opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-11-12 04:32:47 +08:00
Code Issues Packages Projects Releases Wiki Activity
11,414 Commits 479 Branches 432 Tags
643fe38b1e31abb4e3840d3345a295659d928b60
Commit Graph
11414 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Asher 643fe38b1e fix: use temp file on same device with mcp file edit (#20477) 
Otherwise you can get errors like "invalid cross-device link".
 2025-10-29 12:23:06 -08:00
Jaayden Halko c827a08c11 refactor: migrate deployment banner to Tailwind and radix (#20479) 
before:
<img width="1667" height="48" alt="Screenshot 2025-10-25 at 18 02 45"
src="https://github.com/user-attachments/assets/1525a01e-5976-4d0e-8280-1b9ae8d91197"
/>

after:
<img width="1662" height="35" alt="Screenshot 2025-10-25 at 18 02 17"
src="https://github.com/user-attachments/assets/d0fd7b69-ee88-4986-a539-5917c17a8b85"
/>
 2025-10-29 15:41:19 -04:00
Bartek Gatz 1b6556c2f6 fix: improve visual separation between prompt and task list (#20427) 2025-10-29 19:00:27 +00:00
Mathias Fredriksson 859e94d67a fix: deprecate codersdk.AITaskPromptParameterName and reduce usage (#20501) 
Depends on coder/sqlc#1
Fixes coder/internal#979
Updates coder/internal#973
 2025-10-29 18:59:12 +00:00
Cian Johnston 50749d131b ci: workaround for get.helm.sh outage (#20552) 
<!--

If you have used AI to produce some or all of this PR, please ensure you
have read our [AI Contribution
guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING)
before submitting.

-->
 2025-10-29 17:33:03 +00:00
Dean Sheather 9986dc0c38 chore: remove brazil region from dogfood (#20548) 2025-10-29 13:03:14 -04:00
Dean Sheather 92b63871ca chore: remove dogfood envbuilder template deployment (#20546) 
Already missing in state, verified with `terraform state list`
 2025-10-29 13:03:00 -04:00
Mathias Fredriksson 303e9ef7de fix: switch to coder/sqlc fork (#20536) 
Refs https://github.com/coder/sqlc/pull/1
Unblocks https://github.com/coder/coder/pull/20501

Upstream https://github.com/sqlc-dev/sqlc/pull/4159
 2025-10-29 18:45:56 +02:00
Cian Johnston 1ebc217624 fix: update task link AppStatus using task_id (#20543) 
Fixes https://github.com/coder/coder/issues/20515

Alternative to https://github.com/coder/coder/pull/20519

Adds `task_id` to `workspaces_expanded` view and updates the "View Task"
link in `AppStatuses` component.

NOTE: this contains a migration
 2025-10-29 15:45:45 +00:00
Danielle Maywood 06dbadab11 fix(coderd): ensure lifecycle executor has sufficient task permissions (#20539) 
We recently made a change to the `wsbuilder` to handle task related
logic. Our test coverage for the lifecycle executor didn't handle this
scenario and so we missed that it had insufficient permissions.

This PR adds `Update` and `Read` permissions for `Task`s in the
lifecycle executor, as well as an autostart/autostop test tailored to
task workspaces to verify the change.

---

Anthropic's Claude Sonnet 4.5 Thinking was involved in writing the tests
 2025-10-29 15:44:35 +00:00
Cian Johnston 566146af72 fix(coderd): fix audit log resource link for tasks (#20545) 
Existing task audit log links were incorrect. As audit log links are
generated on-the-fly, this does not require backfill.
 2025-10-29 15:31:41 +00:00
Susana Ferreira 7e8fcb4b0f perf: optimize prebuilds membership reconciliation to check orgs not presets (#20493) 
## Description

The membership reconciliation ensures the prebuilds system user is a
member of all organizations with prebuilds configured. To support
prebuilds quota management, each organization must have a prebuilds
group that the system user belongs to.

## Problem

Previously, membership reconciliation iterated over all presets to check
and update membership status. This meant database queries
`GetGroupByOrgAndName` and `InsertGroupMember` were executed for each
preset. Since presets are unique combinations of `(organization,
template, template version, preset)`, this resulted in several redundant
checks for the same organization.

In dogfood, `InsertGroupMember` was called thousands of times per day,
even though memberships were already configured ([internal Grafana
dashboard link](https://grafana.dev.coder.com/goto/46MZ1UgDg?orgId=1))

<img width="5382" height="1788" alt="Screenshot 2025-10-28 at 16 01 36"
src="https://github.com/user-attachments/assets/757b7253-106f-4f72-8586-8e2ede9f18db"
/>

## Solution

This PR introduces `GetOrganizationsWithPrebuildStatus`, a single query
that returns:
* All unique organizations with prebuilds configured
* Whether the prebuilds user is a member of each organization
* Whether the prebuilds group exists in each organization
* Whether the prebuilds user is in the prebuilds group

The membership reconciliation logic now:
* Fetches status for all organizations in one query
* Only performs inserts for organizations missing required memberships
or groups
* Safely handles concurrent operations via unique constraint violations
* This reduces database load from `O(presets)` to `O(organizations)` per
reconciliation loop, with a single read query when everything is
configured.

## Changes

* Add `GetOrganizationsWithPrebuildStatus` SQL query
* Update `membership.ReconcileAll` to use organization-based
reconciliation instead of preset-based
* Update tests to reflect new behavior

Related to internal thread:
https://codercom.slack.com/archives/C07GRNNRW03/p1760535570381369
 2025-10-29 14:24:29 +00:00
Danny Kopping dd28eef5b4 chore: update dogfood template to use new aibridge endpoint (#20525) 
Also updating Nix to 2.28.5 since the previous version 404s.

Closes https://github.com/coder/internal/issues/1105
 2025-10-29 07:53:34 -06:00
Danny Kopping 2f886ce8d0 chore: update docs (#20521) 
Updates AI Bridge docs to remove experiment details.
 2025-10-29 07:43:33 -06:00
Danny Kopping dcfd6d6f73 chore: graduate aibridge cli out of experimental (#20524) 
<!--

If you have used AI to produce some or all of this PR, please ensure you have read our [AI Contribution guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING) before submitting.

-->
 2025-10-29 07:36:08 -06:00
Danny Kopping b20fd6f2c1 chore: graduate aibridge API out of experimental (#20523) 
<!--

If you have used AI to produce some or all of this PR, please ensure you have read our [AI Contribution guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING) before submitting.

-->
 2025-10-29 07:18:54 -06:00
Danny Kopping 2294c55bd9 chore: graduate aibridged* packages out of experimental (#20522) 
<!--

If you have used AI to produce some or all of this PR, please ensure you have read our [AI Contribution guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING) before submitting.

-->
 2025-10-29 07:00:24 -06:00
Susana Ferreira aad1b401c1 feat: add prebuilds reconciliation duration metric (#20535) 
## Description

Adds `coderd_prebuilds_reconciliation_duration_seconds` histogram metric
to track the duration of each prebuilds reconciliation cycle.

This metric helps operators monitor reconciliation performance and
identify potential bottlenecks.

## Changes

- Added `ReconcileStats` struct to capture reconciliation cycle
statistics
- Updated `ReconcileAll()` to return stats including elapsed time
- Added histogram metric
`coderd_prebuilds_reconciliation_duration_seconds`
 2025-10-29 12:52:30 +00:00
Steven Masley a8294872a3 chore: use consistent function for statefile path (#20527) 
We use `getStateFilePath` in 2 locations, and a manual `filepath.Join`
here. Just refactored to use the helper function
 2025-10-29 07:44:09 -05:00
Danny Kopping 95a1ca898f chore: remove aibridge experiment (#20520) 
Removes the experiment and all references to it
 2025-10-29 06:18:38 -06:00
Susana Ferreira c3e3bb58f2 feat: delete pending canceled prebuilds (#20499) 
## Description

PR https://github.com/coder/coder/pull/20387 introduced canceling
pending prebuild jobs from inactive template versions to avoid
provisioning obsolete workspaces. However, the associated prebuilds
remained in the database with "Canceled" status, visible in the UI.

This PR now orphan-deletes these canceled prebuilt workspaces. Since the
canceled jobs were never processed by a provisioner, no Terraform
resources were created, making orphan deletion safe.

Orphan deletion always creates a provisioner job, but behaves
differently based on provisioner availability:
- If no provisioner daemon is available, the job is immediately marked
as completed and the workspace is marked as deleted without any
provisioner processing
- If a provisioner daemon is available, it processes the delete job with
empty Terraform state (no actual resources to destroy)

The job cancellation and workspace deletion occur atomically in the same
transaction. We don't split this into two separate reconciliation runs
because there's no way to distinguish between system-canceled prebuilds
and user-canceled workspaces. If we deleted canceled workspaces in a
later run, we'd delete user-canceled workspaces that users may want to
keep for troubleshooting.

Note: This only applies to system-generated prebuilds from inactive
template versions.

## Changes

* Update `UpdatePrebuildProvisionerJobWithCancel` query to return job
ID, workspace ID, template ID, and template version preset ID
* Add `DeprovisionMode` enum to support orphan deletion in the provision
flow
* Update `ActionTypeCancelPending` handler to cancel jobs and
orphan-delete associated workspaces atomically
 2025-10-29 10:37:28 +00:00
Atif AliClaudeEthan Dickson
 		0d765f56f7 chore: update terraform to 1.13.4 (#20532) 
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Ethan Dickson <ethan@coder.com>
 2025-10-29 07:34:41 +00:00
Asher 8b6f55c312 chore: improve remote mcp workspace and file prompts (#20475) 
I have been experimenting (via blink) and these seem to have made the
LLM behave more intelligently and consistently when it comes to creating
workspaces and manipulating files.

Partially addresses https://github.com/coder/internal/issues/1047
 2025-10-28 15:20:20 -08:00
Danielle Maywood 40fc337659 fix(site): fix react state violation in filetree create/update utils (#20483) 2025-10-28 21:41:02 +00:00
david-fraley f6df4c0ed8 docs: update release calendar for new patches (#20526) 2025-10-28 14:24:03 -07:00
Steven Masley 924afb753f feat: add more detailed init timings in build timeline (#20503) 
This uses the `terraform init -json` logs to add more visibility into
the `init` phase of `plan`. The `init` logs omit `ms` precision, so we
have to use `time.Now()` 😢

Open TF PR: https://github.com/hashicorp/terraform/pull/37818
 2025-10-28 15:47:52 -05:00
Callum Styan 45c43d4ec4 fix: refactor agent resource monitoring API to avoid excessive calls to DB (#20430) 
This should resolve https://github.com/coder/internal/issues/728 by
refactoring the ResourceMonitorAPI struct to only require querying the
resource monitor once for memory and once for volumes, then using the
stored monitors on the API struct from that point on. This should
eliminate the vast majority of calls to `GetWorkspaceByAgentID` and
`FetchVolumesResourceMonitorsUpdatedAfter`/`FetchMemoryResourceMonitorsUpdatedAfter`
(millions of calls per week).

Tests passed, and I ran an instance of coder via a workspace with a
template that added resource monitoring every 10s. Note that this is the
default docker container, so there are other sources of
`GetWorkspaceByAgentID` db queries. Note that this workspace was running
for ~15 minutes at the time I gathered this data.

Over 30s for the `ResourceMonitor` calls:
```
coder@callum-coder-2:~/coder$ curl localhost:19090/metrics | grep ResourceMonitor | grep count
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0coderd_db_query_latencies_seconds_count{query="FetchMemoryResourceMonitorsByAgentID"} 2
coderd_db_query_latencies_seconds_count{query="FetchMemoryResourceMonitorsUpdatedAfter"} 2
100  288k    0  288k    0     0  58.3M      0 --:--:-- --:--:-- --:--:-- 70.4M
coderd_db_query_latencies_seconds_count{query="FetchVolumesResourceMonitorsByAgentID"} 2
coderd_db_query_latencies_seconds_count{query="FetchVolumesResourceMonitorsUpdatedAfter"} 2
coderd_db_query_latencies_seconds_count{query="UpdateMemoryResourceMonitor"} 155
coderd_db_query_latencies_seconds_count{query="UpdateVolumeResourceMonitor"} 155
coder@callum-coder-2:~/coder$ curl localhost:19090/metrics | grep ResourceMonitor | grep count
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0coderd_db_query_latencies_seconds_count{query="FetchMemoryResourceMonitorsByAgentID"} 2
coderd_db_query_latencies_seconds_count{query="FetchMemoryResourceMonitorsUpdatedAfter"} 2
100  288k    0  288k    0     0  34.7M      0 --:--:-- --:--:-- --:--:-- 40.2M
coderd_db_query_latencies_seconds_count{query="FetchVolumesResourceMonitorsByAgentID"} 2
coderd_db_query_latencies_seconds_count{query="FetchVolumesResourceMonitorsUpdatedAfter"} 2
coderd_db_query_latencies_seconds_count{query="UpdateMemoryResourceMonitor"} 158
coderd_db_query_latencies_seconds_count{query="UpdateVolumeResourceMonitor"} 158
```

And over 1m for the `GetWorkspaceAgentByID` calls, the majority are from
the workspace metadata stats updates:
```
coder@callum-coder-2:~/coder$ curl localhost:19090/metrics | grep GetWorkspaceByAgentID | grep count
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  284k    0  284k    0     0  42.4M      0 --:--:-- --:--:-- --:--:-- 46.3M
coderd_db_query_latencies_seconds_count{query="GetWorkspaceByAgentID"} 876
coder@callum-coder-2:~/coder$ curl localhost:19090/metrics | grep GetWorkspaceByAgentID | grep count
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  284k    0  284k    0     0  75.4M      0 --:--:-- --:--:-- --:--:-- 92.7M
coderd_db_query_latencies_seconds_count{query="GetWorkspaceByAgentID"} 918
```

---------

Signed-off-by: Callum Styan <callumstyan@gmail.com>
 2025-10-28 13:38:16 -07:00
Danielle Maywood a1e7e105a4 chore: disable task notifications by default (#20518) 
Relates to https://github.com/coder/internal/issues/1098

Currently task notifications are incredibly noisy. We should disable
them by default for the upcoming release whilst we iron them out.
 2025-10-28 17:21:23 +00:00
david-fraley cf93c34172 docs: update coder_token_lifetime description to include units and examples (#20516) 2025-10-28 15:15:57 +00:00
Cian Johnston 659f89e079 feat(coderd): add owner-related fields to tasks_with_status view (#20471) 
Relates to
https://github.com/coder/coder/pull/20431/files#diff-9cfc826a6ce7e77d977b2025482474dd263d12965b2a94479a74c7f1d872b782

If the workspace relating to a task was deleted, most of the
workspace-related fields in `taskFromDBTaskAndWorkspace` will be
zero-valued. However, we can still get information relating to the owner
so that "created by" shows up correctly in the UI.

Updates the `tasks_with_status` view with a join on `visible_users` to
get owner-related info.
 2025-10-28 14:29:29 +00:00
Danielle Maywood e4e4669feb fix(agent/agentcontainers): remove unneeded default branch (#20511) 
Closes https://github.com/coder/internal/issues/769

According to the `time.NewTicker` documentation [^1] (which is used
under the hood by https://github.com/coder/quartz) it will automatically
adjust the time interval to make up for slow receivers. This means we
should be safe to drop the default branch.

> NewTicker returns a new Ticker containing a channel that will send the
current time on the channel after each tick. The period of the ticks is
specified by the duration argument. The ticker will adjust the time
interval or drop ticks to make up for slow receivers. The duration d
must be greater than zero; if not, NewTicker will panic.

[^1]: https://pkg.go.dev/time#Ticker
 2025-10-28 12:16:42 +00:00
Mathias Fredriksson a1fa58ac17 fix: update dbgen and dbfake task creation and toolsdk test fixtures (#20508) 
Depends on #20506
Fixes coder/internal#1103
 2025-10-28 14:15:58 +02:00
Hugo Dutka 88b7372e7f chore: remove custom go cache download step from CI (#20510) 
Since depot added [native support for go
cache](https://depot.dev/docs/cache/reference/gocache), custom cache
download and upload steps are not necessary anymore.
 2025-10-28 12:58:25 +01:00
Dean Sheather dec6d310a8 fix: avoid bad switch statement in license code (#20509) 
Noticed this while trying to investigate a flake.

Relates to https://github.com/coder/internal/issues/788
 2025-10-28 06:19:52 +00:00
Spike Curtis e720afa9d0 docs: add description of dynamic parameters test (#20488) 
## Add Dynamic Parameters test procedure to 10k users validated architecture

This PR adds a new test procedure for Dynamic Parameters to the 10k users validated architecture documentation. No changes to the recommended hardware specs as this test case succeeded with no issues.
 2025-10-28 10:11:25 +04:00
Danny Kopping d18441debe feat: add AWS Bedrock support (#20507) 
Depends on https://github.com/coder/aibridge/pull/44

Closes https://github.com/coder/aibridge/issues/28

---------

Signed-off-by: Danny Kopping <danny@coder.com>
 2025-10-28 03:38:14 +00:00
ケイラ 4f7b279fd8 feat: add an organization member permission level (#19953) 2025-10-27 17:14:16 -06:00
Mathias Fredriksson c3cbd977f1 fix(coderd/database/dbfake): use transaction for workspace builder (#20506) 
While investigating a flake I noticed that the dbfake workspace builder
executes all database inserts without a transaction. Since our real
wsbuilder implementation utilizes one it makes sense to do here as well.

For example, our normal workspace <-> build relationship is such that a
workspace cannot exist with at least one build. However, our
GetWorkspaces query left joins workspace builds but has types that are
non-nullable, leading to flakes like coder/internal#1103.
 2025-10-28 01:06:52 +02:00
ケイラ d8b1ca70d6 chore: remove @Parkreiner from CODEOWNERS (#20504) 2025-10-27 11:55:33 -06:00
Dean Sheather 5a3ceb38f0 chore: add aibridge data to telemetry (#20449) 
- Adds a new table to keep track of which payloads have already been
reported since we only report for the last clock hour
- Adds a query to gather and aggregate all the data by
provider/model/client

Relates to https://github.com/coder/coder-telemetry-server/issues/27
 2025-10-28 03:16:41 +11:00
Thomas Kosiewski cadf1352b4 feat: add scoped token support to CLI (#19985) 
<!--

If you have used AI to produce some or all of this PR, please ensure you have read our [AI Contribution guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING) before submitting.

-->

Add support for scoped API tokens in CLI

This PR adds CLI support for creating and viewing API tokens with scopes and allow lists. It includes:

- New `--scope` and `--allow` flags for the `tokens create` command
- A new `tokens view` command to display detailed information about a token
- Updated table columns in `tokens list` to show scopes and allow list entries
- Updated help text and examples

These changes enable users to create tokens with limited permissions through the CLI, similar to the existing functionality in the web UI.
 2025-10-27 17:07:25 +01:00
jesmine ed3d6fa9e3 fix(site): preserve file path when building template version (#20481) 
Fixes issue where clicking Build in the template editor would always
redirect to main.tf instead of keeping the currently open file.

Closes #14130

<!--

If you have used AI to produce some or all of this PR, please ensure you
have read our [AI Contribution
guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING)
before submitting.

-->
 2025-10-27 13:03:15 -03:00
ケイラ d9c40d61c2 refactor: clean up policy.rego (#20366) 2025-10-27 10:01:30 -06:00
Bruno Quaresma 90b64c5e04 chore: remove unecessary API.getWorkspaceParameters (#20462) 
I initially created `API.getWorkspaceParameters` to group two related
requests, but after revisiting the implementation, I realized this
abstraction doesn’t add much value. It also prevents us from taking full
advantage of React Query’s built-in caching and invalidation.

So instead of grouping them, I removed the helper and replaced it with
separate queries — this simplifies the flow and lets React Query handle
caching more efficiently.

Related to
https://github.com/coder/coder/pull/20431#discussion_r2457010137
 2025-10-27 12:47:44 -03:00
Paweł Banaszewski d0fb4599f0 feat: add RecordInterceptionEnded rpc (#20494) 
Adds RPC that marks interception as completed.
Added to aibridge in https://github.com/coder/aibridge/pull/43

fixes https://github.com/coder/internal/issues/1051
 2025-10-27 16:38:00 +01:00
Steven Masley ffe22a0ffc chore: show build timeline regardless of agent scripts count (#20470) 2025-10-27 10:09:52 -05:00
dependabot[bot] a1161b79a7 ci: bump the github-actions group with 7 updates (#20498) 
Bumps the github-actions group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/upload-artifact](https://github.com/actions/upload-artifact)
| `4.6.2` | `5.0.0` |
| [chromaui/action](https://github.com/chromaui/action) | `13.3.0` |
`13.3.2` |
|
[actions/download-artifact](https://github.com/actions/download-artifact)
| `5.0.0` | `6.0.0` |
|
[tj-actions/changed-files](https://github.com/tj-actions/changed-files)
| `d03a93c0dbfac6d6dd6a0d8a5e7daff992b07449` |
`dbf178ceecb9304128c8e0648591d71208c6e2c9` |
|
[nixbuild/nix-quick-install-action](https://github.com/nixbuild/nix-quick-install-action)
| `33` | `34` |
| [github/codeql-action](https://github.com/github/codeql-action) |
`4.30.9` | `4.31.0` |
|
[Mattraks/delete-workflow-runs](https://github.com/mattraks/delete-workflow-runs)
| `2.0.6` | `2.1.0` |

Updates `actions/upload-artifact` from 4.6.2 to 5.0.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/upload-artifact/releases">actions/upload-artifact's
releases</a>.</em></p>
<blockquote>
<h2>v5.0.0</h2>
<h2>What's Changed</h2>
<p><strong>BREAKING CHANGE:</strong> this update supports Node
<code>v24.x</code>. This is not a breaking change per-se but we're
treating it as such.</p>
<ul>
<li>Update README.md by <a
href="https://github.com/GhadimiR"><code>@​GhadimiR</code></a> in <a
href="https://redirect.github.com/actions/upload-artifact/pull/681">actions/upload-artifact#681</a></li>
<li>Update README.md by <a
href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a
href="https://redirect.github.com/actions/upload-artifact/pull/712">actions/upload-artifact#712</a></li>
<li>Readme: spell out the first use of GHES by <a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/upload-artifact/pull/727">actions/upload-artifact#727</a></li>
<li>Update GHES guidance to include reference to Node 20 version by <a
href="https://github.com/patrikpolyak"><code>@​patrikpolyak</code></a>
in <a
href="https://redirect.github.com/actions/upload-artifact/pull/725">actions/upload-artifact#725</a></li>
<li>Bump <code>@actions/artifact</code> to <code>v4.0.0</code></li>
<li>Prepare <code>v5.0.0</code> by <a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/upload-artifact/pull/734">actions/upload-artifact#734</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/GhadimiR"><code>@​GhadimiR</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/upload-artifact/pull/681">actions/upload-artifact#681</a></li>
<li><a href="https://github.com/nebuk89"><code>@​nebuk89</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/upload-artifact/pull/712">actions/upload-artifact#712</a></li>
<li><a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/upload-artifact/pull/727">actions/upload-artifact#727</a></li>
<li><a
href="https://github.com/patrikpolyak"><code>@​patrikpolyak</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/upload-artifact/pull/725">actions/upload-artifact#725</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/upload-artifact/compare/v4...v5.0.0">https://github.com/actions/upload-artifact/compare/v4...v5.0.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/upload-artifact/commit/330a01c490aca151604b8cf639adc76d48f6c5d4"><code>330a01c</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/upload-artifact/issues/734">#734</a>
from actions/danwkennedy/prepare-5.0.0</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/03f282445299bbefc96171af272a984663b63a26"><code>03f2824</code></a>
Update <code>github.dep.yml</code></li>
<li><a
href="https://github.com/actions/upload-artifact/commit/905a1ecb5915b264cbc519e4eb415b5d82916018"><code>905a1ec</code></a>
Prepare <code>v5.0.0</code></li>
<li><a
href="https://github.com/actions/upload-artifact/commit/2d9f9cdfa99fedaddba68e9b5b5c281eca26cc63"><code>2d9f9cd</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/upload-artifact/issues/725">#725</a>
from patrikpolyak/patch-1</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/9687587dec67f2a8bc69104e183d311c42af6d6f"><code>9687587</code></a>
Merge branch 'main' into patch-1</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/2848b2cda0e5190984587ec6bb1f36730ca78d50"><code>2848b2c</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/upload-artifact/issues/727">#727</a>
from danwkennedy/patch-1</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/9b511775fd9ce8c5710b38eea671f856de0e70a7"><code>9b51177</code></a>
Spell out the first use of GHES</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/cd231ca1eda77976a84805c4194a1954f56b0727"><code>cd231ca</code></a>
Update GHES guidance to include reference to Node 20 version</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/de65e23aa2b7e23d713bb51fbfcb6d502f8667d8"><code>de65e23</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/upload-artifact/issues/712">#712</a>
from actions/nebuk89-patch-1</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/8747d8cd7632611ad6060b528f3e0f654c98869c"><code>8747d8c</code></a>
Update README.md</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/upload-artifact/compare/ea165f8d65b6e75b540449e92b4886f43607fa02...330a01c490aca151604b8cf639adc76d48f6c5d4">compare
view</a></li>
</ul>
</details>
<br />

Updates `chromaui/action` from 13.3.0 to 13.3.2
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/chromaui/action/commit/bc2d84ad2b60813a67d995c5582d696104a19383"><code>bc2d84a</code></a>
v13.3.2</li>
<li><a
href="https://github.com/chromaui/action/commit/1c807fb41f4db007b022d0806c09a94dce7b5ff6"><code>1c807fb</code></a>
v13.3.1</li>
<li>See full diff in <a
href="https://github.com/chromaui/action/compare/4ffe736a2a8262ea28067ff05a13b635ba31ec05...bc2d84ad2b60813a67d995c5582d696104a19383">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/download-artifact` from 5.0.0 to 6.0.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/download-artifact/releases">actions/download-artifact's
releases</a>.</em></p>
<blockquote>
<h2>v6.0.0</h2>
<h2>What's Changed</h2>
<p><strong>BREAKING CHANGE:</strong> this update supports Node
<code>v24.x</code>. This is not a breaking change per-se but we're
treating it as such.</p>
<ul>
<li>Update README for download-artifact v5 changes by <a
href="https://github.com/yacaovsnc"><code>@​yacaovsnc</code></a> in <a
href="https://redirect.github.com/actions/download-artifact/pull/417">actions/download-artifact#417</a></li>
<li>Update README with artifact extraction details by <a
href="https://github.com/yacaovsnc"><code>@​yacaovsnc</code></a> in <a
href="https://redirect.github.com/actions/download-artifact/pull/424">actions/download-artifact#424</a></li>
<li>Readme: spell out the first use of GHES by <a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/download-artifact/pull/431">actions/download-artifact#431</a></li>
<li>Bump <code>@actions/artifact</code> to <code>v4.0.0</code></li>
<li>Prepare <code>v6.0.0</code> by <a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/download-artifact/pull/438">actions/download-artifact#438</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/download-artifact/pull/431">actions/download-artifact#431</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/download-artifact/compare/v5...v6.0.0">https://github.com/actions/download-artifact/compare/v5...v6.0.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/download-artifact/commit/018cc2cf5baa6db3ef3c5f8a56943fffe632ef53"><code>018cc2c</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/download-artifact/issues/438">#438</a>
from actions/danwkennedy/prepare-6.0.0</li>
<li><a
href="https://github.com/actions/download-artifact/commit/815651c680ffe1c95719d0ed08aba1a2f9d5c177"><code>815651c</code></a>
Revert &quot;Remove <code>github.dep.yml</code>&quot;</li>
<li><a
href="https://github.com/actions/download-artifact/commit/bb3a066a8babc8ed7b3e4218896c548fe34e7115"><code>bb3a066</code></a>
Remove <code>github.dep.yml</code></li>
<li><a
href="https://github.com/actions/download-artifact/commit/fa1ce46bbd11b8387539af12741055a76dfdf804"><code>fa1ce46</code></a>
Prepare <code>v6.0.0</code></li>
<li><a
href="https://github.com/actions/download-artifact/commit/4a24838f3d5601fd639834081e118c2995d51e1c"><code>4a24838</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/download-artifact/issues/431">#431</a>
from danwkennedy/patch-1</li>
<li><a
href="https://github.com/actions/download-artifact/commit/5e3251c4ff5a32e4cf8dd4adaee0e692365237ae"><code>5e3251c</code></a>
Readme: spell out the first use of GHES</li>
<li><a
href="https://github.com/actions/download-artifact/commit/abefc31eafcfbdf6c5336127c1346fdae79ff41c"><code>abefc31</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/download-artifact/issues/424">#424</a>
from actions/yacaovsnc/update_readme</li>
<li><a
href="https://github.com/actions/download-artifact/commit/ac43a6070aa7db8a41e756e7a2846221edca7027"><code>ac43a60</code></a>
Update README with artifact extraction details</li>
<li><a
href="https://github.com/actions/download-artifact/commit/de96f4613b77ec03b5cf633e7c350c32bd3c5660"><code>de96f46</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/download-artifact/issues/417">#417</a>
from actions/yacaovsnc/update_readme</li>
<li><a
href="https://github.com/actions/download-artifact/commit/7993cb44e9052f2f08f9b828ae5ef3ecca7d2ac7"><code>7993cb4</code></a>
Remove migration guide for artifact download changes</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/download-artifact/compare/634f93cb2916e3fdff6788551b99b062d0335ce0...018cc2cf5baa6db3ef3c5f8a56943fffe632ef53">compare
view</a></li>
</ul>
</details>
<br />

Updates `tj-actions/changed-files` from
d03a93c0dbfac6d6dd6a0d8a5e7daff992b07449 to
dbf178ceecb9304128c8e0648591d71208c6e2c9
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/tj-actions/changed-files/blob/main/HISTORY.md">tj-actions/changed-files's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h1><a
href="https://github.com/tj-actions/changed-files/compare/v46.0.5...v47.0.0">47.0.0</a>
- (2025-09-13)</h1>
<h2><!-- raw HTML omitted -->🚀 Features</h2>
<ul>
<li>Add any_added to outputs (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2567">#2567</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/c260d49a827b5eb266673bed7871c5d3ee9b5aef">c260d49</a>)
- (Jellyfrog)</li>
</ul>
<h2><!-- raw HTML omitted -->➖ Remove</h2>
<ul>
<li>Commit and push step from build job (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2538">#2538</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/be393a90381e27c9fec2c8c2e02b00f005710145">be393a9</a>)
- (Tonye Jack)</li>
</ul>
<h2><!-- raw HTML omitted -->🔄 Update</h2>
<ul>
<li>Updated README.md (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2592">#2592</a>)</li>
</ul>
<p>Co-authored-by: github-actions[bot]
&lt;41898282+github-actions[bot]<a
href="https://github.com/users"><code>@​users</code></a>.noreply.github.com&gt;
(<a
href="https://github.com/tj-actions/changed-files/commit/3dbc1e181273d808ccff822a6e00cf18b6628ef0">3dbc1e1</a>)
- (github-actions[bot])</p>
<ul>
<li>Updated README.md (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2591">#2591</a>)</li>
</ul>
<p>Co-authored-by: github-actions[bot]
&lt;41898282+github-actions[bot]<a
href="https://github.com/users"><code>@​users</code></a>.noreply.github.com&gt;
(<a
href="https://github.com/tj-actions/changed-files/commit/b1ccff8c0892ad141d7d2de6f31e526a9dad931f">b1ccff8</a>)
- (github-actions[bot])</p>
<ul>
<li>Updated README.md (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2574">#2574</a>)</li>
</ul>
<p>Co-authored-by: github-actions[bot]
&lt;41898282+github-actions[bot]<a
href="https://github.com/users"><code>@​users</code></a>.noreply.github.com&gt;
(<a
href="https://github.com/tj-actions/changed-files/commit/050a3d3360d29711ee9d8210fc639d902d23ad07">050a3d3</a>)
- (github-actions[bot])</p>
<h2><!-- raw HTML omitted -->📚 Documentation</h2>
<ul>
<li>Update link to glob patterns (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2590">#2590</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/a892f50f7a7187bc288633c09230b09ce7ad8fd0">a892f50</a>)
- (Tonye Jack)</li>
<li>Add Jellyfrog as a contributor for code, and doc (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2573">#2573</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/f000a9b97f254f9590ff26f651cccde827ad36da">f000a9b</a>)
- (allcontributors[bot])</li>
</ul>
<h2><!-- raw HTML omitted -->🧪 Testing</h2>
<ul>
<li>Manual triggered workflows (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2637">#2637</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/c2ca2493190021783138cb8aac49bcee14b4bb89">c2ca249</a>)
- (Tonye Jack)</li>
</ul>
<h2><!-- raw HTML omitted -->⚙️ Miscellaneous Tasks</h2>
<ul>
<li><strong>deps-dev:</strong> Bump jest from 30.0.5 to 30.1.3 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2655">#2655</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/9a6755550a331fdcc8ec45443738933f8fa22eea">9a67555</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump tj-actions/git-cliff from 2.1.0 to 2.2.0
(<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2660">#2660</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/b67e30df88f43e244f4e83775e5ad8335114fb95">b67e30d</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump github/codeql-action from 3.30.2 to
3.30.3 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2661">#2661</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/62aef422ffa195474d80d73387535cf4622b2824">62aef42</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump github/codeql-action from 3.29.11 to
3.30.2 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2659">#2659</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/e874f3cddd0f54ae776e6995ae6dae4cf40fd3d3">e874f3c</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump actions/setup-node from 4.4.0 to 5.0.0
(<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2656">#2656</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/8c14441336bb3d84fd6b7fa83b6d7201c740baf5">8c14441</a>)
- (dependabot[bot])</li>
<li><strong>deps-dev:</strong> Bump <code>@​types/node</code> from
24.3.0 to 24.3.1 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2657">#2657</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/e995ac4be5be2bcb6e29556edc51fb63aca6b49b">e995ac4</a>)
- (dependabot[bot])</li>
<li><strong>deps-dev:</strong> Bump <code>@​types/node</code> from
24.2.1 to 24.3.0 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2649">#2649</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/3b04099b21072562f07469c10deb182b24236ca9">3b04099</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump github/codeql-action from 3.29.9 to
3.29.11 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2651">#2651</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/e7b6c977e51984988e3cc1d6b18abe2a3ba8daaa">e7b6c97</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump tj-actions/git-cliff from 2.0.2 to 2.1.0
(<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2648">#2648</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/765d62bc041415a5b494ef13d02d566128b25973">765d62b</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump github/codeql-action from 3.29.8 to
3.29.9 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2647">#2647</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/2036da178f85576f1940fedb74bb93a36cd89ab7">2036da1</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump github/codeql-action from 3.29.7 to
3.29.8 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2644">#2644</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/239aef84a5502c79a1cea96e495d17588c66c659">239aef8</a>)
- (dependabot[bot])</li>
<li><strong>deps-dev:</strong> Bump <code>@​types/node</code> from
24.2.0 to 24.2.1 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2645">#2645</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/a7d5f5f4919b6dbc6d3a3689887964361e8dd88f">a7d5f5f</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump actions/checkout from 4.2.2 to 5.0.0 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2646">#2646</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/5107f3abcc0c3737db51e2949f181e2c197d4d5b">5107f3a</a>)
- (dependabot[bot])</li>
<li><strong>deps-dev:</strong> Bump <code>@​types/node</code> from
24.1.0 to 24.2.0 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2640">#2640</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/f963b3f3562b00b6d2dd25efc390eb04e51ef6c6">f963b3f</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump actions/download-artifact from 4.3.0 to
5.0.0 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2641">#2641</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/f956744105e18d78bba3844a1199ce43d6503017">f956744</a>)
- (dependabot[bot])</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/tj-actions/changed-files/commit/dbf178ceecb9304128c8e0648591d71208c6e2c9"><code>dbf178c</code></a>
chore(deps): bump actions/setup-node from 5.0.0 to 6.0.0 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2690">#2690</a>)</li>
<li><a
href="https://github.com/tj-actions/changed-files/commit/19002623031eba72900680c5deed5ee6333dbc12"><code>1900262</code></a>
chore(deps): bump github/codeql-action from 3.30.6 to 4.30.9 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2693">#2693</a>)</li>
<li><a
href="https://github.com/tj-actions/changed-files/commit/27e5d78f9b6a61e3160a2fe263cca91675c08fa0"><code>27e5d78</code></a>
chore(deps-dev): bump <code>@​types/node</code> from 24.6.2 to 24.9.1
(<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2695">#2695</a>)</li>
<li>See full diff in <a
href="https://github.com/tj-actions/changed-files/compare/d03a93c0dbfac6d6dd6a0d8a5e7daff992b07449...dbf178ceecb9304128c8e0648591d71208c6e2c9">compare
view</a></li>
</ul>
</details>
<br />

Updates `nixbuild/nix-quick-install-action` from 33 to 34
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/nixbuild/nix-quick-install-action/releases">nixbuild/nix-quick-install-action's
releases</a>.</em></p>
<blockquote>
<h2>nixbuild/nix-quick-install-action@v34</h2>
<h2>Changes</h2>
<ul>
<li>
<p>Update Nix versions: 2.31.0 -&gt; 2.31.2, 2.30.0 -&gt; 2.30.3, 2.29.1
-&gt; 2.29.2, 2.28.4 -&gt; 2.28.5.</p>
</li>
<li>
<p>Bump default Nix version: 2.29.1 -&gt; 2.29.2</p>
</li>
</ul>
<h2>Supported Nix Versions on x86_64-linux runners</h2>
<ul>
<li>2.31.2</li>
<li>2.30.3</li>
<li>2.29.2</li>
<li>2.28.5</li>
<li>2.26.4</li>
<li>2.24.15</li>
<li>2.3.18</li>
</ul>
<h2>Supported Nix Versions on aarch64-linux runners</h2>
<ul>
<li>2.31.2</li>
<li>2.30.3</li>
<li>2.29.2</li>
<li>2.28.5</li>
<li>2.26.4</li>
<li>2.24.15</li>
</ul>
<h2>Supported Nix Versions on x86_64-darwin runners</h2>
<ul>
<li>2.31.2</li>
<li>2.30.3</li>
<li>2.29.2</li>
<li>2.28.5</li>
<li>2.26.4</li>
<li>2.24.15</li>
<li>2.3.18</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/nixbuild/nix-quick-install-action/blob/master/RELEASE">nixbuild/nix-quick-install-action's
changelog</a>.</em></p>
<blockquote>
<p>v34</p>
<h2>Changes</h2>
<ul>
<li>
<p>Update Nix versions: 2.31.0 -&gt; 2.31.2, 2.30.0 -&gt; 2.30.3, 2.29.1
-&gt; 2.29.2, 2.28.4 -&gt; 2.28.5.</p>
</li>
<li>
<p>Bump default Nix version: 2.29.1 -&gt; 2.29.2</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/nixbuild/nix-quick-install-action/commit/2c9db80fb984ceb1bcaa77cdda3fdf8cfba92035"><code>2c9db80</code></a>
Release v34</li>
<li><a
href="https://github.com/nixbuild/nix-quick-install-action/commit/6dd8039259767bef94d598f79b506a92ee991ff8"><code>6dd8039</code></a>
ci: Fix versions</li>
<li><a
href="https://github.com/nixbuild/nix-quick-install-action/commit/a7214c23df4e59da80e6e71503e1f766444fb1e2"><code>a7214c2</code></a>
Fix default version</li>
<li><a
href="https://github.com/nixbuild/nix-quick-install-action/commit/efda085bcade238a03bdbd41f224f08d4ef362e9"><code>efda085</code></a>
Bump Nix versions</li>
<li><a
href="https://github.com/nixbuild/nix-quick-install-action/commit/b644e5e09df2afc194ad86b2a8467b701d15c606"><code>b644e5e</code></a>
Update README and workflows for v33</li>
<li>See full diff in <a
href="https://github.com/nixbuild/nix-quick-install-action/compare/1f095fee853b33114486cfdeae62fa099cda35a9...2c9db80fb984ceb1bcaa77cdda3fdf8cfba92035">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action` from 4.30.9 to 4.31.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.31.0</h2>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>4.31.0 - 24 Oct 2025</h2>
<ul>
<li>Bump minimum CodeQL bundle version to 2.17.6. <a
href="https://redirect.github.com/github/codeql-action/pull/3223">#3223</a></li>
<li>When SARIF files are uploaded by the <code>analyze</code> or
<code>upload-sarif</code> actions, the CodeQL Action automatically
performs post-processing steps to prepare the data for the upload.
Previously, these post-processing steps were only performed before an
upload took place. We are now changing this so that the post-processing
steps will always be performed, even when the SARIF files are not
uploaded. This does not change anything for the
<code>upload-sarif</code> action. For <code>analyze</code>, this may
affect Advanced Setup for CodeQL users who specify a value other than
<code>always</code> for the <code>upload</code> input. <a
href="https://redirect.github.com/github/codeql-action/pull/3222">#3222</a></li>
</ul>
<p>See the full <a
href="https://github.com/github/codeql-action/blob/v4.31.0/CHANGELOG.md">CHANGELOG.md</a>
for more information.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.31.0 - 24 Oct 2025</h2>
<ul>
<li>Bump minimum CodeQL bundle version to 2.17.6. <a
href="https://redirect.github.com/github/codeql-action/pull/3223">#3223</a></li>
<li>When SARIF files are uploaded by the <code>analyze</code> or
<code>upload-sarif</code> actions, the CodeQL Action automatically
performs post-processing steps to prepare the data for the upload.
Previously, these post-processing steps were only performed before an
upload took place. We are now changing this so that the post-processing
steps will always be performed, even when the SARIF files are not
uploaded. This does not change anything for the
<code>upload-sarif</code> action. For <code>analyze</code>, this may
affect Advanced Setup for CodeQL users who specify a value other than
<code>always</code> for the <code>upload</code> input. <a
href="https://redirect.github.com/github/codeql-action/pull/3222">#3222</a></li>
</ul>
<h2>4.30.9 - 17 Oct 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.23.3. <a
href="https://redirect.github.com/github/codeql-action/pull/3205">#3205</a></li>
<li>Experimental: A new <code>setup-codeql</code> action has been added
which is similar to <code>init</code>, except it only installs the
CodeQL CLI and does not initialize a database. Do not use this in
production as it is part of an internal experiment and subject to change
at any time. <a
href="https://redirect.github.com/github/codeql-action/pull/3204">#3204</a></li>
</ul>
<h2>4.30.8 - 10 Oct 2025</h2>
<p>No user facing changes.</p>
<h2>4.30.7 - 06 Oct 2025</h2>
<ul>
<li>[v4+ only] The CodeQL Action now runs on Node.js v24. <a
href="https://redirect.github.com/github/codeql-action/pull/3169">#3169</a></li>
</ul>
<h2>3.30.6 - 02 Oct 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.23.2. <a
href="https://redirect.github.com/github/codeql-action/pull/3168">#3168</a></li>
</ul>
<h2>3.30.5 - 26 Sep 2025</h2>
<ul>
<li>We fixed a bug that was introduced in <code>3.30.4</code> with
<code>upload-sarif</code> which resulted in files without a
<code>.sarif</code> extension not getting uploaded. <a
href="https://redirect.github.com/github/codeql-action/pull/3160">#3160</a></li>
</ul>
<h2>3.30.4 - 25 Sep 2025</h2>
<ul>
<li>We have improved the CodeQL Action's ability to validate that the
workflow it is used in does not use different versions of the CodeQL
Action for different workflow steps. Mixing different versions of the
CodeQL Action in the same workflow is unsupported and can lead to
unpredictable results. A warning will now be emitted from the
<code>codeql-action/init</code> step if different versions of the CodeQL
Action are detected in the workflow file. Additionally, an error will
now be thrown by the other CodeQL Action steps if they load a
configuration file that was generated by a different version of the
<code>codeql-action/init</code> step. <a
href="https://redirect.github.com/github/codeql-action/pull/3099">#3099</a>
and <a
href="https://redirect.github.com/github/codeql-action/pull/3100">#3100</a></li>
<li>We added support for reducing the size of dependency caches for Java
analyses, which will reduce cache usage and speed up workflows. This
will be enabled automatically at a later time. <a
href="https://redirect.github.com/github/codeql-action/pull/3107">#3107</a></li>
<li>You can now run the latest CodeQL nightly bundle by passing
<code>tools: nightly</code> to the <code>init</code> action. In general,
the nightly bundle is unstable and we only recommend running it when
directed by GitHub staff. <a
href="https://redirect.github.com/github/codeql-action/pull/3130">#3130</a></li>
<li>Update default CodeQL bundle version to 2.23.1. <a
href="https://redirect.github.com/github/codeql-action/pull/3118">#3118</a></li>
</ul>
<h2>3.30.3 - 10 Sep 2025</h2>
<p>No user facing changes.</p>
<h2>3.30.2 - 09 Sep 2025</h2>
<ul>
<li>Fixed a bug which could cause language autodetection to fail. <a
href="https://redirect.github.com/github/codeql-action/pull/3084">#3084</a></li>
<li>Experimental: The <code>quality-queries</code> input that was added
in <code>3.29.2</code> as part of an internal experiment is now
deprecated and will be removed in an upcoming version of the CodeQL
Action. It has been superseded by a new <code>analysis-kinds</code>
input, which is part of the same internal experiment. Do not use this in
production as it is subject to change at any time. <a
href="https://redirect.github.com/github/codeql-action/pull/3064">#3064</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/4e94bd11f71e507f7f87df81788dff88d1dacbfb"><code>4e94bd1</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3235">#3235</a>
from github/update-v4.31.0-1d36546c1</li>
<li><a
href="https://github.com/github/codeql-action/commit/8f11182164f2181cc5608a575e3c7ef3bc4a9cd1"><code>8f11182</code></a>
Update changelog for v4.31.0</li>
<li><a
href="https://github.com/github/codeql-action/commit/1d36546c1419dc613cdb4b7fde46b1c81643ccbe"><code>1d36546</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3234">#3234</a>
from github/mbg/changelog/post-processing</li>
<li><a
href="https://github.com/github/codeql-action/commit/08ada26e6a4768939d6da6a5e23ae69052948fd7"><code>08ada26</code></a>
Add changelog entry for post-processing change</li>
<li><a
href="https://github.com/github/codeql-action/commit/b843cbeed03550ed4937992fa96258262e955178"><code>b843cbe</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3233">#3233</a>
from github/mbg/getOptionalEnvVar</li>
<li><a
href="https://github.com/github/codeql-action/commit/1ecd56391940567d00fd07e34b4ca7b75dadd92a"><code>1ecd563</code></a>
Use <code>getOptionalEnvVar</code> in
<code>writePostProcessedFiles</code></li>
<li><a
href="https://github.com/github/codeql-action/commit/e57680792076a32e6f147ccf58374517ea645a31"><code>e576807</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3223">#3223</a>
from github/henrymercer/bump-minimum</li>
<li><a
href="https://github.com/github/codeql-action/commit/ad3567666919ea4249d02a26c230ea8e0daef410"><code>ad35676</code></a>
Add <code>getOptionalEnvVar</code> function</li>
<li><a
href="https://github.com/github/codeql-action/commit/d75645b13f453e29a7f3c3f316babb725e644d0a"><code>d75645b</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3222">#3222</a>
from github/mbg/upload-lib/post-process</li>
<li><a
href="https://github.com/github/codeql-action/commit/710606cc35e2444ba84bdf7702dcb481f7380ae7"><code>710606c</code></a>
Check that <code>outputPath</code> is non-empty</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/16140ae1a102900babc80a33c44059580f687047...4e94bd11f71e507f7f87df81788dff88d1dacbfb">compare
view</a></li>
</ul>
</details>
<br />

Updates `Mattraks/delete-workflow-runs` from 2.0.6 to 2.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/mattraks/delete-workflow-runs/releases">Mattraks/delete-workflow-runs's
releases</a>.</em></p>
<blockquote>
<h2>v2.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update README.md with contents: read permission by <a
href="https://github.com/jonaslindstr"><code>@​jonaslindstr</code></a>
in <a
href="https://redirect.github.com/Mattraks/delete-workflow-runs/pull/19">Mattraks/delete-workflow-runs#19</a></li>
<li>Deletes workflow runs that do not have an existing workflow by <a
href="https://github.com/watercable76"><code>@​watercable76</code></a>
in <a
href="https://redirect.github.com/Mattraks/delete-workflow-runs/pull/20">Mattraks/delete-workflow-runs#20</a></li>
<li>Quick note about GHE <code>baseUrl</code> config by <a
href="https://github.com/kquinsland"><code>@​kquinsland</code></a> in <a
href="https://redirect.github.com/Mattraks/delete-workflow-runs/pull/32">Mattraks/delete-workflow-runs#32</a></li>
<li>Added try/catch blocks to catch each error individually by <a
href="https://github.com/marcelovani"><code>@​marcelovani</code></a> in
<a
href="https://redirect.github.com/Mattraks/delete-workflow-runs/pull/35">Mattraks/delete-workflow-runs#35</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/jonaslindstr"><code>@​jonaslindstr</code></a>
made their first contribution in <a
href="https://redirect.github.com/Mattraks/delete-workflow-runs/pull/19">Mattraks/delete-workflow-runs#19</a></li>
<li><a
href="https://github.com/watercable76"><code>@​watercable76</code></a>
made their first contribution in <a
href="https://redirect.github.com/Mattraks/delete-workflow-runs/pull/20">Mattraks/delete-workflow-runs#20</a></li>
<li><a
href="https://github.com/kquinsland"><code>@​kquinsland</code></a> made
their first contribution in <a
href="https://redirect.github.com/Mattraks/delete-workflow-runs/pull/32">Mattraks/delete-workflow-runs#32</a></li>
<li><a
href="https://github.com/marcelovani"><code>@​marcelovani</code></a>
made their first contribution in <a
href="https://redirect.github.com/Mattraks/delete-workflow-runs/pull/35">Mattraks/delete-workflow-runs#35</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Mattraks/delete-workflow-runs/compare/v2.0.6...v2.1.0">https://github.com/Mattraks/delete-workflow-runs/compare/v2.0.6...v2.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/Mattraks/delete-workflow-runs/commit/ab482449ba468316e9a8801e092d0405715c5e6d"><code>ab48244</code></a>
version v2.1.0</li>
<li><a
href="https://github.com/Mattraks/delete-workflow-runs/commit/feeb82053ea847a97fe4ee2aa314c94eac0eff04"><code>feeb820</code></a>
Undo previous changes.</li>
<li><a
href="https://github.com/Mattraks/delete-workflow-runs/commit/c61e04ec70740b989bdb168af9c948f2172856d8"><code>c61e04e</code></a>
Added another try/catch block</li>
<li><a
href="https://github.com/Mattraks/delete-workflow-runs/commit/f93a693640fbced9f6b9026397406572c0dddcec"><code>f93a693</code></a>
Added another try/catch block</li>
<li><a
href="https://github.com/Mattraks/delete-workflow-runs/commit/f40e9cd01093f8470cb92e70a971329a1c6b5ca1"><code>f40e9cd</code></a>
Removed condition that is limiting deletion</li>
<li><a
href="https://github.com/Mattraks/delete-workflow-runs/commit/0a28a6b9d4f62e5b211056ceead85cc6776403eb"><code>0a28a6b</code></a>
Display debug messages</li>
<li><a
href="https://github.com/Mattraks/delete-workflow-runs/commit/cb572387c439bdadffcac5fdba1f5fae3374309f"><code>cb57238</code></a>
Display all workflows</li>
<li><a
href="https://github.com/Mattraks/delete-workflow-runs/commit/8859caa93697386bdb136521cca778eb9427e800"><code>8859caa</code></a>
Quick note about GHE <code>baseUrl</code> config</li>
<li><a
href="https://github.com/Mattraks/delete-workflow-runs/commit/4c9f24749b7996562658e3d6e10662489e22caca"><code>4c9f247</code></a>
Added better check to verify runs to be deleted, and some logging</li>
<li><a
href="https://github.com/Mattraks/delete-workflow-runs/commit/20682956720600a468c346b81c1965bfc2312d70"><code>2068295</code></a>
Deletes workflow runs that do not have an existing workflow</li>
<li>Additional commits viewable in <a
href="https://github.com/mattraks/delete-workflow-runs/compare/39f0bbed25d76b34de5594dceab824811479e5de...ab482449ba468316e9a8801e092d0405715c5e6d">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2025-10-27 12:25:24 +00:00
dependabot[bot] dd92fbc83c chore: bump google.golang.org/api from 0.252.0 to 0.253.0 (#20497) 
Bumps
[google.golang.org/api](https://github.com/googleapis/google-api-go-client)
from 0.252.0 to 0.253.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's
releases</a>.</em></p>
<blockquote>
<h2>v0.253.0</h2>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.252.0...v0.253.0">0.253.0</a>
(2025-10-22)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3337">#3337</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/40f2752ec3e2075ceada92b8dcc3f6b2e465bb8d">40f2752</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3339">#3339</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/d1ef9766c46dcf687ee1711cc921b8162af47275">d1ef976</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3340">#3340</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/580c65f00246810dadf22d103614c9dbaaaf93af">580c65f</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3341">#3341</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/9d031c42291eef4e164462c979beafb7b2133155">9d031c4</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3342">#3342</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/ca2b9ad85a1e1889fbed2c33f3e1e6cd7dac014b">ca2b9ad</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3344">#3344</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/844753e402286005aa20ad8defb7eece1d4aea0c">844753e</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3345">#3345</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/3de8a5b1f08d0b14773636ed984e9f4c62d097cc">3de8a5b</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3346">#3346</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/a590b9a89840c418a5dd1a426ef91ab740ac536e">a590b9a</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3347">#3347</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/40ca8fedda58c6b2f68a0e8b5be325628f4a0c09">40ca8fe</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.252.0...v0.253.0">0.253.0</a>
(2025-10-22)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3337">#3337</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/40f2752ec3e2075ceada92b8dcc3f6b2e465bb8d">40f2752</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3339">#3339</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/d1ef9766c46dcf687ee1711cc921b8162af47275">d1ef976</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3340">#3340</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/580c65f00246810dadf22d103614c9dbaaaf93af">580c65f</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3341">#3341</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/9d031c42291eef4e164462c979beafb7b2133155">9d031c4</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3342">#3342</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/ca2b9ad85a1e1889fbed2c33f3e1e6cd7dac014b">ca2b9ad</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3344">#3344</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/844753e402286005aa20ad8defb7eece1d4aea0c">844753e</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3345">#3345</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/3de8a5b1f08d0b14773636ed984e9f4c62d097cc">3de8a5b</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3346">#3346</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/a590b9a89840c418a5dd1a426ef91ab740ac536e">a590b9a</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3347">#3347</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/40ca8fedda58c6b2f68a0e8b5be325628f4a0c09">40ca8fe</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/bf0e302fbeb1339d0ee44171a3db421fe4a50eb2"><code>bf0e302</code></a>
chore(main): release 0.253.0 (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3338">#3338</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/40ca8fedda58c6b2f68a0e8b5be325628f4a0c09"><code>40ca8fe</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3347">#3347</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/a590b9a89840c418a5dd1a426ef91ab740ac536e"><code>a590b9a</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3346">#3346</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/3de8a5b1f08d0b14773636ed984e9f4c62d097cc"><code>3de8a5b</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3345">#3345</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/8012a7b9bfe04c4089d1f7f3fac4f553221f3067"><code>8012a7b</code></a>
chore(all): update all (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3343">#3343</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/844753e402286005aa20ad8defb7eece1d4aea0c"><code>844753e</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3344">#3344</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/ca2b9ad85a1e1889fbed2c33f3e1e6cd7dac014b"><code>ca2b9ad</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3342">#3342</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/9d031c42291eef4e164462c979beafb7b2133155"><code>9d031c4</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3341">#3341</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/580c65f00246810dadf22d103614c9dbaaaf93af"><code>580c65f</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3340">#3340</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/d1ef9766c46dcf687ee1711cc921b8162af47275"><code>d1ef976</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3339">#3339</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/googleapis/google-api-go-client/compare/v0.252.0...v0.253.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/api&package-manager=go_modules&previous-version=0.252.0&new-version=0.253.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2025-10-27 12:21:34 +00:00
dependabot[bot] 10d2844cce chore: bump github.com/valyala/fasthttp from 1.67.0 to 1.68.0 (#20496) 
Bumps [github.com/valyala/fasthttp](https://github.com/valyala/fasthttp)
from 1.67.0 to 1.68.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/valyala/fasthttp/releases">github.com/valyala/fasthttp's
releases</a>.</em></p>
<blockquote>
<h2>v1.68.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix named return bugs by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://github.com/valyala/fasthttp/commit/1b8c5593da699309522dee00ad1d6c913482a0f3">https://github.com/valyala/fasthttp/commit/1b8c5593da699309522dee00ad1d6c913482a0f3</a></li>
<li>chore(deps): bump golang.org/x/sys from 0.36.0 to 0.37.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2087">valyala/fasthttp#2087</a></li>
<li>chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.43.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2086">valyala/fasthttp#2086</a></li>
<li>chore(deps): bump golang.org/x/net from 0.45.0 to 0.46.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2085">valyala/fasthttp#2085</a></li>
<li>chore(deps): bump securego/gosec from 2.22.9 to 2.22.10 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2088">valyala/fasthttp#2088</a></li>
<li>chore(deps): bump github.com/klauspost/compress from 1.18.0 to
1.18.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2089">valyala/fasthttp#2089</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/valyala/fasthttp/compare/v1.67.0...v1.68.0">https://github.com/valyala/fasthttp/compare/v1.67.0...v1.68.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/valyala/fasthttp/commit/1b8c5593da699309522dee00ad1d6c913482a0f3"><code>1b8c559</code></a>
Fix named return bugs</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/9ca62939848ed5b186d9b1a696c9de3d76e037ce"><code>9ca6293</code></a>
chore(deps): bump github.com/klauspost/compress from 1.18.0 to 1.18.1
(<a
href="https://redirect.github.com/valyala/fasthttp/issues/2089">#2089</a>)</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/77468f66c6618d8ca3d5d183d1aaf55cc5395f2c"><code>77468f6</code></a>
chore(deps): bump securego/gosec from 2.22.9 to 2.22.10 (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2088">#2088</a>)</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/3a2fdec290176325d5432245facf04ef25674f46"><code>3a2fdec</code></a>
chore(deps): bump golang.org/x/net from 0.45.0 to 0.46.0 (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2085">#2085</a>)</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/59f58c07bec79a5eb65928defdf37ec247504e65"><code>59f58c0</code></a>
chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.43.0 (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2086">#2086</a>)</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/dbfb82aabe6074ab83033941103f890ae09dabbd"><code>dbfb82a</code></a>
chore(deps): bump golang.org/x/sys from 0.36.0 to 0.37.0 (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2087">#2087</a>)</li>
<li>See full diff in <a
href="https://github.com/valyala/fasthttp/compare/v1.67.0...v1.68.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/valyala/fasthttp&package-manager=go_modules&previous-version=1.67.0&new-version=1.68.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2025-10-27 12:14:51 +00:00
dependabot[bot] 277b2d21ca chore: bump github.com/gohugoio/hugo from 0.151.2 to 0.152.2 (#20495) 
Bumps [github.com/gohugoio/hugo](https://github.com/gohugoio/hugo) from
0.151.2 to 0.152.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/gohugoio/hugo/releases">github.com/gohugoio/hugo's
releases</a>.</em></p>
<blockquote>
<h2>v0.152.2</h2>
<p>In <code>v0.152.0</code> we tightened the source validation for <a
href="https://gohugo.io/configuration/module/#mounts">file mounts</a>.
We always said that <em>project mounts can mount with absolute
file/directorynames, modules/themes are restricted to relative</em>. In
<code>v0.152.0</code> we narrowed module/themes mounts to be local,
which made the setup in the bug report listed below fail:</p>
<pre lang="toml"><code>[[module.mounts]]
source = '../../node_modules/bootstrap'
target = 'assets/vendor/bootstrap'
</code></pre>
<p>One part of this is security. But the construct above is
<em>usually</em> very odd (the project uses files in a theme/module, not
the other way around) and not very portable. But the example above
demonstrates a valid exception, that we now have added support for in a
portable way. The above example now works as it did before
<code>v0.152.0</code>, but going forward you can also write:</p>
<pre lang="toml"><code>[[module.mounts]]
source = 'node_modules/bootstrap'
target = 'assets/vendor/bootstrap'
</code></pre>
<p>We now have the <code>node_modules</code> as a special case: For
themes/modules we first check if the mounted source exists locally, if
not we try relative to the project root.</p>
<h2>What's Changed</h2>
<ul>
<li>deps: Update github.com/tdewolff/minify v2.24.4 =&gt; v2.24.5
1c8c21e45 <a
href="https://github.com/jmooring"><code>@​jmooring</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14086">#14086</a></li>
<li>hugofs: Make node_modules a &quot;special case&quot; mount 809ebe01f
<a href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14089">#14089</a></li>
<li>github: Fix typo in stale PR message 08a0679a8 <a
href="https://github.com/jordelver"><code>@​jordelver</code></a></li>
</ul>
<h2>v0.152.1</h2>
<p>These fixes are are all related to the YAML library upgrade in <a
href="https://github.com/gohugoio/hugo/releases/tag/v0.152.0">v0.152.0</a>.</p>
<ul>
<li>Expand the numeric conversions to template funcs/methods e08278d16
<a href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14079">#14079</a></li>
<li>Fix where with uint64 df4f80d54 <a
href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14081">#14081</a></li>
<li>Fix it so YAML integer types can be used where Go int types are
expected d4c78885a <a
href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14079">#14079</a></li>
<li>tpl/compare: Fix compare/sort of uint64s 29e2c2fa9 <a
href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14078">#14078</a></li>
<li>Fix &quot;assignment to entry in nil map&quot; on empty YAML config
files 0579afc3c <a href="https://github.com/bep"><code>@​bep</code></a>
<a
href="https://redirect.github.com/gohugoio/hugo/issues/14074">#14074</a></li>
</ul>
<h2>v0.152.0</h2>
<p>The big new thing and the motivation behind this release is the
upgrade to a more modern YAML library in <a
href="https://github.com/goccy"><code>@​goccy</code></a> 's <a
href="https://github.com/goccy/go-yaml">github.com/goccy/go-yaml</a>.
It's been a surprisingly long and winding road to get here. <strong>Note
that this upgrade comes with some minor breaking changes, most notably
that the old YAML 1.1 spec listed a set of strings that, when unquoted,
were treated as boolean <code>true</code> or
<code>false</code>.</strong> So if you're using any of the values in the
table below as booleans, you need to adjust your YAML, but I suspect
that fixing this very surprising behavior will fix more issues than it
introduces. A big new thing with this new YAML library is the support
for <a
href="https://www.linode.com/docs/guides/yaml-anchors-aliases-overrides-extensions/">YAML
anchors and aliases</a> which helps to reduce duplication in e.g. your
configuration. There are some examples in Hugo's <a
href="https://github.com/gohugoio/hugo/blob/master/hugoreleaser.yaml">release
build configuration</a> and in the <a
href="https://github.com/gohugoio/hugo/blob/master/.circleci/config.yml">Hugo's
CI release setup</a>.</p>
<table>
<thead>
<tr>
<th align="left">Values</th>
<th align="left">Old meaning</th>
<th align="left">New meaning</th>
</tr>
</thead>
<tbody>
<tr>
<td align="left"><code>yes</code>, <code>Yes</code>, <code>YES</code>,
<code>y</code>, <code>Y</code>, <code>on</code>, <code>On</code>,
<code>ON</code></td>
<td align="left"><code>true</code> (bool)</td>
<td align="left"><code>yes</code>, <code>Yes</code>, <code>YES</code>,
<code>y</code>, <code>Y</code>, <code>on</code>, <code>On</code>,
<code>ON</code> (string)</td>
</tr>
<tr>
<td align="left"><code>no</code>, <code>No</code>, <code>NO</code>,
<code>n</code>, <code>N</code>, <code>off</code>, <code>Off</code>,
<code>OFF</code></td>
<td align="left"><code>false</code> (bool)</td>
<td align="left"><code>no</code>, <code>No</code>, <code>NO</code>,
<code>n</code>, <code>N</code>, <code>off</code>, <code>Off</code>,
<code>OFF</code> (string)</td>
</tr>
</tbody>
</table>
<h2>Note</h2>
<ul>
<li>Replace to gopkg.in/yaml with github.com/goccy/go-yaml (note)
a3d954846 <a href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/8822">#8822</a>
<a
href="https://redirect.github.com/gohugoio/hugo/issues/13043">#13043</a>
<a
href="https://redirect.github.com/gohugoio/hugo/issues/14053">#14053</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/gohugoio/hugo/commit/6abdacad3f3fe944ea42177844469139e81feda6"><code>6abdaca</code></a>
releaser: Bump versions for release of 0.152.2</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/1c8c21e45eb7d87c1038b3f3b9ea87b82a11c867"><code>1c8c21e</code></a>
deps: Update github.com/tdewolff/minify v2.24.4 =&gt; v2.24.5</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/809ebe01fa954a44a48c265f0c9a4e4845b9a0f8"><code>809ebe0</code></a>
hugofs: Make node_modules a &quot;special case&quot; mount</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/08a0679a895678b38f1324ae78503fd32ec22996"><code>08a0679</code></a>
github: Fix typo in stale PR message</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/524b98665b64f206f14879ffe29c64f413592a2f"><code>524b986</code></a>
releaser: Prepare repository for 0.153.0-DEV</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/5869cbddd88590563c2b7b400e804ccc7d2cb697"><code>5869cbd</code></a>
releaser: Bump versions for release of 0.152.1</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/e08278d165399bd2d7d7331d966129a2faa268b2"><code>e08278d</code></a>
Expand the numeric conversions to template funcs/methods</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/df4f80d54f389407d935a0388707be2bf888d882"><code>df4f80d</code></a>
Fix where with uint64</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/d4c78885ae4cb7c488ea2ed399aa57f0861f44cb"><code>d4c7888</code></a>
Fix it so YAML integer types can be used where Go int types are
expected</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/29e2c2fa92b10c1250376913558448e838e390fe"><code>29e2c2f</code></a>
tpl/compare: Fix compare/sort of uint64s</li>
<li>Additional commits viewable in <a
href="https://github.com/gohugoio/hugo/compare/v0.151.2...v0.152.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/gohugoio/hugo&package-manager=go_modules&previous-version=0.151.2&new-version=0.152.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2025-10-27 12:08:59 +00:00