opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-10-31 02:43:21 +08:00
Code Issues Packages Projects Releases Wiki Activity
16,069 Commits 479 Branches 417 Tags
45f2eb48ccf2a2e18d9ef6665ccfaf62b42d3e4b
Commit Graph
16069 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Michael Suchacz 45f2eb48cc refactor(coderd): restore agents-access cleanup migration (#28587) 
## Summary

- restore the `agents-access` data cleanup migration as `000587`
(renumbered from `000585`; main advanced past that number)
- revert the temporary RBAC tolerance for retired role names now that
the migration strips stale grants
- make the migration test discover its predecessor dynamically, since
this branch does not carry main's `000585`/`000586`

## Stack context

Stacked on #28186, which retires the `agents-access` role but
intentionally ships without a migration so it can be backported across
diverged migration numbers. This layer completes the retirement on main:
it cleans up stale role grants in `users.rbac_roles`,
`organization_members.roles`, and
`organizations.default_org_member_roles`, then reverts the interim
leniency (role expansion dropping legacy names, assignment validation
ignoring them) that existed only to keep the migration-less base safe.
`rbac.ReservedRoleName` still reserves the retired name so custom roles
cannot shadow it on rollback. Do not backport this PR alongside the base
PR.

## Rollback note

The down migration restores effective access broadly because it cannot
reconstruct which users previously held the removed role.

## Validation

- `go build ./coderd/... ./enterprise/...`
- full `coderd/database/migrations`, `coderd/rbac/...`, and
`coderd/database/dbauthz` suites
- targeted members tests in `coderd`
- repository pre-commit checks (`lint/go`, `lint/ts`, etc.)

> Mux created this pull request on Mike's behalf.
 2026-08-26 15:29:26 +02:00
Hugo Dutka 31146642ba fix(codersdk/toolsdk): select default chat org based on recent usage (#28543) 
When `coder_create_chat` omitted `organization_id`, it selected the
first organization membership, which could choose an organization
without an available chat model.

Default to the organization used by the user's most recently updated
chat. For users with multiple organizations and no prior chats, return a
descriptive error requiring `organization_id`; single-organization
behavior is unchanged.

Closes
https://linear.app/codercom/issue/CODAGT-968/fix-mcp-chat-creation-organization-selection

<details>
<summary>Coder Agents disclosure</summary>

This pull request was generated by Coder Agents.
</details>
 2026-08-26 14:52:44 +02:00
Susana Ferreira e3e7200cff fix(site): distinguish cross-org budgets (#28596) 
## Description

Group member budget actions were disabled whenever another group
governed the member's budget, including groups in the same organization.

Distinguish same-organization and cross-organization effective groups so
administrators can manage overrides from any same-org group page. Keep
the action disabled when the effective group belongs to another
organization.

## Changes

- Add an `otherOrganization` effective-group classification.
- Enable budget management for same-org effective groups.
- Keep budget management disabled for cross-org effective groups.
- Render same-org lookup failures without the cross-org message.

> [!NOTE]
> Generated by Coder Agents on behalf of @ssncferreira.
 2026-08-26 13:09:39 +01:00
Michael Suchacz 845790e652 feat: enable Coder Agents for organization members (#28186) 
## Summary

- make Coder Agents available to organization members without a separate
built-in role
- remove the obsolete role from backend and frontend role surfaces
- update authorization, UI, documentation, and regression coverage

## Database note

This PR intentionally ships no migration so it backports cleanly across
diverged migration numbers. Stale `agents-access` grants may remain in
user role arrays and org default member roles; the retired name is
treated as a grant of nothing (role expansion drops it, assignment
validation ignores it, and the name stays reserved). A follow-up PR will
add the data cleanup migration.

## Validation

- `make gen`
- `make lint`
- repository pre-commit checks
- targeted RBAC, migration, chat API, enterprise, site, Storybook, and
race tests
- `git diff --check`

## Rollback note

Rolling back the deployment restores the previous behavior directly: no
data changed, and older binaries still resolve any lingering
`agents-access` grants.

> Mux created this pull request on Mike's behalf.
 2026-08-26 13:33:13 +02:00
Hugo Dutka 9dda7e7a1b test(cli): wait for expected GitHub auth state (#28622) 
The GitHub OAuth server test treated any successful `AuthMethods`
response after restart as ready. In the failing macOS run in CI
(described in the linked Linear issue), the response decoded
successfully but reported GitHub authentication as disabled, even though
startup logged the default GitHub provider configuration.

Wait until the complete GitHub authentication method reaches the
expected state before asserting it. This preserves retries for transport
readiness while also covering successful but incorrect startup
responses.

Closes
https://linear.app/codercom/issue/ENG-3285/flake-testserveroauth2githubdefaultprovidernewdeployment

<sub>Generated by Coder Agents.</sub>
 2026-08-26 13:16:29 +02:00
Susana Ferreira 56c614422e fix: clarify AI provider collision warnings (#28549) 
AI provider collision warnings were only partially asserted, and the
update coverage did not exercise a provider changing from a distinct
hostname to a colliding hostname.

Assert the complete warning consistently across create, get, list, and
update responses, cover collisions introduced by base URL and
enabled-state updates, and only return the proxy-specific warning when
AI Gateway Proxy is enabled. Clarify that lifecycle status values are
reported by the provider metrics.

Follow-up to #28208.

> [!NOTE]
> Generated by Coder Agents for @ssncferreira.
 2026-08-26 11:12:33 +01:00
Jake Howell bd4af31f78 fix(coderd/provisionerdserver): clarify duplicate preset errors (#28530) 
> 🤖 This PR was written by Coder Agents on behalf of Jake Howell.

Template imports with duplicate preset names currently expose the
underlying PostgreSQL unique constraint error.

Translate that constraint violation into a clear validation message that
identifies the duplicate preset name.

<img width="1110" height="462" alt="image"
src="https://github.com/user-attachments/assets/dc7b86a3-8f85-4694-a0be-aea3d0b53360"
/>


Closes https://github.com/coder/coder/issues/19270
 2026-08-26 11:00:31 +07:00
Jake Howell 5008603d08 fix(site): dispose Monaco diff models on unmount (#28503) 
> 🤖 This PR was written by Coder Agents on behalf of Jake Howell.

Fixes
[DEVEX-736](https://linear.app/codercom/issue/DEVEX-736/template-editor-crashes-becomes-unusable-when-opening-versions).

## Problem

Opening template versions in the template editor leaks Monaco text
models. Each version renders one `DiffEditor` per changed file, and
`SyntaxHighlighter` sets `keepCurrentOriginalModel` /
`keepCurrentModifiedModel`, which tells `@monaco-editor/react` **not**
to dispose the underlying text models when the editor unmounts. Because
no stable model paths are supplied, every visit creates fresh anonymous
models that are never freed. Navigating between versions accumulates
models without bound until the tab lags, spins, and eventually OOMs —
matching the customer reports on 2.34.5.

The flags themselves are still required: removing them makes the library
dispose the models mid-teardown (before the `DiffEditorWidget` is torn
down), which throws.

## Fix

Keep the `keepCurrent*Model` flags, but move the diff editor into its
own `DiffFile` component that owns the model cleanup:

- `DiffFile` captures the `original`/`modified` models in `onMount` and
disposes them in its own unmount effect. Because the effect lives with
the diff editor, it runs whenever the diff editor unmounts — **including
when a file switches diff → plain across versions while
`SyntaxHighlighter` stays mounted** (the `key={filename}` case raised in
review), not only on full unmount.
- Disposal is deferred with `queueMicrotask` so it runs after React's
commit and after `@monaco-editor/react` disposes the widget. Freeing the
models in the same synchronous teardown throws `TextModel got disposed
before DiffEditorWidget model got reset`.

Non-diff files use the plain `Editor`, which already disposes its own
model, so they are unaffected. No editor options or UI behavior change.

## Evidence

Reproduced locally on a template with 32 versions (9 `.tf` files each),
driving 192 in-app version navigations (single SPA session, no page
reloads) and reading `monaco.editor.getModels().length` via temporary
instrumentation.

| | before (pass 1 → pass 6) | after (pass 1 → pass 6) |
|---|---|---|
| retained Monaco models | 532 → **3,142** (unbounded) | ~10–19 (flat) |
| per-navigation render latency | 206ms → **611ms** | ~120–270ms (flat)
|

Before: models climb ~520 per full pass and never release (a sample
taken with zero editors on screen still showed 522 live models). After:
model count and render latency stay flat across the same workload.

## Testing

Added `SyntaxHighlighter.stories.tsx` with a `play` regression test
(`DisposesModelsOnDiffToggle`) that reproduces the exact leak: it
toggles a single surviving `SyntaxHighlighter` between diff and plain
three times and asserts `monaco.editor.getModels().length` drops when
the diff is removed and returns to the baseline each cycle (no
accumulation).

- The test **fails on the unfixed behavior** (disposal removed):
`expected 5 to be less than 4` — models grow instead of being freed.
- With the fix it passes with **zero Monaco teardown errors**:

  ```
$ pnpm test:storybook
src/components/SyntaxHighlighter/SyntaxHighlighter.stories.tsx
   Test Files  1 passed (1)
        Tests  3 passed (3)
       Errors  0
  ```

- `pnpm check` (biome) — pass
- `pnpm lint:types` (`tsc --noEmit`) — pass
- Manual stress test: model count and render latency stay flat across
192 navigations (see Evidence).

<details>
<summary>Investigation & decision log</summary>

**Root cause trace**
- `site/src/pages/TemplateVersionPage/TemplateVersionPageView.tsx` →
`TemplateFiles` renders every template file at once.
- Each changed file → `SyntaxHighlighter` → a full Monaco `DiffEditor`.
- `@monaco-editor/react@4.7.0` unmount cleanup does, in effect:
  ```js
  const model = editor.getModel();
  keepCurrentOriginalModel || model.original.dispose();
  keepCurrentModifiedModel || model.modified.dispose();
  editor.dispose();
  ```
With both `keepCurrent*` flags set, neither model is disposed, so they
leak.
- The flags exist to stop a storybook hang caused by that same
disposal-order error, so they cannot simply be removed.

**Options considered**
1. Remove the flags — fixes the leak but re-introduces the mid-teardown
throw. Rejected.
2. Supply stable `originalModelPath`/`modifiedModelPath` so models are
reused — the library reuses by URI, but its value-sync effect is skipped
on the first render, so a reused model renders **stale content** for the
new version. Rejected.
3. Keep the flags and dispose the captured models when the diff editor
unmounts — targeted and correct for the diff → plain → diff case.
**Chosen.**

**Why the cleanup is scoped to a child component**
The first iteration kept the effect in `SyntaxHighlighter` with an empty
dependency array, so it only ran on full unmount. Review correctly
flagged that a surviving instance switching diff → plain would then
orphan the previous model pair. Scoping the effect to the `DiffFile`
child ties it to the diff editor's own lifecycle, closing that gap.

**Why `queueMicrotask`**
Disposing synchronously in the effect cleanup races Monaco's own widget
teardown and throws `TextModel got disposed before DiffEditorWidget
model got reset`. Deferring one microtask lets the widget finish tearing
down first.

**Test-only editor options**
The stories pass `renderGutterMenu: false` / `occurrencesHighlight:
"off"` through `editorProps`. Those Monaco features register delayed
disposables whose teardown throws under jsdom on unmount; disabling them
keeps the test runner clean. They do not affect model count, and
production keeps Monaco's default options unchanged.
</details>
 2026-08-26 10:32:08 +07:00
Bobby HoandMcKayla はな c9fc5b7ea1 fix: canonicalize API key scope aliases at ingress (#28322) 
`rbac.IsExternalScope` accepts `all` and `application_connect`, neither
of which is an `api_key_scope` enum member. The plural `Scopes` field
stored the name as given, so `{"scopes":["all"]}` passed validation and
then 500'd inside `apikey.Generate` with `invalid API key scope: "all"`.
Reachable from `coder tokens create --scope all`, from the spellings
`docs/admin/users/sessions-tokens.md` taught, and from the `codersdk`
constants exported for exactly this purpose.

- Canonicalize inside `apikey.Generate`, in the loop that already
validates each name. One statement covers every caller and all three
input paths: plural `Scopes`, deprecated singular `Scope`, and the
default. Replaces two open-coded switches and the handler's own
per-element copy, so one place decides the stored spelling and the
handler only decides what may be requested.
- Deduplicate in the same pass. An alias and its canonical spelling are
two names going in and one name in the column.
- `ExternalScopeNames()` lists every name `IsExternalScope` accepts,
instead of dropping catalog entries that fail to parse. A curated entry
that cannot be stored used to pass every test and 500 at runtime; it now
fails two.
- Split the 400. A misspelled name and an internal `api_key_scope`
member need different words, since no re-spelling makes the second
requestable. Both rejection sites share one helper that names the case
and links the docs.
- Add reject-path tests for `not_a_real_scope` and `debug_info:read`.
The second is a valid enum member the rbac catalog treats as internal,
so before this both handler guards could be deleted with the suite still
green. A further case pins that plural `Scopes` wins when a caller sets
both fields.
- `TestExternalScopesAreStorable` pins the class rather than the two
known instances: every public rbac scope name must be storable.
`coderd/rbac` cannot assert this itself, since `database` imports `rbac`
and not the reverse.
- Docs use the canonical spellings, link the `codersdk.APIKeyScope`
schema, and say which scopes a token cannot request.

Egress is unchanged: `convertAPIKey` still derives a legacy singular
name on the way out. `ExternalScopeNames()` returns the same 57 names as
before, and `codersdk/apikey_scopes_gen.go` regenerates identically.

`rbac.CanonicalScopeName` merged with #28167, so this applies to `main`
and reviews on its own. The OAuth2 provider ignores scopes entirely
today (`authorize.go:237`, `tokens.go:377`, `tokens.go:520`), so it is
unaffected until those TODOs resolve.

Deferred from review: PLAT-528, PLAT-529, PLAT-530, and PLAT-532.
PLAT-532 covers `{"scopes":[]}` and `{"allow_list":[]}` defaulting open,
which predates this PR.

---------

Co-authored-by: McKayla はな <mckayla@hey.com>
 2026-08-25 17:12:51 -07:00
McKayla はな 895c5c77a1 feat: add a template parameter settings page (#27559) 2026-08-25 15:06:30 -06:00
Bobby Ho 2236710bad fix(coderd/notifications): HTML-escape the email template values (#28397) 
Follows #28340, now merged.

`smtp.go` renders the notification title through
`PlaintextFromMarkdown`, which strips Markdown **and decodes HTML
entities**, then stores the result in `Labels["_subject"]`.
`html.gotmpl` interpolated that raw into `<title>` and `<h1>`, so an
entity-encoded payload in a user-controlled label arrived as live
markup:

```
template_display_name = &lt;a href="https://attacker.example/login"&gt;Re-authenticate now&lt;/a&gt;

  -> <title>Template "<a href="https://attacker.example/login">Re-authenticate now</a>" deleted</title>
```

Markdown escaping cannot reach this. `&` is not backslash-escapable in
either renderer, and this path never enters gomarkdown, so neither
`html.SkipHTML` nor the `Safelink` added in #28340 sees the string. `{{
.UserName }}` was interpolated raw at the same template, straight from
the unescaped payload the dispatcher receives.

This PR adds `| html` to seven values across eleven positions in
`html.gotmpl`:

| Value | Positions | Why |
|---|---|---|
| `.Labels._subject` | 2 | the injection above, in `<title>` and `<h1>`
|
| `.UserName` | 1 | reaches the template straight from the unescaped
payload |
| `$action.URL` | 1 | rendered from user data at `enqueuer.go:201`;
`EscapedForMarkdown` does not touch `Actions` |
| `$action.Label` | 1 | static today, escaped so it stays safe if that
changes |
| `base_url` | 4 | `--access-url` is scheme-checked only, so a `"`
closes the `href` |
| `current_year` | 1 | cannot carry markup, escaped so the rule has no
exceptions |
| `.NotificationTemplateID` | 1 | same |

`logo_url` and `app_name` were already escaped in #28340. `{{
.Labels._body }}` stays unescaped: it is intentionally gomarkdown
output, and it is the only value in the file that is not escaped.

The action and `base_url` values are defense in depth rather than open
holes. A `"` in an action URL fails closed at enqueue, because the
rendered actions JSON is unmarshalled before use and the quote breaks
that parse; `<`, `>`, `&` and `'` survive but are inert inside a
double-quoted attribute. `base_url` requires an operator to set a
hostile `--access-url`.

Every value is guarded by a test. Removing `| html` from any of the nine
escaped values now fails a named test, verified by removing each pipe in
turn:

- `TestSMTPHTMLTemplateEscapesUntrustedValues` covers `_subject`,
`UserName` and both action values.
- `TestSMTPHTMLTemplateEscapesTrustedValues` covers `base_url`,
`current_year` and `.NotificationTemplateID`, none of which can carry
markup in production, so no golden file would catch their regression.
- `TestSMTPHTMLTemplateEscapesAppearanceHelpers` covers `logo_url` and
`app_name`.

That last point is why the trusted values needed tests rather than
goldens: escaping them costs zero golden churn, so nothing already in
the tree fails when it is removed. Before this PR the same was true of
`$action.Label`, whose escaping could be deleted with no golden diff and
no failing test at all.

The 36 golden files change by entity encoding only, mostly `"` to
`&#34;` and `'` to `&#39;` in subjects. Verified by quoted-printable
decoding every file before and after and confirming the two are
identical once HTML entities are decoded: 36/36 with no semantic
difference. Escaping `base_url`, `current_year` and
`.NotificationTemplateID` added no further churn.

**NOTE**: `$action.URL | html` turns the `&` in the one-time passcode
reset link into `&amp;`. That is the correct encoding of a literal `&`
in an attribute value, and every conformant client decodes it before
navigating, so the request the server receives is unchanged. It is the
only golden change with behavior attached.

Migrating this template to `html/template` was considered and declined;
the reasoning and the conditions that would reverse it are on the CRF-3
review thread.

Refs
https://linear.app/codercom/issue/PLAT-273/markdown-link-injection-into-admin-notification-emails-sec-93
 2026-08-25 14:02:33 -07:00
Callum Styan c4d356ff71 feat(cli): add --username-infix selection to scaletest notifications… (#28515) 2026-08-25 12:48:00 -07:00
Callum Styan f4730aed12 feat: add --username-infix to scaletest create-users (#28514) 2026-08-25 12:45:02 -07:00
Nick Vigilante ce59a86a81 docs: fix Coder Agents tool tables, search filters, attachments, template ranking (#28575) 
Corrects four independent factual errors in the Coder Agents
documentation, each verified against the current implementation.

- **Missing tools in the tool tables.** `stop_workspace` was absent from
the built-in tool table in `docs/ai-coder/agents/index.md` and the
platform tool table in `docs/ai-coder/agents/architecture.md`, and from
the root-chat-only tool list. `find_tools` was undocumented entirely;
both docs now list it with its `mcp-tool-search` experiment gating.
- **Missing `source:` search filter.**
`docs/ai-coder/agents/chat-search-syntax.md` documented every chat
filter except `source:`, while also stating that unrecognized keys
return HTTP 400. Adds the filter row and an example.
- **Attachments described as images only.** The attachments section
claimed PNG, JPEG, GIF, and WebP up to 10 MB. The upload allowlist also
accepts plain text, Markdown, CSV, JSON, and PDF; the cap is 10 MiB per
upload with at most 50 attachments per conversation, and Anthropic
models cap inline images at 5 MiB. Also notes that providers differ in
accepted file types and that rejected parts are downgraded to text.
- **Template ranking described as popularity sort.**
`docs/ai-coder/agents/platform-controls/template-optimization.md` said
templates are sorted by active developer count. `list_templates` ranks
by query relevance tiers first, then by an affinity score that weights
the user's own recent usage far above organization popularity. Wording
now matches `docs/ai-coder/agents/tools/index.md`, which already
documents the formula, and links to it.

Linear: DOCS-716 https://linear.app/codercom/issue/DOCS-716

<details><summary>Analysis evidence</summary>

| Claim | Source |
|-------|--------|
| `stop_workspace` is a root-chat platform tool registered alongside
`create_workspace` and `start_workspace` |
`coderd/x/chatd/chattool/stopworkspace.go`; registration in
`coderd/x/chatd/chatd.go` (`chattool.StopWorkspace`), root-only gate in
`builtinPlanToolAllowed`, disabled for explore sub-agents in
`allowedExploreToolNames` |
| `find_tools` requires the `mcp-tool-search` experiment and deferrable
MCP candidates | `coderd/x/chatd/chattool/findtools.go`;
`decideMCPToolSearch` in `coderd/x/chatd/mcp_tool_search.go` returns
false without `codersdk.ExperimentMCPToolSearch` or with no candidates;
wired in `coderd/x/chatd/generation_preparer.go` |
| `source:` accepts `created_by_me` and `shared_with_me`; passing both
returns owned plus shared; default is owned only |
`coderd/searchquery/search.go` (`Chats`): filter defaults to `OwnedOnly:
true`; the `source` parser rejects any other value, and both values
together set `OwnedOnly` and `SharedOnly`. The literal value `all`
appears in the doc comment but is not accepted by the parser, so it is
not documented. |
| Attachment allowlist, size caps, and per-conversation limit |
`codersdk/chats.go`: `AllChatAttachmentMediaTypes` covers
`application/json`, `application/pdf`, `image/gif`, `image/jpeg`,
`image/png`, `image/webp`, `text/csv`, `text/markdown`, `text/plain`;
`MaxChatFileSizeBytes = 10 * 1024 * 1024`; `MaxChatFileIDs = 50`;
`AnthropicInlineImageCapBytes = 5 * 1024 * 1024` |
| Anthropic and Bedrock share the inline image cap; rejected file parts
are downgraded to text | `coderd/x/chatd/chatprovider/chatprovider.go`:
`InlineImageCapBytes` and `Model.AcceptsFilePartMediaType` |
| Template ranking is relevance tiers then a composite affinity score |
`coderd/x/chatd/chattool/listtemplates.go`: `rankTemplates` sorts by
query score first; `computeAffinityScore` adds recency-decayed personal
usage at `listTemplatesPersonalWeight = 10.0` to `ln(1 +
active_developers)` at `listTemplatesOrgWeight = 1.0` |

Note: `MaxChatFileIDs` is enforced per chat, not per message
(`coderd/exp_chats.go`: "A chat can reference at most %d attachments"),
so the docs say per conversation.

Validation: `pnpm run format-docs` and `pnpm run lint-docs` both pass (0
errors). The formatter widened the touched tables, which accounts for
the reformatted rows in the diff.

</details>

Generated by Coder Agents on behalf of @nickvigilante.
 2026-08-25 15:13:21 -04:00
Nick Vigilante 06c0d3918a docs: correct plan mode MCP tool availability (#28569) 
`docs/ai-coder/agents/index.md` claimed that MCP tools are blocked in
plan mode. Root plan-mode chats actually receive external MCP tools for
each server configuration an administrator approved for plan mode; only
workspace MCP tools and plan-mode sub-agents get none.

Corrects the plan-mode tool-availability wording in both places it
appears in `index.md` so it matches
`docs/ai-coder/agents/architecture.md` and the implementation. The tool
table and attachment wording are out of scope here.

Linear: DOCS-724 https://linear.app/codercom/issue/DOCS-724

<details><summary>Analysis evidence</summary>

`coderd/x/chatd/chatd.go`, `filterExternalMCPConfigsForTurn`: in plan
mode, a chat with a parent gets no external MCP configs ("Plan-mode
subagents do not receive external MCP tools"); a root chat keeps every
config whose `AllowInPlanMode` flag is set and returns those IDs as
approved.

`coderd/x/chatd/generation_preparer.go`: the returned
`approvedPlanMCPConfigIDs` flows into `filterToolsForTurn` and
`activeToolNamesForTurn`, so approved external MCP tools remain exposed
for the turn.

`coderd/x/chatd/chatd.go`, `toolAllowedForTurn`: in plan mode a tool
passes only if it is on the built-in plan allowlist or is an MCP tool
whose `MCPServerConfigID()` is in the approved set. Workspace MCP tools
are not in the external config set, so they stay unavailable.

`docs/ai-coder/agents/architecture.md` already documents this behavior;
`index.md` now uses the same framing.

</details>

Generated by Coder Agents on behalf of @nickvigilante.
 2026-08-25 19:02:35 +00:00
Michael Suchacz 60b03138ae fix(coderd/x/chatd): truncate overlong generated chat titles instead of rejecting them (#28589) 
Chat title generation asks the model for a title in 2-8 words and then
hard-rejects any response longer than 8 words
(`validateGeneratedTitle`). Quickgen pins temperature for repeatable
output, so a model that overshoots the budget for a given conversation
overshoots on every retry: the rename dialog's Generate button returns a
deterministic 500 (`generate manual title: generated title exceeded 8
words`) no matter how often it is clicked, and the automatic
first-message path silently leaves the chat on its fallback title. On
dev.coder.com this rejection fires 1-3 times a day; one chat took 13
consecutive manual failures on 2026-08-25 (14:22-14:27 UTC).

Truncate the normalized title to the 8-word budget in
`normalizeTitleOutput` instead of rejecting it, and keep the empty-title
validation. Both the automatic and manual title paths share this
normalization, so both are fixed.

> Xum (AI agent) authored this change and PR on Mike's behalf.
 2026-08-25 17:56:30 +00:00
TJ 74e5a680bd fix(site/src/pages/AgentsPage): use outlined empty state and kebab menu for personal skills (#28560) 
Polishes the `/agents/settings/personal-skills` page to match the table
patterns used elsewhere (e.g. the AI Gateway keys page):

- The table now renders in every state, so the content area always keeps
its outline: `TableLoader` while loading, a `TableEmpty` with a Retry
CTA on error (with the `ErrorAlert` above), and a `TableEmpty` with an
Add skill CTA when there are no skills.
- The per-row Download / Edit / Delete buttons are replaced with a kebab
(`EllipsisVertical`) dropdown menu, following the pattern in
`CustomRolesPageView`. The trigger shows a spinner and disables while a
download is in flight, and the Actions column header is now
screen-reader only.

Storybook interaction coverage: `RowMenuActions` opens the kebab and
exercises Download, Edit, and Delete; `DownloadingSkill` asserts the
disabled trigger.

<details>
<summary>Review notes</summary>

Self-audited the diff against the FE1-FE10 rules in
`.claude/docs/FRONTEND_PATTERNS.md`: all rules pass. All 22 stories pass
locally, along with Biome and `tsc`.

</details>

---

Generated by Coder Agents on behalf of @tracyjohnsonux.
 2026-08-25 10:37:14 -07:00
Nick Vigilante b146e6f262 docs: align Coder Agents docs with GA framing and licensing terms (#28571) 
Removes early-access-program framing from the Coder Agents docs, drops a
stale `early access` manifest tag, and standardizes the licensing
wording on "Premium license with the Agent Hours entitlement".

- `docs/ai-coder/agents/getting-started.md`: replaces the "collaborative
evaluation between your team and Coder" and customer-specific Slack
channel feedback path with GitHub issues plus normal Coder support
channels, and rewrites the remaining evaluation-period wording to GA
tone. Rollout guidance (pilot group, cost planning, concurrency) is
kept.
- `docs/manifest.json`: removes `"state": ["early access"]` from
`ai-coder/agents/platform-controls/chat-debug-logging.md`, which is not
experiment-gated.
- Licensing terminology aligned across `getting-started.md`,
`licensing-usage.md`, and `platform-controls/index.md`.

No changes to `docs/reference/api/**` and no API path changes.

<details><summary>Analysis evidence</summary>

**Manifest state tag decisions (all `ai-coder/agents` pages)**

| Page | Tag before | Tag after | Why |
|------|-----------|-----------|-----|
| `platform-controls/chat-debug-logging.md` | `["early access"]` | none
| Routes at `coderd/coderd.go` (`GET`/`PUT /debug-logging`, `GET`/`PUT
/user-debug-logging`) sit outside any `RequireExperimentWithDevBypass`
group, there is no matching experiment in the `codersdk.Experiment`
list, and the page body already states the feature is not
experiment-gated. |
| `platform-controls/advisor.md` | `["early access"]` | unchanged |
Gated by `codersdk.ExperimentChatAdvisor` (`chat-advisor`); routes
wrapped in `RequireExperimentWithDevBypass`. |
| `platform-controls/virtual-desktop.md` | `["early access"]` |
unchanged | Gated by `codersdk.ExperimentChatVirtualDesktop`
(`chat-virtual-desktop`); routes wrapped in
`RequireExperimentWithDevBypass`. |
| `platform-controls/spend-management.md` | `["premium"]` | unchanged |
`premium` is a licensing tag, not a maturity tag, and the page states
budget endpoints require a license that includes AI Gateway. Flagging
for awareness rather than changing it. |
| All other `ai-coder/agents` pages | none | none | No maturity tags to
review. |

**Licensing mechanics**

`enterprise/coderd/license/license.go` decodes
`agent_runtime_hours_allocation`, `agent_runtime_hours_limit_soft`, and
`agent_runtime_hours_limit_hard` into
`codersdk.FeatureAgentRuntimeHours` on Premium licenses.
`enterprise/coderd/x/chatd/agentadmission.go` lifts the concurrency cap
only when that feature is enabled and usage is below the hard limit. So
the entitlement, not the license tier alone, is what removes the cap.
Wording is now "Premium license with the Agent Hours entitlement".

`licensing-usage.md` keeps "Agent Time" as the name of the measured
usage metric (matching `runtime_ms` reporting) and now says explicitly
that Agent Time draws down the Agent Hours entitlement. Renaming the
metric itself was left out of scope; flagging in case the product team
wants one name for both.

**Validation**

`pnpm install --frozen-lockfile`, `pnpm run format-docs` (no table
changes), `pnpm run lint-docs` (499 files, 0 errors).

</details>

Linear: DOCS-718 https://linear.app/codercom/issue/DOCS-718

Generated by Coder Agents on behalf of @nickvigilante.
 2026-08-25 13:10:03 -04:00
McKayla はな 29995c9ef8 feat: add a per-template workspace rename setting (#27558) 2026-08-25 11:05:42 -06:00
Nick Vigilante 827c11f43a docs: update Coder Agents admin navigation to AI Settings (#28572) 
## Summary

Fixes stale admin navigation on the three Coder Agents platform-controls
pages not covered by #28482: the retention pages pointed at tabs that do
not exist ("Behavior", the old Agents settings "Lifecycle" tab), and
template optimization pointed at the removed **Agents** > **Settings** >
**Manage Agents** navigation.

Breadcrumbs follow the **Admin settings** > **AI** > **Coder Agents**
convention established by #28482.

## Changes

- `docs/ai-coder/agents/platform-controls/chat-retention.md`: replace
the nonexistent **Behavior** tab with **Admin settings** > **AI** >
**Coder Agents** > **Lifecycle**.
- `docs/ai-coder/agents/platform-controls/chat-debug-retention.md`: same
page, same convention, aligned with chat-retention.md.
- `docs/ai-coder/agents/platform-controls/template-optimization.md`:
replace **Agents** > **Settings** > **Manage Agents** > **Templates**
with **Admin settings** > **AI** > **Coder Agents** > **Templates**.

## Scope note

The first revision also fixed `models.md`, `advisor.md`,
`chat-debug-logging.md`, and `platform-controls/index.md`. Those pages
are covered by #28482 with the same corrections, so this PR reverted
them to avoid conflicting edits and adopted that PR's breadcrumb
convention instead.

Linear: DOCS-715 https://linear.app/codercom/issue/DOCS-715

<details><summary>Analysis evidence</summary>

- `site/src/router.tsx` (~735-780):
`/ai/settings/{lifecycle,templates,coder-agents}` are the live routes;
`/agents/settings/{admin pages}` (~833-890) are `Navigate`-only
redirects.
- No "Behavior" tab exists in any router revision;
`RetentionPeriodSettings` and `DebugRetentionSettings` both render in
`LifecyclePageView.tsx`.
- Breadcrumb convention **Admin settings** > **AI** verified against
`AdminSettings.tsx` / `AISettingsSidebarView.tsx` in #28482.

</details>

Generated by Coder Agents on behalf of @nickvigilante.
 2026-08-25 12:49:27 -04:00
Marcin Tojek 31a976b288 chore(docs): update release docs for v2.35.6 (#28577) 
Automated docs update for v2.35.6 release.

Created by `releasetui`.
 2026-08-25 18:33:58 +02:00
Ethan 409049d1d8 docs: document org-scoped admin configuration for agents (#28482) 
## Summary

Documents the organization scoping of Coder Agents admin configuration,
and corrects the navigation paths, access wording, and default-model
instructions that no longer matched the product. Documentation only, no
product code changes.

Follows #28473, which moved the organization model overrides into an
**Organization settings** section on **Admin settings > AI > Coder
Agents**. #28473 is merged, so this targets `main`.

Closes CODAGT-715

## Changes

- **New page**
`docs/ai-coder/agents/platform-controls/organizations.md`, registered in
`docs/manifest.json`. Covers the deployment/organization scope split,
what an upgrade changes, how an organization without models or MCP
servers behaves, who configures each scope, and how model and MCP server
sharing works.
- **`models.md`**: models are organization-scoped while providers and
their credentials stay deployment-wide. Each organization has one
default model, and the first model added becomes it. Documents the
**Default** badge and the **Set as Coder Agents default model** form
option in place of the star action that no longer exists, and points
model overrides at **Organization settings**.
- **`getting-started.md`**: replaces the Owner-only claim with the
actual access model, adds an organization selection step, and uses the
**Add model** label.
- **`platform-controls/index.md`**: separates deployment-wide controls
from organization-scoped controls, documents personal model overrides
alongside the model configuration section rather than as an enforcement
caveat, and adds `--agents-allowed` plus the `agents-allowed:` search
filter.
- **`platform-controls/advisor.md`** and
**`platform-controls/virtual-desktop.md`**: the Advisor and Virtual
desktop settings are cards in the **Deployment settings** section of the
**Coder Agents** page, not sidebar entries. **Providers** is a sidebar
item, not a tab.
- **`platform-controls/mcp-servers.md`**: slug uniqueness is per
organization, the **Add server** label is correct, and the page is no
longer described as admin-only.
- **`architecture.md`**, **`index.md`**,
**`tasks-to-chats-migration.md`**: organization scope corrections and
organization-scoped model routes.
- Breadcrumbs standardized to **Admin settings > AI > ...**, verified
against `AdminSettings.tsx` and `AISettingsSidebarView.tsx`.

<details>
<summary>Review follow-ups</summary>

The first revision leaked implementation detail into user-facing pages
and contained several claims that did not match the UI. The follow-up
commit removed and corrected the following.

Removed as implementation detail:

- The `chat_model_config` RBAC resource, its actions, and the token
scopes.
- The `available`, `unavailable_reason`, and `unsupported_providers`
response fields, along with the `missing_api_key`, `fetch_failed`, and
`user_api_key_required` values.
- Role and permission tables, ACL storage mechanics, audit internals,
and JSON error bodies on the new organizations page.
- Migration mechanics with no effect on what a user does.

Corrected against the product:

- The star action does not exist. The list shows a **Default** badge and
the add/edit form offers **Set as Coder Agents default model**
(`ModelRow.tsx`, `ModelFormFields.tsx`).
- The first model added to an organization becomes its default
automatically (`coderd/exp_chats.go`). An organization without a stored
default does not fail every chat, so that claim is gone.
- Advisor and Virtual desktop are cards under **Deployment settings**
(`CoderAgentsPageView.tsx`).
- The MCP servers page does not require deployment configuration edit
permission (`AISettingsSidebarView.tsx`).
- Button labels: **Add model** and **Add server**.
- The organization query parameter is `org`, confirmed by
`modelOrganizationSearchParam`.

Left alone deliberately: pre-existing defects outside the introduced
text, including the `/api/v2/chats` route prefixes, create-chat examples
missing `organization_id`, and the pre-existing MCP permissions table.

</details>

## Testing

- `pnpm run format-docs` and `pnpm run lint-docs` pass.
- `make lint/emdash` passes. No emdash or endash added.
- `grep -rn "Defaults & overrides" docs/` returns nothing.
- Every navigation path, button label, and access claim checked against
the corresponding file under `site/src/pages/AISettingsPage/` and
`site/src/modules/management/`.

---

This pull request was generated by Coder Agents on behalf of
@ethanndickson.
 2026-08-25 17:24:39 +01:00
Ethan 816f6fbeef fix(site): clarify chat model permission labels (#28579) 
Renames chat model sharing controls to permissions terminology so the UI
reflects that administrators are managing model access.

Uses “Use” as the user-facing role while preserving the backend `read`
ACL value, and updates the Storybook interactions for the new labels.
 2026-08-25 17:23:08 +01:00
TJ c07bde80c4 fix: use medium badges and shorter shared key label on agent API keys page (#28557) 
On `/agents/settings/api-keys`, bumps the provider key status badge and
the enabled model badges from `sm`/`xs` to the medium (`md`) size, and
shortens the status label "Using shared key" to "Shared key". Updates
the matching Storybook assertion and the status indicator name in
`docs/ai-coder/agents/models.md`.

Verified with `tsc` and the page's Storybook tests (15 passing).

---

*Created by Coder Agents on behalf of @tracyjohnsonux.*
 2026-08-25 16:16:59 +00:00
TJ 94f312dfbd refactor(site): use robot icon for subagent toggle in chat kebab menu (#28561) 
Replaces the rotated `GitForkIcon` on the "Show/Hide subagents" item in
the chat kebab menu with lucide's `BotIcon`, matching the robot icon
already used for subagents in the chat stream (`SubagentTool`,
`ToolIcon`).

---

*This PR was generated by Coder Agents on behalf of @tracyjohnsonux.*
 2026-08-25 16:34:29 +01:00
Bobby Ho 9e8075db0f fix: prevent markdown injection in notifications (#28340) 
First of two PRs.

Notification title and body templates are Markdown authored by Coder,
but the label values interpolated into them are user-controlled and were
substituted through `text/template`, which does no escaping. Those
values arrive from user profile fields and from OIDC/GitHub name claims.

This PR:

- Neutralizes Markdown structure in label, data, and `UserName` values
before they reach the template. Applied in `notifier.prepare`, so
already-queued messages are covered and the stored payload keeps its
original values for webhook consumers. Nested `.Data` map keys are
escaped too: one shipped template prints a key, and those keys are
Terraform resource addresses.
- Narrows the notification Markdown grammar to what templates actually
use. `CommonExtensions` enabled Tables, DefinitionLists and MathJax,
each openable from a value and used by no template. Autolink stays off
so a URL in a value cannot become an anchor.
- Enables `html.Safelink`, restricting generated hrefs to safe schemes,
and guards the panic it exposes: `parser.IsSafeURL` slices a destination
before bounds-checking it, so `[docs]()` crashed both renderers.
- Folds line breaks out of the `Subject:` header and encodes it, fixing
a pre-existing RFC 2047 violation for non-ASCII subjects, a forged
encoded-word that let a value choose the displayed subject, and headers
running past RFC 5322's 998-octet line limit.

Escaping is narrow on purpose, split by where each character carries
meaning:

- `` \[]()!<` `` everywhere. Backtick is in this group because a fenced
block's info string is an HTML sink: gomarkdown writes it into
`class="language-..."` unescaped, and `SkipHTML` does not apply to a
`CodeBlock` node, so a value that closes the attribute and the tag
injects live markup.
- `#-+.>|` only in leading position, so values like `bobby-workspace`
and `1.5` are untouched.
- `=`, `~` and `:` are not escapable by both renderers, so the preceding
line break is folded instead. `:` opens a definition list and a GFM
table delimiter row that escaping `|` cannot reach. A value's *first*
line has no preceding break to fold, so a real tilde fence or `===`
underline is escaped there instead, accepting a visible backslash: an
unterminated `~~~` at the start of a title otherwise renders the
Subject, `<title>` and heading empty.
- Leading indentation is truncated to three spaces. Four open an
indented code block and a space has no escape.
- Emphasis characters are left alone. Escaping `_` corrupts label values
such as `user_override` that body templates compare with `eq`, which
silently drops content from the rendered email.

One golden file changes: the resource replacements `body_markdown` now
reads `docker_container\[0\]`, from the map-key escaping above. Every
other golden is byte-identical.

**One known residual**, pinned by a test that fails if it closes:
CommonMark does not process escapes inside a code span, so where a
template wraps a value in one, as the workspace out-of-disk body does,
the escaper's own backslashes reach the reader. That depends on where
the value lands rather than what it contains, which a pre-render escaper
cannot see. This narrows the class rather than closing it.

**#28397 completes the fix and is stacked on this branch. This PR should
not merge without it.**

Escaping here cannot reach the SMTP HTML template's sinks, by design
rather than by oversight: the subject is produced by
`PlaintextFromMarkdown`, which strips exactly the backslashes added
here, and `html.gotmpl` then interpolated the result through
`text/template`. On this branch alone, a label value still reaches the
Subject, `<title>` and `<h1>` as live markup. #28397 escapes at those
sinks with `| html`, which is the only place the information needed to
escape correctly exists.
 2026-08-25 08:12:00 -07:00
Jakub Domeracki be9f8592eb ci: use dedicated release App token to publish releases (#28553) 
## Problem

The `Publish release` step fails with `HTTP 403: Resource not accessible
by integration` because the default `GITHUB_TOKEN` cannot create the
release tag under the active tag-create protection ruleset.

## Change

Use a dedicated GitHub App token for the `Publish release` step:

- Add a `Generate release App token` step using `secrets.RELEASE_APP_ID`
/ `secrets.RELEASE_APP_PRIVATE_KEY`.
- Switch only that step's `GITHUB_TOKEN` to the minted App token.

## Required before merge (admin)

1. Create the release GitHub App (least privilege) and install it on
`coder/coder`.
2. Configure `RELEASE_APP_ID` / `RELEASE_APP_PRIVATE_KEY`.
3. Add the App to the tag-create protection ruleset bypass list.

Refs coder/security-automation#297.
 2026-08-25 16:32:01 +02:00
Garrett Delfosse 7fc9a6e449 fix: revert update on chat messages table (#28552) 
Reverts commit a2459f8dda from #28319
("fix(coderd/database): stamp existing vectors simple and match config
explicitly").

Note: #28319 was squash-merged, so this reverts only that commit's diff,
not the entire PR.

This directly edits a migration on main due to issues with the
previously merged migration taking too long on large tables.
 2026-08-25 10:14:41 -04:00
Matt Vollmer 79856ebd15 docs: reference Coder Agents instead of Coder Tasks in style guide (#28539) 
## Summary

Updates the Caitlin the Citizen Developer persona in the style guide to
reference Coder Agents instead of the deprecated Coder Tasks product.

### Changes

* `docs/.style/style-guide/audience-and-scope.md`: replaced both "Coder
Tasks" mentions with "Coder Agents" in the Caitlin persona description
and Coder surface list.

<details><summary>Context</summary>

Coder Tasks is deprecated as of v2.34 and replaced by Coder Agents. This
change keeps the internal style guide's persona reference aligned with
current product naming.

</details>

---

This PR was drafted by a Coder Agent on behalf of Matt.
 2026-08-25 10:03:25 -04:00
Garrett Delfosse 7cf24b1a37 docs(docs/ai-coder/agents): document the chat search: full-text filter (#28474) 
Documents the `search:` full-text filter in
`docs/ai-coder/agents/chat-search-syntax.md` and drafts the release
notes copy for chat history search.

Describes `main` plus #28319, which must merge first: stemming and
stopword removal apply to message content only; titles and PR titles
keep `simple` whole-word matching. All claims verified against the
implementation. Two statements in CODAGT-727 were inaccurate and are
documented as the code behaves:

- A value that tokenizes to no searchable words returns an **empty
list**, not HTTP 400
(`TestListChats_Search/NoSearchableWordsReturnsEmpty`). HTTP 400 covers
only an empty `search:` value, unsupported keys, bare terms, or
combining `search:` with `title:`, `pr_title:`, or `pr:`
(`coderd/searchquery/search.go`).
- Results are **paginated** with the standard chat list cursor (default
50), not a bounded non-paginated set (`GetChats`, `listChats`). Ordering
is pinned first, then most recently updated.

Also verified: message bodies are indexed by the dbpurge sweep
(10-minute tick, up to 5 x 10,000 rows, newest first) while titles and
PR titles are searchable immediately; numeric values match exact PR
numbers; `title:`, `pr_title:`, and `repo:` retain `ILIKE` semantics.

`pnpm run format-docs` and `pnpm run lint-docs` pass.

Closes
[CODAGT-727](https://linear.app/codercom/issue/CODAGT-727/chat-search-documentation-and-release-notes)

<details>
<summary>Release notes draft</summary>

### Chat history search

You can now search your chat history by what was said, not just by
title. The chat list `q` parameter accepts a new `search:` filter that
performs full-text search across chat titles, pull request titles, PR
numbers, and message content, for example `?q=search:"kubernetes
restart"`. Matching is case-insensitive and supports quoted phrases,
`OR`, and `-` negation. Message content additionally matches English
word stems (`refactor` finds a message containing `refactoring`).
`search:` cannot be combined with the `title:`, `pr_title:`, or `pr:`
filters; the existing substring filters are unchanged.

**Upgrading with existing chat history:** the message search index is
populated by a background job (every 10 minutes, up to 50,000 messages
per run, newest first). Upgrades are not blocked, and chat reads and
writes are unaffected while the index fills. Older messages appear in
search results progressively; messages indexed before the stemming
upgrade match exact word forms until re-indexed. Titles and PR titles
are searchable immediately.

</details>

---

🤖 This PR was generated by Coder Agents on behalf of @f0ssel.
 2026-08-25 09:09:10 -04:00
Garrett Delfosse 378ac91b49 fix: stem chat search terms with the english text search config (#28319) 
Chat message search used the `simple` text search config, which folds
case but does no stemming, so `refactor` did not match messages
containing `refactoring`. Message bodies now index and query with the
`english` config, which stems both sides. Titles, PR titles, and all
other filters are unchanged.

Migration `000585` adds a `chat_messages.search_tsv_config` enum column
recording which config produced each stored vector and stamps existing
vectors `'simple'` (a column-only update; vectors and indexes are
untouched, since rewriting `search_tsv` would block message writes on
large tables). The dbpurge sweep gains a bounded
`ReindexStaleChatMessagesSearchTsv` pass that rewrites stale vectors
newest first and stops for the process lifetime once drained. Until a
row is rewritten, `GetChats` matches it with the config that produced
it, so pre-migration exact-form searches keep working during the drain.
Vectors written by old binaries mid rolling upgrade cannot stamp the
config, stay pending, and self-heal on the next upgraded sweep.
Steady-state DB load is unchanged.

The down migration resets `english` vectors to `NULL` so the parent
version's existing sweep rewrites them with `simple`.

Closes
[CODAGT-867](https://linear.app/codercom/issue/CODAGT-867/backend-search-improvements-to-handle-partial-matches)

<details>
<summary>Decision log</summary>

- **`english` stemming over prefix matching.** On a 300k-row corpus a
stemmed lookup is a single GIN entry-tree probe, while `term:*` prefix
matching unions posting lists of every lexeme sharing the prefix (up to
a full scan for short prefixes), is asymmetric, and loses the
`websearch_to_tsquery` phrase/OR/negation UX. `pg_trgm` rejected as a
heavier index with different semantics.
- **Scope to message bodies only** (review). Titles and PR titles keep
their `simple` FTS expressions and indexes, identical to main.
- **Config-versioned queue over migration-time reset** (review). An
unqualified `UPDATE ... SET search_tsv = NULL` rewrites every indexed
row in the migration transaction, and an old replica could backfill
reset rows with `simple` vectors that permanently leave the `search_tsv
IS NULL` queue. The config column makes staleness explicit and both
problems disappear.
- **Enum over `text`** (review) for the config column.
- **Trade-offs.** English stopwords are dropped from message search
(stopword-only queries match no messages); stemming is English-specific;
titles do not stem; prefix matching remains out of scope.

</details>

---

🤖 This PR was generated by Coder Agents on behalf of @f0ssel.
 2026-08-25 09:08:52 -04:00
Ethan 6284964b5f test(coderd): remove flaky audit transaction case (#28468) 
The `TransactionAfterNoChange` case in
`TestChatRetentionDays_AuditInfrastructureFailureRejectsWrite` was flaky
in [Flake Check run
32717900411](https://github.com/coder/coder/actions/runs/32717900411).
Its generic `InTx` wrapper armed a shared fail-next flag, so an
unrelated background transaction could consume the failure and let the
target PUT return 204 instead of the expected 500.

Remove the shared transaction wrapper and replace the endpoint-level
case with deterministic unit coverage of
`auditedChatOperationalSettingWrite`. The mock transaction executes the
no-op callback successfully and then returns an error, preserving
coverage that audit suppression happens only after the transaction
succeeds without involving API background transactions.
 2026-08-25 12:59:19 +01:00
Ethan 16e0c4dba7 fix(site/src/pages/AgentsPage): remove redundant model warning (#28484) 
The empty chat form showed a generic no-model warning directly above the
existing provider and model setup notice, repeating the same
unavailable-state information.

Remove the redundant warning and update the affected stories to assert
the remaining actionable setup notice.
 2026-08-25 12:30:24 +01:00
dependabot[bot] 31fba3fce6 ci: bump the github-actions group with 6 updates (#28545) 
Bumps the github-actions group with 6 updates:

| Package | From | To |
| --- | --- | --- |
|
[step-security/harden-runner](https://github.com/step-security/harden-runner)
| `2.20.1` | `2.21.0` |
|
[docker/setup-buildx-action](https://github.com/docker/setup-buildx-action)
| `4.2.0` | `4.3.0` |
|
[toshimaru/auto-author-assign](https://github.com/toshimaru/auto-author-assign)
| `3.0.3` | `3.1.0` |
|
[github/codeql-action/upload-sarif](https://github.com/github/codeql-action)
| `4.37.6` | `4.37.7` |
| [github/codeql-action/init](https://github.com/github/codeql-action) |
`4.37.6` | `4.37.7` |
|
[github/codeql-action/analyze](https://github.com/github/codeql-action)
| `4.37.6` | `4.37.7` |

Updates `step-security/harden-runner` from 2.20.1 to 2.21.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/step-security/harden-runner/releases">step-security/harden-runner's
releases</a>.</em></p>
<blockquote>
<h2>v2.21.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Support for denied endpoints in block mode. This is included in the
enterprise tier. Customers can deny outbound calls, for example, to
public package registries.</li>
<li>Improved Support for AWS CodeBuild GitHub Actions Runners.</li>
<li>Bug fixes.</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/step-security/harden-runner/compare/v2.20.1...v2.21.0">https://github.com/step-security/harden-runner/compare/v2.20.1...v2.21.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/step-security/harden-runner/commit/05e31511f85b41b11d1cf0ef85d0992719546e2c"><code>05e3151</code></a>
Merge pull request <a
href="https://redirect.github.com/step-security/harden-runner/issues/684">#684</a>
from step-security/rc-42</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/0f37afa338f57c61ee3dfc274daca8834963d83e"><code>0f37afa</code></a>
fix: ignore denied-endpoints on non-enterprise tier</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/93b58ee491c5b6cf3a5324966fca2908f8d447f3"><code>93b58ee</code></a>
fix: resolve cache host read-first and never downgrade egress
policy</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/e7399dd3e93d6c159d314af54b4704bc48abf6bc"><code>e7399dd</code></a>
fix: align deny-list mode detection with agent and log when both
endpoint inp...</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/c16689f716a10cdfd9cfe22e63938b8c6c0657de"><code>c16689f</code></a>
test: add denied_endpoints to Configuration fixtures and cover deny-list
merge</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/40b99cf0c7161e4dcdc6c5508927188b65028df9"><code>40b99cf</code></a>
Merge pull request <a
href="https://redirect.github.com/step-security/harden-runner/issues/682">#682</a>
from rohan-stepsecurity/rp/feat/codebuild-self-v2</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/fedec027a205365a7d64001a81931e4c36a1af6e"><code>fedec02</code></a>
Merge branch 'rc-42' into rp/feat/codebuild-self-v2</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/5361fb178b926b2be6df52e11ee257823821567b"><code>5361fb1</code></a>
feat: add build artifacts</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/286474fffe0b8fe7c9db855f132d04a9b48ab564"><code>286474f</code></a>
feat: Support Bravo agent install on CodeBuild runners</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/051ec05283d064bd82f41279db4f70f0717bf778"><code>051ec05</code></a>
Merge pull request <a
href="https://redirect.github.com/step-security/harden-runner/issues/683">#683</a>
from h0x0er/jatin/deny-list</li>
<li>Additional commits viewable in <a
href="https://github.com/step-security/harden-runner/compare/b09bb98e06d4d774595224525879c09bc6e98c40...05e31511f85b41b11d1cf0ef85d0992719546e2c">compare
view</a></li>
</ul>
</details>
<br />

Updates `docker/setup-buildx-action` from 4.2.0 to 4.3.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/docker/setup-buildx-action/releases">docker/setup-buildx-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.3.0</h2>
<ul>
<li>Bump <code>@​docker/actions-toolkit</code> from 0.92.0 to 0.95.0 in
<a
href="https://redirect.github.com/docker/setup-buildx-action/pull/595">docker/setup-buildx-action#595</a></li>
<li>Bump brace-expansion from 1.1.13 to 1.1.18 in <a
href="https://redirect.github.com/docker/setup-buildx-action/pull/600">docker/setup-buildx-action#600</a></li>
<li>Bump js-yaml from 5.2.0 to 5.3.0 in <a
href="https://redirect.github.com/docker/setup-buildx-action/pull/585">docker/setup-buildx-action#585</a></li>
<li>Bump postcss from 8.5.10 to 8.5.25 in <a
href="https://redirect.github.com/docker/setup-buildx-action/pull/598">docker/setup-buildx-action#598</a></li>
<li>Bump undici from 6.27.0 to 6.28.0 in <a
href="https://redirect.github.com/docker/setup-buildx-action/pull/601">docker/setup-buildx-action#601</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/setup-buildx-action/compare/v4.2.0...v4.3.0">https://github.com/docker/setup-buildx-action/compare/v4.2.0...v4.3.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/docker/setup-buildx-action/commit/37fe631027851001ddb9b187196cc803df7f5f0e"><code>37fe631</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/setup-buildx-action/issues/595">#595</a>
from docker/dependabot/npm_and_yarn/docker/actions-to...</li>
<li><a
href="https://github.com/docker/setup-buildx-action/commit/b5c4f91922681cc7c58d15ab7838986951f09d19"><code>b5c4f91</code></a>
[dependabot skip] chore: update generated content</li>
<li><a
href="https://github.com/docker/setup-buildx-action/commit/3e93b637c6430ba8fa896fad44d3aa6821899d63"><code>3e93b63</code></a>
build(deps): bump <code>@​docker/actions-toolkit</code> from 0.92.0 to
0.95.0</li>
<li><a
href="https://github.com/docker/setup-buildx-action/commit/e527031b32c86649307d5d492506855f90470604"><code>e527031</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/setup-buildx-action/issues/600">#600</a>
from docker/dependabot/npm_and_yarn/brace-expansion-1...</li>
<li><a
href="https://github.com/docker/setup-buildx-action/commit/c68814b33cb66f1f7538e546190d410ae557a640"><code>c68814b</code></a>
[dependabot skip] chore: update generated content</li>
<li><a
href="https://github.com/docker/setup-buildx-action/commit/3f891b01bd5012a434f582800366972569aa1886"><code>3f891b0</code></a>
build(deps): bump brace-expansion from 1.1.13 to 1.1.18</li>
<li><a
href="https://github.com/docker/setup-buildx-action/commit/787db26fcde8ddcabd49a81472318028f7113962"><code>787db26</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/setup-buildx-action/issues/585">#585</a>
from docker/dependabot/npm_and_yarn/js-yaml-5.2.1</li>
<li><a
href="https://github.com/docker/setup-buildx-action/commit/f7793687c711790ca336bd4934f1b1bf5f778e17"><code>f779368</code></a>
[dependabot skip] chore: update generated content</li>
<li><a
href="https://github.com/docker/setup-buildx-action/commit/7d5e60413489a33d28077e11d71c668580cfaf8d"><code>7d5e604</code></a>
build(deps): bump js-yaml from 5.2.0 to 5.3.0</li>
<li><a
href="https://github.com/docker/setup-buildx-action/commit/292c2fb3837a12d3ac2d1e47bbc5c00712bad939"><code>292c2fb</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/setup-buildx-action/issues/590">#590</a>
from docker/dependabot/github_actions/actions/setup-n...</li>
<li>Additional commits viewable in <a
href="https://github.com/docker/setup-buildx-action/compare/bb05f3f5519dd87d3ba754cc423b652a5edd6d2c...37fe631027851001ddb9b187196cc803df7f5f0e">compare
view</a></li>
</ul>
</details>
<br />

Updates `toshimaru/auto-author-assign` from 3.0.3 to 3.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/toshimaru/auto-author-assign/releases">toshimaru/auto-author-assign's
releases</a>.</em></p>
<blockquote>
<h2>v3.1.0</h2>
<h2><a
href="https://github.com/toshimaru/auto-author-assign/compare/v3.0.3...v3.1.0">3.1.0</a>
(2026-08-12)</h2>
<h2>What's Changed</h2>
<h3>Features</h3>
<ul>
<li>Add support to <code>skip-users</code> (see <a
href="https://redirect.github.com/toshimaru/auto-author-assign/issues/185">#185</a>
and <a
href="https://redirect.github.com/toshimaru/auto-author-assign/issues/191">#191</a>)
(<a
href="https://github.com/toshimaru/auto-author-assign/commit/c323db629e2e295b2c8ebe87d47bb2c961ef87ae">c323db6</a>)
<ul>
<li>Add skip-users input by <a
href="https://github.com/IsabelParedes"><code>@​IsabelParedes</code></a>
in <a
href="https://redirect.github.com/toshimaru/auto-author-assign/pull/185">toshimaru/auto-author-assign#185</a></li>
<li>feat: Parse <code>skip-users</code> as comma or newline-separated
list by <a
href="https://github.com/toshimaru"><code>@​toshimaru</code></a> in <a
href="https://redirect.github.com/toshimaru/auto-author-assign/pull/191">toshimaru/auto-author-assign#191</a></li>
</ul>
</li>
</ul>
<h3>Security</h3>
<ul>
<li>Configure Dependabot cooldown windows for npm and GitHub Actions by
<a href="https://github.com/toshimaru"><code>@​toshimaru</code></a> with
<a href="https://github.com/Copilot"><code>@​Copilot</code></a> in <a
href="https://redirect.github.com/toshimaru/auto-author-assign/pull/182">toshimaru/auto-author-assign#182</a></li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>build(deps-dev): bump rollup from 4.62.0 to 4.62.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/toshimaru/auto-author-assign/pull/180">toshimaru/auto-author-assign#180</a></li>
<li>build(deps): bump actions/checkout from 6 to 7 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/toshimaru/auto-author-assign/pull/178">toshimaru/auto-author-assign#178</a></li>
<li>build(deps-dev): bump rollup from 4.62.2 to 4.62.3 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/toshimaru/auto-author-assign/pull/186">toshimaru/auto-author-assign#186</a></li>
<li>build(deps): bump actions/setup-node from 6 to 7 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/toshimaru/auto-author-assign/pull/183">toshimaru/auto-author-assign#183</a></li>
<li>build(deps): bump undici from 6.25.0 to 6.28.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/toshimaru/auto-author-assign/pull/188">toshimaru/auto-author-assign#188</a></li>
<li>build(deps-dev): bump rollup from 4.62.3 to 4.62.4 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/toshimaru/auto-author-assign/pull/189">toshimaru/auto-author-assign#189</a></li>
</ul>
<h3>Others</h3>
<ul>
<li>chore(main): release 3.1.0 by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/toshimaru/auto-author-assign/pull/192">toshimaru/auto-author-assign#192</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/IsabelParedes"><code>@​IsabelParedes</code></a>
made their first contribution in <a
href="https://redirect.github.com/toshimaru/auto-author-assign/pull/185">toshimaru/auto-author-assign#185</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/toshimaru/auto-author-assign/compare/v3.0.3...v3.1.0">https://github.com/toshimaru/auto-author-assign/compare/v3.0.3...v3.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/toshimaru/auto-author-assign/blob/main/CHANGELOG.md">toshimaru/auto-author-assign's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2><a
href="https://github.com/toshimaru/auto-author-assign/compare/v3.0.3...v3.1.0">3.1.0</a>
(2026-08-12)</h2>
<h3>Features</h3>
<ul>
<li>add support to skip users (see <a
href="https://redirect.github.com/toshimaru/auto-author-assign/issues/185">#185</a>
and <a
href="https://redirect.github.com/toshimaru/auto-author-assign/issues/191">#191</a>)
(<a
href="https://github.com/toshimaru/auto-author-assign/commit/c323db629e2e295b2c8ebe87d47bb2c961ef87ae">c323db6</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>parse skip-users as comma or newline-separated list (<a
href="https://github.com/toshimaru/auto-author-assign/commit/9db2a78bf35000232ae3b800c3dd021300887393">9db2a78</a>)</li>
</ul>
<h2><a
href="https://github.com/toshimaru/auto-author-assign/compare/v3.0.2...v3.0.3">3.0.3</a>
(2026-06-15)</h2>
<h3>Miscellaneous Chores</h3>
<ul>
<li>release 3.0.3 (<a
href="https://github.com/toshimaru/auto-author-assign/commit/8f813140fc4dbdfcc4a43f89d97033b5988e3773">8f81314</a>)</li>
</ul>
<h2><a
href="https://github.com/toshimaru/auto-author-assign/compare/v3.0.1...v3.0.2">3.0.2</a>
(2026-04-27)</h2>
<h3>Miscellaneous Chores</h3>
<ul>
<li>release 3.0.2 (<a
href="https://github.com/toshimaru/auto-author-assign/commit/658b95bf703955e926268fcaca1124037270bea8">658b95b</a>)</li>
<li>release 3.0.2 (<a
href="https://github.com/toshimaru/auto-author-assign/commit/ca59fc3261247bab40337927fac848bf2a60863f">ca59fc3</a>)</li>
</ul>
<h2><a
href="https://github.com/toshimaru/auto-author-assign/compare/v3.0.0...v3.0.1">3.0.1</a>
(2025-12-25)</h2>
<h3>Miscellaneous Chores</h3>
<ul>
<li>release 3.0.1 (<a
href="https://github.com/toshimaru/auto-author-assign/commit/718d4ed5349747d47952ae841ae03fcbdd74ebea">718d4ed</a>)</li>
</ul>
<h2><a
href="https://github.com/toshimaru/auto-author-assign/compare/v2.1.2...v3.0.0">3.0.0</a>
(2025-12-21)</h2>
<h3>Features</h3>
<ul>
<li>Add <code>npm run package</code> instead of <code>build</code> (<a
href="https://redirect.github.com/toshimaru/auto-author-assign/issues/130">#130</a>)
(<a
href="https://github.com/toshimaru/auto-author-assign/commit/972720f0403d2873e807f16e350c5b0b1be4dda3">972720f</a>)</li>
</ul>
<h3>Miscellaneous Chores</h3>
<ul>
<li>release 3.0.0 (<a
href="https://github.com/toshimaru/auto-author-assign/commit/d100ceff34d1e9cd2c4ea5b8055922f1409f3068">d100cef</a>)</li>
</ul>
<h3><a
href="https://github.com/toshimaru/auto-author-assign/compare/v2.1.1...v2.1.2">2.1.2</a>
(2025-12-16)</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/toshimaru/auto-author-assign/commit/a78a94b219445cece8ccf0d45fec60af449f212a"><code>a78a94b</code></a>
chore(main): release 3.1.0 (<a
href="https://redirect.github.com/toshimaru/auto-author-assign/issues/192">#192</a>)</li>
<li><a
href="https://github.com/toshimaru/auto-author-assign/commit/c323db629e2e295b2c8ebe87d47bb2c961ef87ae"><code>c323db6</code></a>
feat: add support to skip users (see <a
href="https://redirect.github.com/toshimaru/auto-author-assign/issues/185">#185</a>
and <a
href="https://redirect.github.com/toshimaru/auto-author-assign/issues/191">#191</a>)</li>
<li><a
href="https://github.com/toshimaru/auto-author-assign/commit/eae6cfd3b5c7e2cce508a78f856f8827f76cafb3"><code>eae6cfd</code></a>
build(deps-dev): bump rollup from 4.62.3 to 4.62.4 (<a
href="https://redirect.github.com/toshimaru/auto-author-assign/issues/189">#189</a>)</li>
<li><a
href="https://github.com/toshimaru/auto-author-assign/commit/3d6ff397d755c64759c1b416535523166e518e8f"><code>3d6ff39</code></a>
build(deps): bump undici from 6.25.0 to 6.28.0 (<a
href="https://redirect.github.com/toshimaru/auto-author-assign/issues/188">#188</a>)</li>
<li><a
href="https://github.com/toshimaru/auto-author-assign/commit/6c3a1f760361388c2c9f0ae0930d922cab507b48"><code>6c3a1f7</code></a>
docs: use consistent terminology for machine-user accounts</li>
<li><a
href="https://github.com/toshimaru/auto-author-assign/commit/19ec32b7d5b8e5e25add98f708540b51e4c3e8b3"><code>19ec32b</code></a>
docs: note that bot check does not cover machine-user accounts</li>
<li><a
href="https://github.com/toshimaru/auto-author-assign/commit/737b10ed8b9df5741368b9c584436685ef07612d"><code>737b10e</code></a>
build: rebuild dist for skip-users separator fix</li>
<li><a
href="https://github.com/toshimaru/auto-author-assign/commit/9db2a78bf35000232ae3b800c3dd021300887393"><code>9db2a78</code></a>
fix: parse skip-users as comma or newline-separated list</li>
<li><a
href="https://github.com/toshimaru/auto-author-assign/commit/2498de00249093fbd9c9f74f91248c110cb2ecde"><code>2498de0</code></a>
Update README</li>
<li><a
href="https://github.com/toshimaru/auto-author-assign/commit/0bb32246e068f1d145e989a9c6fc7d4753c28eb6"><code>0bb3224</code></a>
Add skip-user input</li>
<li>Additional commits viewable in <a
href="https://github.com/toshimaru/auto-author-assign/compare/3e19bfc990cb1cf0589dce95e9f75289bb1e22de...a78a94b219445cece8ccf0d45fec60af449f212a">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action/upload-sarif` from 4.37.6 to 4.37.7
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/upload-sarif's
releases</a>.</em></p>
<blockquote>
<h2>v4.37.7</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/upload-sarif's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.37.8 - 21 Aug 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.7 - 13 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li>
</ul>
<h2>4.37.6 - 04 Aug 2026</h2>
<ul>
<li>Changed the default filepath for the new remote file address format
that was introduced in CodeQL Action 4.37.0 / 3.37.0 to
<code>.github/codeql-config.yml</code> to align it with the suggested
path that is used elsewhere. <a
href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li>
</ul>
<h2>4.37.5 - 03 Aug 2026</h2>
<ul>
<li>Fixed a bug where a network error while streaming the download of
the CodeQL bundle could terminate the <code>init</code> Action instead
of falling back to downloading the bundle before extracting it. <a
href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li>
</ul>
<h2>4.37.4 - 29 Jul 2026</h2>
<ul>
<li>This version of the CodeQL Action adds support for the
<code>tools</code> input for the <code>codeql-action/init</code> step to
be specified using a <code>github-codeql-tools</code> <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository
property</a>. This feature will gradually be rolled out following the
release of this version. Once rolled out, this allows for the CodeQL CLI
version that is used in GitHub-managed workflows, such as Default Setup,
to be set to a custom value. For example, customers who run into issues
with rate limits when a new CodeQL CLI version is released can set the
value to <code>toolcache</code> to always use the CodeQL CLI version
that is available in the runner toolcache. For Advanced Setup workflows,
the value provided for <code>tools</code> in the workflow definition
always takes precedence unless the value of the repository property
starts with <code>!</code>. <a
href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li>
</ul>
<h2>4.37.3 - 22 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.2 - 21 Jul 2026</h2>
<ul>
<li>The new address format for the <code>config-file</code> input that
was introduced in CodeQL Action 4.37.0 is now enabled by default. In
addition to the format described there, the <code>remote=</code> prefix
can now be used to explicitly indicate that the input refers to a remote
file. All previous input formats continue to be accepted as well. <a
href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li>
<li>The CodeQL Action can now make use of <a
href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured
private registries</a> in Default Setup to retrieve CodeQL configuration
files from remote repositories that require authentication. This will
allow customers to store their CodeQL configuration in a single
repository that can then be referenced by Default Setup workflows in
other repositories. We expect to roll this and other, related changes
out to everyone in July. <a
href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li>
</ul>
<h2>4.37.1 - 16 Jul 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.20.6 and earlier. These versions of
CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise
Server 3.16, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li>
</ul>
<h2>4.37.0 - 08 Jul 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li>
<li>In addition to the existing input format, the
<code>config-file</code> input for the <code>codeql-action/init</code>
step will soon support a new <code>[owner/]repo[@ref][:path]</code>
format. All components except the repository name are optional. If
omitted, <code>owner</code> defaults to the same owner as the repository
the analysis is running for, <code>ref</code> to <code>main</code>, and
<code>path</code> to <code>.github/codeql-action.yaml</code>. Support
for this format ships in this version of the CodeQL Action, but will
only be enabled over the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li>
</ul>
<h2>4.36.3 - 01 Jul 2026</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd"><code>ff2f1c6</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4093">#4093</a>
from github/update-v4.37.7-be7a3dbb8</li>
<li><a
href="https://github.com/github/codeql-action/commit/951a133f96aa2114dd747e9e437305335d0bde16"><code>951a133</code></a>
Update changelog for v4.37.7</li>
<li><a
href="https://github.com/github/codeql-action/commit/be7a3dbb8147b82cd6d27e0707105b36aa190fc1"><code>be7a3db</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4087">#4087</a>
from github/dependabot/npm_and_yarn/npm-minor-0aa561...</li>
<li><a
href="https://github.com/github/codeql-action/commit/9310334b11405b305d9444edfa56cd86e2f1e4fe"><code>9310334</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4086">#4086</a>
from github/mbg/thread-action-state-to-codeql</li>
<li><a
href="https://github.com/github/codeql-action/commit/b4d8a54218a8792de9af2f6f32e33af899ca5212"><code>b4d8a54</code></a>
Rebuild</li>
<li><a
href="https://github.com/github/codeql-action/commit/ab5db2519c3344f2fa61c711fa2d6ad135829200"><code>ab5db25</code></a>
Bump the npm-minor group across 1 directory with 8 updates</li>
<li><a
href="https://github.com/github/codeql-action/commit/38055a3c3cf3979323eaf70fc6c73a8690250bde"><code>38055a3</code></a>
Drop <code>logger</code> from <code>databaseInitCluster</code> in
interface</li>
<li><a
href="https://github.com/github/codeql-action/commit/1f87aed5e66849f0c43ae147377cc77f2d98ac99"><code>1f87aed</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4085">#4085</a>
from github/update-bundle/codeql-bundle-v2.26.3</li>
<li><a
href="https://github.com/github/codeql-action/commit/dc1b98ad1c2f13ccf9fc33fb82f32fc76f944253"><code>dc1b98a</code></a>
Make <code>logger</code> available to <code>getCodeQLForCmd</code></li>
<li><a
href="https://github.com/github/codeql-action/commit/6f0220ee37121218af472efbde25f06907a4da4f"><code>6f0220e</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4084">#4084</a>
from github/navntoft/bump-undici</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/5595ccaf912efad79be6eef63a5619ff05969be3...ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action/init` from 4.37.6 to 4.37.7
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/init's
releases</a>.</em></p>
<blockquote>
<h2>v4.37.7</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/init's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.37.8 - 21 Aug 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.7 - 13 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li>
</ul>
<h2>4.37.6 - 04 Aug 2026</h2>
<ul>
<li>Changed the default filepath for the new remote file address format
that was introduced in CodeQL Action 4.37.0 / 3.37.0 to
<code>.github/codeql-config.yml</code> to align it with the suggested
path that is used elsewhere. <a
href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li>
</ul>
<h2>4.37.5 - 03 Aug 2026</h2>
<ul>
<li>Fixed a bug where a network error while streaming the download of
the CodeQL bundle could terminate the <code>init</code> Action instead
of falling back to downloading the bundle before extracting it. <a
href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li>
</ul>
<h2>4.37.4 - 29 Jul 2026</h2>
<ul>
<li>This version of the CodeQL Action adds support for the
<code>tools</code> input for the <code>codeql-action/init</code> step to
be specified using a <code>github-codeql-tools</code> <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository
property</a>. This feature will gradually be rolled out following the
release of this version. Once rolled out, this allows for the CodeQL CLI
version that is used in GitHub-managed workflows, such as Default Setup,
to be set to a custom value. For example, customers who run into issues
with rate limits when a new CodeQL CLI version is released can set the
value to <code>toolcache</code> to always use the CodeQL CLI version
that is available in the runner toolcache. For Advanced Setup workflows,
the value provided for <code>tools</code> in the workflow definition
always takes precedence unless the value of the repository property
starts with <code>!</code>. <a
href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li>
</ul>
<h2>4.37.3 - 22 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.2 - 21 Jul 2026</h2>
<ul>
<li>The new address format for the <code>config-file</code> input that
was introduced in CodeQL Action 4.37.0 is now enabled by default. In
addition to the format described there, the <code>remote=</code> prefix
can now be used to explicitly indicate that the input refers to a remote
file. All previous input formats continue to be accepted as well. <a
href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li>
<li>The CodeQL Action can now make use of <a
href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured
private registries</a> in Default Setup to retrieve CodeQL configuration
files from remote repositories that require authentication. This will
allow customers to store their CodeQL configuration in a single
repository that can then be referenced by Default Setup workflows in
other repositories. We expect to roll this and other, related changes
out to everyone in July. <a
href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li>
</ul>
<h2>4.37.1 - 16 Jul 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.20.6 and earlier. These versions of
CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise
Server 3.16, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li>
</ul>
<h2>4.37.0 - 08 Jul 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li>
<li>In addition to the existing input format, the
<code>config-file</code> input for the <code>codeql-action/init</code>
step will soon support a new <code>[owner/]repo[@ref][:path]</code>
format. All components except the repository name are optional. If
omitted, <code>owner</code> defaults to the same owner as the repository
the analysis is running for, <code>ref</code> to <code>main</code>, and
<code>path</code> to <code>.github/codeql-action.yaml</code>. Support
for this format ships in this version of the CodeQL Action, but will
only be enabled over the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li>
</ul>
<h2>4.36.3 - 01 Jul 2026</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd"><code>ff2f1c6</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4093">#4093</a>
from github/update-v4.37.7-be7a3dbb8</li>
<li><a
href="https://github.com/github/codeql-action/commit/951a133f96aa2114dd747e9e437305335d0bde16"><code>951a133</code></a>
Update changelog for v4.37.7</li>
<li><a
href="https://github.com/github/codeql-action/commit/be7a3dbb8147b82cd6d27e0707105b36aa190fc1"><code>be7a3db</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4087">#4087</a>
from github/dependabot/npm_and_yarn/npm-minor-0aa561...</li>
<li><a
href="https://github.com/github/codeql-action/commit/9310334b11405b305d9444edfa56cd86e2f1e4fe"><code>9310334</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4086">#4086</a>
from github/mbg/thread-action-state-to-codeql</li>
<li><a
href="https://github.com/github/codeql-action/commit/b4d8a54218a8792de9af2f6f32e33af899ca5212"><code>b4d8a54</code></a>
Rebuild</li>
<li><a
href="https://github.com/github/codeql-action/commit/ab5db2519c3344f2fa61c711fa2d6ad135829200"><code>ab5db25</code></a>
Bump the npm-minor group across 1 directory with 8 updates</li>
<li><a
href="https://github.com/github/codeql-action/commit/38055a3c3cf3979323eaf70fc6c73a8690250bde"><code>38055a3</code></a>
Drop <code>logger</code> from <code>databaseInitCluster</code> in
interface</li>
<li><a
href="https://github.com/github/codeql-action/commit/1f87aed5e66849f0c43ae147377cc77f2d98ac99"><code>1f87aed</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4085">#4085</a>
from github/update-bundle/codeql-bundle-v2.26.3</li>
<li><a
href="https://github.com/github/codeql-action/commit/dc1b98ad1c2f13ccf9fc33fb82f32fc76f944253"><code>dc1b98a</code></a>
Make <code>logger</code> available to <code>getCodeQLForCmd</code></li>
<li><a
href="https://github.com/github/codeql-action/commit/6f0220ee37121218af472efbde25f06907a4da4f"><code>6f0220e</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4084">#4084</a>
from github/navntoft/bump-undici</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/5595ccaf912efad79be6eef63a5619ff05969be3...ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action/analyze` from 4.37.6 to 4.37.7
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/analyze's
releases</a>.</em></p>
<blockquote>
<h2>v4.37.7</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/analyze's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.37.8 - 21 Aug 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.7 - 13 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li>
</ul>
<h2>4.37.6 - 04 Aug 2026</h2>
<ul>
<li>Changed the default filepath for the new remote file address format
that was introduced in CodeQL Action 4.37.0 / 3.37.0 to
<code>.github/codeql-config.yml</code> to align it with the suggested
path that is used elsewhere. <a
href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li>
</ul>
<h2>4.37.5 - 03 Aug 2026</h2>
<ul>
<li>Fixed a bug where a network error while streaming the download of
the CodeQL bundle could terminate the <code>init</code> Action instead
of falling back to downloading the bundle before extracting it. <a
href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li>
</ul>
<h2>4.37.4 - 29 Jul 2026</h2>
<ul>
<li>This version of the CodeQL Action adds support for the
<code>tools</code> input for the <code>codeql-action/init</code> step to
be specified using a <code>github-codeql-tools</code> <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository
property</a>. This feature will gradually be rolled out following the
release of this version. Once rolled out, this allows for the CodeQL CLI
version that is used in GitHub-managed workflows, such as Default Setup,
to be set to a custom value. For example, customers who run into issues
with rate limits when a new CodeQL CLI version is released can set the
value to <code>toolcache</code> to always use the CodeQL CLI version
that is available in the runner toolcache. For Advanced Setup workflows,
the value provided for <code>tools</code> in the workflow definition
always takes precedence unless the value of the repository property
starts with <code>!</code>. <a
href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li>
</ul>
<h2>4.37.3 - 22 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.2 - 21 Jul 2026</h2>
<ul>
<li>The new address format for the <code>config-file</code> input that
was introduced in CodeQL Action 4.37.0 is now enabled by default. In
addition to the format described there, the <code>remote=</code> prefix
can now be used to explicitly indicate that the input refers to a remote
file. All previous input formats continue to be accepted as well. <a
href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li>
<li>The CodeQL Action can now make use of <a
href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured
private registries</a> in Default Setup to retrieve CodeQL configuration
files from remote repositories that require authentication. This will
allow customers to store their CodeQL configuration in a single
repository that can then be referenced by Default Setup workflows in
other repositories. We expect to roll this and other, related changes
out to everyone in July. <a
href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li>
</ul>
<h2>4.37.1 - 16 Jul 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.20.6 and earlier. These versions of
CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise
Server 3.16, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li>
</ul>
<h2>4.37.0 - 08 Jul 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li>
<li>In addition to the existing input format, the
<code>config-file</code> input for the <code>codeql-action/init</code>
step will soon support a new <code>[owner/]repo[@ref][:path]</code>
format. All components except the repository name are optional. If
omitted, <code>owner</code> defaults to the same owner as the repository
the analysis is running for, <code>ref</code> to <code>main</code>, and
<code>path</code> to <code>.github/codeql-action.yaml</code>. Support
for this format ships in this version of the CodeQL Action, but will
only be enabled over the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li>
</ul>
<h2>4.36.3 - 01 Jul 2026</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd"><code>ff2f1c6</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4093">#4093</a>
from github/update-v4.37.7-be7a3dbb8</li>
<li><a
href="https://github.com/github/codeql-action/commit/951a133f96aa2114dd747e9e437305335d0bde16"><code>951a133</code></a>
Update changelog for v4.37.7</li>
<li><a
href="https://github.com/github/codeql-action/commit/be7a3dbb8147b82cd6d27e0707105b36aa190fc1"><code>be7a3db</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4087">#4087</a>
from github/dependabot/npm_and_yarn/npm-minor-0aa561...</li>
<li><a
href="https://github.com/github/codeql-action/commit/9310334b11405b305d9444edfa56cd86e2f1e4fe"><code>9310334</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4086">#4086</a>
from github/mbg/thread-action-state-to-codeql</li>
<li><a
href="https://github.com/github/codeql-action/commit/b4d8a54218a8792de9af2f6f32e33af899ca5212"><code>b4d8a54</code></a>
Rebuild</li>
<li><a
href="https://github.com/github/codeql-action/commit/ab5db2519c3344f2fa61c711fa2d6ad135829200"><code>ab5db25</code></a>
Bump the npm-minor group across 1 directory with 8 updates</li>
<li><a
href="https://github.com/github/codeql-action/commit/38055a3c3cf3979323eaf70fc6c73a8690250bde"><code>38055a3</code></a>
Drop <code>logger</code> from <code>databaseInitCluster</code> in
interface</li>
<li><a
href="https://github.com/github/codeql-action/commit/1f87aed5e66849f0c43ae147377cc77f2d98ac99"><code>1f87aed</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4085">#4085</a>
from github/update-bundle/codeql-bundle-v2.26.3</li>
<li><a
href="https://github.com/github/codeql-action/commit/dc1b98ad1c2f13ccf9fc33fb82f32fc76f944253"><code>dc1b98a</code></a>
Make <code>logger</code> available to <code>getCodeQLForCmd</code></li>
<li><a
href="https://github.com/github/codeql-action/commit/6f0220ee37121218af472efbde25f06907a4da4f"><code>6f0220e</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4084">#4084</a>
from github/navntoft/bump-undici</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/5595ccaf912efad79be6eef63a5619ff05969be3...ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-25 11:23:58 +00:00
dependabot[bot] 7638779c24 chore: bump github.com/brianvoe/gofakeit/v7 from 7.15.0 to 7.16.0 (#28544) 
Bumps
[github.com/brianvoe/gofakeit/v7](https://github.com/brianvoe/gofakeit)
from 7.15.0 to 7.16.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/brianvoe/gofakeit/commit/aab05dbcca39c4cb8a52f64e5b98a8823b425008"><code>aab05db</code></a>
tests - updated to fix flux test failure issue</li>
<li><a
href="https://github.com/brianvoe/gofakeit/commit/517a58640892de2d43d5b03b8a47d329eebd0db7"><code>517a586</code></a>
slogan - updated some strings</li>
<li><a
href="https://github.com/brianvoe/gofakeit/commit/ff1305bd1bcb2ae5edffdb4c8ec51e2ad73acfa9"><code>ff1305b</code></a>
github workflow - updated to fix macos-latest</li>
<li><a
href="https://github.com/brianvoe/gofakeit/commit/3bdc6890f3bbf9ac7899b2df33efd3f3fc79f618"><code>3bdc689</code></a>
Merge pull request <a
href="https://redirect.github.com/brianvoe/gofakeit/issues/395">#395</a>
from ChrisJr404/slogan-mad-libs-templates</li>
<li><a
href="https://github.com/brianvoe/gofakeit/commit/66cc15902391e928c3e24004ccbd53f6e5d36a71"><code>66cc159</code></a>
Add more slogan templates and fix slogan casing</li>
<li><a
href="https://github.com/brianvoe/gofakeit/commit/d14309718f553b12b4a9693a4bc9c359ac7eef40"><code>d143097</code></a>
slogan - build slogans from mad-libs templates via Generate</li>
<li><a
href="https://github.com/brianvoe/gofakeit/commit/f0b548a543358d5eee6c5858a0a6738344fd3ce2"><code>f0b548a</code></a>
fuzz - added initial fuzzing to functions that maybe best for</li>
<li>See full diff in <a
href="https://github.com/brianvoe/gofakeit/compare/v7.15.0...v7.16.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/brianvoe/gofakeit/v7&package-manager=go_modules&previous-version=7.15.0&new-version=7.16.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-25 11:18:42 +00:00
Garrett Delfosse eedc0ece47 fix: avoid 500 when generating chat title from rename dialog and remove unused endpoint (#28306) 2026-08-25 06:52:45 -04:00
Jaayden Halko 511dcc0293 feat(coderd/x/chatd): bill interrupted tool batches on cancellation rows (#28362) 
**Stack**: #28359 → #28360 → #28361 → **#28362 (this PR)**

## Summary

Interrupted local tool batches now bill the partial window they actually
executed, recorded on the same dedicated usage record completed batches
use. Completes the runtime billing work in this stack: completed batches
bill via #28360, interrupted batches via this PR.

Last of a four-PR stack splitting #28211. Stacked on #28361. Closes
CODAGT-928
(https://linear.app/codercom/issue/CODAGT-928/track-local-tool-execution-for-agent-runtime).

## Problem

Interrupting a batch previously billed only the model window; work the
tools already performed was lost.

## Fix

Just before closing the buffer episode, the interrupt task reads the
live tool stamps (`ToolCompletions`) alongside `ModelInvokedAt`. The
interruption commit appends the shared `batchUsageMessage` record (same
shape as #28360: model-only tool-role row with a
`billed_ms`/`billed_calls` audit payload) billing the union of the
started, billable calls' partial execution intervals: completed calls
end at their recorded completion, running calls at the interrupt
instant. Synthesized cancellation rows stay free of batch-level runtime.
Unstarted calls, rejected calls, and sub-agent orchestration tools bill
nothing and append no record. Batches with no live attempt (crash
recovery, state promotion) bill nothing, consistent with generation
losing in-flight runtime on a crash.

Usage-record billing reuses the same interrupt instant as the model
window instead of taking a second clock reading inside the transaction,
so database delay cannot inflate a running call's window.

An earlier revision carried a retry-stable episode snapshot so an
interrupt retry after buffer eviction (a >15s stall) would not lose
billing; it was dropped as not worth the complexity
(https://github.com/coder/coder/pull/28211#discussion_r3812778418). Such
a retry now bills the batch at zero, matching the existing
crash-recovery precedent.

Known gaps left out of scope: retry backoff and errored-attempt time
stay unbilled (no persistence home for error turns), and the advisor
tool's nested model call now bills as tool time by design.
 2026-08-25 17:29:57 +07:00
Ethan d667d68e3c fix(site): harden organization-scoped model loading (#28495) 
Previously, the new agent form treated the dashboard organization as a
usable resource scope while permission filtering was still pending. This
could request a provisional empty model catalog, briefly show the
no-model setup notice, and lose the selected organization when the form
remounted. A malformed organization models response could also crash the
Models settings page.

Wait for authoritative permitted organizations before enabling
organization-scoped resources, persist valid organization selections
across remounts, and reject malformed model responses while retaining a
defensive rendering guard.

## UAT

An adversarial [Coder Agents UAT
run](https://dev.coder.com/agents/980a5a6d-e91b-47f0-902e-25d12ac46935)
validated this commit on a licensed local deployment with two
organizations, a real Anthropic model, and a non-admin user. Under
throttled and artificially delayed authorization, no organization-scoped
request fired before permissions settled and the false setup notice
never appeared, while an authorized zero-model organization still showed
the genuine notice. Persistence across reloads, tampered or stale
localStorage IDs, membership revocation, attachment-preserving
organization switches, single-organization deployments, and induced
malformed or failed model responses on the Models settings page all
behaved correctly. Verdict: PASS.
 2026-08-25 10:25:16 +00:00
Jaayden HalkoandHugo Dutka 64d2d8a108 feat(coderd/x/chatd): record live tool execution stamps in the message part buffer (#28361) 
**Stack**: #28359 → #28360 → **#28361 (this PR)** → #28362

During local tool execution, buffer episodes now record when each
tool-call occurrence actually starts and finishes, via
`RecordToolStart`/`RecordToolCompletion`/`ToolCompletions` on the
message part buffer. Occurrences are keyed by unresolved-call position,
so gaps left by rejected calls and duplicate tool-call IDs stay
distinct: `partitionAmbiguousToolCalls` additionally returns the allowed
calls' input positions, and generation's `chatloop.ToolBillingRecorder`
implementation translates dispatch-order stamps back through them.

Mechanism only: nothing reads the stamps yet. The final PR in the stack
uses them to bill interrupted tool batches on a dedicated usage record
committed alongside their synthesized cancellation rows.

Third of a four-PR stack splitting #28211. Stacked on #28360. Refs
CODAGT-928
(https://linear.app/codercom/issue/CODAGT-928/track-local-tool-execution-for-agent-runtime).

---------

Co-authored-by: Hugo Dutka <hugo@coder.com>
 2026-08-25 16:57:27 +07:00
Michael Suchacz cc958b73be fix(coderd/x/chatd/mcpclient): enforce MCP connect budget and unblock session cleanup (#28400) 
## Problem

During the Aug 19 dev.coder.com incident, chats stalled for up to ~15
minutes per turn. chatd reconnects to every configured MCP server on
every generation step, and one configured server
(`registry.coder.com/mcp`) was black-holing requests from the
deployment's egress IPs: TCP/requests were silently dropped, and each
connect attempt hung until the kernel gave up (~125s), far past the
nominal 10s connect budget.

The budget does not hold because go-sdk v1.7.0 detaches the context
inside `StreamableClientTransport.Connect`, and its error paths block on
HTTP work bound to that detached context. Reproduced in a test: a bare
`Connect` with a 2s deadline against a black-holed server returns after
**12s**. Step-end session cleanup (`session.Close()`) runs synchronously
in the generation loop and blocks on the same detached requests, so a
server that wedges mid-turn stalls every step boundary too.

## Changes

- **Enforce the connect budget externally** (`connectOne`): run
`Connect` + `ListTools` in a goroutine and select on the budget context.
On timeout, abandon the goroutine and leave a reaper that drains its
late result and closes any session that still materialized, so nothing
leaks and the caller returns within the budget.
- **Stop using bare `http.DefaultTransport`**: MCP traffic now rides a
cloned transport with a 5s dial timeout (converts SYN black-holes into
fast errors) and a 60s `ResponseHeaderTimeout`. `http.Client.Timeout`
stays unset so long-lived SSE streams are unaffected.
- **Close sessions in detached goroutines during cleanup**
(`ConnectAll`'s cleanup func): the sessions are discarded regardless,
and a wedged `Close` (DELETE bound to the SDK's detached context) must
not stall the generation loop at step boundaries.

One deliberate deviation from the incident plan: `ResponseHeaderTimeout`
is 60s (matching `toolCallTimeout`) instead of ~10s. The same HTTP
client serves tool-call POSTs, and a JSON-response MCP server sends no
headers until the tool finishes, so a 10s bound would falsely kill
legitimate 10-60s tools that fit today's tool-call budget. The real 10s
connect budget is enforced by the external select, not the transport.

## Tests

- Acceptance: with a black-holed server plus a healthy one configured,
`ConnectAll` returns within the budget and the healthy server's tools
are present; closing the black-holed connections makes the reaper exit
(red without the fix: 1s budget took 11s).
- A slow-but-alive server (300ms/request) still connects.
- A server that only responds after the budget: `ConnectAll` returns
promptly, the late result is reaped.
- Cleanup returns promptly while the session-teardown DELETE is wedged
server-side, and the teardown still happens in the background (red
without the fix: cleanup blocked 60s).
- Transport guard test pinning the dial/response-header bounds.

`go test ./coderd/x/chatd/...` passes (including goleak in `chatd`).

Part of the MCP connect-stall incident follow-up; observability (connect
durations in logs/debug runs) comes in a stacked follow-up PR.

> 🤖 Mux authored this PR on Mike's behalf.

<!-- mux-attribution: model=anthropic:claude-opus-4-6 thinking=high -->
 2026-08-25 09:43:55 +00:00
Jaayden Halko b428c8feb6 feat(coderd): bill completed local tool batches in agent runtime (#28360) 
**Stack**: #28359 → **#28360 (this PR)** → #28361 → #28362

## Summary

Completed local tool batches now count toward Coder Agent runtime
(`chat_messages.runtime_ms`, the source of truth for
`hb_agent_runtime_v1`), excluding sub-agent orchestration tools to avoid
double counting, and without multiplying runtime for parallel tool
calls.

Second of a four-PR stack splitting #28211. Stacked on #28359. Refs
CODAGT-928
(https://linear.app/codercom/issue/CODAGT-928/track-local-tool-execution-for-agent-runtime).

## Problem

Agent runtime previously measured only model invocation wall clock
(stream open to fully consumed). Time spent executing local tools
between steps, including file operations, terminal commands, workspace
provisioning, and MCP tools, was deliberately excluded, which
undercounts the product definition of "actively processing a task".

Naive inclusion has two hazards: a batch of parallel tool calls would
bill N windows for one wall-clock wait, and `wait_agent` would re-bill
child agents that already bill their own model and tool time.

## Fix

Each completed local tool batch bills one window: the union of the
billed tools' execution intervals, persisted as `runtime_ms` on a
dedicated usage record appended after the batch's tool-result rows. The
record is a tool-role message with `visibility='model'`, so it never
reaches the API, SSE, or clients, and prompt replay drops it because its
single internal `tool-batch-usage` part converts to no provider content.
Its content carries an audit payload (`billed_ms`, `billed_calls`) so
the billed window is inspectable after the fact; real tool-result rows
never carry batch-level runtime. Concurrent calls all start at batch
start, so 5 parallel 10s reads bill 10s, not 50s; serial calls
(`SerialToolCalls`) count only from their own launch, so unbilled waits
before them do not count.

Sub-agent orchestration tools (`spawn_agent`, `wait_agent`,
`message_agent`, `interrupt_agent`, `list_agents`,
`list_subagent_models`, plus the deprecated `close_agent` alias) never
extend the window: every chat, including children, applies the same
rules to its own runtime, so a parent's `wait_agent` window would double
count. A lone `wait_agent` bills 0 and appends no usage record;
`execute` 10s in parallel with `wait_agent` 60s bills 10s. A test pins
the unbilled set to the registered sub-agent tool catalog so they cannot
drift.

`GetTotalChatMessageRuntimeMsInRange` already sums `runtime_ms`
role-agnostically, so the usage record is picked up with no schema,
query, or cron changes.

Client-executed dynamic tools, external agents, parked/idle time, and
retry backoff remain unbilled. Interrupted batches still bill only the
model window; the rest of the stack adds partial-window billing via the
same usage record.

`ExecuteLocalToolsOptions` also gains an optional `ToolBillingRecorder`
(`RecordStart`/`RecordComplete`) observing per-occurrence dispatch-order
execution stamps. This PR wires no recorder; the next PR in the stack
connects it to the message part buffer for interrupt billing.

**NOTE**: Reported agent runtime (`hb_agent_runtime_v1`) increases from
deploy forward. There is no backfill and no feature flag.
 2026-08-25 16:40:41 +07:00
Michael Suchacz e244cac9c1 feat(coderd/x/chatd/chattool): improve find_tools relevance and model guidance (#28476) 
Broad `find_tools` queries such as "linear issues" saturated the hard
20-match cap on every call: a large server's name token-matches every
one of its tools (+8 name, +1 server), so ranking was decided by a term
carrying no discriminating information and the model got 20 activations
per search regardless of intent.

Three changes, mirroring what makes xum's `tool_catalog_search` behave
well:

- **Lower default with a `limit` argument.** Keyword matches default to
10 per call; the new optional `limit` raises that up to the existing
hard cap of 20 (non-positive values fall back to the default). Exact
`names` are explicit activation requests and bypass the limit up to the
hard cap, so naming 15 tools still activates all 15.
- **Coverage-first ranking.** Keyword matches sort by distinct query
terms matched before raw score, so a query like "linear issues" ranks
tools matching both terms above the dozens matching only the server
name.
- **Model guidance.** `queries` and `names` now carry schema
descriptions (capability keywords and what they are matched against;
exact-name activation), and the tool description opens by explaining
what deferral means, that matches become callable on the next step, and
that a `"server: terms"` prefix scopes a query to one server.

An earlier revision also inferred a server scope from unprefixed query
words ("linear issues" behaving like "linear: issues"). Review kept
surfacing edge cases in that inference, and coverage-first ranking
already resolves the original saturation complaint, so it was dropped in
favor of the explicit prefix.

The hard cap stays at 20 so the persisted result keeps fitting under the
generic tool-result truncation budget that protects activation-recovery
JSON. Budget and reservation accounting are unchanged; the frontend
renderer ignores unknown argument fields, so no `site/` change is
needed.

> [!NOTE]
> Xum acted on @ibetitsmike's behalf in this pull request.
<!-- xum-attribution: model=claude-opus-4-6 thinking=high -->
 2026-08-25 11:39:43 +02:00
Hugo Dutka 01c935ab6b test(coderd/x/chatd): avoid advancing unrelated retry timers (#28537) 
`TestActiveServer_RetryStatePersistedDuringBackoff` advanced whichever
mock-clock timer was next while waiting for the retried provider call.
If the provider goroutine had not incremented its call count yet, the
test could advance the unrelated 15-minute task timeout and trigger an
extra whole-task retry.

Trap and release only the named generation-retry timer, then wait for
the provider call without advancing the clock again.

Refs
https://linear.app/codercom/issue/CODAGT-967/flake-testactiveserver-retrystatepersistedduringbackoff

<sub>Generated by Coder Agents.</sub>
 2026-08-25 11:35:53 +02:00
Jaayden Halko d44aae37de refactor(coderd/x/chatd): return PersistedStep directly from ExecuteLocalTools (#28359) 
**Stack**: **#28359 (this PR)** → #28360 → #28361 → #28362

`chatloop.ToolExecutionOutcome` only wrapped a `PersistedStep`, so
callers had to reach through `outcome.Step` for every field.
`ExecuteLocalTools` now returns the `PersistedStep` directly and the
wrapper type is deleted. No behavior change.

First of a four-PR stack that makes local tool execution count toward
Coder Agent runtime (splitting #28211). This refactor keeps the rename
noise out of the feature PRs.

Refs CODAGT-928
(https://linear.app/codercom/issue/CODAGT-928/track-local-tool-execution-for-agent-runtime).
 2026-08-25 16:31:06 +07:00
TJ e98e2b9b2e fix(site/src/pages/AIBridgePage): align token badges with neighboring badge sizing (#28477) 
The in/out token pills on the AI Gateway sessions pages looked out of
place next to the provider/client/model badges: they used `Badge
size="sm"` while their neighbors use the default `md`, and their arrow
icons were `size-icon-lg` (24px) — taller than the badge itself,
inflating the pill height.

> [!NOTE]
> The underlying font-size problem (`Badge sm` = 10px `text-2xs`) is
fixed globally in #28517. This PR handles what that one doesn't: the
token pills' size variant, icon sizing, and API cleanup.

## Changes

- Token pills use Badge's default `md` size, matching the
provider/client/model badges next to them.
- Arrow icons drop from `size-icon-lg` (24px) to `size-icon-xs` (14px),
the same icon size the neighboring badges use, with `gap-0.5` between
icon and count.
- Removed the unused `size` prop from `TokenBadges` — no call site ever
passed one — and dropped the now-meaningless `SizeXs`/`SizeMd` stories.

Affects every `TokenBadges` consumer: the sessions list, the session
summary card, and the timeline prompt/tool-call tables.

> 🤖 Generated by Coder Agents on behalf of @tracyjohnsonux
 2026-08-25 00:21:53 -07:00
TJ 0452ff7ec4 refactor(site/src/pages/AIBridgePage): move AI Sessions docs link inline into subtitle (#28481) 
Replaces the "Read the docs" header button on the AI Sessions page with
an inline "View docs" link at the end of the subtitle sentence, matching
the pattern used on the Providers and Provisioner Jobs pages.

---

_Created by a Coder Agent on behalf of the PR author._
 2026-08-25 00:21:12 -07:00
david-fraley 0f41ccd664 fix(site/src/pages/AgentsPage): rename "This Week" group to "Past 7 days" (#28504) 2026-08-25 10:14:59 +03:00
Jake Howell 303935a2dc revert(site/e2e): disable externalAuth suite (#28536) 
> 🤖 This PR was written by Coder Agents on behalf of Jake Howell.

Reverts 18b37e64f5 because the external
authentication end-to-end suite is still failing in CI.

This restores the suite's previous skipped state while the remaining
failure is investigated.

Refs https://linear.app/codercom/issue/DEVEX-413
 2026-08-25 14:13:22 +07:00
Jake Howell bef6b4c30b revert(site): remove built-in emoji avatar inset (#28533) 
> 🤖 This PR was written by Coder Agents on behalf of Jake Howell.

Reverts `75400428ad2b84c707f60fc5e6b378f46f565ef9` (`fix(site/src): give
built-in emoji avatars a consistent inset`).

The global built-in emoji detection and inline padding are causing
regressions. Revert this behavior so a replacement can be developed
separately.

## Changes

- Remove automatic `/emojis/` source detection from `Avatar`.
- Restore caller-controlled avatar variants and styles.
- Remove the built-in emoji inset stories.

## Verification

- Confirmed the resulting patch is the inverse of the target commit.
 2026-08-25 07:07:52 +00:00
TJ 607a1d0666 refactor(site/src): delete DateTimeRangeFilter and unify on the picker's time range type (#28427) 
Completes the deduplication agreed in #28392 (review): now that
`DateTimeRangePicker` has replaced the text-expression
`DateTimeRangeFilter` on the AI Gateway sessions page, the old component
and its `TimeRange` type are deleted, leaving a single time-range value
shape.

- Deletes `site/src/components/DateTimeRangeFilter/` (component,
stories, `timeRange.ts` helpers, tests); nothing imported it except the
sessions page type alias.
- The sessions page helpers in `ListSessionsPage/timeRange.ts` now use
neutral `{start, end}` naming derived from the picker's
`DateTimeRangeValue` (`type TimeRange = Pick<DateTimeRangeValue, "start"
| "end">`), removing the `startedAfter`/`startedBefore` field mapping
the page previously did by hand.

No behavior changes: the query-string serialization
(`started_after`/`started_before` RFC 3339 params) is untouched, and all
existing unit tests pass with only field renames.

---

Generated by Coder Agents on behalf of @tracyjohnsonux.
 2026-08-24 22:58:51 -07:00