opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-21 12:44:32 +08:00
Code Issues Packages Projects Releases Wiki Activity
15,856 Commits 479 Branches 387 Tags
995d7fe31bb30713c765a302a1a8a71b86ae5f15
Commit Graph
15856 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Jaayden Halko 995d7fe31b feat: add per-license Products section with Coder Agents price gates (#28051) 
<img width="1100" height="312" alt="Screenshot 2026-08-17 at 3 43 51 PM"
src="https://github.com/user-attachments/assets/30d21467-93ec-4880-a430-ccd4b494b8f5"
/>


Each license card now always expands to a **Products** section: a Coder
Workspaces box showing active seat usage, and, on Premium licenses, a
Coder Agents box driven by the `agent_runtime_hours_*` license claims
and the merged `agent_runtime_hours` entitlement. The card header gains
a **Type** column (`Trial`/`Standard`), and the left header label now
shows the feature set only (`Premium`/`Enterprise`).

The Coder Agents box renders five states: no allocation (dashed purple
upgrade CTA), unlimited allocation (`-1` sentinel), normal usage,
allocation exceeded (red border and red "Agent hours exceeded" status;
concurrent chats stay Unlimited), and hard limit exceeded (red "Hard
limit exceeded" status; concurrent chats capped at 5, mirroring the
backend's `maxConcurrentRootAgents`, which is not exposed via the API).
Usage and overage indicators only render on the license whose allocation
matches the merged entitlement and which is currently effective,
following the existing AI Governance winning-license pattern via a
generalized `isLicenseApplicableForFeatureUsage` helper; AI Governance
add-on behavior is unchanged.

Stacked on #27985 (base branch `runtime-hours-entitlements`); do not
merge before it.

Notes for review:

- #27985 now grandfathers claim-less Premium licenses into a zero-hour
`agent_runtime_hours` allocation, so the merged entitlement (disabled,
`limit: 0`) and its measured `actual` are always present for Premium
deployments. The upgrade card's "Agent hours used" row therefore renders
universally; the `Premium` story pins that state.


- Agent hours usage now renders with exactly one decimal (e.g.
`16,264.3`, `42.0`), derived from #27985's new `actual_ms` field and
floored to tenths with integer math. The same floored value drives the
exceeded checks, so the displayed number and the red state flip at the
same instant; a fraction past the allocation now trips "Agent hours
exceeded" (`20,000.1 > 20,000`), pinned by the
`PremiumWithAgentHoursExceededByFraction` story. The allocation
denominator stays whole (it comes from the whole-hour license claim).
 2026-08-18 20:07:28 +07:00
david-fraley 6dfba5c567 test(site/src/modules/workspaces): cover version picker stacking (#28154) 2026-08-18 07:52:55 -05:00
Danielle Maywood 9590e9586e fix(site/src/pages/AgentsPage): stop gating chat stream parts on client status (#28207) 2026-08-18 12:51:36 +01:00
Danielle Maywood 14e3ae33cf fix(site/src/pages/AgentsPage): treat interrupting chats as busy in the composer (#28209) 2026-08-18 12:51:29 +01:00
dependabot[bot] 522ef09517 chore: bump github.com/stretchr/testify from 1.11.1 to 1.12.0 (#28259) 
Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify)
from 1.11.1 to 1.12.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/stretchr/testify/releases">github.com/stretchr/testify's
releases</a>.</em></p>
<blockquote>
<h2>v1.12.0</h2>
<h2>What's Changed</h2>
<h3>Functional Changes</h3>
<ul>
<li>assert: make *AssertionFunc types just aliases by <a
href="https://github.com/dolmen"><code>@​dolmen</code></a> in <a
href="https://redirect.github.com/stretchr/testify/pull/1563">stretchr/testify#1563</a></li>
</ul>
<h3>Fixes</h3>
<ul>
<li>mock: avoid panic when expected type is nil in Arguments.Diff by <a
href="https://github.com/mutaiib"><code>@​mutaiib</code></a> in <a
href="https://redirect.github.com/stretchr/testify/pull/1775">stretchr/testify#1775</a></li>
<li>mock: revert to pre-v1.11.0 argument matching behavior for mutating
stringers by <a
href="https://github.com/brackendawson"><code>@​brackendawson</code></a>
in <a
href="https://redirect.github.com/stretchr/testify/pull/1786">stretchr/testify#1786</a></li>
<li>suite: validate method signatures and continue execution for valid
tests by <a
href="https://github.com/vyas-git"><code>@​vyas-git</code></a> in <a
href="https://redirect.github.com/stretchr/testify/pull/1665">stretchr/testify#1665</a></li>
<li>assert.PanicsWithError: report error message by <a
href="https://github.com/olivergondza"><code>@​olivergondza</code></a>
in <a
href="https://redirect.github.com/stretchr/testify/pull/1400">stretchr/testify#1400</a></li>
<li>assert: IsIncreasing et al can return false w/out failing by <a
href="https://github.com/brackendawson"><code>@​brackendawson</code></a>
in <a
href="https://redirect.github.com/stretchr/testify/pull/1787">stretchr/testify#1787</a></li>
<li>add type to error message of assert.Same by <a
href="https://github.com/egawata"><code>@​egawata</code></a> in <a
href="https://redirect.github.com/stretchr/testify/pull/1792">stretchr/testify#1792</a></li>
<li>mock.AssertExpectationsForObjects fix panic with wrong testObject
type. by <a
href="https://github.com/brackendawson"><code>@​brackendawson</code></a>
in <a
href="https://redirect.github.com/stretchr/testify/pull/1795">stretchr/testify#1795</a></li>
<li>assert: truncate very long objects in test failure messages by <a
href="https://github.com/brackendawson"><code>@​brackendawson</code></a>
in <a
href="https://redirect.github.com/stretchr/testify/pull/1646">stretchr/testify#1646</a></li>
<li>assert: fix NotSubset error messages using %#v instead of %q (fixes
<a
href="https://redirect.github.com/stretchr/testify/issues/1800">#1800</a>)
by <a href="https://github.com/nghiack7"><code>@​nghiack7</code></a> in
<a
href="https://redirect.github.com/stretchr/testify/pull/1888">stretchr/testify#1888</a></li>
<li>suite: prevent panic when SetupTest skips with HandleStats by <a
href="https://github.com/blackwell-systems"><code>@​blackwell-systems</code></a>
in <a
href="https://redirect.github.com/stretchr/testify/pull/1877">stretchr/testify#1877</a></li>
</ul>
<h3>Documentation, Build &amp; CI</h3>
<ul>
<li>CI: test also with Go 1.23 by <a
href="https://github.com/dolmen"><code>@​dolmen</code></a> in <a
href="https://redirect.github.com/stretchr/testify/pull/1783">stretchr/testify#1783</a></li>
<li>Vendor unmaintained github.com/pmezard/go-difflib by <a
href="https://github.com/brackendawson"><code>@​brackendawson</code></a>
in <a
href="https://redirect.github.com/stretchr/testify/pull/1708">stretchr/testify#1708</a></li>
<li>Promote ccoVeille to maintainer by <a
href="https://github.com/brackendawson"><code>@​brackendawson</code></a>
in <a
href="https://redirect.github.com/stretchr/testify/pull/1784">stretchr/testify#1784</a></li>
<li>build(deps): bump actions/setup-go from 5 to 6 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/stretchr/testify/pull/1790">stretchr/testify#1790</a></li>
<li>assert.YAMLEq: Document mutlidoc behavior by <a
href="https://github.com/brackendawson"><code>@​brackendawson</code></a>
in <a
href="https://redirect.github.com/stretchr/testify/pull/1791">stretchr/testify#1791</a></li>
<li>_codegen: copy dependency github.com/ernesto-jimenez/gogen/imports
by <a href="https://github.com/dolmen"><code>@​dolmen</code></a> in <a
href="https://redirect.github.com/stretchr/testify/pull/1782">stretchr/testify#1782</a></li>
<li>doc: remove ineffective inline code blocks by <a
href="https://github.com/brackendawson"><code>@​brackendawson</code></a>
in <a
href="https://redirect.github.com/stretchr/testify/pull/1714">stretchr/testify#1714</a></li>
<li>Tag generated assertions as non-generated in new .gitattributes by
<a href="https://github.com/ubunatic"><code>@​ubunatic</code></a> in <a
href="https://redirect.github.com/stretchr/testify/pull/1815">stretchr/testify#1815</a></li>
<li>chore: vendor go-spew from <a
href="https://github.com/davecgh/go-spew">https://github.com/davecgh/go-spew</a>
by <a href="https://github.com/ccoVeille"><code>@​ccoVeille</code></a>
in <a
href="https://redirect.github.com/stretchr/testify/pull/1827">stretchr/testify#1827</a></li>
<li>require: fix godoc generation for assertions returning a bool by <a
href="https://github.com/Baxromumarov"><code>@​Baxromumarov</code></a>
in <a
href="https://redirect.github.com/stretchr/testify/pull/1850">stretchr/testify#1850</a></li>
<li>docs(require): correct example usage to use assert.CollectT
(require.CollectT does not exist) by <a
href="https://github.com/a2not"><code>@​a2not</code></a> in <a
href="https://redirect.github.com/stretchr/testify/pull/1821">stretchr/testify#1821</a></li>
<li>docs: Fix EventuallyWithTf documentation with proper placement of
formatting arguments by <a
href="https://github.com/a2not"><code>@​a2not</code></a> in <a
href="https://redirect.github.com/stretchr/testify/pull/1842">stretchr/testify#1842</a></li>
<li>EMERITUS.md: add <a
href="https://github.com/tylerb"><code>@​tylerb</code></a> by <a
href="https://github.com/dolmen"><code>@​dolmen</code></a> in <a
href="https://redirect.github.com/stretchr/testify/pull/1812">stretchr/testify#1812</a></li>
<li>CI: test also with Go 1.24 by <a
href="https://github.com/alexandear"><code>@​alexandear</code></a> in <a
href="https://redirect.github.com/stretchr/testify/pull/1856">stretchr/testify#1856</a></li>
<li>deps: bump objx to v0.5.3 and remove dependency cycle issue by <a
href="https://github.com/ccoVeille"><code>@​ccoVeille</code></a> in <a
href="https://redirect.github.com/stretchr/testify/pull/1823">stretchr/testify#1823</a></li>
<li>CI: upgrade GitHub Actions and pin hashes by <a
href="https://github.com/SuperQ"><code>@​SuperQ</code></a> in <a
href="https://redirect.github.com/stretchr/testify/pull/1883">stretchr/testify#1883</a></li>
<li>CI: add _readme-gofmt tool to reformat Go code in README by <a
href="https://github.com/dolmen"><code>@​dolmen</code></a> in <a
href="https://redirect.github.com/stretchr/testify/pull/1889">stretchr/testify#1889</a></li>
<li>CI: add check of GitHub Action pinned hashes against tag by <a
href="https://github.com/dolmen"><code>@​dolmen</code></a> in <a
href="https://redirect.github.com/stretchr/testify/pull/1885">stretchr/testify#1885</a></li>
<li>_codegen: modernize by <a
href="https://github.com/dolmen"><code>@​dolmen</code></a> in <a
href="https://redirect.github.com/stretchr/testify/pull/1890">stretchr/testify#1890</a></li>
<li>build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/stretchr/testify/pull/1906">stretchr/testify#1906</a></li>
<li>mock: Mock.Return does not exist anymore by <a
href="https://github.com/Kentzo"><code>@​Kentzo</code></a> in <a
href="https://redirect.github.com/stretchr/testify/pull/1905">stretchr/testify#1905</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/mutaiib"><code>@​mutaiib</code></a> made
their first contribution in <a
href="https://redirect.github.com/stretchr/testify/pull/1775">stretchr/testify#1775</a></li>
<li><a href="https://github.com/vyas-git"><code>@​vyas-git</code></a>
made their first contribution in <a
href="https://redirect.github.com/stretchr/testify/pull/1665">stretchr/testify#1665</a></li>
<li><a
href="https://github.com/olivergondza"><code>@​olivergondza</code></a>
made their first contribution in <a
href="https://redirect.github.com/stretchr/testify/pull/1400">stretchr/testify#1400</a></li>
<li><a href="https://github.com/egawata"><code>@​egawata</code></a> made
their first contribution in <a
href="https://redirect.github.com/stretchr/testify/pull/1792">stretchr/testify#1792</a></li>
<li><a href="https://github.com/ubunatic"><code>@​ubunatic</code></a>
made their first contribution in <a
href="https://redirect.github.com/stretchr/testify/pull/1815">stretchr/testify#1815</a></li>
<li><a
href="https://github.com/Baxromumarov"><code>@​Baxromumarov</code></a>
made their first contribution in <a
href="https://redirect.github.com/stretchr/testify/pull/1850">stretchr/testify#1850</a></li>
<li><a href="https://github.com/a2not"><code>@​a2not</code></a> made
their first contribution in <a
href="https://redirect.github.com/stretchr/testify/pull/1821">stretchr/testify#1821</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/stretchr/testify/commit/001eb7946baf451879253643e4ce4b38eaa0d4a7"><code>001eb79</code></a>
Merge pull request <a
href="https://redirect.github.com/stretchr/testify/issues/1905">#1905</a>
from Kentzo/patch-1</li>
<li><a
href="https://github.com/stretchr/testify/commit/ad40f384b10b10d2bbac85354c80eab5abed0a45"><code>ad40f38</code></a>
Merge pull request <a
href="https://redirect.github.com/stretchr/testify/issues/1906">#1906</a>
from stretchr/dependabot/github_actions/actions/chec...</li>
<li><a
href="https://github.com/stretchr/testify/commit/3bae01746b7ef55bd50252b8c7fe5a41b7bf0fcc"><code>3bae017</code></a>
build(deps): bump actions/checkout from 6.0.2 to 6.0.3</li>
<li><a
href="https://github.com/stretchr/testify/commit/f8c01f33a3747928ede4174ad1b718698fc352e7"><code>f8c01f3</code></a>
mock: Mock.Return does not exist anymore</li>
<li><a
href="https://github.com/stretchr/testify/commit/12f8b5612e125f337c4589e198771e5f8970f160"><code>12f8b56</code></a>
Merge pull request <a
href="https://redirect.github.com/stretchr/testify/issues/1563">#1563</a>
from stretchr/make-AssertionFunc-types-aliases</li>
<li><a
href="https://github.com/stretchr/testify/commit/a11649e4279ae45a978a29285d46c347c351e382"><code>a11649e</code></a>
assert: make *AssertionFunc type just aliases</li>
<li><a
href="https://github.com/stretchr/testify/commit/dc20f419863ab083f472a7af1215cc3c049e8ecd"><code>dc20f41</code></a>
Merge pull request <a
href="https://redirect.github.com/stretchr/testify/issues/1890">#1890</a>
from stretchr/dolmen/codegen-modernize</li>
<li><a
href="https://github.com/stretchr/testify/commit/098f8d75b344a22ada8a305282530785e81f8ea2"><code>098f8d7</code></a>
_codegen: use strings.Builder</li>
<li><a
href="https://github.com/stretchr/testify/commit/d2699bed69a45be5ac63448f017ce0c9e2d103d3"><code>d2699be</code></a>
_codegen: modernize</li>
<li><a
href="https://github.com/stretchr/testify/commit/a463c8caf3411b7d36b87204f997c17ef573675d"><code>a463c8c</code></a>
Merge pull request <a
href="https://redirect.github.com/stretchr/testify/issues/1885">#1885</a>
from stretchr/dolmen/ci-check-ghactions-hashes</li>
<li>Additional commits viewable in <a
href="https://github.com/stretchr/testify/compare/v1.11.1...v1.12.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/stretchr/testify&package-manager=go_modules&previous-version=1.11.1&new-version=1.12.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-18 11:17:49 +00:00
Atif Ali 062c0fdd3b docs: rebrand Windsurf doc page to Devin Desktop (#28205) 
## Summary

Cognition (maker of Devin) rebranded the Windsurf Editor as Devin
Desktop on June 2, 2026, after acquiring it from Codeium in July 2025.
Our docs still referred to the editor as Windsurf and linked to a dead
`codeium.com` domain.

## Changes

- Renamed `docs/user-guides/workspace-access/windsurf.md` to
`devin-desktop.md`, rewritten to lead with Devin Desktop branding, note
the Codeium -> Windsurf -> Devin Desktop history, and use current links
(`windsurf.com`, `docs.windsurf.com`) instead of dead `codeium.com`
ones.
- Updated `docs/manifest.json` and
`docs/user-guides/workspace-access/index.md` to reference the new page.
- Updated remaining Windsurf mentions to Devin Desktop in
`docs/ai-coder/ide-agents.md`, `docs/ai-coder/index.md`,
`docs/reference/glossary.md`, and
`docs/ai-coder/ai-gateway/clients/index.md`.
- Added `windsurf.com`/`devin.ai` to `.github/.linkspector.yml` ignore
patterns; both rate-limit repeated automated requests with 429s (same
class of issue as the `codeium.com`/`marketplace.visualstudio.com` fix
in #28203).
- Switched every module reference from `windsurf` to the new
`devin-desktop` registry module (`docs/about/contributing/modules.md`,
the three `get-started/customize-your-template/*.md` Terraform
tutorials, and the main doc page's module link), since the new module
actually renders `display_name = "Devin Desktop"` / `slug =
"devin-desktop"` in the UI (the old `windsurf` module hardcodes
"Windsurf Editor").

<details>
<summary>Scope notes / sequencing</summary>

The `devin-desktop` module referenced here is being added in
[coder/registry#1050](https://github.com/coder/registry/pull/1050) (not
yet merged/released). That PR is itself gated on
[coder/coder#28214](https://github.com/coder/coder/pull/28214)
(whitelisting the `devin:` URI scheme) shipping in a released Coder
version first. This docs PR can merge independently, the module link
will 404 until #1050 is released, same as any
docs-ahead-of-registry-release sequencing.

The Terraform code samples now show `module "devin-desktop"` because
that module's `display_name`/`slug` are properly parameterized (unlike
`windsurf`, which hardcodes "Windsurf Editor"/`windsurf` regardless of
what's passed in), so the docs stay accurate to the rendered UI.

</details>

## Validation

- `make lint` (docs lint, markdownlint, repo checks) passes.
- Manually verified the new outbound links (`docs.windsurf.com`) return
200; `windsurf.com`/`devin.ai` are rate-limited (429) from this
environment too, hence the added ignore patterns.

Stacked on #28203 (targets that branch so the diff here stays scoped to
the rebrand; will retarget to `main` once #28203 merges).

> 🤖 This PR was created with the help of Coder Agents, and needs a human
review. 🧑💻
 2026-08-18 15:17:02 +05:00
Jake Howell a749cf521f refactor(site): tidy secrets list layout (#27917) 
Tighten the user secrets settings page layout.

Move the enable toggle into a leading column, truncate long
descriptions, promote Add secret and docs into the settings header
actions, and drop the redundant Refresh control now that mutations
already invalidate the secrets query.

| Old | New |
| --- | --- |
| <img width="2936" height="1810" alt="SECRETS_PAGE_OLD"
src="https://github.com/user-attachments/assets/e7d18953-9207-4ea1-874e-054de85a0098"
/> | <img width="2936" height="1810" alt="SECRETS_PAGE_NEW"
src="https://github.com/user-attachments/assets/221e9ab5-3be8-4b3a-80d1-89489b61a008"
/> |
 2026-08-18 16:55:27 +07:00
Susana Ferreira db3566c1a3 chore: correct AI Gateway metric provider label and cardinality notes (#28220) 
The cardinality notes in `aibridge/metrics/metrics.go` assume the
`provider` label takes one of three values, and two for the key pool
metrics. That was accurate when the notes were written: `provider` is
the provider instance name, and the name defaulted to one of the three
provider types aibridge supports. Instances can now be given their own
names, so the label takes any configured name and the series counts
scale with the number of configured providers rather than being capped
at a fixed number.

The monitoring docs are also updated to make clear that `provider` is
the provider instance name.

Comments and documentation only, no behaviour change.

Follow-up to #28210.
 2026-08-18 09:47:00 +00:00
Cian Johnston 6079c514ee fix: follow-up fixes for conditional VCS requests (#27711) 
Follow-ups from #27627 

- Memoizes `Config.Git()` with a mutex so the provider's ETag response
cache survives across calls. Only successful construction is cached;
errors are retried.
- Moves the HTTP client onto `Config.HTTPClient`, wired through
`ConvertConfig`, so `Git()` no longer takes a per-call argument that
would be silently ignored after memoization.
- `newGitHub` and `newGitLab` now return `(Provider, error)`,
eliminating the typed-nil-interface class in `gitprovider.New` rather
than the single instance.
- Gates the 304 branch on a `haveCached` flag instead of a nil body
check.
- Only caches bodies that decode successfully, preventing poisoned
entries.
- Keys the response cache on the full token digest rather than a
truncated prefix.
- Tests added: `TestConfigGitMemoizesProvider`,
`TestConfigGitRetriesOnConstructorError`,
`TestGitLabConstructorErrorReturnsNilInterface`,
`TestResponseCacheStore`,
`TestConditionalRequestReuse/MalformedResponseNotCached`;
`TestConvertYAML/CustomScopesAndEndpoint` now asserts
`Config.HTTPClient` wiring.

Follow-ups tracked in #28139, #28140, #28141, #28142.

> 🤖 Generated by Coder Agents on behalf of @johnstcn.
 2026-08-18 09:00:20 +01:00
Atif Ali b674d40d39 ci: ignore flaky codeium.com and marketplace.visualstudio.com links (#28203) 
## Problem

The docs link-check job (linkspector) started failing on two external
links that aren't actually broken, they're being rate-limited/blocked by
the target sites when hit from GitHub runner IPs:

- `https://codeium.com/windsurf` -> 429
- `https://marketplace.visualstudio.com/vscode` -> 503

## Fix

Add both domains to `ignorePatterns` in `.github/.linkspector.yml`,
matching the existing pattern already used for other real sites that
block the linkspector action / GitHub runner IPs
(`code.visualstudio.com`, `npmjs.com`, `merriam-webster.com`, etc.).

## Validation

Validated the updated YAML parses correctly and ran `make lint` locally
(docs lint, markdownlint, and repo checks all pass).

Follow-up: a separate PR will rebrand the Windsurf docs to Devin Desktop
(Codeium -> Windsurf -> Devin Desktop), since codeium.com is stale
branding, not just a flaky link.

> 🤖 This PR was created with the help of Coder Agents, and needs a human
review. 🧑💻
 2026-08-18 12:32:56 +05:00
Atif Ali 753f3d95c6 chore(site): add devin icon (#28206) 2026-08-18 12:02:05 +05:00
Jaayden Halko fa8ffe4eda feat: report agent runtime hours usage in entitlements (#27985) 
Populate `FeatureAgentRuntimeHours.Actual` on every entitlements refresh
for licenses that grant the feature. A new
`GetTotalUsageHBAgentRuntimeV1` query sums `runtime_ms` over the
license's usage period, reading `usage_events` directly:
`hb_agent_runtime_v1` is exactly one row per hourly bucket
deployment-wide with `created_at` at the bucket start, enforced by the
unique partial index introduced in #27983.

The measurement reuses the shared `measureUsage` policy from #27984
through a new `AgentRuntimeMsFn` closure (usage publisher subject):
failures publish the stable
`LicenseAgentRuntimeUsageUnavailableErrorText` and log the cause. Usage
is floored to whole hours, matching the unit of the
`agent_runtime_hours_*` claims, and at most one warning is emitted per
refresh: reaching the allocation supersedes the advisory soft limit. The
dashboard renders the soft-limit advisory muted without a sales link and
treats the runtime usage-unavailable text as a diagnostic.

**Precise usage.** `Feature.ActualMs` (JSON `actual_ms`), set only for
`agent_runtime_hours`, carries the exact stored milliseconds backing the
floored `Actual` so clients can render fractional hours (e.g. `10.3`).
It has the same freshness as `Actual`; the whole-hour warning thresholds
are unchanged.

**Unlimited licenses.** A license minted with the unlimited (`-1`)
allocation decodes to an enabled feature with a nil `Limit` (#27984), so
the warning write-back now guards the allocation dereference: no
thresholds can exist for an unlimited license, so no runtime hours
warning is ever emitted, while `Actual` is still measured and published.
`Feature.Compare` is unchanged; for usage-period features the
issued-at/end dates decide first, so a metered feature outranks an
unlimited one only on an exact timestamp tie, an edge pinned by a
`TestFeatureComparison` case and documented on
`decodeAgentRuntimeHours`.

**Grandfathered premium licenses.** Premium licenses without
`agent_runtime_hours_*` claims are now granted the feature disabled with
a zero limit over the license term, identical to an explicit
`allocation: 0`: usage is measured and published for every Premium
deployment, and chatd's pooled admission (#27902) caps concurrent
agentic chats until a license with a positive allocation is added. The
default carries a fixed early `UsagePeriod.IssuedAt` (2026-08-01, the
same mechanism as the managed-agents default) so any license actually
carrying the claims outranks it in the `AddFeature` merge regardless of
the licenses' relative issue dates; the constant must stay earlier than
the earliest legitimately issued claim-bearing license. Zero allocations
(explicit or grandfathered) emit no deployment-wide warning banner:
those deployments are steered by the in-page upgrade CTA and the
concurrency cap. Enterprise licenses are unchanged.

Part 3 of a 3-PR stack splitting up #27796 (see there for review
history). Stack: #27983 → #27984 → this PR.

Closes CODAGT-852.
 2026-08-18 12:40:33 +07:00
Ethan 30dc7ebd71 fix(site/src/pages/AgentsPage): persist empty MCP selection (#28238) 
Removing the final optional MCP server from an existing chat produced an
empty selection, but the message request omitted `mcp_server_ids`. The
API interprets an omitted field as preserving the current selection.

Send the selected MCP server IDs for every message, including an empty
array. Add a Storybook interaction test that removes the final MCP
server and verifies the request contains `mcp_server_ids: []`.

<details>
<summary>Manual verification on a local dev instance</summary>

Setup: `./scripts/develop.sh`, an Anthropic provider with
`claude-haiku-4-5`, and a local test MCP server registered with
availability `default_on`.

With this branch, chat `75285d9f`:

1. The new chat showed the MCP chip selected.
2. Sent a message, then removed the chip with the X control.
3. Sent a second message, then reloaded the page.
4. No MCP chip appeared, and the picker toggle stayed off.
5. `GET /api/experimental/chats/{id}` returned `mcp_server_ids: []`.

With the one-line change reverted, chat `751ac191` repeated the same
flow. The chip returned as selected after the reload, and the API
returned `mcp_server_ids: ["b63a2a3a-..."]`.

Not covered: `force_on` servers, plan mode interaction, and queued
messages during streaming.

</details>

Generated by Coder Agents.
 2026-08-18 13:34:02 +08:00
Jaayden Halko d15800b494 feat: tolerate unusable runtime hours claims and decode -1 allocation as unlimited (#27984) 
Two coupled changes to the license/entitlements layer, preparing for
runtime-hours usage reporting.

**Tolerate unusable runtime hour claims.** Unusable
`agent_runtime_hours_*` claim combinations no longer reject the whole
license: rejecting a signed license over a cosmetic threshold claim
would drop the deployment to unlicensed. `decodeAgentRuntimeHours` drops
the unusable claims, surfaces the stable
`LicenseAgentRuntimeHoursClaimsIgnoredWarningText` (deduplicated across
licenses), and logs the affected license and claims through the new
`FeatureArguments.Logger`; `validateAgentRuntimeHours` and its
license-invalidating errors are removed. The dashboard recognizes the
stable diagnostic text and renders it muted, with a "License notices"
heading instead of the exceedance heading and without a sales link.

**Unlimited allocation.** An `agent_runtime_hours_allocation` claim of
exactly `-1` (`AgentRuntimeHoursUnlimitedAllocation`, mirrored in
coder/license) is reserved to mean unlimited: it decodes to an enabled
feature with no `limit` in `/api/v2/entitlements`, the shape the UI
already renders as "Unlimited". Threshold claims alongside it have
nothing to threshold against, so they are dropped with the
claims-ignored warning, and any other negative allocation remains
unusable. The issuer-side counterpart (refusing to mint `-1` together
with threshold claims) is coder/license#49.

The managed agent measurement path is intentionally untouched: managed
agents are deprecated and slated for removal, so the shared
usage-measurement failure policy (`measureUsage`) now lands in #27985
next to its runtime-hours consumer instead of converting a doomed call
site here.

Part 2 of a 3-PR stack splitting up #27796 (see there for review
history). Stack: #27983 → this PR → #27985.
 2026-08-18 12:07:22 +07:00
Atif Ali fb3ed7a56a chore(site): allow devin: URI scheme for Devin Desktop deep links (#28214) 
## Summary

`coder/registry#1050` adds a new `devin-desktop` module that opens Devin
Desktop via a `devin://` deep link (Devin Desktop is Cognition's June 2,
2026 rebrand of Windsurf). Coder's frontend gates which external app URI
schemes it will open with a session token,
`ALLOWED_EXTERNAL_APP_PROTOCOLS` in `site/src/modules/apps/apps.ts`.
`devin:` isn't in that list yet, so without this change the "Open"
button on that app would return the raw URL with the `$SESSION_TOKEN`
placeholder unsubstituted, an unusable link.

## Change

Add `"devin:"` to `ALLOWED_EXTERNAL_APP_PROTOCOLS`, next to the existing
`"windsurf:"` entry.

## Validation

- `pnpm exec biome check --error-on-warnings src/modules/apps/apps.ts`:
clean.
- `pnpm exec vitest run src/modules/apps/apps.test.ts`: 21/21 pass.
- `make pre-commit`: passes.

## Sequencing

`coder/registry#1050` should not be merged until this lands in a
released Coder version, otherwise the `devin-desktop` module's deep link
would be broken on deployments running an older Coder version. Tracked
together in REG-77 / DEVEX-777.

> 🤖 This PR was created with the help of Coder Agents, and needs a human
review. 🧑💻
 2026-08-17 19:58:14 -05:00
dependabot[bot] 9a0afb1c64 chore: bump the coder-modules group across 3 directories with 1 update (#28236) 
Bumps the coder-modules group with 1 update in the /dogfood/coder
directory: coder/personalize/coder.
Bumps the coder-modules group with 1 update in the
/dogfood/coder-envbuilder directory: coder/personalize/coder.
Bumps the coder-modules group with 1 update in the /dogfood/vscode-coder
directory: coder/personalize/coder.

Updates `coder/personalize/coder` from 1.0.32 to 1.0.33

Updates `coder/personalize/coder` from 1.0.32 to 1.0.33

Updates `coder/personalize/coder` from 1.0.32 to 1.0.33


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-18 00:26:55 +00:00
Cian Johnston 444fb8aa9b fix(site): allow single-label AI provider endpoints (#28122) 
Closes #27980.

Reduces the `baseUrl` field validation in `ProviderForm.tsx` to only
validate non-empty input. The previous validation was not in line with
`validateAIProviderBaseURL` in `codersdk/aiproviders.go`. This was
blocking users from adding providers with a short-form hostname (e.g.
`http://localhost:8080/v1`).

> Generated by Coder Agents, reviewed by a human.
 2026-08-18 00:18:26 +01:00
Asher b5d18bb9c9 feat: add redirect URL override for external auth (#28082) 2026-08-17 14:09:23 -08:00
Paweł Banaszewski 94f487b890 test(enterprise/cli): add standalone AI Gateway connection tests (#27860) 
Adds two tests that run the real `ai-gateway start` command against a
real coderd over the production websocket dialer.
`TestAIGatewayStartE2E`: the gateway completes the handshake, loads
providers over DRPC, proxies an OpenAI chat completion on its own
listener, and the interception is recorded in coderd.
`TestAIGatewayStartE2E_InvalidKey`: a key rejected by the handshake is
fatal rather than retried, and the command reports it.

Also tidies the existing tests: `TestAIGatewayStart_HealthBeforeReady`
moves to the external package and reuses the new helpers, the two fake
reloaders collapse into one `mockReloader`.

---

Generated with Coder Agents.
 2026-08-17 20:48:09 +00:00
Jeremy RuppelandSamuel Volin 46ec620767 fix(site): deflake adjust user theme preference (#28219) 
## Summary

Deflakes the `adjust user theme preference` Playwright test
(`site/e2e/tests/users/userSettings.spec.ts`), tracked in DEVEX-415.

The test selected the Light theme and then hard-navigated with
`page.goto`
before the optimistic appearance update was persisted. The navigation
could
cancel the in-flight `PUT /api/v2/users/me/appearance`, so the reloaded
document embedded the stale `dark` preference and the final assertion
flaked.
`toPass` retries could not help because retrying the reload only
re-reads the
still-stale persisted state.

## Fix

Wait for the appearance form's save spinner to clear before the hard
reload,
mirroring how other settings tests wait for a visible save confirmation.
Asserting the optimistic light class first guarantees the spinner is
already
showing if a save started; a repeat run that is already light never
shows it,
so the test is idempotent and there are no direct API calls.

To give the test a UI signal, `Spinner` gets an opt-in `label` prop that
exposes it as a `role="status"` live region with an `aria-label`
(decorative
otherwise). `Loader` moves its label onto its own status container so it
keeps
a single status region.

## Changes

- `site/src/components/Spinner/Spinner.tsx`: opt-in `label` prop.
- `site/src/components/Loader/Loader.tsx`: label on its own status
region.
- `site/src/pages/UserSettingsPage/AppearancePage/AppearanceForm.tsx`:
label
  both appearance save spinners.
- `site/e2e/tests/users/userSettings.spec.ts`: wait for the save
spinner.

## Validation

- `biome check` and `tsc -p .` pass.
- Loader + AppearancePage unit tests and the affected storybook tests
pass.
- The e2e test passed 20/20 under
`pnpm playwright:test -g "adjust user theme preference" --repeat-each
20`.

<details>
<summary>Implementation plan & decision log</summary>

# DEVEX-415: Fix flake in "adjust user theme preference" e2e test

## Problem

Playwright test `site/e2e/tests/users/userSettings.spec.ts` → `adjust
user
theme preference` flakes. After selecting the Light theme and
hard-navigating
to `/`, the reloaded page sometimes stays `dark`, failing the final
assertion.

CI Flake Bot has recorded repeated recurrences on `main` (latest
2026-08-17,
runs `32004239187`, `31745261984`) even after PR #25183 added `toPass`
retries.

## Root cause (confirmed by reading the code)

The appearance update is optimistic and its persistence is not awaited
before
navigation:

- `updateAppearanceSettings` (`site/src/api/queries/users.ts`) has an
`onMutate` that optimistically writes the new theme into the React Query
  cache. The `<html>` class flips to `light` immediately, before the
  `PUT /api/v2/users/me/appearance` completes.
- `useQueuedAppearanceSubmit`
  (`site/src/pages/UserSettingsPage/AppearancePage/AppearancePage.tsx`)
serializes submits: if a request is in flight, the next is queued and
only
  fires after the first settles.
- A fresh `member` user has **empty** appearance settings.
`migrateLegacyPreference` (`site/src/theme/themeMode.ts`) maps empty
settings
to `{ mode: "single", theme: "dark" }` (`DEFAULT_THEME = "dark"`). So
the
"Theme mode" dropdown already starts on **Single theme** and `<html>`
starts
  `dark`. Selecting "Single theme" in the test is therefore a **no-op**
(`onChangeMode` early-returns when `mode === draft.mode`) and fires
**no**
  PUT. The only appearance PUT in the test is the one from clicking
"Light default" (`onSelectSingle("light")` → `theme_preference:
"light"`).
- The test's first `expectLightThemeClasses(page)` passes purely from
the
  optimistic cache. It then calls `page.goto("/")` almost immediately
  (~20 ms after the click). If PUT #2 (the light one) has not persisted
server-side, the new document loads the still-persisted `dark`
preference
from embedded metadata, and every retry of the post-navigation assertion
  sees `dark` for the full 10 s window.

`toPass` cannot help post-navigation because it only re-reads stale,
already
persisted state; it cannot make an unfinished/queued PUT complete.

## Implemented fix: wait for the saving spinner (UI signal) before
navigation

> Iteration history: (1) An earlier attempt waited on the appearance
`PUT` via
> a `waitForApiCall` helper, but that couples the test to a state
transition
> and is non-idempotent (a repeat run that is already light fires no
PUT, so
> the wait times out). CI retries reuse the same ephemeral server, so
this is a
> real hazard. (2) A second attempt confirmed persistence with
> `page.request.get(...)`, but that calls the API directly and stops
being a
> site test. Both were rejected.

The repo's non-flaky settings tests wait for a **visible save
confirmation**
(e.g. "settings updated successfully" toasts) before trusting the
result. The
appearance theme form has no toast; its only save-in-progress feedback
is the
`<Spinner>`. So the fix mirrors that pattern using the spinner:

1. Make the theme section's spinner identifiable via a new opt-in
`label` prop
   on `Spinner` (sets `role="status"` + `aria-label` only when provided;
   decorative otherwise). `Loader` moves its label onto its own `status`
   container so it keeps a single status region and its `getByLabelText`
   queries keep working.
2. In the test, after clicking "Light default", assert the optimistic
light
class, then wait for that spinner to be hidden before `page.goto("/")`.

Why this is correct and idempotent:

- React Query sets `isPending` before `onMutate` applies the optimistic
cache
update, so by the time the optimistic light class is visible the spinner
is
already showing if a save started. Waiting for it to clear guarantees
the PUT
  settled (and was not canceled by navigation) before the reload.
- A repeat run that is already light: clicking "Light default" is a
no-op radio
  change, no PUT fires, the spinner never shows, and `toBeHidden` passes
  immediately. The reload still shows light.
- No direct API calls: the test only observes site UI.

### Implemented changes

`Spinner` gains an opt-in `label` prop
(`site/src/components/Spinner/Spinner.tsx`):

```tsx
role={label ? "status" : undefined}
aria-label={label}
```

`Loader` carries the label on its own status container
(`site/src/components/Loader/Loader.tsx`), and the appearance save
spinners use
the new prop (`AppearanceForm.tsx`):

```tsx
<Spinner loading={isUpdating} size="sm" label="Saving theme preference" />
<Spinner loading={isUpdating} size="sm" label="Saving terminal font" />
```

`site/e2e/tests/users/userSettings.spec.ts`:

```ts
await expect(
	page.getByRole("combobox", { name: /theme mode/i }),
).toContainText("Single theme"); // precondition: single mode

const singleThemeGroup = page.getByRole("group", { name: "Theme" });
await expect(singleThemeGroup).toBeVisible();
await singleThemeGroup.getByText("Light default", { exact: true }).click();

await expectLightThemeClasses(page); // optimistic DOM => spinner showing if saving
await expect(
	page.getByRole("status", { name: "Saving theme preference" }),
).toBeHidden(); // save settled before the hard reload

await page.goto("/", { waitUntil: "domcontentloaded" });
await expectLightThemeClasses(page);
```

Validation: `biome check`, `tsc -p .` pass; Loader + AppearancePage unit
tests
and the affected storybook tests pass; the e2e test passed 20/20 under
`pnpm playwright:test -g "adjust user theme preference" --repeat-each
20`
(idempotent).

## Alternatives considered

- **Wait on the appearance `PUT` via a `waitForApiCall` helper**:
rejected. It
couples the test to a state transition and is non-idempotent, a repeat
run
that is already light fires no PUT so the wait times out (14/15 repeats
  failed). CI retries reuse the same ephemeral server, so this is a real
  hazard, not just a local-repeat artifact.
- **Confirm persistence with `page.request.get(...)`**: rejected. It
calls the
  API directly and stops being a site test.
- **Default `role="status"` on the shared `Spinner`**: rejected.
`Loader` wraps
  `Spinner` in its own `status` div, so a default would nest two status
regions and break `Loader.test.tsx`. The opt-in `label` prop avoids
this.
- **Add a networkidle wait or sleep before navigation**: rejected.
Violates
the repo guidance against `time.Sleep`-style timing hacks and is
inherently
  racy.
- **Fix product behavior instead of the test**: out of scope. Related
bug
DEVEX-94 ("Light Theme setting not respected until Appearance page
opened")
tracks product-side persistence/embedding behavior; this task is scoped
to
  stabilizing the e2e test.

## Files touched

- `site/src/components/Spinner/Spinner.tsx` (new opt-in `label` prop).
- `site/src/components/Loader/Loader.tsx` (label on its own status
region).
- `site/src/pages/UserSettingsPage/AppearancePage/AppearanceForm.tsx`
(use the
  `label` prop on both appearance save spinners).
- `site/e2e/tests/users/userSettings.spec.ts` (wait for the spinner).


</details>

---
This PR was created by Coder Agents on behalf of @jeremyruppel.

---------

Co-authored-by: Samuel Volin <sam.volin@coder.com>
 2026-08-17 15:36:46 -04:00
Andrew Aquino 039c0da5ae feat(site/src/pages/TemplateBuilder): make sidebar steps navigable (#28153) 
## What

Makes the remaining `SelectionSummary` sidebar elements clickable jump
targets on `/templates/new/builder`, continuing the work from #27351
(which made module rows navigable).

Clickable now:

| Sidebar element | Jumps to |
|---|---|
| `Base Template` label | `base-infra` |
| Selected base-template row | `base-parameters` (falls back to
`base-infra` when that step is skipped) |
| `Modules` label | `module-select` |
| Each module row | `module-settings` + scroll (already shipped in
#27351) |
| `Customizations` label | `customizations` |

## Back-stack behavior

The sidebar previously colored groups purely from the current step, so
jumping backward would grey out and disable steps you had already
reached. This adds a `maxReachedGroup` that never shrinks on backward
navigation:

- Groups at or below the furthest-reached group stay `complete` (green)
and clickable, like a browser back-stack.
- Groups strictly above render as `upcoming` and inert (no button, no
hover, not focusable).
- The connecting divider color keys off `maxReachedGroup`, not the
current step, so it stays green after navigating backward.

Clickability is gated on `maxReachedGroup` (you can only jump to steps
you have already reached).

## Changes

- `SelectionSummary.tsx`: new required `maxReachedStep` and
`onNavigateStep` props. Split the single `variant()` into
`indicatorVariant` (label circle), `dividerVariant` (connecting line),
and a `reachable()` gate. `StepIndicator` and `BaseTemplateSelection`
render as `<button>` (hover + focus ring, `aria-label`) when a reachable
handler is supplied, else stay inert.
- `TemplateBuilderPageView.tsx`: track `maxReachedGroup`; add
`navigateToStepId(stepId)` that resolves skipped steps via
`nearestVisible` (so `base-parameters` falls back to `base-infra`) and
mirrors the existing customizations reset when leaving that step. Wire
both new props into `SelectionSummary`.
- `SelectionSummary.stories.tsx`: add `onNavigateStep` to meta and
`maxReachedStep` to existing stories; add `NavigationClicks` (asserts
each label/base/module callback), `BackwardNavigation` (dividers stay
green), and `UpcomingStepsInert` (steps above max-reached are not
buttons).

## Out of scope

Everything else from #27077 stays out: gallery height, sensitive-var
banner relocation, trash-icon wiring, and the scroll-past required-field
subsystem.

## Testing

- `pnpm check` (biome) clean
- `pnpm lint:types` (tsc) clean
- `pnpm vitest run --project=storybook src/pages/TemplateBuilder` — 37
pass
- `pnpm vitest run --project=unit src/pages/TemplateBuilder` — 55 pass

<details>
<summary>Implementation plan / decision log</summary>

### Origin

This is the remainder of PR #27077's item #2 (navigable selection
summary), rebased onto current `main` after #27351 shipped the
module-row navigation.

### Why a `maxReachedGroup` back-stack

`furthestAllowedIndex(state)` on current `main` is all-or-nothing (0
without a base selected, otherwise the last step), so it cannot express
"how far the user has progressed" for the sidebar coloring. A monotonic
`maxReachedGroup` (bumped when the current group advances, never shrunk)
is needed to keep completed steps green and clickable after backward
navigation, matching #27077.

### Decisions

- Reachability gating: gate both coloring and clickability on
`maxReachedGroup` (only jump to steps already reached), rather than the
looser `furthestAllowedIndex` (which would let users skip required steps
once a base is chosen).
- Base-template row target: jump to `base-parameters` and let
`nearestVisible` fall back to `base-infra` when the base has no
parameters/prerequisites.
- Module rows: keep `onNavigateModule` passed directly (not re-gated on
reachability), since a module can only be selected after reaching group
2, so `reachable(2)` is always true when module rows render. This
preserves the earlier decision to keep the module row's handler required
with no inert branch.

</details>

---

Coder Agents generated, on behalf of @aqandrew.
 2026-08-17 12:15:29 -07:00
TJ b4971bc49f feat(site/src/modules/dashboard/Navbar): replace proxy emoji with latency radio icon in trigger (#28128) 
Updates the latency dropdown's collapsed views in the navbar:

- Removes the proxy emoji (`ExternalImage`) from the desktop trigger and
the mobile "Workspace proxy settings" row.
- Shows a lucide `RadioIcon` instead, colored via `getLatencyColor`
(matching the loading state used by the `Latency` component on desktop).
- Keeps the latency text in `content-primary`; only the icon carries the
latency color.

The expanded proxy lists are unchanged (they keep the proxy icon and
colored latency text).

Story changes:

- Added `ClosedWarningLatency` and `ClosedCriticalLatency` to cover the
icon color per latency level.
- Right-aligned the ProxyMenu story trigger to match its navbar
placement, so the end-aligned menu renders without collision shifting in
the story canvas.

> Generated by Coder Agents on behalf of @tracyjohnsonux.
 2026-08-17 18:41:27 +00:00
TJ 5d746aa594 fix(site/src): replace hardcoded text-[13px] with scale tokens outside agents (#28071) 
Replaces the arbitrary `text-[13px]` value with the design-system tokens
`text-sm` (14px) or `text-xs` (12px) in the 18 non-agents files that
used it. `AgentsPage` usages and `modules/resources/AgentMetadata.tsx`
are intentionally left alone; they'll be handled with the agents UI
separately.

Because the custom Tailwind scale bakes `font-weight: 500` into
`text-xs`/`text-sm`, `font-normal` was added wherever the text
previously rendered at 400 and is prose, code, or log content, so only
the size changes there. Short labels, headers, and numeric values take
the token's 500 weight as-is.

### Token decisions

| File | Token | Rationale |
|---|---|---|
| `components/Logs/LogLine.tsx` | `text-xs font-normal` | Dense mono log
output; 12px keeps line-height close to current |
| `components/PaginationWidget/PaginationAmount.tsx` | `text-xs
font-normal` | Caption-style "showing X of Y" text |
| `pages/IconsPage/IconsPage.tsx` (figcaption) | `text-xs font-normal` |
88px-wide icon captions |
| `pages/WorkspacesPage/WorkspacesButton.tsx` | `text-xs font-normal` |
Secondary line under the template name in the combobox |
| `modules/templates/TemplateExampleCard.tsx`,
`pages/CreateTemplateGalleryPage/...` | `text-xs font-normal` |
Secondary card description prose (and its "Read more" link) |
| `components/FullPageLayout/Sidebar.tsx` / `Topbar.tsx` | `text-sm`
(Topbar adds `font-normal`) | Nav chrome; Topbar is a container so
`font-normal` avoids leaking 500 into all children |
| `components/Paywall/PaywallPremium.tsx` | `text-sm font-normal` |
Feature list prose (compact variant) |
| `modules/templates/TemplateFiles/TemplateFiles.tsx` /
`TemplateFileTree.tsx` | `text-sm` | File headers/tree labels (header
already `font-medium`) |
| `modules/workspaces/WorkspaceOutdatedTooltip.tsx` | `text-sm
font-normal` | Tooltip body prose |
| `pages/WorkspacePage/ResourcesSidebar.tsx` | `text-sm font-normal` |
Help text prose |
| `pages/AISettingsPage/.../CredentialField.tsx` | `text-sm font-normal`
| Mono credential input |
| `pages/DeploymentSettingsPage/Option.tsx` | `text-sm` | Already
`font-semibold` |
| `pages/HealthPage/Content.tsx` | `text-sm font-normal` | Mono detail
block |
| `pages/TemplateVersionEditorPage/TemplateVersionEditor.tsx` |
`text-sm` | "Files" panel header label |
| `pages/TemplatePage/TemplateInsightsPage/TemplateInsightsPage.tsx` |
`text-sm` (`font-normal` on prose/empty state) | Data labels and values
in insight panels |

### Storybook review checklist

Stories directly covering changed components:

- `Logs/LogLine` and `Logs/Logs`
- `Paywall/PaywallPremium`
- `TemplateExampleCard`
- `TemplateFiles` and `TemplateFileTree`
- `WorkspaceOutdatedTooltip`
- `CreateTemplateGalleryPageView`
- `IconsPage`
- `TemplateInsightsPage`
- `TemplateVersionEditor` (also exercises FullPageLayout
`Topbar`/`Sidebar`)

Indirect coverage for components without their own stories:

- `PaginationAmount` → `PaginationWidget/PaginationContainer` stories,
plus paginated page views (`UsersPageView`, `AuditPageView`,
`ConnectionLogPageView`)
- `WorkspacesButton` → `WorkspacesPageView` stories (open the "New
workspace" combobox)
- `HealthPage/Content` → `HealthPage/*Page` stories (`DERPPage`,
`DatabasePage`, etc.)
- `ResourcesSidebar` → `WorkspacePage/Workspace` stories (failed-build
state)
- `FullPageLayout Topbar/Sidebar` → `TemplateVersionEditor` stories
- `CredentialField` → `ProviderForm` / `AddProviderPageView` stories

No story exists for `DeploymentSettingsPage/Option`; verify on the
deployment settings page (option value pills).

---

🤖 This PR was generated by Coder Agents on behalf of @tracyjohnsonux.
 2026-08-17 18:41:06 +00:00
Cian Johnston aa80fa3550 fix(coderd/externalauth): also retry on 503 (#28218) 2026-08-17 17:39:23 +01:00
Susana Ferreira 95328f1ead fix: label unpriced token usage metric by provider name and type (#28210) 
## Problem

The `provider` label was inconsistent between AI Gateway metrics. Every
metric emitted by the gateway labels `provider` with the provider
instance name, for example `anthropic-eu`, while
`coder_ai_gateway_cost_control_unpriced_token_usage_records_total` used
the provider type, for example `anthropic`. The two could not be
correlated on `provider`.

The metric was also inconsistent with itself: the path where a provider
fails to resolve labelled by instance name, and the path where a model
has no price labelled by type. The type is still worth exposing, since
prices are keyed on `(provider_type, model)` and that is what an
operator needs to add a price.

## Changes

- Label the metric with `provider` (the instance name, consistent with
the other gateway metrics) and add `provider_type` (the configured type
the price is keyed on).
- Use `unknown` for `provider_type` when the provider does not resolve
to a configured type.
- Log the unresolved-provider case at `warn` instead of `info`. A
missing price is an expected steady state, but a provider that cannot be
resolved is not.
- Update the metrics docs and the `metricsdocgen` fixture.

Closes [AIGOV-574](https://linear.app/codercom/issue/AIGOV-574)

> [!NOTE]
> Initially generated by Claude Opus 5, modified and reviewed by
@ssncferreira
 2026-08-17 14:08:28 +01:00
Jaayden Halko 20c376a575 fix: enforce uniqueness and hour alignment for agent runtime usage events (#27983) 
The usage generator writes `hb_agent_runtime_v1` rows with `created_at`
at the UTC hourly bucket start and exactly one row per bucket, but
nothing in the schema enforced either invariant. A duplicate bucket row
under a different id would be double-counted by any consumer summing
`runtime_ms`, and a misaligned `created_at` would skew which usage
period a bucket is attributed to.

This replaces the non-unique partial index
`idx_usage_events_agent_runtime` (from migration 000561) with a unique
index of the same shape and adds an hour-alignment `CHECK` constraint.
Both statements validate existing rows: every supported writer has
always produced conforming data, so a pre-existing violator is anomalous
and failing the migration loudly beats silently rewriting usage rows.
`generateBucket` treats a unique violation on the bucket index as
another replica having won the race, mirroring the existing `ON CONFLICT
(id)` no-op for committed rows.

The `coderd/notifications` sync commit and its revert cancel out (the
drift they addressed was fixed on main by #27979); the PR's net diff is
only the usage-event changes.

Part 1 of a 3-PR stack splitting up #27796 (see there for review
history). Stack: this PR → #27984 → #27985.
 2026-08-17 16:23:45 +07:00
dependabot[bot] bf236bb340 ci: bump the github-actions group with 2 updates (#28202) 
Bumps the github-actions group with 2 updates:
[fluxcd/flux2/action](https://github.com/fluxcd/flux2) and
[linear/linear-release-action](https://github.com/linear/linear-release-action).

Updates `fluxcd/flux2/action` from 2.9.3 to 2.9.4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/fluxcd/flux2/releases">fluxcd/flux2/action's
releases</a>.</em></p>
<blockquote>
<h2>v2.9.4</h2>
<h2>Highlights</h2>
<p>Flux v2.9.4 is a patch release that ships various fixes to the Flux
controllers, covering source-watcher tarball extraction and glob
expansion limits, the refspecs accepted by
<code>ImageUpdateAutomation</code>, the HTTP request limits of the
notification-controller servers, and Helm repository index loading, OCI
chart digest pinning, <code>Bucket</code> error handling and GCS static
authentication in source-controller. On the CLI side, <code>flux migrate
-f</code> now supports migrating repositories to Flux 2.9. Users are
encouraged to upgrade for the best experience.</p>
<p>Note that this release contains CRD schema changes for
<code>ArtifactGenerator</code> and <code>ImageUpdateAutomation</code>;
both CRDs must be updated along with the controllers.</p>
<p>ℹ️ Please follow the <a
href="https://github.com/fluxcd/flux2/discussions/5572">Upgrade
Procedure for Flux v2.7+</a> for a smooth upgrade from Flux v2.6 to the
latest version.</p>
<p>Fixes:</p>
<ul>
<li>Confine tarball extraction and bound glob expansion
(source-watcher)</li>
<li>Disallow force-update and deletion via refspecs
(image-automation-controller)</li>
<li>Unify HTTP server request limits (notification-controller)</li>
<li>Align Helm repository index loading with upstream Helm v4
(source-controller)</li>
<li>Improve error handling in <code>Bucket</code> reconciliation
(source-controller)</li>
<li>Pin OCI chart verification by digest (source-controller)</li>
<li>Limit GCS static authentication to service account keys
(source-controller)</li>
<li>Restrict the <code>allow-webhooks</code> network policy to the
receiver port (flux CLI)</li>
</ul>
<p>Improvements:</p>
<ul>
<li>Add support for migrating repositories to 2.9 in <code>flux migrate
-f</code> (flux CLI)</li>
<li>Update fluxcd/pkg dependencies, which align the ECR host detection
with upstream (source-controller, image-reflector-controller, flux
CLI)</li>
<li>Update Bitbucket Cloud receiver guidance
(notification-controller)</li>
</ul>
<h2>Components changelog</h2>
<ul>
<li>source-controller <a
href="https://github.com/fluxcd/source-controller/blob/v1.9.4/CHANGELOG.md">v1.9.4</a></li>
<li>source-watcher <a
href="https://github.com/fluxcd/source-watcher/blob/v2.2.3/CHANGELOG.md">v2.2.3</a></li>
<li>notification-controller <a
href="https://github.com/fluxcd/notification-controller/blob/v1.9.3/CHANGELOG.md">v1.9.3</a></li>
<li>image-reflector-controller <a
href="https://github.com/fluxcd/image-reflector-controller/blob/v1.2.4/CHANGELOG.md">v1.2.4</a></li>
<li>image-automation-controller <a
href="https://github.com/fluxcd/image-automation-controller/blob/v1.2.4/CHANGELOG.md">v1.2.4</a></li>
</ul>
<h2>CLI changelog</h2>
<ul>
<li>[release/v2.9.x] Add support for 2.9 in <code>migrate -f</code> by
<a href="https://github.com/fluxcdbot"><code>@​fluxcdbot</code></a> in
<a
href="https://redirect.github.com/fluxcd/flux2/pull/6021">fluxcd/flux2#6021</a></li>
<li>Update fluxcd/pkg dependencies by <a
href="https://github.com/fluxcdbot"><code>@​fluxcdbot</code></a> in <a
href="https://redirect.github.com/fluxcd/flux2/pull/6026">fluxcd/flux2#6026</a></li>
<li>[release/v2.9.x] fix: restrict <code>allow-webhooks</code> netpol to
receiver port by <a
href="https://github.com/fluxcdbot"><code>@​fluxcdbot</code></a> in <a
href="https://redirect.github.com/fluxcd/flux2/pull/6029">fluxcd/flux2#6029</a></li>
<li>Update toolkit components by <a
href="https://github.com/fluxcdbot"><code>@​fluxcdbot</code></a> in <a
href="https://redirect.github.com/fluxcd/flux2/pull/6031">fluxcd/flux2#6031</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/fluxcd/flux2/compare/v2.9.3...v2.9.4">https://github.com/fluxcd/flux2/compare/v2.9.3...v2.9.4</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/fluxcd/flux2/commit/889be9d6cc8afa8ed639e1e1ba4ab678e3b38d8c"><code>889be9d</code></a>
Merge pull request <a
href="https://redirect.github.com/fluxcd/flux2/issues/6031">#6031</a>
from fluxcd/update-components-release/v2.9.x</li>
<li><a
href="https://github.com/fluxcd/flux2/commit/38254293dabb1e982c08d9596e619b615bf48ac7"><code>3825429</code></a>
Update toolkit components</li>
<li><a
href="https://github.com/fluxcd/flux2/commit/ffe365a4536bce3450f9b94358887a7c4bd693fe"><code>ffe365a</code></a>
Merge pull request <a
href="https://redirect.github.com/fluxcd/flux2/issues/6029">#6029</a>
from fluxcd/backport-6028-to-release/v2.9.x</li>
<li><a
href="https://github.com/fluxcd/flux2/commit/8ac865ce1ea514b1d4b8b6c94b63d327897cc28b"><code>8ac865c</code></a>
fix: restrict allow-webhooks netpol to receiver port</li>
<li><a
href="https://github.com/fluxcd/flux2/commit/c49a4868e014340e569c26d6b825e41a5ce4b4ec"><code>c49a486</code></a>
Merge pull request <a
href="https://redirect.github.com/fluxcd/flux2/issues/6026">#6026</a>
from fluxcd/update-pkg-deps/release/v2.9.x</li>
<li><a
href="https://github.com/fluxcd/flux2/commit/4942d15825f1b4b7bc14c35035c309cb761775b7"><code>4942d15</code></a>
Update fluxcd/pkg dependencies</li>
<li><a
href="https://github.com/fluxcd/flux2/commit/a2d0b2919a3796c56f4ab629095b991155143103"><code>a2d0b29</code></a>
Merge pull request <a
href="https://redirect.github.com/fluxcd/flux2/issues/6021">#6021</a>
from fluxcd/backport-6020-to-release/v2.9.x</li>
<li><a
href="https://github.com/fluxcd/flux2/commit/f4ad9e5f4a7e509cb2a6c83bc0693181825c61da"><code>f4ad9e5</code></a>
Add support for 2.9 in migrate -f</li>
<li>See full diff in <a
href="https://github.com/fluxcd/flux2/compare/16602fa989daa99762f1c6d1186ae2ad1c735815...889be9d6cc8afa8ed639e1e1ba4ab678e3b38d8c">compare
view</a></li>
</ul>
</details>
<br />

Updates `linear/linear-release-action` from 0.15.0 to 0.15.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/linear/linear-release-action/releases">linear/linear-release-action's
releases</a>.</em></p>
<blockquote>
<h2>v0.15.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Expose the CLI --issue-pattern flag as an issue_pattern input by <a
href="https://github.com/RomainCscn"><code>@​RomainCscn</code></a> in <a
href="https://redirect.github.com/linear/linear-release-action/pull/56">linear/linear-release-action#56</a></li>
<li>Release v0.15.1 by <a
href="https://github.com/RomainCscn"><code>@​RomainCscn</code></a> in <a
href="https://redirect.github.com/linear/linear-release-action/pull/57">linear/linear-release-action#57</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/linear/linear-release-action/compare/v0.15.0...v0.15.1">https://github.com/linear/linear-release-action/compare/v0.15.0...v0.15.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/linear/linear-release-action/commit/17b8c24f8ceb2b98cabaf1965ff83c55dd596fac"><code>17b8c24</code></a>
Release v0.15.1 (<a
href="https://redirect.github.com/linear/linear-release-action/issues/57">#57</a>)</li>
<li><a
href="https://github.com/linear/linear-release-action/commit/cb0977c25f7e16b4ea2e89d9f71841e3f887dea4"><code>cb0977c</code></a>
Expose the CLI --issue-pattern flag as an issue_pattern input (<a
href="https://redirect.github.com/linear/linear-release-action/issues/56">#56</a>)</li>
<li>See full diff in <a
href="https://github.com/linear/linear-release-action/compare/af56a9a388625921f3757a2f988e4d7aca958377...17b8c24f8ceb2b98cabaf1965ff83c55dd596fac">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-17 07:26:02 +00:00
dependabot[bot] ce88ad131c chore: bump protobufjs from 7.6.1 to 7.6.5 in /site (#28201) 
Bumps [protobufjs](https://github.com/protobufjs/protobuf.js) from 7.6.1
to 7.6.5.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/protobufjs/protobuf.js/releases">protobufjs's
releases</a>.</em></p>
<blockquote>
<h2>protobufjs: v7.6.5</h2>
<h2><a
href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.6.4...protobufjs-v7.6.5">7.6.5</a>
(2026-07-04)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>handle EOF during options parsing (<a
href="https://redirect.github.com/protobufjs/protobuf.js/issues/2352">#2352</a>)
(<a
href="https://redirect.github.com/protobufjs/protobuf.js/issues/2356">#2356</a>)
(<a
href="https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217">10fba6d</a>)</li>
</ul>
<h2>protobufjs: v7.6.4</h2>
<h2><a
href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.6.3...protobufjs-v7.6.4">7.6.4</a>
(2026-06-12)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>Reconfigure and speed up CI (<a
href="https://redirect.github.com/protobufjs/protobuf.js/issues/2329">#2329</a>)
(<a
href="https://github.com/protobufjs/protobuf.js/commit/574f761c05b007dab6595ca1eaed86436579ba3f">574f761</a>)</li>
<li>Remove inquire submodule (<a
href="https://redirect.github.com/protobufjs/protobuf.js/issues/2327">#2327</a>)
(<a
href="https://github.com/protobufjs/protobuf.js/commit/06ddd07064329032aae6db586e2d54938b591792">06ddd07</a>)</li>
</ul>
<h2>protobufjs: v7.6.3</h2>
<h2><a
href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.6.2...protobufjs-v7.6.3">7.6.3</a>
(2026-06-09)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>Avoid name collisions in generated code (<a
href="https://redirect.github.com/protobufjs/protobuf.js/issues/2311">#2311</a>)
(<a
href="https://github.com/protobufjs/protobuf.js/commit/78a9576269a5b590c54686a8122e78e28135cd50">78a9576</a>)</li>
<li>Preserve null conversion behavior for fieldless messages (<a
href="https://redirect.github.com/protobufjs/protobuf.js/issues/2312">#2312</a>)
(<a
href="https://github.com/protobufjs/protobuf.js/commit/df91652aa5cb1ee0204566252df85cbe752298a6">df91652</a>)</li>
</ul>
<h2>protobufjs: v7.6.2</h2>
<h2><a
href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.6.1...protobufjs-v7.6.2">7.6.2</a>
(2026-05-30)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>Backport consistency and correctness fixes (<a
href="https://redirect.github.com/protobufjs/protobuf.js/issues/2294">#2294</a>)
(<a
href="https://github.com/protobufjs/protobuf.js/commit/a92f72e1cb731f06040a7917d3e041666d5f5601">a92f72e</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/protobufjs/protobuf.js/blob/protobufjs-v7.6.5/CHANGELOG.md">protobufjs's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.6.4...protobufjs-v7.6.5">7.6.5</a>
(2026-07-04)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>handle EOF during options parsing (<a
href="https://redirect.github.com/protobufjs/protobuf.js/issues/2352">#2352</a>)
(<a
href="https://redirect.github.com/protobufjs/protobuf.js/issues/2356">#2356</a>)
(<a
href="https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217">10fba6d</a>)</li>
</ul>
<h2><a
href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.6.3...protobufjs-v7.6.4">7.6.4</a>
(2026-06-12)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>Reconfigure and speed up CI (<a
href="https://redirect.github.com/protobufjs/protobuf.js/issues/2329">#2329</a>)
(<a
href="https://github.com/protobufjs/protobuf.js/commit/574f761c05b007dab6595ca1eaed86436579ba3f">574f761</a>)</li>
<li>Remove inquire submodule (<a
href="https://redirect.github.com/protobufjs/protobuf.js/issues/2327">#2327</a>)
(<a
href="https://github.com/protobufjs/protobuf.js/commit/06ddd07064329032aae6db586e2d54938b591792">06ddd07</a>)</li>
</ul>
<h2><a
href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.6.2...protobufjs-v7.6.3">7.6.3</a>
(2026-06-09)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>Avoid name collisions in generated code (<a
href="https://redirect.github.com/protobufjs/protobuf.js/issues/2311">#2311</a>)
(<a
href="https://github.com/protobufjs/protobuf.js/commit/78a9576269a5b590c54686a8122e78e28135cd50">78a9576</a>)</li>
<li>Preserve null conversion behavior for fieldless messages (<a
href="https://redirect.github.com/protobufjs/protobuf.js/issues/2312">#2312</a>)
(<a
href="https://github.com/protobufjs/protobuf.js/commit/df91652aa5cb1ee0204566252df85cbe752298a6">df91652</a>)</li>
</ul>
<h2><a
href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.6.1...protobufjs-v7.6.2">7.6.2</a>
(2026-05-30)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>Backport consistency and correctness fixes (<a
href="https://redirect.github.com/protobufjs/protobuf.js/issues/2294">#2294</a>)
(<a
href="https://github.com/protobufjs/protobuf.js/commit/a92f72e1cb731f06040a7917d3e041666d5f5601">a92f72e</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/protobufjs/protobuf.js/commit/89048ba0bbf3ed78f77199102f0614dafc2b4860"><code>89048ba</code></a>
chore: release protobufjs-v7.x (<a
href="https://redirect.github.com/protobufjs/protobuf.js/issues/2357">#2357</a>)</li>
<li><a
href="https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217"><code>10fba6d</code></a>
fix: handle EOF during options parsing (<a
href="https://redirect.github.com/protobufjs/protobuf.js/issues/2352">#2352</a>)
(<a
href="https://redirect.github.com/protobufjs/protobuf.js/issues/2356">#2356</a>)</li>
<li><a
href="https://github.com/protobufjs/protobuf.js/commit/f8f64efbfc5b52997beb7549e7ea722704320cb1"><code>f8f64ef</code></a>
chore: release protobufjs-v7.x (<a
href="https://redirect.github.com/protobufjs/protobuf.js/issues/2330">#2330</a>)</li>
<li><a
href="https://github.com/protobufjs/protobuf.js/commit/574f761c05b007dab6595ca1eaed86436579ba3f"><code>574f761</code></a>
fix: Reconfigure and speed up CI (<a
href="https://redirect.github.com/protobufjs/protobuf.js/issues/2329">#2329</a>)</li>
<li><a
href="https://github.com/protobufjs/protobuf.js/commit/06ddd07064329032aae6db586e2d54938b591792"><code>06ddd07</code></a>
fix: Remove inquire submodule (<a
href="https://redirect.github.com/protobufjs/protobuf.js/issues/2327">#2327</a>)</li>
<li><a
href="https://github.com/protobufjs/protobuf.js/commit/1d3796d7d29830c73eec792ccbe769be6aa020ac"><code>1d3796d</code></a>
chore: release protobufjs-v7.x (<a
href="https://redirect.github.com/protobufjs/protobuf.js/issues/2317">#2317</a>)</li>
<li><a
href="https://github.com/protobufjs/protobuf.js/commit/df91652aa5cb1ee0204566252df85cbe752298a6"><code>df91652</code></a>
fix: Preserve null conversion behavior for fieldless messages (<a
href="https://redirect.github.com/protobufjs/protobuf.js/issues/2312">#2312</a>)</li>
<li><a
href="https://github.com/protobufjs/protobuf.js/commit/78a9576269a5b590c54686a8122e78e28135cd50"><code>78a9576</code></a>
fix: Avoid name collisions in generated code (<a
href="https://redirect.github.com/protobufjs/protobuf.js/issues/2311">#2311</a>)</li>
<li><a
href="https://github.com/protobufjs/protobuf.js/commit/ec90ef9ccc30fffe6ea9ea37e45781071898229d"><code>ec90ef9</code></a>
chore: release protobufjs-v7.x (<a
href="https://redirect.github.com/protobufjs/protobuf.js/issues/2295">#2295</a>)</li>
<li><a
href="https://github.com/protobufjs/protobuf.js/commit/a92f72e1cb731f06040a7917d3e041666d5f5601"><code>a92f72e</code></a>
fix: Backport consistency and correctness fixes (<a
href="https://redirect.github.com/protobufjs/protobuf.js/issues/2294">#2294</a>)</li>
<li>See full diff in <a
href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.6.1...protobufjs-v7.6.5">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=protobufjs&package-manager=npm_and_yarn&previous-version=7.6.1&new-version=7.6.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-17 07:23:45 +00:00
dependabot[bot] 6af0ad7952 chore: bump @fontsource-variable/geist-mono from 5.2.7 to 5.3.0 in /site (#28200) 
Bumps
[@fontsource-variable/geist-mono](https://github.com/fontsource/font-files/tree/HEAD/fonts/variable/geist-mono)
from 5.2.7 to 5.3.0.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/fontsource/font-files/commits/HEAD/fonts/variable/geist-mono">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@fontsource-variable/geist-mono&package-manager=npm_and_yarn&previous-version=5.2.7&new-version=5.3.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-17 07:22:21 +00:00
dependabot[bot] 87cddd2d78 chore: bump google.golang.org/api from 0.292.0 to 0.293.0 (#28194) 
Bumps
[google.golang.org/api](https://github.com/googleapis/google-api-go-client)
from 0.292.0 to 0.293.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's
releases</a>.</em></p>
<blockquote>
<h2>v0.293.0</h2>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.292.0...v0.293.0">0.293.0</a>
(2026-08-11)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3689">#3689</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/82ee53b794c25614818788285e4d6fca4cfaa1ec">82ee53b</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3691">#3691</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/07e3f98c6d7c44f348bbc05f64f432ec46f435ab">07e3f98</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3692">#3692</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/8ab25861a802d778288129a603846c65b844d8ec">8ab2586</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3693">#3693</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/3ca7257fbaff1a073464989df9a284e7088f2917">3ca7257</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3694">#3694</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/68555327f8bf789f35a7e0d0ebfe9fac16530a68">6855532</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3696">#3696</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/b7d7362fc13addec7389a279e6483db7e8f1159f">b7d7362</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3697">#3697</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/9f826b1a20348948d7ae728134651c3dcbccf5db">9f826b1</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.292.0...v0.293.0">0.293.0</a>
(2026-08-11)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3689">#3689</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/82ee53b794c25614818788285e4d6fca4cfaa1ec">82ee53b</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3691">#3691</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/07e3f98c6d7c44f348bbc05f64f432ec46f435ab">07e3f98</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3692">#3692</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/8ab25861a802d778288129a603846c65b844d8ec">8ab2586</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3693">#3693</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/3ca7257fbaff1a073464989df9a284e7088f2917">3ca7257</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3694">#3694</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/68555327f8bf789f35a7e0d0ebfe9fac16530a68">6855532</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3696">#3696</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/b7d7362fc13addec7389a279e6483db7e8f1159f">b7d7362</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3697">#3697</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/9f826b1a20348948d7ae728134651c3dcbccf5db">9f826b1</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/5b1402ec5cbf03814dc5b35fdd8855f750adcf0a"><code>5b1402e</code></a>
chore(main): release 0.293.0 (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3690">#3690</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/9f826b1a20348948d7ae728134651c3dcbccf5db"><code>9f826b1</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3697">#3697</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/a35fb8e3337735910977da00fe1d55a83f5d884a"><code>a35fb8e</code></a>
chore(all): update all (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3695">#3695</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/b7d7362fc13addec7389a279e6483db7e8f1159f"><code>b7d7362</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3696">#3696</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/68555327f8bf789f35a7e0d0ebfe9fac16530a68"><code>6855532</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3694">#3694</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/3ca7257fbaff1a073464989df9a284e7088f2917"><code>3ca7257</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3693">#3693</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/8ab25861a802d778288129a603846c65b844d8ec"><code>8ab2586</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3692">#3692</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/07e3f98c6d7c44f348bbc05f64f432ec46f435ab"><code>07e3f98</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3691">#3691</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/82ee53b794c25614818788285e4d6fca4cfaa1ec"><code>82ee53b</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3689">#3689</a>)</li>
<li>See full diff in <a
href="https://github.com/googleapis/google-api-go-client/compare/v0.292.0...v0.293.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/api&package-manager=go_modules&previous-version=0.292.0&new-version=0.293.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-17 07:20:50 +00:00
dependabot[bot] 90ef0bc204 chore: bump the x group with 5 updates (#28190) 
Bumps the x group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.54.0` |
`0.55.0` |
| [golang.org/x/mod](https://github.com/golang/mod) | `0.38.0` |
`0.40.0` |
| [golang.org/x/net](https://github.com/golang/net) | `0.57.0` |
`0.58.0` |
| [golang.org/x/text](https://github.com/golang/text) | `0.40.0` |
`0.41.0` |
| [golang.org/x/tools](https://github.com/golang/tools) | `0.48.0` |
`0.49.0` |

Updates `golang.org/x/crypto` from 0.54.0 to 0.55.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/crypto/commit/f44d03d253a1503e51b059ca880867c51d878242"><code>f44d03d</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="https://github.com/golang/crypto/commit/5ed494470b06afb7621b303b04e38366d5863942"><code>5ed4944</code></a>
crypto/internal/poly1305: provide optimised assembly for riscv64</li>
<li><a
href="https://github.com/golang/crypto/commit/b07833c067ec08648541694dc11e02b5ab6b956a"><code>b07833c</code></a>
ssh: return window credit for discarded extended data</li>
<li><a
href="https://github.com/golang/crypto/commit/d701c51f7e4e57f61c4947390514fe631e06202f"><code>d701c51</code></a>
acme: fix nil pointer dereference in pebble test error reporting</li>
<li><a
href="https://github.com/golang/crypto/commit/999d053994c9f2ececb2e85ab0bec72283539e33"><code>999d053</code></a>
ssh: fix parsing of GSSAPI payloads offering multiple mechanisms</li>
<li><a
href="https://github.com/golang/crypto/commit/90f76b8ffe1453c472892d338785687e9727bcc0"><code>90f76b8</code></a>
ssh: reject certificate signature keys before recursing</li>
<li><a
href="https://github.com/golang/crypto/commit/b53964a1ca4763384f2ee3bf482b8ca67a9f9fa8"><code>b53964a</code></a>
ssh: permit empty but non-nil HostKeyAlgorithms, KeyExchanges, Ciphers,
MACs</li>
<li><a
href="https://github.com/golang/crypto/commit/626e40fc986f72b464ecb2063e02e7923bf3025d"><code>626e40f</code></a>
ssh: drain stderr on forwarded TCP and Unix channels</li>
<li><a
href="https://github.com/golang/crypto/commit/31914c699bfcc4906a7f6a178e910388518ed6a3"><code>31914c6</code></a>
x509roots/fallback: update bundle</li>
<li><a
href="https://github.com/golang/crypto/commit/f2135b814ca127b11d04d6d6f0e6569922bace0f"><code>f2135b8</code></a>
all: clean up minor issues found by staticcheck</li>
<li>Additional commits viewable in <a
href="https://github.com/golang/crypto/compare/v0.54.0...v0.55.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `golang.org/x/mod` from 0.38.0 to 0.40.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/mod/commit/d3398d06de5fa5c71083d3d1c26f2cda73508e0f"><code>d3398d0</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="https://github.com/golang/mod/commit/57549bfb0d25b5ff7eb4763aa1f029d7e5383232"><code>57549bf</code></a>
sumdb: ignore unrelated hashes in Lookup</li>
<li><a
href="https://github.com/golang/mod/commit/96f62ae6e9cb1b123de383fa2542812c9ba3b7db"><code>96f62ae</code></a>
sumdb/tlog: fix TileHashReader authentication bypass</li>
<li><a
href="https://github.com/golang/mod/commit/13be9020bbbfae457b59b82c999f8c309cb21ffc"><code>13be902</code></a>
go.mod: update golang.org/x dependencies</li>
<li>See full diff in <a
href="https://github.com/golang/mod/compare/v0.38.0...v0.40.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `golang.org/x/net` from 0.57.0 to 0.58.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/net/commit/acc78e0d2b2c855c0c4fbdcfe5f42a9e3d0f9778"><code>acc78e0</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="https://github.com/golang/net/commit/90d10f01d98d92403c7b2823ab62a977cd01c7c6"><code>90d10f0</code></a>
internal/http3: delete invalid Content-Length if declared in server
handler</li>
<li><a
href="https://github.com/golang/net/commit/08abf4d948c22eae54ea207977c8ee700412a442"><code>08abf4d</code></a>
internal/http3: infer headers when Content-Encoding is set but is
empty</li>
<li><a
href="https://github.com/golang/net/commit/8d10596d262406469433c798878f7a33b1a8d6c4"><code>8d10596</code></a>
http2: avoid deadlocks in wrapped ClientConn state callback</li>
<li><a
href="https://github.com/golang/net/commit/99c3b0a8f463fdf9bfde3b2cb50599ee53891eb0"><code>99c3b0a</code></a>
http2/hpack: build the table lookup maps lazily, only for encoders</li>
<li><a
href="https://github.com/golang/net/commit/5a920b1a80900b1da0d73d18b73c193f7b52b901"><code>5a920b1</code></a>
http3: rework registration to allow using a fake network</li>
<li><a
href="https://github.com/golang/net/commit/7fd284277aab94a6bd16c6a50b7604958f7a18a1"><code>7fd2842</code></a>
quic: return an error from Accept after PacketConn reader exits</li>
<li><a
href="https://github.com/golang/net/commit/825111d7f2d2ccf50aa8eb63f62da04e2e3c5dc6"><code>825111d</code></a>
quic: avoid busy-loop when keep-alive is blocked by congestion
control</li>
<li><a
href="https://github.com/golang/net/commit/a02ddfa7eacb4cf63a5bea6b23761244a6df69f6"><code>a02ddfa</code></a>
http/httpproxy: prioritize lowercase proxy environment variables</li>
<li><a
href="https://github.com/golang/net/commit/574e5eb9d32de67fb16096316d40bb9c412e4906"><code>574e5eb</code></a>
quic: halt conn goroutines on close when listener exits early</li>
<li>Additional commits viewable in <a
href="https://github.com/golang/net/compare/v0.57.0...v0.58.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `golang.org/x/text` from 0.40.0 to 0.41.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/text/commit/acdba6655fd45cdb5ab73c9d6a8981333bd65a39"><code>acdba66</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="https://github.com/golang/text/commit/02aa981a75cb366b39e71729b935c15a7b4e146a"><code>02aa981</code></a>
secure/precis: fix short destination buffer handling in Nickname
profile</li>
<li>See full diff in <a
href="https://github.com/golang/text/compare/v0.40.0...v0.41.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `golang.org/x/tools` from 0.48.0 to 0.49.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/tools/commit/18332fec72972efbb8ab9881984fec2d8cfc2b58"><code>18332fe</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="https://github.com/golang/tools/commit/a5c4651b8e4951086fc536519d0eb869feefa7cb"><code>a5c4651</code></a>
gopls/internal/protocol/command: fix struct field name in comment</li>
<li><a
href="https://github.com/golang/tools/commit/7d08a06ad24bb57ca109618799b3fb0f823a85a3"><code>7d08a06</code></a>
present, cmd/present, cmd/present2md: document lack of security
hardening</li>
<li><a
href="https://github.com/golang/tools/commit/e8a4348692a44c3a3a7157ede01d0407cb0dd034"><code>e8a4348</code></a>
refactor/satisfy: fix &quot;the the&quot; typo</li>
<li><a
href="https://github.com/golang/tools/commit/54624f998d64d74146c63e7f477bcc201d1c44e9"><code>54624f9</code></a>
internal/typesinternal: suppress jsonv2 warning</li>
<li><a
href="https://github.com/golang/tools/commit/c117dde2d0e430d319f475cec3f637c2c9efb56f"><code>c117dde</code></a>
gopls/internal/golang: normalize instantiated fields before rename</li>
<li><a
href="https://github.com/golang/tools/commit/b5b860c7f55cd9ece1dcfcc4a7def912351cb8e9"><code>b5b860c</code></a>
gopls/internal/mcp: report one-based reference line numbers</li>
<li><a
href="https://github.com/golang/tools/commit/bf54bcd2f14a330f0dcffa4cf631235de771bde2"><code>bf54bcd</code></a>
gopls/internal/golang/completion: avoid SEGV from double deslicing</li>
<li><a
href="https://github.com/golang/tools/commit/4b32d669ce28c3b3e274a377a955063223a90350"><code>4b32d66</code></a>
refactor/satisfy/find.go: fix panic on type errors</li>
<li><a
href="https://github.com/golang/tools/commit/e6da7e43e166478a3fa31e18fe3c07fe1379c7db"><code>e6da7e4</code></a>
gopls/internal/protocol/semtok: instructions for modifier/type
changes</li>
<li>Additional commits viewable in <a
href="https://github.com/golang/tools/compare/v0.48.0...v0.49.0">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-17 07:20:14 +00:00
dependabot[bot] 8e5211473f chore: bump tzdata from 1.0.46 to 1.0.50 in /site (#28199) 
Bumps [tzdata](https://github.com/rogierschouten/tzdata-generate) from
1.0.46 to 1.0.50.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/rogierschouten/tzdata-generate/commit/41ba68e0dcd502a173aa8564dc7723a1eb819c58"><code>41ba68e</code></a>
tzdata 2026c</li>
<li><a
href="https://github.com/rogierschouten/tzdata-generate/commit/57262ed943fbb62d8c23fb8a28a4c755fa9e7042"><code>57262ed</code></a>
security fixes</li>
<li><a
href="https://github.com/rogierschouten/tzdata-generate/commit/a0b839f84fee13935e3ceadb857f118ace3b6887"><code>a0b839f</code></a>
Update README.md</li>
<li><a
href="https://github.com/rogierschouten/tzdata-generate/commit/80b6adcf0670cc72df65a8cfda6fd20160213d26"><code>80b6adc</code></a>
Update README.md</li>
<li><a
href="https://github.com/rogierschouten/tzdata-generate/commit/856c38fc89b471eff4c0d2bc6b8919feda48d20e"><code>856c38f</code></a>
tzdata 2026b</li>
<li><a
href="https://github.com/rogierschouten/tzdata-generate/commit/a176aa9f20e398dc5044ae297cedc5451937f35e"><code>a176aa9</code></a>
upgrade dependencies</li>
<li><a
href="https://github.com/rogierschouten/tzdata-generate/commit/61476aa3ea4a542ab616c8b5dd54099a8d842663"><code>61476aa</code></a>
audit fix</li>
<li><a
href="https://github.com/rogierschouten/tzdata-generate/commit/156d450592f7c6dde94782a0c0497ffb84e90252"><code>156d450</code></a>
tzdata 2026a</li>
<li><a
href="https://github.com/rogierschouten/tzdata-generate/commit/c56a60d642ad74215e1a4803c8d0ab3057addec3"><code>c56a60d</code></a>
tz data 2025c</li>
<li><a
href="https://github.com/rogierschouten/tzdata-generate/commit/8126bcf20d661516ec4c9acf0c51945ad3e920b2"><code>8126bcf</code></a>
tz data 2025c</li>
<li>Additional commits viewable in <a
href="https://github.com/rogierschouten/tzdata-generate/compare/v1.0.46...v1.0.50">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tzdata&package-manager=npm_and_yarn&previous-version=1.0.46&new-version=1.0.50)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-17 07:20:02 +00:00
Jake Howell 0350bfd2ea refactor(site): show audit log retention and Premium paywall on observability settings (#27947) 
The Audit Logging section on deployment observability settings only
showed a badge or an info alert, with no actual setting underneath.

When audit logging is entitled, show the Audit Logs Retention option.
When it is not, show the shared Premium paywall instead of the inline
alert.
 2026-08-17 07:19:37 +00:00
Jake Howell 41d2ecec0b feat(site): gate appearance settings behind Premium paywall (#27948) 
Appearance settings previously showed a Premium paywall badge above
still-visible branding and announcement banner forms.

When appearance is not entitled, show only the shared Premium paywall.
When entitled, show the branding form and announcement banners.
 2026-08-17 07:19:19 +00:00
dependabot[bot] e52141fc6a chore: bump github.com/nats-io/nats.go from 1.52.0 to 1.53.1 (#28192) 
Bumps [github.com/nats-io/nats.go](https://github.com/nats-io/nats.go)
from 1.52.0 to 1.53.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/nats-io/nats.go/releases">github.com/nats-io/nats.go's
releases</a>.</em></p>
<blockquote>
<h2>Release v1.53.1</h2>
<h2>Changelog</h2>
<p>This is a patch release containing no functional changes.</p>
<h3>FIXED</h3>
<ul>
<li><code>Version</code> const and the README install line, which were
not updated for v1.53.0 (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2118">#2118</a>)</li>
</ul>
<h3>Complete Changes</h3>
<p><a
href="https://github.com/nats-io/nats.go/compare/v1.53.0...v1.53.1">https://github.com/nats-io/nats.go/compare/v1.53.0...v1.53.1</a></p>
<h2>Release v1.53.0</h2>
<h2>Changelog</h2>
<h3>ADDED</h3>
<ul>
<li>JetStream:
<ul>
<li><code>WithPublishAsyncAckHandler</code> option for JetStream async
publish. Thanks <a
href="https://github.com/occamist"><code>@​occamist</code></a> for the
contribution (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2109">#2109</a>)</li>
<li><code>AckFlowControlPolicy</code> to legacy API (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2091">#2091</a>)</li>
</ul>
</li>
<li>Micro:
<ul>
<li><code>micro.WithEndpointMetadataKey</code>. Thanks <a
href="https://github.com/joeriddles"><code>@​joeriddles</code></a> for
the contribution (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2079">#2079</a>)</li>
</ul>
</li>
</ul>
<h3>FIXED</h3>
<ul>
<li>Core NATS:
<ul>
<li>Websocket connection with path. Thanks <a
href="https://github.com/joeriddles"><code>@​joeriddles</code></a> for
the contribution (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2092">#2092</a>)</li>
<li><code>MsgsTimeout</code> iterator yielding a spurious <code>(nil,
nil)</code> after a timeout. Thanks <a
href="https://github.com/sueun-dev"><code>@​sueun-dev</code></a> and <a
href="https://github.com/c-tonneslan"><code>@​c-tonneslan</code></a> for
the contributions (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2099">#2099</a>,
<a
href="https://redirect.github.com/nats-io/nats.go/issues/2093">#2093</a>)</li>
</ul>
</li>
<li>JetStream:
<ul>
<li>Data race in <code>resetOrderedConsumer</code> when resets overlap
(<a
href="https://redirect.github.com/nats-io/nats.go/issues/2111">#2111</a>)</li>
<li>Avoid panic in <code>PullSubscribe</code> consumer create path.
Thanks <a href="https://github.com/wyf027"><code>@​wyf027</code></a> for
the contribution (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2088">#2088</a>)</li>
<li>Honor per-request <code>JSOpt</code> API prefix across JetStream
APIs. Thanks <a
href="https://github.com/wyf027"><code>@​wyf027</code></a> for the
contribution (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2087">#2087</a>)</li>
<li>Add nil checks for empty JetStream API responses. Thanks <a
href="https://github.com/colecschmidt"><code>@​colecschmidt</code></a>
for the contribution (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2073">#2073</a>)</li>
</ul>
</li>
<li>KeyValue:
<ul>
<li>Recognize error code 10164 for replicated KV CAS conflicts (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2098">#2098</a>)</li>
<li>Reject keys with consecutive dots in <code>keyValid</code> and
<code>searchKeyValid</code>. Thanks <a
href="https://github.com/c-tonneslan"><code>@​c-tonneslan</code></a> for
the contribution (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2076">#2076</a>)</li>
</ul>
</li>
<li>Micro:
<ul>
<li>Endpoint subject prefix over-match. Thanks <a
href="https://github.com/vsaraikin"><code>@​vsaraikin</code></a> for the
contribution (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2105">#2105</a>)</li>
</ul>
</li>
</ul>
<h3>IMPROVED</h3>
<ul>
<li>Performance enhancement when publishing core NATS messages with
headers. Thanks <a
href="https://github.com/jonchammer"><code>@​jonchammer</code></a> for
the contribution (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2083">#2083</a>)</li>
<li>Migrate tests to ntf (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2082">#2082</a>)</li>
<li>Add docs.nats.io examples to main (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2106">#2106</a>)</li>
<li>Improve readme wording for JetStream consumers. Thanks <a
href="https://github.com/trevorah"><code>@​trevorah</code></a> for the
contribution (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2104">#2104</a>)</li>
</ul>
<h3>Complete Changes</h3>
<p><a
href="https://github.com/nats-io/nats.go/compare/v1.52.0...v1.53.0">https://github.com/nats-io/nats.go/compare/v1.52.0...v1.53.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/nats-io/nats.go/commit/db1375fcffae2eb0b4ced1b7bad4d47c4447e4ac"><code>db1375f</code></a>
Release v1.53.1 (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2118">#2118</a>)</li>
<li><a
href="https://github.com/nats-io/nats.go/commit/ae0af2c70af65374f6dfc001be1fc4accf7ddb63"><code>ae0af2c</code></a>
[IMPROVED] Migrate tests to ntf (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2082">#2082</a>)</li>
<li><a
href="https://github.com/nats-io/nats.go/commit/0c5d8d7245c17a418cb850ac69a1aa52b17e19c5"><code>0c5d8d7</code></a>
[ADDED] <code>WithPublishAsyncAckHandler</code> option for JetStream
async publish (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2109">#2109</a>)</li>
<li><a
href="https://github.com/nats-io/nats.go/commit/15d96caf3a5947dcfde1c84b613dd77205e9e892"><code>15d96ca</code></a>
[FIXED] Data race in resetOrderedConsumer when resets overlap (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2111">#2111</a>)</li>
<li><a
href="https://github.com/nats-io/nats.go/commit/f66c8e7396168080b104c91ac6a4c6863bf72373"><code>f66c8e7</code></a>
[FIXED] Recognize error code 10164 for replicated KV CAS conflicts (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2097">#2097</a>)
(#...</li>
<li><a
href="https://github.com/nats-io/nats.go/commit/9d92e853d400b5dc8ec5334ef8967e226299923f"><code>9d92e85</code></a>
iter: don't yield a phantom (nil, nil) after MsgsTimeout's ErrTimeout
(<a
href="https://redirect.github.com/nats-io/nats.go/issues/2093">#2093</a>)</li>
<li><a
href="https://github.com/nats-io/nats.go/commit/c68c4de4fc2ce3834956a2487859d1eaf28a2942"><code>c68c4de</code></a>
[FIXED] micro: endpoint subject prefix over-match (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2105">#2105</a>)</li>
<li><a
href="https://github.com/nats-io/nats.go/commit/e663e6717e4f96add4738d3865dc142ae5c17a6b"><code>e663e67</code></a>
Improve example wording (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2104">#2104</a>)</li>
<li><a
href="https://github.com/nats-io/nats.go/commit/c1a0716149a402b9a0c3e7c7c234cbce5afd9650"><code>c1a0716</code></a>
Add docs.nats.io examples to main (<a
href="https://redirect.github.com/nats-io/nats.go/issues/2106">#2106</a>)</li>
<li><a
href="https://github.com/nats-io/nats.go/commit/77e280d0b1515dd8b47a28606ef2ca7c3a767d3d"><code>77e280d</code></a>
[FIXED] MsgsTimeout iterator yields spurious (nil, nil) after a timeout
(<a
href="https://redirect.github.com/nats-io/nats.go/issues/2099">#2099</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/nats-io/nats.go/compare/v1.52.0...v1.53.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/nats-io/nats.go&package-manager=go_modules&previous-version=1.52.0&new-version=1.53.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-17 07:18:18 +00:00
dependabot[bot] c2368f8ecf chore: bump @pierre/diffs from 1.3.3 to 1.3.5 in /site (#28198) 
Bumps @pierre/diffs from 1.3.3 to 1.3.5.


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@pierre/diffs&package-manager=npm_and_yarn&previous-version=1.3.3&new-version=1.3.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-17 07:16:27 +00:00
dependabot[bot] ad278c6e35 chore: bump axios from 1.18.1 to 1.19.0 in /site (#28197) 
Bumps [axios](https://github.com/axios/axios) from 1.18.1 to 1.19.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/axios/axios/releases">axios's
releases</a>.</em></p>
<blockquote>
<h2>v1.19.0 - July 22, 2026</h2>
<p>This release raises the form-data security floor, adds configuration
and type-system capabilities, and fixes NO_PROXY matching, interceptor
errors, progress reporting, and serialization edge cases.</p>
<h2>🔒 Security Fixes</h2>
<ul>
<li>Multipart Form Data: Raised the form-data dependency floor to
^4.0.6, preventing fresh installations from resolving versions affected
by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (<a
href="https://github.com/advisories/GHSA-hmw2-7cc7-3qxx">https://github.com/advisories/GHSA-hmw2-7cc7-3qxx</a>).
(<a
href="https://redirect.github.com/axios/axios/issues/11028">#11028</a>)</li>
</ul>
<h2>🚀 New Features</h2>
<ul>
<li>Configuration Extensibility: Preserved own-enumerable symbol-keyed
fields through mergeConfig and added a generic params type across public
TypeScript declarations, responses, errors,
adapters, and serializers. (<a
href="https://redirect.github.com/axios/axios/issues/11043">#11043</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11081">#11081</a>)</li>
<li>Header Parameter Parsing: Added the opt-in
AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP
parameter parsing while preserving legacy parsing behavior. (<a
href="https://redirect.github.com/axios/axios/issues/11051">#11051</a>)</li>
<li>HTTP Status Codes: Added the missing Cloudflare 520
WebServerReturnsAnUnknownError status and matching ESM/CJS declarations.
(<a
href="https://redirect.github.com/axios/axios/issues/11067">#11067</a>)</li>
</ul>
<h2>🐛 Bug Fixes</h2>
<ul>
<li>Form Data Conversion: Limited formDataToJSON path splitting to dot
and bracket notation, preserving literal punctuation in keys, and
removed browser-facing Buffer.from usage from toFormData to avoid
unnecessary polyfills. (<a
href="https://redirect.github.com/axios/axios/issues/11006">#11006</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11018">#11018</a>)</li>
<li>Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal
forms during NO_PROXY matching and honored * entries within comma- or
space-separated bypass lists. (<a
href="https://redirect.github.com/axios/axios/issues/11029">#11029</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11053">#11053</a>)</li>
<li>Cancellation: Propagated already-aborted input signals immediately
when composing abort signals. (<a
href="https://redirect.github.com/axios/axios/issues/11035">#11035</a>)</li>
<li>Header Handling: Preserved empty first values for duplicate
singleton headers and made AxiosHeaders#getSetCookie() consistently
return arrays for present values. (<a
href="https://redirect.github.com/axios/axios/issues/11036">#11036</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11037">#11037</a>)</li>
<li>URL Handling: Included normalized, safely redacted offending URLs in
malformed-protocol errors and removed repeated trailing slashes when
combining base URLs. (<a
href="https://redirect.github.com/axios/axios/issues/11024">#11024</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11038">#11038</a>)</li>
<li>Progress Events: Clamped malformed negative progress values to zero
and ensured final Node.js download progress events are delivered before
streamed responses close. (<a
href="https://redirect.github.com/axios/axios/issues/11039">#11039</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11040">#11040</a>)</li>
<li>Error and JSON Serialization: Serialized Set values as arrays in
JSON-compatible snapshots and synthesized useful AxiosError messages
from otherwise-empty AggregateError instances. (<a
href="https://redirect.github.com/axios/axios/issues/11044">#11044</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11059">#11059</a>)</li>
<li>Content-Length Enforcement: Corrected base64 data: URL size
estimation so maxContentLength is enforced consistently by the HTTP and
Fetch adapters. (<a
href="https://redirect.github.com/axios/axios/issues/11061">#11061</a>)</li>
<li>Synchronous Interceptors: Prevented requests from being dispatched
after synchronous request interceptors fail unless their paired
rejection handler resolves successfully. (<a
href="https://redirect.github.com/axios/axios/issues/11071">#11071</a>)</li>
</ul>
<h2>🔧 Maintenance &amp; Chores</h2>
<ul>
<li>Dependencies: Updated development and test tooling, the docs
fixture's Axios version, and GitHub Actions integrations including
Checkout, Setup Node, Setup Deno, and Zizmor. (<a
href="https://redirect.github.com/axios/axios/issues/11031">#11031</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11055">#11055</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11056">#11056</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11058">#11058</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11079">#11079</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11080">#11080</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11088">#11088</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11089">#11089</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11090">#11090</a>)</li>
<li>Build Outputs: Limited sourcemap generation to published minified
bundles, removing broken map references from non-minified builds. (<a
href="https://redirect.github.com/axios/axios/issues/11054">#11054</a>)</li>
<li>Form Data Internals: Centralized FormData header handling and made
the Node.js adapter tolerate getHeaders() returning undefined under the
content-only policy. (<a
href="https://redirect.github.com/axios/axios/issues/11062">#11062</a>)</li>
<li>Developer Experience: Ignored common local AI-tooling directories
and fixed a constant-reassignment crash when the development sandbox
serves its root path. (<a
href="https://redirect.github.com/axios/axios/issues/11032">#11032</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11073">#11073</a>)</li>
<li>Documentation: Updated sponsor information, clarified that baseURL
is not a path-security boundary, scoped provenance claims to attested
releases, and corrected the configuration-defaults documentation. (<a
href="https://redirect.github.com/axios/axios/issues/11041">#11041</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11068">#11068</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11076">#11076</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11078">#11078</a>)</li>
<li>Publishing: Simplified v1 publishing to use the npm version bundled
with Node.js 26 and updated package metadata for the 1.19.0 release. (<a
href="https://redirect.github.com/axios/axios/issues/11083">#11083</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11095">#11095</a>)</li>
</ul>
<h2>🌟 New Contributors</h2>
<p>We are thrilled to welcome our new contributors. Thank you for
helping improve Axios:</p>
<ul>
<li><a
href="https://github.com/afonsojramos"><code>@​afonsojramos</code></a>
(<a
href="https://redirect.github.com/axios/axios/issues/11028">#11028</a>)</li>
<li><a
href="https://github.com/MahinAnowar"><code>@​MahinAnowar</code></a> (<a
href="https://redirect.github.com/axios/axios/issues/11006">#11006</a>)</li>
<li><a
href="https://github.com/yassertawfik4"><code>@​yassertawfik4</code></a>
(<a
href="https://redirect.github.com/axios/axios/issues/11024">#11024</a>)</li>
<li><a
href="https://github.com/AnandSundar"><code>@​AnandSundar</code></a> (<a
href="https://redirect.github.com/axios/axios/issues/11029">#11029</a>)</li>
<li><a
href="https://github.com/lin-hongkuan"><code>@​lin-hongkuan</code></a>
(<a
href="https://redirect.github.com/axios/axios/issues/11035">#11035</a>)</li>
<li><a
href="https://github.com/Wali007-lab"><code>@​Wali007-lab</code></a> (<a
href="https://redirect.github.com/axios/axios/issues/11054">#11054</a>)</li>
<li><a href="https://github.com/magicdawn"><code>@​magicdawn</code></a>
(<a
href="https://redirect.github.com/axios/axios/issues/11043">#11043</a>)</li>
<li><a
href="https://github.com/andrewkernel"><code>@​andrewkernel</code></a>
(<a
href="https://redirect.github.com/axios/axios/issues/11053">#11053</a>)</li>
<li><a
href="https://github.com/Sagargupta16"><code>@​Sagargupta16</code></a>
(<a
href="https://redirect.github.com/axios/axios/issues/11059">#11059</a>)</li>
<li><a
href="https://github.com/Rpaudel379"><code>@​Rpaudel379</code></a> (<a
href="https://redirect.github.com/axios/axios/issues/11078">#11078</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/axios/axios/blob/v1.x/CHANGELOG.md">axios's
changelog</a>.</em></p>
<blockquote>
<h2>v1.19.0 — July 22, 2026</h2>
<p>This release raises the form-data security floor, adds configuration
and type-system capabilities, and fixes NO_PROXY matching, interceptor
errors, progress reporting, and serialization edge cases.</p>
<h2>🔒 Security Fixes</h2>
<ul>
<li>Multipart Form Data: Raised the form-data dependency floor to
^4.0.6, preventing fresh installations from resolving versions affected
by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (<a
href="https://github.com/advisories/GHSA-hmw2-7cc7-3qxx">https://github.com/advisories/GHSA-hmw2-7cc7-3qxx</a>).
(<a
href="https://redirect.github.com/axios/axios/issues/11028">#11028</a>)</li>
</ul>
<h2>🚀 New Features</h2>
<ul>
<li>Configuration Extensibility: Preserved own-enumerable symbol-keyed
fields through mergeConfig and added a generic params type across public
TypeScript declarations, responses, errors,
adapters, and serializers. (<a
href="https://redirect.github.com/axios/axios/issues/11043">#11043</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11081">#11081</a>)</li>
<li>Header Parameter Parsing: Added the opt-in
AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP
parameter parsing while preserving legacy parsing behavior. (<a
href="https://redirect.github.com/axios/axios/issues/11051">#11051</a>)</li>
<li>HTTP Status Codes: Added the missing Cloudflare 520
WebServerReturnsAnUnknownError status and matching ESM/CJS declarations.
(<a
href="https://redirect.github.com/axios/axios/issues/11067">#11067</a>)</li>
</ul>
<h2>🐛 Bug Fixes</h2>
<ul>
<li>
<p>Form Data Conversion: Limited formDataToJSON path splitting to dot
and bracket notation, preserving literal punctuation in keys, and
removed browser-facing Buffer.from usage from toFormData to avoid
unnecessary polyfills. (<a
href="https://redirect.github.com/axios/axios/issues/11006">#11006</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11018">#11018</a>)</p>
</li>
<li>
<p>Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal
forms during NO_PROXY matching and honored * entries within comma- or
space-separated bypass lists. (<a
href="https://redirect.github.com/axios/axios/issues/11029">#11029</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11053">#11053</a>)</p>
</li>
<li>
<p>Cancellation: Propagated already-aborted input signals immediately
when composing abort signals. (<a
href="https://redirect.github.com/axios/axios/issues/11035">#11035</a>)</p>
</li>
<li>
<p>Header Handling: Preserved empty first values for duplicate singleton
headers and made AxiosHeaders#getSetCookie() consistently return arrays
for present values. (<a
href="https://redirect.github.com/axios/axios/issues/11036">#11036</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11037">#11037</a>)</p>
</li>
<li>
<p>URL Handling: Included normalized, safely redacted offending URLs in
malformed-protocol errors and removed repeated trailing slashes when
combining base URLs. (<a
href="https://redirect.github.com/axios/axios/issues/11008">#11008</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11038">#11038</a>)</p>
</li>
<li>
<p>Progress Events: Clamped malformed negative progress values to zero
and ensured final Node.js download progress events are delivered before
streamed responses close. (<a
href="https://redirect.github.com/axios/axios/issues/11039">#11039</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11040">#11040</a>)</p>
</li>
<li>
<p>Error and JSON Serialization: Serialized Set values as arrays in
JSON-compatible snapshots and synthesized useful AxiosError messages
from otherwise-empty AggregateError instances. (<a
href="https://redirect.github.com/axios/axios/issues/11044">#11044</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11059">#11059</a>)</p>
</li>
<li>
<p>Content-Length Enforcement: Corrected base64 data: URL size
estimation so maxContentLength is enforced consistently by the HTTP and
Fetch adapters. (<a
href="https://redirect.github.com/axios/axios/issues/11061">#11061</a>)</p>
</li>
<li>
<p>Synchronous Interceptors: Prevented requests from being dispatched
after synchronous request interceptors fail unless their paired
rejection handler resolves successfully. (<a
href="https://redirect.github.com/axios/axios/issues/11071">#11071</a>)</p>
</li>
</ul>
<h2>🔧 Maintenance &amp; Chores</h2>
<ul>
<li>Dependencies: Updated development and test tooling, the docs
fixture's Axios version, and GitHub Actions integrations including
Checkout, Setup Node, Setup Deno, and Zizmor. (<a
href="https://redirect.github.com/axios/axios/issues/11031">#11031</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11055">#11055</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11056">#11056</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11058">#11058</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11079">#11079</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11080">#11080</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11088">#11088</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11089">#11089</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11090">#11090</a>)</li>
<li>Build Outputs: Limited sourcemap generation to published minified
bundles, removing broken map references from non-minified builds. (<a
href="https://redirect.github.com/axios/axios/issues/11054">#11054</a>)</li>
<li>Form Data Internals: Centralized FormData header handling and made
the Node.js adapter tolerate getHeaders() returning undefined under the
content-only policy. (<a
href="https://redirect.github.com/axios/axios/issues/11062">#11062</a>)</li>
<li>Developer Experience: Ignored common local AI-tooling directories
and fixed a constant-reassignment crash when the development sandbox
serves its root path. (<a
href="https://redirect.github.com/axios/axios/issues/11032">#11032</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11073">#11073</a>)</li>
<li>Documentation: Updated sponsor information, clarified that baseURL
is not a path-security boundary, scoped provenance claims to attested
releases, and corrected the configuration-defaults documentation. (<a
href="https://redirect.github.com/axios/axios/issues/11041">#11041</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11068">#11068</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11076">#11076</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11078">#11078</a>)</li>
<li>Publishing: Simplified v1 publishing to use the npm version bundled
with Node.js 26 and updated package metadata for the 1.19.0 release. (<a
href="https://redirect.github.com/axios/axios/issues/11083">#11083</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11095">#11095</a>)</li>
</ul>
<h2>🌟 New Contributors</h2>
<p>We are thrilled to welcome our new contributors. Thank you for
helping improve Axios:</p>
<ul>
<li><a
href="https://github.com/afonsojramos"><code>@​afonsojramos</code></a>
(<a
href="https://redirect.github.com/axios/axios/issues/11028">#11028</a>)</li>
<li><a
href="https://github.com/MahinAnowar"><code>@​MahinAnowar</code></a> (<a
href="https://redirect.github.com/axios/axios/issues/11006">#11006</a>)</li>
<li><a
href="https://github.com/yassertawfik4"><code>@​yassertawfik4</code></a>
(<a
href="https://redirect.github.com/axios/axios/issues/11024">#11024</a>)</li>
<li><a
href="https://github.com/AnandSundar"><code>@​AnandSundar</code></a> (<a
href="https://redirect.github.com/axios/axios/issues/11029">#11029</a>)</li>
<li><a
href="https://github.com/lin-hongkuan"><code>@​lin-hongkuan</code></a>
(<a
href="https://redirect.github.com/axios/axios/issues/11035">#11035</a>)</li>
<li><a
href="https://github.com/Wali007-lab"><code>@​Wali007-lab</code></a> (<a
href="https://redirect.github.com/axios/axios/issues/11054">#11054</a>)</li>
<li><a href="https://github.com/magicdawn"><code>@​magicdawn</code></a>
(<a
href="https://redirect.github.com/axios/axios/issues/11043">#11043</a>)</li>
<li><a
href="https://github.com/andrewkernel"><code>@​andrewkernel</code></a>
(<a
href="https://redirect.github.com/axios/axios/issues/11053">#11053</a>)</li>
<li><a
href="https://github.com/Sagargupta16"><code>@​Sagargupta16</code></a>
(<a
href="https://redirect.github.com/axios/axios/issues/11059">#11059</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/axios/axios/commit/311fcc5c8d989b7248f05d390bb83bfbfb009977"><code>311fcc5</code></a>
chore(release): prepare release 1.19.0 (<a
href="https://redirect.github.com/axios/axios/issues/11095">#11095</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/cb4fd743abd1c595761c8eda25d1323fc62a3b93"><code>cb4fd74</code></a>
chore(deps): bump axios from 1.16.1 to 1.18.1 in /docs (<a
href="https://redirect.github.com/axios/axios/issues/11088">#11088</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/004c93a9d2acd0561c498eff7bb4431c6bad78af"><code>004c93a</code></a>
chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 in the
github-action...</li>
<li><a
href="https://github.com/axios/axios/commit/122edde91b1183572f4ba399b5b6bc4e3b989718"><code>122edde</code></a>
chore(deps-dev): bump the development_dependencies group with 3 updates
(<a
href="https://redirect.github.com/axios/axios/issues/11089">#11089</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/c44f8d0a910df99486da9175584b99f56a94a73b"><code>c44f8d0</code></a>
ci: use bundled npm for v1 publish (<a
href="https://redirect.github.com/axios/axios/issues/11083">#11083</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/878bb29de570765b0d4c0970e30400d9ea9399f7"><code>878bb29</code></a>
fix(sandbox): resolve TypeError on constant variable path assignment (<a
href="https://redirect.github.com/axios/axios/issues/11073">#11073</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/a092bae50d1884782151b2fcea12974d6da6e376"><code>a092bae</code></a>
fix(core): synchronous interceptors swallow errors and proceed with
request (...</li>
<li><a
href="https://github.com/axios/axios/commit/3041b8fd1daf17404d1bad1f9d94026ea5ab400b"><code>3041b8f</code></a>
feat(HttpStatusCode): add missing 520 status code (<a
href="https://redirect.github.com/axios/axios/issues/11067">#11067</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/58b16c88f0bddf1fadb321aed58ba3f49a90481b"><code>58b16c8</code></a>
refactor(helpers): extract duplicated setFormDataHeaders into a shared
helper...</li>
<li><a
href="https://github.com/axios/axios/commit/3077e62097726d22ba30f1cb847d7a07050e339a"><code>3077e62</code></a>
feat(types): Allow the Params property to be typed, instead of
<code>any</code> (<a
href="https://redirect.github.com/axios/axios/issues/11081">#11081</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/axios/axios/compare/v1.18.1...v1.19.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=axios&package-manager=npm_and_yarn&previous-version=1.18.1&new-version=1.19.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-17 07:16:03 +00:00
dependabot[bot] cdaf7d4bd7 chore: bump @testing-library/user-event from 14.6.1 to 14.6.3 in /site (#28196) 
Bumps
[@testing-library/user-event](https://github.com/testing-library/user-event)
from 14.6.1 to 14.6.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/testing-library/user-event/releases">@​testing-library/user-event's
releases</a>.</em></p>
<blockquote>
<h2>v14.6.3</h2>
<h2><a
href="https://github.com/testing-library/user-event/compare/v14.6.2...v14.6.3">14.6.3</a>
(2026-08-03)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>release:</strong> manually release a patch version (<a
href="https://redirect.github.com/testing-library/user-event/issues/1321">#1321</a>)
(<a
href="https://github.com/testing-library/user-event/commit/1d18b1fae589eeed8e08838672a4c2de0dcc2b36">1d18b1f</a>),
closes <a
href="https://redirect.github.com/testing-library/user-event/issues/1317">#1317</a></li>
</ul>
<h2>v14.6.2</h2>
<h2><a
href="https://github.com/testing-library/user-event/compare/v14.6.1...v14.6.2">14.6.2</a>
(2026-08-03)</h2>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/testing-library/user-event/commit/1d18b1fae589eeed8e08838672a4c2de0dcc2b36"><code>1d18b1f</code></a>
fix(release): manually release a patch version (<a
href="https://redirect.github.com/testing-library/user-event/issues/1321">#1321</a>)</li>
<li><a
href="https://github.com/testing-library/user-event/commit/232f3e6f4f92459c02161d156a70bddd13a59eaa"><code>232f3e6</code></a>
docs: add migration note and clean up README badges (<a
href="https://redirect.github.com/testing-library/user-event/issues/1320">#1320</a>)</li>
<li><a
href="https://github.com/testing-library/user-event/commit/83e2b2261b40f5f08296eaf5af3d42018e6681ed"><code>83e2b22</code></a>
ci: remove deprecated CodeSandbox CI (<a
href="https://redirect.github.com/testing-library/user-event/issues/1318">#1318</a>)</li>
<li><a
href="https://github.com/testing-library/user-event/commit/e8da81953bd9b48512a1e4ce9b73cc36aeaeee37"><code>e8da819</code></a>
ci: publish to npm via OIDC trusted publishing (<a
href="https://redirect.github.com/testing-library/user-event/issues/1317">#1317</a>)</li>
<li><a
href="https://github.com/testing-library/user-event/commit/13fa4bc1f0dedeb866a8730fa357229832437418"><code>13fa4bc</code></a>
ci: stop lint errors from blocking release (<a
href="https://redirect.github.com/testing-library/user-event/issues/1316">#1316</a>)</li>
<li><a
href="https://github.com/testing-library/user-event/commit/c3cec1832f180b6d1dcb7c5d2b0771339dd5e848"><code>c3cec18</code></a>
chore(ci): make releases work with full git history (<a
href="https://redirect.github.com/testing-library/user-event/issues/1315">#1315</a>)</li>
<li><a
href="https://github.com/testing-library/user-event/commit/ebab6c6e81e7022af7afa5aacd07d01626895eb8"><code>ebab6c6</code></a>
add Liadshiran as a contributor for doc (<a
href="https://redirect.github.com/testing-library/user-event/issues/1300">#1300</a>)</li>
<li><a
href="https://github.com/testing-library/user-event/commit/ec470bfd55ab7a741ce2a5b71e98c0f5686ac915"><code>ec470bf</code></a>
docs: fix wrong default enum value (<a
href="https://redirect.github.com/testing-library/user-event/issues/1298">#1298</a>)</li>
<li><a
href="https://github.com/testing-library/user-event/commit/ba79c2f9a58d5927725fee506210d279fde218b5"><code>ba79c2f</code></a>
chore: upgrade node version in csb (<a
href="https://redirect.github.com/testing-library/user-event/issues/1299">#1299</a>)</li>
<li><a
href="https://github.com/testing-library/user-event/commit/63ac399e06bd8f2397a6c581915acd29235f2d38"><code>63ac399</code></a>
fix: allow reassignment of <code>HTMLElement.prototype.focus</code> and
<code>.blur</code> (<a
href="https://redirect.github.com/testing-library/user-event/issues/1265">#1265</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/testing-library/user-event/compare/v14.6.1...v14.6.3">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for <code>@​testing-library/user-event</code> since your
current version.</p>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@testing-library/user-event&package-manager=npm_and_yarn&previous-version=14.6.1&new-version=14.6.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-17 07:15:43 +00:00
dependabot[bot] 2e79169bdb chore: bump vite from 8.2.0 to 8.2.1 in /site in the vite group across 1 directory (#28191) 
Bumps the vite group with 1 update in the /site directory:
[vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).

Updates `vite` from 8.2.0 to 8.2.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/releases">vite's
releases</a>.</em></p>
<blockquote>
<h2>plugin-legacy@8.2.1</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/plugin-legacy@8.2.1/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.2.1</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.2.1/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md">vite's
changelog</a>.</em></p>
<blockquote>
<h2><!-- raw HTML omitted --><a
href="https://github.com/vitejs/vite/compare/v8.2.0...v8.2.1">8.2.1</a>
(2026-08-06)<!-- raw HTML omitted --></h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>build:</strong> make client chunkImportMap work with
<code>sharedPlugins: true</code> (<a
href="https://redirect.github.com/vitejs/vite/issues/23184">#23184</a>)
(<a
href="https://github.com/vitejs/vite/commit/15f03073c915d6ffb9a1fda447ef66b02bf5cde8">15f0307</a>)</li>
<li><strong>bundled-dev:</strong> inject client script tag before chunk
scripts (<a
href="https://redirect.github.com/vitejs/vite/issues/23161">#23161</a>)
(<a
href="https://github.com/vitejs/vite/commit/eac0cc84aa2472a85a19ee84561c1ba71e381a55">eac0cc8</a>)</li>
<li><strong>css:</strong> don't re-run lightningcss visitor during
minify (fix <a
href="https://redirect.github.com/vitejs/vite/issues/23146">#23146</a>)
(<a
href="https://redirect.github.com/vitejs/vite/issues/23147">#23147</a>)
(<a
href="https://github.com/vitejs/vite/commit/de041a79b05a0be965c874592fe2c1505bcd48df">de041a7</a>)</li>
<li><strong>deps:</strong> update all non-major dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/23136">#23136</a>)
(<a
href="https://github.com/vitejs/vite/commit/14454fd8c9a399bc3fdc193e28465b6fcf001e4d">14454fd</a>)</li>
<li><strong>deps:</strong> update rolldown-related dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/23070">#23070</a>)
(<a
href="https://github.com/vitejs/vite/commit/7ac6f7f590747bbdab9958e2c016e3dd04f10542">7ac6f7f</a>)</li>
<li>don't mutate the user config when resolving the lib entry from the
top-level <code>input</code> (<a
href="https://redirect.github.com/vitejs/vite/issues/23135">#23135</a>)
(<a
href="https://github.com/vitejs/vite/commit/b4bf59686a7ac238929e91a6e1708c739b843a2f">b4bf596</a>)</li>
<li>handle shebang ending with uncommon line terminators (<a
href="https://redirect.github.com/vitejs/vite/issues/23038">#23038</a>)
(<a
href="https://github.com/vitejs/vite/commit/17f7b2f193a110d0b47742ad296d182cb4666ce7">17f7b2f</a>)</li>
<li><strong>server:</strong> use a random port when port is 0 (<a
href="https://redirect.github.com/vitejs/vite/issues/23158">#23158</a>)
(<a
href="https://github.com/vitejs/vite/commit/fddf4ea41de5f7889037a2f957438857ac12a260">fddf4ea</a>)</li>
</ul>
<h3>Performance Improvements</h3>
<ul>
<li><strong>css:</strong> look up pure CSS chunks through a Set (<a
href="https://redirect.github.com/vitejs/vite/issues/23114">#23114</a>)
(<a
href="https://github.com/vitejs/vite/commit/1331b0b438b1e7193effb7d2341660bccb9c3155">1331b0b</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li><strong>build:</strong> fix incomplete <code>@default</code> for
build.minify (<a
href="https://redirect.github.com/vitejs/vite/issues/23177">#23177</a>)
(<a
href="https://github.com/vitejs/vite/commit/ef02435114c57d0422028f0e6987f3df8db72969">ef02435</a>)</li>
</ul>
<h3>Miscellaneous Chores</h3>
<ul>
<li><strong>deps:</strong> update dependency rolldown-plugin-dts to
^0.28.0 (<a
href="https://redirect.github.com/vitejs/vite/issues/23137">#23137</a>)
(<a
href="https://github.com/vitejs/vite/commit/4adc1e7931d4beceb4e236d9a271d057c858a06f">4adc1e7</a>)</li>
<li><strong>deps:</strong> update dependency strip-literal to v4 (<a
href="https://redirect.github.com/vitejs/vite/issues/23140">#23140</a>)
(<a
href="https://github.com/vitejs/vite/commit/9db65ce63488ea8f08a3c98dcdc4282b17bd33ff">9db65ce</a>)</li>
</ul>
<h3>Code Refactoring</h3>
<ul>
<li><strong>bundled-dev:</strong> avoid injecting server values in the
bundle (<a
href="https://redirect.github.com/vitejs/vite/issues/22967">#22967</a>)
(<a
href="https://github.com/vitejs/vite/commit/23b8a088dec9dcc3f1c1353f2074f8644b3cc21f">23b8a08</a>)</li>
<li><strong>bundled-dev:</strong> remove rolldown lazy stub module
workaround (<a
href="https://redirect.github.com/vitejs/vite/issues/23129">#23129</a>)
(<a
href="https://github.com/vitejs/vite/commit/e72036eed2e28936ed824971b18aeaa3900857f6">e72036e</a>)</li>
</ul>
<h3>Tests</h3>
<ul>
<li><strong>bundled-dev:</strong> enable sourcemap playgrounds (<a
href="https://redirect.github.com/vitejs/vite/issues/23080">#23080</a>)
(<a
href="https://github.com/vitejs/vite/commit/c2155fe4d5c8d25fba3a7366d367e3296ae669fa">c2155fe</a>)</li>
<li>reduce logs (<a
href="https://redirect.github.com/vitejs/vite/issues/23138">#23138</a>)
(<a
href="https://github.com/vitejs/vite/commit/7673c02e53343ae9356c1f496c1c1da2eb732ac1">7673c02</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vitejs/vite/commit/421615865dad3ed39137d17281814fc78a41246c"><code>4216158</code></a>
release: v8.2.1</li>
<li><a
href="https://github.com/vitejs/vite/commit/fddf4ea41de5f7889037a2f957438857ac12a260"><code>fddf4ea</code></a>
fix(server): use a random port when port is 0 (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23158">#23158</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/de041a79b05a0be965c874592fe2c1505bcd48df"><code>de041a7</code></a>
fix(css): don't re-run lightningcss visitor during minify (fix <a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23146">#23146</a>)
(<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23147">#23147</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/15f03073c915d6ffb9a1fda447ef66b02bf5cde8"><code>15f0307</code></a>
fix(build): make client chunkImportMap work with <code>sharedPlugins:
true</code> (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23184">#23184</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/c2155fe4d5c8d25fba3a7366d367e3296ae669fa"><code>c2155fe</code></a>
test(bundled-dev): enable sourcemap playgrounds (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23080">#23080</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/ef02435114c57d0422028f0e6987f3df8db72969"><code>ef02435</code></a>
docs(build): fix incomplete <code>@default</code> for build.minify (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23177">#23177</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/eac0cc84aa2472a85a19ee84561c1ba71e381a55"><code>eac0cc8</code></a>
fix(bundled-dev): inject client script tag before chunk scripts (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23161">#23161</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/23b8a088dec9dcc3f1c1353f2074f8644b3cc21f"><code>23b8a08</code></a>
refactor(bundled-dev): avoid injecting server values in the bundle (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22967">#22967</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/e72036eed2e28936ed824971b18aeaa3900857f6"><code>e72036e</code></a>
refactor(bundled-dev): remove rolldown lazy stub module workaround (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23129">#23129</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/14454fd8c9a399bc3fdc193e28465b6fcf001e4d"><code>14454fd</code></a>
fix(deps): update all non-major dependencies (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23136">#23136</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vitejs/vite/commits/v8.2.1/packages/vite">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=vite&package-manager=npm_and_yarn&previous-version=8.2.0&new-version=8.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-17 07:14:46 +00:00
dependabot[bot] 69081e2bfa chore: bump next from 15.5.22 to 15.5.23 in /offlinedocs (#28193) 
Bumps [next](https://github.com/vercel/next.js) from 15.5.22 to 15.5.23.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/next.js/releases">next's
releases</a>.</em></p>
<blockquote>
<h2>v15.5.23</h2>
<h2>What's Changed</h2>
<ul>
<li>[15.x] Port ReplyServer traversal guards to FlightClient <a
href="https://github.com/eps1lon"><code>@​eps1lon</code></a> in <a
href="https://redirect.github.com/vercel/next.js/pull/96405">vercel/next.js#96405</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/vercel/next.js/compare/v15.5.22...v15.5.23">https://github.com/vercel/next.js/compare/v15.5.22...v15.5.23</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/next.js/commit/c91fd53e712bad0eb19ab6ee21d0e228bd40eeec"><code>c91fd53</code></a>
v15.5.23</li>
<li><a
href="https://github.com/vercel/next.js/commit/0cb320866d359508c9af3700a5d889d823aed8c6"><code>0cb3208</code></a>
[15.x] Port ReplyServer traversal guards to FlightClient (<a
href="https://redirect.github.com/vercel/next.js/issues/96405">#96405</a>)</li>
<li>See full diff in <a
href="https://github.com/vercel/next.js/compare/v15.5.22...v15.5.23">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=next&package-manager=npm_and_yarn&previous-version=15.5.22&new-version=15.5.23)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-17 07:11:42 +00:00
Jake Howell ea8ba0c678 refactor: remove MUI and Emotion (#27821) 
> 🤖 This PR was modified by Coder Agents on behalf of Jake Howell.

Until we meet again.

## Stack

- #27636
- #27718 
- #27719 
- #27722
- #27723
- #27724
- #27728
- #27730
- #27732
- #27762
- #27763
- #27786
- #27787
- #27788
- #27789
- #27790
- #27791 
- #27817 
- #27820
- #28009

## Final removal (`c39b664`)

Removes the last of MUI and Emotion now that every surface has been
migrated:

- **Dependencies**: drops `@mui/material` and
`@emotion/{cache,css,react,styled}` from `package.json` /
`pnpm-lock.yaml`, and deletes the `@types/emotion.d.ts` and
`@types/mui.d.ts` module augmentations.
- **Theming**: replaces the Emotion `CacheProvider`, MUI `ThemeProvider`
/ `StyledEngineProvider`, and `CssBaseline` in `ThemeProvider` with a
lightweight `theme/context.tsx` that exposes `ThemeContextProvider` and
a `useTheme` hook.
- **Global styles**: moves the base `body` styles (background, text
color, font, antialiasing) that `CssBaseline` previously provided into
`index.css`, and drops the temporary MUI modal/popover scrollbar-gutter
workaround.
- **Cleanup**: removes the MUI → shadcn / Emotion → Tailwind migration
guidance from `site/AGENTS.md`, updates the Storybook `preview.tsx`, and
adjusts assorted components (`Command`, `Slider`, `Switch`, `Tabs`,
`SyntaxHighlighter`, timing charts) and theme files to consume the new
context instead of MUI/Emotion.
 2026-08-17 14:04:48 +07:00
Michael Suchacz 521c383f6b fix: repair stale chat agent bindings after workspace rebuild (#28152) 
## Problem

When a chat is bound to a workspace, chatd persists `chats.agent_id`
pointing at a specific workspace agent, and it only rebinds on the next
chat turn. A workspace stop/start creates a new agent with a new ID in
the latest build, so the chat page resolves the stale agent ID to
`undefined` and the right sidebar silently drops Terminal, Desktop,
Browser, apps, and ports even though the workspace is running. The
existing read-time enrichment only filled nil agent IDs and skipped
stale non-nil ones, so refreshing did not help until the user sent
another message.

## Fix

- `coderd/exp_chats.go`: single-chat reads now repair agent IDs that no
longer resolve in the workspace's latest build, using the same
`agentselect.FindChatAgent` selection chatd uses. A repaired binding
also carries the latest build's ID so the response never pairs the new
agent with the previous build. Bindings that still resolve are
preserved, and repair stays best-effort and response-only (no
write-on-read). List reads keep the previous nil-fill-only behavior
because validating existing bindings would cost a per-workspace
authorization lookup per listed chat.
- `site/src/pages/AgentsPage/AgentChatPage.tsx`: the workspace watch
update handler detects when a running workspace's latest build no longer
contains the chat's bound agent and invalidates the chat query once per
chat/build/binding key for immediate recovery, and the chat query polls
every 30 seconds while the binding remains unresolved so a transiently
failed repair retries even when an idle workspace publishes no further
watch events. The watch stream replays the current workspace on every
(re)connect, so this covers rebuilds that happen while the page is open
or disconnected; page loads are covered by the server-side repair. The
workspace-watcher bailout now also keys on `latest_build.id` so a
rebuild propagates while the page is open.
- `site/src/api/queries/chats.ts`: chat watch events replay the
persisted (pre-repair) binding, so the summary merge adopts a snapshot's
`build_id` only when the snapshot agrees on `agent_id`, keeping the
repaired agent/build pair atomic in the caches.

## Testing

- `go test ./coderd -run TestEnrichChatAgentIDs` covering repair,
keep-valid, selection-error, list-mode-skips-bound, and no-workspaces
cases.
- Storybook interaction story `RecoversSidebarAfterWorkspaceRebuild`
exercising the watch-event to chat-refetch to sidebar-recovery flow
(verified red without the invalidation, green with it).
- `pnpm test AgentChatPage.test.ts` covering the binding-resolution
predicate.

> Mux created this PR on Mike's behalf.
 2026-08-16 20:30:32 +02:00
Wyatt FryandEthan Dickson a005e5cd22 feat: add username and email user search filters (#27922) 
## Summary

User search can now resolve exact `email:` and `username:` terms through
`GET /api/v2/users` instead of only supporting fuzzy free-text matches.
The database query already had exact email and username filters; this
wires the public search parser and API handler to those filters so
clients can ask for a single user by email without fetching every user
or depending on substring matching.

This is the API half of coder/terraform-provider-coderd#403: that
provider PR adds `data.coderd_user.email`, and this PR gives it an
efficient exact lookup path.

## Testing

- `go test ./coderd/searchquery -run '^TestSearchUsers$' -count=1`
- `go test ./coderd -run '^TestGetUsersFilter$' -count=1`
- Live API test:
  - Built local enterprise Coder from this branch.
- Started Coder on `http://127.0.0.1:39991` against a clean Postgres
database.
  - Created `lookup-target@example.com`.
- Verified `GET /api/v2/users?q=email:LOOKUP-TARGET@EXAMPLE.COM&limit=2`
returned exactly one user:

```json
{
  "count": 1,
  "users": [
    {
      "id": "efc6f909-ce0a-4731-bd2f-6e4df417aaa7",
      "username": "lookup-target",
      "email": "lookup-target@example.com"
    }
  ]
}
```

---

![flow.ai](https://img.shields.io/badge/Built_with-flow.ai-6366f1)
![Codex](https://img.shields.io/badge/GPT--5-000000)

---------

Co-authored-by: Ethan Dickson <ethanndickson@gmail.com>
 2026-08-16 18:18:02 +05:00
Jay af90d8e2be fix(agent/agentscripts): create missing log_path parent directory (#28166) 
Previously, a `coder_script` whose `log_path` pointed under a directory
that did not yet exist failed before the script ran, with no per-script
log output. `OpenFile(logPath, O_CREATE|O_RDWR, 0o600)` creates the log
file but not its parent directories, so the open returned `ENOENT`. The
failure only surfaced in the agent log (`startup script(s) failed` /
`shutdown script(s) failed`) and never reached the script's own UI logs,
which made it look like a silent failure.

This creates the resolved parent directory with
`MkdirAll(filepath.Dir(logPath), 0o700)` before opening the log file, so
the script runs and its log is written. `0o700` matches the existing
script data-dir and secret-file directory conventions in this package.
Resolution of `~`, environment variables, and paths relative to `LogDir`
is unchanged; only the parent directory is now created.

Fixes coder/coder#21986

<details><summary>Implementation notes and validation</summary>

**Change**

* `agent/agentscripts/agentscripts.go`: in `(*Runner).run`, after the
full `logPath` resolution and before `OpenFile`, create the parent
directory:

  ```go
  logDir := filepath.Dir(logPath)
  if err = r.Filesystem.MkdirAll(logDir, 0o700); err != nil {
return xerrors.Errorf("create script log file directory %q: %w", logDir,
err)
  }
  ```

**Regression test**

* `agent/agentscripts/agentscripts_test.go`:
`TestExecuteCreatesMissingLogDir` runs a script with a nested,
nonexistent `LogPath` and asserts the streamed output and that the log
file is created.
* The test uses `afero.NewOsFs()` on purpose: `afero.NewMemMapFs()`
auto-creates parent directories on `OpenFile`, so it cannot reproduce
the reported failure.
* Verified red without the fix (`open .../does/not/exist/install.log: no
such file or directory`) and green with it.

**Local validation**

* `gofmt` clean, `go vet`, `go build`, `golangci-lint run` on the
package, and `go test -race ./agent/agentscripts/` all pass.

**End-to-end**

* Validated on a dev instance with a template whose
`coder_script.log_path` targets a nested directory that does not exist.
The agent created the parents with mode `0700` and wrote the log file;
the workspace agent reported healthy.

**Prior attempts**

* [#22796](<https://github.com/coder/coder/issues/22796>) and
[#25545](<https://github.com/coder/coder/issues/25545>) proposed the
same directory-creation approach. Both were closed for non-technical
reasons (a low-effort AI PR and a stale community PR), not rejected on
the merits. This supersedes them, authored by the issue owner, using
`0o700` and adding a regression test.

</details>

---

*Raised on behalf of* @35C4n0r *by Coder Agents.*
 2026-08-14 18:09:21 +00:00
Nick Vigilante 58de9ab8f8 docs: correct broken CLI commands and flags from drift sweep (#28098) 
## Summary

Corrects broken CLI commands and flags surfaced by the DOCS-637
full-corpus runtime drift sweep. Each fix was verified against the
generated CLI reference (`docs/reference/cli/*`) and, where relevant,
`codersdk` source.

## Changes

| Page | Fix |
|------|-----|
| `docs/user-guides/workspace-access/index.md` | `coder port forward` →
`coder port-forward` (the space form is unrecognized; the command is
hyphenated). |
| `docs/ai-coder/github-to-tasks.md` | Remove `coder templates list
--org your-org-name` in two spots — `templates list` has no `--org` flag
(`unknown flag: --org`). |
| `docs/admin/infrastructure/scale-utility.md` | `--cleanup-timeout
15min` → `15m` — Go durations reject the `min` unit (`invalid duration:
unknown unit "min"`). |
| `docs/admin/integrations/dx-data-cloud.md` | `coder users list >
users.csv` emitted a whitespace table, not CSV. Emit JSON and convert to
real CSV with `jq`, mirroring the API tab on the same page and using the
same columns as the default table view
(`username,email,created_at,status`). |

## Notes / judgment calls

- **dx-data-cloud (CSV):** the page genuinely needs CSV (the DX CSM
imports a CSV, and the API tab already produces one via `jq ... @csv`).
`coder users list` only supports `--output table|json`, so the CLI tab
now produces real CSV via `jq` rather than switching the page to JSON.
- **scale-utility `:109` left as-is:** `--target-users 0:100` is
prefixed with "For dashboard traffic:", which correctly scopes it to the
`scaletest dashboard` subcommand, so it is not drift.
- **Excluded — sessions-tokens `--lifetime=720h`:** the sweep flagged
this because the throwaway SUT capped token lifetime at 168h, but
`--max-token-lifetime` defaults to `876600h` (~100 years), so the
example is valid on a default deployment. The `CODER_MAX_TOKEN_LIFETIME`
dependency is also already documented in the page's "Set max token
length" section. No change needed.

Linear: https://linear.app/codercom/issue/DOCS-641

> This PR was created with AI assistance (Coder Agents).
 2026-08-14 12:49:11 -04:00
Nick Vigilante b0e93b6e3b docs: correct nginx X-Forwarded-Proto and certbot instructions flavor (#28086) 
## What

Two fixes to the nginx reverse-proxy tutorial.

### `X-Forwarded-Proto` (line 137)
The config set:
```nginx
proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
```
`$http_x_forwarded_proto` is the value of a client-supplied request
header, which a client can spoof and which is usually empty for a direct
request. In an nginx TLS-terminating reverse proxy this should be
`$scheme`, which nginx sets from the actual connection (`https`). Using
the raw client header can break Coder's scheme detection and
secure-cookie handling.

### Certbot link flavor (line 57)
The Certbot instructions link used `?ws=apache` in an nginx guide;
changed to `?ws=nginx` so readers get nginx instructions.

Surfaced by the runtime drift sweep; verified against `main`.

Linear:
[DOCS-642](https://linear.app/codercom/issue/DOCS-642/docs-fix-reverse-proxy-nginx-x-forwarded-proto-dollarscheme-certbot)

> This PR was created with AI assistance (Coder Agents).
 2026-08-14 12:47:59 -04:00
Nick Vigilante 1d189cc204 docs: fix P2/P3 typos and syntax errors from drift sweep (#28101) 
## Summary

High-confidence textual subset of the DOCS-637 **P2/P3** drift batch (31
findings total). These 8 fixes are pure typo / grammar / syntax
corrections verified directly against the doc source, so they carry no
risk of misreconstructed command output.

## Changes (6 files)

| Page | Fix |
|------|-----|
| `docs/admin/templates/extending-templates/variables.md` | Remove
doubled word: "file in in the template directory" → "file in the
template directory". |
| `docs/admin/networking/port-forwarding.md` | Grammar: heading "From an
coder_app resource" → "From a coder_app resource". |
| `docs/user-guides/workspace-access/index.md` | Malformed heading
"Through with the CLI" → "Through the CLI". |
| `docs/about/contributing/modules.md` | Conventional-commit example
missing the required space: `feat(git-clone):add` → `feat(git-clone):
add`. |
| `docs/ai-coder/tasks-migration.md` | Add missing closing double-quotes
on Terraform `source`/`version` in two snippets that would fail
`terraform` parsing. |
| `docs/admin/users/idp-sync.md` | Role Sync section said "group sync
settings" (copy-paste from the Group Sync section); remove an invalid
trailing comma from a JSON output example. |

## Deferred (remaining ~23 P2/P3 items, not in this PR)

The rest of the batch is stale **command-output** samples (column/schema
changes, sample values) and items that need a content decision (e.g.
`--psk` now deprecated in favor of `--key`; `--address` deprecated; an
undocumented retention flag). Those need live-output reconstruction or a
call on direction, so they're left for follow-up work, consistent with
the issue's "handle after the P0/P1 fixes land" guidance. One catalog
row (`reverse-proxy-nginx.md:57`, certbot `ws=apache`) is already
handled by #28086 and is excluded here.

Linear: https://linear.app/codercom/issue/DOCS-646

> This PR was created with AI assistance (Coder Agents).
 2026-08-14 12:44:55 -04:00
Nick Vigilante 5b97d99a48 docs: fix Helm TLS/ingress value keys in admin/setup (#28087) 
## What

Fix the Helm values in the TLS setup step of
`docs/admin/setup/index.md`. The documented keys are silently ignored by
the chart, so TLS appears configured but isn't.

## Changes

- `coder.tls.secretName` (singular) → `coder.tls.secretNames` (a list).
The chart key is `secretNames`.
- `coder.ingress.secretName` / `coder.ingress.wildcardSecretName` →
nested under `coder.ingress.tls.secretName` /
`coder.ingress.tls.wildcardSecretName`, where the chart actually reads
them.
- Added `coder.ingress.tls.enable: true` so the ingress-termination
example actually enables TLS.

All keys verified against `helm/coder/values.yaml` on `main`
(`coder.tls.secretNames`,
`coder.ingress.tls.{enable,secretName,wildcardSecretName}`). Surfaced by
the runtime drift sweep. The example now parses to the correct chart
structure.

Linear:
[DOCS-643](https://linear.app/codercom/issue/DOCS-643/docs-fix-helm-tlsingress-value-keys-in-adminsetup-secretnames)

> This PR was created with AI assistance (Coder Agents).
 2026-08-14 12:43:46 -04:00
Nick Vigilante 3145cc8386 docs: fix prometheus metric name and slack webhook backtick (#28085) 
## What

Two small monitoring-doc fixes surfaced by the runtime drift sweep.

### `docs/admin/integrations/prometheus.md`
The native-histograms list showed
`coderd_template_coderd_template_workspace_build_duration_seconds`
(doubled `coderd_template_` prefix). The correct metric name, per the
metrics table earlier on the same page and the generated metrics, is
`coderd_template_workspace_build_duration_seconds`.

### `docs/admin/monitoring/notifications/slack.md`
The `CODER_NOTIFICATIONS_WEBHOOK_ENDPOINT` export ended with a stray
backtick:
```
export CODER_NOTIFICATIONS_WEBHOOK_ENDPOINT=http://localhost:6000/v1/webhook`
```
On paste, bash treats the trailing backtick as an unterminated command
substitution and errors. Removed it.

Both reproduced during the runtime drift sweep and verified against
`main`.

Linear:
[DOCS-647](https://linear.app/codercom/issue/DOCS-647/docs-fix-monitoring-examples-prometheus-metric-name-slack-webhook)

> This PR was created with AI assistance (Coder Agents).
 2026-08-14 12:42:39 -04:00
Nick Vigilante f3fd4c4a77 docs: remove invalid --yes flag from coder template version promote (#28084) 
## What

Remove the invalid `--yes` flag from the `coder template version
promote` command in the CI/CD publishing example.

## Why

`docs/tutorials/testing-templates.md` documents, in the GitHub Actions
"Promote template version" step:

```
coder template version promote --template=$TEMPLATE_NAME --template-version=... --yes
```

The `promote` subcommand has no `--yes`/confirmation flag, so the
command exits with `unknown flag: --yes` and breaks the documented CI
workflow. This is a golden-path (automation) breaker.

Verified against the generated reference
`docs/reference/cli/templates_versions_promote.md` (flags are only
`--template`, `--template-version`, `-O/--org`), and reproduced against
a live deployment during the runtime drift sweep. The command is
non-interactive, so no confirmation flag is needed.

## Change

Single line: drop ` --yes`.

Linear:
[DOCS-640](https://linear.app/codercom/issue/DOCS-640/docs-remove-invalid-yes-flag-from-coder-template-version-promote)

> This PR was created with AI assistance (Coder Agents).
 2026-08-14 09:41:43 -07:00