coder

mirror of https://github.com/coder/coder.git synced 2026-09-22 05:05:20 +08:00

Author	SHA1	Message	Date
Matt VollmerandNick Vigilante	75e0790cd7	docs: remove beta references from Coder Agents docs and manifest (#27939 ) Removes all references to "beta" from the Coder Agents documentation under `docs/ai-coder/agents/` and the corresponding `"state": ["beta"]` entries in `docs/manifest.json`. Also updates screenshots, video, and hero image, and regenerates the auto-generated feature-stages table. Beta reference removal: - `getting-started.md`: Removed "Coder Agents is in Beta" from the top note, "is in beta" from the Chats API note, and "during Beta" from the feedback section. Removed the version/stability note pinning 2.33.1. - `index.md`: Removed the "Product status" section that stated Coder Agents is in Beta. - `manifest.json`: Removed `"state": ["beta"]` from 17 entries for pages under `docs/ai-coder/agents/`. Preserved all `premium` and `early access` states. - `feature-stages.md`: Regenerated the auto-generated beta features table, which no longer lists Coder Agents. Asset updates: - `coder-agents-ui.mp4`: Updated demo video on the agents landing page. - `llm-providers.png`: Updated LLM provider support screenshot. - `models-list.png`: Updated models list screenshot. - `models-add-model.png`: Updated add model form screenshot. - `agents-hero-image.png`: Updated hero image on the `docs/ai-coder` landing page. Two references in `models.md` (`v1beta` in the Google Gemini API URL and `anthropic-beta` in the Anthropic header name) were left unchanged as they are provider API identifiers, not product status labels. PR generated with Coder Agents --------- Co-authored-by: Nick Vigilante <nickvigilante@users.noreply.github.com>	2026-08-11 08:57:57 -04:00
Hugo Dutka	7f75e625cc	fix(coderd/x/chatd): deflake TestRunner_StartsRealInterruptTask (#28024 ) Closes [ENG-2869](https://linear.app/codercom/issue/ENG-2869/flake-testpostchatmessagesbusyinterrupt). The test used to assert a transient chat state, so I got rid of that assertion. There was also a related race in `interruptChat` where the test pubsub message buffer could be cleared after a runner posted the pubsub message that tests look for.	2026-08-11 12:56:06 +00:00
Michael Suchacz	57f38b5c24	fix: keep chat attachments while a linking chat exists Fixes https://linear.app/codercom/issue/CODAGT-616/keep-chat-attachments-while-chats-remain-unarchived Chat attachments could disappear even though the chat was still available. This happened when a message was saved without recording which attachments it used, or when cleanup deleted attachments before an archived chat itself was removed. Creating a chat, sending or queuing a message, and editing a message now record both the message and which attachments it uses as one operation. If the chat is already at the 50-attachment limit, the chat change fails without being partially saved. Concurrent attachment writes serialize the 50-file cap per chat. Cleanup locks candidates and checks again for new links before deleting. If a file becomes unavailable after input validation, create, send, and edit return a clear client error and roll back the chat change. An attachment stays available while any chat that uses it still exists. After an archived chat reaches the end of its retention period and is deleted, an old attachment that no remaining chat uses can be cleaned up. The retention guide and unavailable-attachment UI text document this lifecycle. This change cannot restore attachments that were already deleted. The database migration adds two indexes so attachment cleanup stays fast as attachments accumulate. > This PR was authored by Mux (AI) on Mike's behalf.	2026-08-11 13:53:15 +02:00
dependabot[bot]	72ad835330	ci: bump the github-actions group with 10 updates (#28021 ) Bumps the github-actions group with 10 updates: \| Package \| From \| To \| \| --- \| --- \| --- \| \| [step-security/harden-runner](https://github.com/step-security/harden-runner) \| `2.20.0` \| `2.20.1` \| \| [actions/checkout](https://github.com/actions/checkout) \| `7.0.0` \| `7.0.1` \| \| [pnpm/action-setup](https://github.com/pnpm/action-setup) \| `6.0.9` \| `6.0.10` \| \| [docker/login-action](https://github.com/docker/login-action) \| `4.5.2` \| `4.6.0` \| \| [actions/setup-java](https://github.com/actions/setup-java) \| `5.6.0` \| `5.7.0` \| \| [actions/attest](https://github.com/actions/attest) \| `4.2.0` \| `4.2.2` \| \| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) \| `4.37.3` \| `4.37.6` \| \| [github/codeql-action/init](https://github.com/github/codeql-action) \| `4.37.3` \| `4.37.6` \| \| [github/codeql-action/analyze](https://github.com/github/codeql-action) \| `4.37.3` \| `4.37.6` \| \| [umbrelladocs/action-linkspector](https://github.com/umbrelladocs/action-linkspector) \| `1.5.4` \| `1.5.5` \| Updates `step-security/harden-runner` from 2.20.0 to 2.20.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/step-security/harden-runner/releases">step-security/harden-runner's releases</a>.</em></p> <blockquote> <h2>v2.20.1</h2> <h2>What's Changed</h2> <ul> <li>AWS CodeBuild-hosted runner support</li> <li>Implicitly allow single-labeled (internal) domains in block-mode</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/step-security/harden-runner/compare/v2.20.0...v2.20.1">https://github.com/step-security/harden-runner/compare/v2.20.0...v2.20.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/step-security/harden-runner/commit/b09bb98e06d4d774595224525879c09bc6e98c40"><code>b09bb98</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/680">#680</a> from step-security/aws-code-build</li> <li><a href="https://github.com/step-security/harden-runner/commit/35cd77bcf669054f67ffd3d2802ee54a4f13b5b6"><code>35cd77b</code></a> docs: document the Global Block List in the features list</li> <li><a href="https://github.com/step-security/harden-runner/commit/bb6dbef4bf53876cd2710acd1d36413620d20fb3"><code>bb6dbef</code></a> chore: rebuild dist with clean dependency install</li> <li><a href="https://github.com/step-security/harden-runner/commit/98f73c5a0d2b2cc518e6fb8d973a0a4dde00ba13"><code>98f73c5</code></a> chore: update eBPF agent to v1.8.14</li> <li><a href="https://github.com/step-security/harden-runner/commit/54193c17a4fa3883977217b9afe20378ebe60b19"><code>54193c1</code></a> Reapply "feat(runners): detect AWS CodeBuild-hosted runners as third-party pr...</li> <li><a href="https://github.com/step-security/harden-runner/commit/d22dd481cea4e96cedde031cfe600c248b592d54"><code>d22dd48</code></a> Revert "fix(self-hosted): flush agent events at job end when deploy-on-self-h...</li> <li><a href="https://github.com/step-security/harden-runner/commit/0ff09412fb572363b483a3c86ffe52fe61d9fd19"><code>0ff0941</code></a> fix(self-hosted): flush agent events at job end when deploy-on-self-hosted-vm...</li> <li><a href="https://github.com/step-security/harden-runner/commit/a3c333d110c8d95f34488a22e0e56742cfb1b14f"><code>a3c333d</code></a> Revert "feat(runners): detect AWS CodeBuild-hosted runners as third-party pro...</li> <li><a href="https://github.com/step-security/harden-runner/commit/bf94c00d6bba2ae7c4a479b86653039811569968"><code>bf94c00</code></a> feat(runners): detect AWS CodeBuild-hosted runners as third-party provider</li> <li><a href="https://github.com/step-security/harden-runner/commit/514522c5e449f9e28fc901f770e08a573d413e67"><code>514522c</code></a> fix(self-hosted): resolve runner user when USER env var is unset</li> <li>See full diff in <a href="https://github.com/step-security/harden-runner/compare/bf7454d06d71f1098171f2acdf0cd4708d7b5920...b09bb98e06d4d774595224525879c09bc6e98c40">compare view</a></li> </ul> </details> <br /> Updates `actions/checkout` from 7.0.0 to 7.0.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v7.0.1</h2> <h2>What's Changed</h2> <ul> <li>skip running unsafe pr check if input is default by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li> <li>trim only ascii whitespace for branch by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li> <li>escape values passed to --unset by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li> <li>Various dependency updates</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v7...v7.0.1">https://github.com/actions/checkout/compare/v7...v7.0.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v7.0.1</h2> <ul> <li>Skip running unsafe pr check if input is default by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li> <li>Trim only ascii whitespace for branch by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li> <li>Escape values passed to --unset by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li> <li>Various dependency updates</li> </ul> <h2>v7.0.0</h2> <ul> <li>Block checking out fork PR for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Various dependency updates</li> </ul> <h2>v6.0.3</h2> <ul> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <h2>v6.0.2</h2> <ul> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <h2>v6.0.1</h2> <ul> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> </ul> <h2>v6.0.0</h2> <ul> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> </ul> <h2>v5.0.1</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <h2>v5.0.0</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> </ul> <h2>v4.3.1</h2> <ul> <li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li> </ul> <h2>v4.3.0</h2> <ul> <li>docs: update README.md by <a href="https://github.com/motss"><code>@motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li> <li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li> <li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li> <li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li> <li>Update README.md by <a href="https://github.com/nebuk89"><code>@nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li> <li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li> <li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li> </ul> <h2>v4.2.2</h2> <ul> <li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li> <li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li> </ul> <h2>v4.2.1</h2> <ul> <li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/actions/checkout/compare/v7...3d3c42e5aac5ba805825da76410c181273ba90b1">compare view</a></li> </ul> </details> <br /> Updates `pnpm/action-setup` from 6.0.9 to 6.0.10 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pnpm/action-setup/releases">pnpm/action-setup's releases</a>.</em></p> <blockquote> <h2>v6.0.10</h2> <h2>What's Changed</h2> <ul> <li>docs(README): point users to the successor pnpm/setup action by <a href="https://github.com/BlackHole1"><code>@BlackHole1</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/282">pnpm/action-setup#282</a></li> <li>refactor: introduce restore keys for cache by <a href="https://github.com/SukkaW"><code>@SukkaW</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/280">pnpm/action-setup#280</a></li> <li>ci: use pnpm 11 for <code>pr-check</code> by <a href="https://github.com/jamietanna"><code>@jamietanna</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/284">pnpm/action-setup#284</a></li> <li>fix: update pnpm to v11.19.0 by <a href="https://github.com/jamietanna"><code>@jamietanna</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/283">pnpm/action-setup#283</a></li> <li>docs: update README to include devEngines.packageManager by <a href="https://github.com/nemchik"><code>@nemchik</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/273">pnpm/action-setup#273</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/jamietanna"><code>@jamietanna</code></a> made their first contribution in <a href="https://redirect.github.com/pnpm/action-setup/pull/284">pnpm/action-setup#284</a></li> <li><a href="https://github.com/nemchik"><code>@nemchik</code></a> made their first contribution in <a href="https://redirect.github.com/pnpm/action-setup/pull/273">pnpm/action-setup#273</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pnpm/action-setup/compare/v6...v6.0.10">https://github.com/pnpm/action-setup/compare/v6...v6.0.10</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pnpm/action-setup/commit/0977fd99725f1db4007ccb2928dbb4e90d06cc86"><code>0977fd9</code></a> docs: Update README to include devEngines.packageManager (<a href="https://redirect.github.com/pnpm/action-setup/issues/273">#273</a>)</li> <li><a href="https://github.com/pnpm/action-setup/commit/48261aca053e825d84804e8ce05524d558249ac9"><code>48261ac</code></a> fix: update pnpm to v11.19.0 (<a href="https://redirect.github.com/pnpm/action-setup/issues/283">#283</a>)</li> <li><a href="https://github.com/pnpm/action-setup/commit/75677f717d48404e86ae8ee4891543f40de175aa"><code>75677f7</code></a> ci: use pnpm 11 for <code>pr-check</code> (<a href="https://redirect.github.com/pnpm/action-setup/issues/284">#284</a>)</li> <li><a href="https://github.com/pnpm/action-setup/commit/769ae71fb33e6e448a5dc92ad5da997c268eecec"><code>769ae71</code></a> refactor: introduce restore keys for cache (<a href="https://redirect.github.com/pnpm/action-setup/issues/280">#280</a>)</li> <li><a href="https://github.com/pnpm/action-setup/commit/6fed91f804570c1144bfe1911c348642cb986bd4"><code>6fed91f</code></a> docs(README): point users to the successor pnpm/setup action (<a href="https://redirect.github.com/pnpm/action-setup/issues/282">#282</a>)</li> <li>See full diff in <a href="https://github.com/pnpm/action-setup/compare/0ebf47130e4866e96fce0953f49152a61190b271...0977fd99725f1db4007ccb2928dbb4e90d06cc86">compare view</a></li> </ul> </details> <br /> Updates `docker/login-action` from 4.5.2 to 4.6.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/docker/login-action/releases">docker/login-action's releases</a>.</em></p> <blockquote> <h2>v4.6.0</h2> <ul> <li>Harden buildx scoped config path handling by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/login-action/pull/1059">docker/login-action#1059</a></li> <li>Bump <code>@aws-sdk/client-ecr</code> and <code>@aws-sdk/client-ecr-public</code> to 3.1095.0 in <a href="https://redirect.github.com/docker/login-action/pull/1051">docker/login-action#1051</a></li> <li>Bump js-yaml from 5.2.1 to 5.2.2 in <a href="https://redirect.github.com/docker/login-action/pull/1057">docker/login-action#1057</a></li> <li>Bump postcss from 8.5.10 to 8.5.22 in <a href="https://redirect.github.com/docker/login-action/pull/1056">docker/login-action#1056</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/login-action/compare/v4.5.2...v4.6.0">https://github.com/docker/login-action/compare/v4.5.2...v4.6.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/docker/login-action/commit/dbcb813823bdd20940b903addbd779551569679f"><code>dbcb813</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1051">#1051</a> from docker/dependabot/npm_and_yarn/aws-sdk-dependen...</li> <li><a href="https://github.com/docker/login-action/commit/5bcb015ee6ec720ecdeaef2dc1164122e9b209fc"><code>5bcb015</code></a> [dependabot skip] chore: update generated content</li> <li><a href="https://github.com/docker/login-action/commit/b30b2f2d3196c1714318ba0c3c3bec211d949752"><code>b30b2f2</code></a> build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...</li> <li><a href="https://github.com/docker/login-action/commit/9087f1e6d666fe0292409e3c819680c18526e108"><code>9087f1e</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1057">#1057</a> from docker/dependabot/npm_and_yarn/js-yaml-5.2.2</li> <li><a href="https://github.com/docker/login-action/commit/0009830ea169ca16c24c0ea4cac1c325bfa3aee4"><code>0009830</code></a> [dependabot skip] chore: update generated content</li> <li><a href="https://github.com/docker/login-action/commit/23255232d3e43c8f0052d9a0dba82a515a88ce92"><code>2325523</code></a> build(deps): bump js-yaml from 5.2.1 to 5.2.2</li> <li><a href="https://github.com/docker/login-action/commit/4ec1d4a769e8b05a89a7396551dc38b329211688"><code>4ec1d4a</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1056">#1056</a> from docker/dependabot/npm_and_yarn/postcss-8.5.22</li> <li><a href="https://github.com/docker/login-action/commit/5fc99ba47bca274c5a499688f71c7ea79c0ea1b3"><code>5fc99ba</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1053">#1053</a> from docker/dependabot/github_actions/aws-actions/co...</li> <li><a href="https://github.com/docker/login-action/commit/e512bd59d16c53d79ea5c0f0e345fe554453c4bb"><code>e512bd5</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1052">#1052</a> from docker/dependabot/github_actions/codeql-actions...</li> <li><a href="https://github.com/docker/login-action/commit/a146c91b8f371700d323bae808af7cbdc2766ed5"><code>a146c91</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1059">#1059</a> from crazy-max/harden-buildx-scope-paths</li> <li>Additional commits viewable in <a href="https://github.com/docker/login-action/compare/371161bbe7024a29a25c5e19bfcbc0804fe9ad2c...dbcb813823bdd20940b903addbd779551569679f">compare view</a></li> </ul> </details> <br /> Updates `actions/setup-java` from 5.6.0 to 5.7.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-java/releases">actions/setup-java's releases</a>.</em></p> <blockquote> <h2>v5.7.0</h2> <h2>What's Changed</h2> <ul> <li>Fix npm audit failures on releases/v5 by <a href="https://github.com/brunoborges"><code>@brunoborges</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/1154">actions/setup-java#1154</a></li> <li>Backport <a href="https://redirect.github.com/actions/setup-java/issues/1151">#1151</a>: Fix missing wrapper cache distributions by <a href="https://github.com/brunoborges"><code>@brunoborges</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/1153">actions/setup-java#1153</a></li> <li>Deprecate legacy Adopt distributions in v5 by <a href="https://github.com/brunoborges"><code>@brunoborges</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/1186">actions/setup-java#1186</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-java/compare/v5.6.0...v5.7.0">https://github.com/actions/setup-java/compare/v5.6.0...v5.7.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/setup-java/commit/b6effb05e454b25005698d916606bdc6ffcbf961"><code>b6effb0</code></a> Deprecate legacy Adopt distributions in v5 (<a href="https://redirect.github.com/actions/setup-java/issues/1186">#1186</a>)</li> <li><a href="https://github.com/actions/setup-java/commit/e498d2a66a953492f322542257b22125c989b422"><code>e498d2a</code></a> Backport <a href="https://redirect.github.com/actions/setup-java/issues/1151">#1151</a>: Fix missing wrapper cache distributions (<a href="https://redirect.github.com/actions/setup-java/issues/1153">#1153</a>)</li> <li><a href="https://github.com/actions/setup-java/commit/6a3384db745932178632d0e22b2bd28cad1678e6"><code>6a3384d</code></a> Fix npm audit failures on releases/v5 (<a href="https://redirect.github.com/actions/setup-java/issues/1154">#1154</a>)</li> <li>See full diff in <a href="https://github.com/actions/setup-java/compare/03ad4de0992f5dab5e18fcb136590ce7c4a0ac95...b6effb05e454b25005698d916606bdc6ffcbf961">compare view</a></li> </ul> </details> <br /> Updates `actions/attest` from 4.2.0 to 4.2.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/attest/releases">actions/attest's releases</a>.</em></p> <blockquote> <h2>v4.2.2</h2> <h2>What's Changed</h2> <ul> <li>Bump <code>@sigstore/oci</code> from 0.7.1 to 0.7.2 by <a href="https://github.com/bdehamer"><code>@bdehamer</code></a> in <a href="https://redirect.github.com/actions/attest/pull/469">actions/attest#469</a></li> <li>Bump brace-expansion by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/attest/pull/468">actions/attest#468</a></li> <li>Bump ip-address from 10.2.0 to 10.4.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/attest/pull/467">actions/attest#467</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/attest/compare/v4.2.1...v4.2.2">https://github.com/actions/attest/compare/v4.2.1...v4.2.2</a></p> <h2>v4.2.1</h2> <h2>What's Changed</h2> <ul> <li>Bump tar from 7.5.17 to 7.5.21 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/attest/pull/459">actions/attest#459</a></li> <li>fix: strip OCI image tag when pushing attestation to registry by <a href="https://github.com/bdehamer"><code>@bdehamer</code></a> in <a href="https://redirect.github.com/actions/attest/pull/464">actions/attest#464</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/attest/compare/v4.2.0...v4.2.1">https://github.com/actions/attest/compare/v4.2.0...v4.2.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/attest/commit/1e69f48acb82d1966a394da916b4c1698aa569d6"><code>1e69f48</code></a> Bump ip-address from 10.2.0 to 10.4.0 (<a href="https://redirect.github.com/actions/attest/issues/467">#467</a>)</li> <li><a href="https://github.com/actions/attest/commit/02787ce2f81fbfbefd25c8a9c54441f7cdec4a1b"><code>02787ce</code></a> Bump brace-expansion (<a href="https://redirect.github.com/actions/attest/issues/468">#468</a>)</li> <li><a href="https://github.com/actions/attest/commit/98ac037e195b51fa969ebc56da4ccaa9c35fad71"><code>98ac037</code></a> bump <code>@sigstore/oci</code> from 0.7.1 to 0.7.2 (<a href="https://redirect.github.com/actions/attest/issues/469">#469</a>)</li> <li><a href="https://github.com/actions/attest/commit/508db95dd578ae2727ebd6217d5ba78e4fbda05d"><code>508db95</code></a> fix: strip OCI image tag when pushing attestation to registry (<a href="https://redirect.github.com/actions/attest/issues/464">#464</a>)</li> <li><a href="https://github.com/actions/attest/commit/dda48f2935afea63fd4651871c16233251f9d06c"><code>dda48f2</code></a> Bump the npm-development group across 1 directory with 6 updates (<a href="https://redirect.github.com/actions/attest/issues/461">#461</a>)</li> <li><a href="https://github.com/actions/attest/commit/7d789a33ada19b33b74fbcdeb7f8e6cbb509a577"><code>7d789a3</code></a> Bump the actions-minor group with 3 updates (<a href="https://redirect.github.com/actions/attest/issues/463">#463</a>)</li> <li><a href="https://github.com/actions/attest/commit/1f3ca2fbe3d1c724d701286b30c7d90309029739"><code>1f3ca2f</code></a> Add release-cutter canvas extension (<a href="https://redirect.github.com/actions/attest/issues/454">#454</a>)</li> <li><a href="https://github.com/actions/attest/commit/d215549ae8a52064102300d4b4698f3fc1babad8"><code>d215549</code></a> Bump tar from 7.5.17 to 7.5.21 (<a href="https://redirect.github.com/actions/attest/issues/459">#459</a>)</li> <li><a href="https://github.com/actions/attest/commit/20c90ed94816337d30d322057e464c15e29f9890"><code>20c90ed</code></a> Bump the npm-development group with 2 updates (<a href="https://redirect.github.com/actions/attest/issues/455">#455</a>)</li> <li><a href="https://github.com/actions/attest/commit/43c2c81fd275fe2d0ac9a887891189fc000588f1"><code>43c2c81</code></a> Bump the actions-minor group with 4 updates (<a href="https://redirect.github.com/actions/attest/issues/456">#456</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/attest/compare/f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6...1e69f48acb82d1966a394da916b4c1698aa569d6">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/upload-sarif` from 4.37.3 to 4.37.6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/upload-sarif's releases</a>.</em></p> <blockquote> <h2>v4.37.6</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>v4.37.5</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>v4.37.4</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/upload-sarif's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>4.36.3 - 01 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.36.2 - 04 Jun 2026</h2> <ul> <li>Cache CodeQL CLI version information across Actions steps. <a href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li> <li>Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. <a href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/5595ccaf912efad79be6eef63a5619ff05969be3"><code>5595cca</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4071">#4071</a> from github/update-v4.37.6-6a9359a1b</li> <li><a href="https://github.com/github/codeql-action/commit/ec9c75796a7f2cee5af0c5ffa0b81dc3bb58754b"><code>ec9c757</code></a> Add change note for PR 4070</li> <li><a href="https://github.com/github/codeql-action/commit/45c8742e17cbd668814137f95e605d925b8722a2"><code>45c8742</code></a> Update changelog for v4.37.6</li> <li><a href="https://github.com/github/codeql-action/commit/6a9359a1bd054c53cae7bb737bd8d796cfbf3014"><code>6a9359a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4070">#4070</a> from github/mbg/remote-address/change-file-default</li> <li><a href="https://github.com/github/codeql-action/commit/065cdc0394d424981db720df63ebc570e41b775f"><code>065cdc0</code></a> Change <code>DEFAULT_CONFIG_FILE_NAME</code></li> <li><a href="https://github.com/github/codeql-action/commit/f99dd5aeee9cf92e92d0c700cb0aa7afd7bbf431"><code>f99dd5a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4066">#4066</a> from github/dependabot/npm_and_yarn/js-yaml-5.2.2</li> <li><a href="https://github.com/github/codeql-action/commit/1804b211a343d69a6584d26fb3a68a8fe6ca39d4"><code>1804b21</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4068">#4068</a> from github/mergeback/v4.37.5-to-main-d1ba80a1</li> <li><a href="https://github.com/github/codeql-action/commit/3020a2f46286abb1704269b22ada83bd0e81c64f"><code>3020a2f</code></a> Rebuild</li> <li><a href="https://github.com/github/codeql-action/commit/93c3a5a40b7affbf8ea6a480767ed0db8e8d3c5c"><code>93c3a5a</code></a> Update changelog and version after v4.37.5</li> <li><a href="https://github.com/github/codeql-action/commit/d1ba80a13dd99fba24a470575428917156a28b43"><code>d1ba80a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4067">#4067</a> from github/update-v4.37.5-1cd4d01d5</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...5595ccaf912efad79be6eef63a5619ff05969be3">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/init` from 4.37.3 to 4.37.6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/init's releases</a>.</em></p> <blockquote> <h2>v4.37.6</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>v4.37.5</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>v4.37.4</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/init's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>4.36.3 - 01 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.36.2 - 04 Jun 2026</h2> <ul> <li>Cache CodeQL CLI version information across Actions steps. <a href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li> <li>Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. <a href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/5595ccaf912efad79be6eef63a5619ff05969be3"><code>5595cca</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4071">#4071</a> from github/update-v4.37.6-6a9359a1b</li> <li><a href="https://github.com/github/codeql-action/commit/ec9c75796a7f2cee5af0c5ffa0b81dc3bb58754b"><code>ec9c757</code></a> Add change note for PR 4070</li> <li><a href="https://github.com/github/codeql-action/commit/45c8742e17cbd668814137f95e605d925b8722a2"><code>45c8742</code></a> Update changelog for v4.37.6</li> <li><a href="https://github.com/github/codeql-action/commit/6a9359a1bd054c53cae7bb737bd8d796cfbf3014"><code>6a9359a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4070">#4070</a> from github/mbg/remote-address/change-file-default</li> <li><a href="https://github.com/github/codeql-action/commit/065cdc0394d424981db720df63ebc570e41b775f"><code>065cdc0</code></a> Change <code>DEFAULT_CONFIG_FILE_NAME</code></li> <li><a href="https://github.com/github/codeql-action/commit/f99dd5aeee9cf92e92d0c700cb0aa7afd7bbf431"><code>f99dd5a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4066">#4066</a> from github/dependabot/npm_and_yarn/js-yaml-5.2.2</li> <li><a href="https://github.com/github/codeql-action/commit/1804b211a343d69a6584d26fb3a68a8fe6ca39d4"><code>1804b21</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4068">#4068</a> from github/mergeback/v4.37.5-to-main-d1ba80a1</li> <li><a href="https://github.com/github/codeql-action/commit/3020a2f46286abb1704269b22ada83bd0e81c64f"><code>3020a2f</code></a> Rebuild</li> <li><a href="https://github.com/github/codeql-action/commit/93c3a5a40b7affbf8ea6a480767ed0db8e8d3c5c"><code>93c3a5a</code></a> Update changelog and version after v4.37.5</li> <li><a href="https://github.com/github/codeql-action/commit/d1ba80a13dd99fba24a470575428917156a28b43"><code>d1ba80a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4067">#4067</a> from github/update-v4.37.5-1cd4d01d5</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...5595ccaf912efad79be6eef63a5619ff05969be3">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/analyze` from 4.37.3 to 4.37.6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/analyze's releases</a>.</em></p> <blockquote> <h2>v4.37.6</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>v4.37.5</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>v4.37.4</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/analyze's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>4.36.3 - 01 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.36.2 - 04 Jun 2026</h2> <ul> <li>Cache CodeQL CLI version information across Actions steps. <a href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li> <li>Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. <a href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/5595ccaf912efad79be6eef63a5619ff05969be3"><code>5595cca</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4071">#4071</a> from github/update-v4.37.6-6a9359a1b</li> <li><a href="https://github.com/github/codeql-action/commit/ec9c75796a7f2cee5af0c5ffa0b81dc3bb58754b"><code>ec9c757</code></a> Add change note for PR 4070</li> <li><a href="https://github.com/github/codeql-action/commit/45c8742e17cbd668814137f95e605d925b8722a2"><code>45c8742</code></a> Update changelog for v4.37.6</li> <li><a href="https://github.com/github/codeql-action/commit/6a9359a1bd054c53cae7bb737bd8d796cfbf3014"><code>6a9359a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4070">#4070</a> from github/mbg/remote-address/change-file-default</li> <li><a href="https://github.com/github/codeql-action/commit/065cdc0394d424981db720df63ebc570e41b775f"><code>065cdc0</code></a> Change <code>DEFAULT_CONFIG_FILE_NAME</code></li> <li><a href="https://github.com/github/codeql-action/commit/f99dd5aeee9cf92e92d0c700cb0aa7afd7bbf431"><code>f99dd5a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4066">#4066</a> from github/dependabot/npm_and_yarn/js-yaml-5.2.2</li> <li><a href="https://github.com/github/codeql-action/commit/1804b211a343d69a6584d26fb3a68a8fe6ca39d4"><code>1804b21</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4068">#4068</a> from github/mergeback/v4.37.5-to-main-d1ba80a1</li> <li><a href="https://github.com/github/codeql-action/commit/3020a2f46286abb1704269b22ada83bd0e81c64f"><code>3020a2f</code></a> Rebuild</li> <li><a href="https://github.com/github/codeql-action/commit/93c3a5a40b7affbf8ea6a480767ed0db8e8d3c5c"><code>93c3a5a</code></a> Update changelog and version after v4.37.5</li> <li><a href="https://github.com/github/codeql-action/commit/d1ba80a13dd99fba24a470575428917156a28b43"><code>d1ba80a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4067">#4067</a> from github/update-v4.37.5-1cd4d01d5</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...5595ccaf912efad79be6eef63a5619ff05969be3">compare view</a></li> </ul> </details> <br /> Updates `umbrelladocs/action-linkspector` from 1.5.4 to 1.5.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/umbrelladocs/action-linkspector/releases">umbrelladocs/action-linkspector's releases</a>.</em></p> <blockquote> <h2>Release v1.5.5</h2> <p>v1.5.5: PR <a href="https://redirect.github.com/umbrelladocs/action-linkspector/issues/70">#70</a> - Update linkspector version to 0.5.6</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/UmbrellaDocs/action-linkspector/commit/568ec8d29fa92b31fd9ea5381e155c51e922af83"><code>568ec8d</code></a> Merge pull request <a href="https://redirect.github.com/umbrelladocs/action-linkspector/issues/70">#70</a> from UmbrellaDocs/update-linkspector-version</li> <li><a href="https://github.com/UmbrellaDocs/action-linkspector/commit/6132d9352f02722911dc20ede6cff55f5e1b6889"><code>6132d93</code></a> Update linkspector version to 0.5.6</li> <li><a href="https://github.com/UmbrellaDocs/action-linkspector/commit/2f82e255e59a3eff9fd481ff06ef80dacd7218f2"><code>2f82e25</code></a> Merge pull request <a href="https://redirect.github.com/umbrelladocs/action-linkspector/issues/68">#68</a> from sschuberth/patch-1</li> <li><a href="https://github.com/UmbrellaDocs/action-linkspector/commit/72f6bee7082d4a2ddfd80f0b126df4c03a503797"><code>72f6bee</code></a> fix brackets around dpkg</li> <li><a href="https://github.com/UmbrellaDocs/action-linkspector/commit/e0946b31e20e925e6b9d15d34093c606d9d3535e"><code>e0946b3</code></a> ci(github): Run all tests on Ubuntu 24.04 and 26.04</li> <li><a href="https://github.com/UmbrellaDocs/action-linkspector/commit/8b13e46659fda3489c2554d86bb3ad5323d698d2"><code>8b13e46</code></a> fix: Extend the AppArmor check to Ubuntu > 24.04</li> <li>See full diff in <a href="https://github.com/umbrelladocs/action-linkspector/compare/6c637d70424624231467a4ca918be54fa3b792d0...568ec8d29fa92b31fd9ea5381e155c51e922af83">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-11 11:24:39 +00:00
Danielle Maywood	df278ec079	fix: derive diff cache keys from patch content (#27987 )	2026-08-11 12:22:13 +01:00
dependabot[bot]	b0afab063f	chore: bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.69.0 to 0.70.0 (#28018 ) Bumps [go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp](https://github.com/open-telemetry/opentelemetry-go-contrib) from 0.69.0 to 0.70.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md">go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp's changelog</a>.</em></p> <blockquote> <h2>[1.45.0/2.5.2/0.70.0/0.37.2/0.25.0/0.20.0/0.16.2/0.17.0] - 2026-08-03</h2> <h3>Added</h3> <ul> <li>Add <code>go.opentelemetry.io/contrib/detectors/ibmcloud/vpc</code>, a new resource detector for IBM Cloud VPC virtual server instances, ported from <code>github.com/open-telemetry/opentelemetry-collector-contrib/processor/resourcedetectionprocessor/internal/ibmcloud/vpc</code>. Detects <code>cloud.provider</code>, <code>cloud.platform</code>, <code>cloud.region</code>, <code>cloud.availability_zone</code>, <code>cloud.account.id</code>, <code>cloud.resource_id</code>, <code>host.id</code>, <code>host.image.id</code>, <code>host.image.name</code>, <code>host.name</code>, and <code>host.type</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9011">#9011</a>)</li> <li>Add <code>go.opentelemetry.io/contrib/detectors/k8sapi</code>, a new resource detector that queries the Kubernetes API. Detects <code>k8s.node.name</code> and <code>k8s.node.uid</code> when <code>K8S_NODE_NAME</code> is set via the downward API, and <code>k8s.cluster.uid</code> derived from the kube-system namespace UID (works on any Kubernetes distribution). (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9108">#9108</a>)</li> <li>Add new <code>elasticbeanstalk</code> resource detector for AWS Elastic Beanstalk, ported from <code>processor/resourcedetectionprocessor/internal/aws/elasticbeanstalk</code> in opentelemetry-collector-contrib. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8993">#8993</a>)</li> <li>The resource created by <code>go.opentelemetry.io/contrib/otelconf</code> now includes <a href="https://pkg.go.dev/go.opentelemetry.io/otel/sdk/resource#Default">default SDK attributes</a>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8990">#8990</a>)</li> <li>Add support for the <code>aws.ecs</code> resource detector in <code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8915">#8915</a>)</li> <li>Add support for the <code>aws.eks</code> resource detector in <code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9138">#9138</a>)</li> <li>Add support for the <code>azure.vm</code> resource detector in <code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9074">#9074</a>)</li> <li>Add support for the <code>gcp</code> resource detector in <code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9137">#9137</a>)</li> <li>Add <code>go.opentelemetry.io/contrib/detectors/azure/azureappservice</code>, a new resource detector for Azure App Service. Detects <code>cloud.</code>, <code>service.name</code>, <code>azure.resource_group.name</code>, <code>azure.app_service.instance.id</code>, and <code>deployment.environment.name</code> from the <code>WEBSITE_</code> and <code>REGION_NAME</code> environment variables. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9289">#9289</a>)</li> <li>Add <code>azurecontainerapps</code> resource detector for Azure Container Apps. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8939">#8939</a>)</li> <li>Add <code>go.opentelemetry.io/contrib/detectors/azure/azurefunctions</code>, a new resource detector for Azure Functions. Detects <code>cloud.</code>, <code>service.name</code>, <code>azure.resource_group.name</code>, <code>faas.instance</code>, and <code>deployment.environment.name</code> from the <code>FUNCTIONS_</code>, <code>WEBSITE_*</code>, <code>CONTAINER_NAME</code>, and <code>REGION_NAME</code> environment variables. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9290">#9290</a>)</li> <li>Add <code>NewResourceDetector</code> along with the <code>WithAttributeFilter</code> and <code>WithTagKeyFilter</code> options in <code>go.opentelemetry.io/contrib/detectors/azure/azurevm</code>. <code>WithAttributeFilter</code> restricts the returned resource to the attributes the filter accepts. <code>WithTagKeyFilter</code> opts in to <code>azure.tag.<name></code> attributes for the VM tags whose keys satisfy the provided predicate; no VM tags are emitted without it. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9162">#9162</a>)</li> <li>Add <code>go.opentelemetry.io/contrib/detectors/vultr</code> — a new resource detector for Vultr Cloud Compute instances, ported from <code>processor/resourcedetectionprocessor/internal/vultr</code> in <code>opentelemetry-collector-contrib</code>. Detects <code>cloud.provider</code>, <code>cloud.platform</code>, <code>cloud.region</code>, <code>host.id</code>, and <code>host.name</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8995">#8995</a>)</li> </ul> <h3>Changed</h3> <ul> <li>Upgrade <code>go.opentelemetry.io/otel/semconv</code> to <code>v1.43.0</code>, including updates across instrumentation and detector modules. See <a href="https://github.com/open-telemetry/semantic-conventions/releases/tag/v1.43.0">semantic-conventions v1.43.0 release</a> for complete details. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9337">#9337</a>)</li> <li>Upgrade <code>go.opentelemetry.io/otel/semconv</code> to <code>v1.42.0</code>, including updates across instrumentation and detector modules. See <a href="https://github.com/open-telemetry/semantic-conventions/releases/tag/v1.42.0">semantic-conventions v1.42.0 release</a> for complete details. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9196">#9196</a>)</li> <li>Use direct normalized-key lookups in <code>Carrier.Get</code> and <code>Carrier.Keys</code> in <code>go.opentelemetry.io/contrib/propagators/envcar</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9112">#9112</a>)</li> <li>Update log bridge conversions to use attribute key-values instead of the removed log key-values in <code>go.opentelemetry.io/contrib/bridges/otellogr</code>, <code>go.opentelemetry.io/contrib/bridges/otellogrus</code>, <code>go.opentelemetry.io/contrib/bridges/otelslog</code>, and <code>go.opentelemetry.io/contrib/bridges/otelzap</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9180">#9180</a>)</li> <li>The <code>Version()</code> function in <code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code> has been replaced by <code>const Version</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9076">#9076</a>)</li> <li>Set <code>error.type</code> attribute instead of adding <code>exception</code> span events in <code>go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8977">#8977</a>)</li> <li>Prefer the gRPC dial target over the resolved peer IP for the <code>server.address</code> and <code>server.port</code> attributes in <code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8904">#8904</a>)</li> <li>The detector in <code>go.opentelemetry.io/contrib/detectors/azure/azurevm</code> now also detects <code>cloud.account.id</code>, <code>cloud.availability_zone</code>, <code>azure.vm.name</code>, <code>azure.vm.size</code>, <code>azure.vm.scaleset.name</code>, and <code>azure.resource_group.name</code>, and prefers <code>osProfile.computerName</code> for <code>host.name</code> (falling back to the VM name), reconciling it with the collector-contrib Azure resource detector. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9162">#9162</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Fix Prometheus reader resource label filter configuration in <code>go.opentelemetry.io/contrib/otelconf/v0.2.0</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9062">#9062</a>)</li> <li>Apply <code>resource.detection/development.attributes.included</code> and <code>excluded</code> filtering to resource detector attributes in <code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9131">#9131</a>)</li> <li>Honor the context configured with <code>WithContext</code> when constructing resources in <code>go.opentelemetry.io/contrib/otelconf</code> and <code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9160">#9160</a>)</li> <li>Handle nil response bodies from custom <code>RoundTripper</code> implementations in <code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code> without panicking. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9184">#9184</a>)</li> <li>Fix incorrect (overestimated) sum calculation for runtime histograms in <code>go.opentelemetry.io/contrib/instrumentation/runtime</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9063">#9063</a>)</li> <li>Fix <code>Severity.UnmarshalText</code> round trip for positive <code>FATAL</code> offsets above the named range in <code>go.opentelemetry.io/contrib/processors/minsev</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9197">#9197</a>)</li> <li>Reduce binary size by fetching ConfigMaps via <code>rest.HTTPClientFor</code> instead of the Kubernetes clientset in <code>go.opentelemetry.io/contrib/detectors/aws/eks</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9284">#9284</a>)</li> <li><code>TextMapPropagator</code> in <code>go.opentelemetry.io/contrib/propagators/autoprop</code> returns the no-op propagator for empty input, matching the behavior of <code>none</code>. An unknown <code>OTEL_PROPAGATORS</code> value still returns an error with a nil propagator so <code>NewTextMapPropagator</code> falls back to the default TraceContext and Baggage propagators instead of disabling propagation. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9163">#9163</a>)</li> <li>Preserve error-valued attributes nested in a group as grouped attributes instead of silently dropping them in <code>go.opentelemetry.io/contrib/bridges/otelslog</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9238">#9238</a>)</li> <li>Fix a data race in <code>go.opentelemetry.io/contrib/bridges/otelslog</code> where concurrent <code>Handle</code> calls could corrupt each other's log attributes because <code>kvBuffer.KeyValues</code> returned a slice aliasing a shared buffer. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9229">#9229</a>)</li> <li>Avoid a panic in <code>go.opentelemetry.io/contrib/bridges/otelzap</code> when a malformed error field contains a nil or non-error value. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9068">#9068</a>)</li> <li>Use <code>azure.container_app.instance.id</code> instead of <code>service.instance.id</code> for the replica name detected by <code>go.opentelemetry.io/contrib/detectors/azure/azurecontainerapps</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9208">#9208</a>)</li> <li>Preserve the underlying metadata errors returned with partial resources from <code>go.opentelemetry.io/contrib/detectors/gcp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9069">#9069</a>)</li> <li>Copy <code>MultipartForm</code> back to the request <code>otelmux.Middleware</code> was given after the wrapped handler returns, so <code>net/http</code> can find and remove the temp files <code>ParseMultipartForm</code> created on the context-derived request copy, when <code>otelmux.Middleware</code> wraps a handler directly, in <code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code>. This does not cover a handler panic, nor the common <code>router.Use(...)</code> integration, where <code>gorilla/mux</code>'s own routing step makes an additional request copy the middleware cannot write back through; see <a href="https://redirect.github.com/gorilla/mux/pull/777">gorilla/mux#777</a>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9361">#9361</a>)</li> <li>Report the <code>b3</code> header from <code>Fields()</code> for the default <code>B3Unspecified</code> single-header injection encoding, matching what <code>Inject</code> writes, in <code>go.opentelemetry.io/contrib/propagators/b3</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9273">#9273</a>)</li> <li>Fix <code>go.opentelemetry.io/contrib/propagators/aws/xray</code> producing deterministic trace and span IDs when the seed read from <code>crypto/rand</code> silently failed, by switching to <code>math/rand/v2</code>'s concurrency-safe top-level generator. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9359">#9359</a>)</li> <li>Strip connection number suffix from connection ID in <code>go.opentelemetry.io/contrib/instrumentation/go.mongodb.org/mongo-driver/v2/mongo/otelmongo</code> to prevent unbounded metric cardinality. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9352">#9352</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/c8a87a60ba1b3374fd16df11fc3eeae6c41abbc9"><code>c8a87a6</code></a> Release v1.45.0/v2.5.2/v0.70.0/v0.37.2/v0.25.0/v0.20.0/v0.16.2/v0.17.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9413">#9413</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/cde125c563f232eb6b423a208d375f8e53ae2557"><code>cde125c</code></a> fix(deps): update aws-sdk-go-v2 monorepo (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9384">#9384</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/88572a7662d00e805777ed96932d532316c13787"><code>88572a7</code></a> chore(deps): update googleapis to 6ac0973 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9409">#9409</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/e4f511a0f3cc2b09b87cb164427b49dfd2e14f7d"><code>e4f511a</code></a> chore(deps): update github/codeql-action action to v4.37.5 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9410">#9410</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/265eb0b5fe0682801fd8177aec74ce8769c5a0a4"><code>265eb0b</code></a> fix(deps): update go.opentelemetry.io/otel digest to 48db2c6 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9317">#9317</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/941ba46979c59dca89d26040ed919870283e36e9"><code>941ba46</code></a> chore(deps): update github.com/charmbracelet/ultraviolet digest to 8b69304 (#...</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/ededd3b571ad562351a0afe09682774a6f48d63e"><code>ededd3b</code></a> chore(deps): update module github.com/lucasb-eyer/go-colorful to v1.4.1 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9406">#9406</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/7c6e819d4eb26eede10e98c424adb76304025fda"><code>7c6e819</code></a> fix(deps): update module github.com/atombender/go-jsonschema to v0.24.1 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9405">#9405</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/ec1e544a0d6883126198c3fc3a7d62fc8db29195"><code>ec1e544</code></a> chore(deps): update github.com/lufia/plan9stats digest to 341c2f0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9403">#9403</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/5d7e16aa1138a5446a648dd92ebc42031c93e327"><code>5d7e16a</code></a> chore(deps): update github.com/golangci/rowserrcheck digest to d2031e3 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9402">#9402</a>)</li> <li>Additional commits viewable in <a href="https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.69.0...zpages/v0.70.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp&package-manager=go_modules&previous-version=0.69.0&new-version=0.70.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-11 11:18:52 +00:00
dependabot[bot]	f65580a344	chore: bump google.golang.org/api from 0.291.0 to 0.292.0 (#28017 ) Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.291.0 to 0.292.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's releases</a>.</em></p> <blockquote> <h2>v0.292.0</h2> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.291.0...v0.292.0">0.292.0</a> (2026-08-04)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3682">#3682</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/b70719bb5600e7681c883946903c4e55c493c801">b70719b</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3684">#3684</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/c9bc778099e72798eef096de828fb333389f7010">c9bc778</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3685">#3685</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/8140ddf12e1a5c4a54748a94b6655818fcc480ed">8140ddf</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3687">#3687</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/57047fb96a7bd29eea0bfed36a9207389f3cafcf">57047fb</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3688">#3688</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/256abd760aedde96c6e73ecf11822ed4cb223469">256abd7</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.291.0...v0.292.0">0.292.0</a> (2026-08-04)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3682">#3682</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/b70719bb5600e7681c883946903c4e55c493c801">b70719b</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3684">#3684</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/c9bc778099e72798eef096de828fb333389f7010">c9bc778</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3685">#3685</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/8140ddf12e1a5c4a54748a94b6655818fcc480ed">8140ddf</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3687">#3687</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/57047fb96a7bd29eea0bfed36a9207389f3cafcf">57047fb</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3688">#3688</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/256abd760aedde96c6e73ecf11822ed4cb223469">256abd7</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/googleapis/google-api-go-client/commit/8631dd4e00d6b5c37ba1c260bc5efe1de0877098"><code>8631dd4</code></a> chore(main): release 0.292.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3683">#3683</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/256abd760aedde96c6e73ecf11822ed4cb223469"><code>256abd7</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3688">#3688</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/3f73f91e83152f6f7ad9f37018812c81d771d336"><code>3f73f91</code></a> chore(all): update all (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3686">#3686</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/57047fb96a7bd29eea0bfed36a9207389f3cafcf"><code>57047fb</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3687">#3687</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/8140ddf12e1a5c4a54748a94b6655818fcc480ed"><code>8140ddf</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3685">#3685</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/c9bc778099e72798eef096de828fb333389f7010"><code>c9bc778</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3684">#3684</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/b70719bb5600e7681c883946903c4e55c493c801"><code>b70719b</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3682">#3682</a>)</li> <li>See full diff in <a href="https://github.com/googleapis/google-api-go-client/compare/v0.291.0...v0.292.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/api&package-manager=go_modules&previous-version=0.291.0&new-version=0.292.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-11 11:17:17 +00:00
dependabot[bot]	8a30a7da4c	chore: bump github.com/elazarl/goproxy from 1.8.0 to 1.9.0 (#28019 ) Bumps [github.com/elazarl/goproxy](https://github.com/elazarl/goproxy) from 1.8.0 to 1.9.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/elazarl/goproxy/releases">github.com/elazarl/goproxy's releases</a>.</em></p> <blockquote> <h2>v1.9.0: HTTP/2 MITM Full Support</h2> <h2>What's Changed</h2> <ul> <li>HTTP/2 MITM Full Support by <a href="https://github.com/ErikPelli"><code>@ErikPelli</code></a> in <a href="https://redirect.github.com/elazarl/goproxy/pull/785">elazarl/goproxy#785</a></li> <li>Use Go standard library to check port by <a href="https://github.com/ErikPelli"><code>@ErikPelli</code></a> in <a href="https://redirect.github.com/elazarl/goproxy/pull/795">elazarl/goproxy#795</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/elazarl/goproxy/compare/v1.8.6...v1.9.0">https://github.com/elazarl/goproxy/compare/v1.8.6...v1.9.0</a></p> <h3>Highlights & Acknowledgements</h3> <ul> <li><strong>HTTP/2 MITM Support:</strong> This release introduces native support for inspecting and manipulating HTTP/2 traffic within GoProxy's MITM functionality. A special thanks to the team at <a href="https://github.com/LumiaSecurity"><code>@LumiaSecurity</code></a> (including <a href="https://github.com/omriza"><code>@omriza</code></a> for the review) for supporting the development of these HTTP/2 MITM features and contributing to this major enhancement. Achieving full HTTP/2 MITM capability represents a huge milestone for GoProxy, taking our library to the next level for whoever needs it. <strong>To enable it, make sure that <code>AllowHTTP2</code> is set to <code>true</code> in the proxy configuration.</strong></li> </ul> <h3>⚠️ Possible Breaking Change</h3> <ul> <li>Previously there was an incomplete implementation of HTTP/2 inside the <code>h2.go</code> file, with an exported H2Transport struct. Probably no one was using it, but if you were, be careful that in this release it has been removed to create the full HTTP/2 MITM implementation.</li> </ul> <h2>v1.8.6</h2> <h2>What's Changed</h2> <ul> <li>Fix unexpected scheme edge case in MITM by <a href="https://github.com/ErikPelli"><code>@ErikPelli</code></a> in <a href="https://redirect.github.com/elazarl/goproxy/pull/793">elazarl/goproxy#793</a></li> <li>Stream MITM response bodies by <a href="https://github.com/krissetto"><code>@krissetto</code></a> in <a href="https://redirect.github.com/elazarl/goproxy/pull/794">elazarl/goproxy#794</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/krissetto"><code>@krissetto</code></a> made their first contribution in <a href="https://redirect.github.com/elazarl/goproxy/pull/794">elazarl/goproxy#794</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/elazarl/goproxy/compare/v1.8.5...v1.8.6">https://github.com/elazarl/goproxy/compare/v1.8.5...v1.8.6</a></p> <h2>v1.8.5</h2> <h2>What's Changed</h2> <ul> <li>fix(https): coalesce the MITM response head into a single write by <a href="https://github.com/shaharfreiman"><code>@shaharfreiman</code></a> in <a href="https://redirect.github.com/elazarl/goproxy/pull/787">elazarl/goproxy#787</a></li> <li>Remove redundant certificate Leaf set starting from Go 1.23 by <a href="https://github.com/ErikPelli"><code>@ErikPelli</code></a> in <a href="https://redirect.github.com/elazarl/goproxy/pull/789">elazarl/goproxy#789</a></li> <li>Fix headers overwrite when there are no trailers by <a href="https://github.com/ErikPelli"><code>@ErikPelli</code></a> in <a href="https://redirect.github.com/elazarl/goproxy/pull/791">elazarl/goproxy#791</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/shaharfreiman"><code>@shaharfreiman</code></a> made their first contribution in <a href="https://redirect.github.com/elazarl/goproxy/pull/787">elazarl/goproxy#787</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/elazarl/goproxy/compare/v1.8.4...v1.8.5">https://github.com/elazarl/goproxy/compare/v1.8.4...v1.8.5</a></p> <h2>v1.8.4</h2> <h2>What's Changed</h2> <ul> <li>fix: don't set Transfer-Encoding: chunked on 304 responses by <a href="https://github.com/Yanhu007"><code>@Yanhu007</code></a> in <a href="https://redirect.github.com/elazarl/goproxy/pull/770">elazarl/goproxy#770</a></li> <li>docs: add missing godoc comments to exported symbols by <a href="https://github.com/scovl"><code>@scovl</code></a> in <a href="https://redirect.github.com/elazarl/goproxy/pull/768">elazarl/goproxy#768</a></li> <li>http: forward upstream response trailers by <a href="https://github.com/0b01"><code>@0b01</code></a> in <a href="https://redirect.github.com/elazarl/goproxy/pull/773">elazarl/goproxy#773</a></li> <li>Remove insecure skip verify from origin transport by <a href="https://github.com/ErikPelli"><code>@ErikPelli</code></a> in <a href="https://redirect.github.com/elazarl/goproxy/pull/774">elazarl/goproxy#774</a></li> <li>Avoid chunked response when there is http.NoBody by <a href="https://github.com/ErikPelli"><code>@ErikPelli</code></a> in <a href="https://redirect.github.com/elazarl/goproxy/pull/776">elazarl/goproxy#776</a></li> <li>fix(https): close client connection when target connection errors by <a href="https://github.com/wucm667"><code>@wucm667</code></a> in <a href="https://redirect.github.com/elazarl/goproxy/pull/779">elazarl/goproxy#779</a></li> <li>fix: restore examples module health and clarify sample apps by <a href="https://github.com/Thiago-Tertuliano"><code>@Thiago-Tertuliano</code></a> in <a href="https://redirect.github.com/elazarl/goproxy/pull/780">elazarl/goproxy#780</a></li> <li>fix: append headers instead of overwriting when keepDestHeaders is true by <a href="https://github.com/Yanhu007"><code>@Yanhu007</code></a> in <a href="https://redirect.github.com/elazarl/goproxy/pull/771">elazarl/goproxy#771</a></li> </ul> <h2>New Contributors</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/elazarl/goproxy/commit/6225cd309d7c0e201659f1e00086b12fdae62df2"><code>6225cd3</code></a> Use Go standard library to check port (<a href="https://redirect.github.com/elazarl/goproxy/issues/795">#795</a>)</li> <li><a href="https://github.com/elazarl/goproxy/commit/5e4406819eb880480bfe8be39e5c06c161e96ad5"><code>5e44068</code></a> HTTP/2 MITM Full Support (<a href="https://redirect.github.com/elazarl/goproxy/issues/785">#785</a>)</li> <li><a href="https://github.com/elazarl/goproxy/commit/a4bf4321f461a060a8c55d371ae3cfa747d561d5"><code>a4bf432</code></a> Stream MITM response bodies (<a href="https://redirect.github.com/elazarl/goproxy/issues/794">#794</a>)</li> <li><a href="https://github.com/elazarl/goproxy/commit/3f0ac0b322e30aff226ea2ce9f4114c7a5585ff4"><code>3f0ac0b</code></a> Fix unexpected scheme edge case in MITM (<a href="https://redirect.github.com/elazarl/goproxy/issues/793">#793</a>)</li> <li><a href="https://github.com/elazarl/goproxy/commit/d435b12bc2fd1ecae5c03a39fdd452a43e36be00"><code>d435b12</code></a> Fix headers overwrite when there are no trailers (<a href="https://redirect.github.com/elazarl/goproxy/issues/791">#791</a>)</li> <li><a href="https://github.com/elazarl/goproxy/commit/54976310a7923a7526777f9eb0a3fc0f4d625ffc"><code>5497631</code></a> Remove redundant certificate Leaf set starting from Go 1.23 (<a href="https://redirect.github.com/elazarl/goproxy/issues/789">#789</a>)</li> <li><a href="https://github.com/elazarl/goproxy/commit/5ba11e8846d7c139c0404fcc47099ef8dc7375c2"><code>5ba11e8</code></a> fix(https): coalesce the MITM response head into a single write (<a href="https://redirect.github.com/elazarl/goproxy/issues/787">#787</a>)</li> <li><a href="https://github.com/elazarl/goproxy/commit/636207d4c044d260140a1f7a6f13efb609dbadc0"><code>636207d</code></a> fix: append headers instead of overwriting when keepDestHeaders is true (<a href="https://redirect.github.com/elazarl/goproxy/issues/771">#771</a>)</li> <li><a href="https://github.com/elazarl/goproxy/commit/6584eeeb52783bbb3ef0ca44c6edc3241e65bc9d"><code>6584eee</code></a> fix: restore examples module health and clarify sample apps (<a href="https://redirect.github.com/elazarl/goproxy/issues/780">#780</a>)</li> <li><a href="https://github.com/elazarl/goproxy/commit/038e3b90031f25eead7d60a7db162de131321fe7"><code>038e3b9</code></a> fix(https): close client connection when target connection errors (<a href="https://redirect.github.com/elazarl/goproxy/issues/779">#779</a>)</li> <li>Additional commits viewable in <a href="https://github.com/elazarl/goproxy/compare/v1.8.0...v1.9.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/elazarl/goproxy&package-manager=go_modules&previous-version=1.8.0&new-version=1.9.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-11 11:14:42 +00:00
Michael Suchacz	2e5353bde7	feat: add built-in Browser tab for agent-browser (#27910 ) Adds a built-in Browser tab to the Agents page right panel, alongside the built-in Terminal and Desktop tabs, when the chat's bound agent has an app with the well-known slug `agent-browser`. The tab shows only while the app is embeddable and its health is `healthy` (or `disabled`, for templates without a healthcheck), so it appears and disappears live as the daemon comes up or goes down. The iframe stays mounted across tab switches to preserve session state. To avoid duplicates, the generic Add Tab menu and persisted workspace-app tabs now exclude the `agent-browser` app. Detection uses the existing `coder_app` slug and healthcheck signals already present in the workspace data model. The workspace watch handler compares the agent app fields the chat UI consumes, so health transitions propagate without re-render churn on every heartbeat. On the backend, the chat `execute` tool now exports `AGENT_BROWSER_SESSION=<chat id>` on every process it starts. agent-browser resolves its default session from that variable, so browser automation from each chat lands in its own isolated session (named by the chat id in the embedded dashboard) instead of a shared default browser. > Mux created this PR on Mike's behalf.	2026-08-11 12:49:12 +02:00
Jaayden Halko	5bdabc95c8	fix(codersdk/licenses.go): read trial claim instead of misspelled trail (#28014 ) ## What this fixes `codersdk.License.Trial()` looked up the JWT claim `"trail"` (a typo) instead of `"trial"`, the actual claim name set by license issuance (`enterprise/coderd/license/license.go`). Since no license contains a `"trail"` claim, the method always returned `false`. The only consumer is `coder licenses list` (via `cli/cliutil/license.go`), so the CLI never reported a license as a trial even when it was one. The web UI is unaffected because it reads `claims.trial` directly. ## Changes - Read the `"trial"` claim in `License.Trial()`. ## Testing - `go build` / `go vet` on `codersdk` and `cli/cliutil`. - `go test -run 'TestLicensesListFake\|TestLicensesListReal' ./enterprise/cli` passes.	2026-08-11 10:18:22 +00:00
Thomas Kosiewski	37b3f11243	fix(coderd): block SSRF in MCP OAuth2 discovery and client registration (#27989 )	2026-08-11 12:02:34 +02:00
Thomas Kosiewski	91d3027498	fix(coderd): enforce Force On MCP server policy on the backend (#27990 )	2026-08-11 12:02:21 +02:00
Thomas Kosiewski	496ed757ed	fix: prevent IP leaks via external chat images (#27362 )	2026-08-11 11:50:56 +02:00
Michael Suchacz	c97f4da3ac	chore: sync fantasy fork with upstream v0.40.0 and openai-go with v3.50.0 (#27981 ) Our fantasy fork had drifted far behind upstream charmbracelet/fantasy (base v0.31.0 vs current v0.40.0). This PR updates the pinned forks after reconciling which fork hacks upstream has fixed and which we still need, and adapts this repo to the new APIs. ## Fork updates - `charm.land/fantasy` -> [coder/fantasy#51](https://github.com/coder/fantasy/pull/51) (merged): `coder_2_33` synced with upstream v0.40.0, pinned at the merge commit `bb10946892ef`. - `github.com/openai/openai-go/v3` -> [coder/openai-go#10](https://github.com/coder/openai-go/pull/10) (merged): `coder/pinned` rebased from v3.16.0 onto upstream v3.50.0 (required by upstream fantasy), pinned at the merge commit `92b5addb22d2`. - `coder/anthropic-sdk-go` pin unchanged; the fantasy fork now tracks the same revision this repo ships. ## Hack reconciliation summary Dropped from our fantasy diff (upstream now has equivalents, often stricter): truncated-stream fail-closed detection, Anthropic EffortXHigh / computer use / thinking effort / thinking display, replay fidelity for signed reasoning and web_search errors, PDF and text documents with sanitized filename titles, refusal finish-reason mapping (upstream also maps Bedrock `content_filtered`/`guardrail_intervened`), gpt-5.5/5.6 Responses routing, the Go 1.25 downgrade, and the openai-go SSE decoder and appendCompact patches. Still fork-only and preserved: OpenAI computer use, OpenAI Responses replay continuity validation, Anthropic pre-4.6 budget-thinking conversion plus explicit thinking disable for effort none, Anthropic RefusalMetadata parsing, Bedrock cross-region inference profile region mirroring, and openai-go deferred body serialization with the WithJSONSet fix. Picked up new upstream features: stream transport retry with in-band SSE error classification, Bedrock expired-credential refresh, per-message cache markers for OpenAI-compatible models, tool panic recovery, extra usage fields in provider metadata, and ClientMetadata on tool results. ## Changes in this repo - `aibridge/intercept/responses`: `ResponseOutputItemUnion.Arguments` became a union type in openai-go v3.50; read function-call arguments via `.OfString` (plus test literal updates). - `coderd/x/chatd/chatdebug`: register the new fantasy `Call.Headers`, `ObjectCall.Headers`, and `ToolResultPart.ClientMetadata` fields in the normalization coverage map (all skipped). - `aibridge/internal/integrationtest`: make the RST test listener drain the request before resetting the connection. The new SDK's write path exposed the previous 1-byte-read race as sporadic `use of closed network connection` failures; the fix holds over 40 consecutive runs. - `go.mod`: rewrite the fork provenance comments to describe the post-sync state. ## Validation - `go build ./...` and `go vet ./...` clean (vet findings identical to base). - Fresh (`-count=1`) runs of `./coderd/x/chatd/...`, `./aibridge/...`, `./coderd/aibridged/...`, `./coderd/database/db2sdk/`: 37 packages pass. - `TestClientAndConnectionError` stress-tested 40x clean. - Both fork PRs have green CI. > Mux acted on Mike's behalf to create this PR.	2026-08-11 11:20:05 +02:00
Jake Howell	b3acf7f75a	refactor(site): migrate organization settings form off MUI (#27718 ) > 🤖 This PR was modified by Coder Agents on behalf of Jake Howell. Migrates the organization settings info form from MUI TextField to shared FormField/Input/Textarea patterns, and splits the page view into focused section components so info, workspace sharing, and delete are no longer one monolithic file. Behavior is unchanged; this is structure and component migration only. - Replace MUI TextField with FormField for slug and display name, plus a Textarea for description - Extract OrganizationInfoForm, WorkspaceSharingSection, and DeleteOrganizationSection - Move sharing dialog Storybook coverage onto WorkspaceSharingSection	2026-08-11 01:35:12 +00:00
McKayla はな	efd5ce3668	test: fix failing storybook stories (#27674 )	2026-08-10 17:03:28 -06:00
Atif Ali	b781be0fa2	docs: refresh JFrog Artifactory integration guide for SaaS (#28005 ) ## Summary Refreshes the JFrog Artifactory integration guide to cover JFrog SaaS. The JFrog-OAuth section previously implied the module was self-hosted only and mixed the SaaS and self-hosted setup into one ambiguous step. ## Changes - JFrog-OAuth: State the module works with both JFrog SaaS and self-hosted (on-premises) Artifactory. - JFrog-OAuth: Split setup into a SaaS UI flow (External Applications > Custom Integration) and a self-hosted Helm integration-template flow. - JFrog-OAuth: Update the module example to `registry.coder.com/coder/jfrog-oauth/coder`, `1.2.4`. - JFrog-Token: Update the stale example to `registry.coder.com/coder/jfrog-token/coder`, `1.2.2`. ## Validation - `markdownlint-cli2` passes on the file. - No emdash/endash. Preview: https://coder.com/docs/@matifali/jfrog-oauth-docs-saas/admin/integrations/jfrog-artifactory#jfrog-oauth Related to the registry README refresh in coder/registry#1040. 🤖 Generated with [Claude Code](https://claude.ai/code) > 🤖 This PR was created with the help of Coder Agents, and needs a human review. 🧑‍💻	2026-08-11 02:18:39 +05:00
Andrew Aquino	87fdd2b59b	feat(site): add server-side search and pagination for groups page (#27994 ) Repeat of #27604, which I had mistakenly manually merged into #27603, instead of letting Graphite handle it after #27603 merges into main. Reattempting with GitHub stacks now instead of Graphite! See #27604 for details/review.	2026-08-10 13:23:14 -07:00
Andrew Aquino	6e07e2610f	feat: add paginated API endpoint for groups (#27603 ) backend-only changes from #27271; see that PR for summary of changes + implementation details	2026-08-10 13:23:14 -07:00
McKayla はな	ddb2799009	fix: hide the favorite button for workspaces you don't own (#28000 )	2026-08-10 14:15:57 -06:00
McKayla はな	09b0d8e108	chore: update stale Chromatic comments (#27714 )	2026-08-10 14:15:28 -06:00
McKayla はな	b29af7f64a	fix: improve layout of CLI install page (#27998 )	2026-08-10 14:03:04 -06:00
Jeremy Ruppel	baa1e3a6c5	fix(site): make delete dialog confirmation text use primary color (#28002 ) ## Summary In the workspace delete confirmation dialog, the text typed into the "Workspace name" confirmation field rendered in the same secondary color as the placeholder, making it hard to distinguish entered text from the placeholder. The shared `Input` component uses `text-inherit`, so it picked up the dialog description's secondary text color. This sets the confirmation input's text to `text-content-primary` (white on dark), while the placeholder remains `text-content-secondary`. ## Changes - `WorkspaceDeleteDialog.tsx`: add `className="text-content-primary"` to the confirmation `Input`. ##### Before https://github.com/user-attachments/assets/88dbb230-feb6-416c-b516-9cc92950a0b8 ##### After https://github.com/user-attachments/assets/74296b9e-cbdf-40fe-ba3d-6fbcf5d4a9d5 --- _This PR was generated by Coder Agents on behalf of @jeremyruppel._	2026-08-10 15:57:51 -04:00
Steven Masley	053b38944d	fix(coderd): render collected_at as UTC RFC3339 in the agent metadata aggregate (#27991 ) Follow-up to #27934; this fix was pushed to the branch after the squash-merge and missed it. `jsonb_build_object` renders timestamptz in the session `TimeZone`, which Coder never pins, and `collected_at` defaults to year 1 until the agent's first report. On a non-UTC Postgres session a registered-but-never-collected item renders with an LMT second-offset (even `BC`, e.g. `0001-12-31T19:03:58-04:56:02 BC`), which Go's RFC3339 parsing rejects - a 500 for the entire list page whenever `include_agent_metadata` is used. - `to_char(... AT TIME ZONE 'UTC', ...)` pins the rendering; never-collected items round-trip as Go's zero time. - The test now runs against a named-zone database (`dbtestutil.WithTimezone("America/Caracas")`) and requests a registered but never-collected key; it reproduces the 500 without the fix. Also contains the failure mode Go-side: an unparsable aggregate now degrades to missing metadata for that workspace (with a warning log) instead of failing the entire page. The SQL fix prevents the known cause; the containment covers any future one. The test still catches regressions because it asserts the metadata values, not just a 200. --- Authored by Coder Agents on behalf of @Emyrk.	2026-08-10 14:53:48 -05:00
J. Scott Miller	66b065323b	feat: log rate-limited external auth token validation (#26754 ) When `ValidateToken` keeps a token because the external auth validation endpoint was rate-limited (a `403` with rate-limit headers or a `429`), it returns `valid=true` without provider confirmation. Previously this happened silently, so operators couldn't tell a provider-confirmed token from one kept optimistically during a rate limit. This adds a `Logger` to `externalauth.Config` and emits a `Warn` (with `provider_id`, `provider_type`, `status_code`, and `reason`) on those rate-limit branches. It also adds a `coderd_oauth2_external_requests_rate_limited_total{name, source, status_code}` counter, incremented in the instrumented round tripper whenever a provider returns a rate-limited response. The rate-limit detection is the shared `xhttp.IsRateLimited` (in `coderd/util/xhttp`), used by both the tripper and `ValidateToken` so the metric and the validation decision share one definition; no extra wiring is needed since `ValidateToken` already routes through the instrumented client with `source="ValidateToken"`. One deliberate behavioral change rides along: rate-limit detection now also recognizes the unprefixed `RateLimit-Remaining` header (GitLab, and the IETF draft rate-limit headers), so a `403` with `RateLimit-Remaining: 0` is treated as optimistically valid where it was previously treated as revoked. All other valid/invalid decisions are unchanged. `TestValidateToken` asserts the warning's fields on the rate-limited cases and no warning for revocations, `401`, and confirmed responses; `promoauth` and `xhttp` tests cover the detector and the new counter. <details> <summary>Manual testing</summary> The signals fire on the external-auth status check (`GET /api/v2/external-auth/{id}`), which calls `ValidateToken`. To force a rate-limited response, point a provider's `validate_url` at a mock that returns the rate-limit shape: 1. Run a mock returning `429` on one path and `403` + `X-RateLimit-Remaining: 0` on another. 2. Start `coder server` with `--prometheus-enable` and external auth providers whose `validate_url` point at those mock paths (e.g. `CODER_EXTERNAL_AUTH_0_VALIDATE_URL=http://127.0.0.1:5599/429`). 3. Create a stored link, either complete the OAuth flow, or insert a row into `external_auth_links` with a future `oauth_expiry` (token contents are irrelevant; the mock rejects regardless). 4. `curl` the status endpoint with a session token, then check: - coderd logs for the `Warn` (`reason=status_code` for `429`, `reason=rate_limit_headers` for `403`), - the metrics endpoint for `coderd_oauth2_external_requests_rate_limited_total{...,status_code="429"\|"403"}`. Notes: `scripts/testidp -429` only rate-limits `/oauth2/userinfo`, not the `/external-auth-validate/...` path, so it does not exercise this; use a mock `validate_url`. The default Prometheus port `2112` may already be taken on dogfood workspaces, set `CODER_PROMETHEUS_ADDRESS` to a free port. </details> 🤖 Generated with the help of Coder Agents on behalf of @jscottmiller.	2026-08-10 14:43:16 -05:00
Bobby Ho	bd693ad4ae	fix: raise test-go-pg timeout budget, lower macOS parallelism (#27997 ) `test-go-pg (macos-latest)` has recurred three times on [coder/internal#1365](https://github.com/coder/internal/issues/1365), most recently as the `cli` package hitting its own `go test -timeout 20m` after several minutes of runner-side scheduling delay, which marks hundreds of in-flight subtests as failed instead of surfacing the actual cause. Raise `GOTEST_FLAGS -timeout` from `20m` to `25m` and the matching `timeout-minutes` on every job that shares it (`test-go-pg`, `test-go-pg-17`, `test-go-race-pg` in `ci.yaml`; `flake_go` in `flake-go.yaml`; `test-go-pg` in `nightly-gauntlet.yaml`) from `25` to `30`, preserving the 5-minute margin that lets `go test`'s own timeout fire before GitHub cancels the job and produce a goroutine dump for a genuine hang. Also lower macOS `test-parallelism-tests` from `16` to `8`, matching Linux, to test whether the 2x core oversubscription is contributing scheduler contention. Windows keeps `16`; nothing in the current evidence implicates it. This is a mitigation, not a confirmed root cause; the runner scheduling delay itself is still unexplained. Refs coder/internal#1365 ## AI disclosure Per [AI Contribution guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING): this PR was primarily authored by Claude Code, directed by @BobbyHo, based on triage of the linked ticket's CI-flake-bot comments and a review of the current `Makefile`/`ci.yaml`/`flake-go.yaml`/`nightly-gauntlet.yaml` timeout configuration. Verification: - `make lint/actions/actionlint` and `make lint/actions/zizmor` both pass clean on the three edited workflow files. - `make pre-commit` passes (includes `make gen`, `make fmt`, `make lint`, and a full local build). - All three edited workflow YAMLs parse (`ruby -ryaml`) and `make -n test TEST_PACKAGES="./cli/..."` confirms `GOTEST_FLAGS` resolves to `-timeout 25m` as intended. - This is a config-only change (no application code touched); the intended effect can only be confirmed by watching real `test-go-pg` (macOS) runs on this PR and on `main` after merge, since the underlying runner-stall failure is intermittent.	2026-08-10 12:29:05 -07:00
Bobby HoandClaude Opus 5	16c58770f8	feat: constrain the OAuth2 client type column (#27931 ) Extracted from #27873 so the schema change can be reviewed for migration safety on its own. #27873 will rebase onto this. `client_type` decides whether the token endpoint validates a client secret at all, and the column accepts any text: nullable, no `CHECK`, no enum. No Go path can write a bad value today, and `IsPublic` fails closed on anything unrecognized, so the read side is safe. What the schema still permits is the problem: a future migration writing `'public'` onto a row that holds a secret turns off client authentication for that app with nothing to catch it, no constraint, no log, no audit entry, no test. `000565` adds `CHECK (client_type IN ('confidential', 'public'))` and `NOT NULL`. The `UPDATE` ahead of it should touch zero rows, since migration `000344` added the column with a default of `'confidential'` and backfilled with `COALESCE`; it is there so `SET NOT NULL` cannot fail on an unexpected row. Both `ALTER`s take `ACCESS EXCLUSIVE` and scan a table holding one row per registered OAuth2 client, so the lock is brief. ## The second migration, and why it aligns the way it does Two columns describe the same fact and can currently contradict each other. `token_endpoint_auth_method` is the client's own declaration: registered client metadata under RFC 7591 §2, where `"none"` is defined to mean the client is public and has no secret. `client_type` is Coder's derived copy, and it is what the token endpoint enforces on. RFC 7591 defines no `client_type` metadata field; the column exists only as a denormalization. Registration used to persist the declaration verbatim while hardcoding `client_type` to `'confidential'`, so rows exist declaring `"none"` on a client stored confidential that was issued, and still requires, a real secret. A client that reads its own metadata and believes it is public will drop that secret and stop being able to exchange codes. `000566` aligns the declaration to what is enforced, not the reverse. Deriving enforcement from the declaration would reclassify every such client as public and stop requiring the secret it holds, which is a silent authentication downgrade. The down migration is deliberately empty: the previous values are not recorded, and restoring them would only reinstate metadata that tells a client to authenticate in a way the server rejects. ## Application changes `SET NOT NULL` changes the generated field from `sql.NullString` to `string`, so the three write sites are updated to match. That is the entire application diff and no behavior depends on it. Refs https://linear.app/codercom/issue/ENG-3029/oauth2-support-public-client --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-10 10:49:02 -07:00
Nick Vigilante	2f34e1abd0	ci: add scheduled audit-docs-paths workflow (#27245 ) ## What Adds `.github/workflows/audit-docs-paths.yaml`, a scheduled workflow that runs the docs-URL drift audit (`site/scripts/audit-docs-paths.mjs`, added in #25740) on a weekly cron and on demand, so drift is caught automatically instead of only when someone runs the script by hand. Scheduling was suggested by @bpmct on #25740. ## How it works - Triggers: `schedule` (weekly, Monday 09:00 UTC — same cadence as `weekly-docs`) and `workflow_dispatch`. - Checks out both repos: `coder/coder` (root) and `coder/coder.com` (into `coder.com/`, read with the `cdrci` CI-bot token). The audit covers references in both repos. - Runs the audit with absolute `--roots` (required, otherwise the report can't classify findings by repo). - Always uploads the dated report as the `audit-docs-paths-report` artifact and writes it to the run summary. - On findings: opens or updates a single deduplicated tracked issue with the report, and fails the run (red check). On a clean run: closes that issue. ## Enabling (dormant until then) The audit reads coder/coder.com, a private repo, which the default `GITHUB_TOKEN` can't read, so the coder.com checkout uses the existing `cdrci` CI-bot token (`secrets.CDRCI_GITHUB_TOKEN`) — already used for cross-repo checkouts in `release.yaml`/`tag-and-release.yaml`, and `cdrci` is a coder.com collaborator (verified). No new App to stand up. The job is gated behind `vars.AUDIT_DOCS_PATHS_ENABLED` so it merges dormant and can be validated before going live. To turn it on: 1. Set `vars.AUDIT_DOCS_PATHS_ENABLED = 'true'`. 2. Run once via `workflow_dispatch` to confirm the end-to-end run. ## Also in this PR Removes the dormant `audit-docs-paths` job embedded in `weekly-docs.yaml` (added in #25740, gated off pending the same credential). The new dedicated workflow supersedes it; the `weekly-docs.yaml` diff is exactly that job removal. ## Validation - `actionlint -shellcheck= -ignore set-output` passes locally; PR `title`, `lint-actions`, and `lint-docs` are green. - Credential check: `cdrci` is a collaborator on coder/coder.com (read access confirmed); `secrets.CDRCI_GITHUB_TOKEN` already exists in this repo. (Note: `cdrci2` is not a coder.com collaborator, so an earlier `CDRCI2_` attempt was corrected to `CDRCI_`.) - Pre-flight audit against current `main` (both repos): 0 findings — 148 `/docs/` redirect rules indexed; 1846 coder/coder + 432 coder.com TS/TSX files scanned. So a `workflow_dispatch` on `main` today passes green with no issue filed (the "empty audit succeeds" criterion). The failure path can be checked by injecting a stale path on a throwaway branch. ## Decisions for review - Mechanism* = tracked issue + failed check + artifact ("both" from the issue). Easy to narrow to issue-only or fail-only. - Reused `AUDIT_DOCS_PATHS_ENABLED` and removed the embedded job rather than adding a second gate. - Named the file `.yaml` to match the repo's other docs workflows (the issue text said `.yml`). Linear: https://linear.app/codercom/issue/DOCS-366	2026-08-10 13:40:44 -04:00
Michael Suchacz	ad100452d4	fix(aibridge): use latest streaming chat usage instead of cross-chunk sum (#27967 ) ## Problem CODAGT-906: chats using OpenAI-compatible backends (e.g. poolside) through the AI Bridge persist token usage inflated 105x-640x, which falsely triggers automatic chat compaction on every turn. The chat-completions streaming interceptor summed usage across every SSE chunk of one upstream stream and rewrote each relayed usage-bearing chunk with that running sum. Spec-compliant OpenAI emits usage once (final chunk with `stream_options.include_usage`), so the sum equals the final value. vLLM-style backends emit cumulative usage snapshots on every chunk, so the relayed final usage becomes roughly `N_chunks x prompt_tokens` (e.g. 417,012 persisted for a ~6,000-token context). chatd persists that value per assistant message and its compaction trigger reads it as context occupancy. ## Fix Track the latest usage-bearing chunk's raw usage (last-wins) in the stream processor, updating only when a chunk actually carries usage so a trailing usage-less chunk cannot zero it. `marshalChunk` relays that value and `recordTokenUsage` records the same value, unifying relayed and recorded usage. Last-wins is correct for both shapes: a single final usage chunk, and cumulative snapshots where each snapshot already includes all prior tokens. Per-iteration semantics are unchanged: each tool-loop iteration has its own processor, and the final iteration's usage is what the client sees. ## Tests - `TestStreamProcessorUsage` (internal): cumulative snapshots with a trailing usage-less chunk, and the spec-compliant final-only shape; asserts relayed and recorded usage equal the last snapshot. - New txtar fixture `streaming_cumulative_usage_injected_tool.txtar` with per-chunk cumulative usage plus an injected tool call; asserts client-visible final usage through the full interceptor. - Red-green verified: with the fix reverted, the internal test reports zeroed usage (trailing chunk overwrite) and the fixture test reports 18000 summed prompt tokens instead of 6000. The blocking (non-streaming) path deliberately keeps its cross-iteration summation for external clients and is untouched. Remote dogfood UAT validated chat streaming, tool calls, plausible usage numbers, and zero spurious compactions. > Mux acted on Mike's behalf to author this change.	2026-08-10 19:32:24 +02:00
Susana Ferreira	5efa7abe7d	fix: only write AI model prices that changed (#27923 ) Previously, the AI Gateway price seeder rewrote every row of `ai_model_prices` on each server start, because `ON CONFLICT` fires on a key conflict rather than on a value difference. `updated_at` therefore recorded when the server last restarted rather than when a price last changed. Guard the `DO UPDATE` branch so a conflicting row is only rewritten when one of its four prices differs. The comparison uses `IS DISTINCT FROM` rather than `<>` because the price columns are nullable, and `<>` yields NULL when either side is NULL, which would skip the update and leave a stale price in place. Related to https://linear.app/codercom/issue/AIGOV-567/experimental-cli-command-to-set-prices-for-unpriced-ai-models > [!NOTE] > Initially generated by Claude Opus 5, modified and reviewed by @ssncferreira	2026-08-10 16:33:48 +01:00
Susana Ferreira	27414788f7	chore: use 'AI spend' and 'approximate' in budget UI (#27977 ) The "AI budget" column shows spend against the configured limit, not the limit itself, so "AI spend" describes what it actually displays. Renamed in both the groups table and the group members table. Also replaces "estimated" with "approximate" in the surrounding spend copy, which reads more plainly as a signal that the amount isn't exact. The user dropdown now keeps the date range on a single line, so the label wraps above it instead of the dates splitting across two lines. Before: <img width="250" height="89" alt="Screenshot 2026-08-10 at 12 55 55" src="https://github.com/user-attachments/assets/428f7032-0ead-44ac-987d-563e20c97d12" /> After: <img width="248" height="92" alt="Screenshot 2026-08-10 at 12 57 09" src="https://github.com/user-attachments/assets/cf0704ba-d0ab-4132-b207-a15ab2ea4f37" /> Related to internal slack thread: https://codercom.slack.com/archives/C096PFVBZKN/p1786051712464009 > [!NOTE] > Initially generated by Claude Opus 5, modified and reviewed by @ssncferreira	2026-08-10 16:08:06 +01:00
Thomas Kosiewski	84f4a8bb17	fix(site/src): prevent protocol-relative login redirects (#27363 )	2026-08-10 15:35:06 +02:00
Steven Masley	9a57dfa642	feat: include agent metadata in workspace list responses (#27934 ) Closes #27933. Related: #27897 (single-agent GET). Agent metadata is only readable via a per-agent watch stream, so reading it across N workspaces costs N+1 requests. This adds a batch read to the list endpoint: ```text GET /api/v2/workspaces?q=param:"pool=demo" include_agent_metadata:task_status ``` - New `include_agent_metadata` search key, repeatable and key-scoped. It expands the response, it does not filter workspaces. - `GetWorkspaces` aggregates the requested keys as JSON behind a `CASE`: without opt-in the response is unchanged and the subquery never runs. Runs only for the returned page, inside the same authorized query. - Agents in the response gain `metadata` (`[]codersdk.WorkspaceAgentMetadata`, `omitempty`), mapped by the `workspace_agent_id` each element carries. The collection script is omitted; it can be long. - `codersdk.WorkspaceFilter` gains `IncludeAgentMetadata []string`. - No wildcard, no schema change, no migration. --- Authored by Coder Agents on behalf of @Emyrk.	2026-08-10 08:13:32 -05:00
Matt Vollmer	a3a51228ee	chore(site): remove Beta tag from agents navigation (#27986 ) ## Summary Removes the `Beta` feature stage badge from the `/agents` page navigation: - `ChatsPanel.tsx`: removed the badge from the desktop left sidebar header - `AgentPageHeader.tsx`: removed the badge from the mobile top header Both instances rendered `<FeatureStageBadge contentType="beta" size="xs" />` next to the Coder product logo. The `FeatureStageBadge` imports were removed as they are no longer used in these files. ## Sidebar summary - Removed Beta badge from desktop sidebar (`ChatsPanel.tsx`) - Removed Beta badge from mobile header (`AgentPageHeader.tsx`) - Removed unused `FeatureStageBadge` imports from both files - No behavioral or logic changes, badge-only removal --- PR generated with Coder Agents	2026-08-10 08:44:56 -04:00
Jakub Domeracki	8c2f7adeb1	revert: "fix: markdown rendering improvements" (#27979 ) This reverts commit `07f79af65b` ("fix: markdown rendering improvements"). The revert was applied cleanly with `git revert` and restores the notification rendering pipeline to its prior state, including: - `coderd/notifications/dispatch/smtp.go` and `smtp/html.gotmpl` - `coderd/notifications/notifier.go` and `render/gotmpl.go` - Removal of `coderd/notifications/render/sanitize_test.go` and `smtp_internal_test.go` additions - Regenerated SMTP golden templates under `coderd/notifications/testdata/` `go build ./coderd/notifications/...` passes on the reverted tree. --- _This PR was generated by Coder Agents on behalf of @jdomeracki-coder._	2026-08-10 12:58:01 +02:00
Marcin Tojek	cfeae56bed	chore(docs): update release docs for v2.35.4 (#27972 ) Automated docs update for v2.35.4 release. Created by `releasetui`.	2026-08-10 11:53:47 +02:00
Michael Suchacz	95e8b71d03	fix(coderd): start test AI bridge after config in automatic title tests (#27971 ) Fixes the reopened flake tracked in CODAGT-876 / coder/internal#1629. ## Problem The Aug 10 recurrence was not the previously fixed subtests failing again: the nightly-gauntlet macos run ([job log](https://github.com/coder/coder/actions/runs/31355808516/job/93355150162)) flaked in the sibling test `TestPostChats_AutomaticTitleGenerationPasteOnly`, which the flake investigator matched to the existing issue. Both `TestPostChats_AutomaticTitleGeneration*` tests still used `newChatClientWithAPI`, which starts the in-process AI Gateway daemon before the test creates its provider/model config. The daemon's synchronous initial provider load therefore sees zero providers, and route availability depends on the asynchronous pubsub-driven reload racing the one-shot automatic title generation that `CreateChat` kicks off. When the reload loses (initial load at `.575` with `provider_count=0`, title request at `.907` hitting `route not supported`, reload landing at `1.029`), the title candidate fails without retry and the test times out waiting for the `propose_title` request. ## Fix Convert both tests to the pattern #27564 established for the `TestRegenerateChatTitle`/`TestProposeChatTitle` subtests: `newChatClientWithoutAIBridge`, create the model config, then `aibridgedtest.StartTestAIBridgeDaemon`, so the daemon's synchronous initial load already contains the route. The existing `NoPubsubDelivery` subtest guards that initial-load invariant, so no new guard test is added. ## Validation - Deterministic red-green via the isolated-pubsub technique: old ordering with the pubsub leg removed reproduces the exact CI signature (`provider_count=0`, `route not supported`, timeout at the `titleRequested` wait); the new ordering passes with the pubsub leg still removed, proving the synchronous initial load alone provides the route. - `go test ./coderd -run 'TestPostChats_AutomaticTitleGeneration' -count=10` - `go test ./coderd -run 'TestRegenerateChatTitle\|TestProposeChatTitle' -count=1` - `make lint` and `make pre-commit` via hooks. > Opened by Mux on Mike's behalf.	2026-08-10 11:37:59 +02:00
Jakub Domeracki	07f79af65b	fix: markdown rendering improvements Improvements to markdown rendering in notification emails: - More consistent escaping of values interpolated into notification templates - Stricter link handling in the notification email renderer, scoped to the notification rendering path - HTML escaping of values interpolated into the outer email template - Expanded unit and end-to-end coverage of the notification rendering pipeline - `make gen` run to regenerate golden files for SMTP and webhook notification templates	2026-08-10 10:45:19 +02:00
Danielle Maywood	192842c8f2	fix(site/src): treat chat deleted watch events as archive instead of eviction (#27921 )	2026-08-10 09:29:38 +01:00
Danielle Maywood	19fdc23d63	fix(site/src): fan chat message upserts out to every containing page (#27912 )	2026-08-10 09:08:05 +01:00
Marcin Tojek	0414948454	chore(docs): update release docs for v2.34.8 (#27970 ) Automated docs update for v2.34.8 release. Created by `releasetui`.	2026-08-10 09:52:49 +02:00
Jake Howell	bab9963a9a	fix(site): defer external app API key generation to on-click (#27907 ) > 🤖 This PR was written by Coder Agents on behalf of Jake Howell. Resolves [DEVEX-460](https://linear.app/codercom/issue/DEVEX-460/defer-api-key-generation-in-useapplink-to-on-click-instead-of-page). ## Problem `useAppLink` minted a session key on mount via a `useQuery`: ```ts const { data: apiKeyResponse } = useQuery({ ...apiKey(), enabled: isExternalApp(app) && needsSessionToken(app), }); ``` Whenever any page mounted `useAppLink` for an external app that embeds `$SESSION_TOKEN` in its URL (JetBrains Gateway, Coder Desktop, etc.), it fired `POST /api/v2/users/me/keys` on render, even if the user never clicked the link. Each call minted a fresh session key and produced a `created token` audit-log entry. Simply navigating the dashboard generated a stream of `created token` entries with no real connection activity. This is the follow-up to #22318 (AIGOV-24), which only fixed the built-in VS Code / VS Code Insiders buttons in `WorkspacesTable`. ## Change Mirror the on-click minting pattern from #22318, applied to the shared `useAppLink` hook: - Replace the eager `useQuery(apiKey())` with a `useMutation(() => API.getApiKey())` that runs only when the user clicks a token-bearing external app. `onClick` mints the key, builds the final URL, and navigates via `location.href` (these are always custom-protocol, non-HTTP external apps). - The returned `href` no longer embeds a token; the hook owns opening for token apps. - Replace the `hasToken` field with `isLoading` (mint in-flight) and update call sites so token apps are always clickable, with a loading affordance while a key is being minted. - `TaskApps` external-app menu items now render an anchor with the hook's `onClick` (instead of a `RouterLink` that bypassed it), so the deferred mint runs there too. No API key is minted until the user actually opens an external app. ## Affected call sites - `site/src/modules/apps/useAppLink.ts` (core change) - `site/src/modules/resources/AppLink/AppLink.tsx` - `site/src/pages/AgentsPage/components/WorkspacePill.tsx` - `site/src/pages/TaskPage/TaskApps.tsx` ## Testing Added Storybook interaction tests (`play` functions) in `AppLink.stories.tsx` that assert the fix directly: - `ExternalAppDefersSessionToken`: a token-bearing external app mints no key on render, and mints exactly one on click. - `ExternalAppWithoutSessionTokenNeverMints`: an external app without `$SESSION_TOKEN` never mints a key, even on click. Also verified: - `tsc -p .` (frontend typecheck) passes - `biome check` on changed files passes - `vitest` for `AppLink` (incl. new stories), `apps`, `WorkspacePill`, `TaskApps`, and `AppStatuses` stories/tests pass - pre-commit hook (gen/fmt/lint/build) passes ## Manual verification checklist (recommended before merge) - With an external app that uses `$SESSION_TOKEN` (e.g. JetBrains Gateway), open DevTools → Network filtered on `users/me/keys`, reload `/workspaces` and the workspace detail page, and confirm no `POST` fires on render. - Confirm a `POST` fires only when the app link is clicked, and the app opens correctly.	2026-08-10 14:44:35 +10:00
dependabot[bot]	1e578a69a4	chore: bump github.com/go-git/go-git/v5 from 5.19.1 to 5.19.2 (#27950 ) Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.19.1 to 5.19.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-git/go-git/releases">github.com/go-git/go-git/v5's releases</a>.</em></p> <blockquote> <h2>v5.19.2</h2> <h2>What's Changed</h2> <ul> <li>build: Update module golang.org/x/crypto to v0.52.0 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/2150">go-git/go-git#2150</a></li> <li>build: Update module github.com/go-git/go-git/v5 to v5.19.1 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/2141">go-git/go-git#2141</a></li> <li>build: Update module golang.org/x/net to v0.55.0 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/2152">go-git/go-git#2152</a></li> <li>git: Worktree: Add stores index entires with backslashes on Windows by <a href="https://github.com/joshblum"><code>@joshblum</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2262">go-git/go-git#2262</a></li> <li>storage: dotgit, reject path traversal in reference names by <a href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2254">go-git/go-git#2254</a></li> <li>build: Update module golang.org/x/net to v0.56.0 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/2267">go-git/go-git#2267</a></li> <li>build: Update module golang.org/x/text to v0.39.0 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/2268">go-git/go-git#2268</a></li> <li>[v5] git: worktree, make the filesystem wrapper a symlink-safe boundary by <a href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2277">go-git/go-git#2277</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.19.1...v5.19.2">https://github.com/go-git/go-git/compare/v5.19.1...v5.19.2</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-git/go-git/commit/3eeb238da61eb9c7a324f3ee04f990ce89175642"><code>3eeb238</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2277">#2277</a> from go-git/checkout-v5</li> <li><a href="https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab"><code>008a78f</code></a> git: worktree, make the filesystem wrapper a symlink-safe boundary</li> <li><a href="https://github.com/go-git/go-git/commit/2263fb5f022dde90b1c2845f028d3e37e161f2b8"><code>2263fb5</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2268">#2268</a> from go-git/renovate/releases/v5.x-go-golang.org-x-t...</li> <li><a href="https://github.com/go-git/go-git/commit/77b76250d93ec83e2c897638d8a3847b1bfaa38d"><code>77b7625</code></a> build: Update module golang.org/x/text to v0.39.0 [SECURITY]</li> <li><a href="https://github.com/go-git/go-git/commit/85ea767be2b2281693e61afe83911e12c86d6eb7"><code>85ea767</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2267">#2267</a> from go-git/renovate/releases/v5.x-go-golang.org-x-n...</li> <li><a href="https://github.com/go-git/go-git/commit/198675a07b3b8f4eb8f51bf188663a13bb0d9e1a"><code>198675a</code></a> build: Update module golang.org/x/net to v0.56.0 [SECURITY]</li> <li><a href="https://github.com/go-git/go-git/commit/4a0e66d555de5f9a30c31e2df64f445f42bd01e7"><code>4a0e66d</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2254">#2254</a> from pjbgf/v5-dotgit-ref-name-containment</li> <li><a href="https://github.com/go-git/go-git/commit/3b306ef83bd05194a30ce820eed7ed61c3084b5f"><code>3b306ef</code></a> storage: dotgit, align reference-name safety with refname_is_safe</li> <li><a href="https://github.com/go-git/go-git/commit/f3d0cc150b39ae1dc47406a5c170464286914610"><code>f3d0cc1</code></a> storage: dotgit, reject path traversal in reference names</li> <li><a href="https://github.com/go-git/go-git/commit/979cfe9c561d3ced778c88d9cde6db3297e6ed1d"><code>979cfe9</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2262">#2262</a> from joshblum/joshblum/to-slash-v5</li> <li>Additional commits viewable in <a href="https://github.com/go-git/go-git/compare/v5.19.1...v5.19.2">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-git/go-git/v5&package-manager=go_modules&previous-version=5.19.1&new-version=5.19.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/coder/coder/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-09 07:42:17 +00:00
Jake Howell	b2cfc4e530	refactor(site): move `Add users` into `<SettingsHeader />` (#27906 ) Move the Add users action into SettingsHeader on the organization Members page and group detail page, matching the Users page layout. It no longer sits inline with the filters. \| Old \| New \| \| --- \| --- \| \| <img width="2934" height="1742" alt="ORGANIZATION_MEMBERS_OLD" src="https://github.com/user-attachments/assets/c09ccb0b-cce5-4b95-a63b-40c42dd2e1ac" /> \| <img width="2934" height="1742" alt="ORGANIZATION_MEMBERS_NEW" src="https://github.com/user-attachments/assets/a20089b7-04f0-47dc-8153-8f5cca8999cf" /> \|	2026-08-08 18:03:43 +10:00
Jake Howell	ad225269aa	refactor(site): redesign `<AppearanceSettingsPage />` (#27722 ) > 🤖 This PR was modified by Coder Agents on behalf of Jake Howell. - Redesign Deployment Appearance settings to the standard two-column settings layout (`HorizontalForm` / `FormSection`) for branding, with announcement banners as a secondary `SettingsHeader` + table section (aligned with OAuth2 apps / AI Governance). - Demui `IconField` and reuse it for Logo URL (URL input, preview, emoji picker); thin `IconPickerField` to wrap the shared component. - Clean up announcement banner create/edit (draft-only until save, page-top preview via portal, shadcn `Switch` / menu icons, empty-state CTA) and clarify Premium paywall copy to cover branding and announcement banners. \| Old \| New \| \| --- \| --- \| \| <img width="2936" height="2666" alt="appearancesettings_old" src="https://github.com/user-attachments/assets/db11950d-2440-412b-a74d-fcf57f2467e9"/> \| <img width="2936" height="2714" alt="appearancesettings_new" src="https://github.com/user-attachments/assets/3f418fb1-7f94-4fd8-bf54-0d63014c6533"/> \|	2026-08-08 18:03:31 +10:00
Danielle Maywood	e751b285ca	chore(site): upgrade pierre diffs to 1.3.3 (#27932 )	2026-08-07 11:38:56 +01:00
Ethan	ee49107ea9	docs: document per-template agents_allowed (#27518 ) Relates to CODAGT-713 Depends on #27517 This updates the Coder Agents platform controls documentation for the per-template `agents_allowed` model. It replaces the deployment-wide allowlist instructions with the Agents allowed controls in AI Settings and template settings, documents that templates allow agents by default, and explains that disabled templates are excluded from `list_templates`, `read_template`, and `create_workspace`. This is the final PR in the stack and aligns the template routing and optimization guidance with the database, API, frontend, cleanup, and CLI changes in the preceding PRs.	2026-08-07 17:23:28 +10:00
Jake Howell	7a9b4250aa	refactor(site): demui `<IconField />` (#27719 ) > 🤖 This PR was modified by Coder Agents on behalf of Jake Howell. Replace MUI `TextField` / Emotion theming in `IconField` with `InputGroup`, `Popover`, and Tailwind. `IconPickerField` already had the demui'd `InputGroup` + `Popover` implementation, so that was ported into the shared `IconField`. Per review feedback, `IconPickerField` is now removed and its call sites (the MCP server, provider, and OAuth app forms) use `IconField` directly.	2026-08-07 09:56:05 +10:00
Samuel Volin	50640063a2	feat: DEVEX-732 premium badging (#27847 ) Premium badging and gating consistency as a OSS user, I want to be upsold to premium, and tastefully Summary Standardize all base-Premium full-page gates and the two named inline notices. Admins see an in-app “Learn about Premium” path; non-admins are told to contact their deployment administrator. * DEVEX-732 * updates for premium docs pages for consistency * updates for premium badging and paywall components * updates implemented uses of premium badge and premiumpaywall \| Before \| After \| \| --- \| ----------- \| \| <img width="1271" height="564" alt="Screenshot 2026-08-04 at 3 02 32 PM" src="https://github.com/user-attachments/assets/027d4bca-3e34-40b2-ad69-28dbaa4a004b" /> \| <img width="1273" height="600" alt="Screenshot 2026-08-04 at 3 26 37 PM" src="https://github.com/user-attachments/assets/321083c0-7a4c-4c7e-a19c-059807018d3b" /> \| \| Before \| After \| \| --- \| ----------- \| \| <img width="1084" height="672" alt="image" src="https://github.com/user-attachments/assets/741e6bd9-93b0-4ae0-97df-027e8aba5716" /> \| <img width="1289" height="622" alt="Screenshot 2026-08-04 at 3 20 07 PM" src="https://github.com/user-attachments/assets/b3a8c169-ca6e-439b-8752-9209131fc097" /> \| \| Before \| After \| \| --- \| ----------- \| \| <img width="1091" height="865" alt="image (1)" src="https://github.com/user-attachments/assets/f7cd92dd-a975-4db0-bc2a-af092ba783ce" /> \| <img width="1268" height="680" alt="Screenshot 2026-08-04 at 3 37 06 PM" src="https://github.com/user-attachments/assets/8af8081a-0ec9-4fd3-921c-470127f2328b" /> \|	2026-08-06 12:13:12 -06:00
Andrew Aquino	baed1455cf	feat(site/src/pages/TemplateBuilder): scroll to module when clicking sidebar row (#27351 ) ## What Clicking a selected module in the right-hand `SelectionSummary` sidebar now jumps to the module settings step and scrolls that module's card into view. Addresses [DEVEX-587](https://linear.app/codercom/issue/DEVEX-587). This is an isolated slice of #27077 (which bundles several unrelated changes); only the "click a module to scroll to it" behavior is included here. ## Changes - `SelectionSummary`: gains an optional `onNavigateModule` prop. When provided, each selected module row renders as an accessible `<button>` (hover + focus-ring) labeled `Configure <name>`; otherwise rows stay non-interactive. - `ModuleSettingsStep`: each module card wrapper gets a stable `id={module-config-<id>}` scroll anchor plus `scroll-mt-24` so the sticky top nav does not cover the title. - `TemplateBuilderPageView`: adds `navigateToModule`, which switches to the module settings step and scrolls the target module into view once it renders. If the module settings step is skipped (no configurable variables), the click is a no-op. - `SelectionSummary.stories`: adds a `NavigateModuleClick` interaction story and updates `WithLongNameModule` to the new button semantics. ## Explicitly out of scope The rest of #27077 is not included: gallery height/card clamp, sensitive-var banner relocation, trash-icon removal wiring, the scroll-past required-field highlight subsystem, and the broader navigable-sidebar work (step labels, base-row navigation, back-stack semantics). ## Testing - `pnpm check` (biome) clean - `pnpm lint:types` (tsc) clean - `pnpm vitest run --project=unit src/pages/TemplateBuilder` — 46 pass - `pnpm vitest run --project=storybook src/pages/TemplateBuilder` — 34 pass (incl. new `NavigateModuleClick`) <details> <summary>Implementation plan / decision log</summary> ### Goal Open a new PR containing only the changes that satisfy DEVEX-587: clicking a selected module in the right-hand `SelectionSummary` sidebar should jump to the module settings step and scroll that module's card into view. ### Base has moved since #27077 PR #27077 was cut against an older `main`. Today's `main` was refactored: - Steps are URL-driven; `steps.ts` already provides `StepId`, per-step `group` (1/2/3), and `nearestVisible()`. - `TemplateBuilderPageView` already has `navigateToStep(index: number)` and a `useEffect` that resets window scroll on every `currentStep.id` change. - The sidebar no longer has a deselect ("X") button. The PR's entanglement between "make row a nav button" and "move deselect to a trash icon" therefore does not exist on current `main`, so module navigation can be added without removing behavior and without pulling in the trash-icon item. So the isolated diff was written against current `main`, not reused verbatim from the PR. It is smaller than the PR's own hunks and does not include `maxReachedStep`, step-label navigation, or base-row navigation. ### Decisions - Scope for this PR: module-row navigation only. - Skipped-settings fallback: no-op. When no selected module exposes configurable variables, the `module-settings` step is skipped and clicking a module row does nothing (there is no card to scroll to). ### Scroll timing `navigateToStep` triggers a window scroll reset via an existing effect keyed on `currentStep.id`. To cooperate, `navigateToModule` stores the target module id in a ref and a follow-up effect (declared after the scroll-reset effect, so it runs second) calls `scrollIntoView` inside `requestAnimationFrame` once `module-settings` has rendered. When already on `module-settings`, it scrolls immediately. ### Follow-up (deferred): full navigable sidebar Not part of this PR, documented for later. The remainder of #27077's item #2, rebased onto current `main`: - `onNavigateStep?: (stepId: StepId) => void` on `SelectionSummary`. - Clickable step labels: `Base Template` -> `base-infra`, `Modules` -> `module-select`, `Customizations` -> `customizations`. - Clickable selected base-template row -> `base-parameters` (fall back to `base-infra` when that step is skipped for the chosen base). - Back-stack semantics via a `maxReachedStep` prop so steps at or below the furthest-reached group stay `complete` and clickable even after navigating backward, while strictly-higher groups render as inert `upcoming`. - `StepIndicator` and `BaseTemplateSelection` render as `<button>` when a navigation handler is supplied, else stay inert. - Stories: `NavigationClicks`, `BackwardNavigation`, and `UpcomingStepsInert`. </details> --- Coder Agents generated, on behalf of @aqandrew.	2026-08-06 08:26:49 -07:00

1 2 3 4 5 ...