mirror of
https://github.com/coder/coder.git
synced 2026-09-21 20:51:01 +08:00
aa80fa355019daa71b407009507c3635b41ef863
15833
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Cian Johnston
|
aa80fa3550 | fix(coderd/externalauth): also retry on 503 (#28218) | ||
|
Susana Ferreira
|
95328f1ead |
fix: label unpriced token usage metric by provider name and type (#28210)
## Problem The `provider` label was inconsistent between AI Gateway metrics. Every metric emitted by the gateway labels `provider` with the provider instance name, for example `anthropic-eu`, while `coder_ai_gateway_cost_control_unpriced_token_usage_records_total` used the provider type, for example `anthropic`. The two could not be correlated on `provider`. The metric was also inconsistent with itself: the path where a provider fails to resolve labelled by instance name, and the path where a model has no price labelled by type. The type is still worth exposing, since prices are keyed on `(provider_type, model)` and that is what an operator needs to add a price. ## Changes - Label the metric with `provider` (the instance name, consistent with the other gateway metrics) and add `provider_type` (the configured type the price is keyed on). - Use `unknown` for `provider_type` when the provider does not resolve to a configured type. - Log the unresolved-provider case at `warn` instead of `info`. A missing price is an expected steady state, but a provider that cannot be resolved is not. - Update the metrics docs and the `metricsdocgen` fixture. Closes [AIGOV-574](https://linear.app/codercom/issue/AIGOV-574) > [!NOTE] > Initially generated by Claude Opus 5, modified and reviewed by @ssncferreira |
||
|
Jaayden Halko
|
20c376a575 |
fix: enforce uniqueness and hour alignment for agent runtime usage events (#27983)
The usage generator writes `hb_agent_runtime_v1` rows with `created_at` at the UTC hourly bucket start and exactly one row per bucket, but nothing in the schema enforced either invariant. A duplicate bucket row under a different id would be double-counted by any consumer summing `runtime_ms`, and a misaligned `created_at` would skew which usage period a bucket is attributed to. This replaces the non-unique partial index `idx_usage_events_agent_runtime` (from migration 000561) with a unique index of the same shape and adds an hour-alignment `CHECK` constraint. Both statements validate existing rows: every supported writer has always produced conforming data, so a pre-existing violator is anomalous and failing the migration loudly beats silently rewriting usage rows. `generateBucket` treats a unique violation on the bucket index as another replica having won the race, mirroring the existing `ON CONFLICT (id)` no-op for committed rows. The `coderd/notifications` sync commit and its revert cancel out (the drift they addressed was fixed on main by #27979); the PR's net diff is only the usage-event changes. Part 1 of a 3-PR stack splitting up #27796 (see there for review history). Stack: this PR → #27984 → #27985. |
||
|
dependabot[bot]
|
bf236bb340 |
ci: bump the github-actions group with 2 updates (#28202)
Bumps the github-actions group with 2 updates: [fluxcd/flux2/action](https://github.com/fluxcd/flux2) and [linear/linear-release-action](https://github.com/linear/linear-release-action). Updates `fluxcd/flux2/action` from 2.9.3 to 2.9.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/fluxcd/flux2/releases">fluxcd/flux2/action's releases</a>.</em></p> <blockquote> <h2>v2.9.4</h2> <h2>Highlights</h2> <p>Flux v2.9.4 is a patch release that ships various fixes to the Flux controllers, covering source-watcher tarball extraction and glob expansion limits, the refspecs accepted by <code>ImageUpdateAutomation</code>, the HTTP request limits of the notification-controller servers, and Helm repository index loading, OCI chart digest pinning, <code>Bucket</code> error handling and GCS static authentication in source-controller. On the CLI side, <code>flux migrate -f</code> now supports migrating repositories to Flux 2.9. Users are encouraged to upgrade for the best experience.</p> <p>Note that this release contains CRD schema changes for <code>ArtifactGenerator</code> and <code>ImageUpdateAutomation</code>; both CRDs must be updated along with the controllers.</p> <p>ℹ️ Please follow the <a href="https://github.com/fluxcd/flux2/discussions/5572">Upgrade Procedure for Flux v2.7+</a> for a smooth upgrade from Flux v2.6 to the latest version.</p> <p>Fixes:</p> <ul> <li>Confine tarball extraction and bound glob expansion (source-watcher)</li> <li>Disallow force-update and deletion via refspecs (image-automation-controller)</li> <li>Unify HTTP server request limits (notification-controller)</li> <li>Align Helm repository index loading with upstream Helm v4 (source-controller)</li> <li>Improve error handling in <code>Bucket</code> reconciliation (source-controller)</li> <li>Pin OCI chart verification by digest (source-controller)</li> <li>Limit GCS static authentication to service account keys (source-controller)</li> <li>Restrict the <code>allow-webhooks</code> network policy to the receiver port (flux CLI)</li> </ul> <p>Improvements:</p> <ul> <li>Add support for migrating repositories to 2.9 in <code>flux migrate -f</code> (flux CLI)</li> <li>Update fluxcd/pkg dependencies, which align the ECR host detection with upstream (source-controller, image-reflector-controller, flux CLI)</li> <li>Update Bitbucket Cloud receiver guidance (notification-controller)</li> </ul> <h2>Components changelog</h2> <ul> <li>source-controller <a href="https://github.com/fluxcd/source-controller/blob/v1.9.4/CHANGELOG.md">v1.9.4</a></li> <li>source-watcher <a href="https://github.com/fluxcd/source-watcher/blob/v2.2.3/CHANGELOG.md">v2.2.3</a></li> <li>notification-controller <a href="https://github.com/fluxcd/notification-controller/blob/v1.9.3/CHANGELOG.md">v1.9.3</a></li> <li>image-reflector-controller <a href="https://github.com/fluxcd/image-reflector-controller/blob/v1.2.4/CHANGELOG.md">v1.2.4</a></li> <li>image-automation-controller <a href="https://github.com/fluxcd/image-automation-controller/blob/v1.2.4/CHANGELOG.md">v1.2.4</a></li> </ul> <h2>CLI changelog</h2> <ul> <li>[release/v2.9.x] Add support for 2.9 in <code>migrate -f</code> by <a href="https://github.com/fluxcdbot"><code>@fluxcdbot</code></a> in <a href="https://redirect.github.com/fluxcd/flux2/pull/6021">fluxcd/flux2#6021</a></li> <li>Update fluxcd/pkg dependencies by <a href="https://github.com/fluxcdbot"><code>@fluxcdbot</code></a> in <a href="https://redirect.github.com/fluxcd/flux2/pull/6026">fluxcd/flux2#6026</a></li> <li>[release/v2.9.x] fix: restrict <code>allow-webhooks</code> netpol to receiver port by <a href="https://github.com/fluxcdbot"><code>@fluxcdbot</code></a> in <a href="https://redirect.github.com/fluxcd/flux2/pull/6029">fluxcd/flux2#6029</a></li> <li>Update toolkit components by <a href="https://github.com/fluxcdbot"><code>@fluxcdbot</code></a> in <a href="https://redirect.github.com/fluxcd/flux2/pull/6031">fluxcd/flux2#6031</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/fluxcd/flux2/compare/v2.9.3...v2.9.4">https://github.com/fluxcd/flux2/compare/v2.9.3...v2.9.4</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/fluxcd/flux2/commit/889be9d6cc8afa8ed639e1e1ba4ab678e3b38d8c"><code>889be9d</code></a> Merge pull request <a href="https://redirect.github.com/fluxcd/flux2/issues/6031">#6031</a> from fluxcd/update-components-release/v2.9.x</li> <li><a href="https://github.com/fluxcd/flux2/commit/38254293dabb1e982c08d9596e619b615bf48ac7"><code>3825429</code></a> Update toolkit components</li> <li><a href="https://github.com/fluxcd/flux2/commit/ffe365a4536bce3450f9b94358887a7c4bd693fe"><code>ffe365a</code></a> Merge pull request <a href="https://redirect.github.com/fluxcd/flux2/issues/6029">#6029</a> from fluxcd/backport-6028-to-release/v2.9.x</li> <li><a href="https://github.com/fluxcd/flux2/commit/8ac865ce1ea514b1d4b8b6c94b63d327897cc28b"><code>8ac865c</code></a> fix: restrict allow-webhooks netpol to receiver port</li> <li><a href="https://github.com/fluxcd/flux2/commit/c49a4868e014340e569c26d6b825e41a5ce4b4ec"><code>c49a486</code></a> Merge pull request <a href="https://redirect.github.com/fluxcd/flux2/issues/6026">#6026</a> from fluxcd/update-pkg-deps/release/v2.9.x</li> <li><a href="https://github.com/fluxcd/flux2/commit/4942d15825f1b4b7bc14c35035c309cb761775b7"><code>4942d15</code></a> Update fluxcd/pkg dependencies</li> <li><a href="https://github.com/fluxcd/flux2/commit/a2d0b2919a3796c56f4ab629095b991155143103"><code>a2d0b29</code></a> Merge pull request <a href="https://redirect.github.com/fluxcd/flux2/issues/6021">#6021</a> from fluxcd/backport-6020-to-release/v2.9.x</li> <li><a href="https://github.com/fluxcd/flux2/commit/f4ad9e5f4a7e509cb2a6c83bc0693181825c61da"><code>f4ad9e5</code></a> Add support for 2.9 in migrate -f</li> <li>See full diff in <a href="https://github.com/fluxcd/flux2/compare/16602fa989daa99762f1c6d1186ae2ad1c735815...889be9d6cc8afa8ed639e1e1ba4ab678e3b38d8c">compare view</a></li> </ul> </details> <br /> Updates `linear/linear-release-action` from 0.15.0 to 0.15.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/linear/linear-release-action/releases">linear/linear-release-action's releases</a>.</em></p> <blockquote> <h2>v0.15.1</h2> <h2>What's Changed</h2> <ul> <li>Expose the CLI --issue-pattern flag as an issue_pattern input by <a href="https://github.com/RomainCscn"><code>@RomainCscn</code></a> in <a href="https://redirect.github.com/linear/linear-release-action/pull/56">linear/linear-release-action#56</a></li> <li>Release v0.15.1 by <a href="https://github.com/RomainCscn"><code>@RomainCscn</code></a> in <a href="https://redirect.github.com/linear/linear-release-action/pull/57">linear/linear-release-action#57</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/linear/linear-release-action/compare/v0.15.0...v0.15.1">https://github.com/linear/linear-release-action/compare/v0.15.0...v0.15.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/linear/linear-release-action/commit/17b8c24f8ceb2b98cabaf1965ff83c55dd596fac"><code>17b8c24</code></a> Release v0.15.1 (<a href="https://redirect.github.com/linear/linear-release-action/issues/57">#57</a>)</li> <li><a href="https://github.com/linear/linear-release-action/commit/cb0977c25f7e16b4ea2e89d9f71841e3f887dea4"><code>cb0977c</code></a> Expose the CLI --issue-pattern flag as an issue_pattern input (<a href="https://redirect.github.com/linear/linear-release-action/issues/56">#56</a>)</li> <li>See full diff in <a href="https://github.com/linear/linear-release-action/compare/af56a9a388625921f3757a2f988e4d7aca958377...17b8c24f8ceb2b98cabaf1965ff83c55dd596fac">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
ce88ad131c |
chore: bump protobufjs from 7.6.1 to 7.6.5 in /site (#28201)
Bumps [protobufjs](https://github.com/protobufjs/protobuf.js) from 7.6.1 to 7.6.5. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/protobufjs/protobuf.js/releases">protobufjs's releases</a>.</em></p> <blockquote> <h2>protobufjs: v7.6.5</h2> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.6.4...protobufjs-v7.6.5">7.6.5</a> (2026-07-04)</h2> <h3>Bug Fixes</h3> <ul> <li>handle EOF during options parsing (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2352">#2352</a>) (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2356">#2356</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217">10fba6d</a>)</li> </ul> <h2>protobufjs: v7.6.4</h2> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.6.3...protobufjs-v7.6.4">7.6.4</a> (2026-06-12)</h2> <h3>Bug Fixes</h3> <ul> <li>Reconfigure and speed up CI (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2329">#2329</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/574f761c05b007dab6595ca1eaed86436579ba3f">574f761</a>)</li> <li>Remove inquire submodule (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2327">#2327</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/06ddd07064329032aae6db586e2d54938b591792">06ddd07</a>)</li> </ul> <h2>protobufjs: v7.6.3</h2> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.6.2...protobufjs-v7.6.3">7.6.3</a> (2026-06-09)</h2> <h3>Bug Fixes</h3> <ul> <li>Avoid name collisions in generated code (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2311">#2311</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/78a9576269a5b590c54686a8122e78e28135cd50">78a9576</a>)</li> <li>Preserve null conversion behavior for fieldless messages (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2312">#2312</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/df91652aa5cb1ee0204566252df85cbe752298a6">df91652</a>)</li> </ul> <h2>protobufjs: v7.6.2</h2> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.6.1...protobufjs-v7.6.2">7.6.2</a> (2026-05-30)</h2> <h3>Bug Fixes</h3> <ul> <li>Backport consistency and correctness fixes (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2294">#2294</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/a92f72e1cb731f06040a7917d3e041666d5f5601">a92f72e</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/protobufjs/protobuf.js/blob/protobufjs-v7.6.5/CHANGELOG.md">protobufjs's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.6.4...protobufjs-v7.6.5">7.6.5</a> (2026-07-04)</h2> <h3>Bug Fixes</h3> <ul> <li>handle EOF during options parsing (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2352">#2352</a>) (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2356">#2356</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217">10fba6d</a>)</li> </ul> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.6.3...protobufjs-v7.6.4">7.6.4</a> (2026-06-12)</h2> <h3>Bug Fixes</h3> <ul> <li>Reconfigure and speed up CI (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2329">#2329</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/574f761c05b007dab6595ca1eaed86436579ba3f">574f761</a>)</li> <li>Remove inquire submodule (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2327">#2327</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/06ddd07064329032aae6db586e2d54938b591792">06ddd07</a>)</li> </ul> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.6.2...protobufjs-v7.6.3">7.6.3</a> (2026-06-09)</h2> <h3>Bug Fixes</h3> <ul> <li>Avoid name collisions in generated code (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2311">#2311</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/78a9576269a5b590c54686a8122e78e28135cd50">78a9576</a>)</li> <li>Preserve null conversion behavior for fieldless messages (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2312">#2312</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/df91652aa5cb1ee0204566252df85cbe752298a6">df91652</a>)</li> </ul> <h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.6.1...protobufjs-v7.6.2">7.6.2</a> (2026-05-30)</h2> <h3>Bug Fixes</h3> <ul> <li>Backport consistency and correctness fixes (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2294">#2294</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/a92f72e1cb731f06040a7917d3e041666d5f5601">a92f72e</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/protobufjs/protobuf.js/commit/89048ba0bbf3ed78f77199102f0614dafc2b4860"><code>89048ba</code></a> chore: release protobufjs-v7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2357">#2357</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217"><code>10fba6d</code></a> fix: handle EOF during options parsing (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2352">#2352</a>) (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2356">#2356</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/f8f64efbfc5b52997beb7549e7ea722704320cb1"><code>f8f64ef</code></a> chore: release protobufjs-v7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2330">#2330</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/574f761c05b007dab6595ca1eaed86436579ba3f"><code>574f761</code></a> fix: Reconfigure and speed up CI (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2329">#2329</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/06ddd07064329032aae6db586e2d54938b591792"><code>06ddd07</code></a> fix: Remove inquire submodule (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2327">#2327</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/1d3796d7d29830c73eec792ccbe769be6aa020ac"><code>1d3796d</code></a> chore: release protobufjs-v7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2317">#2317</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/df91652aa5cb1ee0204566252df85cbe752298a6"><code>df91652</code></a> fix: Preserve null conversion behavior for fieldless messages (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2312">#2312</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/78a9576269a5b590c54686a8122e78e28135cd50"><code>78a9576</code></a> fix: Avoid name collisions in generated code (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2311">#2311</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/ec90ef9ccc30fffe6ea9ea37e45781071898229d"><code>ec90ef9</code></a> chore: release protobufjs-v7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2295">#2295</a>)</li> <li><a href="https://github.com/protobufjs/protobuf.js/commit/a92f72e1cb731f06040a7917d3e041666d5f5601"><code>a92f72e</code></a> fix: Backport consistency and correctness fixes (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2294">#2294</a>)</li> <li>See full diff in <a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.6.1...protobufjs-v7.6.5">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
6af0ad7952 |
chore: bump @fontsource-variable/geist-mono from 5.2.7 to 5.3.0 in /site (#28200)
Bumps [@fontsource-variable/geist-mono](https://github.com/fontsource/font-files/tree/HEAD/fonts/variable/geist-mono) from 5.2.7 to 5.3.0. <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/fontsource/font-files/commits/HEAD/fonts/variable/geist-mono">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
87cddd2d78 |
chore: bump google.golang.org/api from 0.292.0 to 0.293.0 (#28194)
Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.292.0 to 0.293.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's releases</a>.</em></p> <blockquote> <h2>v0.293.0</h2> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.292.0...v0.293.0">0.293.0</a> (2026-08-11)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3689">#3689</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/82ee53b794c25614818788285e4d6fca4cfaa1ec">82ee53b</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3691">#3691</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/07e3f98c6d7c44f348bbc05f64f432ec46f435ab">07e3f98</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3692">#3692</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/8ab25861a802d778288129a603846c65b844d8ec">8ab2586</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3693">#3693</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/3ca7257fbaff1a073464989df9a284e7088f2917">3ca7257</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3694">#3694</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/68555327f8bf789f35a7e0d0ebfe9fac16530a68">6855532</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3696">#3696</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/b7d7362fc13addec7389a279e6483db7e8f1159f">b7d7362</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3697">#3697</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/9f826b1a20348948d7ae728134651c3dcbccf5db">9f826b1</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.292.0...v0.293.0">0.293.0</a> (2026-08-11)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3689">#3689</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/82ee53b794c25614818788285e4d6fca4cfaa1ec">82ee53b</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3691">#3691</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/07e3f98c6d7c44f348bbc05f64f432ec46f435ab">07e3f98</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3692">#3692</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/8ab25861a802d778288129a603846c65b844d8ec">8ab2586</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3693">#3693</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/3ca7257fbaff1a073464989df9a284e7088f2917">3ca7257</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3694">#3694</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/68555327f8bf789f35a7e0d0ebfe9fac16530a68">6855532</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3696">#3696</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/b7d7362fc13addec7389a279e6483db7e8f1159f">b7d7362</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3697">#3697</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/9f826b1a20348948d7ae728134651c3dcbccf5db">9f826b1</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/googleapis/google-api-go-client/commit/5b1402ec5cbf03814dc5b35fdd8855f750adcf0a"><code>5b1402e</code></a> chore(main): release 0.293.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3690">#3690</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/9f826b1a20348948d7ae728134651c3dcbccf5db"><code>9f826b1</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3697">#3697</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/a35fb8e3337735910977da00fe1d55a83f5d884a"><code>a35fb8e</code></a> chore(all): update all (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3695">#3695</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/b7d7362fc13addec7389a279e6483db7e8f1159f"><code>b7d7362</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3696">#3696</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/68555327f8bf789f35a7e0d0ebfe9fac16530a68"><code>6855532</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3694">#3694</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/3ca7257fbaff1a073464989df9a284e7088f2917"><code>3ca7257</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3693">#3693</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/8ab25861a802d778288129a603846c65b844d8ec"><code>8ab2586</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3692">#3692</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/07e3f98c6d7c44f348bbc05f64f432ec46f435ab"><code>07e3f98</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3691">#3691</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/82ee53b794c25614818788285e4d6fca4cfaa1ec"><code>82ee53b</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3689">#3689</a>)</li> <li>See full diff in <a href="https://github.com/googleapis/google-api-go-client/compare/v0.292.0...v0.293.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
90ef0bc204 |
chore: bump the x group with 5 updates (#28190)
Bumps the x group with 5 updates: | Package | From | To | | --- | --- | --- | | [golang.org/x/crypto](https://github.com/golang/crypto) | `0.54.0` | `0.55.0` | | [golang.org/x/mod](https://github.com/golang/mod) | `0.38.0` | `0.40.0` | | [golang.org/x/net](https://github.com/golang/net) | `0.57.0` | `0.58.0` | | [golang.org/x/text](https://github.com/golang/text) | `0.40.0` | `0.41.0` | | [golang.org/x/tools](https://github.com/golang/tools) | `0.48.0` | `0.49.0` | Updates `golang.org/x/crypto` from 0.54.0 to 0.55.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/crypto/commit/f44d03d253a1503e51b059ca880867c51d878242"><code>f44d03d</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/crypto/commit/5ed494470b06afb7621b303b04e38366d5863942"><code>5ed4944</code></a> crypto/internal/poly1305: provide optimised assembly for riscv64</li> <li><a href="https://github.com/golang/crypto/commit/b07833c067ec08648541694dc11e02b5ab6b956a"><code>b07833c</code></a> ssh: return window credit for discarded extended data</li> <li><a href="https://github.com/golang/crypto/commit/d701c51f7e4e57f61c4947390514fe631e06202f"><code>d701c51</code></a> acme: fix nil pointer dereference in pebble test error reporting</li> <li><a href="https://github.com/golang/crypto/commit/999d053994c9f2ececb2e85ab0bec72283539e33"><code>999d053</code></a> ssh: fix parsing of GSSAPI payloads offering multiple mechanisms</li> <li><a href="https://github.com/golang/crypto/commit/90f76b8ffe1453c472892d338785687e9727bcc0"><code>90f76b8</code></a> ssh: reject certificate signature keys before recursing</li> <li><a href="https://github.com/golang/crypto/commit/b53964a1ca4763384f2ee3bf482b8ca67a9f9fa8"><code>b53964a</code></a> ssh: permit empty but non-nil HostKeyAlgorithms, KeyExchanges, Ciphers, MACs</li> <li><a href="https://github.com/golang/crypto/commit/626e40fc986f72b464ecb2063e02e7923bf3025d"><code>626e40f</code></a> ssh: drain stderr on forwarded TCP and Unix channels</li> <li><a href="https://github.com/golang/crypto/commit/31914c699bfcc4906a7f6a178e910388518ed6a3"><code>31914c6</code></a> x509roots/fallback: update bundle</li> <li><a href="https://github.com/golang/crypto/commit/f2135b814ca127b11d04d6d6f0e6569922bace0f"><code>f2135b8</code></a> all: clean up minor issues found by staticcheck</li> <li>Additional commits viewable in <a href="https://github.com/golang/crypto/compare/v0.54.0...v0.55.0">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/mod` from 0.38.0 to 0.40.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/mod/commit/d3398d06de5fa5c71083d3d1c26f2cda73508e0f"><code>d3398d0</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/mod/commit/57549bfb0d25b5ff7eb4763aa1f029d7e5383232"><code>57549bf</code></a> sumdb: ignore unrelated hashes in Lookup</li> <li><a href="https://github.com/golang/mod/commit/96f62ae6e9cb1b123de383fa2542812c9ba3b7db"><code>96f62ae</code></a> sumdb/tlog: fix TileHashReader authentication bypass</li> <li><a href="https://github.com/golang/mod/commit/13be9020bbbfae457b59b82c999f8c309cb21ffc"><code>13be902</code></a> go.mod: update golang.org/x dependencies</li> <li>See full diff in <a href="https://github.com/golang/mod/compare/v0.38.0...v0.40.0">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/net` from 0.57.0 to 0.58.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/net/commit/acc78e0d2b2c855c0c4fbdcfe5f42a9e3d0f9778"><code>acc78e0</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/net/commit/90d10f01d98d92403c7b2823ab62a977cd01c7c6"><code>90d10f0</code></a> internal/http3: delete invalid Content-Length if declared in server handler</li> <li><a href="https://github.com/golang/net/commit/08abf4d948c22eae54ea207977c8ee700412a442"><code>08abf4d</code></a> internal/http3: infer headers when Content-Encoding is set but is empty</li> <li><a href="https://github.com/golang/net/commit/8d10596d262406469433c798878f7a33b1a8d6c4"><code>8d10596</code></a> http2: avoid deadlocks in wrapped ClientConn state callback</li> <li><a href="https://github.com/golang/net/commit/99c3b0a8f463fdf9bfde3b2cb50599ee53891eb0"><code>99c3b0a</code></a> http2/hpack: build the table lookup maps lazily, only for encoders</li> <li><a href="https://github.com/golang/net/commit/5a920b1a80900b1da0d73d18b73c193f7b52b901"><code>5a920b1</code></a> http3: rework registration to allow using a fake network</li> <li><a href="https://github.com/golang/net/commit/7fd284277aab94a6bd16c6a50b7604958f7a18a1"><code>7fd2842</code></a> quic: return an error from Accept after PacketConn reader exits</li> <li><a href="https://github.com/golang/net/commit/825111d7f2d2ccf50aa8eb63f62da04e2e3c5dc6"><code>825111d</code></a> quic: avoid busy-loop when keep-alive is blocked by congestion control</li> <li><a href="https://github.com/golang/net/commit/a02ddfa7eacb4cf63a5bea6b23761244a6df69f6"><code>a02ddfa</code></a> http/httpproxy: prioritize lowercase proxy environment variables</li> <li><a href="https://github.com/golang/net/commit/574e5eb9d32de67fb16096316d40bb9c412e4906"><code>574e5eb</code></a> quic: halt conn goroutines on close when listener exits early</li> <li>Additional commits viewable in <a href="https://github.com/golang/net/compare/v0.57.0...v0.58.0">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/text` from 0.40.0 to 0.41.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/text/commit/acdba6655fd45cdb5ab73c9d6a8981333bd65a39"><code>acdba66</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/text/commit/02aa981a75cb366b39e71729b935c15a7b4e146a"><code>02aa981</code></a> secure/precis: fix short destination buffer handling in Nickname profile</li> <li>See full diff in <a href="https://github.com/golang/text/compare/v0.40.0...v0.41.0">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/tools` from 0.48.0 to 0.49.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/tools/commit/18332fec72972efbb8ab9881984fec2d8cfc2b58"><code>18332fe</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/tools/commit/a5c4651b8e4951086fc536519d0eb869feefa7cb"><code>a5c4651</code></a> gopls/internal/protocol/command: fix struct field name in comment</li> <li><a href="https://github.com/golang/tools/commit/7d08a06ad24bb57ca109618799b3fb0f823a85a3"><code>7d08a06</code></a> present, cmd/present, cmd/present2md: document lack of security hardening</li> <li><a href="https://github.com/golang/tools/commit/e8a4348692a44c3a3a7157ede01d0407cb0dd034"><code>e8a4348</code></a> refactor/satisfy: fix "the the" typo</li> <li><a href="https://github.com/golang/tools/commit/54624f998d64d74146c63e7f477bcc201d1c44e9"><code>54624f9</code></a> internal/typesinternal: suppress jsonv2 warning</li> <li><a href="https://github.com/golang/tools/commit/c117dde2d0e430d319f475cec3f637c2c9efb56f"><code>c117dde</code></a> gopls/internal/golang: normalize instantiated fields before rename</li> <li><a href="https://github.com/golang/tools/commit/b5b860c7f55cd9ece1dcfcc4a7def912351cb8e9"><code>b5b860c</code></a> gopls/internal/mcp: report one-based reference line numbers</li> <li><a href="https://github.com/golang/tools/commit/bf54bcd2f14a330f0dcffa4cf631235de771bde2"><code>bf54bcd</code></a> gopls/internal/golang/completion: avoid SEGV from double deslicing</li> <li><a href="https://github.com/golang/tools/commit/4b32d669ce28c3b3e274a377a955063223a90350"><code>4b32d66</code></a> refactor/satisfy/find.go: fix panic on type errors</li> <li><a href="https://github.com/golang/tools/commit/e6da7e43e166478a3fa31e18fe3c07fe1379c7db"><code>e6da7e4</code></a> gopls/internal/protocol/semtok: instructions for modifier/type changes</li> <li>Additional commits viewable in <a href="https://github.com/golang/tools/compare/v0.48.0...v0.49.0">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
8e5211473f |
chore: bump tzdata from 1.0.46 to 1.0.50 in /site (#28199)
Bumps [tzdata](https://github.com/rogierschouten/tzdata-generate) from 1.0.46 to 1.0.50. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/rogierschouten/tzdata-generate/commit/41ba68e0dcd502a173aa8564dc7723a1eb819c58"><code>41ba68e</code></a> tzdata 2026c</li> <li><a href="https://github.com/rogierschouten/tzdata-generate/commit/57262ed943fbb62d8c23fb8a28a4c755fa9e7042"><code>57262ed</code></a> security fixes</li> <li><a href="https://github.com/rogierschouten/tzdata-generate/commit/a0b839f84fee13935e3ceadb857f118ace3b6887"><code>a0b839f</code></a> Update README.md</li> <li><a href="https://github.com/rogierschouten/tzdata-generate/commit/80b6adcf0670cc72df65a8cfda6fd20160213d26"><code>80b6adc</code></a> Update README.md</li> <li><a href="https://github.com/rogierschouten/tzdata-generate/commit/856c38fc89b471eff4c0d2bc6b8919feda48d20e"><code>856c38f</code></a> tzdata 2026b</li> <li><a href="https://github.com/rogierschouten/tzdata-generate/commit/a176aa9f20e398dc5044ae297cedc5451937f35e"><code>a176aa9</code></a> upgrade dependencies</li> <li><a href="https://github.com/rogierschouten/tzdata-generate/commit/61476aa3ea4a542ab616c8b5dd54099a8d842663"><code>61476aa</code></a> audit fix</li> <li><a href="https://github.com/rogierschouten/tzdata-generate/commit/156d450592f7c6dde94782a0c0497ffb84e90252"><code>156d450</code></a> tzdata 2026a</li> <li><a href="https://github.com/rogierschouten/tzdata-generate/commit/c56a60d642ad74215e1a4803c8d0ab3057addec3"><code>c56a60d</code></a> tz data 2025c</li> <li><a href="https://github.com/rogierschouten/tzdata-generate/commit/8126bcf20d661516ec4c9acf0c51945ad3e920b2"><code>8126bcf</code></a> tz data 2025c</li> <li>Additional commits viewable in <a href="https://github.com/rogierschouten/tzdata-generate/compare/v1.0.46...v1.0.50">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Jake Howell
|
0350bfd2ea |
refactor(site): show audit log retention and Premium paywall on observability settings (#27947)
The Audit Logging section on deployment observability settings only showed a badge or an info alert, with no actual setting underneath. When audit logging is entitled, show the Audit Logs Retention option. When it is not, show the shared Premium paywall instead of the inline alert. |
||
|
Jake Howell
|
41d2ecec0b |
feat(site): gate appearance settings behind Premium paywall (#27948)
Appearance settings previously showed a Premium paywall badge above still-visible branding and announcement banner forms. When appearance is not entitled, show only the shared Premium paywall. When entitled, show the branding form and announcement banners. |
||
|
dependabot[bot]
|
e52141fc6a |
chore: bump github.com/nats-io/nats.go from 1.52.0 to 1.53.1 (#28192)
Bumps [github.com/nats-io/nats.go](https://github.com/nats-io/nats.go) from 1.52.0 to 1.53.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/nats-io/nats.go/releases">github.com/nats-io/nats.go's releases</a>.</em></p> <blockquote> <h2>Release v1.53.1</h2> <h2>Changelog</h2> <p>This is a patch release containing no functional changes.</p> <h3>FIXED</h3> <ul> <li><code>Version</code> const and the README install line, which were not updated for v1.53.0 (<a href="https://redirect.github.com/nats-io/nats.go/issues/2118">#2118</a>)</li> </ul> <h3>Complete Changes</h3> <p><a href="https://github.com/nats-io/nats.go/compare/v1.53.0...v1.53.1">https://github.com/nats-io/nats.go/compare/v1.53.0...v1.53.1</a></p> <h2>Release v1.53.0</h2> <h2>Changelog</h2> <h3>ADDED</h3> <ul> <li>JetStream: <ul> <li><code>WithPublishAsyncAckHandler</code> option for JetStream async publish. Thanks <a href="https://github.com/occamist"><code>@occamist</code></a> for the contribution (<a href="https://redirect.github.com/nats-io/nats.go/issues/2109">#2109</a>)</li> <li><code>AckFlowControlPolicy</code> to legacy API (<a href="https://redirect.github.com/nats-io/nats.go/issues/2091">#2091</a>)</li> </ul> </li> <li>Micro: <ul> <li><code>micro.WithEndpointMetadataKey</code>. Thanks <a href="https://github.com/joeriddles"><code>@joeriddles</code></a> for the contribution (<a href="https://redirect.github.com/nats-io/nats.go/issues/2079">#2079</a>)</li> </ul> </li> </ul> <h3>FIXED</h3> <ul> <li>Core NATS: <ul> <li>Websocket connection with path. Thanks <a href="https://github.com/joeriddles"><code>@joeriddles</code></a> for the contribution (<a href="https://redirect.github.com/nats-io/nats.go/issues/2092">#2092</a>)</li> <li><code>MsgsTimeout</code> iterator yielding a spurious <code>(nil, nil)</code> after a timeout. Thanks <a href="https://github.com/sueun-dev"><code>@sueun-dev</code></a> and <a href="https://github.com/c-tonneslan"><code>@c-tonneslan</code></a> for the contributions (<a href="https://redirect.github.com/nats-io/nats.go/issues/2099">#2099</a>, <a href="https://redirect.github.com/nats-io/nats.go/issues/2093">#2093</a>)</li> </ul> </li> <li>JetStream: <ul> <li>Data race in <code>resetOrderedConsumer</code> when resets overlap (<a href="https://redirect.github.com/nats-io/nats.go/issues/2111">#2111</a>)</li> <li>Avoid panic in <code>PullSubscribe</code> consumer create path. Thanks <a href="https://github.com/wyf027"><code>@wyf027</code></a> for the contribution (<a href="https://redirect.github.com/nats-io/nats.go/issues/2088">#2088</a>)</li> <li>Honor per-request <code>JSOpt</code> API prefix across JetStream APIs. Thanks <a href="https://github.com/wyf027"><code>@wyf027</code></a> for the contribution (<a href="https://redirect.github.com/nats-io/nats.go/issues/2087">#2087</a>)</li> <li>Add nil checks for empty JetStream API responses. Thanks <a href="https://github.com/colecschmidt"><code>@colecschmidt</code></a> for the contribution (<a href="https://redirect.github.com/nats-io/nats.go/issues/2073">#2073</a>)</li> </ul> </li> <li>KeyValue: <ul> <li>Recognize error code 10164 for replicated KV CAS conflicts (<a href="https://redirect.github.com/nats-io/nats.go/issues/2098">#2098</a>)</li> <li>Reject keys with consecutive dots in <code>keyValid</code> and <code>searchKeyValid</code>. Thanks <a href="https://github.com/c-tonneslan"><code>@c-tonneslan</code></a> for the contribution (<a href="https://redirect.github.com/nats-io/nats.go/issues/2076">#2076</a>)</li> </ul> </li> <li>Micro: <ul> <li>Endpoint subject prefix over-match. Thanks <a href="https://github.com/vsaraikin"><code>@vsaraikin</code></a> for the contribution (<a href="https://redirect.github.com/nats-io/nats.go/issues/2105">#2105</a>)</li> </ul> </li> </ul> <h3>IMPROVED</h3> <ul> <li>Performance enhancement when publishing core NATS messages with headers. Thanks <a href="https://github.com/jonchammer"><code>@jonchammer</code></a> for the contribution (<a href="https://redirect.github.com/nats-io/nats.go/issues/2083">#2083</a>)</li> <li>Migrate tests to ntf (<a href="https://redirect.github.com/nats-io/nats.go/issues/2082">#2082</a>)</li> <li>Add docs.nats.io examples to main (<a href="https://redirect.github.com/nats-io/nats.go/issues/2106">#2106</a>)</li> <li>Improve readme wording for JetStream consumers. Thanks <a href="https://github.com/trevorah"><code>@trevorah</code></a> for the contribution (<a href="https://redirect.github.com/nats-io/nats.go/issues/2104">#2104</a>)</li> </ul> <h3>Complete Changes</h3> <p><a href="https://github.com/nats-io/nats.go/compare/v1.52.0...v1.53.0">https://github.com/nats-io/nats.go/compare/v1.52.0...v1.53.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nats-io/nats.go/commit/db1375fcffae2eb0b4ced1b7bad4d47c4447e4ac"><code>db1375f</code></a> Release v1.53.1 (<a href="https://redirect.github.com/nats-io/nats.go/issues/2118">#2118</a>)</li> <li><a href="https://github.com/nats-io/nats.go/commit/ae0af2c70af65374f6dfc001be1fc4accf7ddb63"><code>ae0af2c</code></a> [IMPROVED] Migrate tests to ntf (<a href="https://redirect.github.com/nats-io/nats.go/issues/2082">#2082</a>)</li> <li><a href="https://github.com/nats-io/nats.go/commit/0c5d8d7245c17a418cb850ac69a1aa52b17e19c5"><code>0c5d8d7</code></a> [ADDED] <code>WithPublishAsyncAckHandler</code> option for JetStream async publish (<a href="https://redirect.github.com/nats-io/nats.go/issues/2109">#2109</a>)</li> <li><a href="https://github.com/nats-io/nats.go/commit/15d96caf3a5947dcfde1c84b613dd77205e9e892"><code>15d96ca</code></a> [FIXED] Data race in resetOrderedConsumer when resets overlap (<a href="https://redirect.github.com/nats-io/nats.go/issues/2111">#2111</a>)</li> <li><a href="https://github.com/nats-io/nats.go/commit/f66c8e7396168080b104c91ac6a4c6863bf72373"><code>f66c8e7</code></a> [FIXED] Recognize error code 10164 for replicated KV CAS conflicts (<a href="https://redirect.github.com/nats-io/nats.go/issues/2097">#2097</a>) (#...</li> <li><a href="https://github.com/nats-io/nats.go/commit/9d92e853d400b5dc8ec5334ef8967e226299923f"><code>9d92e85</code></a> iter: don't yield a phantom (nil, nil) after MsgsTimeout's ErrTimeout (<a href="https://redirect.github.com/nats-io/nats.go/issues/2093">#2093</a>)</li> <li><a href="https://github.com/nats-io/nats.go/commit/c68c4de4fc2ce3834956a2487859d1eaf28a2942"><code>c68c4de</code></a> [FIXED] micro: endpoint subject prefix over-match (<a href="https://redirect.github.com/nats-io/nats.go/issues/2105">#2105</a>)</li> <li><a href="https://github.com/nats-io/nats.go/commit/e663e6717e4f96add4738d3865dc142ae5c17a6b"><code>e663e67</code></a> Improve example wording (<a href="https://redirect.github.com/nats-io/nats.go/issues/2104">#2104</a>)</li> <li><a href="https://github.com/nats-io/nats.go/commit/c1a0716149a402b9a0c3e7c7c234cbce5afd9650"><code>c1a0716</code></a> Add docs.nats.io examples to main (<a href="https://redirect.github.com/nats-io/nats.go/issues/2106">#2106</a>)</li> <li><a href="https://github.com/nats-io/nats.go/commit/77e280d0b1515dd8b47a28606ef2ca7c3a767d3d"><code>77e280d</code></a> [FIXED] MsgsTimeout iterator yields spurious (nil, nil) after a timeout (<a href="https://redirect.github.com/nats-io/nats.go/issues/2099">#2099</a>)</li> <li>Additional commits viewable in <a href="https://github.com/nats-io/nats.go/compare/v1.52.0...v1.53.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
c2368f8ecf |
chore: bump @pierre/diffs from 1.3.3 to 1.3.5 in /site (#28198)
Bumps @pierre/diffs from 1.3.3 to 1.3.5. [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
ad278c6e35 |
chore: bump axios from 1.18.1 to 1.19.0 in /site (#28197)
Bumps [axios](https://github.com/axios/axios) from 1.18.1 to 1.19.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/releases">axios's releases</a>.</em></p> <blockquote> <h2>v1.19.0 - July 22, 2026</h2> <p>This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.</p> <h2>🔒 Security Fixes</h2> <ul> <li>Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (<a href="https://github.com/advisories/GHSA-hmw2-7cc7-3qxx">https://github.com/advisories/GHSA-hmw2-7cc7-3qxx</a>). (<a href="https://redirect.github.com/axios/axios/issues/11028">#11028</a>)</li> </ul> <h2>🚀 New Features</h2> <ul> <li>Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (<a href="https://redirect.github.com/axios/axios/issues/11043">#11043</a>, <a href="https://redirect.github.com/axios/axios/issues/11081">#11081</a>)</li> <li>Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (<a href="https://redirect.github.com/axios/axios/issues/11051">#11051</a>)</li> <li>HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (<a href="https://redirect.github.com/axios/axios/issues/11067">#11067</a>)</li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li>Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (<a href="https://redirect.github.com/axios/axios/issues/11006">#11006</a>, <a href="https://redirect.github.com/axios/axios/issues/11018">#11018</a>)</li> <li>Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (<a href="https://redirect.github.com/axios/axios/issues/11029">#11029</a>, <a href="https://redirect.github.com/axios/axios/issues/11053">#11053</a>)</li> <li>Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (<a href="https://redirect.github.com/axios/axios/issues/11035">#11035</a>)</li> <li>Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (<a href="https://redirect.github.com/axios/axios/issues/11036">#11036</a>, <a href="https://redirect.github.com/axios/axios/issues/11037">#11037</a>)</li> <li>URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (<a href="https://redirect.github.com/axios/axios/issues/11024">#11024</a>, <a href="https://redirect.github.com/axios/axios/issues/11038">#11038</a>)</li> <li>Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (<a href="https://redirect.github.com/axios/axios/issues/11039">#11039</a>, <a href="https://redirect.github.com/axios/axios/issues/11040">#11040</a>)</li> <li>Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (<a href="https://redirect.github.com/axios/axios/issues/11044">#11044</a>, <a href="https://redirect.github.com/axios/axios/issues/11059">#11059</a>)</li> <li>Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (<a href="https://redirect.github.com/axios/axios/issues/11061">#11061</a>)</li> <li>Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (<a href="https://redirect.github.com/axios/axios/issues/11071">#11071</a>)</li> </ul> <h2>🔧 Maintenance & Chores</h2> <ul> <li>Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (<a href="https://redirect.github.com/axios/axios/issues/11031">#11031</a>, <a href="https://redirect.github.com/axios/axios/issues/11055">#11055</a>, <a href="https://redirect.github.com/axios/axios/issues/11056">#11056</a>, <a href="https://redirect.github.com/axios/axios/issues/11058">#11058</a>, <a href="https://redirect.github.com/axios/axios/issues/11079">#11079</a>, <a href="https://redirect.github.com/axios/axios/issues/11080">#11080</a>, <a href="https://redirect.github.com/axios/axios/issues/11088">#11088</a>, <a href="https://redirect.github.com/axios/axios/issues/11089">#11089</a>, <a href="https://redirect.github.com/axios/axios/issues/11090">#11090</a>)</li> <li>Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (<a href="https://redirect.github.com/axios/axios/issues/11054">#11054</a>)</li> <li>Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (<a href="https://redirect.github.com/axios/axios/issues/11062">#11062</a>)</li> <li>Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (<a href="https://redirect.github.com/axios/axios/issues/11032">#11032</a>, <a href="https://redirect.github.com/axios/axios/issues/11073">#11073</a>)</li> <li>Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (<a href="https://redirect.github.com/axios/axios/issues/11041">#11041</a>, <a href="https://redirect.github.com/axios/axios/issues/11068">#11068</a>, <a href="https://redirect.github.com/axios/axios/issues/11076">#11076</a>, <a href="https://redirect.github.com/axios/axios/issues/11078">#11078</a>)</li> <li>Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (<a href="https://redirect.github.com/axios/axios/issues/11083">#11083</a>, <a href="https://redirect.github.com/axios/axios/issues/11095">#11095</a>)</li> </ul> <h2>🌟 New Contributors</h2> <p>We are thrilled to welcome our new contributors. Thank you for helping improve Axios:</p> <ul> <li><a href="https://github.com/afonsojramos"><code>@afonsojramos</code></a> (<a href="https://redirect.github.com/axios/axios/issues/11028">#11028</a>)</li> <li><a href="https://github.com/MahinAnowar"><code>@MahinAnowar</code></a> (<a href="https://redirect.github.com/axios/axios/issues/11006">#11006</a>)</li> <li><a href="https://github.com/yassertawfik4"><code>@yassertawfik4</code></a> (<a href="https://redirect.github.com/axios/axios/issues/11024">#11024</a>)</li> <li><a href="https://github.com/AnandSundar"><code>@AnandSundar</code></a> (<a href="https://redirect.github.com/axios/axios/issues/11029">#11029</a>)</li> <li><a href="https://github.com/lin-hongkuan"><code>@lin-hongkuan</code></a> (<a href="https://redirect.github.com/axios/axios/issues/11035">#11035</a>)</li> <li><a href="https://github.com/Wali007-lab"><code>@Wali007-lab</code></a> (<a href="https://redirect.github.com/axios/axios/issues/11054">#11054</a>)</li> <li><a href="https://github.com/magicdawn"><code>@magicdawn</code></a> (<a href="https://redirect.github.com/axios/axios/issues/11043">#11043</a>)</li> <li><a href="https://github.com/andrewkernel"><code>@andrewkernel</code></a> (<a href="https://redirect.github.com/axios/axios/issues/11053">#11053</a>)</li> <li><a href="https://github.com/Sagargupta16"><code>@Sagargupta16</code></a> (<a href="https://redirect.github.com/axios/axios/issues/11059">#11059</a>)</li> <li><a href="https://github.com/Rpaudel379"><code>@Rpaudel379</code></a> (<a href="https://redirect.github.com/axios/axios/issues/11078">#11078</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/blob/v1.x/CHANGELOG.md">axios's changelog</a>.</em></p> <blockquote> <h2>v1.19.0 — July 22, 2026</h2> <p>This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.</p> <h2>🔒 Security Fixes</h2> <ul> <li>Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (<a href="https://github.com/advisories/GHSA-hmw2-7cc7-3qxx">https://github.com/advisories/GHSA-hmw2-7cc7-3qxx</a>). (<a href="https://redirect.github.com/axios/axios/issues/11028">#11028</a>)</li> </ul> <h2>🚀 New Features</h2> <ul> <li>Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (<a href="https://redirect.github.com/axios/axios/issues/11043">#11043</a>, <a href="https://redirect.github.com/axios/axios/issues/11081">#11081</a>)</li> <li>Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (<a href="https://redirect.github.com/axios/axios/issues/11051">#11051</a>)</li> <li>HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (<a href="https://redirect.github.com/axios/axios/issues/11067">#11067</a>)</li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li> <p>Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (<a href="https://redirect.github.com/axios/axios/issues/11006">#11006</a>, <a href="https://redirect.github.com/axios/axios/issues/11018">#11018</a>)</p> </li> <li> <p>Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (<a href="https://redirect.github.com/axios/axios/issues/11029">#11029</a>, <a href="https://redirect.github.com/axios/axios/issues/11053">#11053</a>)</p> </li> <li> <p>Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (<a href="https://redirect.github.com/axios/axios/issues/11035">#11035</a>)</p> </li> <li> <p>Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (<a href="https://redirect.github.com/axios/axios/issues/11036">#11036</a>, <a href="https://redirect.github.com/axios/axios/issues/11037">#11037</a>)</p> </li> <li> <p>URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (<a href="https://redirect.github.com/axios/axios/issues/11008">#11008</a>, <a href="https://redirect.github.com/axios/axios/issues/11038">#11038</a>)</p> </li> <li> <p>Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (<a href="https://redirect.github.com/axios/axios/issues/11039">#11039</a>, <a href="https://redirect.github.com/axios/axios/issues/11040">#11040</a>)</p> </li> <li> <p>Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (<a href="https://redirect.github.com/axios/axios/issues/11044">#11044</a>, <a href="https://redirect.github.com/axios/axios/issues/11059">#11059</a>)</p> </li> <li> <p>Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (<a href="https://redirect.github.com/axios/axios/issues/11061">#11061</a>)</p> </li> <li> <p>Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (<a href="https://redirect.github.com/axios/axios/issues/11071">#11071</a>)</p> </li> </ul> <h2>🔧 Maintenance & Chores</h2> <ul> <li>Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (<a href="https://redirect.github.com/axios/axios/issues/11031">#11031</a>, <a href="https://redirect.github.com/axios/axios/issues/11055">#11055</a>, <a href="https://redirect.github.com/axios/axios/issues/11056">#11056</a>, <a href="https://redirect.github.com/axios/axios/issues/11058">#11058</a>, <a href="https://redirect.github.com/axios/axios/issues/11079">#11079</a>, <a href="https://redirect.github.com/axios/axios/issues/11080">#11080</a>, <a href="https://redirect.github.com/axios/axios/issues/11088">#11088</a>, <a href="https://redirect.github.com/axios/axios/issues/11089">#11089</a>, <a href="https://redirect.github.com/axios/axios/issues/11090">#11090</a>)</li> <li>Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (<a href="https://redirect.github.com/axios/axios/issues/11054">#11054</a>)</li> <li>Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (<a href="https://redirect.github.com/axios/axios/issues/11062">#11062</a>)</li> <li>Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (<a href="https://redirect.github.com/axios/axios/issues/11032">#11032</a>, <a href="https://redirect.github.com/axios/axios/issues/11073">#11073</a>)</li> <li>Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (<a href="https://redirect.github.com/axios/axios/issues/11041">#11041</a>, <a href="https://redirect.github.com/axios/axios/issues/11068">#11068</a>, <a href="https://redirect.github.com/axios/axios/issues/11076">#11076</a>, <a href="https://redirect.github.com/axios/axios/issues/11078">#11078</a>)</li> <li>Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (<a href="https://redirect.github.com/axios/axios/issues/11083">#11083</a>, <a href="https://redirect.github.com/axios/axios/issues/11095">#11095</a>)</li> </ul> <h2>🌟 New Contributors</h2> <p>We are thrilled to welcome our new contributors. Thank you for helping improve Axios:</p> <ul> <li><a href="https://github.com/afonsojramos"><code>@afonsojramos</code></a> (<a href="https://redirect.github.com/axios/axios/issues/11028">#11028</a>)</li> <li><a href="https://github.com/MahinAnowar"><code>@MahinAnowar</code></a> (<a href="https://redirect.github.com/axios/axios/issues/11006">#11006</a>)</li> <li><a href="https://github.com/yassertawfik4"><code>@yassertawfik4</code></a> (<a href="https://redirect.github.com/axios/axios/issues/11024">#11024</a>)</li> <li><a href="https://github.com/AnandSundar"><code>@AnandSundar</code></a> (<a href="https://redirect.github.com/axios/axios/issues/11029">#11029</a>)</li> <li><a href="https://github.com/lin-hongkuan"><code>@lin-hongkuan</code></a> (<a href="https://redirect.github.com/axios/axios/issues/11035">#11035</a>)</li> <li><a href="https://github.com/Wali007-lab"><code>@Wali007-lab</code></a> (<a href="https://redirect.github.com/axios/axios/issues/11054">#11054</a>)</li> <li><a href="https://github.com/magicdawn"><code>@magicdawn</code></a> (<a href="https://redirect.github.com/axios/axios/issues/11043">#11043</a>)</li> <li><a href="https://github.com/andrewkernel"><code>@andrewkernel</code></a> (<a href="https://redirect.github.com/axios/axios/issues/11053">#11053</a>)</li> <li><a href="https://github.com/Sagargupta16"><code>@Sagargupta16</code></a> (<a href="https://redirect.github.com/axios/axios/issues/11059">#11059</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/axios/axios/commit/311fcc5c8d989b7248f05d390bb83bfbfb009977"><code>311fcc5</code></a> chore(release): prepare release 1.19.0 (<a href="https://redirect.github.com/axios/axios/issues/11095">#11095</a>)</li> <li><a href="https://github.com/axios/axios/commit/cb4fd743abd1c595761c8eda25d1323fc62a3b93"><code>cb4fd74</code></a> chore(deps): bump axios from 1.16.1 to 1.18.1 in /docs (<a href="https://redirect.github.com/axios/axios/issues/11088">#11088</a>)</li> <li><a href="https://github.com/axios/axios/commit/004c93a9d2acd0561c498eff7bb4431c6bad78af"><code>004c93a</code></a> chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 in the github-action...</li> <li><a href="https://github.com/axios/axios/commit/122edde91b1183572f4ba399b5b6bc4e3b989718"><code>122edde</code></a> chore(deps-dev): bump the development_dependencies group with 3 updates (<a href="https://redirect.github.com/axios/axios/issues/11089">#11089</a>)</li> <li><a href="https://github.com/axios/axios/commit/c44f8d0a910df99486da9175584b99f56a94a73b"><code>c44f8d0</code></a> ci: use bundled npm for v1 publish (<a href="https://redirect.github.com/axios/axios/issues/11083">#11083</a>)</li> <li><a href="https://github.com/axios/axios/commit/878bb29de570765b0d4c0970e30400d9ea9399f7"><code>878bb29</code></a> fix(sandbox): resolve TypeError on constant variable path assignment (<a href="https://redirect.github.com/axios/axios/issues/11073">#11073</a>)</li> <li><a href="https://github.com/axios/axios/commit/a092bae50d1884782151b2fcea12974d6da6e376"><code>a092bae</code></a> fix(core): synchronous interceptors swallow errors and proceed with request (...</li> <li><a href="https://github.com/axios/axios/commit/3041b8fd1daf17404d1bad1f9d94026ea5ab400b"><code>3041b8f</code></a> feat(HttpStatusCode): add missing 520 status code (<a href="https://redirect.github.com/axios/axios/issues/11067">#11067</a>)</li> <li><a href="https://github.com/axios/axios/commit/58b16c88f0bddf1fadb321aed58ba3f49a90481b"><code>58b16c8</code></a> refactor(helpers): extract duplicated setFormDataHeaders into a shared helper...</li> <li><a href="https://github.com/axios/axios/commit/3077e62097726d22ba30f1cb847d7a07050e339a"><code>3077e62</code></a> feat(types): Allow the Params property to be typed, instead of <code>any</code> (<a href="https://redirect.github.com/axios/axios/issues/11081">#11081</a>)</li> <li>Additional commits viewable in <a href="https://github.com/axios/axios/compare/v1.18.1...v1.19.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
cdaf7d4bd7 |
chore: bump @testing-library/user-event from 14.6.1 to 14.6.3 in /site (#28196)
Bumps [@testing-library/user-event](https://github.com/testing-library/user-event) from 14.6.1 to 14.6.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/testing-library/user-event/releases">@testing-library/user-event's releases</a>.</em></p> <blockquote> <h2>v14.6.3</h2> <h2><a href="https://github.com/testing-library/user-event/compare/v14.6.2...v14.6.3">14.6.3</a> (2026-08-03)</h2> <h3>Bug Fixes</h3> <ul> <li><strong>release:</strong> manually release a patch version (<a href="https://redirect.github.com/testing-library/user-event/issues/1321">#1321</a>) (<a href="https://github.com/testing-library/user-event/commit/1d18b1fae589eeed8e08838672a4c2de0dcc2b36">1d18b1f</a>), closes <a href="https://redirect.github.com/testing-library/user-event/issues/1317">#1317</a></li> </ul> <h2>v14.6.2</h2> <h2><a href="https://github.com/testing-library/user-event/compare/v14.6.1...v14.6.2">14.6.2</a> (2026-08-03)</h2> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/testing-library/user-event/commit/1d18b1fae589eeed8e08838672a4c2de0dcc2b36"><code>1d18b1f</code></a> fix(release): manually release a patch version (<a href="https://redirect.github.com/testing-library/user-event/issues/1321">#1321</a>)</li> <li><a href="https://github.com/testing-library/user-event/commit/232f3e6f4f92459c02161d156a70bddd13a59eaa"><code>232f3e6</code></a> docs: add migration note and clean up README badges (<a href="https://redirect.github.com/testing-library/user-event/issues/1320">#1320</a>)</li> <li><a href="https://github.com/testing-library/user-event/commit/83e2b2261b40f5f08296eaf5af3d42018e6681ed"><code>83e2b22</code></a> ci: remove deprecated CodeSandbox CI (<a href="https://redirect.github.com/testing-library/user-event/issues/1318">#1318</a>)</li> <li><a href="https://github.com/testing-library/user-event/commit/e8da81953bd9b48512a1e4ce9b73cc36aeaeee37"><code>e8da819</code></a> ci: publish to npm via OIDC trusted publishing (<a href="https://redirect.github.com/testing-library/user-event/issues/1317">#1317</a>)</li> <li><a href="https://github.com/testing-library/user-event/commit/13fa4bc1f0dedeb866a8730fa357229832437418"><code>13fa4bc</code></a> ci: stop lint errors from blocking release (<a href="https://redirect.github.com/testing-library/user-event/issues/1316">#1316</a>)</li> <li><a href="https://github.com/testing-library/user-event/commit/c3cec1832f180b6d1dcb7c5d2b0771339dd5e848"><code>c3cec18</code></a> chore(ci): make releases work with full git history (<a href="https://redirect.github.com/testing-library/user-event/issues/1315">#1315</a>)</li> <li><a href="https://github.com/testing-library/user-event/commit/ebab6c6e81e7022af7afa5aacd07d01626895eb8"><code>ebab6c6</code></a> add Liadshiran as a contributor for doc (<a href="https://redirect.github.com/testing-library/user-event/issues/1300">#1300</a>)</li> <li><a href="https://github.com/testing-library/user-event/commit/ec470bfd55ab7a741ce2a5b71e98c0f5686ac915"><code>ec470bf</code></a> docs: fix wrong default enum value (<a href="https://redirect.github.com/testing-library/user-event/issues/1298">#1298</a>)</li> <li><a href="https://github.com/testing-library/user-event/commit/ba79c2f9a58d5927725fee506210d279fde218b5"><code>ba79c2f</code></a> chore: upgrade node version in csb (<a href="https://redirect.github.com/testing-library/user-event/issues/1299">#1299</a>)</li> <li><a href="https://github.com/testing-library/user-event/commit/63ac399e06bd8f2397a6c581915acd29235f2d38"><code>63ac399</code></a> fix: allow reassignment of <code>HTMLElement.prototype.focus</code> and <code>.blur</code> (<a href="https://redirect.github.com/testing-library/user-event/issues/1265">#1265</a>)</li> <li>Additional commits viewable in <a href="https://github.com/testing-library/user-event/compare/v14.6.1...v14.6.3">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for <code>@testing-library/user-event</code> since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
2e79169bdb |
chore: bump vite from 8.2.0 to 8.2.1 in /site in the vite group across 1 directory (#28191)
Bumps the vite group with 1 update in the /site directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Updates `vite` from 8.2.0 to 8.2.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/releases">vite's releases</a>.</em></p> <blockquote> <h2>plugin-legacy@8.2.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/plugin-legacy@8.2.1/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.2.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.2.1/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md">vite's changelog</a>.</em></p> <blockquote> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v8.2.0...v8.2.1">8.2.1</a> (2026-08-06)<!-- raw HTML omitted --></h2> <h3>Bug Fixes</h3> <ul> <li><strong>build:</strong> make client chunkImportMap work with <code>sharedPlugins: true</code> (<a href="https://redirect.github.com/vitejs/vite/issues/23184">#23184</a>) (<a href="https://github.com/vitejs/vite/commit/15f03073c915d6ffb9a1fda447ef66b02bf5cde8">15f0307</a>)</li> <li><strong>bundled-dev:</strong> inject client script tag before chunk scripts (<a href="https://redirect.github.com/vitejs/vite/issues/23161">#23161</a>) (<a href="https://github.com/vitejs/vite/commit/eac0cc84aa2472a85a19ee84561c1ba71e381a55">eac0cc8</a>)</li> <li><strong>css:</strong> don't re-run lightningcss visitor during minify (fix <a href="https://redirect.github.com/vitejs/vite/issues/23146">#23146</a>) (<a href="https://redirect.github.com/vitejs/vite/issues/23147">#23147</a>) (<a href="https://github.com/vitejs/vite/commit/de041a79b05a0be965c874592fe2c1505bcd48df">de041a7</a>)</li> <li><strong>deps:</strong> update all non-major dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/23136">#23136</a>) (<a href="https://github.com/vitejs/vite/commit/14454fd8c9a399bc3fdc193e28465b6fcf001e4d">14454fd</a>)</li> <li><strong>deps:</strong> update rolldown-related dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/23070">#23070</a>) (<a href="https://github.com/vitejs/vite/commit/7ac6f7f590747bbdab9958e2c016e3dd04f10542">7ac6f7f</a>)</li> <li>don't mutate the user config when resolving the lib entry from the top-level <code>input</code> (<a href="https://redirect.github.com/vitejs/vite/issues/23135">#23135</a>) (<a href="https://github.com/vitejs/vite/commit/b4bf59686a7ac238929e91a6e1708c739b843a2f">b4bf596</a>)</li> <li>handle shebang ending with uncommon line terminators (<a href="https://redirect.github.com/vitejs/vite/issues/23038">#23038</a>) (<a href="https://github.com/vitejs/vite/commit/17f7b2f193a110d0b47742ad296d182cb4666ce7">17f7b2f</a>)</li> <li><strong>server:</strong> use a random port when port is 0 (<a href="https://redirect.github.com/vitejs/vite/issues/23158">#23158</a>) (<a href="https://github.com/vitejs/vite/commit/fddf4ea41de5f7889037a2f957438857ac12a260">fddf4ea</a>)</li> </ul> <h3>Performance Improvements</h3> <ul> <li><strong>css:</strong> look up pure CSS chunks through a Set (<a href="https://redirect.github.com/vitejs/vite/issues/23114">#23114</a>) (<a href="https://github.com/vitejs/vite/commit/1331b0b438b1e7193effb7d2341660bccb9c3155">1331b0b</a>)</li> </ul> <h3>Documentation</h3> <ul> <li><strong>build:</strong> fix incomplete <code>@default</code> for build.minify (<a href="https://redirect.github.com/vitejs/vite/issues/23177">#23177</a>) (<a href="https://github.com/vitejs/vite/commit/ef02435114c57d0422028f0e6987f3df8db72969">ef02435</a>)</li> </ul> <h3>Miscellaneous Chores</h3> <ul> <li><strong>deps:</strong> update dependency rolldown-plugin-dts to ^0.28.0 (<a href="https://redirect.github.com/vitejs/vite/issues/23137">#23137</a>) (<a href="https://github.com/vitejs/vite/commit/4adc1e7931d4beceb4e236d9a271d057c858a06f">4adc1e7</a>)</li> <li><strong>deps:</strong> update dependency strip-literal to v4 (<a href="https://redirect.github.com/vitejs/vite/issues/23140">#23140</a>) (<a href="https://github.com/vitejs/vite/commit/9db65ce63488ea8f08a3c98dcdc4282b17bd33ff">9db65ce</a>)</li> </ul> <h3>Code Refactoring</h3> <ul> <li><strong>bundled-dev:</strong> avoid injecting server values in the bundle (<a href="https://redirect.github.com/vitejs/vite/issues/22967">#22967</a>) (<a href="https://github.com/vitejs/vite/commit/23b8a088dec9dcc3f1c1353f2074f8644b3cc21f">23b8a08</a>)</li> <li><strong>bundled-dev:</strong> remove rolldown lazy stub module workaround (<a href="https://redirect.github.com/vitejs/vite/issues/23129">#23129</a>) (<a href="https://github.com/vitejs/vite/commit/e72036eed2e28936ed824971b18aeaa3900857f6">e72036e</a>)</li> </ul> <h3>Tests</h3> <ul> <li><strong>bundled-dev:</strong> enable sourcemap playgrounds (<a href="https://redirect.github.com/vitejs/vite/issues/23080">#23080</a>) (<a href="https://github.com/vitejs/vite/commit/c2155fe4d5c8d25fba3a7366d367e3296ae669fa">c2155fe</a>)</li> <li>reduce logs (<a href="https://redirect.github.com/vitejs/vite/issues/23138">#23138</a>) (<a href="https://github.com/vitejs/vite/commit/7673c02e53343ae9356c1f496c1c1da2eb732ac1">7673c02</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitejs/vite/commit/421615865dad3ed39137d17281814fc78a41246c"><code>4216158</code></a> release: v8.2.1</li> <li><a href="https://github.com/vitejs/vite/commit/fddf4ea41de5f7889037a2f957438857ac12a260"><code>fddf4ea</code></a> fix(server): use a random port when port is 0 (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23158">#23158</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/de041a79b05a0be965c874592fe2c1505bcd48df"><code>de041a7</code></a> fix(css): don't re-run lightningcss visitor during minify (fix <a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23146">#23146</a>) (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23147">#23147</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/15f03073c915d6ffb9a1fda447ef66b02bf5cde8"><code>15f0307</code></a> fix(build): make client chunkImportMap work with <code>sharedPlugins: true</code> (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23184">#23184</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/c2155fe4d5c8d25fba3a7366d367e3296ae669fa"><code>c2155fe</code></a> test(bundled-dev): enable sourcemap playgrounds (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23080">#23080</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/ef02435114c57d0422028f0e6987f3df8db72969"><code>ef02435</code></a> docs(build): fix incomplete <code>@default</code> for build.minify (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23177">#23177</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/eac0cc84aa2472a85a19ee84561c1ba71e381a55"><code>eac0cc8</code></a> fix(bundled-dev): inject client script tag before chunk scripts (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23161">#23161</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/23b8a088dec9dcc3f1c1353f2074f8644b3cc21f"><code>23b8a08</code></a> refactor(bundled-dev): avoid injecting server values in the bundle (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22967">#22967</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/e72036eed2e28936ed824971b18aeaa3900857f6"><code>e72036e</code></a> refactor(bundled-dev): remove rolldown lazy stub module workaround (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23129">#23129</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/14454fd8c9a399bc3fdc193e28465b6fcf001e4d"><code>14454fd</code></a> fix(deps): update all non-major dependencies (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23136">#23136</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vitejs/vite/commits/v8.2.1/packages/vite">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
69081e2bfa |
chore: bump next from 15.5.22 to 15.5.23 in /offlinedocs (#28193)
Bumps [next](https://github.com/vercel/next.js) from 15.5.22 to 15.5.23. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">next's releases</a>.</em></p> <blockquote> <h2>v15.5.23</h2> <h2>What's Changed</h2> <ul> <li>[15.x] Port ReplyServer traversal guards to FlightClient <a href="https://github.com/eps1lon"><code>@eps1lon</code></a> in <a href="https://redirect.github.com/vercel/next.js/pull/96405">vercel/next.js#96405</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/vercel/next.js/compare/v15.5.22...v15.5.23">https://github.com/vercel/next.js/compare/v15.5.22...v15.5.23</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/c91fd53e712bad0eb19ab6ee21d0e228bd40eeec"><code>c91fd53</code></a> v15.5.23</li> <li><a href="https://github.com/vercel/next.js/commit/0cb320866d359508c9af3700a5d889d823aed8c6"><code>0cb3208</code></a> [15.x] Port ReplyServer traversal guards to FlightClient (<a href="https://redirect.github.com/vercel/next.js/issues/96405">#96405</a>)</li> <li>See full diff in <a href="https://github.com/vercel/next.js/compare/v15.5.22...v15.5.23">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Jake Howell
|
ea8ba0c678 |
refactor: remove MUI and Emotion (#27821)
> 🤖 This PR was modified by Coder Agents on behalf of Jake Howell. Until we meet again. ## Stack - #27636 - #27718 - #27719 - #27722 - #27723 - #27724 - #27728 - #27730 - #27732 - #27762 - #27763 - #27786 - #27787 - #27788 - #27789 - #27790 - #27791 - #27817 - #27820 - #28009 ## Final removal (`c39b664`) Removes the last of MUI and Emotion now that every surface has been migrated: - **Dependencies**: drops `@mui/material` and `@emotion/{cache,css,react,styled}` from `package.json` / `pnpm-lock.yaml`, and deletes the `@types/emotion.d.ts` and `@types/mui.d.ts` module augmentations. - **Theming**: replaces the Emotion `CacheProvider`, MUI `ThemeProvider` / `StyledEngineProvider`, and `CssBaseline` in `ThemeProvider` with a lightweight `theme/context.tsx` that exposes `ThemeContextProvider` and a `useTheme` hook. - **Global styles**: moves the base `body` styles (background, text color, font, antialiasing) that `CssBaseline` previously provided into `index.css`, and drops the temporary MUI modal/popover scrollbar-gutter workaround. - **Cleanup**: removes the MUI → shadcn / Emotion → Tailwind migration guidance from `site/AGENTS.md`, updates the Storybook `preview.tsx`, and adjusts assorted components (`Command`, `Slider`, `Switch`, `Tabs`, `SyntaxHighlighter`, timing charts) and theme files to consume the new context instead of MUI/Emotion. |
||
|
Michael Suchacz
|
521c383f6b |
fix: repair stale chat agent bindings after workspace rebuild (#28152)
## Problem When a chat is bound to a workspace, chatd persists `chats.agent_id` pointing at a specific workspace agent, and it only rebinds on the next chat turn. A workspace stop/start creates a new agent with a new ID in the latest build, so the chat page resolves the stale agent ID to `undefined` and the right sidebar silently drops Terminal, Desktop, Browser, apps, and ports even though the workspace is running. The existing read-time enrichment only filled nil agent IDs and skipped stale non-nil ones, so refreshing did not help until the user sent another message. ## Fix - `coderd/exp_chats.go`: single-chat reads now repair agent IDs that no longer resolve in the workspace's latest build, using the same `agentselect.FindChatAgent` selection chatd uses. A repaired binding also carries the latest build's ID so the response never pairs the new agent with the previous build. Bindings that still resolve are preserved, and repair stays best-effort and response-only (no write-on-read). List reads keep the previous nil-fill-only behavior because validating existing bindings would cost a per-workspace authorization lookup per listed chat. - `site/src/pages/AgentsPage/AgentChatPage.tsx`: the workspace watch update handler detects when a running workspace's latest build no longer contains the chat's bound agent and invalidates the chat query once per chat/build/binding key for immediate recovery, and the chat query polls every 30 seconds while the binding remains unresolved so a transiently failed repair retries even when an idle workspace publishes no further watch events. The watch stream replays the current workspace on every (re)connect, so this covers rebuilds that happen while the page is open or disconnected; page loads are covered by the server-side repair. The workspace-watcher bailout now also keys on `latest_build.id` so a rebuild propagates while the page is open. - `site/src/api/queries/chats.ts`: chat watch events replay the persisted (pre-repair) binding, so the summary merge adopts a snapshot's `build_id` only when the snapshot agrees on `agent_id`, keeping the repaired agent/build pair atomic in the caches. ## Testing - `go test ./coderd -run TestEnrichChatAgentIDs` covering repair, keep-valid, selection-error, list-mode-skips-bound, and no-workspaces cases. - Storybook interaction story `RecoversSidebarAfterWorkspaceRebuild` exercising the watch-event to chat-refetch to sidebar-recovery flow (verified red without the invalidation, green with it). - `pnpm test AgentChatPage.test.ts` covering the binding-resolution predicate. > Mux created this PR on Mike's behalf. |
||
|
Wyatt FryandEthan Dickson
|
a005e5cd22 |
feat: add username and email user search filters (#27922)
## Summary User search can now resolve exact `email:` and `username:` terms through `GET /api/v2/users` instead of only supporting fuzzy free-text matches. The database query already had exact email and username filters; this wires the public search parser and API handler to those filters so clients can ask for a single user by email without fetching every user or depending on substring matching. This is the API half of coder/terraform-provider-coderd#403: that provider PR adds `data.coderd_user.email`, and this PR gives it an efficient exact lookup path. ## Testing - `go test ./coderd/searchquery -run '^TestSearchUsers$' -count=1` - `go test ./coderd -run '^TestGetUsersFilter$' -count=1` - Live API test: - Built local enterprise Coder from this branch. - Started Coder on `http://127.0.0.1:39991` against a clean Postgres database. - Created `lookup-target@example.com`. - Verified `GET /api/v2/users?q=email:LOOKUP-TARGET@EXAMPLE.COM&limit=2` returned exactly one user: ```json { "count": 1, "users": [ { "id": "efc6f909-ce0a-4731-bd2f-6e4df417aaa7", "username": "lookup-target", "email": "lookup-target@example.com" } ] } ``` ---   --------- Co-authored-by: Ethan Dickson <ethanndickson@gmail.com> |
||
|
Jay
|
af90d8e2be |
fix(agent/agentscripts): create missing log_path parent directory (#28166)
Previously, a `coder_script` whose `log_path` pointed under a directory
that did not yet exist failed before the script ran, with no per-script
log output. `OpenFile(logPath, O_CREATE|O_RDWR, 0o600)` creates the log
file but not its parent directories, so the open returned `ENOENT`. The
failure only surfaced in the agent log (`startup script(s) failed` /
`shutdown script(s) failed`) and never reached the script's own UI logs,
which made it look like a silent failure.
This creates the resolved parent directory with
`MkdirAll(filepath.Dir(logPath), 0o700)` before opening the log file, so
the script runs and its log is written. `0o700` matches the existing
script data-dir and secret-file directory conventions in this package.
Resolution of `~`, environment variables, and paths relative to `LogDir`
is unchanged; only the parent directory is now created.
Fixes coder/coder#21986
<details><summary>Implementation notes and validation</summary>
**Change**
* `agent/agentscripts/agentscripts.go`: in `(*Runner).run`, after the
full `logPath` resolution and before `OpenFile`, create the parent
directory:
```go
logDir := filepath.Dir(logPath)
if err = r.Filesystem.MkdirAll(logDir, 0o700); err != nil {
return xerrors.Errorf("create script log file directory %q: %w", logDir,
err)
}
```
**Regression test**
* `agent/agentscripts/agentscripts_test.go`:
`TestExecuteCreatesMissingLogDir` runs a script with a nested,
nonexistent `LogPath` and asserts the streamed output and that the log
file is created.
* The test uses `afero.NewOsFs()` on purpose: `afero.NewMemMapFs()`
auto-creates parent directories on `OpenFile`, so it cannot reproduce
the reported failure.
* Verified red without the fix (`open .../does/not/exist/install.log: no
such file or directory`) and green with it.
**Local validation**
* `gofmt` clean, `go vet`, `go build`, `golangci-lint run` on the
package, and `go test -race ./agent/agentscripts/` all pass.
**End-to-end**
* Validated on a dev instance with a template whose
`coder_script.log_path` targets a nested directory that does not exist.
The agent created the parents with mode `0700` and wrote the log file;
the workspace agent reported healthy.
**Prior attempts**
* [#22796](<https://github.com/coder/coder/issues/22796>) and
[#25545](<https://github.com/coder/coder/issues/25545>) proposed the
same directory-creation approach. Both were closed for non-technical
reasons (a low-effort AI PR and a stale community PR), not rejected on
the merits. This supersedes them, authored by the issue owner, using
`0o700` and adding a regression test.
</details>
---
*Raised on behalf of* @35C4n0r *by Coder Agents.*
|
||
|
Nick Vigilante
|
58de9ab8f8 |
docs: correct broken CLI commands and flags from drift sweep (#28098)
## Summary Corrects broken CLI commands and flags surfaced by the DOCS-637 full-corpus runtime drift sweep. Each fix was verified against the generated CLI reference (`docs/reference/cli/*`) and, where relevant, `codersdk` source. ## Changes | Page | Fix | |------|-----| | `docs/user-guides/workspace-access/index.md` | `coder port forward` → `coder port-forward` (the space form is unrecognized; the command is hyphenated). | | `docs/ai-coder/github-to-tasks.md` | Remove `coder templates list --org your-org-name` in two spots — `templates list` has no `--org` flag (`unknown flag: --org`). | | `docs/admin/infrastructure/scale-utility.md` | `--cleanup-timeout 15min` → `15m` — Go durations reject the `min` unit (`invalid duration: unknown unit "min"`). | | `docs/admin/integrations/dx-data-cloud.md` | `coder users list > users.csv` emitted a whitespace table, not CSV. Emit JSON and convert to real CSV with `jq`, mirroring the API tab on the same page and using the same columns as the default table view (`username,email,created_at,status`). | ## Notes / judgment calls - **dx-data-cloud (CSV):** the page genuinely needs CSV (the DX CSM imports a CSV, and the API tab already produces one via `jq ... @csv`). `coder users list` only supports `--output table|json`, so the CLI tab now produces real CSV via `jq` rather than switching the page to JSON. - **scale-utility `:109` left as-is:** `--target-users 0:100` is prefixed with "For dashboard traffic:", which correctly scopes it to the `scaletest dashboard` subcommand, so it is not drift. - **Excluded — sessions-tokens `--lifetime=720h`:** the sweep flagged this because the throwaway SUT capped token lifetime at 168h, but `--max-token-lifetime` defaults to `876600h` (~100 years), so the example is valid on a default deployment. The `CODER_MAX_TOKEN_LIFETIME` dependency is also already documented in the page's "Set max token length" section. No change needed. Linear: https://linear.app/codercom/issue/DOCS-641 > This PR was created with AI assistance (Coder Agents). |
||
|
Nick Vigilante
|
b0e93b6e3b |
docs: correct nginx X-Forwarded-Proto and certbot instructions flavor (#28086)
## What Two fixes to the nginx reverse-proxy tutorial. ### `X-Forwarded-Proto` (line 137) The config set: ```nginx proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto; ``` `$http_x_forwarded_proto` is the value of a client-supplied request header, which a client can spoof and which is usually empty for a direct request. In an nginx TLS-terminating reverse proxy this should be `$scheme`, which nginx sets from the actual connection (`https`). Using the raw client header can break Coder's scheme detection and secure-cookie handling. ### Certbot link flavor (line 57) The Certbot instructions link used `?ws=apache` in an nginx guide; changed to `?ws=nginx` so readers get nginx instructions. Surfaced by the runtime drift sweep; verified against `main`. Linear: [DOCS-642](https://linear.app/codercom/issue/DOCS-642/docs-fix-reverse-proxy-nginx-x-forwarded-proto-dollarscheme-certbot) > This PR was created with AI assistance (Coder Agents). |
||
|
Nick Vigilante
|
1d189cc204 |
docs: fix P2/P3 typos and syntax errors from drift sweep (#28101)
## Summary High-confidence textual subset of the DOCS-637 **P2/P3** drift batch (31 findings total). These 8 fixes are pure typo / grammar / syntax corrections verified directly against the doc source, so they carry no risk of misreconstructed command output. ## Changes (6 files) | Page | Fix | |------|-----| | `docs/admin/templates/extending-templates/variables.md` | Remove doubled word: "file in in the template directory" → "file in the template directory". | | `docs/admin/networking/port-forwarding.md` | Grammar: heading "From an coder_app resource" → "From a coder_app resource". | | `docs/user-guides/workspace-access/index.md` | Malformed heading "Through with the CLI" → "Through the CLI". | | `docs/about/contributing/modules.md` | Conventional-commit example missing the required space: `feat(git-clone):add` → `feat(git-clone): add`. | | `docs/ai-coder/tasks-migration.md` | Add missing closing double-quotes on Terraform `source`/`version` in two snippets that would fail `terraform` parsing. | | `docs/admin/users/idp-sync.md` | Role Sync section said "group sync settings" (copy-paste from the Group Sync section); remove an invalid trailing comma from a JSON output example. | ## Deferred (remaining ~23 P2/P3 items, not in this PR) The rest of the batch is stale **command-output** samples (column/schema changes, sample values) and items that need a content decision (e.g. `--psk` now deprecated in favor of `--key`; `--address` deprecated; an undocumented retention flag). Those need live-output reconstruction or a call on direction, so they're left for follow-up work, consistent with the issue's "handle after the P0/P1 fixes land" guidance. One catalog row (`reverse-proxy-nginx.md:57`, certbot `ws=apache`) is already handled by #28086 and is excluded here. Linear: https://linear.app/codercom/issue/DOCS-646 > This PR was created with AI assistance (Coder Agents). |
||
|
Nick Vigilante
|
5b97d99a48 |
docs: fix Helm TLS/ingress value keys in admin/setup (#28087)
## What
Fix the Helm values in the TLS setup step of
`docs/admin/setup/index.md`. The documented keys are silently ignored by
the chart, so TLS appears configured but isn't.
## Changes
- `coder.tls.secretName` (singular) → `coder.tls.secretNames` (a list).
The chart key is `secretNames`.
- `coder.ingress.secretName` / `coder.ingress.wildcardSecretName` →
nested under `coder.ingress.tls.secretName` /
`coder.ingress.tls.wildcardSecretName`, where the chart actually reads
them.
- Added `coder.ingress.tls.enable: true` so the ingress-termination
example actually enables TLS.
All keys verified against `helm/coder/values.yaml` on `main`
(`coder.tls.secretNames`,
`coder.ingress.tls.{enable,secretName,wildcardSecretName}`). Surfaced by
the runtime drift sweep. The example now parses to the correct chart
structure.
Linear:
[DOCS-643](https://linear.app/codercom/issue/DOCS-643/docs-fix-helm-tlsingress-value-keys-in-adminsetup-secretnames)
> This PR was created with AI assistance (Coder Agents).
|
||
|
Nick Vigilante
|
3145cc8386 |
docs: fix prometheus metric name and slack webhook backtick (#28085)
## What Two small monitoring-doc fixes surfaced by the runtime drift sweep. ### `docs/admin/integrations/prometheus.md` The native-histograms list showed `coderd_template_coderd_template_workspace_build_duration_seconds` (doubled `coderd_template_` prefix). The correct metric name, per the metrics table earlier on the same page and the generated metrics, is `coderd_template_workspace_build_duration_seconds`. ### `docs/admin/monitoring/notifications/slack.md` The `CODER_NOTIFICATIONS_WEBHOOK_ENDPOINT` export ended with a stray backtick: ``` export CODER_NOTIFICATIONS_WEBHOOK_ENDPOINT=http://localhost:6000/v1/webhook` ``` On paste, bash treats the trailing backtick as an unterminated command substitution and errors. Removed it. Both reproduced during the runtime drift sweep and verified against `main`. Linear: [DOCS-647](https://linear.app/codercom/issue/DOCS-647/docs-fix-monitoring-examples-prometheus-metric-name-slack-webhook) > This PR was created with AI assistance (Coder Agents). |
||
|
Nick Vigilante
|
f3fd4c4a77 |
docs: remove invalid --yes flag from coder template version promote (#28084)
## What Remove the invalid `--yes` flag from the `coder template version promote` command in the CI/CD publishing example. ## Why `docs/tutorials/testing-templates.md` documents, in the GitHub Actions "Promote template version" step: ``` coder template version promote --template=$TEMPLATE_NAME --template-version=... --yes ``` The `promote` subcommand has no `--yes`/confirmation flag, so the command exits with `unknown flag: --yes` and breaks the documented CI workflow. This is a golden-path (automation) breaker. Verified against the generated reference `docs/reference/cli/templates_versions_promote.md` (flags are only `--template`, `--template-version`, `-O/--org`), and reproduced against a live deployment during the runtime drift sweep. The command is non-interactive, so no confirmation flag is needed. ## Change Single line: drop ` --yes`. Linear: [DOCS-640](https://linear.app/codercom/issue/DOCS-640/docs-remove-invalid-yes-flag-from-coder-template-version-promote) > This PR was created with AI assistance (Coder Agents). |
||
|
|
043bebb7bc |
docs: add Coder Desktop stale-tunnel recovery and improve macOS log capture (#26735)
## What Adds a **Recovering from a stale tunnel** section to the Coder Desktop user guide, with separate macOS and Windows procedures, and tightens the existing macOS log-collection instructions. ## Why Users in the field have hit a state where Coder Desktop's menu bar / tray shows **Coder Connect** as enabled but the embedded tunnel is no longer working: * `workspace.coder` fails to resolve (`No such host`), or * DNS returns stale `fd60:627a:a42b::/48` addresses that no longer route, causing `coder ssh`, file sync, and the directory picker to hang. Related issues: * coder/coder#26669 — `ExistsViaCoderConnect` false positives when Coder Desktop has stale DNS * coder/coder-desktop-windows#171 — Tray reports Coder Connect as healthy while tunnel/DNS is broken Until the underlying state-management gap is fixed in the apps, the docs should give users (and support) a safe, repeatable way to recover without rebooting. ## Changes `docs/user-guides/desktop/index.md`: 1. **New "Recovering from a stale tunnel" section** under Troubleshooting: * **macOS:** stop the VPN configuration with `scutil --nc stop`, quit the app via `osascript`, restart the helper daemon in place with `launchctl kickstart -k system/com.coder.Coder-Desktop.Helper`, flush DNS caches, then relaunch. * Includes a warning to **not** use `launchctl bootout`, which removes the daemon from launchd's system domain entirely and is not re-bootstrapped on app relaunch. * Includes a verification step using the built-in sentinel hostname `is.coder--connect--enabled--right--now.coder` (defined in `tailnet/conn.go` as `IsCoderConnectEnabledFmtString`) so users don't need a workspace name to confirm the tunnel is healthy. * Uses `dig @fd60:627a:a42b::53` (explicit server) and `dscacheutil -q host -a name` because plain `dig` does not respect the macOS system resolver. * **Windows:** stop the app and `Coder Desktop` service, flush DNS, restart, then verify the NRPT rule and Wintun adapter. Notes that `ipconfig /flushdns` does not reset the embedded resolver and that filtering agents (e.g., Zscaler) may still shadow `.coder` lookups. 2. **macOS log-collection improvements:** * Switch the predicate from `subsystem == "com.coder.Coder-Desktop"` to `subsystem BEGINSWITH "com.coder.Coder-Desktop"` so the export captures the app, helper daemon, and network extension (which all log under prefixed subsystems). * Add a `log stream` example for live tailing while reproducing an issue. ## Verification * `npx markdownlint-cli2 docs/user-guides/desktop/index.md` — 0 errors. * macOS recovery steps were validated end-to-end on a real install (the `kickstart -k` form, in particular, was confirmed to restart the helper without breaking the install, unlike `bootout`). --- Created on behalf of @mdanter --------- Co-authored-by: blink-so[bot] <211532188+blink-so[bot]@users.noreply.github.com> Co-authored-by: Atif Ali <atif@coder.com> Co-authored-by: Nick Vigilante <nickvigilante@users.noreply.github.com> Co-authored-by: Matyas Danter <mdanter@gmail.com> |
||
|
Danielle Maywood
|
57dc47dc42 |
feat(site): migrate agent chat scrolling (#28130)
Replace the Agents chat's inverse scroll container and sticky user-message overlays with the stock MessageScroller from `@shadcn/react@0.3.0`. Transcript rows now render as direct MessageScroller Items with stable server-backed identities. Only the latest active user turn is a scroll anchor, older history preserves the reading position when prepended, and the package owns follow mode, prompt navigation, and the `Scroll to bottom` control. The integration uses the upstream component hierarchy without patches, bridges, or application-owned scroll correction. Depends on #28079. <details> <summary>Implementation notes</summary> - Use `MessageScroller.Provider`, `Root`, `Viewport`, `Content`, `Item`, and `Button` directly. - Keep durable row IDs stable across pagination; the live assistant uses an ephemeral row until its durable message arrives. - Load additional history from MessageScroller's start-edge state, including underfilled transcripts and retry after a page error. - Remove inverse scrolling, sticky message copies, scroll refs, forced scroll commands, and `react-infinite-scroll-component`. </details> Generated by Coder Agents on behalf of @DanielleMaywood. |
||
|
Danielle Maywood
|
7617b6bdcc |
refactor(site): render live assistant output as a chat timeline row (#28079)
Refactor the Agents chat timeline so live assistant output renders as a timeline row through the same components as durable messages, ahead of the stacked MessageScroller migration in #28130. `ConversationTimeline`'s block rendering is extracted into `MessageBlocks`, the streaming/durable assistant split collapses into a shared `AssistantOutput`, and `LiveStreamTail` shrinks to the empty state and terminal failure callout. Row keys are plain `message:<id>` strings; the live assistant row is a separate ephemeral row. This PR does not change scrolling behavior and adds no backend, API, or database fields. <details> <summary>Implementation notes</summary> - Extract `BlockList` and friends from `ConversationTimeline` into `MessageBlocks` (pure move). - Replace `StreamingOutput` with `AssistantOutput`, used for both live and durable assistant rows. - Render the live assistant as a timeline row via `assignTimelineRows` instead of separate transient content below the transcript. - Keep existing transcript grouping, prompt navigation, and the current scroll container unchanged; the scroller swap happens in #28130. </details> Generated by Coder Agents on behalf of @DanielleMaywood. |
||
|
Bobby Ho
|
1aa3553b52 |
fix(coderd): set Cache-Control: no-store on OAuth2 responses (#28143)
No response from the `/oauth2` route tree set `Cache-Control` at all, so
an intermediary cache or customer-operated reverse proxy was free to
apply a heuristic freshness lifetime to a response carrying a live
credential. RFC 6749 §5.1 and OAuth 2.1 §3.2.3 both make an affirmative
`no-store` directive a MUST for the authorization server.
Adds `httpmw.NoStore`, mounted on the `/oauth2` and
`/api/v2/oauth2-provider` trees, setting `Cache-Control: no-store` and
`Pragma: no-cache` on every response from them. OAuth 2.1 drops `Pragma`
because RFC 9111 §5.4 deprecates it as a request-only field, so sending
both is conformant under either reading. Not operator-configurable,
since both specs say MUST.
## Scope
- **Both trees, not just `POST /oauth2/tokens`.** The mount is one line
either way, and the wider scope also covers DCR registration, client
configuration read and update, the authorize 302 whose `Location` query
carries the code, and `POST /oauth2-provider/apps/{app}/secrets`, which
returns a plaintext client secret. A route added later inherits the
headers, which matters for PLAT-449.
- **A middleware, not a hook in `httpapi.Write`.** Three write paths
never call it: `POST /oauth2/revoke` and `DELETE
/oauth2/clients/{client_id}` write a bare status, and
`writeOAuth2RegistrationError` encodes its own JSON.
- **`/.well-known/*` deliberately excluded.** Public discovery metadata,
and RFC 9728 §5 asks for the opposite treatment. Assertions pin the
exclusion so a later hoist onto a higher router fails CI.
- **Session-credential routes left alone.** `/users/login`,
`/users/otp/change-password`, and `/users/{user}/keys/*` have the same
gap, but PLAT-448 is scoped to OAuth2 and reaching into session auth
changes the risk profile.
Every credential-returning route here is a `POST`, and RFC 9111 §3 bars
heuristic caching of `POST` responses, so this is defense-in-depth
against a non-conformant intermediary rather than a live caching bug.
Both specs say MUST regardless of what caches would actually do.
## Note for PLAT-498
`DELETE /oauth2/tokens` now carries `no-store` and is wrapped in
`apiKeyMiddleware`, which is mounted inside the `/oauth2` tree and
therefore runs after this middleware. It is the one route where both can
write `Cache-Control`, and PLAT-498's write must not replace `no-store`
with something weaker such as `private`. `POST /oauth2/tokens` cannot
overlap, since it deliberately has no `apiKeyMiddleware`.
## Two assumptions testing corrected
- `GET /oauth2/does-not-exist` returns **200**, not 404. Chi runs the
subrouter's middleware chain for unmatched paths, so both headers are
present, but the request falls through to the root router's SPA handler.
The test asserts the headers and deliberately not the status.
- The experiment-disabled case is unreachable from a test binary, since
`RequireExperimentWithDevBypass` short-circuits on `buildinfo.IsDev()`.
A unit test covers the consequence against the `RequireExperiment` it
delegates to.
No schema, `codersdk`, or serpent option changes, so `make gen` produces
no diff. Rollback is a revert.
Refs PLAT-448
|
||
|
Samuel Volin
|
b26f4c0e03 |
feat: DEVEX-751 updated premiumpaywall component (#28070)
* implements the supergraphic component, to show a minified webp theme-aware version of the supergraphic * refine the PaywallPremium into separate PaywallSmall component * paywall no long includes link to docs for component; will be part of DEVEX-742 * appearance and custom roles page uses PaywallSmall <img width="1509" height="676" alt="Screenshot 2026-08-12 at 7 49 54 AM" src="https://github.com/user-attachments/assets/17cd1a16-acc8-415a-819d-bdb9259fdaf9" /> <img width="1499" height="702" alt="Screenshot 2026-08-11 at 12 46 55 PM" src="https://github.com/user-attachments/assets/05cd628a-c8c1-4b1c-a4c9-318814eec428" /> <img width="1466" height="549" alt="Screenshot 2026-08-11 at 12 44 43 PM" src="https://github.com/user-attachments/assets/f0bb0c0e-7702-41a0-a718-78a637c9f4e9" /> <img width="1715" height="652" alt="Screenshot 2026-08-12 at 11 25 21 AM" src="https://github.com/user-attachments/assets/55dedd2c-d44c-4cd0-a425-fbde4452f622" /> |
||
|
Michael Suchacz
|
93c6faf1de |
fix(coderd): send assigned chat model IDs verbatim (#28144)
Fixes #27361 (CODAGT-832). ## Problem When an Agents model was configured under a non-gateway provider type (e.g. Anthropic or OpenAI) with a model ID whose first `/`- or `:`-segment matched a built-in provider name (`anthropic`, `azure`, `bedrock`, `google`, `openai`, `openai-compat`, `openrouter`, `vercel`), `chatprovider.ResolveModelWithProviderHint` parsed it as a canonical `provider/model` reference: the prefix was stripped and the request rerouted to the embedded provider type, overriding the provider the admin explicitly assigned. LLM gateways (e.g. LiteLLM) that namespace their catalogs as `bedrock/...` or `anthropic/...` behind an Anthropic- or OpenAI-type provider failed with an opaque upstream "Model not found", and escaping was impossible (`bedrock/bedrock/...` still rerouted). ## Fix A valid provider hint is now authoritative: `ResolveModelWithProviderHint` returns the assigned provider and the verbatim model ID whenever a hint is present. Canonical `provider/model` and `provider:model` parsing applies only to hint-less resolution paths. Every production call site derives the hint from the model config's explicitly assigned AI provider, so the assignment always wins. The save-time guard rejecting slash-namespaced models on OpenRouter-like providers typed as `openai` (provider named `openrouter` or hosted at `openrouter.ai`) is kept: that combination remains a misconfiguration whose correct fix is the `openrouter` provider type, and rejecting it early beats a confusing upstream error. Its wording no longer claims prefix stripping happens. ## Back-compat note A pre-existing config that relied on stripping (e.g. model `anthropic/claude-x` assigned to an Anthropic-type provider pointing at the real Anthropic API) now sends the prefixed ID verbatim and will get a clear upstream model-not-found error; the admin fixes it by editing the model ID. Nothing in the product ever suggested the canonical form for assigned models. ## Validation - Unit: `TestResolveModelWithProviderHint` updated (hints preserve `bedrock/...`, `anthropic/...`, `provider:...` verbatim; hint-less canonical parsing unchanged), red-green verified against the old ordering. Gateway and openai-type provider routing tests assert verbatim pass-through end to end. - Full `./coderd/x/chatd/...` suites plus `TestCreateChatModelConfig`, `TestUpdateChatModelConfig`, and `TestValidateChatModelConfigProviderModel` pass. - Remote dogfood UAT on real models (PASS): an openai-type provider pointed at a Vercel AI Gateway mount returned a real completion for `anthropic/claude-haiku-4.5`, with trace logs confirming `provider=openai model=anthropic/claude-haiku-4.5` (verbatim, not rerouted); gateway-type (`openai-compat`) routing with `deepseek/deepseek-v4-pro-0813` and the model catalog/picker regressions pass. > Mux acted on Mike's behalf to create this PR. |
||
|
Michael Suchacz
|
d5bb35a49a |
fix(coderd): deflake TestChatMessageWithFiles/FileCapExceeded (#28091)
Fixes the flake tracked in [CODAGT-926](https://linear.app/codercom/issue/CODAGT-926/flake-testchatmessagewithfilesfilecapexceeded). ## Problem `TestChatMessageWithFiles/FileCapExceeded` asserted the rollback of a rejected over-cap send by comparing message counts taken before and after the send. `CreateChat` starts assistant generation asynchronously, so the assistant reply can be persisted between the two reads, making the count check fail even though the rejected message was correctly rolled back ("should have 1 item(s), but has 2"). ## Fix Replace the count comparison with a semantic assertion that the rejected `one too many` message was not persisted, hardened through Codex review rounds: - Scan message history for the rejected marker instead of comparing counts. - Also scan `QueuedMessages`: a busy chat queues the send before file-link validation, so a rollback regression could leave the rejected message queued rather than in history. - Close the queue-promotion race: `getChatMessages` reads history and the queue in two separate database reads, so the assertion first waits for the queue to observe empty; a promoted message must then appear in a fresh history read. ## Verification - Deterministic repro of the exact CI failure signature: waiting for the async assistant reply before the old count assertion reproduced `should have 1 item(s), but has 2` every run. - The new assertion passes under that same forced condition. - Assertion liveness (all temporary red checks reverted): persisting the marker in history fails the history scan; queuing the marker fails the queued scan; queuing the marker and letting it promote fails the post-drain history scan 3/3. - `go test ./coderd -run 'TestChatMessageWithFiles/FileCapExceeded' -count=100` and the full `TestChatMessageWithFiles` parent both pass. > Mux acted on Mike's behalf to create this PR. |
||
|
Michael Suchacz
|
48e1e28638 |
fix(coderd/x/chatd/chattool): make edit_files schema and errors actionable for models (#28121)
## Problem Chat `45b87e40-ffe7-49e5-8932-5fd0bdb9e542` on dev.coder.com failed 57 of 75 `edit_files` tool calls. Every failure was the same: the model omitted `files[].path` (it batched edits per file but only filled in `edits`), and the error relayed back to the model was: ``` POST http://[fd7a:115c:...]:4/api/v0/edit-files: unexpected status code 400: "path" is required ``` The model retried the identical malformed call dozens of times. Two gaps made this sticky: 1. The `edit_files` input schema had no field descriptions, so `path` was only a bare required property. 2. The agent API error reached the model wrapped in HTTP transport noise (method, internal tailnet URL, status code) with no indication of which `files` entry was broken. ## Changes - Add `description` tags to every `edit_files` schema field and state the path requirement in the tool description. - Validate `files` entries in the tool before plan-turn checks and the workspace connection lookup, returning entry-indexed errors such as `files[1].path is required; provide the absolute path of the file to edit; no files in this batch were applied`. - Relay agent API failures with `Message`, `Helper`, `Detail`, and `Validations` from `codersdk.Error` instead of the raw transport-prefixed string. ## Validation - `go test ./coderd/x/chatd/chattool` passes; new tests cover the schema description, entry-indexed validation errors, and transport-noise stripping (each verified red-green by toggling the fix off). - `go build ./...`, `go vet`, and pre-commit (fmt + lint) pass. > Mux created this PR on Mike's behalf. |
||
|
McKayla はな
|
e1fa247e59 | feat: redirect to the template builder after first time setup (#27670) | ||
|
Bobby HoandClaude Opus 5
|
990d24dc42 |
feat: add oauth2 scope columns and single-use delete queries (#28007)
OAuth2 tokens issued by Coder ignore scope entirely. The authorize endpoint parses the `scope` parameter and then discards it, and both grant paths mint API keys with full API access regardless of what the client requested or what the app's allowlist permits. There is also nowhere to put a negotiated scope: nothing carries one from the authorize step to the token it produces. Schema and query groundwork for that pipeline. No behavior change on its own. - Migration `000569` adds a `scope` column to `oauth2_provider_app_codes` and `oauth2_provider_app_tokens`, so a negotiated scope can travel from a code to the token it is exchanged for, and from a token to its refreshed successor. - Existing rows are backfilled to `coder:all`, then both columns become NOT NULL with a non-empty CHECK. Every OAuth2 key is unrestricted in fact today, so the backfill only writes that down, and a caller that omits the column now fails instead of silently issuing full access. - Adds `DeleteOAuth2ProviderAppCodeByIDReturningRow` and `DeleteAPIKeyByIDReturningRow`, which return `sql.ErrNoRows` when the row is already gone. Postgres serializes concurrent deletes on the row lock, so exactly one caller gets a row back, which is what will let the grant paths enforce single use of a code or refresh token without a read-then-write race. - No callers yet. The existing blind deletes and all of their call sites are untouched, and codes and tokens record `coder:all` until a later phase negotiates a real value. Phase 1 of [PLAT-470](https://linear.app/codercom/issue/PLAT-470), tracked as [PLAT-478](https://linear.app/codercom/issue/PLAT-478/phase-1-schema-and-queries). Scope validation at authorize, applying the negotiated scope in the code grant, and refresh narrowing follow as separate PRs. Verified locally: `make gen` and `make lint` clean, the migrations suite passes both up and down, and dbauthz's `TestMethodTestSuite` passes. <details> <summary>End-to-end scope enforcement flow (green marks what this PR touches)</summary> ```mermaid flowchart TD subgraph authorize["/oauth2/authorize"] AZ1["ShowAuthorizePage (GET)<br/>renders consent page"] AZ2["ProcessAuthorize (POST)<br/>scope parsed, then discarded"] Q1["InsertOAuth2ProviderAppCode<br/>gains a Scope param"] AZ1 --> AZ2 --> Q1 end Q1 --> CODES[("oauth2_provider_app_codes<br/>new column: scope text NOT NULL")] subgraph codegrant["POST /oauth2/token, grant_type=authorization_code"] G1["authorizationCodeGrant"] Q2["GetOAuth2ProviderAppCodeByPrefix<br/>now returns Scope"] Q4["DeleteOAuth2ProviderAppCodeByIDReturningRow<br/>added, no caller yet"] G2["apikey.Generate + UserRBACSubject<br/>hardcoded to full access"] G1 --> Q2 --> G2 G1 -.-> Q4 end CODES --> G1 G2 --> Q3 Q3["InsertOAuth2ProviderAppToken<br/>gains a Scope param"] Q3 --> TOKENS[("oauth2_provider_app_tokens<br/>new column: scope text NOT NULL")] subgraph refresh["POST /oauth2/token, grant_type=refresh_token"] G3["refreshTokenGrant"] Q5["GetOAuth2ProviderAppTokenByPrefix<br/>now returns Scope"] Q6["DeleteAPIKeyByIDReturningRow<br/>added, no caller yet"] G3 --> Q5 G3 -.-> Q6 end TOKENS --> G3 Q5 --> Q3 subgraph enforce["Every authenticated API request"] E1["httpmw ExtractAPIKey"] --> E2["APIKey.ScopeSet()"] --> E3["UserRBACSubject"] --> E4["dbauthz authorize"] end TOKENS --> E1 classDef changed fill:#c8e6c9,stroke:#2e7d32,stroke-width:2px,color:#1b3c1e classDef dormant fill:#c8e6c9,stroke:#2e7d32,stroke-width:2px,stroke-dasharray:5 3,color:#1b3c1e class Q1,Q2,Q3,Q5,CODES,TOKENS changed class Q4,Q6 dormant ``` Solid green is added or changed here. Dashed green exists but has no caller yet. Everything else is unchanged, including the enforcement engine at the bottom, which already reads a key's scopes correctly and only needs real data fed into it. </details> <details> <summary>Suggested reading order</summary> Most of the diff is generated. `dump.sql`, `models.go`, `querier.go`, `queries.sql.go`, `check_constraint.go`, and the dbmock and dbmetrics packages all come from `make gen`. 1. `migrations/000569_oauth2_scope_columns.{up,down}.sql`: additive column, backfill, NOT NULL, CHECK, and a `COMMENT ON COLUMN` on each. 2. `queries/oauth2.sql` and `queries/apikeys.sql`: `scope` added to both insert column lists, plus the two new returning-row deletes alongside the untouched originals. The `Get...ByPrefix` selects needed no edit, since they are `SELECT *`. 3. `dbauthz/dbauthz.go`: hand-written wrappers for the two new queries, each fetching by ID, authorizing delete against the fetched object, then delegating. The generic `deleteQ` helper does not fit, since it requires the delete to return only `error`. 4. `oauth2provider/authorize.go` and `oauth2provider/tokens.go`: the only production changes, all behavior-neutral. 5. `dbgen/dbgen.go` and `dbauthz/dbauthz_test.go`: seed threading, plus a case per new query. `MethodTestSuite` fails with "Method never called" for anything untested. Neither type needs to become auditable, which `make lint` confirms by not erroring on `enterprise/audit/table.go`. </details> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|
Michael Suchacz
|
8d4d0b35dd |
feat: add Coder Agents chat tools to the MCP toolsdk (#28025)
Exposes the experimental Coder Agents chats API through the MCP tool registry, so MCP clients (the hosted `/api/experimental/mcp/http` server and `coder exp mcp server`) can start and drive server-side coding agents. New tools in `codersdk/toolsdk`, all thin wrappers over existing `codersdk.ExperimentalClient` methods: | Tool | Wraps | |---|---| | `coder_create_chat` | `CreateChat` (prompt, optional org, model config, labels) | | `coder_get_chat` | `GetChat` (status, last error, last turn summary, workspace, files) | | `coder_get_chat_messages` | `GetChatMessages` (user-facing parts, chronological, cursor pagination, queued prompts) | | `coder_send_chat_message` | `CreateChatMessage` (queue or interrupt busy behavior) | | `coder_interrupt_chat` | `InterruptChat` | | `coder_archive_chat` | `UpdateChat` with `archived: true` | | `coder_list_chat_model_configs` | `ListChatModelConfigs` (enabled configs with default flag) | Both MCP servers register tools from `toolsdk.All`, so no additional wiring is needed. Responses are trimmed to what an MCP caller needs (IDs as strings, user-facing transcripts) rather than full SDK payloads. No new endpoints and no database changes. Also adds MCP [prompts](https://modelcontextprotocol.io/specification/2026-07-28/server/prompts) for the chat workflows, defined once in `codersdk/toolsdk` and registered by both servers: | Prompt | Purpose | |---|---| | `coder_agents_delegate` | delegate a task to a Coder Agents chat and monitor it to completion | | `coder_agents_check` | check the status and recent activity of an existing chat | Each prompt declares the tools its workflow needs; the stdio server skips prompts whose tools are excluded by `--allowed-tools`. Tests run the tools against a chat-enabled coderdtest instance (fake OpenAI-compatible provider plus in-process AI bridge), covering the full lifecycle, an interrupt against a blocked turn, pagination cursors, permission-dependent model config filtering, and argument validation. Prompt coverage spans SDK rendering, the hosted `prompts/list`/`prompts/get` round trip, and the stdio server including allowlist gating. > Mux created this PR on Mike's behalf. |
||
|
Michael Suchacz
|
bca5d72c1c |
fix(site): prefer permitted organization for chat creation (#28078)
Fixes first-send 403s for multi-org users who lack `chat:create` in the deployment default organization (CODAGT-892). Two frontend defects combined to send chat creation to the wrong organization: 1. The Agents create form initialized its organization selection permission-blind to the default org and only corrected it when the `permittedOrganizations` authcheck result *transitioned*, so a fast first send raced the check, and on warm-query-cache remounts the correction never ran at all: the wrong org stayed selected permanently while the org picker was hidden. 2. The permitted-organizations authcheck itself sent no `owner_id`, so roles that grant `chat:create` at member (owner) scope, such as `agents-access` (Coder Agents User, the exact role in the customer report), were denied in every organization and the form always fell back to the default org. This part was split out and already landed on main via #28076; after rebasing, this PR relies on that fix and keeps its stricter regression stories around it. ## Changes - Derive the effective organization at render time: keep the user's explicit pick only while it is still permitted, otherwise fall back to the permitted default org, then the first permitted org, then the dashboard default. Replaces the transition-based reconciliation, which could not fire when the query cache was already warm on mount. - Keep user-driven org cleanup (workspace selection, attachments) in the picker/dialog event handlers; permission-driven changes are handled by render-time state adjustments and the attachment hook's post-commit adoption effect. - Disable Send until the permitted-organizations check settles and the attachment hook has adopted the effective org; hide the org picker and disable the workspace picker until the check settles (their pre-settlement options come from the unfiltered dashboard fallback, so a pick could persist a foreign-org workspace). - Scope persisted attachments to their organization in `useFileAttachments`: restoration defers until a permitted org is known, permission-driven org changes replace attachment state post-commit, in-flight uploads are invalidated by an adoption epoch (including A-to-B-to-A round trips), and no render exposes another org's file IDs, including when authorization resolves to no org at all. - Revalidate org-scoped state on permission refetches: a revoked explicit selection clears instead of lying latent, a settled effective-org change drops the stored workspace, and the org-change confirmation dialog closes (and re-checks on confirm) when its pending org is revoked. - Rebase reconciliation with #28076: the stories use its `permittedOrganizationsKey` helper and retain its `MemberScopedPermissionsShowOrgPicker` regression story alongside this PR's stricter member-scope stories. The backend RBAC rejection was correct; this is frontend-only. ## Testing - Red-green: every guard above was verified by reverting it and confirming exactly its guarding story or unit test fails (whole-file runs). - `pnpm -C site check`, `pnpm -C site lint`, `pnpm -C site lint:types`, full `AgentCreateForm.stories.tsx` (42 pass), `useFileAttachments.test.tsx` (8 pass), re-run after the rebase onto main. - Dogfood UAT on a licensed multi-org dev deployment at this branch: a restricted user with `agents-access` only in a non-default org sends first and warm-remount messages successfully (201, payload carries the permitted org, no 403); admin picker, workspace filtering, and attachment org-change dialog verified. Round 2 of UAT caught the missing `owner_id` (now landed via #28076); round 3 re-verified end to end. > Mux created this PR on Mike's behalf. |
||
|
Steven Masley
|
0d0f5b4392 |
test: skip racey tasks test (#28033)
tasks is being removed, so fixing tests is not worth it Closes: https://github.com/coder/internal/issues/1635 |
||
|
Susana FerreiraandNick Vigilante
|
3426f83a27 |
docs: use approximate spend and add Everyone group tip for AI Gateway cost controls (#28012)
## Summary Updates the AI Governance Cost Control docs in two ways: - **Terminology:** aligns the docs with the UI, which now labels spend as **approximate** rather than **estimated**. Renames the `Estimated spend` term, the "How spend is calculated" section (and its anchor and references), and updates the surrounding prose. - **Everyone group tip:** adds a note that, because the organization's `Everyone` group includes every member, its **Members** tab is a quick way for an admin to look up any user's effective group. This complements the existing Get user AI spend API endpoint, since there is no dedicated cost control page today. Related: https://github.com/coder/coder/pull/27977 --- _This PR was created by Coder Agents on behalf of @ssncferreira._ --------- Co-authored-by: Nick Vigilante <nickvigilante@users.noreply.github.com> |
||
|
TJ
|
49cbd7dde3 |
fix(site): keep standard avatar border for normal AI spend state (#28037)
The navbar avatar received a grey `border-content-secondary` override whenever AI spend data was present, so the default (normal spend) state looked different from a standard avatar. It also relied entirely on border color to communicate state, which is easy to miss and inaccessible to colorblind users. ## Changes - **Avatar border**: always standard — the severity border override is removed for all states. - **Warning / exceeded states** get a notification-style corner badge (like the inbox unread badge): - Warning: triangle-alert icon on the orange alert surface (`surface-orange` / `highlight-orange`). - Exceeded: octagon-alert icon on the red alert surface (`surface-red` / `highlight-red`). - Distinct icon shapes per state make the change perceivable without relying on color; surface/highlight token pairs keep the icon light on dark mode and dark on light mode. - **Accessibility**: the trigger now has a descriptive accessible name — `User menu`, `User menu. AI spend is nearing its limit`, or `User menu. AI spend limit exceeded`. Storybook: `AvatarBorderNormal/Warning/Exceeded` stories assert the trigger's accessible name per state, and Chromatic snapshots cover the visual states. <img width="604" height="542" alt="image" src="https://github.com/user-attachments/assets/3dab5700-c35b-44a6-abc5-7413254adeee" /> --- *This PR was generated by Coder Agents on behalf of @tracyjohnsonux.* |
||
|
Susana Ferreira
|
2d9b6eda8f |
feat: add experimental CLI to price unpriced AI models (#27926)
## Description AI Gateway computes the cost of an interception from `ai_model_prices`, which is seeded on every server start from a price book embedded in the binary. A model the price book does not cover records a NULL cost, so its spend is invisible to cost reporting and is not enforced against budgets. The only fix was to wait for a Coder release that added the model. This adds an experimental CLI, backed by an experimental HTTP endpoint, for pricing those models. Models the price book already covers are rejected, because the seeder re-applies the book on every start and would overwrite an operator price. Support for custom pricing will be handled in https://linear.app/codercom/issue/AIGOV-589/extend-experimental-cli-command-to-set-custom-ai-model-prices. ## Commands ``` coder exp ai-model-prices list [--provider] [--model] coder exp ai-model-prices update [file|-] [--provider] [--model] [--input-price] [--output-price] [--cache-read-price] [--cache-write-price] [--yes] ``` ## Changes - Add `GET` and `POST /api/experimental/ai/model-prices`, gated behind the AI Bridge entitlement and the existing `ai_model_price` RBAC resource. - Add a `GetAIModelPrices` query with optional `provider` and `model` filters applied in SQL. - Validate the whole request before writing anything, so one bad entry cannot leave the table half updated, and report every problem at once. - Reject prices for models the embedded price book already covers, through a new `prices.IsDefaultPriced`. - Add the `coder exp ai-model-prices` command with `list` and `update`. `update` accepts a JSON document or the single-model flags and prints a plan, asking to confirm unless the document is piped in or `--yes` is passed. - Consolidate the supported provider list into `coderd/aibridge/prices/providers` so the price generator and the server share one definition. - Add `codersdk` types and client methods for both endpoints, and bound the request body at 1 MiB. - Document the command in the AI Gateway cost controls page. Closes https://linear.app/codercom/issue/AIGOV-567/experimental-cli-command-to-set-prices-for-unpriced-ai-models > [!NOTE] > Initially generated by Claude Opus 5, modified and reviewed by @ssncferreira |
||
|
Danielle Maywood
|
abe9c79605 | feat(site/src/pages/AgentsPage): render list_subagent_models tool results (#28116) | ||
|
Hugo Dutka
|
bfa937a36a |
chore: update chatd ARCHITECTURE.md guidance in AGENTS.md (#28103)
Update the guidance related to chatd's `ARCHITECTURE.md` to avoid AI-slop in the document. |
||
|
dependabot[bot]
|
b2c70590db |
chore: bump the vite group across 1 directory with 2 updates (#28108)
Bumps the vite group with 2 updates in the /site directory: [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Updates `@vitejs/plugin-react` from 6.0.4 to 6.0.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite-plugin-react/releases">@vitejs/plugin-react's releases</a>.</em></p> <blockquote> <h2>plugin-react@6.0.5</h2> <h3>Fixed the react compiler preset filter to be linear (<a href="https://redirect.github.com/vitejs/vite-plugin-react/pull/1353">#1353</a>)</h3> <p>The improved filter in v6.0.3 was non-linear and caused a performance regression (<a href="https://redirect.github.com/vitejs/vite-plugin-react/issues/1349">#1349</a>). The filter was changed to be linear to avoid that.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md">@vitejs/plugin-react's changelog</a>.</em></p> <blockquote> <h2>6.0.5 (2026-07-30)</h2> <h3>Fixed the react compiler preset filter to be linear (<a href="https://redirect.github.com/vitejs/vite-plugin-react/pull/1353">#1353</a>)</h3> <p>The improved filter in v6.0.3 was non-linear and caused a performance regression (<a href="https://redirect.github.com/vitejs/vite-plugin-react/issues/1349">#1349</a>). The filter was changed to be linear to avoid that.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitejs/vite-plugin-react/commit/68c0cb8796ce18bd049c3d05c5210eaf0617eac0"><code>68c0cb8</code></a> release: plugin-react@6.0.5 (<a href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1362">#1362</a>)</li> <li><a href="https://github.com/vitejs/vite-plugin-react/commit/555cdbc126506317b05404481374406771a41e70"><code>555cdbc</code></a> fix(react): make the react compiler preset filter linear (<a href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1353">#1353</a>)</li> <li><a href="https://github.com/vitejs/vite-plugin-react/commit/a00a9f8240d5a7bb4062ee2a5bac68ea4f0defa6"><code>a00a9f8</code></a> fix(deps): update all non-major dependencies (<a href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1327">#1327</a>)</li> <li>See full diff in <a href="https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.0.5/packages/plugin-react">compare view</a></li> </ul> </details> <br /> Updates `vite` from 8.1.5 to 8.2.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/releases">vite's releases</a>.</em></p> <blockquote> <h2>create-vite@8.2.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/create-vite@8.2.0/packages/create-vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>plugin-legacy@8.2.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/plugin-legacy@8.2.0/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.2.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.2.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.2.0-beta.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.2.0-beta.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md">vite's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/vitejs/vite/compare/v8.2.0-beta.0...v8.2.0">8.2.0</a> (2026-07-30)</h2> <h3>Features</h3> <ul> <li>add <code>input</code> to <code>server.fs.allow</code> (<a href="https://redirect.github.com/vitejs/vite/issues/23035">#23035</a>) (<a href="https://github.com/vitejs/vite/commit/95a3cdab83e1125b03d2e8dd942fb6b64209e5fa">95a3cda</a>)</li> <li><strong>bundled-dev:</strong> reload once after rebuild instead of via the fallback page (<a href="https://redirect.github.com/vitejs/vite/issues/23106">#23106</a>) (<a href="https://github.com/vitejs/vite/commit/b24381d741941b9ce2b1c07db62cc5f4d7bad981">b24381d</a>)</li> <li><strong>bundled-dev:</strong> support worker file update accepted by HMR (<a href="https://redirect.github.com/vitejs/vite/issues/23068">#23068</a>) (<a href="https://github.com/vitejs/vite/commit/0d04351fdc12258c75b9f1cda5780fdb836ed0ef">0d04351</a>)</li> <li><strong>config:</strong> include column in config incompatibility location (<a href="https://redirect.github.com/vitejs/vite/issues/23064">#23064</a>) (<a href="https://github.com/vitejs/vite/commit/8a245726944ed29225920d49be77c33c6e03afc8">8a24572</a>)</li> <li><strong>dev:</strong> resolve interface name for explicit host in network URLs (<a href="https://redirect.github.com/vitejs/vite/issues/22965">#22965</a>) (<a href="https://github.com/vitejs/vite/commit/3ac77d9dd742968961af38a5a91ed6b061ceda7d">3ac77d9</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li><strong>bundledDev:</strong> print build errors to the terminal when an HMR update fails (<a href="https://redirect.github.com/vitejs/vite/issues/23024">#23024</a>) (<a href="https://github.com/vitejs/vite/commit/41c465896e8b11b1eb9c5fbdafbdcc528e189a2c">41c4658</a>)</li> <li><strong>deps:</strong> update all non-major dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/23069">#23069</a>) (<a href="https://github.com/vitejs/vite/commit/4c07b74416f859d7e8bdace13409ef2d080edf76">4c07b74</a>)</li> <li><strong>hmr:</strong> preserve environment snapshot during server restart (<a href="https://redirect.github.com/vitejs/vite/issues/22992">#22992</a>) (<a href="https://github.com/vitejs/vite/commit/b1186c36d06bb94941c58e8272fc4acb8512c93b">b1186c3</a>)</li> <li><strong>importAnalysis:</strong> interop imports injected into optimized dep files by plugins (<a href="https://redirect.github.com/vitejs/vite/issues/23029">#23029</a>) (<a href="https://github.com/vitejs/vite/commit/8c2a87d41fb24536e59643351758084cde4d0dd7">8c2a87d</a>)</li> <li><strong>module-runner:</strong> keep stack trace interception working when <code>Object.prototype</code> is frozen (<a href="https://redirect.github.com/vitejs/vite/issues/23073">#23073</a>) (<a href="https://github.com/vitejs/vite/commit/599c5b02a8b6879b05ede988020f1331e877aaea">599c5b0</a>)</li> <li><strong>server:</strong> strip base in indexHtml module graph lookup (<a href="https://redirect.github.com/vitejs/vite/issues/22932">#22932</a>) (<a href="https://github.com/vitejs/vite/commit/fa005d19af5d847931c6dbefc63841c137383e6c">fa005d1</a>)</li> <li>support resolving top-level input option with plugins (<a href="https://redirect.github.com/vitejs/vite/issues/23101">#23101</a>) (<a href="https://github.com/vitejs/vite/commit/41df81a6a4c3eef08f7a9a8ac9530cd136c0eafa">41df81a</a>)</li> </ul> <h3>Documentation</h3> <ul> <li><strong>config:</strong> correct cacheDir default fallback description (<a href="https://redirect.github.com/vitejs/vite/issues/23060">#23060</a>) (<a href="https://github.com/vitejs/vite/commit/aafa103af5d71fb59d7c3dd617d0cbef3b222f1f">aafa103</a>)</li> </ul> <h3>Tests</h3> <ul> <li>config CJS module vars in ESM case (<a href="https://redirect.github.com/vitejs/vite/issues/23010">#23010</a>) (<a href="https://github.com/vitejs/vite/commit/d8cd38830251b95fd7dddcd0eee0ce94cc61c2f4">d8cd388</a>)</li> </ul> <h2><a href="https://github.com/vitejs/vite/compare/v8.1.5...v8.2.0-beta.0">8.2.0-beta.0</a> (2026-07-22)</h2> <h3>Features</h3> <ul> <li>add <code>input</code> option (<a href="https://redirect.github.com/vitejs/vite/issues/22642">#22642</a>) (<a href="https://github.com/vitejs/vite/commit/9beae37d7221b25463a011feb40b0303ca328d87">9beae37</a>)</li> <li><strong>config:</strong> warn features incompatible with native loader in bundle loader (<a href="https://redirect.github.com/vitejs/vite/issues/22850">#22850</a>) (<a href="https://github.com/vitejs/vite/commit/05302b07267f6b4f9dbeac5b1d73fcc3dc06d730">05302b0</a>)</li> <li><strong>css:</strong> export PostCSS config type for type-safe configs (<a href="https://redirect.github.com/vitejs/vite/issues/22792">#22792</a>) (<a href="https://github.com/vitejs/vite/commit/302c755a8125b9a26214e3b413922b5513e41981">302c755</a>)</li> <li><strong>dev:</strong> label network URLs with their interface name (<a href="https://redirect.github.com/vitejs/vite/issues/22830">#22830</a>) (<a href="https://github.com/vitejs/vite/commit/78accc42a5b8887d9df624f7d4a934d3ead677d1">78accc4</a>)</li> <li><strong>optimizer:</strong> support aube lockfile (<a href="https://redirect.github.com/vitejs/vite/issues/22813">#22813</a>) (<a href="https://github.com/vitejs/vite/commit/6319827116c5be2a19c1b91c84ba3d38ad26a41c">6319827</a>)</li> <li><strong>optimizer:</strong> support nub lockfile (<a href="https://redirect.github.com/vitejs/vite/issues/22891">#22891</a>) (<a href="https://github.com/vitejs/vite/commit/65d3604f6fdbfcf6e86244d7fe3c1ca86acae701">65d3604</a>)</li> <li>update rolldown-related dependencies and use client-side HMR in bundled-dev (<a href="https://redirect.github.com/vitejs/vite/issues/22961">#22961</a>) (<a href="https://github.com/vitejs/vite/commit/960e9efbc1372000caac46cc2f123cef4824e2bb">960e9ef</a>)</li> <li><strong>wasm:</strong> expand test suite, unwrap WebAssembly.Global and enable js-string builtins (<a href="https://redirect.github.com/vitejs/vite/issues/22674">#22674</a>) (<a href="https://github.com/vitejs/vite/commit/9e79b51579457a9af4fa623b68a0bfabbf38010b">9e79b51</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li><strong>build:</strong> map CSS chunks in chunk import maps (fix <a href="https://redirect.github.com/vitejs/vite/issues/22946">#22946</a>) (<a href="https://redirect.github.com/vitejs/vite/issues/22947">#22947</a>) (<a href="https://github.com/vitejs/vite/commit/e16ff3a1199293ac9cdfa6132c08fdea162215f3">e16ff3a</a>)</li> <li><strong>config:</strong> exclude virtual modules from native config compat check (<a href="https://redirect.github.com/vitejs/vite/issues/22979">#22979</a>) (<a href="https://github.com/vitejs/vite/commit/2ced1fe4e4e480ed78cb7aa5c78319e57bfa7783">2ced1fe</a>)</li> <li><strong>css:</strong> rewrite urls in OnceExit-injected content (<a href="https://redirect.github.com/vitejs/vite/issues/22983">#22983</a>) (<a href="https://github.com/vitejs/vite/commit/abb793e18c92592c21fbb8e1f3fc450b5839f04f">abb793e</a>)</li> <li><strong>deps:</strong> update all non-major dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/22985">#22985</a>) (<a href="https://github.com/vitejs/vite/commit/04f345b37064cd0bba6447eb5c32be5c22162f3d">04f345b</a>)</li> <li><strong>deps:</strong> update dependency magic-string to v1 (<a href="https://redirect.github.com/vitejs/vite/issues/22998">#22998</a>) (<a href="https://github.com/vitejs/vite/commit/c60b4d7cdb85b7d4f78671cdcfb863e5f8b66bb7">c60b4d7</a>)</li> <li><strong>hmr:</strong> remove hot data after prune (<a href="https://redirect.github.com/vitejs/vite/issues/23002">#23002</a>) (<a href="https://github.com/vitejs/vite/commit/be9631658f5191ee5c5665e780239d42a330280a">be96316</a>)</li> <li>resolve root to real path (<a href="https://redirect.github.com/vitejs/vite/issues/22832">#22832</a>) (<a href="https://github.com/vitejs/vite/commit/55bba7bbd9de40d031360e4408fe91bff5b29ec9">55bba7b</a>)</li> </ul> <h3>Performance Improvements</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitejs/vite/commit/24a611f1c83a976d32262628d42f683609746635"><code>24a611f</code></a> release: v7.2.4</li> <li><a href="https://github.com/vitejs/vite/commit/2d66b7b14aa6dfd62f3d6a59ee8382ed5ca6fd32"><code>2d66b7b</code></a> fix: revert "perf(deps): replace debug with obug (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21107">#21107</a>)"</li> <li><a href="https://github.com/vitejs/vite/commit/a668014dba377c2b82a32d8124f1761e9ea74f82"><code>a668014</code></a> release: v7.2.3</li> <li><a href="https://github.com/vitejs/vite/commit/acfe939e1f7c303c34b0b39b883cc302da767fa2"><code>acfe939</code></a> perf(deps): replace debug with obug (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21107">#21107</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/4f8171eb3046bd70c83964689897dab4c6b58bc0"><code>4f8171e</code></a> fix(deps): update all non-major dependencies (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21128">#21128</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/50297208452241061cb44d09a4bbdf77a11ac01e"><code>5029720</code></a> chore(deps): update rolldown-related dependencies (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21127">#21127</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/5909efd8fbfd1bf1eab65427aea0613124b2797a"><code>5909efd</code></a> fix: allow multiple <code>bindCLIShortcuts</code> calls with shortcut merging (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21103">#21103</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/39a0a15fd24ed37257c48b795097a3794e54d255"><code>39a0a15</code></a> chore(deps): update rolldown-related dependencies (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21095">#21095</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/6a34ac3422686e7cf7cc9a25d299cb8e5a8d92a0"><code>6a34ac3</code></a> fix(deps): update all non-major dependencies (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21096">#21096</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/02ceaec45e17bef19159188a28d9196fed1761be"><code>02ceaec</code></a> chore(deps): update dependency <code>@rollup/plugin-commonjs</code> to v29 (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21099">#21099</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vitejs/vite/commits/create-vite@8.2.0/packages/vite">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
f09cb20b1e |
ci: bump dorny/paths-filter from 4.0.2 to 4.0.3 in the github-actions group (#28119)
Bumps the github-actions group with 1 update: [dorny/paths-filter](https://github.com/dorny/paths-filter). Updates `dorny/paths-filter` from 4.0.2 to 4.0.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/dorny/paths-filter/releases">dorny/paths-filter's releases</a>.</em></p> <blockquote> <h2>v4.0.3</h2> <h2>What's Changed</h2> <ul> <li>Update Outputs in readme to account for the 'every' predicate-quantifier by <a href="https://github.com/hintron"><code>@hintron</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/247">dorny/paths-filter#247</a></li> <li>fix: scope base-ignored warning to API path by <a href="https://github.com/saschabratton"><code>@saschabratton</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/319">dorny/paths-filter#319</a></li> <li>docs: add contents permission to PR example by <a href="https://github.com/134130"><code>@134130</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/248">dorny/paths-filter#248</a></li> <li>feat: add 'some-with-excludes' predicate quantifier by <a href="https://github.com/arxeiss"><code>@arxeiss</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/322">dorny/paths-filter#322</a></li> <li>Document safe handling of file list outputs in workflows by <a href="https://github.com/dorny"><code>@dorny</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/326">dorny/paths-filter#326</a></li> </ul> <h2>Security</h2> <ul> <li>Escape multi-line filenames in list-files shell and csv output] by <a href="https://github.com/ken-matsui"><code>@ken-matsui</code></a> and <a href="https://github.com/tjswlsgg"><code>@tjswlsgg</code></a> in <a href="https://github.com/advisories/GHSA-7hc6-8hq5-9q2m">https://github.com/advisories/GHSA-7hc6-8hq5-9q2m</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/hintron"><code>@hintron</code></a> made their first contribution in <a href="https://redirect.github.com/dorny/paths-filter/pull/247">dorny/paths-filter#247</a></li> <li><a href="https://github.com/134130"><code>@134130</code></a> made their first contribution in <a href="https://redirect.github.com/dorny/paths-filter/pull/248">dorny/paths-filter#248</a></li> <li><a href="https://github.com/arxeiss"><code>@arxeiss</code></a> made their first contribution in <a href="https://redirect.github.com/dorny/paths-filter/pull/322">dorny/paths-filter#322</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/dorny/paths-filter/compare/v4...v4.0.3">https://github.com/dorny/paths-filter/compare/v4...v4.0.3</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md">dorny/paths-filter's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v4.0.3</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/326">Document safe handling of file list outputs in workflows</a></li> <li><a href="https://github.com/advisories/GHSA-7hc6-8hq5-9q2m">Escape multi-line filenames in list-files shell and csv output</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/322">Add 'some-with-excludes' predicate quantifier</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/248">Add contents permission to PR example</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/319">Scope base-ignored warning to API path</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/247">Update outputs in readme to account for the 'every' predicate-quantifier</a></li> </ul> <h2>v4.0.2</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/317">Work around git dubious ownership errors in container jobs</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/303">Use rev-parse instead of branch --show-current for older git compat</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/282">Fix warning message</a></li> </ul> <h2>v4.0.1</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/255">Support merge queue</a></li> </ul> <h2>v4.0.0</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/294">Update action runtime to node24</a></li> </ul> <h2>v3.0.4</h2> <ul> <li><a href="https://github.com/advisories/GHSA-7hc6-8hq5-9q2m">Escape multi-line filenames in list-files shell and csv output</a></li> </ul> <h2>v3.0.3</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/279">Add missing predicate-quantifier</a></li> </ul> <h2>v3.0.2</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/224">Add config parameter for predicate quantifier</a></li> </ul> <h2>v3.0.1</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/133">Compare base and ref when token is empty</a></li> </ul> <h2>v3.0.0</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/210">Update to Node.js 20</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/215">Update all dependencies</a></li> </ul> <h2>v2.11.1</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/167">Update @actions/core to v1.10.0 - Fixes warning about deprecated set-output</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/168">Document need for pull-requests: read permission</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/164">Updating to actions/checkout@v3</a></li> </ul> <h2>v2.11.0</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/157">Set list-files input parameter as not required</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/161">Update Node.js</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/162">Fix incorrect handling of Unicode characters in exec()</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/163">Use Octokit pagination</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/160">Updates real world links</a></li> </ul> <h2>v2.10.2</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/dorny/paths-filter/commit/ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d"><code>ceb8a2b</code></a> Update CHANGELOG.md for v4.0.3 and v3.0.4 (<a href="https://redirect.github.com/dorny/paths-filter/issues/327">#327</a>)</li> <li><a href="https://github.com/dorny/paths-filter/commit/ef09b88f3eacdbec6ce135a7c9a193a6849545c1"><code>ef09b88</code></a> Document safe handling of file list outputs in workflows (<a href="https://redirect.github.com/dorny/paths-filter/issues/326">#326</a>)</li> <li><a href="https://github.com/dorny/paths-filter/commit/44adc5b06dc135dba334efce9bf3cf0624512d2d"><code>44adc5b</code></a> Merge commit from fork</li> <li><a href="https://github.com/dorny/paths-filter/commit/4711b7a31b4aa89103d8c6ffab2e3b8e7b6381c7"><code>4711b7a</code></a> feat: add 'some-with-excludes' predicate quantifier (<a href="https://redirect.github.com/dorny/paths-filter/issues/322">#322</a>)</li> <li><a href="https://github.com/dorny/paths-filter/commit/93c889f9e58fca66f35a0c83d8673ac7e88bb70a"><code>93c889f</code></a> fix: escape multi-line filenames in list-files shell and csv output</li> <li><a href="https://github.com/dorny/paths-filter/commit/b41dfa943b1939b9b646f67753bfe35cf6e4de03"><code>b41dfa9</code></a> docs: add contents permission to PR example (<a href="https://redirect.github.com/dorny/paths-filter/issues/248">#248</a>)</li> <li><a href="https://github.com/dorny/paths-filter/commit/9af6e5a9d010d1ae8ec570390b3d793e2b70a402"><code>9af6e5a</code></a> fix: scope base-ignored warning to API path (<a href="https://redirect.github.com/dorny/paths-filter/issues/319">#319</a>)</li> <li><a href="https://github.com/dorny/paths-filter/commit/cae9006b65a1a53044b518c68e13e835c54948a7"><code>cae9006</code></a> docs: update outputs in readme to account for the 'every' predicate-quantifie...</li> <li>See full diff in <a href="https://github.com/dorny/paths-filter/compare/7b450fff21473bca461d4b92ce414b9d0420d706...ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
314897631d |
chore: bump @types/lodash from 4.17.24 to 4.17.25 in /site (#28114)
Bumps [@types/lodash](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/lodash) from 4.17.24 to 4.17.25. <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/lodash">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
f792ba45fd |
chore: bump postcss from 8.5.18 to 8.5.26 in /site (#28113)
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.18 to 8.5.26. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/postcss/postcss/releases">postcss's releases</a>.</em></p> <blockquote> <h2>8.5.26</h2> <ul> <li>Fixed <code>list.split()</code> regression (by <a href="https://github.com/lazerg"><code>@lazerg</code></a>).</li> <li>Track symlinks in path protection in source map loading (by <a href="https://github.com/drengir1"><code>@drengir1</code></a>).</li> </ul> <h2>8.5.25</h2> <ul> <li>Fixed 8.5.17 visitor regression.</li> <li>Fixed <code>list.split()</code> for non-string values (by <a href="https://github.com/amir-rezaei"><code>@amir-rezaei</code></a>).</li> </ul> <h2>8.5.24</h2> <ul> <li>Preserve the BOM after the processing (by <a href="https://github.com/hdimer"><code>@hdimer</code></a>).</li> </ul> <h2>8.5.23</h2> <ul> <li>Do not load source map without <code>opts.from</code> for security reasons.</li> </ul> <h2>8.5.22</h2> <ul> <li>Fixed custom property losing semicolon before a comment (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> </ul> <h2>8.5.21</h2> <ul> <li>Fixed childless at-rule losing semicolon before comment (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> <li>Fixed docs (by <a href="https://github.com/isker"><code>@isker</code></a>).</li> </ul> <h2>8.5.20</h2> <ul> <li>Fixed missing space if <code>AtRule#params</code> is set after (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> <li>Fixed mixing AST error on warnings (by <a href="https://github.com/MahinAnowar"><code>@MahinAnowar</code></a>).</li> </ul> <h2>8.5.19</h2> <ul> <li>Fixed cleaning <code>before</code> for new nodes inserted to <code>Root</code> (by <a href="https://github.com/MahinAnowar"><code>@MahinAnowar</code></a>).</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/postcss/postcss/blob/main/CHANGELOG.md">postcss's changelog</a>.</em></p> <blockquote> <h2>8.5.26</h2> <ul> <li>Fixed <code>list.split()</code> regression (by <a href="https://github.com/lazerg"><code>@lazerg</code></a>).</li> <li>Track symlinks in path protection in source map loading (by <a href="https://github.com/drengir1"><code>@drengir1</code></a>).</li> </ul> <h2>8.5.25</h2> <ul> <li>Fixed 8.5.17 visitor regression.</li> <li>Fixed <code>list.split()</code> for non-string values (by <a href="https://github.com/amir-rezaei"><code>@amir-rezaei</code></a>).</li> </ul> <h2>8.5.24</h2> <ul> <li>Preserve the BOM after the processing (by <a href="https://github.com/hdimer"><code>@hdimer</code></a>).</li> </ul> <h2>8.5.23</h2> <ul> <li>Do not load source map without <code>opts.from</code> for security reasons.</li> </ul> <h2>8.5.22</h2> <ul> <li>Fixed custom property losing semicolon before a comment (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> </ul> <h2>8.5.21</h2> <ul> <li>Fixed childless at-rule losing semicolon before comment (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> <li>Fixed docs (by <a href="https://github.com/isker"><code>@isker</code></a>).</li> </ul> <h2>8.5.20</h2> <ul> <li>Fixed missing space if <code>AtRule#params</code> is set after (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> <li>Fixed mixing AST error on warnings (by <a href="https://github.com/MahinAnowar"><code>@MahinAnowar</code></a>).</li> </ul> <h2>8.5.19</h2> <ul> <li>Fixed cleaning <code>before</code> for new nodes inserted to <code>Root</code> (by <a href="https://github.com/MahinAnowar"><code>@MahinAnowar</code></a>).</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/postcss/postcss/commit/07b25773f38f77919f2af02ae3e8896b0deb5988"><code>07b2577</code></a> Release 8.5.26 version</li> <li><a href="https://github.com/postcss/postcss/commit/47de6b9d7c55674cb326c5de7a734a740916defc"><code>47de6b9</code></a> Update CI</li> <li><a href="https://github.com/postcss/postcss/commit/1493a83db7830912316512f55ab6064e7b7dd68e"><code>1493a83</code></a> Fix Rule#selectors losing the empty selector (<a href="https://redirect.github.com/postcss/postcss/issues/2129">#2129</a>)</li> <li><a href="https://github.com/postcss/postcss/commit/180db166e250d20e6761b224ae8d8134c9ba3e40"><code>180db16</code></a> Typo</li> <li><a href="https://github.com/postcss/postcss/commit/29e9e00f132c96e46e1de295b816fe88a05354e7"><code>29e9e00</code></a> Resolve symlinks before the previous-source-map containment check (<a href="https://redirect.github.com/postcss/postcss/issues/2125">#2125</a>)</li> <li><a href="https://github.com/postcss/postcss/commit/3ba8f84703a884329b58abea579c3615684e0b7e"><code>3ba8f84</code></a> Update dependencies</li> <li><a href="https://github.com/postcss/postcss/commit/87e72f671fd0d401c52822b5226c656632d92ec0"><code>87e72f6</code></a> Update lock file</li> <li><a href="https://github.com/postcss/postcss/commit/caaeeb907e4a816c44a23b00b151882bd02325a1"><code>caaeeb9</code></a> Upgrade nanoid to fix infinite loop on zero size (<a href="https://redirect.github.com/postcss/postcss/issues/2124">#2124</a>)</li> <li><a href="https://github.com/postcss/postcss/commit/3609b6f4296952d0b5b9ddae42c8d73ee460c041"><code>3609b6f</code></a> Explain how to type plugin options</li> <li><a href="https://github.com/postcss/postcss/commit/fbad419cbd01cd7a9a1a46413447f2cd9b3fce4a"><code>fbad419</code></a> docs: show ESM and TypeScript plugin declaration (<a href="https://redirect.github.com/postcss/postcss/issues/2118">#2118</a>)</li> <li>Additional commits viewable in <a href="https://github.com/postcss/postcss/compare/8.5.18...8.5.26">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
a742b53b26 |
chore: bump motion from 12.42.2 to 12.43.0 in /site (#28111)
Bumps [motion](https://github.com/motiondivision/motion) from 12.42.2 to 12.43.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/motiondivision/motion/blob/main/CHANGELOG.md">motion's changelog</a>.</em></p> <blockquote> <h2>[12.43.0] 2026-07-27</h2> <h3>Added</h3> <ul> <li>Hardware acceleration for <code>backgroundColor</code> in supported browsers.</li> <li>Hardware acceleration for SVG elements.</li> </ul> <h3>Fixed</h3> <ul> <li><code>AnimatePresence</code>: Exiting children no longer interleave with entering children, which could reorder and remount children present in both renders.</li> <li><code>motion</code>: Throw error when passing a custom <code>motion</code> component an incorrect <code>ref</code> type.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/motiondivision/motion/commit/a4ef40a5dd378205a41dbb19e7fad04e3280607f"><code>a4ef40a</code></a> v12.43.0</li> <li><a href="https://github.com/motiondivision/motion/commit/14f2d286d1b0805ca8a34b41f9c4122a36e215eb"><code>14f2d28</code></a> adding svg acceleration</li> <li><a href="https://github.com/motiondivision/motion/commit/1f5a27b828d42574ff3dfffa29f77da613d84eb2"><code>1f5a27b</code></a> Fixing merge</li> <li><a href="https://github.com/motiondivision/motion/commit/79f03532429c6abee2de5161e3ca1594aa2d61f0"><code>79f0353</code></a> Updating changelog</li> <li><a href="https://github.com/motiondivision/motion/commit/57f179b1beaec64da990ca914c18697f87265b4f"><code>57f179b</code></a> Updating changelog</li> <li><a href="https://github.com/motiondivision/motion/commit/695cb3954d4df55ca0794bc95f084b377e4f5f4f"><code>695cb39</code></a> Merge pull request <a href="https://redirect.github.com/motiondivision/motion/issues/3755">#3755</a> from motiondivision/fix-issue-2777</li> <li><a href="https://github.com/motiondivision/motion/commit/33a1820f6c35e9b206eca277e059415b07ddafde"><code>33a1820</code></a> Drop the production fallback for non-DOM refs</li> <li><a href="https://github.com/motiondivision/motion/commit/ebe35f223ddda0806af8d8335e7f053115d67d4b"><code>ebe35f2</code></a> Throw an actionable invariant for non-DOM custom component refs</li> <li><a href="https://github.com/motiondivision/motion/commit/a6ed0946a338256f660560500861b09c2b8a20d2"><code>a6ed094</code></a> Merge pull request <a href="https://redirect.github.com/motiondivision/motion/issues/3754">#3754</a> from motiondivision/fix-3745-popchild-ref-warning</li> <li><a href="https://github.com/motiondivision/motion/commit/9f251f3377766a6bf97a93c1634c4e51a7408ccf"><code>9f251f3</code></a> Merge pull request <a href="https://redirect.github.com/motiondivision/motion/issues/3763">#3763</a> from motiondivision/advisor/003-color-waapi</li> <li>Additional commits viewable in <a href="https://github.com/motiondivision/motion/compare/v12.42.2...v12.43.0">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |