1356 Commits

Include renames

Author	SHA1	Message	Date
Denis Afonso	f77d0065ed	fix: correct gvisor replace directive to match module path (#26822) ... ## Summary Fixes the gvisor `replace` directive in `go.mod` to target the correct module path. ## Problem PR #23055 added a replace directive to use the coder/gvisor fork (which fixes an integer overflow causing `panic: length < 0` crashes). However, the directive targeted the wrong module path: ``` replace gvisor.dev => github.com/coder/gvisor v0.0.0-20260313164934-7a658db7b714 ``` The actual module path declared in gvisor's `go.mod` is `gvisor.dev/gvisor`, not `gvisor.dev`. Go module replace directives require an exact module path match, so the previous directive was a no-op and the patched fork was never used. ## Fix ```diff -replace gvisor.dev => github.com/coder/gvisor v0.0.0-20260313164934-7a658db7b714 +replace gvisor.dev/gvisor => github.com/coder/gvisor v0.0.0-20260313164934-7a658db7b714 ``` ## Validation Verified locally with `go list -m`: **Before (no-op replace):** ``` $ go list -m gvisor.dev/gvisor gvisor.dev/gvisor v0.0.0-20240509041132-65b30f7869dc ``` **After (correct replace):** ``` $ go list -m gvisor.dev/gvisor gvisor.dev/gvisor v0.0.0-20240509041132-65b30f7869dc => github.com/coder/gvisor v0.0.0-20260313164934-7a658db7b714 ``` The `=>` confirms the fork is now applied. Fixes https://github.com/coder/coder/issues/20885 --- <details> <summary>Investigation context</summary> - The coder/gvisor fork (commit `7a658db7b714`) declares `module gvisor.dev/gvisor` in its go.mod - Customer runtime stack traces show `gvisor.dev/gvisor@v0.0.0-20240509041132-65b30f7869dc` (unpatched upstream), confirming the fork was not applied - The crash is `panic: length < 0` in `gvisor.dev/gvisor/pkg/tcpip/transport/tcp.(*sender).splitSeg` - Related Linear ticket: ENT-118 </details> --- *Generated by [Coder Agents](https://coder.com/agents) on behalf of @denisra*	2026-07-01 17:11:47 +01:00
dependabot[bot]	681d77154b	chore: bump github.com/valyala/fasthttp from 1.71.0 to 1.72.0 (#26859) ... Bumps [github.com/valyala/fasthttp](https://github.com/valyala/fasthttp) from 1.71.0 to 1.72.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/valyala/fasthttp/releases">github.com/valyala/fasthttp's releases</a>.</em></p> <blockquote> <h2>v1.72.0</h2> <h2>What's Changed</h2> <ul> <li>Update to go1.25 as minimal version by <a href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2205">valyala/fasthttp#2205</a></li> <li>client: add aggregate connection count metrics by <a href="https://github.com/z9z"><code>@​z9z</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2201">valyala/fasthttp#2201</a></li> <li>fix(server): return ErrMissingFile when MultipartForm.File is nil by <a href="https://github.com/u5surf"><code>@​u5surf</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2260">valyala/fasthttp#2260</a></li> <li>bug: FS cache cleaner goroutine leaks when CleanStop is nil (default) (<a href="https://redirect.github.com/valyala/fasthttp/issues/2218">#2218</a>), <a href="https://redirect.github.com/valyala/fasthttp/issues/2247">#2247</a> by <a href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2271">valyala/fasthttp#2271</a></li> <li>bug: data race on pipeline client c.chR during worker drain (<a href="https://redirect.github.com/valyala/fasthttp/issues/2220">#2220</a>) by <a href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2272">valyala/fasthttp#2272</a></li> <li>bug: TCPDialer.tcpAddrsClean() goroutine leaks — no shutdown mechanism (<a href="https://redirect.github.com/valyala/fasthttp/issues/2222">#2222</a>) by <a href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2273">valyala/fasthttp#2273</a></li> <li>bug: double concurrency counter increment in ServeConn causes counter leak (<a href="https://redirect.github.com/valyala/fasthttp/issues/2238">#2238</a>) by <a href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2275">valyala/fasthttp#2275</a></li> <li>bug: body stream leak in compression methods when response is discarded (<a href="https://redirect.github.com/valyala/fasthttp/issues/2244">#2244</a>) by <a href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2276">valyala/fasthttp#2276</a></li> <li>bug: InMemoryListener deadlock under high concurrency (<a href="https://redirect.github.com/valyala/fasthttp/issues/2245">#2245</a>) by <a href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2277">valyala/fasthttp#2277</a></li> <li>bug: fasthttpadaptor writer leak, data race, and crash on handler panic (<a href="https://redirect.github.com/valyala/fasthttp/issues/2246">#2246</a>) by <a href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2278">valyala/fasthttp#2278</a></li> <li>bug: fasthttpproxy dialers return nil DialFunc on error, causing panic (<a href="https://redirect.github.com/valyala/fasthttp/issues/2248">#2248</a>) by <a href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2279">valyala/fasthttp#2279</a></li> <li>bug: closeIdleConns TOCTOU race with serveConn idle timestamp (<a href="https://redirect.github.com/valyala/fasthttp/issues/2250">#2250</a>) by <a href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2280">valyala/fasthttp#2280</a></li> <li>bug: AppendCert/AppendCertEmbed not thread-safe (<a href="https://redirect.github.com/valyala/fasthttp/issues/2251">#2251</a>) by <a href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2281">valyala/fasthttp#2281</a></li> <li>bug: SetBodySizePoolLimit data race — plain int written without synchronization (<a href="https://redirect.github.com/valyala/fasthttp/issues/2252">#2252</a>) by <a href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2282">valyala/fasthttp#2282</a></li> <li>bug: file descriptor leak in prefork parent process (<a href="https://redirect.github.com/valyala/fasthttp/issues/2253">#2253</a>) by <a href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2283">valyala/fasthttp#2283</a></li> <li>security: SO_REUSEADDR on Windows enables port hijacking (<a href="https://redirect.github.com/valyala/fasthttp/issues/2254">#2254</a>) by <a href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2284">valyala/fasthttp#2284</a></li> <li>bug: file descriptor leak on z/OS s390x when FcntlInt fails (<a href="https://redirect.github.com/valyala/fasthttp/issues/2255">#2255</a>) by <a href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2285">valyala/fasthttp#2285</a></li> <li>bug: filesLockMap grows unboundedly, leaking memory (<a href="https://redirect.github.com/valyala/fasthttp/issues/2256">#2256</a>) by <a href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2286">valyala/fasthttp#2286</a></li> <li>security: TLS verification silently disabled for malformed addresses (<a href="https://redirect.github.com/valyala/fasthttp/issues/2236">#2236</a>) by <a href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2274">valyala/fasthttp#2274</a></li> <li>fix(fs): remove temporary file when compression fails by <a href="https://github.com/u5surf"><code>@​u5surf</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2264">valyala/fasthttp#2264</a></li> <li>fix double release of streamed client response body by <a href="https://github.com/Mereng"><code>@​Mereng</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2211">valyala/fasthttp#2211</a></li> <li>fix(client): switch to GET on 303 redirect per RFC 9110 by <a href="https://github.com/u5surf"><code>@​u5surf</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2265">valyala/fasthttp#2265</a></li> <li>ci: re-enable gocritic deferInLoop check for non-test code by <a href="https://github.com/u5surf"><code>@​u5surf</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2288">valyala/fasthttp#2288</a></li> <li>Fix flaky race tests by <a href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2292">valyala/fasthttp#2292</a></li> <li>fix(lbclient): prevent deadlock when all clients are removed by <a href="https://github.com/u5surf"><code>@​u5surf</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2287">valyala/fasthttp#2287</a></li> <li>reject duplicate Content-Length in response header parser by <a href="https://github.com/alhudz"><code>@​alhudz</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2294">valyala/fasthttp#2294</a></li> <li>strip cr/lf from header keys in normalizeHeaderKey by <a href="https://github.com/alhudz"><code>@​alhudz</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2295">valyala/fasthttp#2295</a></li> <li>fix(client): guard nil waiter in decConnsCount by <a href="https://github.com/SAY-5"><code>@​SAY-5</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2266">valyala/fasthttp#2266</a></li> <li>strip semicolons from cookie setters to block attribute injection by <a href="https://github.com/alhudz"><code>@​alhudz</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2298">valyala/fasthttp#2298</a></li> <li>feat(prefork): graceful shutdown, leak fixes, hook robustness (re-open of <a href="https://redirect.github.com/valyala/fasthttp/issues/2180">#2180</a> follow-up) by <a href="https://github.com/ReneWerner87"><code>@​ReneWerner87</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2199">valyala/fasthttp#2199</a></li> <li>fix: prevent data race on FSCompressedFileSuffixes map by <a href="https://github.com/xbrxr03"><code>@​xbrxr03</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2300">valyala/fasthttp#2300</a></li> <li>reject duplicate Transfer-Encoding in request header parser by <a href="https://github.com/alhudz"><code>@​alhudz</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2303">valyala/fasthttp#2303</a></li> <li>preserve duplicate request headers in ConvertRequest by <a href="https://github.com/alhudz"><code>@​alhudz</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2305">valyala/fasthttp#2305</a></li> <li>fix(server): close listener on serve error in ListenAndServe helpers by <a href="https://github.com/fereidani"><code>@​fereidani</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2304">valyala/fasthttp#2304</a></li> <li>validate trailer values in parseTrailer by <a href="https://github.com/alhudz"><code>@​alhudz</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2301">valyala/fasthttp#2301</a></li> <li>Avoid default content type for empty requests by <a href="https://github.com/nkgotcode"><code>@​nkgotcode</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2296">valyala/fasthttp#2296</a></li> <li>chore(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2210">valyala/fasthttp#2210</a></li> <li>chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2209">valyala/fasthttp#2209</a></li> <li>chore(deps): bump golang.org/x/sys from 0.44.0 to 0.45.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2208">valyala/fasthttp#2208</a></li> <li>chore(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2207">valyala/fasthttp#2207</a></li> <li>chore(deps): bump securego/gosec from 2.26.1 to 2.27.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2261">valyala/fasthttp#2261</a></li> <li>chore(deps): bump securego/gosec from 2.27.0 to 2.27.1 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2267">valyala/fasthttp#2267</a></li> <li>chore(deps): bump golang.org/x/sys from 0.45.0 to 0.46.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2289">valyala/fasthttp#2289</a></li> <li>chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2290">valyala/fasthttp#2290</a></li> <li>chore(deps): bump golang.org/x/net from 0.55.0 to 0.56.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2291">valyala/fasthttp#2291</a></li> <li>chore(deps): bump actions/checkout from 6 to 7 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2297">valyala/fasthttp#2297</a></li> </ul> <h2>New Contributors</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/valyala/fasthttp/commit/37a31d78c5d221b24b9cb6652481b5acd4dd674f"><code>37a31d7</code></a> Avoid default content type for empty requests (<a href="https://redirect.github.com/valyala/fasthttp/issues/2296">#2296</a>)</li> <li><a href="https://github.com/valyala/fasthttp/commit/d93cb94af2c31641d00025140785609ddd746eb3"><code>d93cb94</code></a> validate trailer values in parseTrailer (<a href="https://redirect.github.com/valyala/fasthttp/issues/2301">#2301</a>)</li> <li><a href="https://github.com/valyala/fasthttp/commit/9d21d3546ab1d8422b0b5b2801e46aef568619ce"><code>9d21d35</code></a> Remove unused uint322ip, inline ip2uint32</li> <li><a href="https://github.com/valyala/fasthttp/commit/eb82c9a13addbe488f69cbf530444bb2561fd083"><code>eb82c9a</code></a> Reject invalid cookie values during parsing</li> <li><a href="https://github.com/valyala/fasthttp/commit/598e2e06218dbcaf4da6b3723477effd9d7b6233"><code>598e2e0</code></a> fix(server): close listener on serve error in ListenAndServe helpers (<a href="https://redirect.github.com/valyala/fasthttp/issues/2304">#2304</a>)</li> <li><a href="https://github.com/valyala/fasthttp/commit/134a8fedab6eb02fda4b8d96c48d2a72082d2e0c"><code>134a8fe</code></a> preserve duplicate request headers in ConvertRequest (<a href="https://redirect.github.com/valyala/fasthttp/issues/2305">#2305</a>)</li> <li><a href="https://github.com/valyala/fasthttp/commit/7bca504536636cf77726f3018365626a8b975b5f"><code>7bca504</code></a> reject duplicate Transfer-Encoding in request header parser (<a href="https://redirect.github.com/valyala/fasthttp/issues/2303">#2303</a>)</li> <li><a href="https://github.com/valyala/fasthttp/commit/9ee3c15997f8ab21519c2728017e9fbff03fe142"><code>9ee3c15</code></a> docs: document FSCompressedFileSuffixes is not safe for concurrent modificati...</li> <li><a href="https://github.com/valyala/fasthttp/commit/2c1590038fa5d0e04896c8b0aafc138ce286bfa7"><code>2c15900</code></a> feat(prefork): graceful shutdown, leak fixes, hook robustness (re-open of <a href="https://redirect.github.com/valyala/fasthttp/issues/21">#21</a>...</li> <li><a href="https://github.com/valyala/fasthttp/commit/ec58c6e67ee8f608a673cc01f07f045d04fa17b5"><code>ec58c6e</code></a> strip semicolons from cookie setters to block attribute injection (<a href="https://redirect.github.com/valyala/fasthttp/issues/2298">#2298</a>)</li> <li>Additional commits viewable in <a href="https://github.com/valyala/fasthttp/compare/v1.71.0...v1.72.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-30 11:18:33 +00:00
dependabot[bot]	33780758c1	chore: bump github.com/open-policy-agent/opa from 1.17.0 to 1.18.1 (#26858) ... Bumps [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) from 1.17.0 to 1.18.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/open-policy-agent/opa/releases">github.com/open-policy-agent/opa's releases</a>.</em></p> <blockquote> <h2>v1.18.1</h2> <p>This release fixes a memory leak introduced in OPA v1.17.0. It is advised to update if you notice excess memory usage when running OPA server.</p> <h3>Fixes</h3> <ul> <li>ast: fix AnnotationSet memory leak via runtime.AddCleanup cycle (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8817">#8817</a>) authored by <a href="https://github.com/srenatus"><code>@​srenatus</code></a> reported by <a href="https://github.com/keydon"><code>@​keydon</code></a> and <a href="https://github.com/gorsr01"><code>@​gorsr01</code></a></li> </ul> <h2>v1.18.0</h2> <p>This release contains a mix of bugfixes and small features. Notably:</p> <ul> <li>A breaking fix to the outbound <code>User-Agent</code> header so it conforms to RFC 9110 (see below)</li> <li>Container-aware resource limits: automatic <code>GOMAXPROCS</code> is restored and automatic <code>GOMEMLIMIT</code> is now supported</li> <li>Several <code>opa fmt</code> correctness fixes</li> <li>Improvements to <code>opa test --coverage</code> (ranges in report, inline rule head tracking, conjunction-expression coverage)</li> </ul> <h3>Breaking: Fix User-Agent according to RFC9110 (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8792">#8792</a>)</h3> <p>OPA's outbound HTTP requests (bundle, discovery, decision log, status, <code>http.send</code>, AWS KMS/ECR) previously sent <code>User-Agent: Open Policy Agent/&lt;version&gt; (&lt;os&gt;, &lt;arch&gt;)</code>, which is not a valid RFC 9110 <code>User-Agent</code> value because the <code>product</code> token cannot contain spaces. The header is now <code>Open-Policy-Agent/&lt;version&gt; (&lt;os&gt;, &lt;arch&gt;)</code>. Server-side log filters or WAF rules that exact-match the old string will need to be updated.</p> <p>Authored by <a href="https://github.com/sspaink"><code>@​sspaink</code></a>, reported by <a href="https://github.com/SpecLad"><code>@​SpecLad</code></a></p> <h3>Runtime, SDK, Tooling</h3> <ul> <li>bundle: fix per-module rego version lookup (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8797">#8797</a>) authored by <a href="https://github.com/sspaink"><code>@​sspaink</code></a>, reported by <a href="https://github.com/xubinzheng"><code>@​xubinzheng</code></a></li> <li>bundle: improve determinism of <code>file_rego_versions</code> patterns with overlap (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8733">#8733</a>) authored by <a href="https://github.com/philipaconrad"><code>@​philipaconrad</code></a></li> <li>cover: Track inline rule head in post trace walk (<a href="https://redirect.github.com/open-policy-agent/opa/issues/6531">#6531</a>) authored by <a href="https://github.com/charlieegan3"><code>@​charlieegan3</code></a>, reported by <a href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li> <li>cover: Update report to include ranges (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8748">#8748</a>) reported and authored by <a href="https://github.com/charlieegan3"><code>@​charlieegan3</code></a></li> <li>cover: Add support for coverage of conjunction exprs (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8809">#8809</a>) authored by <a href="https://github.com/charlieegan3"><code>@​charlieegan3</code></a></li> <li>download/oci: Set Accept headers (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8720">#8720</a>) authored by <a href="https://github.com/charlieegan3"><code>@​charlieegan3</code></a></li> <li>fmt: preserve the multiline but single entry iterables (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8557">#8557</a>) authored by <a href="https://github.com/unichronic"><code>@​unichronic</code></a>, reported by <a href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li> <li>format: Fix dropped with-clause after comment in object value (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8765">#8765</a>) authored by <a href="https://github.com/sspaink"><code>@​sspaink</code></a>, reported by <a href="https://github.com/srabraham"><code>@​srabraham</code></a></li> <li>format: keep lone <code>with</code> on the closing-bracket line of multi-line expressions (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8804">#8804</a>) authored by <a href="https://github.com/anneheartrecord"><code>@​anneheartrecord</code></a>, reported by <a href="https://github.com/burnster"><code>@​burnster</code></a></li> <li>oracle: Fix find-definition on expressions inside <code>ast.Not</code> nodes (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8731">#8731</a>) authored by <a href="https://github.com/johanfylling"><code>@​johanfylling</code></a></li> <li>runtime: Restore goautomaxprocs, add automemlimit (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8784">#8784</a>) authored by <a href="https://github.com/charlieegan3"><code>@​charlieegan3</code></a></li> </ul> <h3>Compiler, Topdown and Rego</h3> <ul> <li>ast: Apply location to inner <code>ast.Not</code> expressions (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8717">#8717</a>) authored by <a href="https://github.com/johanfylling"><code>@​johanfylling</code></a>, reported by <a href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li> <li>ast: Clean up code for value comparisons (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8737">#8737</a>) authored by <a href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li> <li>ast: Fix PE regression for <code>future.keywords.not</code> negation inside <code>every</code> (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8781">#8781</a>) authored by <a href="https://github.com/johanfylling"><code>@​johanfylling</code></a></li> <li>internal/edittree: Add recursive tree node recycling (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8693">#8693</a>) authored by <a href="https://github.com/philipaconrad"><code>@​philipaconrad</code></a></li> <li>internal: compile,planner: improve determinism of <code>plan</code>/<code>wasm</code> bundle builds (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8732">#8732</a>) authored by <a href="https://github.com/philipaconrad"><code>@​philipaconrad</code></a></li> <li>perf: avoid allocations in <code>object.get</code> (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8729">#8729</a>) authored by <a href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li> <li>topdown: Fix PE not namespacing vars in comprehensions nested inside <code>every</code> (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8816">#8816</a>) authored by <a href="https://github.com/johanfylling"><code>@​johanfylling</code></a></li> <li>topdown: remove <code>dst.Compare(src)</code> shortcut (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8739">#8739</a>) authored by <a href="https://github.com/srenatus"><code>@​srenatus</code></a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md">github.com/open-policy-agent/opa's changelog</a>.</em></p> <blockquote> <h1>Change Log</h1> <p>All notable changes to this project will be documented in this file. This project adheres to <a href="http://semver.org/">Semantic Versioning</a>.</p> <h2>Unreleased</h2> <h2>1.18.0</h2> <p>This release contains a mix of bugfixes and small features. Notably:</p> <ul> <li>A breaking fix to the outbound <code>User-Agent</code> header so it conforms to RFC 9110 (see below)</li> <li>Container-aware resource limits: automatic <code>GOMAXPROCS</code> is restored and automatic <code>GOMEMLIMIT</code> is now supported</li> <li>Several <code>opa fmt</code> correctness fixes</li> <li>Improvements to <code>opa test --coverage</code> (ranges in report, inline rule head tracking, conjunction-expression coverage)</li> </ul> <h3>Breaking: Fix User-Agent according to RFC9110 (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8792">#8792</a>)</h3> <p>OPA's outbound HTTP requests (bundle, discovery, decision log, status, <code>http.send</code>, AWS KMS/ECR) previously sent <code>User-Agent: Open Policy Agent/&lt;version&gt; (&lt;os&gt;, &lt;arch&gt;)</code>, which is not a valid RFC 9110 <code>User-Agent</code> value because the <code>product</code> token cannot contain spaces. The header is now <code>Open-Policy-Agent/&lt;version&gt; (&lt;os&gt;, &lt;arch&gt;)</code>. Server-side log filters or WAF rules that exact-match the old string will need to be updated.</p> <p>Authored by <a href="https://github.com/sspaink"><code>@​sspaink</code></a>, reported by <a href="https://github.com/SpecLad"><code>@​SpecLad</code></a></p> <h3>Runtime, SDK, Tooling</h3> <ul> <li>bundle: fix per-module rego version lookup (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8797">#8797</a>) authored by <a href="https://github.com/sspaink"><code>@​sspaink</code></a>, reported by <a href="https://github.com/xubinzheng"><code>@​xubinzheng</code></a></li> <li>bundle: improve determinism of <code>file_rego_versions</code> patterns with overlap (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8733">#8733</a>) authored by <a href="https://github.com/philipaconrad"><code>@​philipaconrad</code></a></li> <li>cover: Track inline rule head in post trace walk (<a href="https://redirect.github.com/open-policy-agent/opa/issues/6531">#6531</a>) authored by <a href="https://github.com/charlieegan3"><code>@​charlieegan3</code></a>, reported by <a href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li> <li>cover: Update report to include ranges (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8748">#8748</a>) reported and authored by <a href="https://github.com/charlieegan3"><code>@​charlieegan3</code></a></li> <li>cover: Add support for coverage of conjunction exprs (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8809">#8809</a>) authored by <a href="https://github.com/charlieegan3"><code>@​charlieegan3</code></a></li> <li>download/oci: Set Accept headers (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8720">#8720</a>) authored by <a href="https://github.com/charlieegan3"><code>@​charlieegan3</code></a></li> <li>fmt: preserve the multiline but single entry iterables (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8557">#8557</a>) authored by <a href="https://github.com/unichronic"><code>@​unichronic</code></a>, reported by <a href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li> <li>format: Fix dropped with-clause after comment in object value (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8765">#8765</a>) authored by <a href="https://github.com/sspaink"><code>@​sspaink</code></a>, reported by <a href="https://github.com/srabraham"><code>@​srabraham</code></a></li> <li>format: keep lone <code>with</code> on the closing-bracket line of multi-line expressions (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8804">#8804</a>) authored by <a href="https://github.com/anneheartrecord"><code>@​anneheartrecord</code></a>, reported by <a href="https://github.com/burnster"><code>@​burnster</code></a></li> <li>oracle: Fix find-definition on expressions inside <code>ast.Not</code> nodes (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8731">#8731</a>) authored by <a href="https://github.com/johanfylling"><code>@​johanfylling</code></a></li> <li>runtime: Restore goautomaxprocs, add automemlimit (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8784">#8784</a>) authored by <a href="https://github.com/charlieegan3"><code>@​charlieegan3</code></a></li> </ul> <h3>Compiler, Topdown and Rego</h3> <ul> <li>ast: Apply location to inner <code>ast.Not</code> expressions (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8717">#8717</a>) authored by <a href="https://github.com/johanfylling"><code>@​johanfylling</code></a>, reported by <a href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li> <li>ast: Clean up code for value comparisons (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8737">#8737</a>) authored by <a href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li> <li>ast: Fix PE regression for <code>future.keywords.not</code> negation inside <code>every</code> (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8781">#8781</a>) authored by <a href="https://github.com/johanfylling"><code>@​johanfylling</code></a></li> <li>internal/edittree: Add recursive tree node recycling (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8693">#8693</a>) authored by <a href="https://github.com/philipaconrad"><code>@​philipaconrad</code></a></li> <li>internal: compile,planner: improve determinism of <code>plan</code>/<code>wasm</code> bundle builds (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8732">#8732</a>) authored by <a href="https://github.com/philipaconrad"><code>@​philipaconrad</code></a></li> <li>perf: avoid allocations in <code>object.get</code> (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8729">#8729</a>) authored by <a href="https://github.com/anderseknert"><code>@​anderseknert</code></a></li> <li>topdown: Fix PE not namespacing vars in comprehensions nested inside <code>every</code> (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8816">#8816</a>) authored by <a href="https://github.com/johanfylling"><code>@​johanfylling</code></a></li> <li>topdown: remove <code>dst.Compare(src)</code> shortcut (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8739">#8739</a>) authored by <a href="https://github.com/srenatus"><code>@​srenatus</code></a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/open-policy-agent/opa/commit/acc8bf9f88bbef57c500dbdd7231509e48ade525"><code>acc8bf9</code></a> Release v1.18.1</li> <li><a href="https://github.com/open-policy-agent/opa/commit/713dc6a42757e4b175ec8f74d58e341f89004467"><code>713dc6a</code></a> ast: fix AnnotationSet memory leak via runtime.AddCleanup cycle</li> <li><a href="https://github.com/open-policy-agent/opa/commit/cc2c5c60a4c486f15a5e8de457e96ed0fefaf5fe"><code>cc2c5c6</code></a> Prepare v1.18 release (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8820">#8820</a>)</li> <li><a href="https://github.com/open-policy-agent/opa/commit/e72a98fb10b43cfc4067568de8909c669e8a1b79"><code>e72a98f</code></a> format: keep lone <code>with</code> on the closing-bracket line of multi-line expression...</li> <li><a href="https://github.com/open-policy-agent/opa/commit/03646dde18924c2c74a13526e4cea408dcbb4481"><code>03646dd</code></a> topdown: Fix PE not namespacing vars in comprehensions nested inside <code>every</code> ...</li> <li><a href="https://github.com/open-policy-agent/opa/commit/bf2bb5261cf84958c295dd74e763837e2c021fd8"><code>bf2bb52</code></a> benchmarks: split off script, emit markdown table</li> <li><a href="https://github.com/open-policy-agent/opa/commit/02ce276093b85d101172045f0307d53f5f9cc89d"><code>02ce276</code></a> version: fix ill-formed User-Agent header (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8796">#8796</a>)</li> <li><a href="https://github.com/open-policy-agent/opa/commit/1fdbb77dd6b7aaf65dffd8c23563df72a59639a3"><code>1fdbb77</code></a> build(deps): bump the dependencies group across 2 directories with 6 updates</li> <li><a href="https://github.com/open-policy-agent/opa/commit/954196aaa43841958547b1a0ba564e591d342a67"><code>954196a</code></a> cover: Add support for coverage of conjunction exprs (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8809">#8809</a>)</li> <li><a href="https://github.com/open-policy-agent/opa/commit/dec8333b32aed9189721220f3e8101460ebb170f"><code>dec8333</code></a> deduplicate change-detection output in pr CI checks (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8808">#8808</a>)</li> <li>Additional commits viewable in <a href="https://github.com/open-policy-agent/opa/compare/v1.17.0...v1.18.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-30 11:17:30 +00:00
dependabot[bot]	d440e71109	chore: bump golang.org/x/tools from 0.46.0 to 0.47.0 in the x group (#26857) ... Bumps the x group with 1 update: [golang.org/x/tools](https://github.com/golang/tools). Updates `golang.org/x/tools` from 0.46.0 to 0.47.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/tools/commit/fbf9f2e2c8124fbe1877f5ed2857111038d9fe12"><code>fbf9f2e</code></a> gopls/internal/cmd: add tests of 'gopls help'</li> <li><a href="https://github.com/golang/tools/commit/e891f79e03c0d60a806f959113eb8a748a3dd3fe"><code>e891f79</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/tools/commit/0602b30930e307645a5b43697b316a5599dea9a1"><code>0602b30</code></a> gopls: revert CLI usability revamp to stabilize release</li> <li><a href="https://github.com/golang/tools/commit/60c2434eca161a47c4697fdf65718dc259c1cf5b"><code>60c2434</code></a> gopls/internal/cmd: fix regression in initialization</li> <li><a href="https://github.com/golang/tools/commit/29e158310c709074e3cc2f7f1cd5ab9af11eb13b"><code>29e1583</code></a> gopls/internal/mcp: go_diagnostics: use idiomatic iterators</li> <li><a href="https://github.com/golang/tools/commit/0772d6a918b878bf9983d765a65af011d84483b4"><code>0772d6a</code></a> go/ssa: add test for fix of <a href="https://redirect.github.com/golang/go/issues/73871">golang/go#73871</a> in go/types@go1.25</li> <li><a href="https://github.com/golang/tools/commit/0fdde844aba91691351f38a7f1da04354170017e"><code>0fdde84</code></a> gopls/internal/tool: rename Application to Command and embed in SubCommand</li> <li><a href="https://github.com/golang/tools/commit/bd9e76d9f0ec7faf1dc77d440463c182ac9c348c"><code>bd9e76d</code></a> go/callgraph/vta: document ssa.InstantiateGenerics requirement</li> <li><a href="https://github.com/golang/tools/commit/d711ac7849d4f5456228745090323144c4c2d190"><code>d711ac7</code></a> go/ssa: remove incorrect hasTypeParams check</li> <li><a href="https://github.com/golang/tools/commit/439decda73f3e6449050bcb3a0241ed96d5e74e1"><code>439decd</code></a> gopls/internal/cache/xrefs: avoid materializing Inspector</li> <li>Additional commits viewable in <a href="https://github.com/golang/tools/compare/v0.46.0...v0.47.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-30 11:15:40 +00:00
Yevhenii Shcherbina	8bf6f43016	feat: support cross-account Bedrock AssumeRole in AI Bridge (#26527) ... # Support IAM role assumption for AWS Bedrock in AI Bridge ## Summary Implements https://linear.app/codercom/issue/AIGOV-371/support-dynamic-bedrock-assumerole-across-aws-accounts-for-ai-gateway A Bedrock provider can now be configured with an IAM role to assume. Before calling Bedrock, the gateway assumes that role via STS and signs requests with the resulting temporary credentials. Whether the role lives in the same account or another one is entirely a matter of the role's trust policy. ## Problem Many organizations prohibit long-lived AWS access keys and expect workloads to authenticate through assumed IAM roles instead. A common case is an organization that runs Bedrock across several AWS accounts, one per business unit, and needs each unit's usage billed to its own account by assuming a role there. AI Bridge previously authenticated a Bedrock provider only with static keys or the gateway's own ambient AWS identity, which is shared by every provider, with no way to assume a role. These deployments had no clean path. ## How it works When a provider is configured with a role ARN, the gateway uses its base identity to assume that role via STS and signs Bedrock requests with the temporary credentials it returns. The base identity is whatever the AWS default credential chain resolves, IRSA, EKS Pod Identity, EC2 Instance Profile, or static keys. Credentials are resolved once when the provider is set up and are then cached and rotated, so individual requests are served from the cache rather than triggering a new STS call. A deployment that needs several roles configures several providers, each pointing at its own role. ## Configuration The role ARN is part of the Bedrock provider settings and is set through the AI provider API. It is optional: a provider with no role ARN behaves exactly as before. ## Scope and trade-offs - This PR is backend only. The settings UI for the role ARN ships in a follow-up. - Configuration is not exposed through environment variables. Environment-based provider configuration is being phased out in favor of database-managed providers, so the role ARN is intentionally database and API only. Follow-up PR: https://github.com/coder/coder/pull/26578	2026-06-24 12:03:27 -04:00
Cian Johnston	2d28c1b396	feat: surface template README to agent template tools (#26334) ... Fixes CODAGT-447. Alternative implementation of https://github.com/coder/coder/pull/26212 and https://github.com/coder/coder/pull/25978 - Adds up to the first 1000 characters of `README.md` (with leading frontmatter stripped) to `chattool.list_templates` output - Adds up to 800 characters of `README.md` to `chattool.read_template`. **Note:** skipping `toolsdk` versions to keep scope small. > 🤖 Generated by Coder Agents	2026-06-24 12:32:46 +01:00
Sas Swart	cec1b4e886	fix: upgrade coder/boundary to v0.9.0 (#26651) ... Bumps `github.com/coder/boundary` from pseudo-version `v0.8.4-0.20260304164748-566aeea939ab` to `v0.9.0`. This picks up the fixes included in the [v0.9.0 release](https://github.com/coder/boundary/releases/tag/v0.9.0), notably: - feat: report drop counts to agent via BoundaryStatus - fix: preserve percent-encoded path when forwarding Relates to https://linear.app/codercom/issue/AIGOV-424 > Generated by Coder Agents on behalf of @SasSwart	2026-06-24 10:42:12 +02:00
dependabot[bot]	eb4bea6e94	chore: bump github.com/coreos/go-oidc/v3 from 3.18.0 to 3.19.0 (#26608) ... Bumps [github.com/coreos/go-oidc/v3](https://github.com/coreos/go-oidc) from 3.18.0 to 3.19.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/coreos/go-oidc/releases">github.com/coreos/go-oidc/v3's releases</a>.</em></p> <blockquote> <h2>v3.19.0</h2> <h2>What's Changed</h2> <ul> <li>fix: Key refresh should set <code>no-cache</code> to get most up to date keys by <a href="https://github.com/Yanni8"><code>@​Yanni8</code></a> in <a href="https://redirect.github.com/coreos/go-oidc/pull/485">coreos/go-oidc#485</a></li> <li>oidc: add support for validating back-channel logout tokens by <a href="https://github.com/ericchiang"><code>@​ericchiang</code></a> in <a href="https://redirect.github.com/coreos/go-oidc/pull/486">coreos/go-oidc#486</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Yanni8"><code>@​Yanni8</code></a> made their first contribution in <a href="https://redirect.github.com/coreos/go-oidc/pull/485">coreos/go-oidc#485</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/coreos/go-oidc/compare/v3.18.0...v3.19.0">https://github.com/coreos/go-oidc/compare/v3.18.0...v3.19.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/coreos/go-oidc/commit/4204f0b2b0f903070de5f51a459fe5e23faca113"><code>4204f0b</code></a> oidc: add support for validating back-channel logout tokens</li> <li><a href="https://github.com/coreos/go-oidc/commit/f77e01c50994c6ad4f4c3a6ed3e2380bab1f1ff2"><code>f77e01c</code></a> fix: Key refresh should set no-cache to get most up to date keys</li> <li>See full diff in <a href="https://github.com/coreos/go-oidc/compare/v3.18.0...v3.19.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-23 11:19:00 +00:00
dependabot[bot]	e2333ebd29	chore: bump github.com/prometheus/common from 0.68.1 to 0.69.0 (#26607) ... Bumps [github.com/prometheus/common](https://github.com/prometheus/common) from 0.68.1 to 0.69.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/prometheus/common/releases">github.com/prometheus/common's releases</a>.</em></p> <blockquote> <h2>v0.69.0</h2> <h2>What's Changed</h2> <ul> <li>config: strip credentials on cross-host redirects by <a href="https://github.com/roidelapluie"><code>@​roidelapluie</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/901">prometheus/common#901</a></li> <li>Modernize Go by <a href="https://github.com/SuperQ"><code>@​SuperQ</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/919">prometheus/common#919</a></li> <li>config: make isCrossHostRedirect sticky across the redirect chain by <a href="https://github.com/roidelapluie"><code>@​roidelapluie</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/920">prometheus/common#920</a></li> <li>config: check cross-host redirect before OAuth2 token fetch by <a href="https://github.com/roidelapluie"><code>@​roidelapluie</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/921">prometheus/common#921</a></li> <li>expfmt: fix nil pointer panic when parsing empty braces &quot;{}&quot; by <a href="https://github.com/roidelapluie"><code>@​roidelapluie</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/922">prometheus/common#922</a></li> <li>model: reduce allocations in Time.UnmarshalJSON by <a href="https://github.com/bboreham"><code>@​bboreham</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/918">prometheus/common#918</a></li> <li>config: resolve LoadHTTPConfigFile paths relative to the config file by <a href="https://github.com/roidelapluie"><code>@​roidelapluie</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/925">prometheus/common#925</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/prometheus/common/compare/v0.68.1...v0.69.0">https://github.com/prometheus/common/compare/v0.68.1...v0.69.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/prometheus/common/blob/main/CHANGELOG.md">github.com/prometheus/common's changelog</a>.</em></p> <blockquote> <h2>v0.69.0 / 2026-06-17</h2> <h3>Security / behavior changes</h3> <ul> <li><strong>config: credentials are no longer forwarded across cross-host redirects.</strong> When <code>FollowRedirects</code> is enabled, the HTTP client now strips <code>Authorization</code>, <code>Cookie</code>, <code>Proxy-Authorization</code> and other sensitive headers, and skips basic-auth, bearer-token and OAuth2 credentials, when a redirect points to a different host. This aligns with Go's <code>net/http</code> behavior. Callers that relied on credentials being sent to a redirect target on another host will need to target that host directly. <a href="https://redirect.github.com/prometheus/common/issues/901">#901</a> <a href="https://redirect.github.com/prometheus/common/issues/920">#920</a> <a href="https://redirect.github.com/prometheus/common/issues/921">#921</a></li> <li>config: <code>LoadHTTPConfigFile</code> now resolves relative file paths (e.g. <code>*_file</code> credentials, <code>http_headers</code> files) against the config file's own directory instead of its parent directory. Configs that worked around the old behavior by prefixing paths with the config's directory name must drop that prefix. <a href="https://redirect.github.com/prometheus/common/issues/925">#925</a></li> </ul> <h3>Bugfixes</h3> <ul> <li>expfmt: fix nil pointer panic when parsing empty braces <code>{}</code>. <a href="https://redirect.github.com/prometheus/common/issues/922">#922</a></li> <li>model: fix <code>Time.UnmarshalJSON</code> for larger negative numbers. <a href="https://redirect.github.com/prometheus/common/issues/918">#918</a></li> </ul> <h3>Performance</h3> <ul> <li>model: reduce allocations in <code>Time.UnmarshalJSON</code>. <a href="https://redirect.github.com/prometheus/common/issues/918">#918</a></li> </ul> <h3>Internal</h3> <ul> <li>Synchronize common files from prometheus/prometheus. <a href="https://redirect.github.com/prometheus/common/issues/917">#917</a></li> <li>Modernize Go. <a href="https://redirect.github.com/prometheus/common/issues/919">#919</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/prometheus/common/compare/v0.68.1...v0.69.0">https://github.com/prometheus/common/compare/v0.68.1...v0.69.0</a></p> <h2>v0.67.2 / 2025-10-28</h2> <h2>What's Changed</h2> <ul> <li>config: Fix panic in <code>tlsRoundTripper</code> when CA file is absent by <a href="https://github.com/ndk"><code>@​ndk</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/792">prometheus/common#792</a></li> <li>Cleanup linting issues by <a href="https://github.com/SuperQ"><code>@​SuperQ</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/860">prometheus/common#860</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/ndk"><code>@​ndk</code></a> made their first contribution in <a href="https://redirect.github.com/prometheus/common/pull/792">prometheus/common#792</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/prometheus/common/compare/v0.67.1...v0.67.2">https://github.com/prometheus/common/compare/v0.67.1...v0.67.2</a></p> <h2>v0.67.1 / 2025-10-07</h2> <h2>What's Changed</h2> <ul> <li>Remove VERSION file to avoid Go conflict error in <a href="https://redirect.github.com/prometheus/common/pull/853">prometheus/common#853</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/prometheus/common/compare/v0.67.0...v0.67.1">https://github.com/prometheus/common/compare/v0.67.0...v0.67.1</a></p> <h2>v0.67.0 / 2025-10-07</h2> <h2>What's Changed</h2> <ul> <li>Create CHANGELOG.md for easier communication of library changes, especially possible breaking changes. by <a href="https://github.com/ywwg"><code>@​ywwg</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/833">prometheus/common#833</a></li> <li>model: New test for validation with dots by <a href="https://github.com/m1k1o"><code>@​m1k1o</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/759">prometheus/common#759</a></li> <li>expfmt: document NewTextParser as required by <a href="https://github.com/burgerdev"><code>@​burgerdev</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/842">prometheus/common#842</a></li> <li>expfmt: Add support for float histograms and gauge histograms by <a href="https://github.com/beorn7"><code>@​beorn7</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/843">prometheus/common#843</a></li> <li>Updated minimum Go version to 1.24.0, updated Go dependecies by <a href="https://github.com/SuperQ"><code>@​SuperQ</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/849">prometheus/common#849</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/prometheus/common/commit/e3c14a039d494d866242b36ac253dfecf9c7210b"><code>e3c14a0</code></a> Merge pull request <a href="https://redirect.github.com/prometheus/common/issues/925">#925</a> from roidelapluie/roidelapluie/fix-loadhttpconfigfile...</li> <li><a href="https://github.com/prometheus/common/commit/a7b791d0a0cd8e7be164d7f3fdb33450c1868b1c"><code>a7b791d</code></a> config: resolve LoadHTTPConfigFile paths relative to the config file</li> <li><a href="https://github.com/prometheus/common/commit/f84efec4e4deb31a8afd39c4f4f7ba2b30f39df3"><code>f84efec</code></a> Merge pull request <a href="https://redirect.github.com/prometheus/common/issues/918">#918</a> from prometheus/time-split</li> <li><a href="https://github.com/prometheus/common/commit/2269d3d1af9a40c9324bb523087f7704fabe7f1d"><code>2269d3d</code></a> Merge pull request <a href="https://redirect.github.com/prometheus/common/issues/922">#922</a> from roidelapluie/roidelapluie/fix-textparse-empty-br...</li> <li><a href="https://github.com/prometheus/common/commit/a1600af967b7eaa77360339b402b447855c24915"><code>a1600af</code></a> expfmt: fix nil pointer panic when parsing empty braces &quot;{}&quot;</li> <li><a href="https://github.com/prometheus/common/commit/56fe3954537fa60da94055f19172fafa25347948"><code>56fe395</code></a> Merge pull request <a href="https://redirect.github.com/prometheus/common/issues/921">#921</a> from roidelapluie/roidelapluie/oauth2-cross-host-check</li> <li><a href="https://github.com/prometheus/common/commit/0fcda471410c91d285776092b7d768d8ac199bc9"><code>0fcda47</code></a> Merge pull request <a href="https://redirect.github.com/prometheus/common/issues/920">#920</a> from roidelapluie/roidelapluie/cross-host-sticky</li> <li><a href="https://github.com/prometheus/common/commit/30ba470f4f55107af9dbe7fbe9c95c0617c13f43"><code>30ba470</code></a> Merge pull request <a href="https://redirect.github.com/prometheus/common/issues/919">#919</a> from prometheus/superq/modernize</li> <li><a href="https://github.com/prometheus/common/commit/2b55b3e9e7e899f2cbcbcb7afdcb55c2db6a1754"><code>2b55b3e</code></a> config: check cross-host redirect before OAuth2 token fetch</li> <li><a href="https://github.com/prometheus/common/commit/428856f9a5d0d790dacdf03e789c2ef87b03fc40"><code>428856f</code></a> config: make isCrossHostRedirect sticky across the redirect chain</li> <li>Additional commits viewable in <a href="https://github.com/prometheus/common/compare/v0.68.1...v0.69.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-23 11:18:52 +00:00
dependabot[bot]	8cf394d145	chore: bump google.golang.org/api from 0.284.0 to 0.286.0 (#26606) ... Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.284.0 to 0.286.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's releases</a>.</em></p> <blockquote> <h2>v0.286.0</h2> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.285.0...v0.286.0">0.286.0</a> (2026-06-22)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3629">#3629</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/f25a08b7bd916e0719cc9e0d003454a8aaa8caf9">f25a08b</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3631">#3631</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/b3bb97ff046401ce738b4e6830642b2e6c712536">b3bb97f</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3632">#3632</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/7332dd74f142bba59a27778f115eac98cc254bfb">7332dd7</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3634">#3634</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/36081a00df42df1ca3e3228067737839aa905c9e">36081a0</a>)</li> </ul> <h2>v0.285.0</h2> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.284.0...v0.285.0">0.285.0</a> (2026-06-16)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3618">#3618</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/5c008a7963c278aff6be6c839cbf20bd0b8ae231">5c008a7</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3620">#3620</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/21a12ed9dc47cb8d9b9aa4e1f5759ac2044063a5">21a12ed</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3622">#3622</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/17394ca1afffb6d740e134a0bc148d79106c4c80">17394ca</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3623">#3623</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/087611c9a9b2c0e68f429641a012a43396afb4ce">087611c</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3624">#3624</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/72b67889b20325f1a09222d62b3184a68ad30ee2">72b6788</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3626">#3626</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/4f1d165677d35c4caecd7faf93eec27cb2fd25cd">4f1d165</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3628">#3628</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/894cccb170d1ea81f8bf49ddd072a3ef52df3d25">894cccb</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.285.0...v0.286.0">0.286.0</a> (2026-06-22)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3629">#3629</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/f25a08b7bd916e0719cc9e0d003454a8aaa8caf9">f25a08b</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3631">#3631</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/b3bb97ff046401ce738b4e6830642b2e6c712536">b3bb97f</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3632">#3632</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/7332dd74f142bba59a27778f115eac98cc254bfb">7332dd7</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3634">#3634</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/36081a00df42df1ca3e3228067737839aa905c9e">36081a0</a>)</li> </ul> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.284.0...v0.285.0">0.285.0</a> (2026-06-16)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3618">#3618</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/5c008a7963c278aff6be6c839cbf20bd0b8ae231">5c008a7</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3620">#3620</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/21a12ed9dc47cb8d9b9aa4e1f5759ac2044063a5">21a12ed</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3622">#3622</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/17394ca1afffb6d740e134a0bc148d79106c4c80">17394ca</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3623">#3623</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/087611c9a9b2c0e68f429641a012a43396afb4ce">087611c</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3624">#3624</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/72b67889b20325f1a09222d62b3184a68ad30ee2">72b6788</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3626">#3626</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/4f1d165677d35c4caecd7faf93eec27cb2fd25cd">4f1d165</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3628">#3628</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/894cccb170d1ea81f8bf49ddd072a3ef52df3d25">894cccb</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/googleapis/google-api-go-client/commit/94e4ed985051ce54267a5f938e57b8d77963c101"><code>94e4ed9</code></a> chore(main): release 0.286.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3630">#3630</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/36081a00df42df1ca3e3228067737839aa905c9e"><code>36081a0</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3634">#3634</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/7332dd74f142bba59a27778f115eac98cc254bfb"><code>7332dd7</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3632">#3632</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/b3bb97ff046401ce738b4e6830642b2e6c712536"><code>b3bb97f</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3631">#3631</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/f25a08b7bd916e0719cc9e0d003454a8aaa8caf9"><code>f25a08b</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3629">#3629</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/182ae992632d7ba19b5d3c60c71bda28fbfabca1"><code>182ae99</code></a> chore(main): release 0.285.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3619">#3619</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/894cccb170d1ea81f8bf49ddd072a3ef52df3d25"><code>894cccb</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3628">#3628</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/50adedd746e19a1fa5302c5b47dbd6f269bd8c14"><code>50adedd</code></a> chore(all): update all (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3625">#3625</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/4f1d165677d35c4caecd7faf93eec27cb2fd25cd"><code>4f1d165</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3626">#3626</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/72b67889b20325f1a09222d62b3184a68ad30ee2"><code>72b6788</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3624">#3624</a>)</li> <li>Additional commits viewable in <a href="https://github.com/googleapis/google-api-go-client/compare/v0.284.0...v0.286.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-23 11:17:13 +00:00
dependabot[bot]	3fb402cd82	chore: bump github.com/gohugoio/hugo from 0.163.0 to 0.163.3 (#26579) ... Bumps [github.com/gohugoio/hugo](https://github.com/gohugoio/hugo) from 0.163.0 to 0.163.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/gohugoio/hugo/releases">github.com/gohugoio/hugo's releases</a>.</em></p> <blockquote> <h2>v0.163.3</h2> <h2>What's Changed</h2> <ul> <li>markup/highlight: Escape lang in default code block rendering ce1a7e0b <a href="https://github.com/bep"><code>@​bep</code></a> thanks to <a href="https://github.com/k0ngj1"><code>@​k0ngj1</code></a> for reporting this issue.</li> <li>parser/pageparser: Preserve non-ASCII whitespace after e.g. summary divider 70a9068a <a href="https://github.com/bep"><code>@​bep</code></a></li> <li>resources: Support babel/postcss config variants 9d66d513 <a href="https://github.com/jmooring"><code>@​jmooring</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/15039">#15039</a> <a href="https://redirect.github.com/gohugoio/hugo/issues/15040">#15040</a> <a href="https://redirect.github.com/gohugoio/hugo/issues/15043">#15043</a></li> <li>hugolib: Fix page/section name collision regression f0133466 <a href="https://github.com/jmooring"><code>@​jmooring</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/15046">#15046</a></li> </ul> <h2>v0.163.2</h2> <h2>What's Changed</h2> <ul> <li>Continue resolving on ERR_ACCESS_DENIED in Node's resolver 134674f0 <a href="https://github.com/bep"><code>@​bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/15041">#15041</a></li> <li>markup: Standardize behavior when external converters are missing 147f605f <a href="https://github.com/jmooring"><code>@​jmooring</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14222">#14222</a></li> </ul> <h2>v0.163.1</h2> <p>The majority of the fixes in this release are security related (including the upstream fix in 93c8c7d3 (golang.org/x/image)). Thanks to <a href="https://github.com/vnth4nhnt"><code>@​vnth4nhnt</code></a> for finding the issues fixed in a00b5c72 and cf9c8f93 (I will do the CVE work on this later). There has been a uptick in security reports lately, which doesn't mean that Hugo has gotten less secure, this is mostly the work of the new and powerful AI tools using Hugo's restrictive <a href="https://gohugo.io/about/security/">security model</a> as their baseline. Just take a look at Go's recent <a href="https://github.com/golang/go/issues?q=is%3Aissue%20label%3ASecurity">security issue list</a> to see a demonstration of this.</p> <h2>What's Changed</h2> <ul> <li>build(deps): bump golang.org/x/image from 0.41.0 to 0.42.0 93c8c7d3 <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]</li> <li>Fix multi --renderSegments merge behavior 95e5e9f4 <a href="https://github.com/bep"><code>@​bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/15024">#15024</a></li> <li>security: Normalize integer IPv4 host encodings in http.urls check a00b5c72 <a href="https://github.com/bep"><code>@​bep</code></a></li> <li>Drop symlinks in os.ReadDir, os.ReadFile, os.Stat and os.FileExists cf9c8f93 <a href="https://github.com/bep"><code>@​bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/15019">#15019</a></li> <li>commands: Fix convert command 2602796c <a href="https://github.com/jmooring"><code>@​jmooring</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/15012">#15012</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/gohugoio/hugo/commit/4d22555aebf458d5d150500c9ac4bee5b24cf0d3"><code>4d22555</code></a> releaser: Bump versions for release of 0.163.3</li> <li><a href="https://github.com/gohugoio/hugo/commit/ce1a7e0bce3713af40496ded3c2c0ceeed49231d"><code>ce1a7e0</code></a> markup/highlight: Escape lang in default code block rendering</li> <li><a href="https://github.com/gohugoio/hugo/commit/e8988c31412249897a2e6805b61c37ed5c82a10c"><code>e8988c3</code></a> Merge commit 'c86d9f4aa8a58931f52df6516f10b67c807505fb'</li> <li><a href="https://github.com/gohugoio/hugo/commit/c86d9f4aa8a58931f52df6516f10b67c807505fb"><code>c86d9f4</code></a> Squashed 'docs/' changes from 1f8ddb8a52..e17426e2b6</li> <li><a href="https://github.com/gohugoio/hugo/commit/70a9068aa67c67a9eb2ab5fe062faf5a99e6b650"><code>70a9068</code></a> parser/pageparser: Preserve non-ASCII whitespace after e.g. summary divider</li> <li><a href="https://github.com/gohugoio/hugo/commit/9d66d513cee02e77c96c78059d5c3ae6b1c5dde9"><code>9d66d51</code></a> resources: Support babel/postcss config variants</li> <li><a href="https://github.com/gohugoio/hugo/commit/f01334666790f328e222f67c278396ee77003021"><code>f013346</code></a> hugolib: Fix page/section name collision regression</li> <li><a href="https://github.com/gohugoio/hugo/commit/96e06e1ab8484327dcbb521b8445a52d0c022cf3"><code>96e06e1</code></a> releaser: Prepare repository for 0.164.0-DEV</li> <li><a href="https://github.com/gohugoio/hugo/commit/19a5cec0b9618163bb519487382e861d29edf383"><code>19a5cec</code></a> releaser: Bump versions for release of 0.163.2</li> <li><a href="https://github.com/gohugoio/hugo/commit/134674f00df2c2c0db24f0674de2263298d33eb7"><code>134674f</code></a> Continue resolving on ERR_ACCESS_DENIED in Node's resolver</li> <li>Additional commits viewable in <a href="https://github.com/gohugoio/hugo/compare/v0.163.0...v0.163.3">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/coder/coder/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-22 18:28:02 +00:00
dependabot[bot]	2f3285ebe7	chore: bump the x group across 1 directory with 2 updates (#26521) ... Bumps the x group with 2 updates in the / directory: [golang.org/x/mod](https://github.com/golang/mod) and [golang.org/x/tools](https://github.com/golang/tools). Updates `golang.org/x/mod` from 0.36.0 to 0.37.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/mod/commit/deb1dfcdb7c7fd98fb5afddc3e95dd36d5880874"><code>deb1dfc</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/mod/commit/087f6515dd3ba3e8b06918fa425ffe7732321a7a"><code>087f651</code></a> modfile: use slices.Backward</li> <li><a href="https://github.com/golang/mod/commit/343ee60345a1f2ff0692be9dd068c0778dba985c"><code>343ee60</code></a> x/mod: allow for aggressively conslidating requires</li> <li>See full diff in <a href="https://github.com/golang/mod/compare/v0.36.0...v0.37.0">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/tools` from 0.45.0 to 0.46.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/tools/commit/3d6f8dfd4853c8b323940b931f1170c6d0df8d23"><code>3d6f8df</code></a> go/packages: propagate PATH in TestConfigEnvDoesNotInheritProcessEnv</li> <li><a href="https://github.com/golang/tools/commit/47abf61fcbb4abdcf37a986ce23e20dc140fd018"><code>47abf61</code></a> gopls: move internal/tool into gopls/internal/tool</li> <li><a href="https://github.com/golang/tools/commit/19cebc548e6c35b3bf20bd09490e7db258183507"><code>19cebc5</code></a> go/packages/gopackages: use standard flag package instead of internal/tool</li> <li><a href="https://github.com/golang/tools/commit/e965c10097987837d9805f8069f4a8278de7180f"><code>e965c10</code></a> gopls/internal/test/marker: update hover test</li> <li><a href="https://github.com/golang/tools/commit/96efd3d65c18f9f8d66bc94ec5d709db0b7e72f0"><code>96efd3d</code></a> gopls/internal/golang/stubmethods: support generic interfaces</li> <li><a href="https://github.com/golang/tools/commit/83be7b7739a3e73db55876c5d396c8d891f61a51"><code>83be7b7</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/tools/commit/bf05c11f9ba6f0ed70931bf0a302e9099897d726"><code>bf05c11</code></a> internal/typesinternal: ForEachElement: test generic methods</li> <li><a href="https://github.com/golang/tools/commit/99df0abf1ba525779b731d2f9ef358c1b8a1b633"><code>99df0ab</code></a> go/callgraph/static: support generic methods</li> <li><a href="https://github.com/golang/tools/commit/6942095782f864dadecfb2839bf2371d676bfb48"><code>6942095</code></a> go/ssa: fix instantiation of generic methods on non-generic receivers</li> <li><a href="https://github.com/golang/tools/commit/070e85daf671b972397e181b13cd7a0be55fa6b0"><code>070e85d</code></a> go/callgraph/rta: skip generic methods in fingerprinting</li> <li>Additional commits viewable in <a href="https://github.com/golang/tools/compare/v0.45.0...v0.46.0">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-18 15:13:50 +00:00
Ethan	0fcd9c2005	chore: bump fantasy to sync from upstream (#26440) ... Closes CODAGT-572 ## Overview Bumps `charm.land/fantasy` to the head of `coder_2_33` (`v0.0.0-20260617050554-2e3ddbca75dd`) and adapts `chatd` to it. The fantasy bump: - Syncs upstream `charmbracelet/fantasy` main (v0.31.0) into `coder_2_33` (coder/fantasy#42). - Mirrors the request region when prefixing cross-region inference profiles, so a legacy (un-qualified) Bedrock model ID is prefixed for the same region the request is actually signed for. Pulling in the new fantasy version propagates its required transitive dependency upgrades (aws-sdk-go-v2, OpenTelemetry, google genai, `golang.org/x/*`, etc.) through MVS, which accounts for the bulk of the `go.mod`/`go.sum` churn. ## chatd changes - Thread a per-provider `Region` through `ConfiguredProvider` and `ProviderAPIKeys` (`RegionByProvider`), and merge/prune/resolve it alongside API keys and base URLs. - Source the Bedrock region from AI provider settings in `chatd` and pass `fantasybedrock.WithRegion` when a region is configured. - Migrate the runtime Bedrock title-generation model ID to a fully-qualified `global.anthropic.*` ID. - Emit a `finish_reason` in the test OpenAI streaming server so streams close on a terminal event, matching fantasy's fail-closed stream handling. ## Heads-up: most of this is short-lived Almost all of the `chatd` code in this PR only executes on the **direct (non-gateway) routing path** — the branch taken when `AIGatewayRoutingEnabled` is `false`. That flag was a transition crutch for AI Gateway routing, and it (plus the entire direct path / `x/chatd/chatprovider` package that backs it) is slated for removal in CODAGT-598. Under AI Gateway routing — which is the path every deployment is expected to run — the Bedrock region is resolved by aibridge directly from provider settings (`cli/aibridged.go` builds `aibridge.AWSBedrockConfig{Region: settings.Bedrock.Region}`), so none of the region plumbing added here is reached. Concretely, expect the following to be deleted alongside the direct path: - The `RegionByProvider` map, the `Region()` accessor, and the region preservation in merge/resolve plus the region pruning in `PruneDisabledProviderKeys` (`chatprovider.go`). - The `fantasybedrock.WithRegion(region)` branch in `ModelFromConfig` — only reachable on the direct path; the gateway path builds a `fantasyanthropic` client with no region key. - Reading `settings.Bedrock.Region` in `aiProviderConfigFromKeys` (`chatd.go`). - The region-specific tests in `chatprovider_test.go`, and the `chattest`/`model_coverage` adjustments that support direct-path testing. What survives the cleanup (independent of routing): - The `charm.land/fantasy` bump and its `go.mod`/`go.sum` transitive churn. - The fully-qualified `global.anthropic.*` Bedrock title-generation model ID in `quickgen.go` (a runtime-valid model identifier, not direct-path-specific). We're landing the full change anyway so the direct path stays correct for the remaining transition window; just don't be surprised when CODAGT-598 reclaims most of it. ## Notes Depends on coder/fantasy `coder_2_33` already containing the upstream sync and Bedrock region fix (merged via coder/fantasy#42 and coder/fantasy#43).	2026-06-19 00:53:59 +10:00
dependabot[bot]	a6559a8b00	chore: bump github.com/prometheus-community/pro-bing from 0.8.0 to 0.9.0 (#26404) ... Bumps [github.com/prometheus-community/pro-bing](https://github.com/prometheus-community/pro-bing) from 0.8.0 to 0.9.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/prometheus-community/pro-bing/releases">github.com/prometheus-community/pro-bing's releases</a>.</em></p> <blockquote> <h2>v0.9.0</h2> <h2>What's Changed</h2> <ul> <li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@​prombot</code></a> in <a href="https://redirect.github.com/prometheus-community/pro-bing/pull/185">prometheus-community/pro-bing#185</a></li> <li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@​prombot</code></a> in <a href="https://redirect.github.com/prometheus-community/pro-bing/pull/186">prometheus-community/pro-bing#186</a></li> <li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@​prombot</code></a> in <a href="https://redirect.github.com/prometheus-community/pro-bing/pull/190">prometheus-community/pro-bing#190</a></li> <li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@​prombot</code></a> in <a href="https://redirect.github.com/prometheus-community/pro-bing/pull/191">prometheus-community/pro-bing#191</a></li> <li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@​prombot</code></a> in <a href="https://redirect.github.com/prometheus-community/pro-bing/pull/193">prometheus-community/pro-bing#193</a></li> <li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@​prombot</code></a> in <a href="https://redirect.github.com/prometheus-community/pro-bing/pull/197">prometheus-community/pro-bing#197</a></li> <li>Add required make step by <a href="https://github.com/ArthurSens"><code>@​ArthurSens</code></a> in <a href="https://redirect.github.com/prometheus-community/pro-bing/pull/201">prometheus-community/pro-bing#201</a></li> <li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@​prombot</code></a> in <a href="https://redirect.github.com/prometheus-community/pro-bing/pull/199">prometheus-community/pro-bing#199</a></li> <li>Fix ping test by <a href="https://github.com/SuperQ"><code>@​SuperQ</code></a> in <a href="https://redirect.github.com/prometheus-community/pro-bing/pull/203">prometheus-community/pro-bing#203</a></li> <li>Replace CircleCI with Github Actions by <a href="https://github.com/ArthurSens"><code>@​ArthurSens</code></a> in <a href="https://redirect.github.com/prometheus-community/pro-bing/pull/200">prometheus-community/pro-bing#200</a></li> <li>Migrate to PromCI by <a href="https://github.com/SuperQ"><code>@​SuperQ</code></a> in <a href="https://redirect.github.com/prometheus-community/pro-bing/pull/205">prometheus-community/pro-bing#205</a></li> <li>Bump actions/checkout from 6.0.2 to 6.0.3 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus-community/pro-bing/pull/206">prometheus-community/pro-bing#206</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/ArthurSens"><code>@​ArthurSens</code></a> made their first contribution in <a href="https://redirect.github.com/prometheus-community/pro-bing/pull/201">prometheus-community/pro-bing#201</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/prometheus-community/pro-bing/compare/v0.8.0...v0.9.0">https://github.com/prometheus-community/pro-bing/compare/v0.8.0...v0.9.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/prometheus-community/pro-bing/commit/945b9010a1de9b190bd7cc76fd6b667305f7604c"><code>945b901</code></a> Bump actions/checkout from 6.0.2 to 6.0.3 (<a href="https://redirect.github.com/prometheus-community/pro-bing/issues/206">#206</a>)</li> <li><a href="https://github.com/prometheus-community/pro-bing/commit/8ad48a3a4494524d283a80cf2586c922c34996e2"><code>8ad48a3</code></a> Migrate to PromCI (<a href="https://redirect.github.com/prometheus-community/pro-bing/issues/205">#205</a>)</li> <li><a href="https://github.com/prometheus-community/pro-bing/commit/1194d691ed5ef6e95d0f7c86f03280c50cecaad6"><code>1194d69</code></a> Replace CircleCI with Github Actions (<a href="https://redirect.github.com/prometheus-community/pro-bing/issues/200">#200</a>)</li> <li><a href="https://github.com/prometheus-community/pro-bing/commit/5b8ff3d3e855d8917a58ddd7f0952fd6d2995375"><code>5b8ff3d</code></a> Merge pull request <a href="https://redirect.github.com/prometheus-community/pro-bing/issues/203">#203</a> from prometheus-community/superq/localhost_ping_test</li> <li><a href="https://github.com/prometheus-community/pro-bing/commit/9e6b9559f3c8a5120fbdd70f42e99bb7ff143810"><code>9e6b955</code></a> Fix ping test</li> <li><a href="https://github.com/prometheus-community/pro-bing/commit/9e7ca651df21a1bb2af84a3b3f7f9f0aa9d2779d"><code>9e7ca65</code></a> Merge pull request <a href="https://redirect.github.com/prometheus-community/pro-bing/issues/199">#199</a> from prombot/repo_sync</li> <li><a href="https://github.com/prometheus-community/pro-bing/commit/0657089f4960412c2809c3c3c82244e5cff5b126"><code>0657089</code></a> Merge pull request <a href="https://redirect.github.com/prometheus-community/pro-bing/issues/201">#201</a> from prometheus-community/fix-golangcilint</li> <li><a href="https://github.com/prometheus-community/pro-bing/commit/b42280d67499a58ed879f827db4e28a05d12e381"><code>b42280d</code></a> Add required make step</li> <li><a href="https://github.com/prometheus-community/pro-bing/commit/f8995dd68ba40d6d7656d67d7d56b5f8ea8f487a"><code>f8995dd</code></a> Update common Prometheus files</li> <li><a href="https://github.com/prometheus-community/pro-bing/commit/f4241153b56afdc77511329e0cdffd95142d0658"><code>f424115</code></a> Merge pull request <a href="https://redirect.github.com/prometheus-community/pro-bing/issues/197">#197</a> from prometheus-community/repo_sync</li> <li>Additional commits viewable in <a href="https://github.com/prometheus-community/pro-bing/compare/v0.8.0...v0.9.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-16 11:18:26 +00:00
dependabot[bot]	1def9c693e	chore: bump google.golang.org/api from 0.283.0 to 0.284.0 (#26403) ... Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.283.0 to 0.284.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's releases</a>.</em></p> <blockquote> <h2>v0.284.0</h2> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.283.0...v0.284.0">0.284.0</a> (2026-06-09)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3613">#3613</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/5f021536107adde3063487a75aa9f46078490191">5f02153</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3616">#3616</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/25b429a5431a77dd95eb00466661c1447eab6d16">25b429a</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3617">#3617</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/1ef362535b2f2f3afbc1408adbf6d3b69e58ad26">1ef3625</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.283.0...v0.284.0">0.284.0</a> (2026-06-09)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3613">#3613</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/5f021536107adde3063487a75aa9f46078490191">5f02153</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3616">#3616</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/25b429a5431a77dd95eb00466661c1447eab6d16">25b429a</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3617">#3617</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/1ef362535b2f2f3afbc1408adbf6d3b69e58ad26">1ef3625</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/googleapis/google-api-go-client/commit/5c6a0b03b25a64955922133a4486f9632f381e88"><code>5c6a0b0</code></a> chore(main): release 0.284.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3614">#3614</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/1ef362535b2f2f3afbc1408adbf6d3b69e58ad26"><code>1ef3625</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3617">#3617</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/4dd580d53ff4585321810eaddf5c65d6d6b9d893"><code>4dd580d</code></a> chore(all): update all (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3615">#3615</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/25b429a5431a77dd95eb00466661c1447eab6d16"><code>25b429a</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3616">#3616</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/5f021536107adde3063487a75aa9f46078490191"><code>5f02153</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3613">#3613</a>)</li> <li>See full diff in <a href="https://github.com/googleapis/google-api-go-client/compare/v0.283.0...v0.284.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-16 11:18:17 +00:00
Ethan	deb6eec68b	fix: forward attached filenames to Anthropic chat models (#26051) ... Previously, fantasy's Anthropic provider adapter accepted PDF and text FileParts but dropped the filename on the floor, so Claude (direct or via Bedrock) saw the document bytes without any handle and could not answer questions like "what's in foo.pdf". Other providers (OpenAI, Gemini, OpenRouter, Vercel) already forwarded filenames. Bumps `coder/fantasy` past [coder/fantasy#38](https://github.com/coder/fantasy/pull/38), which sanitizes `FilePart.Filename` and sets it as the Anthropic `DocumentBlockParam.Title` for both `application/pdf` and `text/*` attachments, and emits a `CallWarning` for unsupported `FilePart` media types instead of silently dropping them. On this side, plumbs the resolved filename through `partsToMessageParts` so the `FilePart` literal carries it into the provider. The existing `TestModelFromConfig_AnthropicPDFFilePartReachesProvider` regression test is extended to assert the outbound Anthropic request includes the sanitized title (`quarterly_report.v1.pdf` becomes `quarterly report v1 pdf`). Closes CODAGT-545	2026-06-10 11:37:33 +10:00
dependabot[bot]	9408b9d89b	chore: bump github.com/gohugoio/hugo from 0.162.0 to 0.163.0 (#26157) ... Bumps [github.com/gohugoio/hugo](https://github.com/gohugoio/hugo) from 0.162.0 to 0.163.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/gohugoio/hugo/releases">github.com/gohugoio/hugo's releases</a>.</em></p> <blockquote> <h2>v0.163.0</h2> <p>The main topic in this release is improvements to the AVIF image handling that we introduced in <code>v0.162.0</code>. See <a href="https://gohugo.io/configuration/imaging/#avif">the docs</a> for details, but:</p> <ul> <li>We have turned down the default <code>quality</code> for AVIF to 60. Turns out, JPEG/WebP with quality 75 is comparable to AVIF with quality 60. You can now also set quality per image format in your project config (and also per image processed if needed).</li> <li>We have added a <code>hint</code> to the AVIF with the same values as for <code>WEBP</code>. For <code>lossy</code> compression, the photo/picture hints (and the default) encodes with YUV420 chroma subsampling instead of YUV444, keeping 444 for text/icon/drawing. This greatly reduces the memory needed to encode these images.</li> </ul> <h2>Improvements</h2> <ul> <li>resources/jsconfig: Remove deprecated baseUrl setting ff2903a9 <a href="https://github.com/bep"><code>@​bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14991">#14991</a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14996">#14996</a></li> <li>all: Adjust tests for deprecated link and image render hook settings ca68936d <a href="https://github.com/jmooring"><code>@​jmooring</code></a></li> <li>all: Run go fix ./... 781fabf4 <a href="https://github.com/bep"><code>@​bep</code></a></li> <li>pagesfromdata: Use relative path for content adapter template metrics 1d018ef8 <a href="https://github.com/anupamojha-eng"><code>@​anupamojha-eng</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14999">#14999</a></li> <li>ci: Re-add macos-latest to the test matrix 121bc6ce <a href="https://github.com/bep"><code>@​bep</code></a></li> <li>images: Deprecate Imaging.Compression and move it down to webp and avif configs cf18b827 <a href="https://github.com/bep"><code>@​bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14998">#14998</a></li> <li>Only support the latest Go version 98ad9b3c <a href="https://github.com/bep"><code>@​bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14997">#14997</a></li> <li>page: Add IsBranch and deprecate IsNode b89e7fe6 <a href="https://github.com/bep"><code>@​bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/11574">#11574</a></li> <li>images: Force cache invalidation for AVIF target e8fefc83 <a href="https://github.com/bep"><code>@​bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14990">#14990</a></li> <li>images: Add a per-format AVIF hint setting a043d3ec <a href="https://github.com/bep"><code>@​bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14992">#14992</a></li> <li>images: Make AVIF chroma subsampling content-aware via the hint 341f575d <a href="https://github.com/bep"><code>@​bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14987">#14987</a></li> <li>Cap AVIF lossy quality at 99 248241b6 <a href="https://github.com/bep"><code>@​bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14981">#14981</a></li> <li>config: Deprecate the glogal imaging quality setting 4e47d95d <a href="https://github.com/bep"><code>@​bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14979">#14979</a></li> <li>images: Make 60 the default quality for AVIF 03b4b542 <a href="https://github.com/bep"><code>@​bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14979">#14979</a></li> <li>livereload: Disconnect from websocket server on pageswap 79be0532 <a href="https://github.com/bep"><code>@​bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14983">#14983</a></li> <li>tpl/tplimpl/embedded: Prevent leading newline in sitemap template 0f440460 <a href="https://github.com/bep"><code>@​bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14977">#14977</a></li> <li>images: Recover from memory alloc errors in WASM image processors 4e17421e <a href="https://github.com/bep"><code>@​bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14985">#14985</a></li> <li>images: Add quality setting per image format b01ecd4c <a href="https://github.com/bep"><code>@​bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14957">#14957</a></li> <li>misc: Remove duplicate words in comments 45c00b7c <a href="https://github.com/jmooring"><code>@​jmooring</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14936">#14936</a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14950">#14950</a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14965">#14965</a></li> <li>Add some PNG to AVIF golden test cases 28d882ab <a href="https://github.com/bep"><code>@​bep</code></a></li> </ul> <h2>Dependency Updates</h2> <ul> <li>build(deps): bump github.com/bits-and-blooms/bitset 0d29fc81 <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]</li> <li>build(deps): bump github.com/tetratelabs/wazero bb57404f <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]</li> <li>build(deps): bump github.com/rogpeppe/go-internal from 1.14.1 to 1.15.0 7d1b1fb3 <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]</li> <li>build(deps): bump github.com/getkin/kin-openapi from 0.138.0 to 0.139.0 77a11470 <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]</li> </ul> <h2>v0.162.1</h2> <h2>What's Changed</h2> <ul> <li>modules/npm: Fix false stale warning after npm pack 59f35cd9 <a href="https://github.com/jmooring"><code>@​jmooring</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14959">#14959</a></li> <li>Revert &quot;tpl/collections: Make dict return nil when no values are provided&quot; c2709750 <a href="https://github.com/bep"><code>@​bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14958">#14958</a></li> <li>tpl/time: Fix locale-specific month abbreviations ea8b48af <a href="https://github.com/jmooring"><code>@​jmooring</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14948">#14948</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/gohugoio/hugo/commit/4a9485336a3ff2cea07ab88e2a17ec34d5baaa6e"><code>4a94853</code></a> releaser: Bump versions for release of 0.163.0</li> <li><a href="https://github.com/gohugoio/hugo/commit/1d018ef8573e1cbeca6c05b6df0792cb5f672541"><code>1d018ef</code></a> pagesfromdata: Use relative path for content adapter template metrics</li> <li><a href="https://github.com/gohugoio/hugo/commit/121bc6ceb232effd98a85a5fec357181be8ff01e"><code>121bc6c</code></a> ci: Re-add macos-latest to the test matrix</li> <li><a href="https://github.com/gohugoio/hugo/commit/0d29fc81bb559750644bc163ec67f21f3c36ed1b"><code>0d29fc8</code></a> build(deps): bump github.com/bits-and-blooms/bitset</li> <li><a href="https://github.com/gohugoio/hugo/commit/bb57404f3d93cd588e98f34c742b8b7c2741a4c7"><code>bb57404</code></a> build(deps): bump github.com/tetratelabs/wazero</li> <li><a href="https://github.com/gohugoio/hugo/commit/781fabf4e406aae6b888d4f9f68331e7f13e89aa"><code>781fabf</code></a> all: Run go fix ./...</li> <li><a href="https://github.com/gohugoio/hugo/commit/cf18b827e2bebe95f87b36bff9937218348a55ca"><code>cf18b82</code></a> images: Deprecate Imaging.Compression and move it down to webp and avif configs</li> <li><a href="https://github.com/gohugoio/hugo/commit/98ad9b3c03278d0af3ebd13f8ec9fc1a71d46745"><code>98ad9b3</code></a> Only support the latest Go version</li> <li><a href="https://github.com/gohugoio/hugo/commit/ff2903a9317ba45a65f9963f837c66cc6bce3c0e"><code>ff2903a</code></a> resources/jsconfig: Remove deprecated baseUrl setting</li> <li><a href="https://github.com/gohugoio/hugo/commit/7d1b1fb33dd7bdbb0d16dde9509ce15d93f7d894"><code>7d1b1fb</code></a> build(deps): bump github.com/rogpeppe/go-internal from 1.14.1 to 1.15.0</li> <li>Additional commits viewable in <a href="https://github.com/gohugoio/hugo/compare/v0.162.0...v0.163.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-09 11:14:22 +00:00
dependabot[bot]	5d8cd2ea7c	chore: bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.68.0 to 0.69.0 (#26042) ... Bumps [go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp](https://github.com/open-telemetry/opentelemetry-go-contrib) from 0.68.0 to 0.69.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-go-contrib/releases">go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp's releases</a>.</em></p> <blockquote> <h2>v1.44.0/v2.5.1/v0.69.0/v0.37.1/v0.24.0/v0.19.0/v0.16.1/v0.16.0</h2> <h3>Added</h3> <ul> <li>Add <code>error.type</code> attribute to <code>http.client.request.duration</code> for transport failures in <code>otelhttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8801">#8801</a>)</li> <li>Add examples for prometheus compatibility document. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8716">#8716</a>)</li> <li>Add support for <code>cardinality_limits</code> in <code>PeriodicMetricReader</code> in <code>otelconf</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8885">#8885</a>)</li> <li>Add <code>Resource</code> method to <code>SDK</code> in <code>go.opentelemetry.io/contrib/otelconf/x</code> to expose the resolved SDK resource from declarative configuration. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8913">#8913</a>)</li> <li>Add <code>go.opentelemetry.io/contrib/detectors/hetzner</code>, a new resource detector for Hetzner Cloud servers, ported from <code>github.com/open-telemetry/opentelemetry-collector-contrib/processor/resourcedetectionprocessor/internal/hetzner</code>. Detects <code>cloud.provider</code>, <code>cloud.platform</code>, <code>cloud.region</code>, <code>cloud.availability_zone</code>, <code>host.id</code>, and <code>host.name</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8979">#8979</a>)</li> </ul> <h3>Changed</h3> <ul> <li>Set error field as <code>record.SetErr</code> instead of a plain attribute in <code>go.opentelemetry.io/contrib/bridges/otellogrus</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8776">#8776</a>)</li> <li>Set the &quot;error&quot; field (e.g. created via <code>zap.Error</code>) as <code>record.SetErr</code> instead of a plain attribute in <code>go.opentelemetry.io/contrib/bridges/otelzap</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8719">#8719</a>)</li> <li>Set fields implementing <code>error</code> interface from <code>slog</code> records as <code>record.SetErr</code> instead of plain attributes in <code>go.opentelemetry.io/contrib/bridges/otelslog</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8774">#8774</a>)</li> <li>Set emitted errors in <code>go.opentelemetry.io/contrib/bridges/otellogr</code> as record errors (<code>Record.SetErr</code>) instead of <code>exception.message</code> attributes. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8775">#8775</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Fix header attributes lost when using sub-spans in <code>go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8797">#8797</a>)</li> <li>Validate <code>encoding</code> configuration for OTLP HTTP exporters in <code>go.opentelemetry.io/contrib/otelconf</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8772">#8772</a>)</li> <li>Remove the custom body wrapper from the request's body after the request is processed to allow body type comparisons with the original type in <code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code> and <code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/6914">#6914</a>)</li> <li>Unknown or empty HTTP methods now report &quot;_OTHER&quot; instead of &quot;GET&quot; across all HTTP instrumentations to align with OpenTelemetry semantic conventions. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8868">#8868</a>)</li> <li>The default span name formatter in <code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code> now conforms to the OpenTelemetry HTTP semantic conventions for server span names. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8871">#8871</a>) <ul> <li>The default span name is now <code>{method} {route}</code> (e.g. <code>GET /foo/{id}</code>) when a route pattern is available, or <code>{method}</code> (e.g. <code>GET</code>) otherwise.</li> </ul> </li> </ul> <h3>Removed</h3> <ul> <li>Remove the deprecated <code>WithSpanOptions</code> option in <code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8991">#8991</a>)</li> </ul> <h2>What's Changed</h2> <ul> <li>otelconf: validate encoding configuration for OTLP HTTP exporters by <a href="https://github.com/sonalgaud12"><code>@​sonalgaud12</code></a> in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8772">open-telemetry/opentelemetry-go-contrib#8772</a></li> <li>fix(deps): update module github.com/aws/aws-sdk-go-v2/service/s3 to v1.99.0 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8780">open-telemetry/opentelemetry-go-contrib#8780</a></li> <li>chore(deps): update prom/prometheus docker tag to v3.11.1 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8779">open-telemetry/opentelemetry-go-contrib#8779</a></li> <li>otellogrus: Set error field as <code>record.SetErr</code> by <a href="https://github.com/sonalgaud12"><code>@​sonalgaud12</code></a> in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8778">open-telemetry/opentelemetry-go-contrib#8778</a></li> <li>chore(deps): update module golang.org/x/sys to v0.43.0 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8783">open-telemetry/opentelemetry-go-contrib#8783</a></li> <li>chore(deps): update golang.org/x/telemetry digest to 93c7c8a by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8786">open-telemetry/opentelemetry-go-contrib#8786</a></li> <li>chore(deps): update module github.com/mattn/go-isatty to v0.0.21 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8787">open-telemetry/opentelemetry-go-contrib#8787</a></li> <li>chore(deps): update module github.com/mattn/go-runewidth to v0.0.23 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8788">open-telemetry/opentelemetry-go-contrib#8788</a></li> <li>chore(deps): update golang.org/x by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8791">open-telemetry/opentelemetry-go-contrib#8791</a></li> <li>chore(deps): update actions/github-script action to v9 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8795">open-telemetry/opentelemetry-go-contrib#8795</a></li> <li>fix(deps): update golang.org/x by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8794">open-telemetry/opentelemetry-go-contrib#8794</a></li> <li>otelzap: set error field as record.SetErr by <a href="https://github.com/iblancasa"><code>@​iblancasa</code></a> in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8719">open-telemetry/opentelemetry-go-contrib#8719</a></li> <li>fix(deps): update golang.org/x to 746e56f by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8796">open-telemetry/opentelemetry-go-contrib#8796</a></li> <li>chore(deps): update module golang.org/x/arch to v0.26.0 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8798">open-telemetry/opentelemetry-go-contrib#8798</a></li> <li>Check if otelgrpc metrics are enabled by <a href="https://github.com/dashpole"><code>@​dashpole</code></a> in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8792">open-telemetry/opentelemetry-go-contrib#8792</a></li> <li>chore(deps): update actions/upload-artifact action to v7.0.1 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8800">open-telemetry/opentelemetry-go-contrib#8800</a></li> <li>Check instrument enabled in deprecatedruntime by <a href="https://github.com/dashpole"><code>@​dashpole</code></a> in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8793">open-telemetry/opentelemetry-go-contrib#8793</a></li> <li>chore(deps): update module github.com/ashanbrown/forbidigo/v2 to v2.3.1 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8804">open-telemetry/opentelemetry-go-contrib#8804</a></li> <li>chore(deps): update module github.com/ashanbrown/makezero/v2 to v2.2.1 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8802">open-telemetry/opentelemetry-go-contrib#8802</a></li> <li>chore(deps): update module github.com/manuelarte/funcorder to v0.6.0 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8803">open-telemetry/opentelemetry-go-contrib#8803</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md">go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp's changelog</a>.</em></p> <blockquote> <h2>[1.44.0/2.5.1/0.69.0/0.37.1/0.24.0/0.19.0/0.16.1/0.16.0] - 2026-05-28</h2> <h3>Added</h3> <ul> <li>Add <code>error.type</code> attribute to <code>http.client.request.duration</code> for transport failures in <code>otelhttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8801">#8801</a>)</li> <li>Add examples for prometheus compatibility document. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8716">#8716</a>)</li> <li>Add support for <code>cardinality_limits</code> in <code>PeriodicMetricReader</code> in <code>otelconf</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8885">#8885</a>)</li> <li>Add <code>Resource</code> method to <code>SDK</code> in <code>go.opentelemetry.io/contrib/otelconf/x</code> to expose the resolved SDK resource from declarative configuration. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8913">#8913</a>)</li> <li>Add <code>go.opentelemetry.io/contrib/detectors/hetzner</code>, a new resource detector for Hetzner Cloud servers, ported from <code>github.com/open-telemetry/opentelemetry-collector-contrib/processor/resourcedetectionprocessor/internal/hetzner</code>. Detects <code>cloud.provider</code>, <code>cloud.platform</code>, <code>cloud.region</code>, <code>cloud.availability_zone</code>, <code>host.id</code>, and <code>host.name</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8979">#8979</a>)</li> </ul> <h3>Changed</h3> <ul> <li>Set error field as <code>record.SetErr</code> instead of a plain attribute in <code>go.opentelemetry.io/contrib/bridges/otellogrus</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8776">#8776</a>)</li> <li>Set the &quot;error&quot; field (e.g. created via <code>zap.Error</code>) as <code>record.SetErr</code> instead of a plain attribute in <code>go.opentelemetry.io/contrib/bridges/otelzap</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8719">#8719</a>)</li> <li>Set fields implementing <code>error</code> interface from <code>slog</code> records as <code>record.SetErr</code> instead of plain attributes in <code>go.opentelemetry.io/contrib/bridges/otelslog</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8774">#8774</a>)</li> <li>Set emitted errors in <code>go.opentelemetry.io/contrib/bridges/otellogr</code> as record errors (<code>Record.SetErr</code>) instead of <code>exception.message</code> attributes. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8775">#8775</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Fix header attributes lost when using sub-spans in <code>go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8797">#8797</a>)</li> <li>Validate <code>encoding</code> configuration for OTLP HTTP exporters in <code>go.opentelemetry.io/contrib/otelconf</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8772">#8772</a>)</li> <li>Remove the custom body wrapper from the request's body after the request is processed to allow body type comparisons with the original type in <code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code> and <code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/6914">#6914</a>)</li> <li>Unknown or empty HTTP methods now report &quot;_OTHER&quot; instead of &quot;GET&quot; across all HTTP instrumentations to align with OpenTelemetry semantic conventions. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8868">#8868</a>)</li> <li>The default span name formatter in <code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code> now conforms to the OpenTelemetry HTTP semantic conventions for server span names. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8871">#8871</a>) <ul> <li>The default span name is now <code>{method} {route}</code> (e.g. <code>GET /foo/{id}</code>) when a route pattern is available, or <code>{method}</code> (e.g. <code>GET</code>) otherwise.</li> </ul> </li> </ul> <h3>Removed</h3> <ul> <li>Remove the deprecated <code>WithSpanOptions</code> option in <code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8991">#8991</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/03b2bcdb54b3dde73c9ff91ae216aec262f6c8f5"><code>03b2bcd</code></a> Release v1.44.0/v2.5.1/v0.69.0/v0.37.1/v0.24.0/v0.19.0/v0.16.1/v0.16.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9033">#9033</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/80c46d4037d5991ce324216a52cf7e8d7f2d81fa"><code>80c46d4</code></a> chore(deps): update module github.com/alecthomas/chroma/v2 to v2.26.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9034">#9034</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/51f292197d33b84a21b3c70ae21cb185a2570d5e"><code>51f2921</code></a> fix(deps): update module github.com/hetznercloud/hcloud-go/v2 to v2.41.2 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9026">#9026</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/db82162f1b642bb6dca7fa5be48045315bb466d6"><code>db82162</code></a> fix(deps): update aws-sdk-go-v2 monorepo (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9031">#9031</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/5a3e533d8cd4045128e61a966f6dad58964a78ea"><code>5a3e533</code></a> fix(deps): update module github.com/aws/smithy-go to v1.26.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9032">#9032</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/c67843c753a924faef17bc4aa63c138aa9472477"><code>c67843c</code></a> otelhttp: Remove custom wrapper after handling request (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/6914">#6914</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/c0a41352283151ab6655e88120e4ff4f0a917a2e"><code>c0a4135</code></a> docs(otelhttptrace): add performance guidance for WithoutSubSpans (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8785">#8785</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/a51a86790e1f4df231a70bb5fecc72b95d3c1bf0"><code>a51a867</code></a> otelconf: implement cardinality_limits support in PeriodicMetricReader (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8885">#8885</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/dead6e50fc0b5b3dc4aea288df207953dae5afe7"><code>dead6e5</code></a> chore(deps): update module go.yaml.in/yaml/v2 to v2.4.4 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8994">#8994</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/979ce1857524394d0884fd7c491722c5bcb43d50"><code>979ce18</code></a> chore(deps): update module github.com/jgautheron/goconst to v1.10.2 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9030">#9030</a>)</li> <li>Additional commits viewable in <a href="https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.68.0...zpages/v0.69.0">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-05 12:37:40 +00:00
dependabot[bot]	7e3ac4a85e	chore: bump google.golang.org/api from 0.280.0 to 0.283.0 (#26045) ... Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.280.0 to 0.283.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's releases</a>.</em></p> <blockquote> <h2>v0.283.0</h2> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.282.0...v0.283.0">0.283.0</a> (2026-06-01)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3609">#3609</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/ed84bb800c56d3f7fee4c11f96673114e94a8cc2">ed84bb8</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3611">#3611</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/3855346eda7f4ba6c844d86de5de493d3e395f00">3855346</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3612">#3612</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/32624d32240ec8e5997810fb9cb54f8000b6c7f8">32624d3</a>)</li> </ul> <h2>v0.282.0</h2> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.281.0...v0.282.0">0.282.0</a> (2026-05-27)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3607">#3607</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/3c139a07f71096667d5a623591ddb37dacd38d55">3c139a0</a>)</li> </ul> <h2>v0.281.0</h2> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.280.0...v0.281.0">0.281.0</a> (2026-05-26)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3600">#3600</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/bcaee85f93824a21f5441c2ccd3b4d4811d97de7">bcaee85</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3602">#3602</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/f0071d379f4443ffdae9994fe141b1b5e0c18a62">f0071d3</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3603">#3603</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/b1aa9dea8c3c0e539c8d9687c99c55ec3679c996">b1aa9de</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3604">#3604</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/711e008d9caf16e6fb68c860f83a28fd0a8c0f98">711e008</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3606">#3606</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/3ad8e8e2ab4ae50862c0fc5b17efa2d3cda33d9a">3ad8e8e</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.282.0...v0.283.0">0.283.0</a> (2026-06-01)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3609">#3609</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/ed84bb800c56d3f7fee4c11f96673114e94a8cc2">ed84bb8</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3611">#3611</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/3855346eda7f4ba6c844d86de5de493d3e395f00">3855346</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3612">#3612</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/32624d32240ec8e5997810fb9cb54f8000b6c7f8">32624d3</a>)</li> </ul> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.281.0...v0.282.0">0.282.0</a> (2026-05-27)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3607">#3607</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/3c139a07f71096667d5a623591ddb37dacd38d55">3c139a0</a>)</li> </ul> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.280.0...v0.281.0">0.281.0</a> (2026-05-26)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3600">#3600</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/bcaee85f93824a21f5441c2ccd3b4d4811d97de7">bcaee85</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3602">#3602</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/f0071d379f4443ffdae9994fe141b1b5e0c18a62">f0071d3</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3603">#3603</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/b1aa9dea8c3c0e539c8d9687c99c55ec3679c996">b1aa9de</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3604">#3604</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/711e008d9caf16e6fb68c860f83a28fd0a8c0f98">711e008</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3606">#3606</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/3ad8e8e2ab4ae50862c0fc5b17efa2d3cda33d9a">3ad8e8e</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/googleapis/google-api-go-client/commit/f6726366ff2f0b8fc82cec6f063dc9beb3ab1377"><code>f672636</code></a> chore(main): release 0.283.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3610">#3610</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/32624d32240ec8e5997810fb9cb54f8000b6c7f8"><code>32624d3</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3612">#3612</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/3855346eda7f4ba6c844d86de5de493d3e395f00"><code>3855346</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3611">#3611</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/ed84bb800c56d3f7fee4c11f96673114e94a8cc2"><code>ed84bb8</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3609">#3609</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/60aebbd7406af09eb63866ff79f0dbd40cccecbb"><code>60aebbd</code></a> chore(main): release 0.282.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3608">#3608</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/3c139a07f71096667d5a623591ddb37dacd38d55"><code>3c139a0</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3607">#3607</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/8f434ff91fe8dc299942ecd7c87ebab151ff38e5"><code>8f434ff</code></a> chore(main): release 0.281.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3601">#3601</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/57f4b28d8c80b464f7f0b486a555de528fb89c4e"><code>57f4b28</code></a> chore(all): update all (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3605">#3605</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/3ad8e8e2ab4ae50862c0fc5b17efa2d3cda33d9a"><code>3ad8e8e</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3606">#3606</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/711e008d9caf16e6fb68c860f83a28fd0a8c0f98"><code>711e008</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3604">#3604</a>)</li> <li>Additional commits viewable in <a href="https://github.com/googleapis/google-api-go-client/compare/v0.280.0...v0.283.0">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-05 12:37:19 +00:00
Ehab Younes	38ae92b6b7	chore: upgrade slog to 3.1.0 (#26096) ... Changes from https://github.com/coder/slog/releases/tag/v3.1.0 This also carries the transitive dependency versions required by `cdr.dev/slog/v3@v3.1.0`, including OpenTelemetry `v1.44.0`, Cloud Logging `v1.18.0`, and the updated `google.golang.org/genproto` modules.	2026-06-05 15:23:04 +03:00
Michael Suchacz	c4792cf104	fix: show Anthropic Opus 4.7+ thinking (#26026) ... ## Summary - Updates Coder's pinned `github.com/coder/fantasy` fork to include coder/fantasy#39. - Exposes Anthropic `thinking_display` as a typed chat model provider option with `summarized` and `omitted` values. - Validates configured `thinking_display` values and maps them to `fantasyanthropic.ProviderOptions.ThinkingDisplay`. - Regenerates the API/UI option schemas so the admin model config form gets a generated select field. ## Tests - `go mod tidy` - `make gen` - `go test ./codersdk ./coderd/x/chatd/chatprovider ./coderd -run 'TestChatModelProviderOptions|TestAnthropicThinkingDisplayFromChat|TestProviderOptionsFromChatModelConfig_AnthropicThinkingDisplay|TestMergeMissingProviderOptions_AnthropicThinkingDisplay|TestValidateChatModelProviderOptions_AnthropicThinkingDisplay'` - `go test ./coderd/x/chatd/... ./codersdk` - `go test ./coderd -run 'TestValidateChatModelProviderOptions_AnthropicThinkingDisplay'` - `pnpm --dir site exec -- biome lint --error-on-warnings src/api/chatModelOptionsGenerated.json src/api/typesGenerated.ts` - pre-commit hook, including fmt, lint, and slim build > Mux working on behalf of Mike.	2026-06-05 08:37:54 +02:00
Seth Shelnutt	61a35185cf	fix: upgrade Go toolchain from 1.26.2 to 1.26.4 (#26066) ... Upgrades the Go toolchain from 1.26.2 to 1.26.4 to address two stdlib CVEs: - **CVE-2026-27145** (Low): `crypto/x509` `VerifyHostname` has quadratic cost with large DNS SAN lists, enabling DoS with untrusted certificates. - **CVE-2026-42507** (Low): `net/textproto` includes attacker-controlled input in errors without escaping, enabling log injection. ### Changes - `go.mod`: Bump `go` directive from 1.26.2 to 1.26.4 - `mise.toml`: Bump `go` tool version from 1.26.2 to 1.26.4 - `mise.lock`: Regenerated with updated Go checksums Resolves ENT-104 > Generated by Coder Agents on behalf of @Shelnutt2	2026-06-04 11:22:28 -04:00
dependabot[bot]	a67f53870f	chore: bump github.com/nats-io/nats-server/v2 from 2.12.8 to 2.14.2 (#26046) ... Bumps [github.com/nats-io/nats-server/v2](https://github.com/nats-io/nats-server) from 2.12.8 to 2.14.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/nats-io/nats-server/releases">github.com/nats-io/nats-server/v2's releases</a>.</em></p> <blockquote> <h2>Release v2.14.2</h2> <h2>Changelog</h2> <p>Refer to the <a href="https://docs.nats.io/release-notes/whats_new/whats_new_214">2.14 Upgrade Guide</a> for backwards compatibility notes with 2.12.x. Please note that the 2.13.x version was skipped.</p> <h3>Go Version</h3> <ul> <li>1.26.3</li> </ul> <h3>Dependencies</h3> <ul> <li>golang.org/x/crypto v0.52.0</li> <li>golang.org/x/sys v0.45.0</li> <li>github.com/nats-io/jwt/v2 v2.8.2</li> <li>github.com/nats-io/nkeys v0.4.16</li> </ul> <h3>Improved</h3> <p>General</p> <ul> <li>The client ID is now available through the embedded <code>ClientAuthentication</code> API (<a href="https://redirect.github.com/nats-io/nats-server/issues/8217">#8217</a>)</li> </ul> <h3>Fixed</h3> <p>General</p> <ul> <li>A race condition when handling subscription interest over routes has been fixed (<a href="https://redirect.github.com/nats-io/nats-server/issues/8235">#8235</a>)</li> <li>Potential protocol-level corruption from rewriting <code>$JS.ACK</code> subjects has been fixed (<a href="https://redirect.github.com/nats-io/nats-server/issues/8242">#8242</a>)</li> <li>Potential protocol-level corruption from buffer misuse in compressed WebSocket clients has been fixed (<a href="https://redirect.github.com/nats-io/nats-server/issues/8244">#8244</a>)</li> <li>The <code>/accstatz</code> monitoring endpoint no longer omits accounts with only leaf connections (<a href="https://redirect.github.com/nats-io/nats-server/issues/8252">#8252</a>)</li> </ul> <p>JetStream</p> <ul> <li>Fixed a case where Raft peers were not correctly tracked after an inactivity stall during catchup (<a href="https://redirect.github.com/nats-io/nats-server/issues/8226">#8226</a>)</li> <li>Quorum needed is now calculated correctly when bootstrapping the metalayer when gateway URLs resolve to multiple IP addresses (<a href="https://redirect.github.com/nats-io/nats-server/issues/8238">#8238</a>)</li> <li>The filestore no longer performs a block skip check on streams with extremely high subject counts, as it could result in runaway CPU usage (<a href="https://redirect.github.com/nats-io/nats-server/issues/8227">#8227</a>)</li> <li>Fixed a case where the filestore would not release a lock after handling a write error (<a href="https://redirect.github.com/nats-io/nats-server/issues/8232">#8232</a>)</li> <li>Purge operations on both file and memory stores are now more consistent with each other (<a href="https://redirect.github.com/nats-io/nats-server/issues/8241">#8241</a>)</li> <li>Fixed a case where the consumer lock would not release a lock after handling a start sequence error (<a href="https://redirect.github.com/nats-io/nats-server/issues/8230">#8230</a>)</li> <li>Counter streams and message schedules now have configuration constraints applied to prevent incorrect usage patterns (<a href="https://redirect.github.com/nats-io/nats-server/issues/8240">#8240</a>)</li> <li>Improved stream and consumer scale down behaviour consistency (<a href="https://redirect.github.com/nats-io/nats-server/issues/8253">#8253</a>)</li> <li>Fixed an issue where the per-subject state last block was not stored correctly with a max messages per subject limit of 1 (<a href="https://redirect.github.com/nats-io/nats-server/issues/8254">#8254</a>)</li> <li>Fixed a drift that could occur in the peer sets after a peer remove of an online node (<a href="https://redirect.github.com/nats-io/nats-server/issues/8258">#8258</a>)</li> </ul> <h3>Complete Changes</h3> <p><a href="https://github.com/nats-io/nats-server/compare/v2.14.1...v2.14.2">https://github.com/nats-io/nats-server/compare/v2.14.1...v2.14.2</a></p> <h2>Release v2.14.2-RC.1</h2> <h2>Changelog</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nats-io/nats-server/commit/1d065926bb99ed14ebe9cf6a21529d28310fc8d3"><code>1d06592</code></a> Release v2.14.2</li> <li><a href="https://github.com/nats-io/nats-server/commit/4e1aefa11412f699f6e31549ea215389824d4c07"><code>4e1aefa</code></a> Cherry-picks for v2.14.2 (<a href="https://redirect.github.com/nats-io/nats-server/issues/8256">#8256</a>)</li> <li><a href="https://github.com/nats-io/nats-server/commit/ac092ff7c60aa4a0fa3f466198aa89d58bd15f47"><code>ac092ff</code></a> Update dependencies</li> <li><a href="https://github.com/nats-io/nats-server/commit/01e589d49a512276adfa9f60699560c5be63bfd5"><code>01e589d</code></a> [FIXED] Peer set desync/re-add after stream peer-remove</li> <li><a href="https://github.com/nats-io/nats-server/commit/3d122e82432917c2e4395523a33e929cc71ec5ca"><code>3d122e8</code></a> De-flake TestJetStreamConsumerPrioritized</li> <li><a href="https://github.com/nats-io/nats-server/commit/3836d96692a7b9d1405ea404161e6a7f48ba3115"><code>3836d96</code></a> [FIXED] Initial MaxMsgsPerSubject update not enforced</li> <li><a href="https://github.com/nats-io/nats-server/commit/92cf2e314fe7ef38f3ac6223f874efa0f58819e0"><code>92cf2e3</code></a> [FIXED] Filestore only stores last block when MaxMsgsPerSubject 1</li> <li><a href="https://github.com/nats-io/nats-server/commit/3288b4fe279b6f689dc985758add443acb9095db"><code>3288b4f</code></a> (2.14) [IMPROVED] Remove redundant error check in filestore</li> <li><a href="https://github.com/nats-io/nats-server/commit/6ea46d54029a662ae3545da70b01c32976f6cdbc"><code>6ea46d5</code></a> [FIXED] Stream and consumer scale down consistency</li> <li><a href="https://github.com/nats-io/nats-server/commit/5edd91c01a32945e1a4837a104c59114972c9bfb"><code>5edd91c</code></a> [FIXED] AccountStatz omits accounts with only leaf connections</li> <li>Additional commits viewable in <a href="https://github.com/nats-io/nats-server/compare/v2.12.8...v2.14.2">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-04 00:27:26 +00:00
dependabot[bot]	dc6202f7da	chore: bump github.com/prometheus/common from 0.67.5 to 0.68.1 (#26041) ... Bumps [github.com/prometheus/common](https://github.com/prometheus/common) from 0.67.5 to 0.68.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/prometheus/common/releases">github.com/prometheus/common's releases</a>.</em></p> <blockquote> <h2>v0.68.1</h2> <h2>What's Changed</h2> <ul> <li>build(deps): bump golang.org/x/net from 0.52.0 to 0.53.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/common/pull/903">prometheus/common#903</a></li> <li>build(deps): bump golang.org/x/net from 0.53.0 to 0.55.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/common/pull/914">prometheus/common#914</a></li> <li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@​prombot</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/915">prometheus/common#915</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/prometheus/common/compare/v0.68.0...v0.68.1">https://github.com/prometheus/common/compare/v0.68.0...v0.68.1</a></p> <h2>v0.68.0</h2> <h2>What's Changed</h2> <ul> <li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@​prombot</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/873">prometheus/common#873</a></li> <li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@​prombot</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/874">prometheus/common#874</a></li> <li>build(deps): bump github.com/golang-jwt/jwt/v5 from 5.3.0 to 5.3.1 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/common/pull/879">prometheus/common#879</a></li> <li>build(deps): bump golang.org/x/net from 0.48.0 to 0.49.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/common/pull/878">prometheus/common#878</a></li> <li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@​prombot</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/875">prometheus/common#875</a></li> <li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@​prombot</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/880">prometheus/common#880</a></li> <li>Remove logic adding unit to metrics name by <a href="https://github.com/vesari"><code>@​vesari</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/877">prometheus/common#877</a></li> <li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@​prombot</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/881">prometheus/common#881</a></li> <li>Update for Go 1.26 by <a href="https://github.com/SuperQ"><code>@​SuperQ</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/883">prometheus/common#883</a></li> <li>build(deps): bump golang.org/x/net from 0.49.0 to 0.51.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/common/pull/882">prometheus/common#882</a></li> <li>version: Add a slog helper by <a href="https://github.com/SuperQ"><code>@​SuperQ</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/886">prometheus/common#886</a></li> <li>Remove Arthur from maintainers list by <a href="https://github.com/ArthurSens"><code>@​ArthurSens</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/885">prometheus/common#885</a></li> <li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@​prombot</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/895">prometheus/common#895</a></li> <li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@​prombot</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/896">prometheus/common#896</a></li> <li>config: change NewOAuth2RoundTripper to accept variadic HTTPClientOption by <a href="https://github.com/alliasgher"><code>@​alliasgher</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/898">prometheus/common#898</a></li> <li>config: guard against nil oauth2 credential in RoundTrip by <a href="https://github.com/alliasgher"><code>@​alliasgher</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/897">prometheus/common#897</a></li> <li>build(deps): bump golang.org/x/net from 0.51.0 to 0.52.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/common/pull/890">prometheus/common#890</a></li> <li>build(deps): bump go.yaml.in/yaml/v2 from 2.4.3 to 2.4.4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/common/pull/891">prometheus/common#891</a></li> <li>build(deps): bump golang.org/x/oauth2 from 0.34.0 to 0.36.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/common/pull/892">prometheus/common#892</a></li> <li>Move interface assertions to a test file by <a href="https://github.com/msiegen"><code>@​msiegen</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/839">prometheus/common#839</a></li> <li>fix(http_config): fix client cert rotation when no CA is configured by <a href="https://github.com/machine424"><code>@​machine424</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/908">prometheus/common#908</a></li> <li>Remove CircleCI by <a href="https://github.com/ArthurSens"><code>@​ArthurSens</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/910">prometheus/common#910</a></li> <li>Fix: apply DialContextFunc to OAuth2 token-fetch transport by <a href="https://github.com/yuri-tceretian"><code>@​yuri-tceretian</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/911">prometheus/common#911</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/alliasgher"><code>@​alliasgher</code></a> made their first contribution in <a href="https://redirect.github.com/prometheus/common/pull/898">prometheus/common#898</a></li> <li><a href="https://github.com/msiegen"><code>@​msiegen</code></a> made their first contribution in <a href="https://redirect.github.com/prometheus/common/pull/839">prometheus/common#839</a></li> <li><a href="https://github.com/machine424"><code>@​machine424</code></a> made their first contribution in <a href="https://redirect.github.com/prometheus/common/pull/908">prometheus/common#908</a></li> <li><a href="https://github.com/yuri-tceretian"><code>@​yuri-tceretian</code></a> made their first contribution in <a href="https://redirect.github.com/prometheus/common/pull/911">prometheus/common#911</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/prometheus/common/compare/v0.67.5...v0.68.0">https://github.com/prometheus/common/compare/v0.67.5...v0.68.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/prometheus/common/commit/212057321e897d625d07379aaddaca01afca7710"><code>2120573</code></a> Update common Prometheus files (<a href="https://redirect.github.com/prometheus/common/issues/915">#915</a>)</li> <li><a href="https://github.com/prometheus/common/commit/228386adfe1e9c8ede570fbca47782a9abca1a35"><code>228386a</code></a> build(deps): bump golang.org/x/net from 0.53.0 to 0.55.0 (<a href="https://redirect.github.com/prometheus/common/issues/914">#914</a>)</li> <li><a href="https://github.com/prometheus/common/commit/b8c88b4866403159e523c588dc7563b0f78c0418"><code>b8c88b4</code></a> build(deps): bump golang.org/x/net from 0.52.0 to 0.53.0 (<a href="https://redirect.github.com/prometheus/common/issues/903">#903</a>)</li> <li><a href="https://github.com/prometheus/common/commit/1e0ae832fb26a2c20c2c0d6ee1289111c668be18"><code>1e0ae83</code></a> config: apply DialContextFunc to OAuth2 token-fetch transport (<a href="https://redirect.github.com/prometheus/common/issues/911">#911</a>)</li> <li><a href="https://github.com/prometheus/common/commit/b51d01ba2175d103309dcee11f6c01bd03487a64"><code>b51d01b</code></a> Remove CircleCI (<a href="https://redirect.github.com/prometheus/common/issues/910">#910</a>)</li> <li><a href="https://github.com/prometheus/common/commit/0f3c348807322ea84d92fc7688b1b37a08e17d1f"><code>0f3c348</code></a> Merge pull request <a href="https://redirect.github.com/prometheus/common/issues/908">#908</a> from machine424/ttlsco</li> <li><a href="https://github.com/prometheus/common/commit/732a9cf781621a8d8f895ef933b78cf4e9f5d6af"><code>732a9cf</code></a> fix(http_config): fix client cert rotation when no CA is configured</li> <li><a href="https://github.com/prometheus/common/commit/ce9215c53d8c8e507c5f72a69d80568c072be3d9"><code>ce9215c</code></a> Move interface assertions to a test file (<a href="https://redirect.github.com/prometheus/common/issues/839">#839</a>)</li> <li><a href="https://github.com/prometheus/common/commit/1ba5ed78ffdaf199c6dded3ff8ac88edbdb53712"><code>1ba5ed7</code></a> build(deps): bump golang.org/x/oauth2 from 0.34.0 to 0.36.0 (<a href="https://redirect.github.com/prometheus/common/issues/892">#892</a>)</li> <li><a href="https://github.com/prometheus/common/commit/8f8ada69df73ad76cabef710856070a42ef420c0"><code>8f8ada6</code></a> build(deps): bump go.yaml.in/yaml/v2 from 2.4.3 to 2.4.4 (<a href="https://redirect.github.com/prometheus/common/issues/891">#891</a>)</li> <li>Additional commits viewable in <a href="https://github.com/prometheus/common/compare/v0.67.5...v0.68.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-04 00:13:22 +00:00
dependabot[bot]	02ffd456d1	chore: bump github.com/aws/smithy-go from 1.25.1 to 1.27.0 (#26043) ... Bumps [github.com/aws/smithy-go](https://github.com/aws/smithy-go) from 1.25.1 to 1.27.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/aws/smithy-go/blob/main/CHANGELOG.md">github.com/aws/smithy-go's changelog</a>.</em></p> <blockquote> <h1>Release (2026-06-02)</h1> <h2>General Highlights</h2> <ul> <li><strong>Dependency Update</strong>: Updated to the latest SDK module versions</li> </ul> <h2>Module Highlights</h2> <ul> <li><code>github.com/aws/smithy-go</code>: v1.27.0 <ul> <li><strong>Feature</strong>: Add APIs for schema-based serialization.</li> <li><strong>Feature</strong>: Add support for all current AWS and Smithy protocols.</li> <li><strong>Bug Fix</strong>: Enforce max nesting depth of 128 on CBOR payloads.</li> </ul> </li> <li><code>github.com/aws/smithy-go/aws-http-auth</code>: <a href="https://github.com/aws/smithy-go/blob/main/aws-http-auth/CHANGELOG.md#v120-2026-06-02">v1.2.0</a> <ul> <li><strong>Feature</strong>: Add event stream signer.</li> </ul> </li> </ul> <h1>Release (2026-05-27)</h1> <h2>General Highlights</h2> <ul> <li><strong>Dependency Update</strong>: Updated to the latest SDK module versions</li> </ul> <h2>Module Highlights</h2> <ul> <li><code>github.com/aws/smithy-go</code>: v1.26.0 <ul> <li><strong>Feature</strong>: Add StringSlice to endpoint rulesfn.</li> </ul> </li> </ul> <h1>Release (2026-04-23)</h1> <h2>General Highlights</h2> <ul> <li><strong>Dependency Update</strong>: Updated to the latest SDK module versions</li> </ul> <h2>Module Highlights</h2> <ul> <li><code>github.com/aws/smithy-go</code>: v1.25.1 <ul> <li><strong>Bug Fix</strong>: Fixed a memory leak in the LRU cache implementation used by some AWS services.</li> </ul> </li> </ul> <h1>Release (2026-04-15)</h1> <h2>General Highlights</h2> <ul> <li><strong>Dependency Update</strong>: Updated to the latest SDK module versions</li> </ul> <h2>Module Highlights</h2> <ul> <li><code>github.com/aws/smithy-go</code>: v1.25.0 <ul> <li><strong>Feature</strong>: Add support for endpointBdd trait</li> </ul> </li> </ul> <h1>Release (2026-04-02)</h1> <h2>General Highlights</h2> <ul> <li><strong>Dependency Update</strong>: Updated to the latest SDK module versions</li> </ul> <h2>Module Highlights</h2> <ul> <li><code>github.com/aws/smithy-go</code>: v1.24.3 <ul> <li><strong>Bug Fix</strong>: Add additional sigv4 configuration.</li> </ul> </li> <li><code>github.com/aws/smithy-go/aws-http-auth</code>: <a href="https://github.com/aws/smithy-go/blob/main/aws-http-auth/CHANGELOG.md#v113-2026-04-02">v1.1.3</a> <ul> <li><strong>Bug Fix</strong>: Add additional sigv4 configuration.</li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/aws/smithy-go/commit/3f6ece24dd0646e1f43ce05d980bcb4880a6e7fe"><code>3f6ece2</code></a> Release 2026-06-02</li> <li><a href="https://github.com/aws/smithy-go/commit/3432807d26fd8d74013bd20d7d4c56ff379e2e16"><code>3432807</code></a> Revert &quot;changelog&quot;</li> <li><a href="https://github.com/aws/smithy-go/commit/9663ed6253396a37d3cca9e37a9410118a370bc1"><code>9663ed6</code></a> changelog</li> <li><a href="https://github.com/aws/smithy-go/commit/bcd9f540477b856423b2a8f679574df8026a5dbe"><code>bcd9f54</code></a> enforce a max nesting depth of 128 on cbor payloads (<a href="https://redirect.github.com/aws/smithy-go/issues/670">#670</a>)</li> <li><a href="https://github.com/aws/smithy-go/commit/ff093e96647027be14e7079a03359bc8c80d6b6f"><code>ff093e9</code></a> changelog</li> <li><a href="https://github.com/aws/smithy-go/commit/1db7cb38af94cbdbf000a31a56f5a1d20191fa68"><code>1db7cb3</code></a> hold off on unsafe string for now</li> <li><a href="https://github.com/aws/smithy-go/commit/473b1947c03deea1898ffd01fbba8de765d5eed7"><code>473b194</code></a> update README again</li> <li><a href="https://github.com/aws/smithy-go/commit/6620de4fc429f2553f793bb170a997e6c9d2e439"><code>6620de4</code></a> update README</li> <li><a href="https://github.com/aws/smithy-go/commit/22c5357d5d20fd4262b62ca7bb3530d7759a79bf"><code>22c5357</code></a> introduce schema-based serialization (<a href="https://redirect.github.com/aws/smithy-go/issues/666">#666</a>)</li> <li><a href="https://github.com/aws/smithy-go/commit/6857390fd160b416d0e369dc9dc5c2b3736178fc"><code>6857390</code></a> fix: remove deprecated io/ioutil from codegen templates (<a href="https://redirect.github.com/aws/smithy-go/issues/669">#669</a>)</li> <li>Additional commits viewable in <a href="https://github.com/aws/smithy-go/compare/v1.25.1...v1.27.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-04 00:13:19 +00:00
dependabot[bot]	3ffccf38ac	chore: bump github.com/jedib0t/go-pretty/v6 from 6.7.1 to 6.8.0 (#26047) ... Bumps [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty) from 6.7.1 to 6.8.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jedib0t/go-pretty/releases">github.com/jedib0t/go-pretty/v6's releases</a>.</em></p> <blockquote> <h2>v6.8.0</h2> <h2>What's Changed</h2> <ul> <li>progress: fix speed decay on done trackers and log overwrite; fixes <a href="https://redirect.github.com/jedib0t/go-pretty/issues/405">#405</a> by <a href="https://github.com/jedib0t"><code>@​jedib0t</code></a> in <a href="https://redirect.github.com/jedib0t/go-pretty/pull/406">jedib0t/go-pretty#406</a></li> <li>fix: wrap wide runes when wrapLen is odd in WrapHard by <a href="https://github.com/koriyoshi2041"><code>@​koriyoshi2041</code></a> in <a href="https://redirect.github.com/jedib0t/go-pretty/pull/408">jedib0t/go-pretty#408</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/koriyoshi2041"><code>@​koriyoshi2041</code></a> made their first contribution in <a href="https://redirect.github.com/jedib0t/go-pretty/pull/408">jedib0t/go-pretty#408</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/jedib0t/go-pretty/compare/v6.7.10...v6.8.0">https://github.com/jedib0t/go-pretty/compare/v6.7.10...v6.8.0</a></p> <h2>v6.7.10</h2> <h2>What's Changed</h2> <ul> <li>Fix panic on text align with unicode by <a href="https://github.com/edznux-dd"><code>@​edznux-dd</code></a> in <a href="https://redirect.github.com/jedib0t/go-pretty/pull/404">jedib0t/go-pretty#404</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/edznux-dd"><code>@​edznux-dd</code></a> made their first contribution in <a href="https://redirect.github.com/jedib0t/go-pretty/pull/404">jedib0t/go-pretty#404</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/jedib0t/go-pretty/compare/v6.7.9...v6.7.10">https://github.com/jedib0t/go-pretty/compare/v6.7.9...v6.7.10</a></p> <h2>v6.7.9</h2> <h2>What's Changed</h2> <ul> <li>table: markdown padding for human-friendly output; fixes <a href="https://redirect.github.com/jedib0t/go-pretty/issues/402">#402</a> by <a href="https://github.com/jedib0t"><code>@​jedib0t</code></a> in <a href="https://redirect.github.com/jedib0t/go-pretty/pull/403">jedib0t/go-pretty#403</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/jedib0t/go-pretty/compare/v6.7.8...v6.7.9">https://github.com/jedib0t/go-pretty/compare/v6.7.8...v6.7.9</a></p> <h2>v6.7.8</h2> <h2>What's Changed</h2> <ul> <li>progress: SortByIndex for better control of sorting by <a href="https://github.com/jedib0t"><code>@​jedib0t</code></a> in <a href="https://redirect.github.com/jedib0t/go-pretty/pull/398">jedib0t/go-pretty#398</a></li> <li>progress: address race conditions in render/stop/trackers; fixes 399 by <a href="https://github.com/jedib0t"><code>@​jedib0t</code></a> in <a href="https://redirect.github.com/jedib0t/go-pretty/pull/401">jedib0t/go-pretty#401</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/jedib0t/go-pretty/compare/v6.7.7...v6.7.8">https://github.com/jedib0t/go-pretty/compare/v6.7.7...v6.7.8</a></p> <h2>v6.7.7</h2> <h2>What's Changed</h2> <ul> <li>table: fix border with no data rows (original behavior) by <a href="https://github.com/jedib0t"><code>@​jedib0t</code></a> in <a href="https://redirect.github.com/jedib0t/go-pretty/pull/397">jedib0t/go-pretty#397</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/jedib0t/go-pretty/compare/v6.7.6...v6.7.7">https://github.com/jedib0t/go-pretty/compare/v6.7.6...v6.7.7</a></p> <h2>v6.7.6</h2> <h2>What's Changed</h2> <ul> <li>text: fix alignment issues with box/block chars by <a href="https://github.com/jedib0t"><code>@​jedib0t</code></a> in <a href="https://redirect.github.com/jedib0t/go-pretty/pull/389">jedib0t/go-pretty#389</a></li> <li>table: FilterBy: add row filtering support by <a href="https://github.com/jedib0t"><code>@​jedib0t</code></a> in <a href="https://redirect.github.com/jedib0t/go-pretty/pull/390">jedib0t/go-pretty#390</a></li> <li>table: split style.go into individual files by <a href="https://github.com/jedib0t"><code>@​jedib0t</code></a> in <a href="https://redirect.github.com/jedib0t/go-pretty/pull/392">jedib0t/go-pretty#392</a></li> <li>table: fix border with no data rows; fixes <a href="https://redirect.github.com/jedib0t/go-pretty/issues/395">#395</a> by <a href="https://github.com/jedib0t"><code>@​jedib0t</code></a> in <a href="https://redirect.github.com/jedib0t/go-pretty/pull/396">jedib0t/go-pretty#396</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/jedib0t/go-pretty/compare/v6.7.5...v6.7.6">https://github.com/jedib0t/go-pretty/compare/v6.7.5...v6.7.6</a></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/jedib0t/go-pretty/commit/45fb00d043b710d670b9e921f9e9c58111460522"><code>45fb00d</code></a> text: wrap wide runes when wrapLen is odd in WrapHard (<a href="https://redirect.github.com/jedib0t/go-pretty/issues/408">#408</a>)</li> <li><a href="https://github.com/jedib0t/go-pretty/commit/ad1754989240b73f22b3f4911dd5d3d40b7c22c8"><code>ad17549</code></a> progress: fix speed decay on done trackers and log overwrite; fixes <a href="https://redirect.github.com/jedib0t/go-pretty/issues/405">#405</a> (<a href="https://redirect.github.com/jedib0t/go-pretty/issues/406">#406</a>)</li> <li><a href="https://github.com/jedib0t/go-pretty/commit/66563fd9a0aa2096db65417e9cb0b5841957d8aa"><code>66563fd</code></a> text: fix panic on align with unicode (<a href="https://redirect.github.com/jedib0t/go-pretty/issues/404">#404</a>)</li> <li><a href="https://github.com/jedib0t/go-pretty/commit/017a359e50d97a9f5ed869ceed4b2e23acdea9de"><code>017a359</code></a> table: markdown padding for human-friendly output; fixes <a href="https://redirect.github.com/jedib0t/go-pretty/issues/402">#402</a> (<a href="https://redirect.github.com/jedib0t/go-pretty/issues/403">#403</a>)</li> <li><a href="https://github.com/jedib0t/go-pretty/commit/f05e1de9926ede0af62f680829a87133a0ad5fd7"><code>f05e1de</code></a> progress: address race conditions in render/stop/trackers; fixes 399 (<a href="https://redirect.github.com/jedib0t/go-pretty/issues/401">#401</a>)</li> <li><a href="https://github.com/jedib0t/go-pretty/commit/1cebbc5ded6de0bb3419c7d0bc34abaa97f389f4"><code>1cebbc5</code></a> progress: SortByIndex for better control of sorting (<a href="https://redirect.github.com/jedib0t/go-pretty/issues/398">#398</a>)</li> <li><a href="https://github.com/jedib0t/go-pretty/commit/b0a2ab976f5d85d1368824a904e645a636c1b3c8"><code>b0a2ab9</code></a> table: fix border with no data rows (original behavior) (<a href="https://redirect.github.com/jedib0t/go-pretty/issues/397">#397</a>)</li> <li><a href="https://github.com/jedib0t/go-pretty/commit/73867ddb662b6ce805252e910c4922548f0fd337"><code>73867dd</code></a> table: fix border with no data rows; fixes <a href="https://redirect.github.com/jedib0t/go-pretty/issues/395">#395</a> (<a href="https://redirect.github.com/jedib0t/go-pretty/issues/396">#396</a>)</li> <li><a href="https://github.com/jedib0t/go-pretty/commit/b2eda901ed06554942e31e54ab28af675494291a"><code>b2eda90</code></a> table: split style.go into individual files (<a href="https://redirect.github.com/jedib0t/go-pretty/issues/392">#392</a>)</li> <li><a href="https://github.com/jedib0t/go-pretty/commit/0b7174f7b48136ba1bf9e59679f18e88571b6e31"><code>0b7174f</code></a> README.me: link to package README.md instead of folder (<a href="https://redirect.github.com/jedib0t/go-pretty/issues/391">#391</a>)</li> <li>Additional commits viewable in <a href="https://github.com/jedib0t/go-pretty/compare/v6.7.1...v6.8.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-04 00:12:36 +00:00
dependabot[bot]	62338f3f08	chore: bump github.com/nats-io/nats.go from 1.51.0 to 1.52.0 (#26044) ... Bumps [github.com/nats-io/nats.go](https://github.com/nats-io/nats.go) from 1.51.0 to 1.52.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/nats-io/nats.go/releases">github.com/nats-io/nats.go's releases</a>.</em></p> <blockquote> <h2>Release v1.52.0</h2> <h2>Changelog</h2> <p>This release focuses on 2.14 nats-server features support.</p> <h3>ADDED</h3> <ul> <li>JetStream: <ul> <li>Added fast batch stream config field (<a href="https://redirect.github.com/nats-io/nats.go/issues/2052">#2052</a>)</li> <li>Added message scheduling headers and publish opts (<a href="https://redirect.github.com/nats-io/nats.go/issues/2051">#2051</a>)</li> <li>Updated <code>StreamConfig</code> with <code>Consumer</code> field and added <code>AckFlowControlPolicy</code> (<a href="https://redirect.github.com/nats-io/nats.go/issues/2070">#2070</a>)</li> <li>Added reset consumer API (<a href="https://redirect.github.com/nats-io/nats.go/issues/2069">#2069</a>)</li> </ul> </li> </ul> <h3>FIXED</h3> <ul> <li>Core NATS: <ul> <li>Fix Subscription.StatusChanged channel closure on Closed Subscription. Thanks <a href="https://github.com/nithimani38-prog"><code>@​nithimani38-prog</code></a> for the contribution (<a href="https://redirect.github.com/nats-io/nats.go/issues/2034">#2034</a>)</li> </ul> </li> </ul> <h3>IMPROVED</h3> <ul> <li>Fixed Flaky JS cluster tests (<a href="https://redirect.github.com/nats-io/nats.go/issues/2062">#2062</a>)</li> </ul> <h3>Complete Changes</h3> <p><a href="https://github.com/nats-io/nats.go/compare/v1.51.0...v1.52.0">https://github.com/nats-io/nats.go/compare/v1.51.0...v1.52.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nats-io/nats.go/commit/e9f2a36e31b1065f69b252ea090c01e8869eab0b"><code>e9f2a36</code></a> Release v1.52.0 (<a href="https://redirect.github.com/nats-io/nats.go/issues/2074">#2074</a>)</li> <li><a href="https://github.com/nats-io/nats.go/commit/609274f8c57b65c9d11b01b008b0e40fadfc9d5b"><code>609274f</code></a> [FIXED] Subscription.StatusChanged channel closure on Closed Subscription (<a href="https://redirect.github.com/nats-io/nats.go/issues/2">#2</a>...</li> <li><a href="https://github.com/nats-io/nats.go/commit/f7cde748abc86c2981cb1391ca828fceea02af66"><code>f7cde74</code></a> [IMPROVED] Use latest release build for badge in README (<a href="https://redirect.github.com/nats-io/nats.go/issues/2064">#2064</a>)</li> <li><a href="https://github.com/nats-io/nats.go/commit/c7476ea556818d561945e78863adab422f00de03"><code>c7476ea</code></a> [IMPROVED] Reject empty consumer info in CONSUMER.RESET response (<a href="https://redirect.github.com/nats-io/nats.go/issues/2072">#2072</a>)</li> <li><a href="https://github.com/nats-io/nats.go/commit/8fde36fd10a34224e22f4f8a8ad1f61ecaedd18f"><code>8fde36f</code></a> [ADDED] ResetConsumer JetStream API (<a href="https://redirect.github.com/nats-io/nats.go/issues/2069">#2069</a>)</li> <li><a href="https://github.com/nats-io/nats.go/commit/dcfd0fcc6f63c4a2e4436e5aa3ecd4e1dcc598df"><code>dcfd0fc</code></a> [ADDED] StreamSource.Consumer config field and AckFlowControlPolicy (<a href="https://redirect.github.com/nats-io/nats.go/issues/2070">#2070</a>)</li> <li><a href="https://github.com/nats-io/nats.go/commit/7a28503b5d5d633d2caaa2639571e5f19c8eebec"><code>7a28503</code></a> [ADDED] Publish options and consts for message scheduling (<a href="https://redirect.github.com/nats-io/nats.go/issues/2051">#2051</a>)</li> <li><a href="https://github.com/nats-io/nats.go/commit/6c91a518e305e56c6481cf63ba52416300b7f5d3"><code>6c91a51</code></a> [ADDED] AllowBatchPublish stream config field (<a href="https://redirect.github.com/nats-io/nats.go/issues/2052">#2052</a>)</li> <li><a href="https://github.com/nats-io/nats.go/commit/a614d0be24c7e9a22a406572bee44d897cff27c3"><code>a614d0b</code></a> [FIXED] Flaky JS cluster tests due to race in setupJSClusterWithSize (<a href="https://redirect.github.com/nats-io/nats.go/issues/2062">#2062</a>)</li> <li>See full diff in <a href="https://github.com/nats-io/nats.go/compare/v1.51.0...v1.52.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-04 00:10:17 +00:00
Ethan	9fe75587ae	fix: forward user-uploaded PDFs to Anthropic and Bedrock (#25946) ... Previously, user-uploaded PDFs were silently dropped by fantasy's Anthropic provider adapter, so Claude (direct or via Bedrock) only saw the user's text and replied as if no document had been attached. Other providers (OpenAI, Gemini, OpenRouter, Vercel) were unaffected. Bumps `coder/fantasy` past [coder/fantasy#37](https://github.com/coder/fantasy/pull/37) (cherry-pick of upstream [charmbracelet/fantasy#197](https://github.com/charmbracelet/fantasy/pull/197)), which emits an Anthropic `document` content block with a base64 PDF source for `fantasy.FilePart{MediaType: "application/pdf"}` and counts `OfDocument` as user-visible so a PDF-only user message is no longer culled as empty. Adds a regression test (`TestModelFromConfig_AnthropicPDFFilePartReachesProvider`) that drives a `fantasy.FilePart` through the real Anthropic provider against a `chattest.NewAnthropic` stub and asserts the outbound request contains a base64 document block. The test was verified to fail on the previous fantasy pin (the request leaves with zero messages and `Generate` returns EOF) and pass on the new one. Manually verified end-to-end with `./scripts/develop.sh`: uploading a PDF to a Claude-backed Coder Agents chat now lets the model read it. Closes CODAGT-540	2026-06-03 00:16:01 +10:00
Thomas Kosiewski	fe257666d7	ci: refactor CI to use mise for shared tool setup (#25727)	2026-06-01 15:55:19 +02:00
Mathias Fredriksson	60f0bfe94c	fix: update tailscale fork to fix goroutine leak in TestRun (#25838) ... Update the coder/tailscale fork to include the fix for goroutine leaks in measureHTTPLatency. The function creates an http.Transport per DERP probe for a single HTTP request but did not disable keep-alives, causing readLoop/writeLoop goroutines to persist after the function returns. These were detected by goleak in support/TestRun. The fork fix sets DisableKeepAlives: true on the transport. Closes PLAT-289	2026-05-29 11:15:21 +00:00
dependabot[bot]	df929467f6	chore: bump github.com/open-policy-agent/opa from 1.11.0 to 1.17.0 (#25200) ... Bumps [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) from 1.11.0 to 1.17.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/open-policy-agent/opa/releases">github.com/open-policy-agent/opa's releases</a>.</em></p> <blockquote> <h2>v1.16.2</h2> <p>This release updates the version of Go used to build the OPA binaries and images to 1.26.3; addressing <a href="https://groups.google.com/g/golang-announce/c/qcCIEXso47M">a number of vulnerabilities</a>.</p> <h2>v1.16.1</h2> <p>This is a patch release addressing a regression in the plugin manager that may cause the service to hang on shutdown (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8590">#8590</a>).</p> <h2>v1.16.0</h2> <blockquote> <p>[!WARNING]</p> <p>A regression has been found in the plugin manager, which may cause the service to hang on shutdown. Users are advised to go directly to v1.16.1.</p> </blockquote> <p>This release contains a mix of new features, performance improvements, and bugfixes. Notably:</p> <ul> <li>New <code>uri.parse</code> and <code>uri.is_valid</code> built-in functions</li> <li>Data API Request/Response Metadata</li> <li>Prometheus metrics exported via OTLP</li> <li>Formatter improvements</li> </ul> <blockquote> <p><strong><em>NOTE:</em></strong></p> <p>In v1.15.x, OPA was dropping logs for bundle downloads, <code>print()</code> calls and other plugin-originated logs. Users are advised to update, v1.16.0 fixes this bug in (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8544">#8544</a>).</p> </blockquote> <h3>New <code>uri.parse</code> and <code>uri.is_valid</code> built-in functions (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8263">#8263</a>)</h3> <p>Two new <a href="https://www.openpolicyagent.org/docs/policy-reference/builtins">built-in functions</a> have been added: <code>uri.parse</code> for parsing a given URI, and <code>uri.is_valid</code> for verifying the structure of a given URI.</p> <h4>uri.parse</h4> <p>Parses a URI and returns an object containing its components according to <a href="https://www.rfc-editor.org/rfc/rfc3986.html">RFC 3986</a>. Empty components are omitted.</p> <pre lang="rego"><code>package example <p>test_uri if { uri.parse(&quot;<a href="https://example.com:8080/api?q=1#top">https://example.com:8080/api?q=1#top</a>&quot;) == { &quot;scheme&quot;: &quot;https&quot;, &quot;hostname&quot;: &quot;example.com&quot;, &quot;port&quot;: &quot;8080&quot;, &quot;path&quot;: &quot;/api&quot;, &quot;raw_path&quot;: &quot;/api&quot;, &quot;raw_query&quot;: &quot;q=1&quot;, &quot;fragment&quot;: &quot;top&quot;, } } </code></pre></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md">github.com/open-policy-agent/opa's changelog</a>.</em></p> <blockquote> <h2>1.17.0</h2> <p>This release contains a mix of new features, performance improvements, and bugfixes. Notably:</p> <ul> <li>A new <code>future.keywords.not</code> import that adds improved semantics to the <code>not</code> keyword.</li> <li>Rule Labels in Decision Logs</li> <li>Published json schema for IR and bundle manifest</li> <li>Dropped automaxprocs and x/net dependencies</li> </ul> <h3>Improved Negation Semantics (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8387">#8387</a>)</h3> <p>This OPA release introduces a new <a href="https://www.openpolicyagent.org/docs/policy-reference/keywords/not#improved-negation-semantics"><code>future.keywords.not</code> import</a> that fixes a long-standing semantic issue with negation in Rego.</p> <p>Without the import, the compiler expands a negated composite expression like <code>not f(g(input.x))</code> into a series of sub-expressions evaluated <em>before</em> the <code>not</code>:</p> <pre><code>__local0__ = input.x g(__local0__, __local1__) not f(__local1__) </code></pre> <p>If any sub-expression fails — for example, <code>input.x</code> is undefined or <code>g</code> produces an undefined result — the entire rule fails rather than the <code>not</code> succeeding. This is unintuitive: the user's intent is &quot;the condition does not hold,&quot; but an undefined intermediate value causes a silent failure instead of the expected <code>not</code> result.</p> <p>With <code>import future.keywords.not</code>, composite-expression negation wraps the full compiler expansion in an implicit body:</p> <pre><code>not { __local0__ = input.x; g(__local0__, __local1__); f(__local1__) } </code></pre> <p>Now, if <em>any</em> sub-expression is undefined or fails, the body is unsatisfiable and the <code>not</code> expression succeeds; matching the intuition that &quot;the condition does not hold.&quot;</p> <blockquote> <p><strong><em>NOTE:</em></strong></p> <p>Users are recommended to import <code>future.keywords.not</code> whenever the <code>not</code> keyword is used in a policy.</p> </blockquote> <p>Authored by <a href="https://github.com/johanfylling"><code>@​johanfylling</code></a></p> <h3>Rule Labels in Decision Logs (<a href="https://redirect.github.com/open-policy-agent/opa/issues/2089">#2089</a>)</h3> <p>Rule annotations now support a <code>labels</code> field. Labels from all successfully evaluated rules are collected and included in each decision log entry as a top-level <code>rule_labels</code></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/open-policy-agent/opa/commit/64a3625d33bc6ad8e7c40df03b76ce2fb3ab4d21"><code>64a3625</code></a> Release v1.17.0 (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8710">#8710</a>)</li> <li><a href="https://github.com/open-policy-agent/opa/commit/68c9de5da00ea9d631c50327c709d5d7e8844bba"><code>68c9de5</code></a> benchmarks: tweak per-PR benchmark regression check based on pr-check</li> <li><a href="https://github.com/open-policy-agent/opa/commit/7fe3066154b7780eac16c290475f8506573a427f"><code>7fe3066</code></a> server: remove dead code (s.partials) (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8708">#8708</a>)</li> <li><a href="https://github.com/open-policy-agent/opa/commit/37830be801a9ce4ec6d23df33f645bb6095f3043"><code>37830be</code></a> ast,storage/inmem: Add <code>inmem.NewFromASTObject</code> and add missing string case t...</li> <li><a href="https://github.com/open-policy-agent/opa/commit/1661f22ba399e94d08d8fb85218580a61779bdc4"><code>1661f22</code></a> ast: add some schema $ref tests</li> <li><a href="https://github.com/open-policy-agent/opa/commit/3e22f562f1e370973c1b6750eff11d06fe554c70"><code>3e22f56</code></a> benchmarks: only run for go changes</li> <li><a href="https://github.com/open-policy-agent/opa/commit/13aaeabce2221217cb6c175b269475803740fad2"><code>13aaeab</code></a> benchmarks: move env vars, remove zizmor-ignore comment</li> <li><a href="https://github.com/open-policy-agent/opa/commit/93e170868ac37f87696adfc2d7f672a0f1814936"><code>93e1708</code></a> benchmarks: fix PR message, skip tests</li> <li><a href="https://github.com/open-policy-agent/opa/commit/4ce3991901eed5b622a21f2f629029727e192ba7"><code>4ce3991</code></a> benchmarks: use go tool machinery, add benchstat</li> <li><a href="https://github.com/open-policy-agent/opa/commit/41df8df4a26d8de7a81bf4c5d78cb94f10a108d5"><code>41df8df</code></a> benchmarks: use benchlab for per-PR feedback</li> <li>Additional commits viewable in <a href="https://github.com/open-policy-agent/opa/compare/v1.11.0...v1.17.0">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-28 15:20:56 +00:00
Steven Masley	4591212482	feat: implement SCIM handler for SCIM 2.0 compliance (#25572) ... Rewrites the SCIM 2.0 user provisioning handler to be RFC 7644 compliant. Verified against an external IdP Okta. Behavior is OPT IN	2026-05-28 10:00:37 -05:00
Jon Ayers	f6f284ea51	feat: add initial NATS implementation (#25602)	2026-05-27 12:57:20 -05:00
dependabot[bot]	d03986e3f6	chore: bump the x group with 3 updates (#25696) ... [//]: # (dependabot-start) ⚠️ **Dependabot is rebasing this PR** ⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Bumps the x group with 3 updates: [golang.org/x/crypto](https://github.com/golang/crypto), [golang.org/x/net](https://github.com/golang/net) and [golang.org/x/sys](https://github.com/golang/sys). Updates `golang.org/x/crypto` from 0.51.0 to 0.52.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/crypto/commit/a1c0d9929856c8aba2b31f079340f00578eda803"><code>a1c0d99</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/crypto/commit/3c7c86938f4541c333d506f719388d9c42d4763d"><code>3c7c869</code></a> ssh: fix deadlock on unexpected channel responses</li> <li><a href="https://github.com/golang/crypto/commit/533fb3f7e4a5ae23f69d1837cd851d35ff5b76ce"><code>533fb3f</code></a> ssh: fix source-address critical option bypass</li> <li><a href="https://github.com/golang/crypto/commit/abbc44d451a6f9236a2bbd26cbcd4d0fec473da3"><code>abbc44d</code></a> ssh: fix incorrect operator order</li> <li><a href="https://github.com/golang/crypto/commit/e052873987615dc96fe67607a9a6adb76311344f"><code>e052873</code></a> ssh: fix infinite loop on large channel writes due to integer overflow</li> <li><a href="https://github.com/golang/crypto/commit/b61cf853a89d82cad68da5e12a6beca2116f8456"><code>b61cf85</code></a> ssh: enforce user presence verification for security keys</li> <li><a href="https://github.com/golang/crypto/commit/9c2cd33e8d96a96133fd6ff732510ebba539c2bd"><code>9c2cd33</code></a> ssh: enforce strict limits on DSA key parameters</li> <li><a href="https://github.com/golang/crypto/commit/890731877d85f71cfdc9554e7a27fec4684fc4c4"><code>8907318</code></a> ssh: reject RSA keys with excessively large moduli</li> <li><a href="https://github.com/golang/crypto/commit/ffd87b4878fa98ca2908ec534e1a410bf095a35e"><code>ffd87b4</code></a> ssh: fix panic when authority callbacks are nil</li> <li><a href="https://github.com/golang/crypto/commit/4e7a7384ecbc8d519f6f4c11b36fa9d761fc8946"><code>4e7a738</code></a> ssh: fix deadlock on unexpected global responses</li> <li>Additional commits viewable in <a href="https://github.com/golang/crypto/compare/v0.51.0...v0.52.0">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/net` from 0.54.0 to 0.55.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/net/commit/7770ec48d03fec35e378665337b4faca93c38423"><code>7770ec4</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/net/commit/4ece7b612ad44ad6c4d5e0d5d4df9c18cc211905"><code>4ece7b6</code></a> html: escape greater-than symbol in doctype identifiers</li> <li><a href="https://github.com/golang/net/commit/08be507abce89191d78cd49da60f4501fc910472"><code>08be507</code></a> html: improve Noah's Ark clause performance</li> <li><a href="https://github.com/golang/net/commit/a8fb2fe4f7378f816302b9f2f7b8290ce512e5dd"><code>a8fb2fe</code></a> html: properly render fostered elements in foreign content</li> <li><a href="https://github.com/golang/net/commit/0dc5b7a5f81d7155ade6d5e9db35992998679932"><code>0dc5b7a</code></a> html: properly check namespace in &quot;in body&quot; any other end tag</li> <li><a href="https://github.com/golang/net/commit/a452f3cc17168a60bc3f439a3ae0fcffc32eca0e"><code>a452f3c</code></a> html: ignore duplicate attributes during tokenization</li> <li><a href="https://github.com/golang/net/commit/f8651996b24ba47d89dd9eb97fd47758e6d1886f"><code>f865199</code></a> quic: fix appendMaxDataFrame erroneously accumulating sentLimit</li> <li><a href="https://github.com/golang/net/commit/210ed3cb901cb549818aefa04b71dadaf149d05d"><code>210ed3c</code></a> quic: establish a &quot;happened-before&quot; relationship between stream write and read</li> <li><a href="https://github.com/golang/net/commit/ad8140e0aa2ec41b37ea478b4525a423bcc21af9"><code>ad8140e</code></a> quic: fix buffer slicing when handling overlapping stream data</li> <li><a href="https://github.com/golang/net/commit/23ee2efe81a3ff183b4eca46c42f749af7efca45"><code>23ee2ef</code></a> http2: avoid API changes when built with go1.27</li> <li>See full diff in <a href="https://github.com/golang/net/compare/v0.54.0...v0.55.0">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/sys` from 0.44.0 to 0.45.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/sys/commit/397d5f80920585bc27433d878aba498d062f81e1"><code>397d5f8</code></a> unix: update to Linux kernel 7.0</li> <li><a href="https://github.com/golang/sys/commit/0a387f7a07d7a0e9811f00603c10b4e5a94ab79c"><code>0a387f7</code></a> cpu: detect zbc extension on riscv64</li> <li><a href="https://github.com/golang/sys/commit/758f71cb839d131daf0ba4befa6a2c6ceb21a649"><code>758f71c</code></a> cpu: add LLACQ_SCREL, SCQ, DBAR_HINTS detection for loong64</li> <li><a href="https://github.com/golang/sys/commit/99666ae32e07f6403182a79cb5df0c417cbbf25f"><code>99666ae</code></a> unix: merge Linux readv/writev implementation with Darwin/OpenBSD</li> <li><a href="https://github.com/golang/sys/commit/e4444cbaaaf61cecff8e635874066fcd5c841575"><code>e4444cb</code></a> windows: add NtSetEaFile, NtQueryEaFile and NtQueryInformationFile</li> <li><a href="https://github.com/golang/sys/commit/04396e85d470b7f990a9a1df5c1a44dc8e30c292"><code>04396e8</code></a> unix: add Readv, Writev, Preadv, Pwritev for OpenBSD</li> <li>See full diff in <a href="https://github.com/golang/sys/compare/v0.44.0...v0.45.0">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-26 18:57:15 +00:00
dependabot[bot]	089ae2411e	chore: bump github.com/gohugoio/hugo from 0.161.1 to 0.162.0 (#25698) ... Bumps [github.com/gohugoio/hugo](https://github.com/gohugoio/hugo) from 0.161.1 to 0.162.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/gohugoio/hugo/releases">github.com/gohugoio/hugo's releases</a>.</em></p> <blockquote> <h2>v0.162.0</h2> <p>The notable new feature in this release is support for <a href="https://gohugo.io/configuration/imaging/#avif-images">AVIF images</a> (both encoder and decoder). There's a <a href="https://github.com/bep/hdrsdr.com">demo site</a> set up that demonstrates the difference between HDR AVIF and SDR JPEG images. Note that that demo is only really interesting if viewed on an HDR capable screen (e.g. Apple Retina).</p> <h2>Security fixes</h2> <p>There are some notable security fixes in this release.</p> <h3>Security fixes in Go</h3> <p>This release upgrades from Go 1.26.1 to 126.3, which brings a set of security fixes. Some relevant for Hugo are:</p> <ul> <li>XSS in html/template (CVE-2026-39826 &amp; CVE-2026-39823): Two separate vulnerabilities where escaper bypasses in html/template could lead to Cross-Site Scripting (XSS).</li> <li>html/template: Fixes an issue where JS template literal contexts were incorrectly tracked across template branches, which could lead to improper content escaping.</li> </ul> <h3>Security fixes and hardening in Hugo</h3> <p>The following changes either fix a concrete issue or reduce the default attack surface of <code>hugo</code> builds.</p> <ul> <li><strong>Disallow <code>text/html</code> content files by default</strong> (<a href="https://github.com/gohugoio/hugo/commit/e41a06447d">e41a064</a>). A new <code>security.allowContent</code> policy gates which content media types may be used for pages under <code>/content</code>. <code>text/html</code> is denied by default; sites that rely on hand-authored or adapter-emitted HTML content can opt back in with <code>security.allowContent = ['.*']</code>.</li> <li><strong>Re-check <code>security.http.urls</code> on every redirect hop in <code>resources.GetRemote</code></strong> (<a href="https://github.com/gohugoio/hugo/commit/86fbb0f7a8">86fbb0f</a>).</li> <li><strong>Reject symlinked entries in <code>resources.Get</code></strong> (<a href="https://github.com/gohugoio/hugo/commit/f8b5fa09a6">f8b5fa0</a>).</li> </ul> <p><strong>We will update this section later with links to CVEs where applicable.</strong></p> <h2>All changes</h2> <ul> <li>hugolib: Fix Page.GitInfo for modules with go.mod in a repo subdirectory df542191 <a href="https://github.com/bep"><code>@​bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14942">#14942</a></li> <li>Fix typo in CONTRIBUTING.md 4bc7caea <a href="https://github.com/bep"><code>@​bep</code></a></li> <li>resources: Fix the :counter placeholder 5d51b82a <a href="https://github.com/jmooring"><code>@​jmooring</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14921">#14921</a></li> <li>commands: Fix import from Jekyll 81d77620 <a href="https://github.com/jmooring"><code>@​jmooring</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14795">#14795</a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14906">#14906</a></li> <li>Fix prevention of direct symlink reads in resources.Get f8b5fa09 <a href="https://github.com/bep"><code>@​bep</code></a></li> <li>commands: Fix github-dark chromastyles 88d838a9 <a href="https://github.com/xndvaz"><code>@​xndvaz</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14831">#14831</a></li> <li>Disallow HTML content by default e41a0644 <a href="https://github.com/bep"><code>@​bep</code></a></li> <li>Add image processing support for AVIF 90d9f812 <a href="https://github.com/bep"><code>@​bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/7837">#7837</a></li> <li>config: Preserve intentionally empty maps 80e60847 <a href="https://github.com/jmooring"><code>@​jmooring</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14944">#14944</a></li> <li>hugolib: Merge existing hugo_stats.json when renderSegments is set aeb9a5cc <a href="https://github.com/bep"><code>@​bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14939">#14939</a></li> <li>all: Replace RWMutex struct caches with ConcurrentMap c4bbc280 <a href="https://github.com/bep"><code>@​bep</code></a></li> <li>tpl/tplimpl: Consolidate and improve embedded template integration tests d8c70218 <a href="https://github.com/jmooring"><code>@​jmooring</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14932">#14932</a></li> <li>parser: Drop empty sub maps from hugo config output ee4f1acd <a href="https://github.com/bep"><code>@​bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14855">#14855</a></li> <li>markup/highlight: Allow overriding type and code via options b6133657 <a href="https://github.com/bep"><code>@​bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/11872">#11872</a></li> <li>Update AI assistance disclosure requirements d2c821b5 <a href="https://github.com/bep"><code>@​bep</code></a></li> <li>hugolib: Use AllTranslated in IsTranslated 4ed7600f <a href="https://github.com/bep"><code>@​bep</code></a></li> <li>tpl: Simplify sitemap template cbe4339a <a href="https://github.com/bep"><code>@​bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14912">#14912</a></li> <li>tpl: Use AllTranslations in sitemap template 6475d308 <a href="https://github.com/bep"><code>@​bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14912">#14912</a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14917">#14917</a></li> <li>tpl/collections: Make dict return nil when no values are provided 67aede43 <a href="https://github.com/bep"><code>@​bep</code></a></li> <li>Sync Go template package to 1.26.3 87f194b2 <a href="https://github.com/bep"><code>@​bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14897">#14897</a></li> <li>Upgrade to Go 1.26.3 d81e3c29 <a href="https://github.com/bep"><code>@​bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14897">#14897</a></li> <li>ci: Check embedded template formatting with gotmplfmt 7c65a4db <a href="https://github.com/bep"><code>@​bep</code></a></li> <li>tpl: Run gotmplfmt -w . d31a9275 <a href="https://github.com/bep"><code>@​bep</code></a></li> <li>markup/goldmark/codeblocks: Always split Chroma options into .Options c36608c5 <a href="https://github.com/jmooring"><code>@​jmooring</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14909">#14909</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/gohugoio/hugo/commit/076dfe13d0f789e3d9586b192f8f7f3329c26990"><code>076dfe1</code></a> releaser: Bump versions for release of 0.162.0</li> <li><a href="https://github.com/gohugoio/hugo/commit/e41a06447daa3071a01f333fdcec0a5153c3c8d1"><code>e41a064</code></a> Disallow HTML content by default</li> <li><a href="https://github.com/gohugoio/hugo/commit/90d9f812b2cafc79ca125a829936dec9654aec64"><code>90d9f81</code></a> Add image processing support for AVIF</li> <li><a href="https://github.com/gohugoio/hugo/commit/80e60847fb5d12f6a54fae782cb643a1772c38b6"><code>80e6084</code></a> config: Preserve intentionally empty maps</li> <li><a href="https://github.com/gohugoio/hugo/commit/df5421918a987cedaba42a050b0e4dde9c88ba3f"><code>df54219</code></a> hugolib: Fix Page.GitInfo for modules with go.mod in a repo subdirectory</li> <li><a href="https://github.com/gohugoio/hugo/commit/aeb9a5cc02fad527220d6a40b1450661c6a56503"><code>aeb9a5c</code></a> hugolib: Merge existing hugo_stats.json when renderSegments is set</li> <li><a href="https://github.com/gohugoio/hugo/commit/c4bbc2805c7092deafabae01e71ff2dda37bd877"><code>c4bbc28</code></a> all: Replace RWMutex struct caches with ConcurrentMap</li> <li><a href="https://github.com/gohugoio/hugo/commit/d8c70218b7385125d807784534af5e5491bc30df"><code>d8c7021</code></a> tpl/tplimpl: Consolidate and improve embedded template integration tests</li> <li><a href="https://github.com/gohugoio/hugo/commit/ee4f1acd93b417078715693fb22ce1fd2bab2684"><code>ee4f1ac</code></a> parser: Drop empty sub maps from hugo config output</li> <li><a href="https://github.com/gohugoio/hugo/commit/b6133657e006290375e587bfb6566469a14911af"><code>b613365</code></a> markup/highlight: Allow overriding type and code via options</li> <li>Additional commits viewable in <a href="https://github.com/gohugoio/hugo/compare/v0.161.1...v0.162.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-26 18:55:33 +00:00
Cian Johnston	579daaff70	feat: add GitLab support to coderd/externalauth/gitprovider ... Fixes CODAGT-146 Add GitLab support to the gitprovider package for gitsync/chatd PR diff flows. This is a squashed stack of 3 PRs: #25651 - refactor(coderd/externalauth): prepare gitprovider for multi-provider support - Change gitprovider.New to return (Provider, error) - Extract shared helpers (parseRetryAfter, checkRateLimitError, countDiffLines, escapePathPreserveSlashes) from github.go - Update all callers (db2sdk, exp_chats, gitsync) for new signature - Add error logging for provider construction failures - Thread context through provider resolution #25652 - feat(coderd/externalauth/gitprovider): add GitLab provider - Implement full Provider interface: FetchPullRequestStatus, FetchPullRequestDiff, FetchBranchDiff, ResolveBranchPullRequest - Handle nested groups, forks, and self-hosted instances - Rate limit detection on both library and raw HTTP paths - URL parsing/building with NormalizePullRequestURL support - Unit tests covering error paths, URL parsing, state mapping - Document GitLab configuration and known limitations #25653 - test(coderd/externalauth/gitprovider): add GitLab VCR integration tests - FetchPullRequestStatus: 4 fixtures (open, conflicts, merged, closed) - FetchPullRequestDiff: 4 fixtures - FetchBranchDiff: 3 fixtures (open, deleted, fork) - ResolveBranchPullRequest: 3 fixtures - go-vcr cassettes with sanitized GitLab API responses	2026-05-25 17:41:02 +01:00
Cian Johnston	a4afb9dfc6	feat: add --env-file flag to develop.sh (#25621) ... Adds `--env-file` to `scripts/develop.sh` to allow reading environment from a given file. This makes it easier to configure things like external auth providers, access URLs, and other dev-time settings without exporting a wall of environment variables in every shell session. > Generated with [Coder Agents](https://coder.com/agents)	2026-05-25 11:54:57 +01:00
Zach	8d0a73f0b1	chore: bump terraform-provider-coder and coder/preview for coder_secret removal (#25590) ... We decided to remove secret requirements and go a different direction for secrets in Coder (see PLAT-243). As a result, we removed the code in terraform-provider-coder and coder/preview to handle this resource. This PR pulls in said updated versions. Generated with assistance by Coder Agents.	2026-05-22 07:57:54 -06:00
Mathias Fredriksson	f1b772928d	feat: parse execute tool commands and render them in the chat UI (#25478) ... When the execute tool runs a chained shell command, the UI previously rendered the raw string. Long chains like "cd /repo && git pull && git add . && git commit -m fix" were hard to scan. A new ChatMessagePart.ParsedCommands [][]string field on tool-call parts carries one entry per simple command, parsed in chatd from args via mvdan.cc/sh/v3/syntax. The frontend renders the joined list ("cd, git pull, git add, git commit") in place of the raw command, and falls back to the raw command when the field is absent. Closes CODAGT-446	2026-05-21 08:12:34 +00:00
dependabot[bot]	ce57ecc908	chore: bump google.golang.org/api from 0.278.0 to 0.280.0 (#25516) ... Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.278.0 to 0.280.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's releases</a>.</em></p> <blockquote> <h2>v0.280.0</h2> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.279.0...v0.280.0">0.280.0</a> (2026-05-19)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3591">#3591</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/55ba2fab69ee14286ad052f57ed90a726b071e86">55ba2fa</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3593">#3593</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/054d4b6054450d2be21f50fad64145a4e0125424">054d4b6</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3594">#3594</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/03829161b8cd77bf11f4a3a5d07a43f6b1904fbe">0382916</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3595">#3595</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/13e1ad2eeb540d19709df87ce9a0cfdb632f1bf3">13e1ad2</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3596">#3596</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/4c77865748dda2086de226e9401531c934cd909f">4c77865</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3598">#3598</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/ae2f33001826f523ecc6d2f141244e55fbac45c0">ae2f330</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3599">#3599</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/f82d2049187ed2ab7ee27831a1a78887c5969ca4">f82d204</a>)</li> </ul> <h2>v0.279.0</h2> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.278.0...v0.279.0">0.279.0</a> (2026-05-12)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3585">#3585</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/09db0e346a6b567747dceee3872229a62c95124c">09db0e3</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3587">#3587</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/e87e376dbd590cffb3632c378e1ade4a9dacf3ce">e87e376</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3590">#3590</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/d4241eaef9ab3daad4fd4aaeccc118795cfc58a7">d4241ea</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.279.0...v0.280.0">0.280.0</a> (2026-05-19)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3591">#3591</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/55ba2fab69ee14286ad052f57ed90a726b071e86">55ba2fa</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3593">#3593</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/054d4b6054450d2be21f50fad64145a4e0125424">054d4b6</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3594">#3594</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/03829161b8cd77bf11f4a3a5d07a43f6b1904fbe">0382916</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3595">#3595</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/13e1ad2eeb540d19709df87ce9a0cfdb632f1bf3">13e1ad2</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3596">#3596</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/4c77865748dda2086de226e9401531c934cd909f">4c77865</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3598">#3598</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/ae2f33001826f523ecc6d2f141244e55fbac45c0">ae2f330</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3599">#3599</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/f82d2049187ed2ab7ee27831a1a78887c5969ca4">f82d204</a>)</li> </ul> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.278.0...v0.279.0">0.279.0</a> (2026-05-12)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3585">#3585</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/09db0e346a6b567747dceee3872229a62c95124c">09db0e3</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3587">#3587</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/e87e376dbd590cffb3632c378e1ade4a9dacf3ce">e87e376</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3590">#3590</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/d4241eaef9ab3daad4fd4aaeccc118795cfc58a7">d4241ea</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/googleapis/google-api-go-client/commit/3887b09ecbbaf25fba1bf52227ad5ca4f89e9968"><code>3887b09</code></a> chore(main): release 0.280.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3592">#3592</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/f82d2049187ed2ab7ee27831a1a78887c5969ca4"><code>f82d204</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3599">#3599</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/13e7314e1377c0dd4e132a681b3130abc5843dbd"><code>13e7314</code></a> chore(all): update all (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3597">#3597</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/ae2f33001826f523ecc6d2f141244e55fbac45c0"><code>ae2f330</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3598">#3598</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/4c77865748dda2086de226e9401531c934cd909f"><code>4c77865</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3596">#3596</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/13e1ad2eeb540d19709df87ce9a0cfdb632f1bf3"><code>13e1ad2</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3595">#3595</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/03829161b8cd77bf11f4a3a5d07a43f6b1904fbe"><code>0382916</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3594">#3594</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/054d4b6054450d2be21f50fad64145a4e0125424"><code>054d4b6</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3593">#3593</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/55ba2fab69ee14286ad052f57ed90a726b071e86"><code>55ba2fa</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3591">#3591</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/e446d4cdeb5e63cd6916051edd2c56588eede309"><code>e446d4c</code></a> chore(main): release 0.279.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3586">#3586</a>)</li> <li>Additional commits viewable in <a href="https://github.com/googleapis/google-api-go-client/compare/v0.278.0...v0.280.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-19 22:55:11 +00:00
dependabot[bot]	f6a9e43185	chore: bump github.com/coder/terraform-provider-coder/v2 from 2.16.0 to 2.17.0 (#25515) ... Bumps [github.com/coder/terraform-provider-coder/v2](https://github.com/coder/terraform-provider-coder) from 2.16.0 to 2.17.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/coder/terraform-provider-coder/releases">github.com/coder/terraform-provider-coder/v2's releases</a>.</em></p> <blockquote> <h2>v2.17.0</h2> <h2>What's Changed</h2> <ul> <li>build(deps): Bump golang.org/x/mod from 0.34.0 to 0.35.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/coder/terraform-provider-coder/pull/500">coder/terraform-provider-coder#500</a></li> <li>build(deps): Bump crazy-max/ghaction-import-gpg from 6.3.0 to 7.0.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/coder/terraform-provider-coder/pull/485">coder/terraform-provider-coder#485</a></li> <li>build(deps): Bump goreleaser/goreleaser-action from 7.0.0 to 7.1.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/coder/terraform-provider-coder/pull/502">coder/terraform-provider-coder#502</a></li> <li>build(deps): Bump goreleaser/goreleaser-action from 7.1.0 to 7.2.1 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/coder/terraform-provider-coder/pull/505">coder/terraform-provider-coder#505</a></li> <li>build(deps): Bump golang.org/x/mod from 0.35.0 to 0.36.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/coder/terraform-provider-coder/pull/508">coder/terraform-provider-coder#508</a></li> <li>chore: upgrade Go to 1.26 by <a href="https://github.com/matifali"><code>@​matifali</code></a> in <a href="https://redirect.github.com/coder/terraform-provider-coder/pull/494">coder/terraform-provider-coder#494</a></li> <li>chore: warn when coder_agent dir breaks Desktop file sync by <a href="https://github.com/zenithwolf1000"><code>@​zenithwolf1000</code></a> in <a href="https://redirect.github.com/coder/terraform-provider-coder/pull/507">coder/terraform-provider-coder#507</a></li> <li>build(deps): Bump github.com/hashicorp/terraform-plugin-sdk/v2 from 2.38.1 to 2.40.1 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/coder/terraform-provider-coder/pull/506">coder/terraform-provider-coder#506</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/zenithwolf1000"><code>@​zenithwolf1000</code></a> made their first contribution in <a href="https://redirect.github.com/coder/terraform-provider-coder/pull/507">coder/terraform-provider-coder#507</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/coder/terraform-provider-coder/compare/v2.16.0...v2.17.0">https://github.com/coder/terraform-provider-coder/compare/v2.16.0...v2.17.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/coder/terraform-provider-coder/commit/35a52f2969dfd236df4ea370fdb84a70475e5bbd"><code>35a52f2</code></a> build(deps): Bump github.com/hashicorp/terraform-plugin-sdk/v2 from 2.38.1 to...</li> <li><a href="https://github.com/coder/terraform-provider-coder/commit/c80aa71a5d8d03c8ebb7de2c02e34556fa98f04b"><code>c80aa71</code></a> chore: warn when coder_agent dir breaks Desktop file sync (<a href="https://redirect.github.com/coder/terraform-provider-coder/issues/507">#507</a>)</li> <li><a href="https://github.com/coder/terraform-provider-coder/commit/d1b758b3e04a35d3339fa838872bec137eb28e15"><code>d1b758b</code></a> chore: upgrade Go to 1.26 (<a href="https://redirect.github.com/coder/terraform-provider-coder/issues/494">#494</a>)</li> <li><a href="https://github.com/coder/terraform-provider-coder/commit/223b51b40f52bfdfcad65805f3bf94c31dfd531d"><code>223b51b</code></a> build(deps): Bump golang.org/x/mod from 0.35.0 to 0.36.0 (<a href="https://redirect.github.com/coder/terraform-provider-coder/issues/508">#508</a>)</li> <li><a href="https://github.com/coder/terraform-provider-coder/commit/fe03a1da39aaf2f1eb0945526d7a284339963262"><code>fe03a1d</code></a> build(deps): Bump goreleaser/goreleaser-action from 7.1.0 to 7.2.1 (<a href="https://redirect.github.com/coder/terraform-provider-coder/issues/505">#505</a>)</li> <li><a href="https://github.com/coder/terraform-provider-coder/commit/7da76fab022e71fd2ded14df27daa7de36e4980d"><code>7da76fa</code></a> build(deps): Bump goreleaser/goreleaser-action from 7.0.0 to 7.1.0 (<a href="https://redirect.github.com/coder/terraform-provider-coder/issues/502">#502</a>)</li> <li><a href="https://github.com/coder/terraform-provider-coder/commit/8f68c55762c371e4f4d3dcafd83688d0b613dffc"><code>8f68c55</code></a> build(deps): Bump crazy-max/ghaction-import-gpg from 6.3.0 to 7.0.0 (<a href="https://redirect.github.com/coder/terraform-provider-coder/issues/485">#485</a>)</li> <li><a href="https://github.com/coder/terraform-provider-coder/commit/99b6eee0c6467576672ad8ff5a4a68539ccba19b"><code>99b6eee</code></a> build(deps): Bump golang.org/x/mod from 0.34.0 to 0.35.0 (<a href="https://redirect.github.com/coder/terraform-provider-coder/issues/500">#500</a>)</li> <li>See full diff in <a href="https://github.com/coder/terraform-provider-coder/compare/v2.16.0...v2.17.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-19 22:52:59 +00:00
dependabot[bot]	91c405caa4	chore: bump github.com/brianvoe/gofakeit/v7 from 7.14.0 to 7.15.0 (#25513) ... Bumps [github.com/brianvoe/gofakeit/v7](https://github.com/brianvoe/gofakeit) from 7.14.0 to 7.15.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/brianvoe/gofakeit/commit/010dc54464bc1c104ee1bad3823325dd2e14d4dd"><code>010dc54</code></a> email - better email generation with weighted mix and testing valid email gen...</li> <li><a href="https://github.com/brianvoe/gofakeit/commit/794efc9b4520eb8f2df00b3db0aa8fb64e04d469"><code>794efc9</code></a> password - space usage adjustment</li> <li><a href="https://github.com/brianvoe/gofakeit/commit/ee08eae8003a40768c47bacd76dfa5503a461752"><code>ee08eae</code></a> Merge pull request <a href="https://redirect.github.com/brianvoe/gofakeit/issues/392">#392</a> from shubhamatkal/fix/password-guarantee-character-sets</li> <li><a href="https://github.com/brianvoe/gofakeit/commit/c38fe1a8fb22e850fbdbbe2a54d5954a60e13a65"><code>c38fe1a</code></a> github - workflow less verbose</li> <li><a href="https://github.com/brianvoe/gofakeit/commit/22b91127ddcc896b66a389c2c00b73985091d11c"><code>22b9112</code></a> datetime - yearly fix</li> <li><a href="https://github.com/brianvoe/gofakeit/commit/35520064411e85a403d4b41f22d3269604871e20"><code>3552006</code></a> fix: guarantee at least one char per enabled set in Password()</li> <li>See full diff in <a href="https://github.com/brianvoe/gofakeit/compare/v7.14.0...v7.15.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-19 22:52:23 +00:00
dependabot[bot]	01492e0e7b	chore: bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 (#25494) ... Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.19.0 to 5.19.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-git/go-git/releases">github.com/go-git/go-git/v5's releases</a>.</em></p> <blockquote> <h2>v5.19.1</h2> <h2>What's Changed</h2> <ul> <li>v5: plumbing: transport/ssh, Shell-quote path by <a href="https://github.com/hiddeco"><code>@​hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2068">go-git/go-git#2068</a></li> <li>v5: git: submodule, Fix relative URL resolution by <a href="https://github.com/hiddeco"><code>@​hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2070">go-git/go-git#2070</a></li> <li>v5: git: submodule, canonical remote for relative URLs by <a href="https://github.com/hiddeco"><code>@​hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2074">go-git/go-git#2074</a></li> <li>v5: git: submodule, error on remote without URLs by <a href="https://github.com/hiddeco"><code>@​hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2078">go-git/go-git#2078</a></li> <li>v5: plumbing: format/idxfile, Validate offset64 indices by <a href="https://github.com/hiddeco"><code>@​hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2084">go-git/go-git#2084</a></li> <li>v5: *: Reject malformed variable-length integers by <a href="https://github.com/hiddeco"><code>@​hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2092">go-git/go-git#2092</a></li> <li>v5: plumbing: format/packfile, Tighten delta validation by <a href="https://github.com/hiddeco"><code>@​hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2091">go-git/go-git#2091</a></li> <li>v5: Add <code>worktreeFilesystem</code> wrapper for worktree and hardening by <a href="https://github.com/hiddeco"><code>@​hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2100">go-git/go-git#2100</a></li> <li>v5: config: validate submodule names by <a href="https://github.com/hiddeco"><code>@​hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2082">go-git/go-git#2082</a></li> <li>build: Update module github.com/go-git/go-git/v5 to v5.19.0 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@​go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/2111">go-git/go-git#2111</a></li> <li>v5: git: Allow MkdirAll on worktree-root paths by <a href="https://github.com/hiddeco"><code>@​hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2117">go-git/go-git#2117</a></li> <li>v5: git: Stop validating symlink target paths by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2116">go-git/go-git#2116</a></li> <li>v5: plumbing: format decoder input bounds and contracts by <a href="https://github.com/hiddeco"><code>@​hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2125">go-git/go-git#2125</a></li> <li>plumbing: format/packfile, cap delta chain depth in parser by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2137">go-git/go-git#2137</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.19.0...v5.19.1">https://github.com/go-git/go-git/compare/v5.19.0...v5.19.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-git/go-git/commit/3c3be601aa6c0fd0d536c0d1e4f898b4c60e65fe"><code>3c3be60</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2137">#2137</a> from go-git/validate-v5</li> <li><a href="https://github.com/go-git/go-git/commit/3fba897bd9e84b1aec170fa708b80e297b7d6cf6"><code>3fba897</code></a> plumbing: format/packfile, cap delta chain depth in parser</li> <li><a href="https://github.com/go-git/go-git/commit/a97d6601c85e017bb64c2b0f2e3169f6ef6a6709"><code>a97d660</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2125">#2125</a> from hiddeco/v5/format-input-bounds</li> <li><a href="https://github.com/go-git/go-git/commit/aeaa125c8af8e4c4c95b574c22c5633e97fc436e"><code>aeaa125</code></a> plumbing: format/objfile, require Header before Read</li> <li><a href="https://github.com/go-git/go-git/commit/1f38e171218526ea254a73187a52f0648253c1b8"><code>1f38e17</code></a> plumbing: format/packfile, bound inflate size</li> <li><a href="https://github.com/go-git/go-git/commit/f7545a02529e03998d6a7219140dc0e6644ad337"><code>f7545a0</code></a> plumbing: format/idxfile, bound nr by file size</li> <li><a href="https://github.com/go-git/go-git/commit/170b88181f385913a457a08b68c88956fb3f8e4f"><code>170b881</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2116">#2116</a> from pjbgf/symlink-v5</li> <li><a href="https://github.com/go-git/go-git/commit/7b6d994467f06630268904aa3c441b6de7248b31"><code>7b6d994</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2117">#2117</a> from hiddeco/v5/worktree-fs-mkdirall-root-noop</li> <li><a href="https://github.com/go-git/go-git/commit/f0709b32f8fbb87c16cd63c6762d2cd515f36541"><code>f0709b3</code></a> git: Stop validating symlink target paths</li> <li><a href="https://github.com/go-git/go-git/commit/776d00f11d336f26862d0f2bab987b217f3a7844"><code>776d00f</code></a> git: Allow MkdirAll on worktree-root paths</li> <li>Additional commits viewable in <a href="https://github.com/go-git/go-git/compare/v5.19.0...v5.19.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/coder/coder/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-19 16:20:21 +00:00
Rowan Smith	9cf359475b	fix: update tailscale fork to fix TSMP/ICMP callback leak (#25469) ... Updates `github.com/coder/tailscale` to [`v1.1.1-0.20260519043957-6f014ff9434f`](https://github.com/coder/tailscale/commit/6f014ff9434f8c7c4b5b0b0450cbaf2e8b4a52af) to include the fix from [coder/tailscale#122](https://github.com/coder/tailscale/pull/122), which ports the upstream [tailscale/tailscale#18113](https://github.com/tailscale/tailscale/pull/18113) fix for TSMP/ICMP callback leaks. Fixes #25380 > Generated with [Coder Agents](https://coder.com) by @rowansmithau	2026-05-19 15:19:09 +10:00
Ethan	e75bd3aca4	fix: preserve Anthropic replay fidelity (#25377) ... Anthropic is strict about replaying the latest assistant turn once it contains signed or redacted reasoning. We were still mutating that turn in a few Coder-owned places: dropping empty reasoning blocks on replay, rewriting provider-tool history during sanitization, and in the worst case sending a prompt we already knew Anthropic would reject. This patch keeps the latest signed assistant immutable through Coder's replay and sanitization paths, preserves empty signed or redacted reasoning anywhere Coder owns the ledger, and fails before the provider call if the prompt is still unsafe. It also bumps the existing `coder/fantasy` `coder_2_33` fork that `main` already uses to the commit containing coder/fantasy#35. These fixes have also been upstreamed to charmbracelet/fantasy. Closes CODAGT-409.	2026-05-18 15:20:33 +10:00
Ethan	e37bf4f7be	ci: bump paralleltestctx to v0.0.2 (#25323) ... ## Summary - bump `github.com/coder/paralleltestctx` from v0.0.1 to v0.0.2 - pick up the latest paralleltestctx timeout-context detection improvements in `go tool ... paralleltestctx` runs	2026-05-15 00:14:38 +10:00
Jakub Domeracki	1a1f06aa79	fix: verify PKCS7 signature on Azure instance identity tokens (#25286) ... Migrates Azure instance identity verification from `go.mozilla.org/pkcs7` and `github.com/fullsailor/pkcs7` to `github.com/smallstep/pkcs7`, using `VerifyWithChainAtTime` to validate both the PKCS7 signature and the certificate chain in one call. The previous code only verified the signer certificate against a set of intermediates/roots but did not verify that the PKCS7 signature itself covered the content, meaning tampered payloads could be accepted. The `Options` struct is restructured to accept `Roots`, `Intermediates`, and `CurrentTime` as explicit fields instead of embedding `x509.VerifyOptions`. The test helper `NewAzureInstanceIdentity` now builds a realistic 3-level certificate chain (Root CA -> Intermediate CA -> Signing Cert) matching real Azure trust hierarchy. New tests (`TestValidate_TamperedContent`, `TestValidate_UntrustedCertWithValidSignature`) confirm tampered and untrusted envelopes are rejected. Addresses GHSA-6x44-w3xg-hqqf. > [!NOTE] > This PR was authored by Coder Agents. <details> <summary>Implementation Plan</summary> ### Files Changed | File | Summary | |------|---------| | `coderd/azureidentity/azureidentity.go` | Replace `signer.Verify()` with `VerifyWithChainAtTime`; restructure `Options` struct; add `ParseCertificates()` helper | | `coderd/azureidentity/azureidentity_test.go` | Add `testCertChain` builder, tampered-content and untrusted-cert tests; update existing tests for new `Options` API | | `coderd/coderd.go` | Change `AzureCertificates` field from `x509.VerifyOptions` to `azureidentity.Options` | | `coderd/workspaceresourceauth.go` | Pass `api.AzureCertificates` directly instead of wrapping | | `coderd/coderdtest/coderdtest.go` | Migrate to `smallstep/pkcs7`; build 3-level cert chain in test helper | | `go.mod` / `go.sum` | Add `github.com/smallstep/pkcs7`; remove `fullsailor/pkcs7` and `go.mozilla.org/pkcs7` | </details>	2026-05-13 14:14:07 +00:00
dependabot[bot]	4b54925abc	chore: bump the x group across 1 directory with 7 updates (#25198) ... Bumps the x group with 4 updates in the / directory: [golang.org/x/crypto](https://github.com/golang/crypto), [golang.org/x/mod](https://github.com/golang/mod), [golang.org/x/net](https://github.com/golang/net) and [golang.org/x/tools](https://github.com/golang/tools). Updates `golang.org/x/crypto` from 0.50.0 to 0.51.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/crypto/commit/b8a14a8d65f88c0c79c139171f1354c69a6cdb8a"><code>b8a14a8</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/crypto/commit/9d9d5078968ddb8a279092c665a24e7de4178778"><code>9d9d507</code></a> x509roots/fallback/bundle: fix bundle test with Go 1.27+</li> <li><a href="https://github.com/golang/crypto/commit/fd0b90d21f9ab4b5dd398e9526b570bfea86e370"><code>fd0b90d</code></a> acme: include Problem in OrderError.Error</li> <li><a href="https://github.com/golang/crypto/commit/b9e53593a6073e6a786c49e9ad27956a9b77e54e"><code>b9e5359</code></a> pbkdf2: turn into a wrapper for crypto/pbkdf2</li> <li><a href="https://github.com/golang/crypto/commit/cc0e4fc1d49127130b0d00612a2eeed2ab745d40"><code>cc0e4fc</code></a> hkdf: forward Extract to the standard library</li> <li><a href="https://github.com/golang/crypto/commit/a8e9237a216b050e1b11e041863825104a6811db"><code>a8e9237</code></a> x509roots/fallback: update bundle</li> <li>See full diff in <a href="https://github.com/golang/crypto/compare/v0.50.0...v0.51.0">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/mod` from 0.35.0 to 0.36.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/mod/commit/643da9ba74f1165d8cae1505d453b3de3cf21b7b"><code>643da9b</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/mod/commit/ccc3cdf529d1eee2a832437eb1b85240044d21cb"><code>ccc3cdf</code></a> zip: include 'but content has correct sum' note in TestVCS</li> <li><a href="https://github.com/golang/mod/commit/ab3031803214705d2c9f1102318b083e7086a155"><code>ab30318</code></a> zip: update zip hashes for new flate compression</li> <li>See full diff in <a href="https://github.com/golang/mod/compare/v0.35.0...v0.36.0">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/net` from 0.53.0 to 0.54.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/net/commit/b138e06246cb323f2f380c2b7f7dd91f581dd56b"><code>b138e06</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/net/commit/689f70a42abd350f3a1aaa70b0d13eb9543d927a"><code>689f70a</code></a> quic: fix wrong final size being used for RESET_STREAM frame</li> <li><a href="https://github.com/golang/net/commit/208f306b2f0fd008b388bee2c2644be279778e94"><code>208f306</code></a> http3: increase handshake timeout</li> <li><a href="https://github.com/golang/net/commit/49810da71b9026da9e0d028a6ad8c7730c52d9c4"><code>49810da</code></a> http2: enable net/http wrapping when go &gt;= 1.27</li> <li><a href="https://github.com/golang/net/commit/5e11a5ab891c117eda83b4304d60dd13286c1c76"><code>5e11a5a</code></a> quic: fix data race in streamForFrame</li> <li><a href="https://github.com/golang/net/commit/8c63081cd380ea768db5651941614b73472160ff"><code>8c63081</code></a> http2: use empty Transport rather than DefaultTransport in http2wrap</li> <li><a href="https://github.com/golang/net/commit/fc7b466ca49cb204039630533ece4fc557eb35cd"><code>fc7b466</code></a> http2: add http2wrap test</li> <li><a href="https://github.com/golang/net/commit/15c2cb1875fd727313dc4de909b3ee149422fbe2"><code>15c2cb1</code></a> http2: avoid overflowing 32-bit int when http2wrap enabled</li> <li><a href="https://github.com/golang/net/commit/64651885c2f2d745d77af2d7af2edbf568c179af"><code>6465188</code></a> http2: add wrapped Server</li> <li><a href="https://github.com/golang/net/commit/72f419a894cb0597dd5b6bcf119086bf2af41231"><code>72f419a</code></a> http2: add wrapped ClientConn</li> <li>Additional commits viewable in <a href="https://github.com/golang/net/compare/v0.53.0...v0.54.0">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/sys` from 0.43.0 to 0.44.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/sys/commit/fb1facd76f95fa87c151018200ea5e4892ff115d"><code>fb1facd</code></a> windows: avoid uint16 overflow in NewNTUnicodeString</li> <li><a href="https://github.com/golang/sys/commit/94ad893e1e59c1d079221324d38945d2aad8703f"><code>94ad893</code></a> windows: add GetIfTable2Ex, GetIpInterface{Entry,Table}, GetUnicastIpAddressT...</li> <li><a href="https://github.com/golang/sys/commit/54fe89f8411576c06b345b341ca79a77d878a4ad"><code>54fe89f</code></a> cpu: use IsProcessorFeaturePresent to calculate ARM64 on windows</li> <li><a href="https://github.com/golang/sys/commit/df7d5d7b60641d17d87e2b50911124cb65f954fd"><code>df7d5d7</code></a> unix: automatically remove container created by mkall.sh</li> <li><a href="https://github.com/golang/sys/commit/68a4a8e945b22751c1a619261b1d755372a1d5f7"><code>68a4a8e</code></a> unix: avoid nil pointer dereference in Utime</li> <li><a href="https://github.com/golang/sys/commit/690c91f6ecf3b3ef141ad2aedb1306a868b3a176"><code>690c91f</code></a> unix: add CPUSetDynamic for systems with more than 1024 CPUs</li> <li>See full diff in <a href="https://github.com/golang/sys/compare/v0.43.0...v0.44.0">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/term` from 0.42.0 to 0.43.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/term/commit/3c3e4855f7d2eb06c3e48933554add9ec6b599b5"><code>3c3e485</code></a> go.mod: update golang.org/x dependencies</li> <li>See full diff in <a href="https://github.com/golang/term/compare/v0.42.0...v0.43.0">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/text` from 0.36.0 to 0.37.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/text/commit/3ef517e623a4bfc08d6457f87d73afda7af7d8e1"><code>3ef517e</code></a> go.mod: update golang.org/x dependencies</li> <li>See full diff in <a href="https://github.com/golang/text/compare/v0.36.0...v0.37.0">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/tools` from 0.44.0 to 0.45.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/tools/commit/2aabba0e4be44cc8f254ced118a7156d04bbc9f3"><code>2aabba0</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/tools/commit/ef989b3f45baff2849e87f4a70d9a189be5a6959"><code>ef989b3</code></a> go/types/internal/play: show Info.Instances[Ident]</li> <li><a href="https://github.com/golang/tools/commit/21d44f2f2bb3f3a8e06e35523d14bb70cb275c89"><code>21d44f2</code></a> go/analysis/passes/inline: document skipping of TestF-&gt;F calls</li> <li><a href="https://github.com/golang/tools/commit/ec83c2190d81a18bbd472cc1498575b168017e5d"><code>ec83c21</code></a> go/analysis/passes/modernize: minmax: only remove exact userdefined</li> <li><a href="https://github.com/golang/tools/commit/5625353d39195f1deb9261c5ee983abbdc4a15ca"><code>5625353</code></a> go/analysis/passes/modernize: improve value variable name generation</li> <li><a href="https://github.com/golang/tools/commit/15a3bd5d4ce0651f5cf43ea125db2110c67b257b"><code>15a3bd5</code></a> gopls/internal/analysis/errorsastype: imporove example clarity</li> <li><a href="https://github.com/golang/tools/commit/cd57ef8f8dd7a30ef500bfe1eef0779223cbdfc3"><code>cd57ef8</code></a> go/packages: include dependency errors when CompiledGoFiles is missing</li> <li><a href="https://github.com/golang/tools/commit/053fdbcef55e8f977d8decc0fde2920c61eb5374"><code>053fdbc</code></a> go/analysis/passes/modernize: minmax: fix pure operands only</li> <li><a href="https://github.com/golang/tools/commit/bf84681c4a0185014c089cffd533e22bbeffcb49"><code>bf84681</code></a> go/analysis/passes/errorsas: add example of invalid errors.As use</li> <li><a href="https://github.com/golang/tools/commit/23921d1decfe5da40309ac183353c8cb38b03dfa"><code>23921d1</code></a> gopls: add errorsastype analyzer</li> <li>Additional commits viewable in <a href="https://github.com/golang/tools/compare/v0.44.0...v0.45.0">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-12 17:33:46 +00:00
dependabot[bot]	0234422a55	chore: bump google.golang.org/api from 0.277.0 to 0.278.0 (#25201) ... Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.277.0 to 0.278.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's releases</a>.</em></p> <blockquote> <h2>v0.278.0</h2> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.277.0...v0.278.0">0.278.0</a> (2026-05-05)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3582">#3582</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/76b1187e506ac0f48caac67907dd0805b253f74c">76b1187</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3584">#3584</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/e36c88361d11545583325c3ac6bdbd9cf1f1a7d0">e36c883</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.277.0...v0.278.0">0.278.0</a> (2026-05-05)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3582">#3582</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/76b1187e506ac0f48caac67907dd0805b253f74c">76b1187</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3584">#3584</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/e36c88361d11545583325c3ac6bdbd9cf1f1a7d0">e36c883</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/googleapis/google-api-go-client/commit/07c758daacbc24e32753c3f1b537c7f6cce626f0"><code>07c758d</code></a> chore(main): release 0.278.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3583">#3583</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/e36c88361d11545583325c3ac6bdbd9cf1f1a7d0"><code>e36c883</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3584">#3584</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/76b1187e506ac0f48caac67907dd0805b253f74c"><code>76b1187</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3582">#3582</a>)</li> <li>See full diff in <a href="https://github.com/googleapis/google-api-go-client/compare/v0.277.0...v0.278.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-12 17:19:34 +00:00
Yevhenii Shcherbina	592e45dcfb	chore: bump coder-guts dependency (#25154) ... Bump coder/guts to v1.7.0. Related PR: https://github.com/coder/guts/pull/81	2026-05-11 19:18:44 -04:00