00:00
Nick Vigilante c58ac71ca3 docs(docs/tutorials): reformat to one sentence per line (#30703) 
Reformats the tutorials under `docs/tutorials` to one sentence per line,
as the [docs style
guide](https://github.com/coder/coder/blob/main/docs/.style/style-guide/formatting.md#one-sentence-per-line)
requires. Hard-wrapped paragraphs are unwrapped and lines holding
several sentences are split, so a later edit to one sentence shows up as
a one-line diff.

Apart from the exception below, only whitespace inside paragraphs and
list items changes, and the rendered pages are the same. Comparing the
changed files against `main` word for word, ignoring whitespace and
blockquote `>` markers, finds differences only on the reworded lines.
`git diff --word-diff` is easier to read than the line diff.

9 lines that already contained an em or en dash were reworded by hand,
because `lint/emdash` treats every reflowed line as newly added. Each
uses a parenthetical, a separate sentence, or a colon after a lead-in.
Dashes on lines the reflow did not touch are left alone. The two reverse
proxy tutorials also write `*.coder.example.com` in backticks instead of
escaping the asterisk, which the formatter would otherwise drop.

Applied with an in-progress formatter, limited to pages listed in
`docs/manifest.json` and excluding generated reference docs. This is one
of a batch of PRs that split the docs by area (19 files changed, 656
insertions(+), 1265 deletions(-)).

---
🤖 Built with AI assistance.
 2026-10-15 11:24:40 -04:00
Atif Ali c85ebc1346 fix: make workspace create denials on behalf of another user actionable (#30537) 
Creating a workspace for another user as a caller without permission
returned the same 403 as creating your own: "You are unable to create a
workspace in this organization. It is possible to have access to the
template, but not be able to create a workspace." For service accounts
and integrations that always create for someone else, that doesn't say
who the workspace was for, which organization, or what to do about it.

When the caller is not the owner, the two 403s now say what is missing
and for whom. Messages and details only; status codes and authorization
are unchanged, and self-creates keep their existing text.

Missing create permission:

> You can't create workspaces for other users in this organization.
> Creating a workspace for "alice" needs permission to create workspaces
owned by other users in organization "coder", which your account doesn't
have. Use an account with that permission (for example an organization
admin), or create the workspace as "alice".

Missing `use` on the template:

> You can't use the template "demo" to create workspaces for other
users.
> Creating a workspace for "alice" from this template needs "use" access
to template "demo", which your account doesn't have. Ask a template
admin to grant it, or use an account that has it.

`preflightWorkspaceCreate` now receives the caller's ID and the owner
(name included) instead of just the owner ID. `coder create` prints the
detail already, and the web UI shows it through `ErrorAlert`.

**How it renders**

Web UI (create page, `ErrorAlert`):

<img width="2592" height="1490" alt="Web UI error for creating a
workspace on behalf of another user"
src="https://github.com/user-attachments/assets/9b1f1378-e4df-40df-8b6f-ca6cccdc4238"
/>

CLI (`coder create alice/ws1 --template demo` as a plain member):

```
error: Trace=[create workspace: ]
You can't create workspaces for other users in this organization.
Creating a workspace for "alice" needs permission to create workspaces owned by other users in organization "coder", which your account doesn't have. Use an account with that permission (for example an organization admin), or create the workspace as "alice".
```

Refs PLAT-726. Related owner-state inconsistencies are tracked in
PLAT-749.
 2026-10-15 17:27:13 +05:00
cdrciandgithub-actions[bot] 7e69cd0af7 chore: refresh AI model price book (#30828) 
## Price book changes

0 models added, 0 models removed, 24 models changed.

<details>
<summary>Changed</summary>

- openrouter/deepseek/deepseek-v4-pro
- openrouter/deepseek/deepseek-v4-pro-0813
- openrouter/deepseek/deepseek-v4.1-flash
- openrouter/google/gemma-4-31b-it
- openrouter/minimax/minimax-m2.5
- openrouter/mistralai/mistral-small-3.2-24b-instruct
- openrouter/moonshotai/kimi-k3
- openrouter/openai/gpt-5.6-sol
- openrouter/openai/gpt-5.6-sol-pro
- openrouter/openai/gpt-oss-120b
- openrouter/qwen/qwen3.6-35b-a3b
- openrouter/qwen/qwen3.8-27b
- openrouter/tencent/hy3
- openrouter/tencent/hy4-preview
- openrouter/z-ai/glm-5
- openrouter/z-ai/glm-5.1
- openrouter/z-ai/glm-5.2
- openrouter/z-ai/glm-5.3
- openrouter/~deepseek/deepseek-flash-latest
- openrouter/~deepseek/deepseek-pro-latest
- openrouter/~google/gemini-pro-latest
- openrouter/~moonshotai/kimi-latest
- openrouter/~z-ai/glm-flash-latest
- openrouter/~z-ai/glm-latest
</details>

## Review notes

Regenerated by `make gen/aibridge-prices` from the live
[models.dev](https://models.dev) catalog. Both artifacts come from one
snapshot, so they ship together:

- `coderd/aibridge/prices/data/prices.json`
- `site/src/modules/aiModels/knownModels/knownModelsGenerated.json`

These are customer-visible cost numbers taken from upstream data, so
this PR is never merged automatically. The summary above lists what
moved; check the diff for exact figures before approving.

Opened automatically by the [aigateway-prices-refresh
workflow](https://github.com/coder/coder/actions/runs/38710433812).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-10-15 12:01:26 +01:00
Ethan aef7f15510 fix(coderd/x/chatd): only retry without drop_block when it's rejected (#30821) 
In #29792, once a provider and model had accepted `drop_block`, any 400
on a request with it retried once without it, since I didn't know what
error a provider returns for an unsupported beta. That turned out to
hide real errors. On dogfood, a chat replaying some very tall
screenshots hit Anthropic's many-image limit:

```
messages.9.content.43.image.source.base64.data: At least one of the image dimensions exceed max allowed size for many-image requests: 3000 pixels
```

The retry without `drop_block` then hit the stale thinking block, so the
chat failed with the binding error instead, and the image error only
showed up in a warn log.

To fix, we'll only retry without `drop_block` when the 400 is a known
rejection of the field or its beta, and otherwise return the error as is
and keep the hint. The catch is that if a provider rejects the beta with
an error we don't recognise, chats on that model will see it until a
restart clears the hint, rather than us recovering.

Claude Code (as of 2.1.300) does the same on Anthropic's own API, Claude
Platform on AWS included: it only retries without the beta when the 400
names it or the `block_binding` field. On Bedrock, Vertex and Mantle it
also retries on any 400 it doesn't otherwise recognise, which we could
copy if that catch turns out to matter.

The oversized screenshots are a separate problem, since chatd doesn't
resize images at all.
 2026-10-15 14:39:21 +11:00
Andrew Aquino 1d57682dab fix: give buttons accessible names (#30796) 
Fixes the axe `button-name` (WCAG 4.1.2) findings from the Deque audit:

- fixes DEQ-431
- fixes DEQ-456
- fixes DEQ-101 (duplicate of DEQ-456)
- fixes DEQ-138

affected buttons:

- **Workspace sharing role selects** (DEQ-431, DEQ-456, DEQ-101): Radix
Select triggers render `role="combobox"`, and ARIA doesn't let a
combobox take its name from its content. That's why the visible
"Use"/"Admin" text didn't count. Each member row's select is now named
`Role for <member>`. The add-member form's select is named `Role`.
- **Agent logs "Copy selected logs" button** (DEQ-138): the icon-only
button had a name only in its tooltip. It now has `sr-only` text,
matching the download button next to it.

Adds Vitest coverage in `WorkspaceSharingForm.test.tsx`. The test finds
each select by its accessible name and checks that changing the role
calls the update callback. It fails without the fix.

<details>
<summary>Implementation notes and review decisions</summary>

**Mapping axe selectors to components**

- DEQ-431: `form > div > button:nth-child(2)` is `RoleSelectField` in
`AddWorkspaceUserOrGroup`.
- DEQ-456 / DEQ-101: `table > tbody > tr > td:nth-child(2) > button` is
`RoleSelect` in `WorkspaceSharingForm`.
- DEQ-138: `section:nth-child(3)` (agent card logs section) `> … >
div:nth-child(2) > button:nth-child(1)` is the copy button in the
`AgentRow` logs toolbar. `data-state="closed"` with no `aria-expanded`
means it's a Tooltip trigger.

**Justified findings from the frontend review (`frontend-deep-review`
and `frontend-review`)**

- FE1/TS5, no Vitest for the copy button: rendering `AgentRow` with
streamed logs needs the proxy context and websocket log fixtures. The
change only adds an `sr-only` label. I removed a story `play` assertion
that I'd first added, because FE1 bans assertions in `play` functions.
- FE6, label-in-name (WCAG 2.5.3): the combobox's visible text is its
*value* ("Use"/"Admin"), not its label. The visible label is the "Role"
column header, and the accessible names include it. Screen readers still
announce the value from the trigger's content.
- Not changed: the copy button's tooltip switches to "Copied!" but
screen readers hear no announcement. That was already the case before
this PR, and it's a different WCAG criterion (4.1.3), so it's out of
scope here.

**Checks run:** `pnpm check`, `pnpm lint:types`, `pnpm lint`, the unit
tests, the `AgentRow` / `WorkspaceSharingPage` / `WorkspaceActions`
story tests, and `make pre-commit`.

</details>

---

_Generated by Coder Agents on behalf of @aqandrew._
 2026-10-14 15:58:33 -07:00
Bobby Ho 603dd420d1 feat: add ServerTailnet logs and metrics for unreachable agents (#30133) 
Add default-level metrics and warn-level diagnostics to investigate
ServerTailnet reachability failures causing agent-specific 502s, without
restarting coderd or enabling debug logging.

- Enrich request logs and PTY/chatd warnings with agent ID, failure
  reason, wait duration, coordinator state, WireGuard handshake and
  byte counts, and DERP regions.
- Add metrics for unreachable attempts by reason, reachability latency,
  embedded DERP connections, and offline app/terminal requests.
- Distinguish reachability failures from subsequent TCP dial failures,
  cap reverse proxy dials at one minute, and exclude expected chatd
  readiness polls and superseded-agent dials from unreachable counts.
- Report missing handshakes as zero time instead of 1970, also fixing
  `coder ping`.

Part of PLAT-680, a sub-issue of PLAT-360.
 2026-10-14 14:55:29 -07:00
dependabot[bot] 609c5b95fb chore: bump github.com/moby/sys/user from 0.4.0 to 0.4.1 (#30534) 
Bumps [github.com/moby/sys/user](https://github.com/moby/sys) from 0.4.0
to 0.4.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/moby/sys/releases">github.com/moby/sys/user's
releases</a>.</em></p>
<blockquote>
<h2>mountinfo v0.4.1</h2>
<p>Fixes and improvements:</p>
<ul>
<li>Fix PrefixFilter() being too greedy (<a
href="https://redirect.github.com/moby/sys/issues/61">#61</a>)</li>
<li>TestMountedBy*: add missing pre-checks
(ce8f425e79a74602c4055fb1776f38043d56827b)</li>
<li>Documentation improvements (<a
href="https://redirect.github.com/moby/sys/issues/52">#52</a>)</li>
</ul>
<h2>user/v0.4.1</h2>
<h2>What's Changed</h2>
<ul>
<li>user: prevent possible DoS via unbounded parsing of user and group
database files in CVE-2026-61801 / <a
href="https://github.com/moby/sys/security/advisories/GHSA-mjcv-p78q-w5fw">GHSA-mjcv-p78q-w5fw</a>.
This fixes a similar issue as CVE-2026-47262 in containerd.</li>
<li>user: prevent falling back to looking up numeric usernames and
improve handling of numeric user/group to prevent looking up numeric
values as usernames. This fixes a similar issue as CVE-2026-46680 in
containerd. <a
href="https://redirect.github.com/moby/sys/pull/221">moby/sys#221</a></li>
<li>user: bump Go to 1.18, modernize <a
href="https://redirect.github.com/moby/sys/pull/198">moby/sys#198</a></li>
<li>user: make code a bit more DRY <a
href="https://redirect.github.com/moby/sys/pull/225">moby/sys#225</a></li>
<li>user: test cleanups <a
href="https://redirect.github.com/moby/sys/pull/226">moby/sys#226</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/moby/sys/compare/user/v0.4.0...user/v0.4.1">https://github.com/moby/sys/compare/user/v0.4.0...user/v0.4.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/moby/sys/commit/85a71bbe1faa36c552a960e6a5f3d0cfb632fbbe"><code>85a71bb</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/moby/sys/commit/2c56c3d5d089bfa66d01b6c0bb69428e9d5d18c5"><code>2c56c3d</code></a>
user: limit line length in ParseGroupFilter</li>
<li><a
href="https://github.com/moby/sys/commit/bba2f13154cb607bfbc7e209f8d9100ef4000329"><code>bba2f13</code></a>
user: limit reads from user database files</li>
<li><a
href="https://github.com/moby/sys/commit/ee79b0e8cbbf36c26a182e94e0ec41c5c1c09c34"><code>ee79b0e</code></a>
Merge pull request <a
href="https://redirect.github.com/moby/sys/issues/221">#221</a> from
thaJeztah/limit_uidgid</li>
<li><a
href="https://github.com/moby/sys/commit/6eb9f1533f265128f3172f26319ac4ec337e2cdc"><code>6eb9f15</code></a>
user: GetAdditionalGroups: treat numeric group arguments as GIDs
only</li>
<li><a
href="https://github.com/moby/sys/commit/c66bd2df666e11742905d01b82273f8a1db1be0c"><code>c66bd2d</code></a>
user: prevent falling back to looking up numeric usernames</li>
<li><a
href="https://github.com/moby/sys/commit/c87335998b73cbe3ecbf4bb8372e3118edb8e835"><code>c873359</code></a>
Merge pull request <a
href="https://redirect.github.com/moby/sys/issues/226">#226</a> from
thaJeztah/user_test_cleanups</li>
<li><a
href="https://github.com/moby/sys/commit/f41a5ef1732cf3793717f6b0ff126116ddde8874"><code>f41a5ef</code></a>
Merge pull request <a
href="https://redirect.github.com/moby/sys/issues/225">#225</a> from
thaJeztah/user_dry</li>
<li><a
href="https://github.com/moby/sys/commit/5c2e8a01a7ce7f2456dbcd706173161e035d4df5"><code>5c2e8a0</code></a>
user: add test-cases for maxID (math.MaxInt32)</li>
<li><a
href="https://github.com/moby/sys/commit/e001aea433c246e3011c4f3bdab96a209f194510"><code>e001aea</code></a>
user: use sub-tests</li>
<li>Additional commits viewable in <a
href="https://github.com/moby/sys/compare/user/v0.4.0...user/v0.4.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/moby/sys/user&package-manager=go_modules&previous-version=0.4.0&new-version=0.4.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/coder/coder/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-14 20:39:44 +00:00
Michael Suchacz e7c2fd5d2e feat: add Gemini 4 Argon to Agents and AI Gateway (#30780) 
Add Gemini 4 Argon to the Agents known models catalog, so it appears as
a suggestion when an admin adds a chat model, and regenerate the AI
Gateway price book from models.dev.

| Provider | Model ID | Placed before |
|---|---|---|
| google | `gemini-4-argon` | `gemini-3.1-pro-preview` |
| openrouter, vercel | `google/gemini-4-argon` |
`google/gemini-3.8-flash` |

**Pricing.** The price book carries Google's launch rates on google,
openrouter, vercel, and copilot: $2 per 1M input tokens, $10 per 1M
output tokens, and $0.10 per 1M cached input tokens. Google doubles them
on 2026-12-01 ($4, $20, $0.20); the weekly refresh picks that up once
models.dev changes. The google entry keeps models.dev's 32,768 max
output tokens, the cap Google enforces on non-streaming
`generateContent` calls (larger values return HTTP 400 there).

**Thinking levels.** `googleSupportedThinkingLevels` did not recognize
the `argon` name token and failed closed, so chatd sent Argon no
`thinking_level` and no `include_thoughts`: the native Google path
dropped the reasoning effort, and neither path showed thought summaries.
Argon accepts LOW, MEDIUM, and HIGH like Gemini 3.1 Pro and rejects
MINIMAL, so the map now treats it like the Pro family.

**Upstream drift.** `prices.json` covers every model of its 8 providers,
so the regeneration also brings the changes since the last weekly
refresh, all on OpenRouter and Vercel: 14 other new entries, 26 entries
models.dev delisted, and 51 price changes. The catalog picks up the same
changes for 8 curated OpenRouter entries (DeepSeek, Kimi, Qwen, and
GLM).

## Testing

- Live requests to `gemini-4-argon` through the AI Gateway's Google
provider (Google's OpenAI-compatible endpoint): `reasoning_effort` and
`thinking_level` values `low`, `medium`, and `high` return 200 and
`minimal` returns 400; `include_thoughts` returns thought text in
streaming and non-streaming responses.
- Red-green: removing the `argon` token fails
`TestGoogleSupportedThinkingLevels/gemini-4-argon` (expected LOW,
MEDIUM, HIGH; got nil).
- Regenerating from the saved models.dev snapshot reproduces both
generated files byte for byte.
- `go test ./scripts/aibridgepricesgen/... ./coderd/aibridge/prices/...
./coderd/x/chatd/chatprovider/...` and `pnpm exec vitest run
--project=unit src/modules/aiModels/` pass. The pre-commit hook passed;
local pre-push checks were skipped, so CI is the first full run.

## Review record

- Frontend review: the only `site/` change is the generated
`knownModelsGenerated.json`, so the FE1 to FE10 checklist does not
apply; no hand-written frontend code changed.

> Xum opened this PR on behalf of @ibetitsmike.
 2026-10-14 22:39:00 +02:00
Bobby Ho 11f1ee7d9f ci: fail the test process with a heap profile when memory passes a per-runner limit (#30487) 
test: add memory guard and heap profiles for CI timeouts

Add a memory guard to `cli`, `agent`, and `enterprise/cli` to diagnose
recurring macOS `test-go-pg` timeouts. Recent logs show runaway memory
usage and heavy swapping, but the allocation source remains unknown.

- Check Go runtime memory once per second, with per-process CI limits
  of 5 GiB on macOS and 6 GiB on Linux and Windows. Disabled when
  `CODER_TEST_MEMORY_LIMIT_MIB` is unset.
- On exceeding the limit, save a heap profile, attempt a second profile
  after forced GC with a five-second wait limit, then panic with memory
  usage, profile paths, and all goroutine stacks.
- Upload heap profiles from unsuccessful CI jobs on every OS, retaining
  them for seven days.
- Test guard lifecycle, environment parsing, panic diagnostics, profile
  validity, and post-GC allocation attribution. Validate with race
  tests, vet, lint, and a manual macOS test.

Refs https://linear.app/codercom/issue/PLAT-251/flake-test-go-pg-macos-job-timeoutcancelled
Refs https://github.com/coder/internal/issues/1365
 2026-10-14 12:32:49 -07:00
Nick Vigilante c647260901 docs(docs/ai-coder/ai-gateway): reformat to one sentence per line (#30701) 
Reformats the AI Gateway docs directly under `docs/ai-coder/ai-gateway`
to one sentence per line, as the [docs style
guide](https://github.com/coder/coder/blob/main/docs/.style/style-guide/formatting.md#one-sentence-per-line)
requires. Hard-wrapped paragraphs are unwrapped and lines holding
several sentences are split, so a later edit to one sentence shows up as
a one-line diff.

Apart from the exception below, only whitespace inside paragraphs and
list items changes, and the rendered pages are the same. Comparing the
changed files against `main` word for word, ignoring whitespace and
blockquote `>` markers, finds differences only on the reworded lines.
`git diff --word-diff` is easier to read than the line diff.

4 lines that already contained an em or en dash were reworded by hand,
because `lint/emdash` treats every reflowed line as newly added. Each
uses a parenthetical, a separate sentence, or a colon after a lead-in.
Dashes on lines the reflow did not touch are left alone.

Applied with an in-progress formatter, limited to pages listed in
`docs/manifest.json` and excluding generated reference docs. This is one
of a batch of PRs that split the docs by area (10 files changed, 395
insertions(+), 570 deletions(-)).

---
🤖 Built with AI assistance.
 2026-10-14 15:24:49 -04:00
Andrew Aquino 4f7bddb640 fix(site/src/pages/TemplateBuilder): use a radio group for module category filters (#30523) 
Fixes the axe `aria-valid-attr-value` violation reported in DEQ-288 on
the template builder's "Select modules" step.

The category filters were Radix `Tabs` with no `TabsContent`. Radix
`TabsTrigger` always sets `aria-controls` to `<baseId>-content-<value>`,
so the active "All" trigger pointed at an id that did not exist. (axe
skips `aria-controls` on tabs with `aria-selected="false"`, which is why
only the active one was flagged.)

The categories filter the same grid as the search field, so they are not
tabs and there is no panel per category. They now render as a Radix
`RadioGroup` (`role="radiogroup"` with `role="radio"` / `aria-checked`
items) labelled "Filter modules by category". Arrow keys move focus and
check the item, following the APG radio pattern. Keyboard focus shows
the same ring as `TabLink`. The styling matches the previous tabs;
computed colors, borders, padding, and positions are identical. The
shared `#/components/RadioGroup` wrapper renders a dot indicator, so
this uses the Radix primitive directly.

The `useKebabMenu` call is removed with the tabs. It was never wired up
here (no measure props and no overflow menu rendered), and the row
already wraps.

Verification:
- Ran axe-core 4.11 against the `Default` and `FilteredByCategory`
stories. On `main` it reports `aria-valid-attr-value` on
`#radix-…-trigger-All`. On this branch that violation is gone. The
remaining `nested-interactive` and `target-size` findings come from
`ModuleCard` and are out of scope.
- Keyboard check in Playwright: Tab lands on the checked radio,
ArrowRight/ArrowLeft check the adjacent category and filter the grid,
and Tab leaves the group in one stop. The focus ring shows on keyboard
focus only, not on mouse click.
- `pnpm test:storybook` for `ModuleSelectStep.stories.tsx` (5 passed),
`pnpm lint:types`, `pnpm check`, `pnpm lint`.

> 🤖 This PR was generated by Coder Agents on behalf of @aqandrew.
 2026-10-14 11:47:12 -07:00
Nick Vigilante 1872b183ee docs(docs/admin): reformat setup and integrations docs to one sentence per line (#30704) 
Reformats the setup and integrations docs under `docs/admin/setup` and
`docs/admin/integrations` to one sentence per line, as the [docs style
guide](https://github.com/coder/coder/blob/main/docs/.style/style-guide/formatting.md#one-sentence-per-line)
requires. Hard-wrapped paragraphs are unwrapped and lines holding
several sentences are split, so a later edit to one sentence shows up as
a one-line diff.

Apart from the exception below, only whitespace inside paragraphs and
list items changes, and the rendered pages are the same. Comparing the
changed files against `main` word for word, ignoring whitespace and
blockquote `>` markers, finds differences only on the reworded lines.
`git diff --word-diff` is easier to read than the line diff.

1 lines that already contained an em or en dash were reworded by hand,
because `lint/emdash` treats every reflowed line as newly added. Each
uses a parenthetical, a separate sentence, or a colon after a lead-in.
Dashes on lines the reflow did not touch are left alone.

Applied with an in-progress formatter, limited to pages listed in
`docs/manifest.json` and excluding generated reference docs. This is one
of a batch of PRs that split the docs by area (25 files changed, 380
insertions(+), 572 deletions(-)).

---
🤖 Built with AI assistance.
 2026-10-14 14:29:20 -04:00
dependabot[bot] 238a476e9a chore: bump github.com/hashicorp/terraform-json from 0.28.0 to 0.29.0 (#30774) 
Bumps
[github.com/hashicorp/terraform-json](https://github.com/hashicorp/terraform-json)
from 0.28.0 to 0.29.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/hashicorp/terraform-json/releases">github.com/hashicorp/terraform-json's
releases</a>.</em></p>
<blockquote>
<h2>v0.29.0</h2>
<p>ENHANCEMENTS:</p>
<ul>
<li>version: Allow parsing of a <code>format_version</code> field, added
in Terraform 1.17 (<a
href="https://redirect.github.com/hashicorp/terraform-json/pull/208">#208</a>)</li>
<li>Add <code>init_output</code> log type for use when parsing logs from
the <code>init</code> command (<a
href="https://redirect.github.com/hashicorp/terraform-json/pull/181">#181</a>)</li>
<li>logging: Add support for <code>state migrate</code> message types
(<a
href="https://redirect.github.com/hashicorp/terraform-json/pull/210">#210</a>)</li>
<li>Add support for JSON output from <code>workspace list</code> command
(<a
href="https://redirect.github.com/hashicorp/terraform-json/pull/198">#198</a>)</li>
<li>Enable parsing <code>state_store_initialization_start</code> JSON
log message from <code>init</code> command (<a
href="https://redirect.github.com/hashicorp/terraform-json/pull/212">#212</a>)</li>
</ul>
<p>BUG FIXES:</p>
<ul>
<li>Avoid panic in <code>(WorkspaceListOutput) CurrentWorkspace</code>
if no workspaces are listed (<a
href="https://redirect.github.com/hashicorp/terraform-json/pull/214">#214</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/hashicorp/terraform-json/commit/8f4894d138d0fe71436cba6dbc8f16577e9a9e7d"><code>8f4894d</code></a>
fix: Avoid panic in <code>(WorkspaceListOutput) CurrentWorkspace</code>
if no workspaces...</li>
<li><a
href="https://github.com/hashicorp/terraform-json/commit/540e4c2dd221e4b115258ea0a3a8c8fc24bb3b03"><code>540e4c2</code></a>
test: Enable parsing <code>state_store_initialization_start </code> JSON
message, add te...</li>
<li><a
href="https://github.com/hashicorp/terraform-json/commit/456fd358731ed4d6fc2e30f6e6a12d6532761682"><code>456fd35</code></a>
refactor: Rename JSON message type constants to use <code>Message</code>
prefix in name ...</li>
<li><a
href="https://github.com/hashicorp/terraform-json/commit/ebdaf2c44e73a2f66e3e048dc6b9b73846a8a7bd"><code>ebdaf2c</code></a>
logging: Add support for <code>state migrate</code> message types (<a
href="https://redirect.github.com/hashicorp/terraform-json/issues/210">#210</a>)</li>
<li><a
href="https://github.com/hashicorp/terraform-json/commit/5a1ca9230975ec15a9885e4a35b755646fda3028"><code>5a1ca92</code></a>
Add support for JSON output from <code>workspace list</code> (<a
href="https://redirect.github.com/hashicorp/terraform-json/issues/198">#198</a>)</li>
<li><a
href="https://github.com/hashicorp/terraform-json/commit/e0b680713a97433a2b3aff9395516bded146210b"><code>e0b6807</code></a>
feat: Add <code>init_output</code> log type for use when parsing a
subset of logs from t...</li>
<li><a
href="https://github.com/hashicorp/terraform-json/commit/1835ed6fbee33db47013369b2f0dff44655894ef"><code>1835ed6</code></a>
version: Allow parsing of a format_version field, added in v1.17 (<a
href="https://redirect.github.com/hashicorp/terraform-json/issues/208">#208</a>)</li>
<li><a
href="https://github.com/hashicorp/terraform-json/commit/f4ef9969cba17897dc68940e97b0f3f203807630"><code>f4ef996</code></a>
build(deps): bump actions/checkout from 7.0.0 to 7.0.1 in the
github-actions-...</li>
<li><a
href="https://github.com/hashicorp/terraform-json/commit/4a96b30be8a74ee37652aebdaadfbeefaab2de52"><code>4a96b30</code></a>
build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 in the
github-actions-...</li>
<li>See full diff in <a
href="https://github.com/hashicorp/terraform-json/compare/v0.28.0...v0.29.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/hashicorp/terraform-json&package-manager=go_modules&previous-version=0.28.0&new-version=0.29.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-14 18:09:54 +00:00
Nick Vigilante ed6a8441dc docs(docs/user-guides): reformat to one sentence per line (#30705) 
Reformats the user guides under `docs/user-guides` to one sentence per
line, as the [docs style
guide](https://github.com/coder/coder/blob/main/docs/.style/style-guide/formatting.md#one-sentence-per-line)
requires. Hard-wrapped paragraphs are unwrapped and lines holding
several sentences are split, so a later edit to one sentence shows up as
a one-line diff.

Apart from the exception below, only whitespace inside paragraphs and
list items changes, and the rendered pages are the same. Comparing the
changed files against `main` word for word, ignoring whitespace and
blockquote `>` markers, finds differences only on the reworded lines.
`git diff --word-diff` is easier to read than the line diff.

7 lines that already contained an em or en dash were reworded by hand,
because `lint/emdash` treats every reflowed line as newly added. Each
uses a parenthetical, a separate sentence, or a colon after a lead-in.
Dashes on lines the reflow did not touch are left alone.

Applied with an in-progress formatter, limited to pages listed in
`docs/manifest.json` and excluding generated reference docs. This is one
of a batch of PRs that split the docs by area (29 files changed, 715
insertions(+), 1068 deletions(-)).

---
🤖 Built with AI assistance.
 2026-10-14 14:04:33 -04:00
Nick Vigilante 935e076210 docs: delete unlisted pages and their screenshots (#30758) 
Deletes seven docs files and 10 screenshots that are not in the docs
manifest and are superseded or empty:

- `docs/about/why-coder.md`: a TODO stub. The one link to it, a "Do"
example in the style guide, now names its source in plain text.
- `docs/tutorials/example-guide.md`: a contributor template with no
inbound links. Its guidance is recorded in DOCS-1207 for a tutorial
section in `contributing/documentation.md`, which is still to write.
- `docs/start/first-template.md` and six step 6 screenshots in
`docs/images/templates/`. Content is cataloged in DOCS-1209 for the
Templates landing page.
- `docs/start/first-workspace.md` and three screenshots in
`docs/images/start/`. Content is cataloged in DOCS-1208 for the
Workspaces landing page.
- `docs/start/local-deploy.md` and `docs/images/start/setup-page.png`.
Redundant with `get-started/` and `install/cli.md`.

The deleted files stay recoverable at `adcce66826`.

This replaces #30710, #30711, #30712, #30713 and #30714, which are
closed in favor of this PR.

Linear: DOCS-1205, DOCS-1206, DOCS-1207, DOCS-1211, DOCS-1212. Related:
DOCS-1208, DOCS-1209.

I ran `lint/docs-html`, `lint/docs-manifest`, `lint/docs-redirects` and
`lint/emdash` locally.

> Generated by Coder Agents on behalf of @nickvigilante.
 2026-10-14 14:03:58 -04:00
dependabot[bot] 63e5a6eb2c chore: bump google.golang.org/api from 0.300.0 to 0.301.0 (#30770) 
Bumps
[google.golang.org/api](https://github.com/googleapis/google-api-go-client)
from 0.300.0 to 0.301.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's
releases</a>.</em></p>
<blockquote>
<h2>v0.301.0</h2>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.300.0...v0.301.0">0.301.0</a>
(2026-10-07)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3754">#3754</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/ebafad334e2218c37dbbcc267219e338fbd0d056">ebafad3</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3756">#3756</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/e85ebac72dd7e12c538a14f6e2b8a1c83f9872b9">e85ebac</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3759">#3759</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/267f7a8c8e539f21e64b696686bb9476bf0c5ef0">267f7a8</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3760">#3760</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/282280c028412560d8c259c0e5ce80cd3c16d624">282280c</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3761">#3761</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/3f7eebf8a548d20db29fa5c654f2de96c4f8db14">3f7eebf</a>)</li>
<li><strong>option/internaloption:</strong> Add
EnableDirectPathXdsOverInterconnect (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3742">#3742</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/9bda4c115cedcef9f5938378563e04592f56fe18">9bda4c1</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.300.0...v0.301.0">0.301.0</a>
(2026-10-07)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3754">#3754</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/ebafad334e2218c37dbbcc267219e338fbd0d056">ebafad3</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3756">#3756</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/e85ebac72dd7e12c538a14f6e2b8a1c83f9872b9">e85ebac</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3759">#3759</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/267f7a8c8e539f21e64b696686bb9476bf0c5ef0">267f7a8</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3760">#3760</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/282280c028412560d8c259c0e5ce80cd3c16d624">282280c</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3761">#3761</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/3f7eebf8a548d20db29fa5c654f2de96c4f8db14">3f7eebf</a>)</li>
<li><strong>option/internaloption:</strong> Add
EnableDirectPathXdsOverInterconnect (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3742">#3742</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/9bda4c115cedcef9f5938378563e04592f56fe18">9bda4c1</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/22cea49978ad0d51b64d4ec4a193fb477400fac4"><code>22cea49</code></a>
chore(main): release 0.301.0 (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3755">#3755</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/3f7eebf8a548d20db29fa5c654f2de96c4f8db14"><code>3f7eebf</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3761">#3761</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/6fa455aa97d4db710919bd387b95015f8e179537"><code>6fa455a</code></a>
chore(all): update all to v7 (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3758">#3758</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/282280c028412560d8c259c0e5ce80cd3c16d624"><code>282280c</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3760">#3760</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/9bda4c115cedcef9f5938378563e04592f56fe18"><code>9bda4c1</code></a>
feat(option/internaloption): add EnableDirectPathXdsOverInterconnect (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3742">#3742</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/52cd18f7989503b45c5c2a43e4b7a5a00de02e76"><code>52cd18f</code></a>
chore(all): update all (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3757">#3757</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/267f7a8c8e539f21e64b696686bb9476bf0c5ef0"><code>267f7a8</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3759">#3759</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/e85ebac72dd7e12c538a14f6e2b8a1c83f9872b9"><code>e85ebac</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3756">#3756</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/ebafad334e2218c37dbbcc267219e338fbd0d056"><code>ebafad3</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3754">#3754</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/81143a2b633c2b7885760150ace96573acfba373"><code>81143a2</code></a>
chore: embargo generation of integrations:v2 (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3753">#3753</a>)</li>
<li>See full diff in <a
href="https://github.com/googleapis/google-api-go-client/compare/v0.300.0...v0.301.0">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-14 18:02:55 +00:00
dependabot[bot] f4dcbf01aa chore: bump github.com/brianvoe/gofakeit/v7 from 7.17.0 to 7.18.0 (#30773) 
Bumps
[github.com/brianvoe/gofakeit/v7](https://github.com/brianvoe/gofakeit)
from 7.17.0 to 7.18.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/brianvoe/gofakeit/commit/cda0d12f40c422ea813591ec3b01ab0666e4cf84"><code>cda0d12</code></a>
datetime - added addtional compensation for date formatting</li>
<li><a
href="https://github.com/brianvoe/gofakeit/commit/dcfd43a768864284a1189378578fe8068ef38f54"><code>dcfd43a</code></a>
Merge pull request <a
href="https://redirect.github.com/brianvoe/gofakeit/issues/400">#400</a>
from 00200200/fix/struct-time-unpadded-format</li>
<li><a
href="https://github.com/brianvoe/gofakeit/commit/0843461ed662b8e04c07fee66b310e2c89ff7383"><code>0843461</code></a>
Limit unpadded date fallback and assert calendar boundaries</li>
<li><a
href="https://github.com/brianvoe/gofakeit/commit/77d7e48aff92482afeeac0bd5e405386cef98a4d"><code>77d7e48</code></a>
Fix struct time field parsing with unpadded date formats</li>
<li><a
href="https://github.com/brianvoe/gofakeit/commit/0edecf3ab8e582cb6fb63216e64634ff524624a2"><code>0edecf3</code></a>
Merge pull request <a
href="https://redirect.github.com/brianvoe/gofakeit/issues/399">#399</a>
from jakezwang/fix/finite-float-range-overflow</li>
<li><a
href="https://github.com/brianvoe/gofakeit/commit/f0bf10be1e11d82fc33018316543501cd6086f88"><code>f0bf10b</code></a>
Fix finite float ranges with overflowing spans</li>
<li><a
href="https://github.com/brianvoe/gofakeit/commit/0cd394dc8cc283909974bbe729d376322d83929c"><code>0cd394d</code></a>
Merge pull request <a
href="https://redirect.github.com/brianvoe/gofakeit/issues/398">#398</a>
from aykhans/docs/add-missing-readme-functions</li>
<li><a
href="https://github.com/brianvoe/gofakeit/commit/d2376abf9a9b97002fdf2c73789e9b8e6275e90a"><code>d2376ab</code></a>
docs: add missing functions to README</li>
<li>See full diff in <a
href="https://github.com/brianvoe/gofakeit/compare/v7.17.0...v7.18.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/brianvoe/gofakeit/v7&package-manager=go_modules&previous-version=7.17.0&new-version=7.18.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-14 18:02:17 +00:00
dependabot[bot] 1657112b33 ci: bump the github-actions group with 4 updates (#30776) 
Bumps the github-actions group with 4 updates:
[step-security/harden-runner](https://github.com/step-security/harden-runner),
[actions/upload-artifact](https://github.com/actions/upload-artifact),
[fluxcd/flux2/action](https://github.com/fluxcd/flux2) and
[linear/linear-release-action](https://github.com/linear/linear-release-action).

Updates `step-security/harden-runner` from 2.21.1 to 2.22.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/step-security/harden-runner/releases">step-security/harden-runner's
releases</a>.</em></p>
<blockquote>
<h2>v2.22.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Fixed security rules not initializing on GHES self-hosted
runners</li>
<li>Fixed GHES connectivity in block mode by implicitly allowing the
GHES hostname</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/step-security/harden-runner/compare/v2.22.0...v2.22.1">https://github.com/step-security/harden-runner/compare/v2.22.0...v2.22.1</a></p>
<h2>v2.22.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Linux ARM64 support for community tier</li>
<li>GHES support for self-hosted VMs (enterprise tier)</li>
<li>MacOS and Windows runner deny list support for block policy
(enterprise tier).</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/step-security/harden-runner/compare/v2.21.1...v2.22.0">https://github.com/step-security/harden-runner/compare/v2.21.1...v2.22.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/step-security/harden-runner/commit/ccd8616d44fd3846e67624a50d5aad6d37bf2d25"><code>ccd8616</code></a>
Merge pull request <a
href="https://redirect.github.com/step-security/harden-runner/issues/704">#704</a>
from h0x0er/jatin/ghes-endp</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/037ccfd0b8acd0743d7ce4b3e53f67dc16f831b9"><code>037ccfd</code></a>
implicitly add ghes endpoint in allowList</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/e7438c7b4d9fde75004beb1805ca407c067d5340"><code>e7438c7</code></a>
Merge pull request <a
href="https://redirect.github.com/step-security/harden-runner/issues/703">#703</a>
from h0x0er/jatin/ghes-codebuild-fixes</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/afb0b33c8978810916155d52997450fe76eea40a"><code>afb0b33</code></a>
fixes for armour rules not getting initialised</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/351661ca32ac09a36dc5ee2d536e3128f2a3c8ed"><code>351661c</code></a>
Merge pull request <a
href="https://redirect.github.com/step-security/harden-runner/issues/701">#701</a>
from step-security/rc-44</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/1dc7f2e42d1e949acb71b995cb46ef39bcf6ee43"><code>1dc7f2e</code></a>
Merge pull request <a
href="https://redirect.github.com/step-security/harden-runner/issues/702">#702</a>
from h0x0er/jatin/ghes-changes-up</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/af5ca3847fec87ec2d45ed150d07fe3afaca39e4"><code>af5ca38</code></a>
simplified ghes config creation</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/9a6d710958b49c0266ea466f1d9505af191114fa"><code>9a6d710</code></a>
fix2</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/74c65eac851c4c0546996bb406adcf91e6dd97c4"><code>74c65ea</code></a>
fix</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/ceac8169ef2b77fd1324abbf8bae8edd2d6d3199"><code>ceac816</code></a>
resovled comments</li>
<li>Additional commits viewable in <a
href="https://github.com/step-security/harden-runner/compare/e14015d583714f6e62063499dc959a02595150a1...ccd8616d44fd3846e67624a50d5aad6d37bf2d25">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/upload-artifact` from 7.0.1 to 7.0.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/upload-artifact/releases">actions/upload-artifact's
releases</a>.</em></p>
<blockquote>
<h2>v7.0.2</h2>
<h2>What's Changed</h2>
<ul>
<li>Improves artifact download retries when the service returns HTTP 429
(rate limiting), including honoring valid Retry-After headers.</li>
<li>Updates <code>@​actions/artifact</code> to v6.3.1.</li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/tunc-d"><code>@​tunc-d</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/upload-artifact/pull/821">actions/upload-artifact#821</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2">https://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/upload-artifact/commit/cf430e030ddbb5b0abf93d22962f4752f3646cd9"><code>cf430e0</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/upload-artifact/issues/822">#822</a>
from actions/tunc-d-prepare-upload-v7-0-2</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/c2acdedd35a8824a1552c7137f8c18288c3ea469"><code>c2acded</code></a>
chore: prepare v7.0.2 release</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/4687c1bbaa0a58abb517d90b4bbade6754c80c1a"><code>4687c1b</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/upload-artifact/issues/821">#821</a>
from actions/tunc-d-upload-artifact-package-bump</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/8cbe1bebdb858105d8fdd88f81404d4de4595719"><code>8cbe1be</code></a>
Bump <code>@​actions/artifact</code> to 6.3.1</li>
<li>See full diff in <a
href="https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9">compare
view</a></li>
</ul>
</details>
<br />

Updates `fluxcd/flux2/action` from 2.9.5 to 2.9.6
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/fluxcd/flux2/releases">fluxcd/flux2/action's
releases</a>.</em></p>
<blockquote>
<h2>v2.9.6</h2>
<h2>Highlights</h2>
<p>Flux v2.9.6 is a patch release that stops helm-controller from
reapplying chart CRDs on every upgrade when server-side apply is
enabled, and recovers HelmReleases left with a drifted
<code>Ready=Unknown</code> condition after a failed status patch.
source-controller normalizes Azure Blob listing ETags so unchanged
containers are no longer re-downloaded on every reconcile, and evicts
stale Helm repository index entries from the cache so repositories with
frequently changing indexes no longer fail with &quot;Cache is
full&quot;. kustomize-controller extends SOPS decryption error redaction
to <code>spec.postBuild.substituteFrom</code> values, so substituted
secrets echoed back in API validation errors are masked out of status
conditions and events, and adds the opt-in
<code>DisableCommitStatusEvent</code> feature gate. Users are encouraged
to upgrade for the best experience.</p>
<p>ℹ️ Please follow the <a
href="https://github.com/fluxcd/flux2/discussions/5572">Upgrade
Procedure for Flux v2.7+</a> for a smooth upgrade from Flux v2.6 to the
latest version.</p>
<p>Fixes:</p>
<ul>
<li>Stop reapplying chart CRDs on upgrades when using server-side apply
with the default <code>Create</code> policy (helm-controller)</li>
<li>Recover HelmReleases stranded with a drifted
<code>Ready=Unknown</code> condition after a failed status patch
(helm-controller)</li>
<li>Ignore <code>NotFound</code> when deleting the HelmChart
(helm-controller)</li>
<li>Normalize Azure Blob listing ETags so unchanged containers are not
re-downloaded on every reconcile (source-controller)</li>
<li>Evict stale Helm repository index entries from the cache to avoid
&quot;Cache is full&quot; errors (source-controller)</li>
<li>Extend SOPS decryption error redaction to
<code>spec.postBuild.substituteFrom</code> values
(kustomize-controller)</li>
</ul>
<p>Improvements:</p>
<ul>
<li>Add the opt-in <code>DisableCommitStatusEvent</code> feature gate
(kustomize-controller)</li>
</ul>
<h2>Components changelog</h2>
<ul>
<li>source-controller <a
href="https://github.com/fluxcd/source-controller/blob/v1.9.6/CHANGELOG.md">v1.9.6</a></li>
<li>kustomize-controller <a
href="https://github.com/fluxcd/kustomize-controller/blob/v1.9.6/CHANGELOG.md">v1.9.6</a></li>
<li>helm-controller <a
href="https://github.com/fluxcd/helm-controller/blob/v1.6.5/CHANGELOG.md">v1.6.5</a></li>
</ul>
<h2>CLI changelog</h2>
<ul>
<li>[release/v2.9.x] Format reproducible created timestamp in UTC by <a
href="https://github.com/fluxcdbot"><code>@​fluxcdbot</code></a> in <a
href="https://redirect.github.com/fluxcd/flux2/pull/6081">fluxcd/flux2#6081</a></li>
<li>Update toolkit components by <a
href="https://github.com/fluxcdbot"><code>@​fluxcdbot</code></a> in <a
href="https://redirect.github.com/fluxcd/flux2/pull/6097">fluxcd/flux2#6097</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/fluxcd/flux2/compare/v2.9.5...v2.9.6">https://github.com/fluxcd/flux2/compare/v2.9.5...v2.9.6</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/fluxcd/flux2/commit/b9c17924adb533d3617ec7de97a7b0f4acc07b39"><code>b9c1792</code></a>
Merge pull request <a
href="https://redirect.github.com/fluxcd/flux2/issues/6097">#6097</a>
from fluxcd/update-components-release/v2.9.x</li>
<li><a
href="https://github.com/fluxcd/flux2/commit/847c02bb967a9021af601762cefab103a01acbd6"><code>847c02b</code></a>
Update toolkit components</li>
<li><a
href="https://github.com/fluxcd/flux2/commit/5156dee7c62dde24752a3317dbdf6e089e6e15eb"><code>5156dee</code></a>
Merge pull request <a
href="https://redirect.github.com/fluxcd/flux2/issues/6098">#6098</a>
from fluxcd/update-pkg-deps/release/v2.9.x</li>
<li><a
href="https://github.com/fluxcd/flux2/commit/c2437feed91b522a3d4f607e5c4d08111898b315"><code>c2437fe</code></a>
Update fluxcd/pkg dependencies</li>
<li><a
href="https://github.com/fluxcd/flux2/commit/0a66b4a91da048b159f2c1c925013922ed4c4e1c"><code>0a66b4a</code></a>
Merge pull request <a
href="https://redirect.github.com/fluxcd/flux2/issues/6081">#6081</a>
from fluxcd/backport-6074-to-release/v2.9.x</li>
<li><a
href="https://github.com/fluxcd/flux2/commit/d3ab1f61604076f8bda82e7f3cab93db249e0711"><code>d3ab1f6</code></a>
Format reproducible created timestamp in UTC</li>
<li>See full diff in <a
href="https://github.com/fluxcd/flux2/compare/dd233c4fadef306a62b7893204f8e3817fecc2b2...b9c17924adb533d3617ec7de97a7b0f4acc07b39">compare
view</a></li>
</ul>
</details>
<br />

Updates `linear/linear-release-action` from 0.18.0 to 0.18.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/linear/linear-release-action/releases">linear/linear-release-action's
releases</a>.</em></p>
<blockquote>
<h2>v0.18.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Support release descriptions in the GitHub Action by <a
href="https://github.com/duong-vu"><code>@​duong-vu</code></a> in <a
href="https://redirect.github.com/linear/linear-release-action/pull/71">linear/linear-release-action#71</a></li>
<li>Skip the automatic GitHub token on GitHub Enterprise runners by <a
href="https://github.com/RomainCscn"><code>@​RomainCscn</code></a> in <a
href="https://redirect.github.com/linear/linear-release-action/pull/72">linear/linear-release-action#72</a></li>
<li>Verify CLI installs against committed checksums by <a
href="https://github.com/RomainCscn"><code>@​RomainCscn</code></a> in <a
href="https://redirect.github.com/linear/linear-release-action/pull/73">linear/linear-release-action#73</a></li>
<li>Release v0.18.1 by <a
href="https://github.com/RomainCscn"><code>@​RomainCscn</code></a> in <a
href="https://redirect.github.com/linear/linear-release-action/pull/74">linear/linear-release-action#74</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/duong-vu"><code>@​duong-vu</code></a>
made their first contribution in <a
href="https://redirect.github.com/linear/linear-release-action/pull/71">linear/linear-release-action#71</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/linear/linear-release-action/compare/v0.18.0...v0.18.1">https://github.com/linear/linear-release-action/compare/v0.18.0...v0.18.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/linear/linear-release-action/commit/30f9ae77461ec29f07fffe0c52edd1909bfbb6f5"><code>30f9ae7</code></a>
Release v0.18.1 (<a
href="https://redirect.github.com/linear/linear-release-action/issues/74">#74</a>)</li>
<li><a
href="https://github.com/linear/linear-release-action/commit/8db66b644c0bffd50aaa89b51c8eae0120f94b87"><code>8db66b6</code></a>
Verify CLI installs against committed checksums (<a
href="https://redirect.github.com/linear/linear-release-action/issues/73">#73</a>)</li>
<li><a
href="https://github.com/linear/linear-release-action/commit/65ed0ec8b3bdc6823789a0d3f361120d932c54ac"><code>65ed0ec</code></a>
Skip the automatic GitHub token on GitHub Enterprise runners (<a
href="https://redirect.github.com/linear/linear-release-action/issues/72">#72</a>)</li>
<li><a
href="https://github.com/linear/linear-release-action/commit/bc513a9e552e26d94d6e885af2f6c02f7a16c800"><code>bc513a9</code></a>
Add release description input to action (<a
href="https://redirect.github.com/linear/linear-release-action/issues/71">#71</a>)</li>
<li>See full diff in <a
href="https://github.com/linear/linear-release-action/compare/d4af10092984f9bc6d5efa075b242bdf01333463...30f9ae77461ec29f07fffe0c52edd1909bfbb6f5">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-14 18:01:59 +00:00
dependabot[bot] 710584c1bc chore: bump github.com/prometheus/client_golang from 1.24.1 to 1.25.0 (#30775) 
Bumps
[github.com/prometheus/client_golang](https://github.com/prometheus/client_golang)
from 1.24.1 to 1.25.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/prometheus/client_golang/releases">github.com/prometheus/client_golang's
releases</a>.</em></p>
<blockquote>
<h2>v1.25.0</h2>
<p>⚠️ This release raises the minimum required Go version to 1.26
and includes breaking API changes in <code>api/prometheus/v1</code> (see
the [CHANGE] entries below). ⚠️</p>
<h2>1.25.0 / 2026-10-07</h2>
<ul>
<li>[CHANGE] Minimum required Go version is now 1.26, only the two
latest Go versions (1.26 and 1.27) are supported from now on. <a
href="https://redirect.github.com/prometheus/client_golang/issues/2138">#2138</a></li>
<li>[CHANGE] api/prometheus/v1: <code>Query</code>,
<code>QueryRange</code>, <code>Series</code>, <code>LabelNames</code>,
and <code>LabelValues</code> now return <code>Infos</code> annotations
in addition to <code>Warnings</code>, matching the Prometheus server's
info annotations. This changes the signatures of these methods and of
<code>api.Client</code>'s <code>Do</code>/<code>DoGetFallback</code>;
custom API client implementations must be updated. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1963">#1963</a></li>
<li>[CHANGE] api/prometheus/v1: Rework <code>TSDBBlocks</code> result
types to align with the Prometheus server's <code>tsdb.BlockMeta</code>:
<code>TSDBBlocksResult</code> now contains <code>Blocks
[]TSDBBlockMeta</code> directly instead of mirroring the full API
envelope, nested types are renamed (<code>TSDBBlockMeta</code>,
<code>TSDBBlockStats</code>, <code>TSDBBlockMetaCompaction</code>), stat
fields are <code>uint64</code> with <code>omitempty</code> tags, and the
optional compaction <code>parents</code> field is included. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1928">#1928</a></li>
<li>[FEATURE] testutil: Add <code>GatherAndFormat</code> to encode a
subset of metrics from a Gatherer. <a
href="https://redirect.github.com/prometheus/client_golang/issues/2091">#2091</a></li>
<li>[FEATURE] promhttp: Add <code>HandlerOpts.AcceptedFormats</code> to
customize the formats negotiated from the incoming <code>Accept</code>
header, enabling opt-in to experimental formats such as OpenMetrics 2.0
without changing default negotiation. <a
href="https://redirect.github.com/prometheus/client_golang/issues/2146">#2146</a></li>
<li>[ENHANCEMENT] promhttp: Negotiated metrics responses now include a
<code>Vary</code> header. <a
href="https://redirect.github.com/prometheus/client_golang/issues/2142">#2142</a></li>
<li>[ENHANCEMENT] prometheus: Regenerate the default runtime collector
metrics for Go 1.25 and Go 1.26. <a
href="https://redirect.github.com/prometheus/client_golang/issues/2090">#2090</a>,
<a
href="https://redirect.github.com/prometheus/client_golang/issues/2095">#2095</a></li>
<li>[ENHANCEMENT] testutil: Finalize OpenMetrics output in
<code>GatherAndFormat</code> and <code>CollectAndFormat</code>
(terminating <code># EOF</code>). <a
href="https://redirect.github.com/prometheus/client_golang/issues/2125">#2125</a></li>
<li>[BUGFIX] api: Match complete URL path placeholders only; a
<code>:foo</code> argument no longer substitutes inside
<code>:foobar</code>. <a
href="https://redirect.github.com/prometheus/client_golang/issues/2136">#2136</a></li>
<li>[BUGFIX] exp/api/remote: Reset the pooled buffer before generic
proto marshaling, preventing corrupted remote-write payloads. <a
href="https://redirect.github.com/prometheus/client_golang/issues/2139">#2139</a></li>
<li>[BUGFIX] testutil/promlint: Fix &quot;mibi&quot; unit prefix to
&quot;mebi&quot;. <a
href="https://redirect.github.com/prometheus/client_golang/issues/2135">#2135</a></li>
</ul>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<ul>
<li>fix: Remove unneeded and broken CI badge by <a
href="https://github.com/bwplotka"><code>@​bwplotka</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/2057">prometheus/client_golang#2057</a></li>
<li>Synchronize common files from prometheus/prometheus by <a
href="https://github.com/prombot"><code>@​prombot</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/2060">prometheus/client_golang#2060</a></li>
<li>build(deps): bump the codeql group with 4 updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/prometheus/client_golang/pull/2066">prometheus/client_golang#2066</a></li>
<li>build(deps): bump github.com/klauspost/compress from 1.19.0 to
1.19.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/prometheus/client_golang/pull/2071">prometheus/client_golang#2071</a></li>
<li>build(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 in the
golang-org-x group across 1 directory by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/prometheus/client_golang/pull/2069">prometheus/client_golang#2069</a></li>
<li>build(deps): bump github.com/klauspost/compress from 1.19.0 to
1.19.1 in /exp by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/prometheus/client_golang/pull/2072">prometheus/client_golang#2072</a></li>
<li>build(deps): bump github.com/prometheus/common from 0.69.0 to 0.70.1
in /exp by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/prometheus/client_golang/pull/2073">prometheus/client_golang#2073</a></li>
<li>build(deps): bump github.com/prometheus/common from 0.69.0 to 0.70.1
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/prometheus/client_golang/pull/2070">prometheus/client_golang#2070</a></li>
<li>build(deps): bump google.golang.org/grpc from 1.79.3 to 1.82.1 in
/tutorials/whatsup by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/prometheus/client_golang/pull/2075">prometheus/client_golang#2075</a></li>
<li>Pin GitHub Actions by <a
href="https://github.com/SuperQ"><code>@​SuperQ</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/2074">prometheus/client_golang#2074</a></li>
<li>build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/prometheus/client_golang/pull/2067">prometheus/client_golang#2067</a></li>
<li>promhttp: fix panic on requests with nil URL by <a
href="https://github.com/SAY-5"><code>@​SAY-5</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/2065">prometheus/client_golang#2065</a></li>
<li>Return info annotations in addition to warnings in the API by <a
href="https://github.com/zenador"><code>@​zenador</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1963">prometheus/client_golang#1963</a></li>
<li>build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/prometheus/client_golang/pull/2082">prometheus/client_golang#2082</a></li>
<li>Synchronize common files from prometheus/prometheus by <a
href="https://github.com/prombot"><code>@​prombot</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/2084">prometheus/client_golang#2084</a></li>
<li>Synchronize common files from prometheus/prometheus by <a
href="https://github.com/prombot"><code>@​prombot</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/2086">prometheus/client_golang#2086</a></li>
<li>Synchronize common files from prometheus/prometheus by <a
href="https://github.com/prombot"><code>@​prombot</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/2088">prometheus/client_golang#2088</a></li>
<li>Regenerate Go collector runtime metrics for Go 1.25 and Go 1.26 by
<a href="https://github.com/bwplotka"><code>@​bwplotka</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/2090">prometheus/client_golang#2090</a></li>
<li>go.mod: remove obsolete exclude rule by <a
href="https://github.com/thaJeztah"><code>@​thaJeztah</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/2077">prometheus/client_golang#2077</a></li>
<li>Synchronize common files from prometheus/prometheus by <a
href="https://github.com/prombot"><code>@​prombot</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/2093">prometheus/client_golang#2093</a></li>
<li>README: document the OpenTelemetry OTLP push bridge by <a
href="https://github.com/mvanhorn"><code>@​mvanhorn</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1987">prometheus/client_golang#1987</a></li>
<li>docs: add AGENTS.md contributor and maintainer guide by <a
href="https://github.com/bwplotka"><code>@​bwplotka</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/2056">prometheus/client_golang#2056</a></li>
<li>testutil: add GatherAndFormat helper by <a
href="https://github.com/wieghx"><code>@​wieghx</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/2091">prometheus/client_golang#2091</a></li>
<li>build(deps): bump the codeql group with 4 updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/prometheus/client_golang/pull/2101">prometheus/client_golang#2101</a></li>
<li>build(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/prometheus/client_golang/pull/2097">prometheus/client_golang#2097</a></li>
<li>build(deps): bump github.com/klauspost/compress from 1.19.1 to
1.19.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/prometheus/client_golang/pull/2098">prometheus/client_golang#2098</a></li>
<li>build(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12
in /exp by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/prometheus/client_golang/pull/2099">prometheus/client_golang#2099</a></li>
<li>build(deps): bump github.com/klauspost/compress from 1.19.1 to
1.19.2 in /exp by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/prometheus/client_golang/pull/2100">prometheus/client_golang#2100</a></li>
<li>build(deps): bump github.com/prometheus/procfs from 0.21.1 to 0.22.0
in the prometheus group across 1 directory by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/prometheus/client_golang/pull/2096">prometheus/client_golang#2096</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/prometheus/client_golang/blob/v1.25.0/CHANGELOG.md">github.com/prometheus/client_golang's
changelog</a>.</em></p>
<blockquote>
<h2>1.25.0 / 2026-10-07</h2>
<ul>
<li>[CHANGE] Minimum required Go version is now 1.26, only the two
latest Go versions (1.26 and 1.27) are supported from now on. <a
href="https://redirect.github.com/prometheus/client_golang/issues/2138">#2138</a></li>
<li>[CHANGE] api/prometheus/v1: <code>Query</code>,
<code>QueryRange</code>, <code>Series</code>, <code>LabelNames</code>,
and <code>LabelValues</code> now return <code>Infos</code> annotations
in addition to <code>Warnings</code>, matching the Prometheus server's
info annotations. This changes the signatures of these methods and of
<code>api.Client</code>'s <code>Do</code>/<code>DoGetFallback</code>;
custom API client implementations must be updated. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1963">#1963</a></li>
<li>[CHANGE] api/prometheus/v1: Rework <code>TSDBBlocks</code> result
types to align with the Prometheus server's <code>tsdb.BlockMeta</code>:
<code>TSDBBlocksResult</code> now contains <code>Blocks
[]TSDBBlockMeta</code> directly instead of mirroring the full API
envelope, nested types are renamed (<code>TSDBBlockMeta</code>,
<code>TSDBBlockStats</code>, <code>TSDBBlockMetaCompaction</code>), stat
fields are <code>uint64</code> with <code>omitempty</code> tags, and the
optional compaction <code>parents</code> field is included. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1928">#1928</a></li>
<li>[FEATURE] testutil: Add <code>GatherAndFormat</code> to encode a
subset of metrics from a Gatherer. <a
href="https://redirect.github.com/prometheus/client_golang/issues/2091">#2091</a></li>
<li>[FEATURE] promhttp: Add <code>HandlerOpts.AcceptedFormats</code> to
customize the formats negotiated from the incoming <code>Accept</code>
header, enabling opt-in to experimental formats such as OpenMetrics 2.0
without changing default negotiation. <a
href="https://redirect.github.com/prometheus/client_golang/issues/2146">#2146</a></li>
<li>[ENHANCEMENT] promhttp: Negotiated metrics responses now include a
<code>Vary</code> header. <a
href="https://redirect.github.com/prometheus/client_golang/issues/2142">#2142</a></li>
<li>[ENHANCEMENT] prometheus: Regenerate the default runtime collector
metrics for Go 1.25 and Go 1.26. <a
href="https://redirect.github.com/prometheus/client_golang/issues/2090">#2090</a>,
<a
href="https://redirect.github.com/prometheus/client_golang/issues/2095">#2095</a></li>
<li>[ENHANCEMENT] testutil: Finalize OpenMetrics output in
<code>GatherAndFormat</code> and <code>CollectAndFormat</code>
(terminating <code># EOF</code>). <a
href="https://redirect.github.com/prometheus/client_golang/issues/2125">#2125</a></li>
<li>[BUGFIX] api: Match complete URL path placeholders only; a
<code>:foo</code> argument no longer substitutes inside
<code>:foobar</code>. <a
href="https://redirect.github.com/prometheus/client_golang/issues/2136">#2136</a></li>
<li>[BUGFIX] exp/api/remote: Reset the pooled buffer before generic
proto marshaling, preventing corrupted remote-write payloads. <a
href="https://redirect.github.com/prometheus/client_golang/issues/2139">#2139</a></li>
<li>[BUGFIX] testutil/promlint: Fix &quot;mibi&quot; unit prefix to
&quot;mebi&quot;. <a
href="https://redirect.github.com/prometheus/client_golang/issues/2135">#2135</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/prometheus/client_golang/commit/0d88875bc7494ed8414e067756ff3399e3068c64"><code>0d88875</code></a>
Cut v1.25.0 (<a
href="https://redirect.github.com/prometheus/client_golang/issues/2164">#2164</a>)</li>
<li><a
href="https://github.com/prometheus/client_golang/commit/e9946ee846c4916ae4def4318b422b084aad687c"><code>e9946ee</code></a>
Cut v1.25.0-rc.0 (<a
href="https://redirect.github.com/prometheus/client_golang/issues/2154">#2154</a>)</li>
<li><a
href="https://github.com/prometheus/client_golang/commit/de866d63fa67a78f723397d33624b89a439dbe73"><code>de866d6</code></a>
Merge pull request <a
href="https://redirect.github.com/prometheus/client_golang/issues/2152">#2152</a>
from prometheus/dependabot/go_modules/api/prometheus...</li>
<li><a
href="https://github.com/prometheus/client_golang/commit/a37302f6f0677b61954ae08077c85221c21f4883"><code>a37302f</code></a>
prometheus: fix modernize lint findings (<a
href="https://redirect.github.com/prometheus/client_golang/issues/2151">#2151</a>)</li>
<li><a
href="https://github.com/prometheus/client_golang/commit/a3fa3807231bcb72fc56c10e65c72e1102013907"><code>a3fa380</code></a>
build(deps): bump google.golang.org/grpc</li>
<li><a
href="https://github.com/prometheus/client_golang/commit/9da3fcc7c7b60c0565771518ecb9043df23f286a"><code>9da3fcc</code></a>
fix: updates for tsdb blocks handling (<a
href="https://redirect.github.com/prometheus/client_golang/issues/1928">#1928</a>)</li>
<li><a
href="https://github.com/prometheus/client_golang/commit/0ecb5c28f53c957e8adabe6707ad8609641e50f0"><code>0ecb5c2</code></a>
api: match complete URL placeholders (<a
href="https://redirect.github.com/prometheus/client_golang/issues/2136">#2136</a>)</li>
<li><a
href="https://github.com/prometheus/client_golang/commit/2ad001aa7b446e3a245de21c0f397c57289d7d94"><code>2ad001a</code></a>
exp/api/remote: reset buffer before generic marshal (<a
href="https://redirect.github.com/prometheus/client_golang/issues/2139">#2139</a>)</li>
<li><a
href="https://github.com/prometheus/client_golang/commit/0db8d43ff97adbb75da10c57fceaf8fb8ee13d05"><code>0db8d43</code></a>
promhttp: vary negotiated metrics responses (<a
href="https://redirect.github.com/prometheus/client_golang/issues/2142">#2142</a>)</li>
<li><a
href="https://github.com/prometheus/client_golang/commit/b1f9c7a6cbb2cd6000042806b7f688cabb9d3771"><code>b1f9c7a</code></a>
Merge pull request <a
href="https://redirect.github.com/prometheus/client_golang/issues/2144">#2144</a>
from prometheus/dependabot/go_modules/exp/github.com...</li>
<li>Additional commits viewable in <a
href="https://github.com/prometheus/client_golang/compare/v1.24.1...v1.25.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/prometheus/client_golang&package-manager=go_modules&previous-version=1.24.1&new-version=1.25.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-14 17:43:48 +00:00
dependabot[bot] e129c7786c chore: bump github.com/shopspring/decimal from 1.4.0 to 1.5.0 (#30767) 
Bumps
[github.com/shopspring/decimal](https://github.com/shopspring/decimal)
from 1.4.0 to 1.5.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/shopspring/decimal/releases">github.com/shopspring/decimal's
releases</a>.</em></p>
<blockquote>
<h2>v1.5.0</h2>
<p><strong>Full Changelog</strong> can be found in <a
href="https://github.com/shopspring/decimal/blob/master/CHANGELOG.md">CHANGELOG.md</a>.
Please read its <strong>BEHAVIOR CHANGES</strong> section before
upgrading.</p>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/PauliusLozys"><code>@​PauliusLozys</code></a>
made their first contribution in <a
href="https://redirect.github.com/shopspring/decimal/pull/403">shopspring/decimal#403</a></li>
<li><a href="https://github.com/JohnAD"><code>@​JohnAD</code></a> made
their first contribution in <a
href="https://redirect.github.com/shopspring/decimal/pull/389">shopspring/decimal#389</a></li>
<li><a href="https://github.com/jtwatson"><code>@​jtwatson</code></a>
made their first contribution in <a
href="https://redirect.github.com/shopspring/decimal/pull/395">shopspring/decimal#395</a></li>
<li><a
href="https://github.com/c-tonneslan"><code>@​c-tonneslan</code></a>
made their first contribution in <a
href="https://redirect.github.com/shopspring/decimal/pull/425">shopspring/decimal#425</a></li>
<li><a href="https://github.com/Streppel"><code>@​Streppel</code></a>
made their first contribution in <a
href="https://redirect.github.com/shopspring/decimal/pull/414">shopspring/decimal#414</a></li>
<li><a href="https://github.com/orinnz"><code>@​orinnz</code></a> made
their first contribution in <a
href="https://redirect.github.com/shopspring/decimal/pull/438">shopspring/decimal#438</a></li>
<li><a
href="https://github.com/amitmishra11"><code>@​amitmishra11</code></a>
made their first contribution in <a
href="https://redirect.github.com/shopspring/decimal/pull/426">shopspring/decimal#426</a></li>
<li><a href="https://github.com/SashaMIT"><code>@​SashaMIT</code></a>
made their first contribution in <a
href="https://redirect.github.com/shopspring/decimal/pull/437">shopspring/decimal#437</a></li>
<li><a href="https://github.com/jakezwang"><code>@​jakezwang</code></a>
made their first contribution in <a
href="https://redirect.github.com/shopspring/decimal/pull/433">shopspring/decimal#433</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/shopspring/decimal/blob/master/CHANGELOG.md">github.com/shopspring/decimal's
changelog</a>.</em></p>
<blockquote>
<h2>Decimal v1.5.0</h2>
<h4>BEHAVIOR CHANGES</h4>
<ul>
<li><code>NewFromString</code> and <code>UnmarshalBinary</code>, and so
JSON, text, SQL, gob and Spanner decoding, reject exponents larger than
the new <code>MaxDecodeExponent</code> setting (default 10,000). Such
input could hang the process or use gigabytes of memory. Raise
<code>MaxDecodeExponent</code> if you need larger exponents <a
href="https://redirect.github.com/shopspring/decimal/pull/440">#440</a></li>
<li><code>Pow</code>, <code>PowWithPrecision</code>,
<code>PowInt32</code> and <code>PowBigInt</code> round correctly.
Results for fractional exponents have
<code>PowPrecisionNegativeExponent</code> (16) decimal places, and
negative powers that used to return 0 keep 16 significant digits, so
<code>10^-18</code> is <code>0.000000000000000001</code>. Results too
large to represent return an error, or 0 from <code>Pow</code>, instead
of hanging or panicking <a
href="https://redirect.github.com/shopspring/decimal/pull/439">#439</a></li>
<li><code>RoundUp</code>, <code>RoundDown</code>, <code>RoundCeil</code>
and <code>RoundFloor</code> always return exponent <code>-places</code>,
like <code>Round</code>. Values don't change, but
<code>Exponent()</code>, <code>Coefficient()</code> and
<code>String()</code> with <code>TrimTrailingZeros = false</code> can <a
href="https://redirect.github.com/shopspring/decimal/pull/426">#426</a>
<a
href="https://redirect.github.com/shopspring/decimal/pull/441">#441</a></li>
<li><code>Truncate</code> supports negative precision: <code>5432</code>
truncated to <code>-2</code> is <code>5400</code>. Before, it returned
<code>5432</code> unchanged <a
href="https://redirect.github.com/shopspring/decimal/pull/426">#426</a></li>
<li><code>Shift</code> panics when the exponent overflows an int32,
instead of wrapping around <a
href="https://redirect.github.com/shopspring/decimal/pull/437">#437</a></li>
<li><code>NewFromString</code> rejects a sign right after a leading
decimal point, such as <code>&quot;.-5&quot;</code> <a
href="https://redirect.github.com/shopspring/decimal/pull/447">#447</a></li>
</ul>
<h4>FEATURES</h4>
<ul>
<li>Add <code>TrimTrailingZeros</code> and
<code>UseScientificNotation</code> settings for string output <a
href="https://redirect.github.com/shopspring/decimal/pull/389">#389</a>
<a
href="https://redirect.github.com/shopspring/decimal/pull/416">#416</a></li>
<li>Add Spanner support with <code>EncodeSpanner</code> and
<code>DecodeSpanner</code> for <code>Decimal</code> and
<code>NullDecimal</code> <a
href="https://redirect.github.com/shopspring/decimal/pull/395">#395</a></li>
</ul>
<h4>ENHANCEMENTS</h4>
<ul>
<li>Most operations are faster and allocate less, about twice as fast on
average across the benchmarks <a
href="https://redirect.github.com/shopspring/decimal/pull/444">#444</a>
<a
href="https://redirect.github.com/shopspring/decimal/pull/445">#445</a>
<a
href="https://redirect.github.com/shopspring/decimal/pull/446">#446</a>
<a
href="https://redirect.github.com/shopspring/decimal/pull/447">#447</a>
<a
href="https://redirect.github.com/shopspring/decimal/pull/448">#448</a>
<a
href="https://redirect.github.com/shopspring/decimal/pull/449">#449</a>
<a
href="https://redirect.github.com/shopspring/decimal/pull/451">#451</a></li>
<li>Faster <code>UnmarshalJSON</code>, <code>Scan</code> and
<code>NewFromString</code> <a
href="https://redirect.github.com/shopspring/decimal/pull/403">#403</a></li>
<li><code>ExpHullAbrham</code> raises its partial sum to a power by
squaring. Large inputs that took minutes now take seconds <a
href="https://redirect.github.com/shopspring/decimal/pull/450">#450</a></li>
<li>Document that <code>NewFromFloat</code> returns the shortest decimal
that converts back to the same float, and how to convert large whole
numbers exactly <a
href="https://redirect.github.com/shopspring/decimal/pull/442">#442</a></li>
<li>Split <code>decimal.go</code> into <code>decimal.go</code>,
<code>math.go</code> and <code>encoding.go</code> <a
href="https://redirect.github.com/shopspring/decimal/pull/452">#452</a></li>
<li>Lint with golangci-lint in CI, and test on Go 1.26 and 1.27 <a
href="https://redirect.github.com/shopspring/decimal/pull/453">#453</a>
<a
href="https://redirect.github.com/shopspring/decimal/pull/454">#454</a></li>
</ul>
<h4>BUGFIXES</h4>
<ul>
<li>Fix <code>Float64</code> hanging on decimals with huge exponents <a
href="https://redirect.github.com/shopspring/decimal/pull/438">#438</a></li>
<li>Fix <code>ExpHullAbrham</code> returning <code>10^exp</code> instead
of 1 for tiny inputs <a
href="https://redirect.github.com/shopspring/decimal/pull/433">#433</a></li>
<li>Fix a data race in <code>ExpTaylor</code> <a
href="https://redirect.github.com/shopspring/decimal/pull/414">#414</a></li>
<li>Fix <code>NumDigits</code> for some exact powers of ten <a
href="https://redirect.github.com/shopspring/decimal/pull/425">#425</a></li>
<li>Fix the <code>omitzero</code> struct tag for <code>Decimal</code>
fields in nested structs <a
href="https://redirect.github.com/shopspring/decimal/pull/415">#415</a></li>
<li>Fix <code>RoundCash</code> giving wrong results with a low
<code>DivisionPrecision</code> <a
href="https://redirect.github.com/shopspring/decimal/pull/443">#443</a></li>
<li><code>NullDecimal</code> is no longer <code>Valid</code> after a
failed <code>Scan</code>, <code>UnmarshalJSON</code> or
<code>DecodeSpanner</code> <a
href="https://redirect.github.com/shopspring/decimal/pull/443">#443</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/shopspring/decimal/commit/f658fbf1eb94abc869558633a0b9b239300899f4"><code>f658fbf</code></a>
docs: changelog for v1.5.0 (<a
href="https://redirect.github.com/shopspring/decimal/issues/455">#455</a>)</li>
<li><a
href="https://github.com/shopspring/decimal/commit/b2609858efe06dcfd25d4ecdec1a80531856d4d6"><code>b260985</code></a>
ci: test on Go 1.26 and 1.27 instead of 1.22 and 1.23 (<a
href="https://redirect.github.com/shopspring/decimal/issues/454">#454</a>)</li>
<li><a
href="https://github.com/shopspring/decimal/commit/d25658fa8de1d9ace7cc9f068f7469f9e44ec581"><code>d25658f</code></a>
chore: lint with golangci-lint in CI instead of Go Report Card (<a
href="https://redirect.github.com/shopspring/decimal/issues/453">#453</a>)</li>
<li><a
href="https://github.com/shopspring/decimal/commit/fc257b4a95d135982828135d99f17b7f6075c13f"><code>fc257b4</code></a>
chore: split decimal.go into math.go and encoding.go (<a
href="https://redirect.github.com/shopspring/decimal/issues/452">#452</a>)</li>
<li><a
href="https://github.com/shopspring/decimal/commit/aed8543466e85124e50ef52648894a2d1b6c1cd7"><code>aed8543</code></a>
fix: RoundCash with a low DivisionPrecision and NullDecimal.Valid after
error...</li>
<li><a
href="https://github.com/shopspring/decimal/commit/811854c508d5eaf855afb2267e364498a985b2d0"><code>811854c</code></a>
perf: faster QuoRem, DivRound, Round, RoundBank, RoundUp, RoundCeil and
Round...</li>
<li><a
href="https://github.com/shopspring/decimal/commit/9b6d1186ce89d33fe37ae8f2785d83a4966f9ec1"><code>9b6d118</code></a>
perf: raise the ExpHullAbrham sum to its power by squaring (<a
href="https://redirect.github.com/shopspring/decimal/issues/450">#450</a>)</li>
<li><a
href="https://github.com/shopspring/decimal/commit/cc8953c6b309c7031dd45e91891ced6fbb0581da"><code>cc8953c</code></a>
perf: build trig constants once (<a
href="https://redirect.github.com/shopspring/decimal/issues/449">#449</a>)</li>
<li><a
href="https://github.com/shopspring/decimal/commit/84990cbfac3cfdada111489558da172cc40ce593"><code>84990cb</code></a>
perf: faster String, MarshalJSON and NewFromString; reject a sign after
the d...</li>
<li><a
href="https://github.com/shopspring/decimal/commit/71ebcfdcdf6d4a5e1751294ae667666273b03fe3"><code>71ebcfd</code></a>
Fix the scale of the small-input exponential result (<a
href="https://redirect.github.com/shopspring/decimal/issues/433">#433</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/shopspring/decimal/compare/v1.4.0...v1.5.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/shopspring/decimal&package-manager=go_modules&previous-version=1.4.0&new-version=1.5.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-14 17:39:10 +00:00
dependabot[bot] 62ea1fd422 chore: bump the x group across 1 directory with 8 updates (#30772) 
Bumps the x group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.57.0` |
`0.58.0` |
| [golang.org/x/mod](https://github.com/golang/mod) | `0.41.0` |
`0.42.0` |
| [golang.org/x/net](https://github.com/golang/net) | `0.59.0` |
`0.60.0` |
| [golang.org/x/sync](https://github.com/golang/sync) | `0.23.0` |
`0.24.0` |
| [golang.org/x/sys](https://github.com/golang/sys) | `0.48.0` |
`0.49.0` |
| [golang.org/x/term](https://github.com/golang/term) | `0.46.0` |
`0.47.0` |
| [golang.org/x/text](https://github.com/golang/text) | `0.42.0` |
`0.43.0` |
| [golang.org/x/tools](https://github.com/golang/tools) | `0.50.0` |
`0.51.0` |


Updates `golang.org/x/crypto` from 0.57.0 to 0.58.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/crypto/commit/8fdf07b3114278fb3b78c1cf1814e08bd851eb4c"><code>8fdf07b</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="https://github.com/golang/crypto/commit/2437861a30358e949c7be3c9f876233fd28c20fe"><code>2437861</code></a>
salsa20: fix keystream reuse in LoongArch LSX tail</li>
<li><a
href="https://github.com/golang/crypto/commit/c3db4df58582058384d318c87f1c912848d8c464"><code>c3db4df</code></a>
acme: prefer test log helpers in test contexts</li>
<li><a
href="https://github.com/golang/crypto/commit/4e01a8447cadd21a75969d3db82ba6191202cebc"><code>4e01a84</code></a>
acme: adds support for profiles draft</li>
<li><a
href="https://github.com/golang/crypto/commit/8f0f1112abdbc13b6e53068b813cc327e40f2f9f"><code>8f0f111</code></a>
ssh: check that no Unicode-aware string function is used</li>
<li><a
href="https://github.com/golang/crypto/commit/b39ff6d641ecc5bb4b241737cb0c6b646f3e12a9"><code>b39ff6d</code></a>
ssh: add certificate algorithms for ML-DSA keys</li>
<li><a
href="https://github.com/golang/crypto/commit/4465db3225a5d7b6f86e015ad0a10ab81342aca1"><code>4465db3</code></a>
ssh: add the ML-DSA public key algorithms</li>
<li><a
href="https://github.com/golang/crypto/commit/83e695bb1a7ac85613745a2544464f652ddcffcf"><code>83e695b</code></a>
ssh: implement ETM mode for CBC ciphers</li>
<li><a
href="https://github.com/golang/crypto/commit/946083a5fb28da882ed9fa6eb561e000f47e3ee7"><code>946083a</code></a>
ssh: only drop a trailing carriage return</li>
<li><a
href="https://github.com/golang/crypto/commit/543dde943b04b875f2220324e0e9881be7d0092d"><code>543dde9</code></a>
ssh: accept known_hosts entries with a multi-word comment</li>
<li>Additional commits viewable in <a
href="https://github.com/golang/crypto/compare/v0.57.0...v0.58.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `golang.org/x/mod` from 0.41.0 to 0.42.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/mod/commit/b5136e5ba156da612a1efc6e49b55988a134a5e0"><code>b5136e5</code></a>
sumdb/tlog: use recorded responses in TestCertificateTransparency</li>
<li><a
href="https://github.com/golang/mod/commit/1e9a5aeb397f5c4abf7aa1927d01575defde85d3"><code>1e9a5ae</code></a>
go.mod: update golang.org/x dependencies</li>
<li>See full diff in <a
href="https://github.com/golang/mod/compare/v0.41.0...v0.42.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `golang.org/x/net` from 0.59.0 to 0.60.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/net/commit/18ece0ce30bc35fa81fe72028bf309bb3ff3f4a5"><code>18ece0c</code></a>
http2: prevent crash due to HPACK encoder race</li>
<li><a
href="https://github.com/golang/net/commit/2d03f9dcd22da1be6f645ddfd0541fd94d68e5db"><code>2d03f9d</code></a>
http2: avoid 2x refund on stream close with buffered data</li>
<li><a
href="https://github.com/golang/net/commit/cc7d34fd2dd5864bcafe3e5e0a84919240be98c0"><code>cc7d34f</code></a>
http2: avoid excessive work on initial window changes</li>
<li><a
href="https://github.com/golang/net/commit/57f4235f83712a299328015548240512213a3852"><code>57f4235</code></a>
http2: apply header limits to Trailer headers too</li>
<li><a
href="https://github.com/golang/net/commit/01e3d0338c2256320c59c863f9298e9544a99feb"><code>01e3d03</code></a>
http2: coalesce dials via wrapped Transport.RoundTrip</li>
<li><a
href="https://github.com/golang/net/commit/28247830e9fb37184c6be718f483a0c7d0949022"><code>2824783</code></a>
http2: delete malformed framing-related headers</li>
<li><a
href="https://github.com/golang/net/commit/b13c0c165994a0042e0c4a4d01e2b998097967c9"><code>b13c0c1</code></a>
internal/http3: delete HTTP/3 package</li>
<li><a
href="https://github.com/golang/net/commit/520c891fe60b2ffd4b4ee349d95cac4c1c0d9ee1"><code>520c891</code></a>
quic: off-path support in loss/congestion/rtt</li>
<li><a
href="https://github.com/golang/net/commit/656874fd46a65a97eac94003e0eb8751be4403d0"><code>656874f</code></a>
quic: determine local address for connections</li>
<li><a
href="https://github.com/golang/net/commit/a818e160ee8fbf01b12286ff806fab82f0ed764f"><code>a818e16</code></a>
quic: add a pathAddrs type, holding a local/peer address pair</li>
<li>Additional commits viewable in <a
href="https://github.com/golang/net/compare/v0.59.0...v0.60.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `golang.org/x/sync` from 0.23.0 to 0.24.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/sync/commit/36f2d70ecde9857dc4e363242a1369c7645d6770"><code>36f2d70</code></a>
errgroup: modernize the usage of closures in goroutines</li>
<li>See full diff in <a
href="https://github.com/golang/sync/compare/v0.23.0...v0.24.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `golang.org/x/sys` from 0.48.0 to 0.49.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/sys/commit/b6b8557e8e2974925aec7a136ba0e323eedc5f43"><code>b6b8557</code></a>
unix/linux: unify ppc64x syscall wrappers</li>
<li><a
href="https://github.com/golang/sys/commit/aab6988eff65f762ecf6b757c3571b8a45f40618"><code>aab6988</code></a>
unix: add PrctlArg5Ptr</li>
<li><a
href="https://github.com/golang/sys/commit/cdfd9840b35fca673dd1b27ef69a13b9f5be0d04"><code>cdfd984</code></a>
unix: pass fcntl data as unsafe.Pointer in FcntlF{lock,store} on
darwin</li>
<li><a
href="https://github.com/golang/sys/commit/782b836d3ae6ebda757c7b3800818e737c623614"><code>782b836</code></a>
unix/linux: don't warn about closed stderr from child process</li>
<li><a
href="https://github.com/golang/sys/commit/61592fb02e581c922feaf3d9ada8547488b70964"><code>61592fb</code></a>
unix: return syscall error in *listxattrNS on BSD</li>
<li><a
href="https://github.com/golang/sys/commit/c136fdad42c8b16318f29da74e73194c779ba862"><code>c136fda</code></a>
unix/linux/Dockerfile: update to Go 1.26.8</li>
<li><a
href="https://github.com/golang/sys/commit/f1d0d79251083d5d223af16c0d8c5207a355c627"><code>f1d0d79</code></a>
unix: pass xattr data as unsafe.Pointer in BSD xattr syscalls</li>
<li><a
href="https://github.com/golang/sys/commit/67f850b71cbdd0a9bb58e2c45cb487ab5a72f83f"><code>67f850b</code></a>
unix: update linux to v7.2</li>
<li><a
href="https://github.com/golang/sys/commit/eb1f6591861ee38df32e043d27508fd1effa4854"><code>eb1f659</code></a>
unix: add O_EXEC and O_SEARCH on darwin</li>
<li><a
href="https://github.com/golang/sys/commit/51bc73186f49d1a8f85b1fa28d0c14585ac812cd"><code>51bc731</code></a>
unix: add Mmsghdr for linux</li>
<li>Additional commits viewable in <a
href="https://github.com/golang/sys/compare/v0.48.0...v0.49.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `golang.org/x/term` from 0.46.0 to 0.47.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/term/commit/0851034afad912733699827b3bb94436f059797f"><code>0851034</code></a>
go.mod: update golang.org/x dependencies</li>
<li>See full diff in <a
href="https://github.com/golang/term/compare/v0.46.0...v0.47.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `golang.org/x/text` from 0.42.0 to 0.43.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/text/commit/ac40b0f06c159afb5bfca4d1860f8b4b60dbc160"><code>ac40b0f</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="https://github.com/golang/text/commit/6dcc5b674302d746762d908ed0e2ad65d84f36f1"><code>6dcc5b6</code></a>
unicode/bidi: avoid quadratic behavior in Paragraph.Order and
Paragraph.Line</li>
<li><a
href="https://github.com/golang/text/commit/d0ecd29e39d37c5647d8db9e2edb40d61b220e2a"><code>d0ecd29</code></a>
secure/bidirule: lazily precompute ASCII table</li>
<li>See full diff in <a
href="https://github.com/golang/text/compare/v0.42.0...v0.43.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `golang.org/x/tools` from 0.50.0 to 0.51.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/tools/commit/ea2f152dc35325e4b9b639583972375972350a84"><code>ea2f152</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="https://github.com/golang/tools/commit/00443da123aa0b0f0729b6a72badabad7835b1d0"><code>00443da</code></a>
go/analysis/passes/printf: pin testdata Go versions</li>
<li><a
href="https://github.com/golang/tools/commit/9ba0a15b6ac31e1d2748917e6f219e1d98c7c4fa"><code>9ba0a15</code></a>
internal/refactor/inline: check import accessibility before Go
version</li>
<li><a
href="https://github.com/golang/tools/commit/25196fcc818e9cc69a8ff7e263f5f60183c46b4e"><code>25196fc</code></a>
cmd/toolstash: check -linkobj files to support early export</li>
<li><a
href="https://github.com/golang/tools/commit/ead0503d8e7d79d756adf531c515223974a10c51"><code>ead0503</code></a>
gopls/internal/golang: unexport dragon*Question variables</li>
<li><a
href="https://github.com/golang/tools/commit/5693030baf216af18b7756b08f6b6fa4a7e379b2"><code>5693030</code></a>
gopls/internal/golang: call arguments mistreated in inlineAllCalls</li>
<li><a
href="https://github.com/golang/tools/commit/134264d72fba423ca1ad358683cd3c32699b010e"><code>134264d</code></a>
gopls/internal/golang/stubmethods: do not panic when FindByPos
fails</li>
<li><a
href="https://github.com/golang/tools/commit/01d93d7fa1ae1cd76076088e56c42f7b4734e7b0"><code>01d93d7</code></a>
gopls/internal/golang: slay the dragon: update questions</li>
<li><a
href="https://github.com/golang/tools/commit/405de3911f7d546b09f02249f64c59b5fa3b5d53"><code>405de39</code></a>
go/callgraph: fix benchmarks to analyze whole program</li>
<li><a
href="https://github.com/golang/tools/commit/231a7fadf2aa68064ab7a5b5b01363fc3f25e127"><code>231a7fa</code></a>
go/ssa, cmd/deadcode: release type information once functions are
built</li>
<li>Additional commits viewable in <a
href="https://github.com/golang/tools/compare/v0.50.0...v0.51.0">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-14 17:37:25 +00:00
Bobby Ho ee5e3a4029 feat: send script resource addresses and dependencies in the agent manifest (#30627) 
feat: include script dependencies in agent manifests

Send persisted script Terraform addresses and dependency lists on every
manifest request, preserving them across agent restarts, reconnects, and
shutdown without rebuilding the workspace.

- Add `resource_address` and `dependencies` to the agent proto, with
  `SUCCESS` and `COMPLETION` requirements.
- Reuse shared database-to-SDK validation and add bidirectional SDK/proto
  conversion. Reject empty prerequisite addresses and invalid requirements
  rather than accepting partial lists.
- Bump the agent API to v2.13 and update the agent's RPC connection.
  Older agents ignore the new fields; older servers return empty fields.
- Test manifest delivery, subagent isolation, round trips, invalid
  dependencies, and unchanged encoding when the new fields are unset.

Script execution is unchanged; ordering enforcement follows in PLAT-549.
Production dependency lists remain empty until #30556 merges.

Stacked on #30625. Refs PLAT-548.
 2026-10-14 17:26:31 +00:00
Bobby Ho fb09983c77 feat: attach script order dependencies during conversion (#30556) 
feat(provisioner): transport resolved script order dependencies

Attach finalized `coder_script_order` dependencies to scripts during
START imports, covering workspace agents and devcontainer subagents.
Dependencies are sorted by prerequisite address and preserve `success`
or `completion` requirements. Invalid graphs attach nothing.

- Reject Graph responses exceeding the 4 MiB DRPC limit with a readable
  error reporting the size and limit instead of a transport failure.
  This check applies to all templates.
- Preserve START-only conversion: STOP imports carry addresses but no
  dependencies. Templates without ordering rules are otherwise unchanged.
- Add tests for dependency attachment, requirement preservation, sorting,
  devcontainer scripts, and oversized responses.

Server-side consumption remains a separate follow-up.

Refs [PLAT-547](https://linear.app/codercom/issue/PLAT-547/phase-2-transport-resolved-script-dependencies-from-provisioner).
 2026-10-14 16:58:19 +00:00
Nick Vigilante 6afd1515e0 fix(coderd/templatebuilder): guard quickstart C/C++ install on every tool it installs (#30374) 
The Quickstart base's C/C++ branch guarded on `command -v gcc`, but
installs `gcc g++ make cmake`. `codercom/enterprise-base:ubuntu` ships
gcc but not cmake, so cmake was never installed while the script
reported success. The guard now checks every tool the install provides
(`gcc`, `g++`, `make`, `cmake`).

Adds `TestQuickstartCppInstallGuard`, which runs the rendered C/C++
branch against stubbed tools and asserts the install runs when any of
them is missing. It fails without the fix.

Fixes DOCS-736. The matching example template change is in the DOCS-613
PR.

Generated by Coder Agents on behalf of @nickvigilante.
 2026-10-14 12:35:48 -04:00
Danielle Maywood b8c9195b3f fix(site/src/pages/AgentsPage): make git panel refresh match a page reload (#30678) 
The git panel's refresh button invalidated the PR diff contents but not
the chat, whose `diff_statuses` back the PR tabs, so a page reload could
show PR state the button missed. Refresh now also invalidates the chat
entity.

The button was also disabled until the panel had git context, which left
no way to pick up a repo created after the chat touched its path. It is
now always enabled; the diff style toggles stay disabled without git
context.

### Before (Scenario A)


https://github.com/user-attachments/assets/82dc7c48-148f-4661-af73-8400a275b05d

### After (Scenario A)


https://github.com/user-attachments/assets/0f24e390-39d3-4b43-9f4c-63d499837e33

### Before (Scenario B)


https://github.com/user-attachments/assets/a779031a-8bb9-466b-9cf3-a56ad02a98d5

### After (Scenario B)


https://github.com/user-attachments/assets/05c081e7-7ad1-4608-8ef7-1bac4940034c

<details>
<summary>Decision log</summary>

The git panel's refresh button should show everything a page reload
would. Investigation found five ways it didn't, each fixed in its own PR
on the current `changes` protocol:

1. `execute` without a workdir didn't record the directory the process
ran in (`agent/agentproc`).
2. Refresh only rescanned repos already being watched, so a repo created
or recreated after its path was recorded stayed hidden
(`agent/agentgit`). A connection with no repos also got no first
message.
3. After a git watch reconnect, the new full state was merged into the
previous connection's map, so deleted repos stayed visible
(`useGitWatcher`).
4. A chat watch reconnect didn't refetch the open chat, so missed
`diff_status_change` events were lost (`AgentsPageLayout`).
5. Refresh didn't refetch the chat, whose diff statuses back the PR
tabs, and was disabled until git context existed (`GitPanel`,
`AgentChatPageView`).

Considered and deferred: a snapshot protocol with diffs fetched by hash,
which would keep large multi-repo diffs under the 4 MiB proxy read
limit, and making scans faster at scale. Neither is needed to fix
refresh, and together they made a single ~5900-line change that couldn't
be reviewed. The refresh spinner still runs for a fixed time, since
tying it to the response needs a request ID in the protocol.

</details>

---

_Generated by Coder Agents on behalf of @DanielleMaywood._
 2026-10-14 17:04:40 +01:00
Danielle Maywood dad010ff11 fix(site/src/pages/AgentsPage): refetch the open chat when the chat watch reconnects (#30677) 
Events missed while the chat watch socket was disconnected, such as
`diff_status_change`, only reach the open chat through a refetch. The
socket's `onOpen` handler already invalidated the chat lists, but not
the open chat, so its PR state could stay stale until a page reload.

`onOpen` now also invalidates the open chat entity and its diff
contents. This includes the first open, adding one refetch on page load,
the same as the existing chat list invalidation.

### Before


https://github.com/user-attachments/assets/b88a18d2-dfef-45bc-87f0-4c2d492b8ed7

### After


https://github.com/user-attachments/assets/65f84af2-7d2b-4a51-ae33-56cca62d9946

<details>
<summary>Decision log</summary>

The git panel's refresh button should show everything a page reload
would. Investigation found five ways it didn't, each fixed in its own PR
on the current `changes` protocol:

1. `execute` without a workdir didn't record the directory the process
ran in (`agent/agentproc`).
2. Refresh only rescanned repos already being watched, so a repo created
or recreated after its path was recorded stayed hidden
(`agent/agentgit`). A connection with no repos also got no first
message.
3. After a git watch reconnect, the new full state was merged into the
previous connection's map, so deleted repos stayed visible
(`useGitWatcher`).
4. A chat watch reconnect didn't refetch the open chat, so missed
`diff_status_change` events were lost (`AgentsPageLayout`).
5. Refresh didn't refetch the chat, whose diff statuses back the PR
tabs, and was disabled until git context existed (`GitPanel`,
`AgentChatPageView`).

Considered and deferred: a snapshot protocol with diffs fetched by hash,
which would keep large multi-repo diffs under the 4 MiB proxy read
limit, and making scans faster at scale. Neither is needed to fix
refresh, and together they made a single ~5900-line change that couldn't
be reviewed. The refresh spinner still runs for a fixed time, since
tying it to the response needs a request ID in the protocol.

</details>

---

_Generated by Coder Agents on behalf of @DanielleMaywood._
 2026-10-14 17:04:39 +01:00
Danielle Maywood 63eef9efde fix(site/src/pages/AgentsPage/hooks): replace git state on reconnect (#30676) 
When the git watch socket reconnected, the agent's full state was merged
into the map from the previous connection. Repos deleted while
disconnected, or lost because the agent restarted, stayed in the panel
until the page was reloaded.

The first `changes` message of each connection now replaces the map.
Later messages on the same connection are still applied as deltas. With
an agent that includes #30675, this also clears the panel when the new
connection has no repos.

### Before


https://github.com/user-attachments/assets/3df52312-8234-4c71-8e84-06dfabe8509c

### After


https://github.com/user-attachments/assets/2113a74c-f916-4ac4-bf11-1b58d78d1901

<details>
<summary>Decision log</summary>

The git panel's refresh button should show everything a page reload
would. Investigation found five ways it didn't, each fixed in its own PR
on the current `changes` protocol:

1. `execute` without a workdir didn't record the directory the process
ran in (`agent/agentproc`).
2. Refresh only rescanned repos already being watched, so a repo created
or recreated after its path was recorded stayed hidden
(`agent/agentgit`). A connection with no repos also got no first
message.
3. After a git watch reconnect, the new full state was merged into the
previous connection's map, so deleted repos stayed visible
(`useGitWatcher`).
4. A chat watch reconnect didn't refetch the open chat, so missed
`diff_status_change` events were lost (`AgentsPageLayout`).
5. Refresh didn't refetch the chat, whose diff statuses back the PR
tabs, and was disabled until git context existed (`GitPanel`,
`AgentChatPageView`).

Considered and deferred: a snapshot protocol with diffs fetched by hash,
which would keep large multi-repo diffs under the 4 MiB proxy read
limit, and making scans faster at scale. Neither is needed to fix
refresh, and together they made a single ~5900-line change that couldn't
be reviewed. The refresh spinner still runs for a fixed time, since
tying it to the response needs a request ID in the protocol.

</details>

---

_Generated by Coder Agents on behalf of @DanielleMaywood._
 2026-10-14 17:04:39 +01:00
Danielle Maywood e981ff4eec fix(agent/agentgit): re-resolve chat paths on refresh (#30675) 
A git watch `refresh` only rescanned the repos already being watched. A
path recorded before its repo existed, for example before `git init`, or
a repo that was deleted and recreated, stayed hidden until the client
reconnected, so a page reload showed repos the refresh button didn't.

Refresh now resolves the chat's paths again, as a new connection does.
The first scan of a connection is also sent even when no repos are
watched, so a client can replace state left over from an earlier
connection; later scans with no repos still send nothing.

### Before


https://github.com/user-attachments/assets/33bf9046-0448-4537-9a97-c97f51e1cc39

### After


https://github.com/user-attachments/assets/82b15d03-6460-4fe0-b5e7-b4bafbbd72d1

<details>
<summary>Decision log</summary>

The git panel's refresh button should show everything a page reload
would. Investigation found five ways it didn't, each fixed in its own PR
on the current `changes` protocol:

1. `execute` without a workdir didn't record the directory the process
ran in (`agent/agentproc`).
2. Refresh only rescanned repos already being watched, so a repo created
or recreated after its path was recorded stayed hidden
(`agent/agentgit`). A connection with no repos also got no first
message.
3. After a git watch reconnect, the new full state was merged into the
previous connection's map, so deleted repos stayed visible
(`useGitWatcher`).
4. A chat watch reconnect didn't refetch the open chat, so missed
`diff_status_change` events were lost (`AgentsPageLayout`).
5. Refresh didn't refetch the chat, whose diff statuses back the PR
tabs, and was disabled until git context existed (`GitPanel`,
`AgentChatPageView`).

Considered and deferred: a snapshot protocol with diffs fetched by hash,
which would keep large multi-repo diffs under the 4 MiB proxy read
limit, and making scans faster at scale. Neither is needed to fix
refresh, and together they made a single ~5900-line change that couldn't
be reviewed. The refresh spinner still runs for a fixed time, since
tying it to the response needs a request ID in the protocol.

</details>

---

_Generated by Coder Agents on behalf of @DanielleMaywood._
 2026-10-14 17:04:39 +01:00
Danielle Maywood 2b844aa649 fix(agent/agentproc): track the default working directory for chat processes (#30674) 
A process started through the agent's process API without a `workdir`
runs in the agent's default directory, but only an explicit `workdir`
was recorded in the chat's path store. Repositories touched that way
were never watched by the git panel.

The path store now records `proc.workDir`, the directory the process
actually ran in, whether requested or defaulted.

### Before


https://github.com/user-attachments/assets/b98c290a-0c77-4ce4-bb00-eb4088d2067e

### After


https://github.com/user-attachments/assets/0383aa1a-eced-4338-97af-3c54501cdedb

<details>
<summary>Decision log</summary>

The git panel's refresh button should show everything a page reload
would. Investigation found five ways it didn't, each fixed in its own PR
on the current `changes` protocol:

1. `execute` without a workdir didn't record the directory the process
ran in (`agent/agentproc`).
2. Refresh only rescanned repos already being watched, so a repo created
or recreated after its path was recorded stayed hidden
(`agent/agentgit`). A connection with no repos also got no first
message.
3. After a git watch reconnect, the new full state was merged into the
previous connection's map, so deleted repos stayed visible
(`useGitWatcher`).
4. A chat watch reconnect didn't refetch the open chat, so missed
`diff_status_change` events were lost (`AgentsPageLayout`).
5. Refresh didn't refetch the chat, whose diff statuses back the PR
tabs, and was disabled until git context existed (`GitPanel`,
`AgentChatPageView`).

Considered and deferred: a snapshot protocol with diffs fetched by hash,
which would keep large multi-repo diffs under the 4 MiB proxy read
limit, and making scans faster at scale. Neither is needed to fix
refresh, and together they made a single ~5900-line change that couldn't
be reviewed. The refresh spinner still runs for a fixed time, since
tying it to the response needs a request ID in the protocol.

</details>

---

_Generated by Coder Agents on behalf of @DanielleMaywood._
 2026-10-14 17:04:38 +01:00
dylanhuff-at-coder c856d5fb22 feat: accept template version IDs in --template-version (#30563) 
Follow-up to #30199. `--template-version` on `coder create`, `start`,
`stop`, and `update` (plus `--stop-template-version` on `update`) now
takes a template version ID as well as a name. Passing a version UUID
used to 404 with a pretty unhelpful `get template version by name`
error.

`resolveTemplateVersionID` still looks up by name first, so a version
that happens to be named like a UUID resolves the same way it did
before. If that 404s and the input parses as a UUID, it falls back to
fetching the version by ID. Either way the version has to belong to the
selected template. That check matters most for `create`, which only
sends the version ID and lets the server derive the template from it, so
without it `coder create --template foo --template-version <id of a bar
version>` would quietly create a `bar` workspace.

The name is now path-escaped before the lookup. Previously something
like `../../../templateversions/<id>` could reach other API routes
through the name lookup and skip the template check entirely.

Not-found errors now read `template version "x" not found for template
"foo"` instead of the raw SDK error, so anything matching on the old
text will need updating. Flag help and the generated CLI docs say "name
or ID" now.
 2026-10-14 08:52:36 -07:00
Denis AfonsoandClaude 200cffcfd8 fix(scripts/release): promote stable on immutable releases (#30745) 
## Problem

`./scripts/release_promote_stable.sh v2.37.4` failed today with:

```
edit release failed: PATCH https://api.github.com/repos/coder/coder/releases/403906567: 404 Not Found
```

Releases on this repo are immutable (`gh release view v2.37.4 --json
isImmutable` → `true`). `promoteVersionToStable` cloned the entire
`RepositoryRelease` into `EditRelease`, so the PATCH carried `tag_name`,
`target_commitish` and the assets. GitHub rejects that on an immutable
release even when the values are unchanged, and answers 404 rather than
422. The same edit with only `body`, `prerelease` and `make_latest`
succeeds (that's how v2.37.4 was promoted by hand).

## Change

- Build a minimal `RepositoryRelease{Body, Prerelease, MakeLatest}` for
the edit.
- Drop the `Draft: false` assignment (published releases are never
drafts, and `draft` is not an editable field on immutable releases).
- Dry-run now logs the body diff instead of a diff of the whole object.
- Remove the now-unused `cloneRelease` helper.

Verified with `go test ./scripts/release/` and a `promote --dry-run`
against v2.36.7.

Every release published since immutable releases were enabled is
affected, so without this the command cannot promote anything. Related:
the release-process review notes that this step is also missing from the
runbook and should become a workflow job on every `.0` mainline release.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude <noreply@anthropic.com>
 2026-10-14 16:42:56 +01:00
Garrett Delfosse 2b9fad8bba feat: add chat project sharing database layer (#30479) 
Database and authorization layer for chat project sharing (experiment
`chat-projects`), part 1 of 2. #30439 adds the API on top of it. Nothing
here changes behavior: projects start with empty ACLs, no endpoint
writes them yet, and deleting a project still detaches its chats.
Project deletion is in #30683.

- **Schema:** migration `000621` adds `user_acl` and `group_acl` jsonb
columns to `chat_projects`, typed as `ChatACL` like chats, with GIN
indexes. It also adds the `chat_project:share` API key scope.
- **Queries:**
- `GetChatProjectsOwnedOrSharedWithUserID`: owned projects plus projects
with an ACL entry for the user directly, through a group, or through the
Everyone group (whose ID is the organization ID). Entries count only for
members of the project's organization. Keys match regardless of actions,
so dbauthz filters the rows.
- `IsChatProjectAccessibleByUserID`: whether a user owns a project or
holds a `read` or `*` grant on it, for code running under a system
subject. With sharing disabled, dbauthz answers owner-only.
- `GetChatProjectByIDForUpdate`: lets the ACL update read, modify, and
write in one transaction.
  - `UpdateChatProjectACLByID`.
- **RBAC:**
- New `share` action on `chat_project`. dbauthz requires it to update
the ACL.
- `ChatProject.RBACObject` attaches the project ACL. Memory objects get
a derived ACL: project `read` grants memory read, and `read` with
`update` grants memory create and delete. Wildcard grants count. Read
sharees change memories through their chats' agents, which #30439 gates.
Project instructions authorize through the same object, so a `read`
grant reads them and an `update` grant edits them.
- `--disable-chat-sharing` also covers projects: ACLs are ignored, the
ACL update is rejected, and roles deny `chat_project:share`. The help
text and chat sharing docs say so.
- **Audit:** `user_acl` and `group_acl` changes are tracked.
- **Tests:**
- Querier tests run the access queries both raw and through dbauthz
(owner, direct user, group, Everyone, wildcard grants, a member of
another org, grants without read).
- RBAC object and memory ACL tests, with an authorizer check, in both
sharing modes.
- dbauthz cases including the disabled guards, and the
`chat_project:share` negation in the roles test.

The generated TypeScript changes only add the new scope value.

> Generated by Coder Agents.
 2026-10-14 10:42:00 -04:00
Lisa Fiander 2254965ef8 docs: update release calendar for v2.38 (#30757) 
Updates the release calendar in `docs/reference/releases.md`.

For the `2.38` release: 
* `2.38` becomes Mainline
* `2.37` Stable
* `2.36` Security Support
* `2.35` Not Supported 
* `2.32` drops off. 

 
Latest patch versions are bumped to `v2.34.12`, `v2.35.9`, `v2.36.7`,
`v2.37.4`, and `v2.38.0`, and a `2.39` "Not Released" row is added.
The `2.35` row's link text (`v2.35.6`) is fixed to match its target
(`v2.35.7`, now `v2.35.9`).

Generated with `scripts/update-release-calendar.sh`, then hand-adjusted:

- 2.38 links to its changelog post,
`broader-model-access-and-tighter-governance-controls-in-238`, since
`coder-2-38` returns 404. The longer link widens the table, so every row
is realigned.
- 2.35 keeps `coder-2-35-1`; the script's `coder-2-35` returns 404.
- 2.38's date is the GitHub release publish date (October 06, the first
Tuesday). The script uses the tag commit date (October 01).

The "latest ESR version" link in the ESR section is also updated from
`v2.34.5` to `v2.34.12`.

Note: re-running the script will revert the two link overrides above.

---

_Generated by Coder Agents on behalf of @Lisa-Fiander._
 2026-10-14 15:24:26 +01:00