opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-11-02 13:33:30 +08:00
Code Issues Packages Projects Releases Wiki Activity
15,781 Commits 479 Branches 422 Tags
96553f8105829be79e679f4d312fe07da4f2e4f3
Commit Graph
15781 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
dependabot[bot] 96553f8105 chore: bump the react group across 1 directory with 2 updates (#28107) 
[//]: # (dependabot-start)
⚠️  **Dependabot is rebasing this PR** ⚠️ 

Rebasing might not happen immediately, so don't worry if this takes some
time.

Note: if you make any changes to this PR yourself, they will take
precedence over the rebase.

---

[//]: # (dependabot-end)

Bumps the react group with 2 updates in the /site directory:
[@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react)
and
[@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom).

Updates `@types/react` from 19.2.17 to 19.2.18
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react">compare
view</a></li>
</ul>
</details>
<br />

Updates `@types/react-dom` from 19.2.3 to 19.2.4
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-13 10:57:26 +00:00
dependabot[bot] 0e267475a7 chore: bump next from 15.5.21 to 15.5.22 in /offlinedocs (#28110) 
Bumps [next](https://github.com/vercel/next.js) from 15.5.21 to 15.5.22.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/next.js/releases">next's
releases</a>.</em></p>
<blockquote>
<h2>v15.5.22</h2>
<h2>What's Changed</h2>
<ul>
<li>[15.5] Reject TypeScript &gt;= 7.0 with an actionable error by <a
href="https://github.com/lukesandberg"><code>@​lukesandberg</code></a>
in <a
href="https://redirect.github.com/vercel/next.js/pull/96110">vercel/next.js#96110</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/vercel/next.js/compare/v15.5.21...v15.5.22">https://github.com/vercel/next.js/compare/v15.5.21...v15.5.22</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/next.js/commit/6ad9e56bbb6b1ebc17a3d35fa820800ac6419775"><code>6ad9e56</code></a>
v15.5.22</li>
<li><a
href="https://github.com/vercel/next.js/commit/fcc0424b7616e73a5f38d2e4f8ec8315355dacf3"><code>fcc0424</code></a>
[15.5] Reject TypeScript &gt;= 7.0 with an actionable error (<a
href="https://redirect.github.com/vercel/next.js/issues/96110">#96110</a>)</li>
<li>See full diff in <a
href="https://github.com/vercel/next.js/compare/v15.5.21...v15.5.22">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=next&package-manager=npm_and_yarn&previous-version=15.5.21&new-version=15.5.22)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-13 10:55:19 +00:00
dependabot[bot] a450104247 chore: bump @types/lodash from 4.17.24 to 4.17.25 in /offlinedocs (#28109) 
Bumps
[@types/lodash](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/lodash)
from 4.17.24 to 4.17.25.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/lodash">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@types/lodash&package-manager=npm_and_yarn&previous-version=4.17.24&new-version=4.17.25)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-13 10:54:51 +00:00
dependabot[bot] 625681aa82 chore: bump the coder-modules group across 2 directories with 1 update (#28106) 
Bumps the coder-modules group with 1 update in the /dogfood/coder
directory: coder/claude-code/coder.
Bumps the coder-modules group with 1 update in the /dogfood/vscode-coder
directory: coder/claude-code/coder.

Updates `coder/claude-code/coder` from 5.2.0 to 5.4.0

Updates `coder/claude-code/coder` from 5.2.0 to 5.4.0


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-13 10:52:11 +00:00
Michael Suchacz e92fd8e96f chore: retire mark3labs/mcp-go dependency (#28061) 
## Stack Context

PR 6 of 6 in a stack that migrates every Coder MCP surface from the
archived `github.com/mark3labs/mcp-go` library to the official
`github.com/modelcontextprotocol/go-sdk` v1.7.0.

Stack: #28056 -> #28057 -> #28058 -> #28059 -> #28060 -> #28061

## Why

With every production surface migrated, this PR removes the mark3labs
dependency entirely and converts the remaining test fixtures.

- Migrates the remaining mark3labs test fixtures (coderd MCP e2e tests,
chatd fixtures, mcpclient fixtures, and the Force On MCP policy tests)
to official stateless SDK servers.
- Removes `github.com/mark3labs/mcp-go` from `go.mod` and drops the
corresponding dependabot ignore entry. Zero references remain repo-wide.
- Updates the MCP docs for the 2026-07-28 protocol: stateless Streamable
HTTP behavior, the supported 2024-11-05 through 2026-07-28 protocol
range, and explicit non-features (resources, prompts, structured output,
elicitation, MCP Tasks).
- The e2e ping assertion is removed because MCP 2026-07-28 removed the
ping method.

> Mux created this PR on Mike's behalf.
 2026-08-13 10:47:14 +00:00
Michael Suchacz c8e8b21a88 feat: migrate aibridge injected-MCP proxy to official MCP Go SDK (#28060) 
## Stack Context

PR 5 of 6 in a stack that migrates every Coder MCP surface from the
archived `github.com/mark3labs/mcp-go` library to the official
`github.com/modelcontextprotocol/go-sdk` v1.7.0.

Stack: #28056 -> #28057 -> #28058 -> #28059 -> #28060 -> #28061

## Why

The aibridge injected-MCP proxy now owns an official `*mcp.Client`,
`*mcp.StreamableClientTransport`, and `*mcp.ClientSession`.

- The proxy constructor accepts an optional `*http.Client` instead of
mark3labs options; the header-injecting wrapper shallow-copies a
supplied client so its Timeout, Jar, and redirect policy survive.
- Manual protocol version negotiation and the mark3labs five-second
close workaround are removed; the SDK negotiates during `Connect` and
fails when no mutually supported version exists.
- Repeated `Init` closes the previous session, and a failed tool fetch
closes the just-created session so transports do not leak.
- Tool and intercept types use the official pointer content types;
embedded resource blobs are re-encoded to base64 for model-facing text
because the SDK decodes them into raw bytes.
- `aibridge/mcpmock` is regenerated, and its stale `go:generate` source
path is corrected.

> Mux created this PR on Mike's behalf.
 2026-08-13 10:38:14 +00:00
Michael Suchacz 7720e283f5 feat(agent/x/agentmcp): migrate workspace agent MCP client to official Go SDK (#28059) 
## Stack Context

PR 4 of 6 in a stack that migrates every Coder MCP surface from the
archived `github.com/mark3labs/mcp-go` library to the official
`github.com/modelcontextprotocol/go-sdk` v1.7.0.

Stack: #28056 -> #28057 -> #28058 -> #28059 -> #28060 -> #28061

## Why

The workspace agent MCP manager now stores `*mcp.ClientSession` per
configured server.

- stdio servers use `mcp.CommandTransport` with an `exec.Cmd` built from
Coder's `agentexec.Execer`, preserving environment enrichment; the
command uses the manager's parent context so a stdio subprocess outlives
the connect handshake and stops when the session closes.
- HTTP and SSE servers use header-injecting HTTP clients.
- Binary tool content is re-encoded to base64 for the agent API because
the official SDK decodes it into raw bytes.
- The reload test now triggers config diffs via an environment variable
because the official SDK drops connections on non-protocol stdout output
(flags like `-test.v` made the fake server chatty).

> Mux created this PR on Mike's behalf.
 2026-08-13 10:29:13 +00:00
Michael Suchacz 1e546ea8a3 feat(coderd/x/chatd/mcpclient): migrate external MCP client to official Go SDK (#28058) 
## Stack Context

PR 3 of 6 in a stack that migrates every Coder MCP surface from the
archived `github.com/mark3labs/mcp-go` library to the official
`github.com/modelcontextprotocol/go-sdk` v1.7.0.

Stack: #28056 -> #28057 -> #28058 -> #28059 -> #28060 -> #28061

## Why

The chatd external MCP client (admin-configured MCP servers used by
Agent chat) now holds `*mcp.ClientSession` connections created via
`mcp.NewClient` and `Client.Connect`, with `StreamableClientTransport`
or `SSEClientTransport` per server config.

- Auth and identity headers are injected through a custom
`http.RoundTripper` because the official SDK has no per-header transport
options.
- Tool input schemas are extracted from the SDK's `map[string]any`
decoding.
- Content conversion handles the official pointer content types; the SDK
decodes blob resources into raw bytes, so binary content is handled
without an extra base64 round trip.
- Test fixtures are official stateless Streamable HTTP servers.

> Mux created this PR on Mike's behalf.
 2026-08-13 10:11:47 +00:00
Michael Suchacz 26fe3f3185 feat(cli): migrate exp mcp stdio server to official MCP Go SDK (#28057) 
## Stack Context

PR 2 of 6 in a stack that migrates every Coder MCP surface from the
archived `github.com/mark3labs/mcp-go` library to the official
`github.com/modelcontextprotocol/go-sdk` v1.7.0.

Stack: #28056 -> #28057 -> #28058 -> #28059 -> #28060 -> #28061

## Why

`coder exp mcp server` (stdio) now uses the official SDK server with
`mcp.IOTransport` over the invocation's stdin/stdout, and reuses the
shared `coderd/mcp.RegisterSDKTool` helper from PR #28056 so both
servers register tools identically.

- A `nopWriteCloser` prevents the SDK from closing the invocation's
stdout.
- Tests send spec-compliant initialize params and
`notifications/initialized` before `tools/list` because the official SDK
enforces the protocol lifecycle.

> Mux created this PR on Mike's behalf.
 2026-08-13 10:02:47 +00:00
Michael Suchacz 08a1525f78 feat: migrate coderd MCP server to official MCP Go SDK (#28056) 
## Stack Context

PR 1 of 6 in a stack that migrates every Coder MCP surface from the
archived `github.com/mark3labs/mcp-go` library to the official
`github.com/modelcontextprotocol/go-sdk` v1.7.0, adding MCP 2026-07-28
support while keeping compatibility with clients speaking 2024-11-05
through 2025-06-18.

Stack: #28056 -> #28057 -> #28058 -> #28059 -> #28060 -> #28061

## Why

The coderd Streamable HTTP MCP server (`/api/experimental/mcp/http`) is
the foundation layer: it introduces the official SDK dependency and the
shared `RegisterSDKTool` helper the CLI server reuses.

- The server runs the SDK handler in stateless mode with `JSONResponse:
true`, preserving the previous `application/json` POST wire format. GET
and DELETE return 405, and no `Mcp-Session-Id` is issued, both permitted
by the Streamable HTTP spec.
- `DisableLocalhostProtection` is set because coderd commonly listens on
loopback behind a reverse proxy with a public Host header; the
endpoint's bearer authentication is the relevant access control.
- Tool registration builds raw JSON object schemas and omits empty
`required`, keeping `tools/list` output byte-identical to the previous
server (verified with a golden comparison).
- SDK logs are adapted to `cdr.dev/slog/v3`; only warnings and errors
are forwarded because the SDK logs several INFO lines per stateless
request.
- Tests cover the modern 2026-07-28 flow, legacy 2025-06-18 initialize,
unsupported protocol version rejection (`-32022`), and non-POST method
behavior.

## Known behavior deltas vs the old endpoint

Both deltas come from the SDK enforcing the Streamable HTTP spec where
mark3labs was lenient, on an experimental endpoint:

- POST requests whose `Accept` header lists `application/json` without
`text/event-stream` are now rejected with 400 (the spec requires clients
to list both; a missing `Accept` header is still tolerated). mark3labs
did not validate `Accept` at all.
- The old server generated an unvalidated `Mcp-Session-Id` response
header; the stateless SDK handler issues none. Clients that merely echo
the header back are unaffected.

## Validation

Beyond unit/integration tests, a remote dogfood UAT ran protocol
conformance against a live dev server built from the stack tip: version
negotiation matrix (2024-11-05 through bogus/omitted values), auth,
session/method semantics, tool schema sanity, tools/call happy and error
paths (unknown tool, schema-violating args, malformed JSON, jsonrpc
"1.0"), and a concurrency smoke test. No 500s or connection drops; error
shapes are clean JSON-RPC/HTTP errors.

> Mux created this PR on Mike's behalf.
 2026-08-13 09:50:18 +00:00
Michael Suchacz d509e1e6a0 fix(site): include owner context in Agents org picker permission check (#28076) 
Fixes the Agents org picker and workspace attach menu for users whose
only chat grant comes from the member-scoped "Coder Agents User"
(`agents-access`) org role (PRODUCT-552).

## Problem

The per-org authcheck behind the org picker checked `chat:create` with
only `organization_id`. The `agents-access` role grants chat permissions
at org-member scope, which requires the checked object to be owned by
the caller (`policy.rego` `org_member` requires a non-empty owner
matching the subject). With no `owner_id`, every org check returned
`false`, so:

- the org picker never rendered (`permittedOrgs.length > 1` gate),
- the form stayed pinned to the default org,
- the workspace attach menu, filtered to that org, showed "No workspaces
found" even though the user had workspaces in another org.

The page-level `createChat` check already includes `owner_id: "me"`,
which is why the same user could load the page and create chats via the
API.

## Fix

Pass `owner_id: "me"` in the `permittedOrganizations` seed check in
`AgentCreateForm`, matching the page-level check's semantics. The
`permittedOrganizations` helper spreads the check object through, so
each per-org check now carries owner context and the backend substitutes
the caller's user ID.

The other `permittedOrganizations` callsites
(`organization_member:create`, `template:create`) check org-scoped admin
permissions and correctly omit `owner_id`.

Adds a regression story whose `checkAuthorization` mock only allows
checks carrying `owner_id: "me"` (mirroring the RBAC member-scope
behavior); it fails without the fix and passes with it (red-green
verified).

## Validation

- Red-green verified regression story: fails without the fix (picker not
found), passes with it; all 31 stories in the file pass.
- `pnpm -C site check` and `pnpm -C site lint:types` clean.
- Remote dogfood UAT (dev.coder.com chat
[97be7f39](https://dev.coder.com/agents/97be7f39-4688-45ee-be3d-24bc4f6f8046)):
PASS on all acceptance criteria at this exact commit. Reproduced the bug
scenario end to end (two orgs, non-admin user with only the "Coder
Agents User" role in both, workspace only in the second org): the org
picker renders, the second org's workspaces appear in the attach menu,
and chat creation succeeds with a real model. Single-org and admin
behaviors unchanged. Authcheck probe documents the backend semantics:
`chat:create` with `owner_id: "me"` returns true, without it returns
false.

> Mux acted on Mike's behalf for this PR.
 2026-08-13 11:19:38 +02:00
Cian JohnstonandCopilot Autofix powered by AI 3f9e8cca2a chore: add test coverage for chatd compaction (#28053) 
## Summary

Adds test coverage for the three compaction-decision functions in chatd
that had zero tests: `latestPromptUsage`, `shouldCompactPromptUsage`,
and `contextTokensFromUsage`.

AIGOV-585 hypothesized that chatd's token counting logic was incorrect —
that it compared a cumulative sum of prompt tokens across all
agentic-loop steps against the context window. The tests disprove this:
`latestPromptUsage` returns the last persisted assistant message's
usage, not a sum. The actual bug was in the aibridge streaming
interceptor, which summed usage across SSE chunks and persisted inflated
values (fixed in `ad100452d4`).

## What's tested

- `TestLatestPromptUsage` — pins that the compaction path reads the last
step's usage (5,400), not a cumulative sum across steps (15,600). If
someone wires `TotalUsage` into the compaction path as the issue
suggested, this fails.
- `TestShouldCompactPromptUsage` — covers the threshold decision with
the inflated value from the issue (417,012 → compacts), the correct
value (6,000 → doesn't compact), cache token counting, and both disable
guards (threshold=100, contextLimit=0).

<details>
<summary>Plan / investigation notes</summary>

- Traced the full flow: `chatloop.go:993` sets `result.usage =
part.Usage` from the per-step `StreamPartTypeFinish` event, not the
accumulated `TotalUsage` from `agent.go:544`. chatd never calls
fantasy's `Agent` interface.
- The `TotalUsage` accumulation in `agent.go:544` is only used for cost
attribution, not context occupancy.
- Commit `ad100452d4` fixed the real bug in
`aibridge/intercept/chatcompletions/streaming.go` (cross-chunk usage
summation for vLLM-style backends).
- Tests reuse existing `dbMessage` and `withUsage` helpers from
`message_conversion_test.go` (same package).

</details>

Generated by [Coder Agents](https://coder.com)

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-08-13 08:42:23 +01:00
Steven Masley f0c17291b3 feat: unhide --oidc-redirect-url server option (#28072) 
Unhides the `--oidc-redirect-url` / `CODER_OIDC_REDIRECT_URL` server
option so it appears in `coder server --help` and the deployment
configuration docs.

- Removed `Hidden: true` from the option in `codersdk/deployment.go`
- Regenerated CLI golden files and docs via `make gen`

---

> Generated with Coder Agents on behalf of @Emyrk
 2026-08-12 16:02:15 -05:00
Bobby Ho 209d1ca498 fix: reject PKCE code_verifier below RFC 7636 length floor (#28003) 
The token endpoint accepted any non-empty `code_verifier`, so a
one-character verifier was enough to authenticate. RFC 7636 §4.1
requires 43 to 128 characters from the unreserved set.

That fix plus the related gaps review surfaced in the same path:

- Enforce the length and charset floor on the verifier before the S256
comparison runs.
- Validate the challenge at the authorize endpoint too. It was only
checked for non-emptiness, so a malformed challenge was stored and then
failed late at token exchange, blaming the wrong parameter.
- A malformed verifier now returns `invalid_request` (RFC 6749 §5.2); a
well-formed but wrong one still returns `invalid_grant` (RFC 7636 §4.6).
Both looked identical before, so a client had no way to tell a syntax
error from a hash mismatch and would retry the same bad verifier
forever.
- Revoke the authorization code when a PKCE check fails. Without that, a
leaked code could be replayed with unlimited verifier guesses for its
remaining lifetime, and RFC 6749 §10.5 requires codes to be single use.
- Fix verifier generation in `scripts/oauth2/*.sh` and the docs example.
They deleted reserved base64 characters instead of translating them to
the URL-safe alphabet, so most runs produced verifiers under the new
floor.

Also carries #28041, which merged into this branch: public clients may
register bare custom schemes such as `vscode://` again, with `mailto`,
`tel`, and `sms` rejected.

Split out of #27873 (public OAuth2 client support). PKCE is already
mandatory for every client, so this stands on its own.

<details>
<summary>Manual verification</summary>

Ran against a local dev server on this branch, using a session token and
a throwaway app from `scripts/oauth2/setup-test-app.sh`.

1. Happy path unchanged: HTTP 200, verifier length 43.
2. `code_verifier=short`, and a 43-character verifier ending in `!`:
both HTTP 400 `invalid_request`, so charset is enforced and not just
length.
3. `code_challenge=tooshort` at authorize: HTTP 400 `invalid_request`,
no code issued. An empty challenge still hits the older "required and
cannot be empty" message.
4. Well-formed but wrong verifier: HTTP 400 `invalid_grant`, distinct
from the cases above.
5. Retrying that same code with the correct verifier: HTTP 400, code
already revoked by the failed check.
6. `generate-pkce.sh` produces a 43-character verifier (20 out of 20
runs); the docs example produces 128.
7. `scripts/oauth2/test-mcp-oauth2.sh` passes end to end. The two
bearer-token failures in its output are a pre-existing script bug
(`09c50559f3`, July 2025) that reuses a resource-scoped token against
the real API, not a regression here.

</details>
 2026-08-12 13:36:52 -07:00
Michael Suchacz 0acd9785fa fix(coderd/x/agenthooks/dispatch): deflake TestDispatcherTimeoutNoRetry (#28050) 2026-08-12 20:53:28 +02:00
Michael Suchacz 1458d27d78 fix: allow manual chat compaction from the error state (#28022) 
A chat that fails generation with a context overflow (for example `Input
length 262625 exceeds the maximum allowed input length of 262112
tokens`) is stuck in a catch-22: `POST /chats/{id}/compact` returns 409
because the `RequestCompaction` transition is only allowed from the
waiting state, and the only other way out of the error state is sending
or editing a message, which re-runs generation with the same oversized
prompt and fails again. Compaction is exactly the recovery a
context-overflowed chat needs, and it is unreachable exactly when it is
needed.

Three semantic changes:

- Allow `RequestCompaction` from the error states: `E0 -> R0` and `E1 ->
R1` (queued messages are preserved and processed after the compaction
turn).
- Clear `last_error` in `Tx.RequestCompaction`, matching the
architecture rule that transitions leaving `E0`/`E1` clear the stored
error. Without this a successful compaction would land in waiting with a
stale persisted error.
- Grant the compaction turn a fresh history epoch: a
`grant_history_epoch` flag on `UpdateChatExecutionState` sets
`history_version = snapshot_version`, resets `generation_attempt`, and
clears `retry_state` in the same atomic update that clears `last_error`
(mirroring the `chat_messages` trigger postcondition). The transition
inserts no history, so without this the turn inherits the failed turn's
spent retry budget, and resetting the counter alone could collide with
message part episode keys still retained on the erroring replica.

No frontend change is required: the chat input is already enabled in the
error state and `/compact` submission already handles both the success
and 409 paths. Also updates ARCHITECTURE.md (transition matrix,
endpoint, and manual compaction sections), the endpoint's swagger
description, and SDK comments.

> Mux created this PR on Mike's behalf.

<!-- mux-attribution: model=claude-sonnet-4-6 thinking=high -->
 2026-08-12 20:38:57 +02:00
TJ b145142404 fix(site): add aria-label to icon-only Back navigation links (#26222) 
## Summary

Two icon-only "Back" navigation links in the topbars have no accessible
name. The visible tooltip text is wired via Radix's `aria-describedby`,
which provides a *description*, not an accessible **name**, so screen
readers announce them as just "link" with no purpose.

This adds an `aria-label` to each link matching the visible tooltip
text, following the existing `aria-label` convention already used in
these same files (e.g. `aria-label="Create File"`, `aria-label="Daily
usage"`).

## WCAG 2.1 criteria addressed

- **SC 4.1.2 Name, Role, Value** (Level A)
- **SC 2.4.4 Link Purpose (In Context)** (Level A)

## Changes

| File | Element | Added |
|---|---|---|
| `site/src/pages/WorkspacePage/WorkspaceTopbar.tsx` |
Back-to-workspaces chevron link | `aria-label="Back to workspaces"` |
| `site/src/pages/TemplateVersionEditorPage/TemplateVersionEditor.tsx` |
Back-to-template chevron link | `aria-label="Back to the template"` |

No visual change. No behavior change for sighted users. `aria-label` is
safe here because the elements have no visible text content (only an
icon), so it is not overriding a visible name.

<details>
<summary>Why not rely on the existing Tooltip?</summary>

Radix UI's `Tooltip` wires `aria-describedby` from the trigger to the
tooltip content. `aria-describedby` provides an *accessible
description*, not an *accessible name*. WCAG 4.1.2 requires interactive
controls to have a programmatically determinable name, and screen
readers do not consistently announce descriptions, especially when no
name is present. Adding `aria-label` gives the link a stable,
programmatic name that exactly matches the visible tooltip text.

</details>

---

_Created by Coder Agents on behalf of @tracyjohnsonux._
 2026-08-12 17:23:37 +00:00
Matt Vollmer 52bd05adb4 docs: remove AI Governance Add-On references (#28073) 
## Summary

Replaces all remaining "AI Governance Add-On" references with language
consistent with AI Governance being included with a Premium license.

**`docs/ai-coder/ai-gateway/standalone.md`**

- Admonition: "AI Gateway requires the AI Governance Add-On...
deployments without the add-on will not be able to access" → "AI Gateway
requires a Premium license. Community deployments cannot access AI
Gateway."
- Requirements list: "A Coder license with the AI Governance Add-On" →
"A Premium license with AI Governance"

**`docs/install/airgap.md`**

- Table row: "deployments with the AI Governance Add On" → "deployments
with AI Governance"

**`docs/reference/glossary.md`**

- Agent Firewall, AI Gateway, AI Gateway Proxy entries: "This feature
requires the AI Governance Add-On" → "This feature requires a Premium
license"
- Agent Workspace Build entry: "the AI Governance Add-On expands the
allowance" → "a Premium license expands the allowance"
- Heading: "### AI Governance Add-On" → "### AI Governance"
- Definition: "A separate per-user license for Premium customers,
purchased on top of a Premium subscription..." → "Included with a
Premium license, AI Governance unlocks..."

**`docs/ai-coder/ai-governance.md`**

- Removed the "Identifying AI seat consumers" section (heading through
end of file), which described an "AI add-on column" in the UI

## Note

References to Agent Workspace Builds will be eliminated in a separate PR
that removes Coder Tasks from the docs.

---

PR generated with Coder Agents.
 2026-08-12 11:35:36 -04:00
blockgroot 7a545b35ed fix(aibridge): record token usage without an MCP proxier (#27886) 
_Disclosure: investigated and drafted with Claude Opus 5. I reviewed the
change and ran the tests locally._

Streaming Responses interceptions recorded no token usage when the
bridge was built with a nil `mcp.ServerProxier`, because
`recordTokenUsage` was called from inside the `i.mcpProxy != nil` branch
in `aibridge/intercept/responses/streaming.go`. Requests completed
normally and returned `200`, so traffic was served but metered as zero,
with no error surfaced. Upstream reports usage on the
`response.completed` event independently of tool injection, so the
proxier is not a valid precondition for recording it.

That state is reachable in production:
`coderd/aibridged/pool.go:255-265` treats proxier construction failure
as non-fatal ("MCP server injection can gracefully degrade") and caches
the resulting bridge via `SetWithTTL`, so one transient config-retrieval
error suppressed usage recording for every streaming Responses request
served by that bridge until its TTL expired.

This records usage for every completed response, guarded only on
`completedResponse`, matching `responses/blocking.go` and both
`chatcompletions` implementations. Per-iteration semantics are preserved
for the inner agentic loop.

The integration harness substituted a non-nil noop manager whenever no
proxier was supplied (`setupbridge.go:153-155`), so the nil path was
never exercised. `withoutMCP()` covers it.

Verification, with the fix reverted:

```
--- FAIL: TestResponsesStreamingRecordsTokenUsageWithoutMCP/without_mcp_proxy
        Error: "[]" should have 1 item(s), but has 0
--- PASS: TestResponsesStreamingRecordsTokenUsageWithoutMCP/with_noop_mcp_proxy
```

and with it applied:

```
--- PASS: TestResponsesStreamingRecordsTokenUsageWithoutMCP/without_mcp_proxy
--- PASS: TestResponsesStreamingRecordsTokenUsageWithoutMCP/with_noop_mcp_proxy
--- PASS: TestResponsesStreamingRecordsTokenUsagePerAgenticIteration
```

The per-iteration case asserts exactly two records for the injected-tool
fixture, so decoupling the call from the proxier does not double-count
when the agentic loop iterates. `go test -race ./aibridge/...` passes
across all 15 packages.

Fixes #27885



One caveat on verification: I was unable to run `make gen` / `make
pre-commit` locally, as I do not have the full mise toolchain installed.
The change touches no codegen inputs (no SQL, protos, mocks, or
TypeScript), so I do not expect generated-file drift, but flagging it
rather than leaving it implied.
 2026-08-12 16:08:29 +01:00
Michael Suchacz b3607f51b2 fix: keep chat token usage for streams ending with usage-less chunks (#28068) 
Bumps the coder/fantasy fork pin to pick up coder/fantasy#52.

## Problem

Chats on `poolside/laguna-xs-2.1` showed no context usage: every
assistant message persisted NULL token columns, and automatic compaction
never triggered, so chats ran to context overflow. AIBridge recorded
correct usage for the same requests, so the loss was client-side in
fantasy.

When tools are declared, laguna-xs reports cumulative usage on every
delta chunk and ends the stream with a `finish_reason` chunk whose
`usage` is null, with no trailing usage-only chunk. Fantasy's
chat-completions stream loops reassigned usage from every chunk, and the
default stream usage hook returns zero usage for usage-less chunks, so
the trailing finish chunk wiped the real usage one chunk earlier. The
Finish part then reported `Usage{0,0,0}`, which chatd persists as NULL
(`nullInt64IfNonZero`).

## Fix

coder/fantasy#52 adopts the stream usage hook's result only when the
chunk actually carries usage, in both the chat-completions stream loop
and the JSON-mode object stream loop. This mirrors the aibridge fix in
#27967, which is why the gateway recorded usage correctly while fantasy
lost it. Spec-compliant backends that emit usage once on the final chunk
are unaffected.

This PR pins the fork at the merged commit and documents the fork-only
patch in the go.mod comment block.

## Validation

- coder/fantasy#52: new regression tests for both stream loops, proven
red against the unguarded code; full module tests, vet, gofmt, and
golangci-lint green; fork CI green before merge.
- Here: `go build ./...`, `go vet ./coderd/x/chatd/...`, and `go test
./coderd/x/chatd/...` (including the chatdebug field-coverage guard) all
pass with the bumped pin.

> Mux acted on Mike's behalf to create this PR.
 2026-08-12 17:08:01 +02:00
Danielle Maywood 5a33b669b4 feat: redesign the advisor tool row (#28069) 2026-08-12 15:35:31 +01:00
Cian Johnston e02d9adc11 chore: add NewUnstartedHTTPServer helper to disable keep-alives on test servers (#28052) 
Tests that proxy or pool connections to a bare `httptest.Server`
intermittently fail on Windows with a bare EOF when a stale pooled
connection is reused. net/http will not retry a non-replayable request
(e.g. a POST) on a closed pooled connection, so forcing a fresh
connection per request eliminates the failure class. This is the same
mechanism fixed in #28016 (AIGOV-430 / internal#1564), now expressed as
a reusable, behavior-preserving helper.

This PR adds `testutil.NewTestHTTPServer`, a known-good wrapper around
`httptest.NewServer` that applies some defaults. Currently the only
default is disabling keep-alives by default.

- `testutil/http_server.go`: `NewHTTPServer(t, handler, opts)` started,
with documented defaults, starts automatically, and handles `t.Cleanup`.
- `testutil/http_server_test.go`: unit test for defaults and overriding
defaults.
- `enterprise/aibridgeproxyd/reload_test.go`: refactor the harness's
hand-rolled server to the helper.

## Future Work

- Functional options are exposed but not explicitly defined. This can be
done later as required.
- No lint rule or broader migration. A forcing-function analyzer
covering more packages, plus wider adoption, belongs in a separate
follow-up.

## Verification

- `testutil` and `enterprise/aibridgeproxyd` suites pass under `-race`.
- `TestProxy_HotReloadRouting` and `TestProxy_StaleTunnel` pass 10x
under `-race`.
- New helper unit test passes under `-race`.

> Generated by a Coder agent.
 2026-08-12 15:22:38 +01:00
Danielle Maywood c424a76a12 feat: wire chat search box to full-text search (#27973) 2026-08-12 15:04:01 +01:00
Seth Shelnutt 6765731ea9 feat(site/src/pages/AgentsPage): add download and export for personal skills (#28032) 
## Summary

Adds a way to get personal skills back out of Coder Agents as files, so
sharing a skill no longer means pasting `SKILL.md` by hand.

- **Per-skill Download**: a `Download` action on each row of the
*Personal
  skills* settings page saves that skill's `SKILL.md` as `<name>.md`.
- **Export all**: a header button zips every personal skill (each as
  `<name>/SKILL.md`) and downloads `personal-skills.zip`.

Scope is **personal skills only** (workspace/filesystem skills are
read-only
in chat and out of scope). No backend changes: the single-skill content
endpoint (`GET /api/experimental/users/{user}/skills/{skillName}`)
already
returns full content, so the view fetches on demand and downloads with
`file-saver`, zipping with `jszip` (both existing deps, matching
`DownloadLogsDialog`).

## Changes

- `AgentSettingsPersonalSkillsPageView.tsx`: `Download` per-row button
(with
per-row spinner) and an `Export all` header button (disabled when empty
or
  loading).
- `AgentSettingsPersonalSkillsPage.tsx`: container handlers that fetch
  content via `queryClient.fetchQuery(userSkill(name))` and trigger the
download/zip, with `toast` error handling. Download logic is extracted
to
  module-level helpers to stay React Compiler friendly.
- `AgentSettingsPersonalSkillsPageView.stories.tsx`: interaction stories
  asserting `onDownload`/`onExportAll` fire, plus loading-state stories.

## Testing

- `pnpm check` (biome), `pnpm lint:types` (tsc), React Compiler check,
and
  Storybook interaction tests (22 passed) all pass locally.
- `make pre-commit` passed.

Closes
[CODAGT-918](https://linear.app/codercom/issue/CODAGT-918/add-ability-to-download-and-export-skills-from-coder-agents).

<details>
<summary>Implementation plan</summary>

### Problem

Users can create, edit, and delete personal skills in Agent settings,
but
there is no way to get a skill back out as a file. The only workaround
was to
paste the `SKILL.md` content by hand.

### Decisions (confirmed with requester)

1. Surface: download in the settings UI (Personal skills page).
2. Build both single-skill download and export-all (zip).
3. Personal skills only (workspace/filesystem skills out of scope).

### Approach (frontend-only, additive)

No backend changes: the single-skill content endpoint already exists.
The
view stays presentational and exposes new callbacks; the container
fetches
content and performs the download, mirroring how Edit/Delete already
split
between view and container.

- Per-row Download button, placed before Edit in the actions cell; shows
a
  spinner while its own row is downloading.
- Export all button in the section header, disabled when there are no
skills
  or while loading.
- Container: single download fetches content and `saveAs(<name>.md)`;
export
  all fetches every skill, adds each as `<name>/SKILL.md` to a `JSZip`,
generates a blob, and `saveAs(personal-skills.zip)`. Failures surface
via
  `toast.error`.
- Stories cover the interactions and loading states (stories are the FE
test
  surface).

### Out of scope

- Workspace skills download (filesystem source): different data path,
  read-only in chat, not user-owned data.
- In-chat download button on the `read_skill` tool output: possible
  follow-up, different surface and interaction model.

</details>

---

_Opened by Coder Agents on behalf of @Shelnutt2._
 2026-08-12 09:20:30 -04:00
Michael Suchacz 88e113554a fix: report per-request Anthropic usage in chat token accounting (#27966) 2026-08-12 12:52:22 +02:00
Michael Suchacz ac11ae52d1 fix(site/src/pages/AgentsPage): stop attachment downloads from trapping iOS PWAs (#27853) 
On iOS, tapping an attachment download link inside the installed
(standalone) PWA hands the file to QuickLook, which renders on top of
the app with no reliable way back. Users had to force-quit the PWA to
recover.

## Approach

In iOS standalone mode, when the device supports file sharing, the
download click is intercepted and the fetched attachment is handed to
the native share sheet (`navigator.share` with a `File`), where the user
can pick Save to Files or any other target. This is the
platform-intended path for saving files from a PWA; no library covers it
(FileSaver.js is broken in iOS PWAs, and browser-fs-access falls back to
the same broken anchor path).

Everything else keeps native behavior:

- Non-iOS platforms and regular iOS Safari tabs keep the plain `<a
download>` anchor.
- iOS standalone devices without file sharing keep the anchor too.
- Inline `data:` attachments are decoded locally because the production
CSP (`connect-src 'self'`) blocks fetching them.

## Error model

Deliberately small: a share-sheet dismissal (`AbortError`) is silent, an
expired click gesture (`NotAllowedError`, which happens when the fetch
outlasts transient activation) shows a toast whose Save action retries
with a fresh gesture, and any other failure shows a plain error toast.

An earlier revision carried pending-state tracking, abort-signal
threading through unmount, and a blob-URL tab fallback; those guards
were removed on purpose to keep the change proportionate to the defect.

Also hardens chat file uploads slightly: filenames are sanitized before
upload and the file-picker `accept` attribute mirrors the server's
attachment allowlist.

## Testing

- Storybook interaction tests cover the share happy path and
native-anchor behavior; unit tests cover the intercept gate (including
iPadOS detection), failure toasts, retry action, and inline-data decode.
- Validated on an iPhone against a dev deployment: share sheet opens,
Save to Files works, and the app remains usable afterwards.

> Mux implemented this on Mike's behalf.

<!-- mux-attribution: model=claude-sonnet-4-5 thinking=high -->
 2026-08-12 08:31:26 +02:00
Jake Howell 726e86cef7 refactor(site): add <Drawer /> and migrate build logs drawer (#28009) 
> 🤖 This PR was written by Coder Agents on behalf of Jake Howell.

Follow-up to #27798. That PR introduced a shared `Drawer` primitive by
adding [`vaul`](https://github.com/emilkowalski/vaul) as a dependency.
As raised in review, `vaul` is currently unmaintained, and this drawer
is the only place in the UI using that concept.

This PR takes the
[suggested](https://github.com/coder/coder/pull/27798#pullrequestreview-4901095865)
route: a dead-simple, self-owned drawer that covers this one case well,
built directly on Radix UI's `Dialog` (already a dependency via
`radix-ui`) instead of `vaul`. It keeps the same shadcn-style API
(`Drawer`, `DrawerTrigger`, `DrawerContent`, `DrawerHeader`,
`DrawerFooter`, `DrawerTitle`, `DrawerDescription`, `DrawerClose`) so
usage stays familiar, and migrates `CreateTemplatePage`'s
`BuildLogsDrawer` off MUI onto it.

### What changed

- Add `site/src/components/Drawer/Drawer.tsx`: a reusable drawer/sheet
built on `radix-ui` `Dialog`. Supports a `direction` prop
(`top`/`bottom`/`left`/`right`, default `right`) with slide animations
via `tailwindcss-animate`. No new dependencies.
- Migrate `BuildLogsDrawer` from `@mui/material/Drawer` to the new
component. Desktop panel stays at 800px via `min(800px, 100%)` so it
stays within the viewport on mobile.
- Storybook coverage with `play()` functions for both the generic
`Drawer` (open/close, direction) and `BuildLogsDrawer` (close via the X
button and via Escape assert `onClose`), addressing the earlier P1
review note about covering the controlled close path.

### Why Radix instead of vaul

- `radix-ui` `Dialog` is already a dependency and provides
accessibility, focus management, and open/close state.
- No dependency on an unmaintained package for a single-use concept.
- `vaul`'s drag-to-dismiss gesture is not needed for this build-logs use
case.
 2026-08-12 13:51:04 +10:00
Michael Suchacz bde38e9d10 fix(coderd/x/chatd): synchronize aibridgeTestFactory recorded fields (#28031) 
Fixes the data race in the chatd test helper `aibridgeTestFactory`
reported in CODAGT-917 (`test-go-race-pg` flake in
`TestAwaitSubagentCompletion/Timeout`).

`TransportFor` recorded `providerName` and `source` with plain field
writes. Tests that start the chat worker share one factory between
concurrently running chat runners (parent chat and spawned subagent), so
two runners resolving models at the same time raced on those writes.

The fix guards the recorded fields with a mutex and reads them through a
locked `recorded()` accessor at the three asserting call sites.

Verified with a red-green repro: concurrent `TransportFor` calls on one
factory failed `go test -race` with the exact CI signature (lines 37-38)
before the fix and pass after it. Also ran `go test -race
./coderd/x/chatd -run TestAwaitSubagentCompletion -count=10` and the
full `go test -race ./coderd/x/chatd` package, both clean.

Audited every other `aibridge.TransportFactory` implementation and
`aibridgeTestFactory` use site for the same defect:
`chattest.MockAIBridgeTransport` is already mutex-guarded,
`stubTransportFactory` (coderd/aibridge_test.go) records via a channel,
`providerRoutedTransportFactory` (chatd_test.go) is a stateless lookup,
and the production factories keep no recorded state. No other occurrence
exists.

Closes CODAGT-917.

> Mux acted on Mike's behalf to create this PR.
 2026-08-11 23:51:00 +02:00
TJ 5fab238ed1 fix(site/src/pages/AgentsPage): improve git panel color contrast (#28038) 
## Summary

Follow-up to #27012 addressing color contrast in the git panel:

- The orange (`text-content-warning`) **Working** label failed color
contrast. The label in the view switcher trigger and dropdown now uses
`text-content-secondary`. The `CircleDotIcon` keeps its original
`text-content-warning` color as a state indicator.
- The **Commit** and **View PR** buttons now use `text-content-primary`
for their text and icons instead of `text-content-secondary`. The
now-redundant `hover:text-content-primary` was dropped.

No behavior changes; class-only updates in `GitPanel.tsx` and
`RemoteDiffPanel.tsx`.

## Testing

- `biome check` and `tsc --noEmit` pass on the touched files.
- Verified visually via Storybook screenshots of the GitPanel stories.

---

> Generated by Coder Agents on behalf of @tracyjohnsonux.
 2026-08-11 14:04:15 -07:00
TJ f7f840ac69 feat(site/src/pages/AgentsPage): consolidate git panel tab strip into a view switcher dropdown (#27012) 
## What

Replaces the git panel's tab strip (`[PR #4847] [Working coder] [Working
other]`) with a single dropdown "view switcher" that lists the PR (when
present) and each dirty working repo as items.

Also:

- Moves the PR title to a dedicated row below the switcher, truncated
with a hover tooltip for the full title. The row only appears while the
PR view is active.
- Removes the redundant PR-state badge from the RemoteDiffPanel
sub-header (state is now shown as the colored pill on the switcher
trigger).

## Why

The common multi-view states are `PR only`, `Working only`, or `PR + one
Working repo`. The tab strip was fine for one view but crowded the
toolbar the moment two showed up. Collapsing to a single trigger +
optional dropdown keeps the toolbar quiet in the 80% case and the
switcher stays intuitive when there is more than one thing to look at.

## Screens

Storybook coverage:

- `PullRequestAndWorkingChanges` — collapsed switcher shows the PR state
+ `PR #<n>`, PR title below.
- `ViewSwitcherOpen` (new) — dropdown open with PR and both working
repos, then clicks a working entry to verify the view swaps.
- `DraftPullRequest`, `MergedPullRequest`, `ClosedPullRequest` —
trigger's colored pill reflects state (play assertions added).
- `WorkingChangesOnly`, `BranchOnly`, `MultipleRepos`, `EmptyState`,
`GitNotActive`, `GitStatusLoading` — all pass.
- `EverDirtyRepoGoneClean`, `CleanRepoFromStart` — regression coverage
updated to target the new switcher rather than the old `Working` tab
buttons.

<details>
<summary>Decisions and scoping notes</summary>

### Why a switcher and not a PR-only dropdown

Original design showed multiple PRs in the dropdown, but the server
model only tracks **one PR per chat** (`ChatDiffStatus.pr_number` is a
single field). Multi-PR would need a DB / watcher / SDK change out of
scope for a UI polish PR.

After reviewing frequency of the actual multi-view states (`PR only` and
`Working only` dominate; `PR + Working` shows up during review
iteration; 3+ views is rare), we scaled back to make the dropdown a
**view switcher** that spans the existing tab strip's data: PR + working
repos. Ships today, no backend work.

### Behavior notes

- With a single item the trigger renders as a static pill (no chevron,
no dropdown behavior); it becomes an interactive dropdown once there is
more than one item.
- The colored state pill on the trigger uses `text-git-*-bright` /
`text-content-warning` / `text-content-secondary` (text color only; no
background token).
- Dropdown items render as `[icon] primary secondary` where
primary/secondary is `PR #<n> / title` for the remote entry and `Working
/ repo` for local entries.
- Local (Working) entries are visually nested under the remote/PR entry
when one is present; otherwise they render flush-left.
- When the head branch is known but no PR is opened, the trigger reads
`Branch | <head-branch>`.

</details>

---

_Coder Agent generated on behalf of @tracyjohnsonux._
 2026-08-11 12:25:06 -07:00
Jeremy Ruppel e9ee83af69 fix(site/src): gate TemplateExampleCard Use template link on builder state (#28035) 2026-08-11 14:30:37 -04:00
Andrew Aquino b721935fc1 chore(site): add generateConnectionSessionId helper function (#27935) 
- adds a `generateConnectionSessionId` helper function which reuses our
existing `generateRandomString` logic
- adds tests for `generateConnectionSessionId` in utils/random.test.ts
(utils/random.ts was previously untested)
- renames our existing `generateRandomString` function to be
`generateRandomBase64String`

additional context in
https://github.com/coder/coder/pull/27671#discussion_r3731213459

This PR doesn't change any of our UIs. The new
`generateConnectionSessionId` function is a piece of frontend plumbing
related to DEVEX-663. I originally implemented #27677 so that web
terminal connections to workspaces would be identified by uuids--but
according to the RFC for DEVEX-663, those connection session ids should
be lowercase hexadecimal strings (not uuids).
 2026-08-11 09:38:28 -07:00
J. Scott Miller 866e676320 feat: invalidate provisioner daemon sessions on key deletion (#26532) 
## Summary

Closes PLAT-305.

When a provisioner key is deleted, the associated daemon kept operating
on its existing WebSocket connection, because authentication was only
checked at connection establishment and deletion was a bare `DELETE`
with no session invalidation.

This adds four layers of defense so a deleted key promptly stops doing
work:

1. **Publish on delete.** `deleteProvisionerKey` publishes to a new
per-key pubsub channel (`coderd/pubsub.ProvisionerKeyDeletedChannel`)
after a successful delete. Publish errors are logged but still return
`204`, since layer 3 is the durable backstop.
2. **Subscribe and tear down.** The daemon serve handler subscribes to
its key's channel and terminates the DRPC session on a deletion event.
Termination is deferred while a job claimed by the session is active:
the daemon may finish and report the in-flight job
(`UpdateJob`/`CompleteJob` have no key check), and the last active job's
completion performs the cancellation. Because Postgres `LISTEN`/`NOTIFY`
does not buffer for non-listeners, the handler also performs a
synchronous key-existence re-check immediately after subscribing to
close the race between auth and subscription. The subscription uses
`SubscribeWithErr` so that an `ErrDroppedMessages` signal (emitted when
the pubsub listener reconnects) triggers the same key re-check, closing
the listener-outage window in which a deletion notification could be
missed.
3. **Backstop on acquire.** `AcquireJob` and `AcquireJobWithCancel`
verify the key still exists before waiting for a job, and the `Acquirer`
claims jobs in a transaction that first locks the worker's deletable key
(`LockProvisionerKeyByIDForShare`, a `FOR KEY SHARE` row lock held until
commit) before running the `AcquireProvisionerJob` claim, so a claim
cannot commit after the key's deletion. This guards against a missed
pubsub message. A missing key row surfaces as its own result rather than
overloading the claim query's no-rows response: the acquire terminates
with `ErrProvisionerKeyDeleted` (terminating the session, with the same
active-job deferral) and hands the consumed wakeup to another waiting
daemon in the same domain, rather than silently re-parking and starving
peers of job postings.
4. **Heartbeat watchdog.** The per-session heartbeat loop (1m interval)
also re-checks the key, so even a session whose deletion notification
was silently lost terminates within one heartbeat interval instead of
living until the connection breaks (same active-job deferral as layer
2). Reserved keys skip the check.

A job that is claimed but never delivered (the session or connection
dies between the database claim and the stream send) is marked failed
immediately on a fresh context, instead of staying assigned to the
worker until the job reaper.

Reserved keys (built-in, user-auth, PSK) are exempt throughout, since
they are not deletable rows. The acquire-time lookup runs as
`dbauthz.AsSystemReadProvisionerDaemons`, because the provisionerd role
cannot read provisioner keys and a provisioner key's RBAC object is a
provisioner daemon.

A single key can back many daemons (and span HA replicas), so the
per-key channel fans out to invalidate all of them at once. Per-key
channels keep the `LISTEN` count proportional to distinct keys rather
than waking every daemon on unrelated deletions.

### Known limitations

- **`UpdateJob`/`CompleteJob` intentionally have no key check.** By the
time those RPCs arrive the work has already run; rejecting completion
would strand a build in "running" (until the job reaper fails it) with
real infrastructure left unreconciled. Session termination is deferred
while a job is active so the completion can be reported; the daemon may
not receive the final RPC response when the deferred termination fires,
but the job's outcome is already persisted.
- **After termination, the daemon process redials and receives 401s
until restarted.** The dial-time exit logic only triggers on 403, and
the auth middleware returns 401 for an invalid key; this dial behavior
predates this PR and is tracked as a follow-up in
[PLAT-452](https://linear.app/codercom/issue/PLAT-452) (return 403 for
invalid provisioner keys).

## Tests

- `coderd/provisionerdserver`: `TestAcquireJob_ProvisionerKeyDeleted`
(both RPC variants), `TestAcquireJob_ReservedProvisionerKey`,
`TestHeartbeat_ProvisionerKeyDeleted` (heartbeat watchdog cancels the
session after key deletion), `TestAcquirer_ProvisionerKeyDeleted` (a
dead-key acquiree exits terminally and its clearance is promoted to a
peer in the same domain), and `TestTerminateSession_Deferral`
(termination is immediate when idle and deferred until the last active
job finishes).
- `coderd/database`: `TestAcquireProvisionerJob/ProvisionerKeyLock`
covers the lock query against real Postgres: it returns the key ID while
the row exists and no rows once it is deleted. The lock-then-claim
composition is pinned by `TestAcquirer_ProvisionerKeyDeleted`.
- `enterprise/coderd`:
`TestProvisionerDaemonServe/KeyDeletionClosesSession` asserts an active
session closes after its key is deleted.
`KeyDeletedDuringSetupClosesSession` covers the post-subscribe re-check
when a key is deleted between auth and subscription, and
`DroppedMessageClosesSession` covers the `ErrDroppedMessages` re-check
when a deletion is missed during a listener outage.

## Validation

- `make` pre-commit (gen/fmt/lint/build) passed via git hooks.
- Targeted tests pass; existing acquire tests pass with no regression.
- Manual: brought up a dev deployment (coder-in-coder) with a Premium
license, created a deletable provisioner key, and started an external
daemon with `coder provisionerd start`. Confirmed it authenticated via
the key and connected, appearing as `idle` in both `coder provisioner
list` (with the key name) and the organization Provisioners UI.
- Manual, idle teardown: deleted the key while the daemon was idle. The
server logged `provisioner key deleted, terminating session`, the
daemon's session closed immediately, and it dropped from `coder
provisioner list` (then entered the known 401 redial loop, PLAT-452).
- Manual, deferred termination: ran a workspace build (tagged template,
`sleep 45` in `local-exec`) pinned to the external daemon and deleted
the key mid-build. The server logged `deferring session cancellation
until active jobs finish`; the heartbeat watchdog re-checked mid-build
and re-deferred rather than force-killing. The build ran to completion
(`Apply complete`, workspace `Started`) and only then did `canceling
session after job completion` fire. The documented caveat reproduced:
the daemon lost the final `CompleteJob` ack, and the build outcome was
still persisted correctly.

<details>
<summary>Implementation plan and design decisions</summary>

### Design

- **Per-key vs global channel:** chose per-key
(`provisioner_key_deleted:<keyID>`) so daemons do not wake on unrelated
deletions. The cost is one `LISTEN` per distinct key per replica on the
shared listener connection, which is negligible against Coder's existing
channels.
- **Missing-key behavior on acquire:** returns an error that tears down
the acquire rather than silently returning an empty job.
- **Subscribe-startup race:** ordering is `authorize ->
UpsertProvisionerDaemon -> Subscribe -> GetProvisionerKeyByID`. The
post-subscribe re-check handles a deletion that committed before the
`LISTEN` registered (Postgres does not buffer notifications for
non-listeners; the in-process buffer only smooths bursts and drops on
overflow).
- **`NewServer` change:** `KeyID` was added to
`provisionerdserver.Options` to avoid a positional signature change
across call sites. The in-memory (built-in) daemon leaves it unset and
is therefore exempt.

### Files

- `coderd/pubsub/provisionerkeydeleted.go` (new) — channel helper.
- `enterprise/coderd/provisionerkeys.go` — publish on delete.
- `enterprise/coderd/provisionerdaemons.go` — subscribe, re-check,
cancel session; pass `KeyID`.
- `coderd/provisionerdserver/provisionerdserver.go` — `KeyID` option and
acquire-time existence check.

</details>

---

This pull request was created by Coder Agents on behalf of
@jscottmiller.
 2026-08-11 11:04:51 -05:00
Cian Johnston e5629126b7 docs: document prebuilds quota group behavior (#28015) 
Documents the behavior of the prebuilds quota group so admins can find
it and understand why the `prebuilds` user doesn't appear in its member
list.

Clarifies that prebuilt workspaces are attributed to a group named
`coderprebuiltworkspaces` (often referred to as the **Prebuilt
Workspaces** group), which defaults to a quota allowance of 0 and should
be adjusted to match the desired prebuild pool size. Adds a note that
the `prebuilds` user is a system user and is hidden from group member
listings in the dashboard and API.

> 🤖 This change was generated by Coder Agents (https://coder.com).
 2026-08-11 17:01:34 +01:00
Nick Vigilante 160964fc66 Update contributing link in CONTRIBUTING.md (#28029) 
This will eventually need to change, since I plan on moving the
CONTRIBUTING docs out of the product docs and back in GitHub, but this
fixes a broken link.

<!--

If you have used AI to produce some or all of this PR, please ensure you
have read our [AI Contribution
guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING)
before submitting.

-->
 2026-08-11 15:50:17 +00:00
Atif Ali c6e3be5090 chore(coderd/x/chatd): bump computer-use models to current frontier releases (#28026) 2026-08-11 20:49:49 +05:00
Nick Vigilante 0a7bb80a1e feat: make CLI/API doc generators emit front-matter metadata (Phase 2) (#27246) 
## Summary

Phase 2 of the H1 → front-matter migration (`DOCS-483`; parent
`DOCS-477`). Makes the two reference-doc generators emit per-page
metadata as YAML front matter instead of a leading `# H1`, so generated
pages are self-describing and `make gen` stops reverting migrated pages
(Phase 3).

Phase 1 (`DOCS-482`) made the coder.com renderers prefer a front-matter
`title` (manifest fallback).

> [!NOTE]
> Rebased onto `main` and fully regenerated, and updated across two
rounds of Coder Agents Review — see **Review follow-ups** below.

## Changes

- **`scripts/clidocgen/command.tpl` + `gen.go` + `main.go`** — front
matter now carries `title` (from `fullName`) and `description` (from the
command's `Short`), and the leading `# H1` is dropped. The CLI index
page's front matter is taken from the manifest `Command Line` route
(title/description/icon_path).
- **`scripts/apidocgen/postprocess/main.go`** — reads the manifest and,
at write time, injects front matter carrying each section's `title` plus
any curated `description`, `state`, and `icon_path`. The API index
page's front matter is taken from the manifest `REST API` route.
- **`scripts/docgenenv`** (new shared code) — one `YAMLScalar`
front-matter escaper, one `Route`/`Manifest` schema +
`LoadManifest`/`FindRoute`, and one `FrontMatter(Route)` emitter, all
imported by both generators (no duplicated helpers, types, or emitters).
- Regenerated all **166 CLI + 31 API** reference pages.

### Metadata → front matter, and what stays in the manifest

Every *per-page* manifest field is mirrored into the page's front
matter: `title`, `description`, `state`, `icon_path`. The **structural**
fields stay in `manifest.json`:

- `children` — the nav tree (explicitly out of scope).
- `path` — the manifest's pointer to the file; a page carrying its own
path is redundant/error-prone, so it's treated like `children`.

The fields are **duplicated** into front matter and **`manifest.json` is
left unchanged**, so this is a **no-op for rendering today** (coder.com
strips front matter for `llms`, and Algolia + the renderer read only
`title`). Removing the fields from the manifest is the natural
follow-up, gated on the renderer reading them from front matter first.

### Why the API side changes the postprocessor, not the `.dot` templates

The issue text suggested editing
`scripts/apidocgen/markdown-template/*`. I deliberately did **not**,
because the postprocessor derives each page's **filename, section title,
and manifest route** from the leading `# {name}` line
(`extractSectionName`). Emitting front matter from the template would
break that extraction. Instead the widdershins templates still emit `#
{name}`, the postprocessor reads it (and now verifies it), and then
swaps the heading for a front-matter block as each section is written.

## Review follow-ups (Coder Agents Review)

### Round 1 — addressed in `e53d5e03` (all threads resolved)

- **CRF-1 / CRF-4** — de-duplicated the escaper and the
`route`/`manifest` schema + traversal into `scripts/docgenenv` (shared
by both generators).
- **CRF-2** — `YAMLScalar` now quotes YAML-reserved scalars
(`true/false/null/…`, numbers); no current value is affected.
- **CRF-3** — added unit tests: a `YAMLScalar` round-trip, `FindRoute`,
and `prependFrontMatter`.
- **CRF-5** — the CLI and API **index** pages now mirror their manifest
route's title/description/icon_path instead of a hardcoded
`coder`/`API`, fixing a rendered-heading regression (`REST API`/`Command
Line` were being overwritten).
- **CRF-6** — dropped the dead `#login` anchor in
`docs/support/support-bundle.md` (the migrated `login.md` no longer
mints that heading anchor).
- **CRF-7 / CRF-8 / CRF-11** — renamed to `prependFrontMatter`, switched
to `bytes.Cut`, and it now strips the first line only when it is the `#
{name}` heading (`extractSectionName` errors otherwise).
- **CRF-9** — removed the orphan `docs/reference/api/chat.md` (not in
the manifest, not linked; the real page is `chats.md`).
- **CRF-10** — the metadata read and the manifest rewrite now share one
`FindRoute` traversal.
- **CRF-13** — moot under squash-merge; this branch is a single
scopeless commit.
- **CRF-15** — the pre-existing `sort.Slice`/`slices.IsSorted`
comparator is left as-is per the review (out of scope; safe today
because section names are unique).

### Round 2 — addressed in `ee796e7107` (all threads resolved)

- **CRF-16** (P1) — removed three em-dashes from new doc comments (the
only `make lint` failure on the prior head); the emdash gate is green.
- **CRF-17 / CRF-18** — unified front-matter emission into one shared
`docgenenv.FrontMatter(Route)`, used by the API postprocessor directly
and by `command.tpl` via a `frontMatter` template func. This retires the
hand-written template YAML and the
`indexTitle`/`indexDescription`/`indexIconPath` closures, so a new
front-matter field is wired in one place, and it gives the CLI index the
`state` arm it previously lacked. Verified byte-identical: a full CLI +
API regen produces zero page changes.
- **CRF-19** — CLI child sort switched to `slices.SortFunc` +
`cmp.Compare` (typed comparator).
- **CRF-20** — reworded the `prependFrontMatter` comment:
`extractSectionName`'s fail-fast is the load-bearing guard; the prefix
check is a defensive backstop.
- **CRF-21** — added `icon_path`/`state` coverage in `docgenenv`'s
`TestFrontMatter/AllFields` (the branch the index page relies on,
previously at 0%).
- **CRF-22** — `YAMLScalar` no longer emits a trailing-space value as a
bare scalar (YAML strips it on read, so it would not round-trip); added
test coverage.
- **CRF-24** — the shared emitter removed the duplicated `cliIndexRoute`
doc comment; the rationale now lives in one place.
- **CRF-23** (Phase 3, out of scope here) — noted: the API generator
wipes and regenerates `reference/api/` from the manifest, so removing
curated metadata from the manifest in Phase 3 needs another source first
(a generator that preserves existing front matter, or metadata carried
alongside the swagger annotations).
- **Process (Mafu-san)** — the verification set below now leads with
`make lint`, the mandatory CI gate that the earlier list omitted.

## Cross-repo dependency

**Resolved — this PR no longer has a hard merge-ordering gate** (CRF-14
was right; the earlier "must merge after #968" note was stale).

The coder.com surfaces that would otherwise leak raw front matter from
`coder/coder` `main` are already front-matter-aware on merged PRs:

- **coder.com#964** (`DOCS-554`, llms-full.txt corpus + Algolia) —
**merged**.
- **coder.com#974** (`DOCS-574`, the `.md` proxy twin + `llms.txt` index
titles) — **merged**.

coder.com#968 (`DOCS-577`) was re-scoped to only the renderer
route-metadata generalization; it's a no-op on today's corpus and its
own description confirms the "deploy before the generators" constraint
no longer applies (that was driven by the llms corpus, now in #964).
Worth a final confirmation that #964/#974 are **deployed** before merge,
but there's no branch/PR ordering blocker left.

## Verification & evidence

AI was the primary author of this PR (see disclosure below); per the [AI
Contribution
Guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING)
here is manual verification.

- `make lint` (golangci-lint + the emdash gate) passes; `go build` / `go
vet` / `go test` are clean for the generators + `scripts/docgenenv`;
`pnpm check-docs` passes.
- `swagger.json`, `docs.go`, and `manifest.json` are **unchanged** —
metadata is duplicated into front matter; command/section names and
routes did not move.
- The diff is purely additive front matter
(`title`/`description`/`state`/`icon_path`) + the leading H1 removal; no
body reflow. A full CLI + API regen produces **zero** page changes
beyond the two index pages.

<details>
<summary>Terminal evidence</summary>

CLI `description` from the command's `Short` (`YAMLScalar` quotes when
needed, e.g. a `Short` with a colon):

```md
---
title: server
description: Start a Coder server
---
```

API pages inherit curated manifest metadata (only Agents/Chats have any
today):

```md
---
title: Chats
description: "REST endpoints for Coder Agents Chats API (programmatic agent sessions)."
state:
  - early access
---
```

Diff scope + "no body changes" proof (uses an explicit `base..HEAD`
range, so it actually tests the claim):

```
$ git diff --shortstat origin/main
 210 files changed, 1447 insertions(+), 344 deletions(-)
# = 166 CLI + 31 API reference pages + generators + scripts/docgenenv
# swagger.json / docs.go / manifest.json: NOT modified

# Every removed line under docs/reference is a leading "# H1"; nothing else:
$ git diff origin/main..HEAD -- docs/reference/ | grep '^-' | grep -v '^---' | grep -v '^-# '
(empty)

$ pnpm check-docs
Summary: 0 error(s)
```

</details>

Linear: DOCS-483

> This PR was created with AI assistance (Coder Agents).
 2026-08-11 15:22:55 +00:00
Cian Johnston 5febde0ebb fix: disable keep-alives on mock aibridged to prevent stale-conn EOF (#28016) 
Fixes the Windows-only `TestProxy_HotReloadRouting` EOF flake (AIGOV-430
/ [internal#1564](https://github.com/coder/internal/issues/1564)).

## Root cause

The proxy forwards MITM'd requests to aibridged over a keep-alive-pooled
`http.Transport`. net/http will not retry a POST on a reused-but-closed
pooled connection (a POST isn't replayable), so a stale reuse of a conn
the mock aibridged has closed surfaces as a bare `EOF` on the Windows
runner. goproxy turns that upstream round-trip error into a closed MITM
connection, so the test client sees `Post
"https://alpha.invalid/v1/messages": EOF`.

This is a stale pooled-connection reuse failure, not a routing or
hot-reload bug: `Reload()` is a synchronous atomic router swap and never
touches the upstream transport.

## Fix

`bridged.Config.SetKeepAlivesEnabled(false)` on the mock aibridged
backend forces a fresh proxy→aibridged connection per request,
eliminating the stale-reuse failure by construction. No production
changes.

## Verification

- `go test -race` of the reload family passes repeatedly (`-count=10`,
earlier `-count=20` and full package `-race`).
- Cannot reproduce the Windows closed-socket semantics on a Linux
runner, so this removes the failure class rather than proving it;
Windows CI is the confirmation.

Closes https://linear.app/codercom/issue/AIGOV-430

---

Generated by a Coder agent.
 2026-08-11 15:48:23 +01:00
Thomas Kosiewski 2c35d33a28 fix(.github/workflows): run windows mise install under bash, tolerate missing mtimehash (#28020) 
Closes coder/internal#1630 (Linear CODAGT-879).

## Problem

`test-go-pg (windows-2022)` flaked with `mtimehash: command not found`
(exit 127) before any tests ran. The `Install Go mise tools` step ran
`retry.sh` (a bash script) without `shell: bash`, so Windows executed it
under the default PowerShell shell, which reports success without
actually running the install. A warm mise tool cache masks the defect,
making it intermittent. #27483 fixed the `ci.yaml` `test-go-pg` step,
but two gaps remained.

## Changes

- **`nightly-gauntlet.yaml`**: add `shell: bash` to its `Install Go mise
tools` step, which had the identical unfixed defect on the
`windows-2022` matrix entry (installs `gotestsum` the same way).
- **`ci.yaml`**: the `Normalize File and Directory Timestamps` step now
warns and skips instead of failing the job when `mtimehash` is missing,
since it only optimizes Go test cache hits. This is the follow-up
hardening suggested in coder/internal#1630 so a cache helper can never
again prevent the tests from running.

## Reproduction and verification on a real Windows runner

A temporary workflow on this branch (removed in the final commit)
recreated the pre-#27483 step shape on `depot-windows-2022-16` with the
mise CI cache disabled to emulate the cache-miss path:

- **Repro run
[31484281427](https://github.com/coder/coder/actions/runs/31484281427)**:
the default-shell install step reported `success` under `pwsh.EXE` with
no install output; the subsequent bash step failed with `mtimehash:
command not found`, pipeline exit code 127 — exactly matching the flake
evidence.
- **Verification run
[31484905616](https://github.com/coder/coder/actions/runs/31484905616)**
(all green): with `shell: bash`, mise builds mtimehash and the exact
production `find . -type f ! -path ./.git/\*\* | mtimehash` command runs
cleanly.

## Validation

- `actionlint` and `make lint/actions/zizmor` pass on the modified
workflows.
- Pre-commit hooks green on all commits.

---
_Generated with [`mux`](https://github.com/coder/mux) • Model:
`anthropic:claude-fable-5` • Thinking: `xhigh`_
 2026-08-11 16:46:37 +02:00
Atif Ali d7953bd046 fix(coderd): use service account wording in account notifications (#27536) 2026-08-11 13:16:25 +00:00
Matt VollmerandNick Vigilante 75e0790cd7 docs: remove beta references from Coder Agents docs and manifest (#27939) 
Removes all references to "beta" from the Coder Agents documentation
under `docs/ai-coder/agents/` and the corresponding `"state": ["beta"]`
entries in `docs/manifest.json`. Also updates screenshots, video, and
hero image, and regenerates the auto-generated feature-stages table.

**Beta reference removal:**
- `getting-started.md`: Removed "Coder Agents is in Beta" from the top
note, "is in beta" from the Chats API note, and "during Beta" from the
feedback section. Removed the version/stability note pinning 2.33.1.
- `index.md`: Removed the "Product status" section that stated Coder
Agents is in Beta.
- `manifest.json`: Removed `"state": ["beta"]` from 17 entries for pages
under `docs/ai-coder/agents/`. Preserved all `premium` and `early
access` states.
- `feature-stages.md`: Regenerated the auto-generated beta features
table, which no longer lists Coder Agents.

**Asset updates:**
- `coder-agents-ui.mp4`: Updated demo video on the agents landing page.
- `llm-providers.png`: Updated LLM provider support screenshot.
- `models-list.png`: Updated models list screenshot.
- `models-add-model.png`: Updated add model form screenshot.
- `agents-hero-image.png`: Updated hero image on the `docs/ai-coder`
landing page.

Two references in `models.md` (`v1beta` in the Google Gemini API URL and
`anthropic-beta` in the Anthropic header name) were left unchanged as
they are provider API identifiers, not product status labels.

PR generated with Coder Agents

---------

Co-authored-by: Nick Vigilante <nickvigilante@users.noreply.github.com>
 2026-08-11 08:57:57 -04:00
Hugo Dutka 7f75e625cc fix(coderd/x/chatd): deflake TestRunner_StartsRealInterruptTask (#28024) 
Closes
[ENG-2869](https://linear.app/codercom/issue/ENG-2869/flake-testpostchatmessagesbusyinterrupt).
The test used to assert a transient chat state, so I got rid of that
assertion. There was also a related race in `interruptChat` where the
test pubsub message buffer could be cleared after a runner posted the
pubsub message that tests look for.
 2026-08-11 12:56:06 +00:00
Michael Suchacz 57f38b5c24 fix: keep chat attachments while a linking chat exists 
Fixes https://linear.app/codercom/issue/CODAGT-616/keep-chat-attachments-while-chats-remain-unarchived

Chat attachments could disappear even though the chat was still available. This happened when a message was saved without recording which attachments it used, or when cleanup deleted attachments before an archived chat itself was removed.

Creating a chat, sending or queuing a message, and editing a message now record both the message and which attachments it uses as one operation. If the chat is already at the 50-attachment limit, the chat change fails without being partially saved.

Concurrent attachment writes serialize the 50-file cap per chat. Cleanup locks candidates and checks again for new links before deleting. If a file becomes unavailable after input validation, create, send, and edit return a clear client error and roll back the chat change.

An attachment stays available while any chat that uses it still exists. After an archived chat reaches the end of its retention period and is deleted, an old attachment that no remaining chat uses can be cleaned up. The retention guide and unavailable-attachment UI text document this lifecycle. This change cannot restore attachments that were already deleted.

The database migration adds two indexes so attachment cleanup stays fast as attachments accumulate.

> This PR was authored by Mux (AI) on Mike's behalf.
 2026-08-11 13:53:15 +02:00
dependabot[bot] 72ad835330 ci: bump the github-actions group with 10 updates (#28021) 
Bumps the github-actions group with 10 updates:

| Package | From | To |
| --- | --- | --- |
|
[step-security/harden-runner](https://github.com/step-security/harden-runner)
| `2.20.0` | `2.20.1` |
| [actions/checkout](https://github.com/actions/checkout) | `7.0.0` |
`7.0.1` |
| [pnpm/action-setup](https://github.com/pnpm/action-setup) | `6.0.9` |
`6.0.10` |
| [docker/login-action](https://github.com/docker/login-action) |
`4.5.2` | `4.6.0` |
| [actions/setup-java](https://github.com/actions/setup-java) | `5.6.0`
| `5.7.0` |
| [actions/attest](https://github.com/actions/attest) | `4.2.0` |
`4.2.2` |
|
[github/codeql-action/upload-sarif](https://github.com/github/codeql-action)
| `4.37.3` | `4.37.6` |
| [github/codeql-action/init](https://github.com/github/codeql-action) |
`4.37.3` | `4.37.6` |
|
[github/codeql-action/analyze](https://github.com/github/codeql-action)
| `4.37.3` | `4.37.6` |
|
[umbrelladocs/action-linkspector](https://github.com/umbrelladocs/action-linkspector)
| `1.5.4` | `1.5.5` |

Updates `step-security/harden-runner` from 2.20.0 to 2.20.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/step-security/harden-runner/releases">step-security/harden-runner's
releases</a>.</em></p>
<blockquote>
<h2>v2.20.1</h2>
<h2>What's Changed</h2>
<ul>
<li>AWS CodeBuild-hosted runner support</li>
<li>Implicitly allow single-labeled (internal) domains in
block-mode</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/step-security/harden-runner/compare/v2.20.0...v2.20.1">https://github.com/step-security/harden-runner/compare/v2.20.0...v2.20.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/step-security/harden-runner/commit/b09bb98e06d4d774595224525879c09bc6e98c40"><code>b09bb98</code></a>
Merge pull request <a
href="https://redirect.github.com/step-security/harden-runner/issues/680">#680</a>
from step-security/aws-code-build</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/35cd77bcf669054f67ffd3d2802ee54a4f13b5b6"><code>35cd77b</code></a>
docs: document the Global Block List in the features list</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/bb6dbef4bf53876cd2710acd1d36413620d20fb3"><code>bb6dbef</code></a>
chore: rebuild dist with clean dependency install</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/98f73c5a0d2b2cc518e6fb8d973a0a4dde00ba13"><code>98f73c5</code></a>
chore: update eBPF agent to v1.8.14</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/54193c17a4fa3883977217b9afe20378ebe60b19"><code>54193c1</code></a>
Reapply &quot;feat(runners): detect AWS CodeBuild-hosted runners as
third-party pr...</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/d22dd481cea4e96cedde031cfe600c248b592d54"><code>d22dd48</code></a>
Revert &quot;fix(self-hosted): flush agent events at job end when
deploy-on-self-h...</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/0ff09412fb572363b483a3c86ffe52fe61d9fd19"><code>0ff0941</code></a>
fix(self-hosted): flush agent events at job end when
deploy-on-self-hosted-vm...</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/a3c333d110c8d95f34488a22e0e56742cfb1b14f"><code>a3c333d</code></a>
Revert &quot;feat(runners): detect AWS CodeBuild-hosted runners as
third-party pro...</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/bf94c00d6bba2ae7c4a479b86653039811569968"><code>bf94c00</code></a>
feat(runners): detect AWS CodeBuild-hosted runners as third-party
provider</li>
<li><a
href="https://github.com/step-security/harden-runner/commit/514522c5e449f9e28fc901f770e08a573d413e67"><code>514522c</code></a>
fix(self-hosted): resolve runner user when USER env var is unset</li>
<li>See full diff in <a
href="https://github.com/step-security/harden-runner/compare/bf7454d06d71f1098171f2acdf0cd4708d7b5920...b09bb98e06d4d774595224525879c09bc6e98c40">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/checkout` from 7.0.0 to 7.0.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/releases">actions/checkout's
releases</a>.</em></p>
<blockquote>
<h2>v7.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>skip running unsafe pr check if input is default by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li>
<li>trim only ascii whitespace for branch by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li>
<li>escape values passed to --unset by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li>
<li>Various dependency updates</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v7...v7.0.1">https://github.com/actions/checkout/compare/v7...v7.0.1</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>v7.0.1</h2>
<ul>
<li>Skip running unsafe pr check if input is default by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li>
<li>Trim only ascii whitespace for branch by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li>
<li>Escape values passed to --unset by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li>
<li>Various dependency updates</li>
</ul>
<h2>v7.0.0</h2>
<ul>
<li>Block checking out fork PR for pull_request_target and workflow_run
by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
<li>Various dependency updates</li>
</ul>
<h2>v6.0.3</h2>
<ul>
<li>Fix checkout init for SHA-256 repositories by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
</ul>
<h2>v6.0.2</h2>
<ul>
<li>Fix tag handling: preserve annotations and explicit fetch-tags by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li>
</ul>
<h2>v6.0.1</h2>
<ul>
<li>Add worktree support for persist-credentials includeIf by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li>
</ul>
<h2>v6.0.0</h2>
<ul>
<li>Persist creds to a separate file by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li>
<li>Update README to include Node.js 24 support details and requirements
by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li>
</ul>
<h2>v5.0.1</h2>
<ul>
<li>Port v6 cleanup to v5 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li>
</ul>
<h2>v5.0.0</h2>
<ul>
<li>Update actions checkout to use node 24 by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
</ul>
<h2>v4.3.1</h2>
<ul>
<li>Port v6 cleanup to v4 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li>
</ul>
<h2>v4.3.0</h2>
<ul>
<li>docs: update README.md by <a
href="https://github.com/motss"><code>@​motss</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
<li>Add internal repos for checking out multiple repositories by <a
href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
<li>Documentation update - add recommended permissions to Readme by <a
href="https://github.com/benwells"><code>@​benwells</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
<li>Adjust positioning of user email note and permissions heading by <a
href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li>
<li>Update README.md by <a
href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
<li>Update CODEOWNERS for actions by <a
href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li>
<li>Update package dependencies by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
</ul>
<h2>v4.2.2</h2>
<ul>
<li><code>url-helper.ts</code> now leverages well-known environment
variables by <a href="https://github.com/jww3"><code>@​jww3</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li>
<li>Expand unit test coverage for <code>isGhes</code> by <a
href="https://github.com/jww3"><code>@​jww3</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li>
</ul>
<h2>v4.2.1</h2>
<ul>
<li>Check out other refs/* by commit if provided, fall back to ref by <a
href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/actions/checkout/compare/v7...3d3c42e5aac5ba805825da76410c181273ba90b1">compare
view</a></li>
</ul>
</details>
<br />

Updates `pnpm/action-setup` from 6.0.9 to 6.0.10
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pnpm/action-setup/releases">pnpm/action-setup's
releases</a>.</em></p>
<blockquote>
<h2>v6.0.10</h2>
<h2>What's Changed</h2>
<ul>
<li>docs(README): point users to the successor pnpm/setup action by <a
href="https://github.com/BlackHole1"><code>@​BlackHole1</code></a> in <a
href="https://redirect.github.com/pnpm/action-setup/pull/282">pnpm/action-setup#282</a></li>
<li>refactor: introduce restore keys for cache by <a
href="https://github.com/SukkaW"><code>@​SukkaW</code></a> in <a
href="https://redirect.github.com/pnpm/action-setup/pull/280">pnpm/action-setup#280</a></li>
<li>ci: use pnpm 11 for <code>pr-check</code> by <a
href="https://github.com/jamietanna"><code>@​jamietanna</code></a> in <a
href="https://redirect.github.com/pnpm/action-setup/pull/284">pnpm/action-setup#284</a></li>
<li>fix: update pnpm to v11.19.0 by <a
href="https://github.com/jamietanna"><code>@​jamietanna</code></a> in <a
href="https://redirect.github.com/pnpm/action-setup/pull/283">pnpm/action-setup#283</a></li>
<li>docs: update README to include devEngines.packageManager by <a
href="https://github.com/nemchik"><code>@​nemchik</code></a> in <a
href="https://redirect.github.com/pnpm/action-setup/pull/273">pnpm/action-setup#273</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/jamietanna"><code>@​jamietanna</code></a> made
their first contribution in <a
href="https://redirect.github.com/pnpm/action-setup/pull/284">pnpm/action-setup#284</a></li>
<li><a href="https://github.com/nemchik"><code>@​nemchik</code></a> made
their first contribution in <a
href="https://redirect.github.com/pnpm/action-setup/pull/273">pnpm/action-setup#273</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/pnpm/action-setup/compare/v6...v6.0.10">https://github.com/pnpm/action-setup/compare/v6...v6.0.10</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pnpm/action-setup/commit/0977fd99725f1db4007ccb2928dbb4e90d06cc86"><code>0977fd9</code></a>
docs: Update README to include devEngines.packageManager (<a
href="https://redirect.github.com/pnpm/action-setup/issues/273">#273</a>)</li>
<li><a
href="https://github.com/pnpm/action-setup/commit/48261aca053e825d84804e8ce05524d558249ac9"><code>48261ac</code></a>
fix: update pnpm to v11.19.0 (<a
href="https://redirect.github.com/pnpm/action-setup/issues/283">#283</a>)</li>
<li><a
href="https://github.com/pnpm/action-setup/commit/75677f717d48404e86ae8ee4891543f40de175aa"><code>75677f7</code></a>
ci: use pnpm 11 for <code>pr-check</code> (<a
href="https://redirect.github.com/pnpm/action-setup/issues/284">#284</a>)</li>
<li><a
href="https://github.com/pnpm/action-setup/commit/769ae71fb33e6e448a5dc92ad5da997c268eecec"><code>769ae71</code></a>
refactor: introduce restore keys for cache (<a
href="https://redirect.github.com/pnpm/action-setup/issues/280">#280</a>)</li>
<li><a
href="https://github.com/pnpm/action-setup/commit/6fed91f804570c1144bfe1911c348642cb986bd4"><code>6fed91f</code></a>
docs(README): point users to the successor pnpm/setup action (<a
href="https://redirect.github.com/pnpm/action-setup/issues/282">#282</a>)</li>
<li>See full diff in <a
href="https://github.com/pnpm/action-setup/compare/0ebf47130e4866e96fce0953f49152a61190b271...0977fd99725f1db4007ccb2928dbb4e90d06cc86">compare
view</a></li>
</ul>
</details>
<br />

Updates `docker/login-action` from 4.5.2 to 4.6.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/docker/login-action/releases">docker/login-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.6.0</h2>
<ul>
<li>Harden buildx scoped config path handling by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/1059">docker/login-action#1059</a></li>
<li>Bump <code>@​aws-sdk/client-ecr</code> and
<code>@​aws-sdk/client-ecr-public</code> to 3.1095.0 in <a
href="https://redirect.github.com/docker/login-action/pull/1051">docker/login-action#1051</a></li>
<li>Bump js-yaml from 5.2.1 to 5.2.2 in <a
href="https://redirect.github.com/docker/login-action/pull/1057">docker/login-action#1057</a></li>
<li>Bump postcss from 8.5.10 to 8.5.22 in <a
href="https://redirect.github.com/docker/login-action/pull/1056">docker/login-action#1056</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/login-action/compare/v4.5.2...v4.6.0">https://github.com/docker/login-action/compare/v4.5.2...v4.6.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/docker/login-action/commit/dbcb813823bdd20940b903addbd779551569679f"><code>dbcb813</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1051">#1051</a>
from docker/dependabot/npm_and_yarn/aws-sdk-dependen...</li>
<li><a
href="https://github.com/docker/login-action/commit/5bcb015ee6ec720ecdeaef2dc1164122e9b209fc"><code>5bcb015</code></a>
[dependabot skip] chore: update generated content</li>
<li><a
href="https://github.com/docker/login-action/commit/b30b2f2d3196c1714318ba0c3c3bec211d949752"><code>b30b2f2</code></a>
build(deps): bump the aws-sdk-dependencies group across 1 directory with
2 up...</li>
<li><a
href="https://github.com/docker/login-action/commit/9087f1e6d666fe0292409e3c819680c18526e108"><code>9087f1e</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1057">#1057</a>
from docker/dependabot/npm_and_yarn/js-yaml-5.2.2</li>
<li><a
href="https://github.com/docker/login-action/commit/0009830ea169ca16c24c0ea4cac1c325bfa3aee4"><code>0009830</code></a>
[dependabot skip] chore: update generated content</li>
<li><a
href="https://github.com/docker/login-action/commit/23255232d3e43c8f0052d9a0dba82a515a88ce92"><code>2325523</code></a>
build(deps): bump js-yaml from 5.2.1 to 5.2.2</li>
<li><a
href="https://github.com/docker/login-action/commit/4ec1d4a769e8b05a89a7396551dc38b329211688"><code>4ec1d4a</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1056">#1056</a>
from docker/dependabot/npm_and_yarn/postcss-8.5.22</li>
<li><a
href="https://github.com/docker/login-action/commit/5fc99ba47bca274c5a499688f71c7ea79c0ea1b3"><code>5fc99ba</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1053">#1053</a>
from docker/dependabot/github_actions/aws-actions/co...</li>
<li><a
href="https://github.com/docker/login-action/commit/e512bd59d16c53d79ea5c0f0e345fe554453c4bb"><code>e512bd5</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1052">#1052</a>
from docker/dependabot/github_actions/codeql-actions...</li>
<li><a
href="https://github.com/docker/login-action/commit/a146c91b8f371700d323bae808af7cbdc2766ed5"><code>a146c91</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1059">#1059</a>
from crazy-max/harden-buildx-scope-paths</li>
<li>Additional commits viewable in <a
href="https://github.com/docker/login-action/compare/371161bbe7024a29a25c5e19bfcbc0804fe9ad2c...dbcb813823bdd20940b903addbd779551569679f">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/setup-java` from 5.6.0 to 5.7.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/setup-java/releases">actions/setup-java's
releases</a>.</em></p>
<blockquote>
<h2>v5.7.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix npm audit failures on releases/v5 by <a
href="https://github.com/brunoborges"><code>@​brunoborges</code></a> in
<a
href="https://redirect.github.com/actions/setup-java/pull/1154">actions/setup-java#1154</a></li>
<li>Backport <a
href="https://redirect.github.com/actions/setup-java/issues/1151">#1151</a>:
Fix missing wrapper cache distributions by <a
href="https://github.com/brunoborges"><code>@​brunoborges</code></a> in
<a
href="https://redirect.github.com/actions/setup-java/pull/1153">actions/setup-java#1153</a></li>
<li>Deprecate legacy Adopt distributions in v5 by <a
href="https://github.com/brunoborges"><code>@​brunoborges</code></a> in
<a
href="https://redirect.github.com/actions/setup-java/pull/1186">actions/setup-java#1186</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-java/compare/v5.6.0...v5.7.0">https://github.com/actions/setup-java/compare/v5.6.0...v5.7.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/setup-java/commit/b6effb05e454b25005698d916606bdc6ffcbf961"><code>b6effb0</code></a>
Deprecate legacy Adopt distributions in v5 (<a
href="https://redirect.github.com/actions/setup-java/issues/1186">#1186</a>)</li>
<li><a
href="https://github.com/actions/setup-java/commit/e498d2a66a953492f322542257b22125c989b422"><code>e498d2a</code></a>
Backport <a
href="https://redirect.github.com/actions/setup-java/issues/1151">#1151</a>:
Fix missing wrapper cache distributions (<a
href="https://redirect.github.com/actions/setup-java/issues/1153">#1153</a>)</li>
<li><a
href="https://github.com/actions/setup-java/commit/6a3384db745932178632d0e22b2bd28cad1678e6"><code>6a3384d</code></a>
Fix npm audit failures on releases/v5 (<a
href="https://redirect.github.com/actions/setup-java/issues/1154">#1154</a>)</li>
<li>See full diff in <a
href="https://github.com/actions/setup-java/compare/03ad4de0992f5dab5e18fcb136590ce7c4a0ac95...b6effb05e454b25005698d916606bdc6ffcbf961">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/attest` from 4.2.0 to 4.2.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/attest/releases">actions/attest's
releases</a>.</em></p>
<blockquote>
<h2>v4.2.2</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump <code>@​sigstore/oci</code> from 0.7.1 to 0.7.2 by <a
href="https://github.com/bdehamer"><code>@​bdehamer</code></a> in <a
href="https://redirect.github.com/actions/attest/pull/469">actions/attest#469</a></li>
<li>Bump brace-expansion by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/attest/pull/468">actions/attest#468</a></li>
<li>Bump ip-address from 10.2.0 to 10.4.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/attest/pull/467">actions/attest#467</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/attest/compare/v4.2.1...v4.2.2">https://github.com/actions/attest/compare/v4.2.1...v4.2.2</a></p>
<h2>v4.2.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump tar from 7.5.17 to 7.5.21 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/attest/pull/459">actions/attest#459</a></li>
<li>fix: strip OCI image tag when pushing attestation to registry by <a
href="https://github.com/bdehamer"><code>@​bdehamer</code></a> in <a
href="https://redirect.github.com/actions/attest/pull/464">actions/attest#464</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/attest/compare/v4.2.0...v4.2.1">https://github.com/actions/attest/compare/v4.2.0...v4.2.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/attest/commit/1e69f48acb82d1966a394da916b4c1698aa569d6"><code>1e69f48</code></a>
Bump ip-address from 10.2.0 to 10.4.0 (<a
href="https://redirect.github.com/actions/attest/issues/467">#467</a>)</li>
<li><a
href="https://github.com/actions/attest/commit/02787ce2f81fbfbefd25c8a9c54441f7cdec4a1b"><code>02787ce</code></a>
Bump brace-expansion (<a
href="https://redirect.github.com/actions/attest/issues/468">#468</a>)</li>
<li><a
href="https://github.com/actions/attest/commit/98ac037e195b51fa969ebc56da4ccaa9c35fad71"><code>98ac037</code></a>
bump <code>@​sigstore/oci</code> from 0.7.1 to 0.7.2 (<a
href="https://redirect.github.com/actions/attest/issues/469">#469</a>)</li>
<li><a
href="https://github.com/actions/attest/commit/508db95dd578ae2727ebd6217d5ba78e4fbda05d"><code>508db95</code></a>
fix: strip OCI image tag when pushing attestation to registry (<a
href="https://redirect.github.com/actions/attest/issues/464">#464</a>)</li>
<li><a
href="https://github.com/actions/attest/commit/dda48f2935afea63fd4651871c16233251f9d06c"><code>dda48f2</code></a>
Bump the npm-development group across 1 directory with 6 updates (<a
href="https://redirect.github.com/actions/attest/issues/461">#461</a>)</li>
<li><a
href="https://github.com/actions/attest/commit/7d789a33ada19b33b74fbcdeb7f8e6cbb509a577"><code>7d789a3</code></a>
Bump the actions-minor group with 3 updates (<a
href="https://redirect.github.com/actions/attest/issues/463">#463</a>)</li>
<li><a
href="https://github.com/actions/attest/commit/1f3ca2fbe3d1c724d701286b30c7d90309029739"><code>1f3ca2f</code></a>
Add release-cutter canvas extension (<a
href="https://redirect.github.com/actions/attest/issues/454">#454</a>)</li>
<li><a
href="https://github.com/actions/attest/commit/d215549ae8a52064102300d4b4698f3fc1babad8"><code>d215549</code></a>
Bump tar from 7.5.17 to 7.5.21 (<a
href="https://redirect.github.com/actions/attest/issues/459">#459</a>)</li>
<li><a
href="https://github.com/actions/attest/commit/20c90ed94816337d30d322057e464c15e29f9890"><code>20c90ed</code></a>
Bump the npm-development group with 2 updates (<a
href="https://redirect.github.com/actions/attest/issues/455">#455</a>)</li>
<li><a
href="https://github.com/actions/attest/commit/43c2c81fd275fe2d0ac9a887891189fc000588f1"><code>43c2c81</code></a>
Bump the actions-minor group with 4 updates (<a
href="https://redirect.github.com/actions/attest/issues/456">#456</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/attest/compare/f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6...1e69f48acb82d1966a394da916b4c1698aa569d6">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action/upload-sarif` from 4.37.3 to 4.37.6
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/upload-sarif's
releases</a>.</em></p>
<blockquote>
<h2>v4.37.6</h2>
<ul>
<li>Changed the default filepath for the new remote file address format
that was introduced in CodeQL Action 4.37.0 / 3.37.0 to
<code>.github/codeql-config.yml</code> to align it with the suggested
path that is used elsewhere. <a
href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li>
</ul>
<h2>v4.37.5</h2>
<ul>
<li>Fixed a bug where a network error while streaming the download of
the CodeQL bundle could terminate the <code>init</code> Action instead
of falling back to downloading the bundle before extracting it. <a
href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li>
</ul>
<h2>v4.37.4</h2>
<ul>
<li>This version of the CodeQL Action adds support for the
<code>tools</code> input for the <code>codeql-action/init</code> step to
be specified using a <code>github-codeql-tools</code> <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository
property</a>. This feature will gradually be rolled out following the
release of this version. Once rolled out, this allows for the CodeQL CLI
version that is used in GitHub-managed workflows, such as Default Setup,
to be set to a custom value. For example, customers who run into issues
with rate limits when a new CodeQL CLI version is released can set the
value to <code>toolcache</code> to always use the CodeQL CLI version
that is available in the runner toolcache. For Advanced Setup workflows,
the value provided for <code>tools</code> in the workflow definition
always takes precedence unless the value of the repository property
starts with <code>!</code>. <a
href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/upload-sarif's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.37.6 - 04 Aug 2026</h2>
<ul>
<li>Changed the default filepath for the new remote file address format
that was introduced in CodeQL Action 4.37.0 / 3.37.0 to
<code>.github/codeql-config.yml</code> to align it with the suggested
path that is used elsewhere. <a
href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li>
</ul>
<h2>4.37.5 - 03 Aug 2026</h2>
<ul>
<li>Fixed a bug where a network error while streaming the download of
the CodeQL bundle could terminate the <code>init</code> Action instead
of falling back to downloading the bundle before extracting it. <a
href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li>
</ul>
<h2>4.37.4 - 29 Jul 2026</h2>
<ul>
<li>This version of the CodeQL Action adds support for the
<code>tools</code> input for the <code>codeql-action/init</code> step to
be specified using a <code>github-codeql-tools</code> <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository
property</a>. This feature will gradually be rolled out following the
release of this version. Once rolled out, this allows for the CodeQL CLI
version that is used in GitHub-managed workflows, such as Default Setup,
to be set to a custom value. For example, customers who run into issues
with rate limits when a new CodeQL CLI version is released can set the
value to <code>toolcache</code> to always use the CodeQL CLI version
that is available in the runner toolcache. For Advanced Setup workflows,
the value provided for <code>tools</code> in the workflow definition
always takes precedence unless the value of the repository property
starts with <code>!</code>. <a
href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li>
</ul>
<h2>4.37.3 - 22 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.2 - 21 Jul 2026</h2>
<ul>
<li>The new address format for the <code>config-file</code> input that
was introduced in CodeQL Action 4.37.0 is now enabled by default. In
addition to the format described there, the <code>remote=</code> prefix
can now be used to explicitly indicate that the input refers to a remote
file. All previous input formats continue to be accepted as well. <a
href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li>
<li>The CodeQL Action can now make use of <a
href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured
private registries</a> in Default Setup to retrieve CodeQL configuration
files from remote repositories that require authentication. This will
allow customers to store their CodeQL configuration in a single
repository that can then be referenced by Default Setup workflows in
other repositories. We expect to roll this and other, related changes
out to everyone in July. <a
href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li>
</ul>
<h2>4.37.1 - 16 Jul 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.20.6 and earlier. These versions of
CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise
Server 3.16, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li>
</ul>
<h2>4.37.0 - 08 Jul 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li>
<li>In addition to the existing input format, the
<code>config-file</code> input for the <code>codeql-action/init</code>
step will soon support a new <code>[owner/]repo[@ref][:path]</code>
format. All components except the repository name are optional. If
omitted, <code>owner</code> defaults to the same owner as the repository
the analysis is running for, <code>ref</code> to <code>main</code>, and
<code>path</code> to <code>.github/codeql-action.yaml</code>. Support
for this format ships in this version of the CodeQL Action, but will
only be enabled over the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li>
</ul>
<h2>4.36.3 - 01 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.36.2 - 04 Jun 2026</h2>
<ul>
<li>Cache CodeQL CLI version information across Actions steps. <a
href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li>
<li>Reduce requests while waiting for analysis processing by using
exponential backoff when polling SARIF processing status. <a
href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/5595ccaf912efad79be6eef63a5619ff05969be3"><code>5595cca</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4071">#4071</a>
from github/update-v4.37.6-6a9359a1b</li>
<li><a
href="https://github.com/github/codeql-action/commit/ec9c75796a7f2cee5af0c5ffa0b81dc3bb58754b"><code>ec9c757</code></a>
Add change note for PR 4070</li>
<li><a
href="https://github.com/github/codeql-action/commit/45c8742e17cbd668814137f95e605d925b8722a2"><code>45c8742</code></a>
Update changelog for v4.37.6</li>
<li><a
href="https://github.com/github/codeql-action/commit/6a9359a1bd054c53cae7bb737bd8d796cfbf3014"><code>6a9359a</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4070">#4070</a>
from github/mbg/remote-address/change-file-default</li>
<li><a
href="https://github.com/github/codeql-action/commit/065cdc0394d424981db720df63ebc570e41b775f"><code>065cdc0</code></a>
Change <code>DEFAULT_CONFIG_FILE_NAME</code></li>
<li><a
href="https://github.com/github/codeql-action/commit/f99dd5aeee9cf92e92d0c700cb0aa7afd7bbf431"><code>f99dd5a</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4066">#4066</a>
from github/dependabot/npm_and_yarn/js-yaml-5.2.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/1804b211a343d69a6584d26fb3a68a8fe6ca39d4"><code>1804b21</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4068">#4068</a>
from github/mergeback/v4.37.5-to-main-d1ba80a1</li>
<li><a
href="https://github.com/github/codeql-action/commit/3020a2f46286abb1704269b22ada83bd0e81c64f"><code>3020a2f</code></a>
Rebuild</li>
<li><a
href="https://github.com/github/codeql-action/commit/93c3a5a40b7affbf8ea6a480767ed0db8e8d3c5c"><code>93c3a5a</code></a>
Update changelog and version after v4.37.5</li>
<li><a
href="https://github.com/github/codeql-action/commit/d1ba80a13dd99fba24a470575428917156a28b43"><code>d1ba80a</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4067">#4067</a>
from github/update-v4.37.5-1cd4d01d5</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...5595ccaf912efad79be6eef63a5619ff05969be3">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action/init` from 4.37.3 to 4.37.6
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/init's
releases</a>.</em></p>
<blockquote>
<h2>v4.37.6</h2>
<ul>
<li>Changed the default filepath for the new remote file address format
that was introduced in CodeQL Action 4.37.0 / 3.37.0 to
<code>.github/codeql-config.yml</code> to align it with the suggested
path that is used elsewhere. <a
href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li>
</ul>
<h2>v4.37.5</h2>
<ul>
<li>Fixed a bug where a network error while streaming the download of
the CodeQL bundle could terminate the <code>init</code> Action instead
of falling back to downloading the bundle before extracting it. <a
href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li>
</ul>
<h2>v4.37.4</h2>
<ul>
<li>This version of the CodeQL Action adds support for the
<code>tools</code> input for the <code>codeql-action/init</code> step to
be specified using a <code>github-codeql-tools</code> <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository
property</a>. This feature will gradually be rolled out following the
release of this version. Once rolled out, this allows for the CodeQL CLI
version that is used in GitHub-managed workflows, such as Default Setup,
to be set to a custom value. For example, customers who run into issues
with rate limits when a new CodeQL CLI version is released can set the
value to <code>toolcache</code> to always use the CodeQL CLI version
that is available in the runner toolcache. For Advanced Setup workflows,
the value provided for <code>tools</code> in the workflow definition
always takes precedence unless the value of the repository property
starts with <code>!</code>. <a
href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/init's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.37.6 - 04 Aug 2026</h2>
<ul>
<li>Changed the default filepath for the new remote file address format
that was introduced in CodeQL Action 4.37.0 / 3.37.0 to
<code>.github/codeql-config.yml</code> to align it with the suggested
path that is used elsewhere. <a
href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li>
</ul>
<h2>4.37.5 - 03 Aug 2026</h2>
<ul>
<li>Fixed a bug where a network error while streaming the download of
the CodeQL bundle could terminate the <code>init</code> Action instead
of falling back to downloading the bundle before extracting it. <a
href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li>
</ul>
<h2>4.37.4 - 29 Jul 2026</h2>
<ul>
<li>This version of the CodeQL Action adds support for the
<code>tools</code> input for the <code>codeql-action/init</code> step to
be specified using a <code>github-codeql-tools</code> <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository
property</a>. This feature will gradually be rolled out following the
release of this version. Once rolled out, this allows for the CodeQL CLI
version that is used in GitHub-managed workflows, such as Default Setup,
to be set to a custom value. For example, customers who run into issues
with rate limits when a new CodeQL CLI version is released can set the
value to <code>toolcache</code> to always use the CodeQL CLI version
that is available in the runner toolcache. For Advanced Setup workflows,
the value provided for <code>tools</code> in the workflow definition
always takes precedence unless the value of the repository property
starts with <code>!</code>. <a
href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li>
</ul>
<h2>4.37.3 - 22 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.2 - 21 Jul 2026</h2>
<ul>
<li>The new address format for the <code>config-file</code> input that
was introduced in CodeQL Action 4.37.0 is now enabled by default. In
addition to the format described there, the <code>remote=</code> prefix
can now be used to explicitly indicate that the input refers to a remote
file. All previous input formats continue to be accepted as well. <a
href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li>
<li>The CodeQL Action can now make use of <a
href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured
private registries</a> in Default Setup to retrieve CodeQL configuration
files from remote repositories that require authentication. This will
allow customers to store their CodeQL configuration in a single
repository that can then be referenced by Default Setup workflows in
other repositories. We expect to roll this and other, related changes
out to everyone in July. <a
href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li>
</ul>
<h2>4.37.1 - 16 Jul 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.20.6 and earlier. These versions of
CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise
Server 3.16, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li>
</ul>
<h2>4.37.0 - 08 Jul 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li>
<li>In addition to the existing input format, the
<code>config-file</code> input for the <code>codeql-action/init</code>
step will soon support a new <code>[owner/]repo[@ref][:path]</code>
format. All components except the repository name are optional. If
omitted, <code>owner</code> defaults to the same owner as the repository
the analysis is running for, <code>ref</code> to <code>main</code>, and
<code>path</code> to <code>.github/codeql-action.yaml</code>. Support
for this format ships in this version of the CodeQL Action, but will
only be enabled over the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li>
</ul>
<h2>4.36.3 - 01 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.36.2 - 04 Jun 2026</h2>
<ul>
<li>Cache CodeQL CLI version information across Actions steps. <a
href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li>
<li>Reduce requests while waiting for analysis processing by using
exponential backoff when polling SARIF processing status. <a
href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/5595ccaf912efad79be6eef63a5619ff05969be3"><code>5595cca</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4071">#4071</a>
from github/update-v4.37.6-6a9359a1b</li>
<li><a
href="https://github.com/github/codeql-action/commit/ec9c75796a7f2cee5af0c5ffa0b81dc3bb58754b"><code>ec9c757</code></a>
Add change note for PR 4070</li>
<li><a
href="https://github.com/github/codeql-action/commit/45c8742e17cbd668814137f95e605d925b8722a2"><code>45c8742</code></a>
Update changelog for v4.37.6</li>
<li><a
href="https://github.com/github/codeql-action/commit/6a9359a1bd054c53cae7bb737bd8d796cfbf3014"><code>6a9359a</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4070">#4070</a>
from github/mbg/remote-address/change-file-default</li>
<li><a
href="https://github.com/github/codeql-action/commit/065cdc0394d424981db720df63ebc570e41b775f"><code>065cdc0</code></a>
Change <code>DEFAULT_CONFIG_FILE_NAME</code></li>
<li><a
href="https://github.com/github/codeql-action/commit/f99dd5aeee9cf92e92d0c700cb0aa7afd7bbf431"><code>f99dd5a</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4066">#4066</a>
from github/dependabot/npm_and_yarn/js-yaml-5.2.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/1804b211a343d69a6584d26fb3a68a8fe6ca39d4"><code>1804b21</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4068">#4068</a>
from github/mergeback/v4.37.5-to-main-d1ba80a1</li>
<li><a
href="https://github.com/github/codeql-action/commit/3020a2f46286abb1704269b22ada83bd0e81c64f"><code>3020a2f</code></a>
Rebuild</li>
<li><a
href="https://github.com/github/codeql-action/commit/93c3a5a40b7affbf8ea6a480767ed0db8e8d3c5c"><code>93c3a5a</code></a>
Update changelog and version after v4.37.5</li>
<li><a
href="https://github.com/github/codeql-action/commit/d1ba80a13dd99fba24a470575428917156a28b43"><code>d1ba80a</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4067">#4067</a>
from github/update-v4.37.5-1cd4d01d5</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...5595ccaf912efad79be6eef63a5619ff05969be3">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action/analyze` from 4.37.3 to 4.37.6
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/analyze's
releases</a>.</em></p>
<blockquote>
<h2>v4.37.6</h2>
<ul>
<li>Changed the default filepath for the new remote file address format
that was introduced in CodeQL Action 4.37.0 / 3.37.0 to
<code>.github/codeql-config.yml</code> to align it with the suggested
path that is used elsewhere. <a
href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li>
</ul>
<h2>v4.37.5</h2>
<ul>
<li>Fixed a bug where a network error while streaming the download of
the CodeQL bundle could terminate the <code>init</code> Action instead
of falling back to downloading the bundle before extracting it. <a
href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li>
</ul>
<h2>v4.37.4</h2>
<ul>
<li>This version of the CodeQL Action adds support for the
<code>tools</code> input for the <code>codeql-action/init</code> step to
be specified using a <code>github-codeql-tools</code> <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository
property</a>. This feature will gradually be rolled out following the
release of this version. Once rolled out, this allows for the CodeQL CLI
version that is used in GitHub-managed workflows, such as Default Setup,
to be set to a custom value. For example, customers who run into issues
with rate limits when a new CodeQL CLI version is released can set the
value to <code>toolcache</code> to always use the CodeQL CLI version
that is available in the runner toolcache. For Advanced Setup workflows,
the value provided for <code>tools</code> in the workflow definition
always takes precedence unless the value of the repository property
starts with <code>!</code>. <a
href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/analyze's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.37.6 - 04 Aug 2026</h2>
<ul>
<li>Changed the default filepath for the new remote file address format
that was introduced in CodeQL Action 4.37.0 / 3.37.0 to
<code>.github/codeql-config.yml</code> to align it with the suggested
path that is used elsewhere. <a
href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li>
</ul>
<h2>4.37.5 - 03 Aug 2026</h2>
<ul>
<li>Fixed a bug where a network error while streaming the download of
the CodeQL bundle could terminate the <code>init</code> Action instead
of falling back to downloading the bundle before extracting it. <a
href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li>
</ul>
<h2>4.37.4 - 29 Jul 2026</h2>
<ul>
<li>This version of the CodeQL Action adds support for the
<code>tools</code> input for the <code>codeql-action/init</code> step to
be specified using a <code>github-codeql-tools</code> <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository
property</a>. This feature will gradually be rolled out following the
release of this version. Once rolled out, this allows for the CodeQL CLI
version that is used in GitHub-managed workflows, such as Default Setup,
to be set to a custom value. For example, customers who run into issues
with rate limits when a new CodeQL CLI version is released can set the
value to <code>toolcache</code> to always use the CodeQL CLI version
that is available in the runner toolcache. For Advanced Setup workflows,
the value provided for <code>tools</code> in the workflow definition
always takes precedence unless the value of the repository property
starts with <code>!</code>. <a
href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li>
</ul>
<h2>4.37.3 - 22 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.2 - 21 Jul 2026</h2>
<ul>
<li>The new address format for the <code>config-file</code> input that
was introduced in CodeQL Action 4.37.0 is now enabled by default. In
addition to the format described there, the <code>remote=</code> prefix
can now be used to explicitly indicate that the input refers to a remote
file. All previous input formats continue to be accepted as well. <a
href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li>
<li>The CodeQL Action can now make use of <a
href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured
private registries</a> in Default Setup to retrieve CodeQL configuration
files from remote repositories that require authentication. This will
allow customers to store their CodeQL configuration in a single
repository that can then be referenced by Default Setup workflows in
other repositories. We expect to roll this and other, related changes
out to everyone in July. <a
href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li>
</ul>
<h2>4.37.1 - 16 Jul 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.20.6 and earlier. These versions of
CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise
Server 3.16, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li>
</ul>
<h2>4.37.0 - 08 Jul 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li>
<li>In addition to the existing input format, the
<code>config-file</code> input for the <code>codeql-action/init</code>
step will soon support a new <code>[owner/]repo[@ref][:path]</code>
format. All components except the repository name are optional. If
omitted, <code>owner</code> defaults to the same owner as the repository
the analysis is running for, <code>ref</code> to <code>main</code>, and
<code>path</code> to <code>.github/codeql-action.yaml</code>. Support
for this format ships in this version of the CodeQL Action, but will
only be enabled over the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li>
</ul>
<h2>4.36.3 - 01 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.36.2 - 04 Jun 2026</h2>
<ul>
<li>Cache CodeQL CLI version information across Actions steps. <a
href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li>
<li>Reduce requests while waiting for analysis processing by using
exponential backoff when polling SARIF processing status. <a
href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/5595ccaf912efad79be6eef63a5619ff05969be3"><code>5595cca</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4071">#4071</a>
from github/update-v4.37.6-6a9359a1b</li>
<li><a
href="https://github.com/github/codeql-action/commit/ec9c75796a7f2cee5af0c5ffa0b81dc3bb58754b"><code>ec9c757</code></a>
Add change note for PR 4070</li>
<li><a
href="https://github.com/github/codeql-action/commit/45c8742e17cbd668814137f95e605d925b8722a2"><code>45c8742</code></a>
Update changelog for v4.37.6</li>
<li><a
href="https://github.com/github/codeql-action/commit/6a9359a1bd054c53cae7bb737bd8d796cfbf3014"><code>6a9359a</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4070">#4070</a>
from github/mbg/remote-address/change-file-default</li>
<li><a
href="https://github.com/github/codeql-action/commit/065cdc0394d424981db720df63ebc570e41b775f"><code>065cdc0</code></a>
Change <code>DEFAULT_CONFIG_FILE_NAME</code></li>
<li><a
href="https://github.com/github/codeql-action/commit/f99dd5aeee9cf92e92d0c700cb0aa7afd7bbf431"><code>f99dd5a</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4066">#4066</a>
from github/dependabot/npm_and_yarn/js-yaml-5.2.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/1804b211a343d69a6584d26fb3a68a8fe6ca39d4"><code>1804b21</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4068">#4068</a>
from github/mergeback/v4.37.5-to-main-d1ba80a1</li>
<li><a
href="https://github.com/github/codeql-action/commit/3020a2f46286abb1704269b22ada83bd0e81c64f"><code>3020a2f</code></a>
Rebuild</li>
<li><a
href="https://github.com/github/codeql-action/commit/93c3a5a40b7affbf8ea6a480767ed0db8e8d3c5c"><code>93c3a5a</code></a>
Update changelog and version after v4.37.5</li>
<li><a
href="https://github.com/github/codeql-action/commit/d1ba80a13dd99fba24a470575428917156a28b43"><code>d1ba80a</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4067">#4067</a>
from github/update-v4.37.5-1cd4d01d5</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...5595ccaf912efad79be6eef63a5619ff05969be3">compare
view</a></li>
</ul>
</details>
<br />

Updates `umbrelladocs/action-linkspector` from 1.5.4 to 1.5.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/umbrelladocs/action-linkspector/releases">umbrelladocs/action-linkspector's
releases</a>.</em></p>
<blockquote>
<h2>Release v1.5.5</h2>
<p>v1.5.5: PR <a
href="https://redirect.github.com/umbrelladocs/action-linkspector/issues/70">#70</a>
- Update linkspector version to 0.5.6</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/UmbrellaDocs/action-linkspector/commit/568ec8d29fa92b31fd9ea5381e155c51e922af83"><code>568ec8d</code></a>
Merge pull request <a
href="https://redirect.github.com/umbrelladocs/action-linkspector/issues/70">#70</a>
from UmbrellaDocs/update-linkspector-version</li>
<li><a
href="https://github.com/UmbrellaDocs/action-linkspector/commit/6132d9352f02722911dc20ede6cff55f5e1b6889"><code>6132d93</code></a>
Update linkspector version to 0.5.6</li>
<li><a
href="https://github.com/UmbrellaDocs/action-linkspector/commit/2f82e255e59a3eff9fd481ff06ef80dacd7218f2"><code>2f82e25</code></a>
Merge pull request <a
href="https://redirect.github.com/umbrelladocs/action-linkspector/issues/68">#68</a>
from sschuberth/patch-1</li>
<li><a
href="https://github.com/UmbrellaDocs/action-linkspector/commit/72f6bee7082d4a2ddfd80f0b126df4c03a503797"><code>72f6bee</code></a>
fix brackets around dpkg</li>
<li><a
href="https://github.com/UmbrellaDocs/action-linkspector/commit/e0946b31e20e925e6b9d15d34093c606d9d3535e"><code>e0946b3</code></a>
ci(github): Run all tests on Ubuntu 24.04 and 26.04</li>
<li><a
href="https://github.com/UmbrellaDocs/action-linkspector/commit/8b13e46659fda3489c2554d86bb3ad5323d698d2"><code>8b13e46</code></a>
fix: Extend the AppArmor check to Ubuntu &gt; 24.04</li>
<li>See full diff in <a
href="https://github.com/umbrelladocs/action-linkspector/compare/6c637d70424624231467a4ca918be54fa3b792d0...568ec8d29fa92b31fd9ea5381e155c51e922af83">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-11 11:24:39 +00:00
Danielle Maywood df278ec079 fix: derive diff cache keys from patch content (#27987) 2026-08-11 12:22:13 +01:00
dependabot[bot] b0afab063f chore: bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.69.0 to 0.70.0 (#28018) 
Bumps
[go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp](https://github.com/open-telemetry/opentelemetry-go-contrib)
from 0.69.0 to 0.70.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md">go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp's
changelog</a>.</em></p>
<blockquote>
<h2>[1.45.0/2.5.2/0.70.0/0.37.2/0.25.0/0.20.0/0.16.2/0.17.0] -
2026-08-03</h2>
<h3>Added</h3>
<ul>
<li>Add <code>go.opentelemetry.io/contrib/detectors/ibmcloud/vpc</code>,
a new resource detector for IBM Cloud VPC virtual server instances,
ported from
<code>github.com/open-telemetry/opentelemetry-collector-contrib/processor/resourcedetectionprocessor/internal/ibmcloud/vpc</code>.
Detects <code>cloud.provider</code>, <code>cloud.platform</code>,
<code>cloud.region</code>, <code>cloud.availability_zone</code>,
<code>cloud.account.id</code>, <code>cloud.resource_id</code>,
<code>host.id</code>, <code>host.image.id</code>,
<code>host.image.name</code>, <code>host.name</code>, and
<code>host.type</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9011">#9011</a>)</li>
<li>Add <code>go.opentelemetry.io/contrib/detectors/k8sapi</code>, a new
resource detector that queries the Kubernetes API. Detects
<code>k8s.node.name</code> and <code>k8s.node.uid</code> when
<code>K8S_NODE_NAME</code> is set via the downward API, and
<code>k8s.cluster.uid</code> derived from the kube-system namespace UID
(works on any Kubernetes distribution). (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9108">#9108</a>)</li>
<li>Add new <code>elasticbeanstalk</code> resource detector for AWS
Elastic Beanstalk, ported from
<code>processor/resourcedetectionprocessor/internal/aws/elasticbeanstalk</code>
in opentelemetry-collector-contrib. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8993">#8993</a>)</li>
<li>The resource created by
<code>go.opentelemetry.io/contrib/otelconf</code> now includes <a
href="https://pkg.go.dev/go.opentelemetry.io/otel/sdk/resource#Default">default
SDK attributes</a>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8990">#8990</a>)</li>
<li>Add support for the <code>aws.ecs</code> resource detector in
<code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8915">#8915</a>)</li>
<li>Add support for the <code>aws.eks</code> resource detector in
<code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9138">#9138</a>)</li>
<li>Add support for the <code>azure.vm</code> resource detector in
<code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9074">#9074</a>)</li>
<li>Add support for the <code>gcp</code> resource detector in
<code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9137">#9137</a>)</li>
<li>Add
<code>go.opentelemetry.io/contrib/detectors/azure/azureappservice</code>,
a new resource detector for Azure App Service. Detects
<code>cloud.*</code>, <code>service.name</code>,
<code>azure.resource_group.name</code>,
<code>azure.app_service.instance.id</code>, and
<code>deployment.environment.name</code> from the <code>WEBSITE_*</code>
and <code>REGION_NAME</code> environment variables. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9289">#9289</a>)</li>
<li>Add <code>azurecontainerapps</code> resource detector for Azure
Container Apps. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8939">#8939</a>)</li>
<li>Add
<code>go.opentelemetry.io/contrib/detectors/azure/azurefunctions</code>,
a new resource detector for Azure Functions. Detects
<code>cloud.*</code>, <code>service.name</code>,
<code>azure.resource_group.name</code>, <code>faas.instance</code>, and
<code>deployment.environment.name</code> from the
<code>FUNCTIONS_*</code>, <code>WEBSITE_*</code>,
<code>CONTAINER_NAME</code>, and <code>REGION_NAME</code> environment
variables. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9290">#9290</a>)</li>
<li>Add <code>NewResourceDetector</code> along with the
<code>WithAttributeFilter</code> and <code>WithTagKeyFilter</code>
options in
<code>go.opentelemetry.io/contrib/detectors/azure/azurevm</code>.
<code>WithAttributeFilter</code> restricts the returned resource to the
attributes the filter accepts. <code>WithTagKeyFilter</code> opts in to
<code>azure.tag.&lt;name&gt;</code> attributes for the VM tags whose
keys satisfy the provided predicate; no VM tags are emitted without it.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9162">#9162</a>)</li>
<li>Add <code>go.opentelemetry.io/contrib/detectors/vultr</code> — a new
resource detector for Vultr Cloud Compute instances, ported from
<code>processor/resourcedetectionprocessor/internal/vultr</code> in
<code>opentelemetry-collector-contrib</code>. Detects
<code>cloud.provider</code>, <code>cloud.platform</code>,
<code>cloud.region</code>, <code>host.id</code>, and
<code>host.name</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8995">#8995</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Upgrade <code>go.opentelemetry.io/otel/semconv</code> to
<code>v1.43.0</code>, including updates across instrumentation and
detector modules.
See <a
href="https://github.com/open-telemetry/semantic-conventions/releases/tag/v1.43.0">semantic-conventions
v1.43.0 release</a> for complete details. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9337">#9337</a>)</li>
<li>Upgrade <code>go.opentelemetry.io/otel/semconv</code> to
<code>v1.42.0</code>, including updates across instrumentation and
detector modules.
See <a
href="https://github.com/open-telemetry/semantic-conventions/releases/tag/v1.42.0">semantic-conventions
v1.42.0 release</a> for complete details. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9196">#9196</a>)</li>
<li>Use direct normalized-key lookups in <code>Carrier.Get</code> and
<code>Carrier.Keys</code> in
<code>go.opentelemetry.io/contrib/propagators/envcar</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9112">#9112</a>)</li>
<li>Update log bridge conversions to use attribute key-values instead of
the removed log key-values in
<code>go.opentelemetry.io/contrib/bridges/otellogr</code>,
<code>go.opentelemetry.io/contrib/bridges/otellogrus</code>,
<code>go.opentelemetry.io/contrib/bridges/otelslog</code>, and
<code>go.opentelemetry.io/contrib/bridges/otelzap</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9180">#9180</a>)</li>
<li>The <code>Version()</code> function in
<code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code>
has been replaced by <code>const Version</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9076">#9076</a>)</li>
<li>Set <code>error.type</code> attribute instead of adding
<code>exception</code> span events in
<code>go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8977">#8977</a>)</li>
<li>Prefer the gRPC dial target over the resolved peer IP for the
<code>server.address</code> and <code>server.port</code> attributes in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8904">#8904</a>)</li>
<li>The detector in
<code>go.opentelemetry.io/contrib/detectors/azure/azurevm</code> now
also detects <code>cloud.account.id</code>,
<code>cloud.availability_zone</code>, <code>azure.vm.name</code>,
<code>azure.vm.size</code>, <code>azure.vm.scaleset.name</code>, and
<code>azure.resource_group.name</code>, and prefers
<code>osProfile.computerName</code> for <code>host.name</code> (falling
back to the VM name), reconciling it with the collector-contrib Azure
resource detector. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9162">#9162</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix Prometheus reader resource label filter configuration in
<code>go.opentelemetry.io/contrib/otelconf/v0.2.0</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9062">#9062</a>)</li>
<li>Apply
<code>resource.detection/development.attributes.included</code> and
<code>excluded</code> filtering to resource detector attributes in
<code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9131">#9131</a>)</li>
<li>Honor the context configured with <code>WithContext</code> when
constructing resources in
<code>go.opentelemetry.io/contrib/otelconf</code> and
<code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9160">#9160</a>)</li>
<li>Handle nil response bodies from custom <code>RoundTripper</code>
implementations in
<code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code>
without panicking. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9184">#9184</a>)</li>
<li>Fix incorrect (overestimated) sum calculation for runtime histograms
in <code>go.opentelemetry.io/contrib/instrumentation/runtime</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9063">#9063</a>)</li>
<li>Fix <code>Severity.UnmarshalText</code> round trip for positive
<code>FATAL</code> offsets above the named range in
<code>go.opentelemetry.io/contrib/processors/minsev</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9197">#9197</a>)</li>
<li>Reduce binary size by fetching ConfigMaps via
<code>rest.HTTPClientFor</code> instead of the Kubernetes clientset in
<code>go.opentelemetry.io/contrib/detectors/aws/eks</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9284">#9284</a>)</li>
<li><code>TextMapPropagator</code> in
<code>go.opentelemetry.io/contrib/propagators/autoprop</code> returns
the no-op propagator for empty input, matching the behavior of
<code>none</code>. An unknown <code>OTEL_PROPAGATORS</code> value still
returns an error with a nil propagator so
<code>NewTextMapPropagator</code> falls back to the default TraceContext
and Baggage propagators instead of disabling propagation. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9163">#9163</a>)</li>
<li>Preserve error-valued attributes nested in a group as grouped
attributes instead of silently dropping them in
<code>go.opentelemetry.io/contrib/bridges/otelslog</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9238">#9238</a>)</li>
<li>Fix a data race in
<code>go.opentelemetry.io/contrib/bridges/otelslog</code> where
concurrent <code>Handle</code> calls could corrupt each other's log
attributes because <code>kvBuffer.KeyValues</code> returned a slice
aliasing a shared buffer. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9229">#9229</a>)</li>
<li>Avoid a panic in
<code>go.opentelemetry.io/contrib/bridges/otelzap</code> when a
malformed error field contains a nil or non-error value. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9068">#9068</a>)</li>
<li>Use <code>azure.container_app.instance.id</code> instead of
<code>service.instance.id</code> for the replica name detected by
<code>go.opentelemetry.io/contrib/detectors/azure/azurecontainerapps</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9208">#9208</a>)</li>
<li>Preserve the underlying metadata errors returned with partial
resources from <code>go.opentelemetry.io/contrib/detectors/gcp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9069">#9069</a>)</li>
<li>Copy <code>MultipartForm</code> back to the request
<code>otelmux.Middleware</code> was given after the wrapped handler
returns, so <code>net/http</code> can find and remove the temp files
<code>ParseMultipartForm</code> created on the context-derived request
copy, when <code>otelmux.Middleware</code> wraps a handler directly, in
<code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code>.
This does not cover a handler panic, nor the common
<code>router.Use(...)</code> integration, where
<code>gorilla/mux</code>'s own routing step makes an additional request
copy the middleware cannot write back through; see <a
href="https://redirect.github.com/gorilla/mux/pull/777">gorilla/mux#777</a>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9361">#9361</a>)</li>
<li>Report the <code>b3</code> header from <code>Fields()</code> for the
default <code>B3Unspecified</code> single-header injection encoding,
matching what <code>Inject</code> writes, in
<code>go.opentelemetry.io/contrib/propagators/b3</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9273">#9273</a>)</li>
<li>Fix <code>go.opentelemetry.io/contrib/propagators/aws/xray</code>
producing deterministic trace and span IDs when the seed read from
<code>crypto/rand</code> silently failed, by switching to
<code>math/rand/v2</code>'s concurrency-safe top-level generator. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9359">#9359</a>)</li>
<li>Strip connection number suffix from connection ID in
<code>go.opentelemetry.io/contrib/instrumentation/go.mongodb.org/mongo-driver/v2/mongo/otelmongo</code>
to prevent unbounded metric cardinality. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9352">#9352</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/c8a87a60ba1b3374fd16df11fc3eeae6c41abbc9"><code>c8a87a6</code></a>
Release v1.45.0/v2.5.2/v0.70.0/v0.37.2/v0.25.0/v0.20.0/v0.16.2/v0.17.0
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9413">#9413</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/cde125c563f232eb6b423a208d375f8e53ae2557"><code>cde125c</code></a>
fix(deps): update aws-sdk-go-v2 monorepo (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9384">#9384</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/88572a7662d00e805777ed96932d532316c13787"><code>88572a7</code></a>
chore(deps): update googleapis to 6ac0973 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9409">#9409</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/e4f511a0f3cc2b09b87cb164427b49dfd2e14f7d"><code>e4f511a</code></a>
chore(deps): update github/codeql-action action to v4.37.5 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9410">#9410</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/265eb0b5fe0682801fd8177aec74ce8769c5a0a4"><code>265eb0b</code></a>
fix(deps): update go.opentelemetry.io/otel digest to 48db2c6 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9317">#9317</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/941ba46979c59dca89d26040ed919870283e36e9"><code>941ba46</code></a>
chore(deps): update github.com/charmbracelet/ultraviolet digest to
8b69304 (#...</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/ededd3b571ad562351a0afe09682774a6f48d63e"><code>ededd3b</code></a>
chore(deps): update module github.com/lucasb-eyer/go-colorful to v1.4.1
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9406">#9406</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/7c6e819d4eb26eede10e98c424adb76304025fda"><code>7c6e819</code></a>
fix(deps): update module github.com/atombender/go-jsonschema to v0.24.1
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9405">#9405</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/ec1e544a0d6883126198c3fc3a7d62fc8db29195"><code>ec1e544</code></a>
chore(deps): update github.com/lufia/plan9stats digest to 341c2f0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9403">#9403</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/5d7e16aa1138a5446a648dd92ebc42031c93e327"><code>5d7e16a</code></a>
chore(deps): update github.com/golangci/rowserrcheck digest to d2031e3
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9402">#9402</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.69.0...zpages/v0.70.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp&package-manager=go_modules&previous-version=0.69.0&new-version=0.70.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-11 11:18:52 +00:00
dependabot[bot] f65580a344 chore: bump google.golang.org/api from 0.291.0 to 0.292.0 (#28017) 
Bumps
[google.golang.org/api](https://github.com/googleapis/google-api-go-client)
from 0.291.0 to 0.292.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's
releases</a>.</em></p>
<blockquote>
<h2>v0.292.0</h2>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.291.0...v0.292.0">0.292.0</a>
(2026-08-04)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3682">#3682</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/b70719bb5600e7681c883946903c4e55c493c801">b70719b</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3684">#3684</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/c9bc778099e72798eef096de828fb333389f7010">c9bc778</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3685">#3685</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/8140ddf12e1a5c4a54748a94b6655818fcc480ed">8140ddf</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3687">#3687</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/57047fb96a7bd29eea0bfed36a9207389f3cafcf">57047fb</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3688">#3688</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/256abd760aedde96c6e73ecf11822ed4cb223469">256abd7</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.291.0...v0.292.0">0.292.0</a>
(2026-08-04)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3682">#3682</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/b70719bb5600e7681c883946903c4e55c493c801">b70719b</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3684">#3684</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/c9bc778099e72798eef096de828fb333389f7010">c9bc778</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3685">#3685</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/8140ddf12e1a5c4a54748a94b6655818fcc480ed">8140ddf</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3687">#3687</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/57047fb96a7bd29eea0bfed36a9207389f3cafcf">57047fb</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3688">#3688</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/256abd760aedde96c6e73ecf11822ed4cb223469">256abd7</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/8631dd4e00d6b5c37ba1c260bc5efe1de0877098"><code>8631dd4</code></a>
chore(main): release 0.292.0 (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3683">#3683</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/256abd760aedde96c6e73ecf11822ed4cb223469"><code>256abd7</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3688">#3688</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/3f73f91e83152f6f7ad9f37018812c81d771d336"><code>3f73f91</code></a>
chore(all): update all (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3686">#3686</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/57047fb96a7bd29eea0bfed36a9207389f3cafcf"><code>57047fb</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3687">#3687</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/8140ddf12e1a5c4a54748a94b6655818fcc480ed"><code>8140ddf</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3685">#3685</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/c9bc778099e72798eef096de828fb333389f7010"><code>c9bc778</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3684">#3684</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/b70719bb5600e7681c883946903c4e55c493c801"><code>b70719b</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3682">#3682</a>)</li>
<li>See full diff in <a
href="https://github.com/googleapis/google-api-go-client/compare/v0.291.0...v0.292.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/api&package-manager=go_modules&previous-version=0.291.0&new-version=0.292.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-11 11:17:17 +00:00
dependabot[bot] 8a30a7da4c chore: bump github.com/elazarl/goproxy from 1.8.0 to 1.9.0 (#28019) 
Bumps [github.com/elazarl/goproxy](https://github.com/elazarl/goproxy)
from 1.8.0 to 1.9.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/elazarl/goproxy/releases">github.com/elazarl/goproxy's
releases</a>.</em></p>
<blockquote>
<h2>v1.9.0: HTTP/2 MITM Full Support</h2>
<h2>What's Changed</h2>
<ul>
<li>HTTP/2 MITM Full Support by <a
href="https://github.com/ErikPelli"><code>@​ErikPelli</code></a> in <a
href="https://redirect.github.com/elazarl/goproxy/pull/785">elazarl/goproxy#785</a></li>
<li>Use Go standard library to check port by <a
href="https://github.com/ErikPelli"><code>@​ErikPelli</code></a> in <a
href="https://redirect.github.com/elazarl/goproxy/pull/795">elazarl/goproxy#795</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/elazarl/goproxy/compare/v1.8.6...v1.9.0">https://github.com/elazarl/goproxy/compare/v1.8.6...v1.9.0</a></p>
<h3>Highlights &amp; Acknowledgements</h3>
<ul>
<li><strong>HTTP/2 MITM Support:</strong> This release introduces native
support for inspecting and manipulating HTTP/2 traffic within GoProxy's
MITM functionality.
A special thanks to the team at <a
href="https://github.com/LumiaSecurity"><code>@​LumiaSecurity</code></a>
(including <a href="https://github.com/omriza"><code>@​omriza</code></a>
for the review) for supporting the development of these HTTP/2 MITM
features and contributing to this major enhancement.
Achieving full HTTP/2 MITM capability represents a huge milestone for
GoProxy, taking our library to the next level for whoever needs it.
<strong>To enable it, make sure that <code>AllowHTTP2</code> is set to
<code>true</code> in the proxy configuration.</strong></li>
</ul>
<h3>⚠️ Possible Breaking Change</h3>
<ul>
<li>Previously there was an incomplete implementation of HTTP/2 inside
the <code>h2.go</code> file, with an exported H2Transport struct.
Probably no one was using it, but if you were, be careful that in this
release it has been removed to create the full HTTP/2 MITM
implementation.</li>
</ul>
<h2>v1.8.6</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix unexpected scheme edge case in MITM by <a
href="https://github.com/ErikPelli"><code>@​ErikPelli</code></a> in <a
href="https://redirect.github.com/elazarl/goproxy/pull/793">elazarl/goproxy#793</a></li>
<li>Stream MITM response bodies by <a
href="https://github.com/krissetto"><code>@​krissetto</code></a> in <a
href="https://redirect.github.com/elazarl/goproxy/pull/794">elazarl/goproxy#794</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/krissetto"><code>@​krissetto</code></a>
made their first contribution in <a
href="https://redirect.github.com/elazarl/goproxy/pull/794">elazarl/goproxy#794</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/elazarl/goproxy/compare/v1.8.5...v1.8.6">https://github.com/elazarl/goproxy/compare/v1.8.5...v1.8.6</a></p>
<h2>v1.8.5</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(https): coalesce the MITM response head into a single write by
<a
href="https://github.com/shaharfreiman"><code>@​shaharfreiman</code></a>
in <a
href="https://redirect.github.com/elazarl/goproxy/pull/787">elazarl/goproxy#787</a></li>
<li>Remove redundant certificate Leaf set starting from Go 1.23 by <a
href="https://github.com/ErikPelli"><code>@​ErikPelli</code></a> in <a
href="https://redirect.github.com/elazarl/goproxy/pull/789">elazarl/goproxy#789</a></li>
<li>Fix headers overwrite when there are no trailers by <a
href="https://github.com/ErikPelli"><code>@​ErikPelli</code></a> in <a
href="https://redirect.github.com/elazarl/goproxy/pull/791">elazarl/goproxy#791</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/shaharfreiman"><code>@​shaharfreiman</code></a>
made their first contribution in <a
href="https://redirect.github.com/elazarl/goproxy/pull/787">elazarl/goproxy#787</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/elazarl/goproxy/compare/v1.8.4...v1.8.5">https://github.com/elazarl/goproxy/compare/v1.8.4...v1.8.5</a></p>
<h2>v1.8.4</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: don't set Transfer-Encoding: chunked on 304 responses by <a
href="https://github.com/Yanhu007"><code>@​Yanhu007</code></a> in <a
href="https://redirect.github.com/elazarl/goproxy/pull/770">elazarl/goproxy#770</a></li>
<li>docs: add missing godoc comments to exported symbols by <a
href="https://github.com/scovl"><code>@​scovl</code></a> in <a
href="https://redirect.github.com/elazarl/goproxy/pull/768">elazarl/goproxy#768</a></li>
<li>http: forward upstream response trailers by <a
href="https://github.com/0b01"><code>@​0b01</code></a> in <a
href="https://redirect.github.com/elazarl/goproxy/pull/773">elazarl/goproxy#773</a></li>
<li>Remove insecure skip verify from origin transport by <a
href="https://github.com/ErikPelli"><code>@​ErikPelli</code></a> in <a
href="https://redirect.github.com/elazarl/goproxy/pull/774">elazarl/goproxy#774</a></li>
<li>Avoid chunked response when there is http.NoBody by <a
href="https://github.com/ErikPelli"><code>@​ErikPelli</code></a> in <a
href="https://redirect.github.com/elazarl/goproxy/pull/776">elazarl/goproxy#776</a></li>
<li>fix(https): close client connection when target connection errors by
<a href="https://github.com/wucm667"><code>@​wucm667</code></a> in <a
href="https://redirect.github.com/elazarl/goproxy/pull/779">elazarl/goproxy#779</a></li>
<li>fix: restore examples module health and clarify sample apps by <a
href="https://github.com/Thiago-Tertuliano"><code>@​Thiago-Tertuliano</code></a>
in <a
href="https://redirect.github.com/elazarl/goproxy/pull/780">elazarl/goproxy#780</a></li>
<li>fix: append headers instead of overwriting when keepDestHeaders is
true by <a
href="https://github.com/Yanhu007"><code>@​Yanhu007</code></a> in <a
href="https://redirect.github.com/elazarl/goproxy/pull/771">elazarl/goproxy#771</a></li>
</ul>
<h2>New Contributors</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/elazarl/goproxy/commit/6225cd309d7c0e201659f1e00086b12fdae62df2"><code>6225cd3</code></a>
Use Go standard library to check port (<a
href="https://redirect.github.com/elazarl/goproxy/issues/795">#795</a>)</li>
<li><a
href="https://github.com/elazarl/goproxy/commit/5e4406819eb880480bfe8be39e5c06c161e96ad5"><code>5e44068</code></a>
HTTP/2 MITM Full Support (<a
href="https://redirect.github.com/elazarl/goproxy/issues/785">#785</a>)</li>
<li><a
href="https://github.com/elazarl/goproxy/commit/a4bf4321f461a060a8c55d371ae3cfa747d561d5"><code>a4bf432</code></a>
Stream MITM response bodies (<a
href="https://redirect.github.com/elazarl/goproxy/issues/794">#794</a>)</li>
<li><a
href="https://github.com/elazarl/goproxy/commit/3f0ac0b322e30aff226ea2ce9f4114c7a5585ff4"><code>3f0ac0b</code></a>
Fix unexpected scheme edge case in MITM (<a
href="https://redirect.github.com/elazarl/goproxy/issues/793">#793</a>)</li>
<li><a
href="https://github.com/elazarl/goproxy/commit/d435b12bc2fd1ecae5c03a39fdd452a43e36be00"><code>d435b12</code></a>
Fix headers overwrite when there are no trailers (<a
href="https://redirect.github.com/elazarl/goproxy/issues/791">#791</a>)</li>
<li><a
href="https://github.com/elazarl/goproxy/commit/54976310a7923a7526777f9eb0a3fc0f4d625ffc"><code>5497631</code></a>
Remove redundant certificate Leaf set starting from Go 1.23 (<a
href="https://redirect.github.com/elazarl/goproxy/issues/789">#789</a>)</li>
<li><a
href="https://github.com/elazarl/goproxy/commit/5ba11e8846d7c139c0404fcc47099ef8dc7375c2"><code>5ba11e8</code></a>
fix(https): coalesce the MITM response head into a single write (<a
href="https://redirect.github.com/elazarl/goproxy/issues/787">#787</a>)</li>
<li><a
href="https://github.com/elazarl/goproxy/commit/636207d4c044d260140a1f7a6f13efb609dbadc0"><code>636207d</code></a>
fix: append headers instead of overwriting when keepDestHeaders is true
(<a
href="https://redirect.github.com/elazarl/goproxy/issues/771">#771</a>)</li>
<li><a
href="https://github.com/elazarl/goproxy/commit/6584eeeb52783bbb3ef0ca44c6edc3241e65bc9d"><code>6584eee</code></a>
fix: restore examples module health and clarify sample apps (<a
href="https://redirect.github.com/elazarl/goproxy/issues/780">#780</a>)</li>
<li><a
href="https://github.com/elazarl/goproxy/commit/038e3b90031f25eead7d60a7db162de131321fe7"><code>038e3b9</code></a>
fix(https): close client connection when target connection errors (<a
href="https://redirect.github.com/elazarl/goproxy/issues/779">#779</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/elazarl/goproxy/compare/v1.8.0...v1.9.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/elazarl/goproxy&package-manager=go_modules&previous-version=1.8.0&new-version=1.9.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-11 11:14:42 +00:00
Michael Suchacz 2e5353bde7 feat: add built-in Browser tab for agent-browser (#27910) 
Adds a built-in Browser tab to the Agents page right panel, alongside
the built-in Terminal and Desktop tabs, when the chat's bound agent has
an app with the well-known slug `agent-browser`. The tab shows only
while the app is embeddable and its health is `healthy` (or `disabled`,
for templates without a healthcheck), so it appears and disappears live
as the daemon comes up or goes down. The iframe stays mounted across tab
switches to preserve session state.

To avoid duplicates, the generic Add Tab menu and persisted
workspace-app tabs now exclude the `agent-browser` app. Detection uses
the existing `coder_app` slug and healthcheck signals already present in
the workspace data model. The workspace watch handler compares the agent
app fields the chat UI consumes, so health transitions propagate without
re-render churn on every heartbeat.

On the backend, the chat `execute` tool now exports
`AGENT_BROWSER_SESSION=<chat id>` on every process it starts.
agent-browser resolves its default session from that variable, so
browser automation from each chat lands in its own isolated session
(named by the chat id in the embedded dashboard) instead of a shared
default browser.

> Mux created this PR on Mike's behalf.
 2026-08-11 12:49:12 +02:00
Jaayden Halko 5bdabc95c8 fix(codersdk/licenses.go): read trial claim instead of misspelled trail (#28014) 
## What this fixes

`codersdk.License.Trial()` looked up the JWT claim `"trail"` (a typo)
instead of `"trial"`, the actual claim name set by license issuance
(`enterprise/coderd/license/license.go`). Since no license contains a
`"trail"` claim, the method always returned `false`.

The only consumer is `coder licenses list` (via
`cli/cliutil/license.go`), so the CLI never reported a license as a
trial even when it was one. The web UI is unaffected because it reads
`claims.trial` directly.

## Changes

- Read the `"trial"` claim in `License.Trial()`.

## Testing

- `go build` / `go vet` on `codersdk` and `cli/cliutil`.
- `go test -run 'TestLicensesListFake|TestLicensesListReal'
./enterprise/cli` passes.
 2026-08-11 10:18:22 +00:00