coder

mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00

Author	SHA1	Message	Date
dependabot[bot]	522ef09517	chore: bump github.com/stretchr/testify from 1.11.1 to 1.12.0 (#28259 ) Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.11.1 to 1.12.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/stretchr/testify/releases">github.com/stretchr/testify's releases</a>.</em></p> <blockquote> <h2>v1.12.0</h2> <h2>What's Changed</h2> <h3>Functional Changes</h3> <ul> <li>assert: make AssertionFunc types just aliases by <a href="https://github.com/dolmen"><code>@dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1563">stretchr/testify#1563</a></li> </ul> <h3>Fixes</h3> <ul> <li>mock: avoid panic when expected type is nil in Arguments.Diff by <a href="https://github.com/mutaiib"><code>@mutaiib</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1775">stretchr/testify#1775</a></li> <li>mock: revert to pre-v1.11.0 argument matching behavior for mutating stringers by <a href="https://github.com/brackendawson"><code>@brackendawson</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1786">stretchr/testify#1786</a></li> <li>suite: validate method signatures and continue execution for valid tests by <a href="https://github.com/vyas-git"><code>@vyas-git</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1665">stretchr/testify#1665</a></li> <li>assert.PanicsWithError: report error message by <a href="https://github.com/olivergondza"><code>@olivergondza</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1400">stretchr/testify#1400</a></li> <li>assert: IsIncreasing et al can return false w/out failing by <a href="https://github.com/brackendawson"><code>@brackendawson</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1787">stretchr/testify#1787</a></li> <li>add type to error message of assert.Same by <a href="https://github.com/egawata"><code>@egawata</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1792">stretchr/testify#1792</a></li> <li>mock.AssertExpectationsForObjects fix panic with wrong testObject type. by <a href="https://github.com/brackendawson"><code>@brackendawson</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1795">stretchr/testify#1795</a></li> <li>assert: truncate very long objects in test failure messages by <a href="https://github.com/brackendawson"><code>@brackendawson</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1646">stretchr/testify#1646</a></li> <li>assert: fix NotSubset error messages using %#v instead of %q (fixes <a href="https://redirect.github.com/stretchr/testify/issues/1800">#1800</a>) by <a href="https://github.com/nghiack7"><code>@nghiack7</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1888">stretchr/testify#1888</a></li> <li>suite: prevent panic when SetupTest skips with HandleStats by <a href="https://github.com/blackwell-systems"><code>@blackwell-systems</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1877">stretchr/testify#1877</a></li> </ul> <h3>Documentation, Build & CI</h3> <ul> <li>CI: test also with Go 1.23 by <a href="https://github.com/dolmen"><code>@dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1783">stretchr/testify#1783</a></li> <li>Vendor unmaintained github.com/pmezard/go-difflib by <a href="https://github.com/brackendawson"><code>@brackendawson</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1708">stretchr/testify#1708</a></li> <li>Promote ccoVeille to maintainer by <a href="https://github.com/brackendawson"><code>@brackendawson</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1784">stretchr/testify#1784</a></li> <li>build(deps): bump actions/setup-go from 5 to 6 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/stretchr/testify/pull/1790">stretchr/testify#1790</a></li> <li>assert.YAMLEq: Document mutlidoc behavior by <a href="https://github.com/brackendawson"><code>@brackendawson</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1791">stretchr/testify#1791</a></li> <li>_codegen: copy dependency github.com/ernesto-jimenez/gogen/imports by <a href="https://github.com/dolmen"><code>@dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1782">stretchr/testify#1782</a></li> <li>doc: remove ineffective inline code blocks by <a href="https://github.com/brackendawson"><code>@brackendawson</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1714">stretchr/testify#1714</a></li> <li>Tag generated assertions as non-generated in new .gitattributes by <a href="https://github.com/ubunatic"><code>@ubunatic</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1815">stretchr/testify#1815</a></li> <li>chore: vendor go-spew from <a href="https://github.com/davecgh/go-spew">https://github.com/davecgh/go-spew</a> by <a href="https://github.com/ccoVeille"><code>@ccoVeille</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1827">stretchr/testify#1827</a></li> <li>require: fix godoc generation for assertions returning a bool by <a href="https://github.com/Baxromumarov"><code>@Baxromumarov</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1850">stretchr/testify#1850</a></li> <li>docs(require): correct example usage to use assert.CollectT (require.CollectT does not exist) by <a href="https://github.com/a2not"><code>@a2not</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1821">stretchr/testify#1821</a></li> <li>docs: Fix EventuallyWithTf documentation with proper placement of formatting arguments by <a href="https://github.com/a2not"><code>@a2not</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1842">stretchr/testify#1842</a></li> <li>EMERITUS.md: add <a href="https://github.com/tylerb"><code>@tylerb</code></a> by <a href="https://github.com/dolmen"><code>@dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1812">stretchr/testify#1812</a></li> <li>CI: test also with Go 1.24 by <a href="https://github.com/alexandear"><code>@alexandear</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1856">stretchr/testify#1856</a></li> <li>deps: bump objx to v0.5.3 and remove dependency cycle issue by <a href="https://github.com/ccoVeille"><code>@ccoVeille</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1823">stretchr/testify#1823</a></li> <li>CI: upgrade GitHub Actions and pin hashes by <a href="https://github.com/SuperQ"><code>@SuperQ</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1883">stretchr/testify#1883</a></li> <li>CI: add _readme-gofmt tool to reformat Go code in README by <a href="https://github.com/dolmen"><code>@dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1889">stretchr/testify#1889</a></li> <li>CI: add check of GitHub Action pinned hashes against tag by <a href="https://github.com/dolmen"><code>@dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1885">stretchr/testify#1885</a></li> <li>_codegen: modernize by <a href="https://github.com/dolmen"><code>@dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1890">stretchr/testify#1890</a></li> <li>build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/stretchr/testify/pull/1906">stretchr/testify#1906</a></li> <li>mock: Mock.Return does not exist anymore by <a href="https://github.com/Kentzo"><code>@Kentzo</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1905">stretchr/testify#1905</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/mutaiib"><code>@mutaiib</code></a> made their first contribution in <a href="https://redirect.github.com/stretchr/testify/pull/1775">stretchr/testify#1775</a></li> <li><a href="https://github.com/vyas-git"><code>@vyas-git</code></a> made their first contribution in <a href="https://redirect.github.com/stretchr/testify/pull/1665">stretchr/testify#1665</a></li> <li><a href="https://github.com/olivergondza"><code>@olivergondza</code></a> made their first contribution in <a href="https://redirect.github.com/stretchr/testify/pull/1400">stretchr/testify#1400</a></li> <li><a href="https://github.com/egawata"><code>@egawata</code></a> made their first contribution in <a href="https://redirect.github.com/stretchr/testify/pull/1792">stretchr/testify#1792</a></li> <li><a href="https://github.com/ubunatic"><code>@ubunatic</code></a> made their first contribution in <a href="https://redirect.github.com/stretchr/testify/pull/1815">stretchr/testify#1815</a></li> <li><a href="https://github.com/Baxromumarov"><code>@Baxromumarov</code></a> made their first contribution in <a href="https://redirect.github.com/stretchr/testify/pull/1850">stretchr/testify#1850</a></li> <li><a href="https://github.com/a2not"><code>@a2not</code></a> made their first contribution in <a href="https://redirect.github.com/stretchr/testify/pull/1821">stretchr/testify#1821</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/stretchr/testify/commit/001eb7946baf451879253643e4ce4b38eaa0d4a7"><code>001eb79</code></a> Merge pull request <a href="https://redirect.github.com/stretchr/testify/issues/1905">#1905</a> from Kentzo/patch-1</li> <li><a href="https://github.com/stretchr/testify/commit/ad40f384b10b10d2bbac85354c80eab5abed0a45"><code>ad40f38</code></a> Merge pull request <a href="https://redirect.github.com/stretchr/testify/issues/1906">#1906</a> from stretchr/dependabot/github_actions/actions/chec...</li> <li><a href="https://github.com/stretchr/testify/commit/3bae01746b7ef55bd50252b8c7fe5a41b7bf0fcc"><code>3bae017</code></a> build(deps): bump actions/checkout from 6.0.2 to 6.0.3</li> <li><a href="https://github.com/stretchr/testify/commit/f8c01f33a3747928ede4174ad1b718698fc352e7"><code>f8c01f3</code></a> mock: Mock.Return does not exist anymore</li> <li><a href="https://github.com/stretchr/testify/commit/12f8b5612e125f337c4589e198771e5f8970f160"><code>12f8b56</code></a> Merge pull request <a href="https://redirect.github.com/stretchr/testify/issues/1563">#1563</a> from stretchr/make-AssertionFunc-types-aliases</li> <li><a href="https://github.com/stretchr/testify/commit/a11649e4279ae45a978a29285d46c347c351e382"><code>a11649e</code></a> assert: make AssertionFunc type just aliases</li> <li><a href="https://github.com/stretchr/testify/commit/dc20f419863ab083f472a7af1215cc3c049e8ecd"><code>dc20f41</code></a> Merge pull request <a href="https://redirect.github.com/stretchr/testify/issues/1890">#1890</a> from stretchr/dolmen/codegen-modernize</li> <li><a href="https://github.com/stretchr/testify/commit/098f8d75b344a22ada8a305282530785e81f8ea2"><code>098f8d7</code></a> _codegen: use strings.Builder</li> <li><a href="https://github.com/stretchr/testify/commit/d2699bed69a45be5ac63448f017ce0c9e2d103d3"><code>d2699be</code></a> _codegen: modernize</li> <li><a href="https://github.com/stretchr/testify/commit/a463c8caf3411b7d36b87204f997c17ef573675d"><code>a463c8c</code></a> Merge pull request <a href="https://redirect.github.com/stretchr/testify/issues/1885">#1885</a> from stretchr/dolmen/ci-check-ghactions-hashes</li> <li>Additional commits viewable in <a href="https://github.com/stretchr/testify/compare/v1.11.1...v1.12.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/stretchr/testify&package-manager=go_modules&previous-version=1.11.1&new-version=1.12.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-18 11:17:49 +00:00
dependabot[bot]	87cddd2d78	chore: bump google.golang.org/api from 0.292.0 to 0.293.0 (#28194 ) Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.292.0 to 0.293.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's releases</a>.</em></p> <blockquote> <h2>v0.293.0</h2> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.292.0...v0.293.0">0.293.0</a> (2026-08-11)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3689">#3689</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/82ee53b794c25614818788285e4d6fca4cfaa1ec">82ee53b</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3691">#3691</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/07e3f98c6d7c44f348bbc05f64f432ec46f435ab">07e3f98</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3692">#3692</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/8ab25861a802d778288129a603846c65b844d8ec">8ab2586</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3693">#3693</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/3ca7257fbaff1a073464989df9a284e7088f2917">3ca7257</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3694">#3694</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/68555327f8bf789f35a7e0d0ebfe9fac16530a68">6855532</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3696">#3696</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/b7d7362fc13addec7389a279e6483db7e8f1159f">b7d7362</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3697">#3697</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/9f826b1a20348948d7ae728134651c3dcbccf5db">9f826b1</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.292.0...v0.293.0">0.293.0</a> (2026-08-11)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3689">#3689</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/82ee53b794c25614818788285e4d6fca4cfaa1ec">82ee53b</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3691">#3691</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/07e3f98c6d7c44f348bbc05f64f432ec46f435ab">07e3f98</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3692">#3692</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/8ab25861a802d778288129a603846c65b844d8ec">8ab2586</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3693">#3693</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/3ca7257fbaff1a073464989df9a284e7088f2917">3ca7257</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3694">#3694</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/68555327f8bf789f35a7e0d0ebfe9fac16530a68">6855532</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3696">#3696</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/b7d7362fc13addec7389a279e6483db7e8f1159f">b7d7362</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3697">#3697</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/9f826b1a20348948d7ae728134651c3dcbccf5db">9f826b1</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/googleapis/google-api-go-client/commit/5b1402ec5cbf03814dc5b35fdd8855f750adcf0a"><code>5b1402e</code></a> chore(main): release 0.293.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3690">#3690</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/9f826b1a20348948d7ae728134651c3dcbccf5db"><code>9f826b1</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3697">#3697</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/a35fb8e3337735910977da00fe1d55a83f5d884a"><code>a35fb8e</code></a> chore(all): update all (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3695">#3695</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/b7d7362fc13addec7389a279e6483db7e8f1159f"><code>b7d7362</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3696">#3696</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/68555327f8bf789f35a7e0d0ebfe9fac16530a68"><code>6855532</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3694">#3694</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/3ca7257fbaff1a073464989df9a284e7088f2917"><code>3ca7257</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3693">#3693</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/8ab25861a802d778288129a603846c65b844d8ec"><code>8ab2586</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3692">#3692</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/07e3f98c6d7c44f348bbc05f64f432ec46f435ab"><code>07e3f98</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3691">#3691</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/82ee53b794c25614818788285e4d6fca4cfaa1ec"><code>82ee53b</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3689">#3689</a>)</li> <li>See full diff in <a href="https://github.com/googleapis/google-api-go-client/compare/v0.292.0...v0.293.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/api&package-manager=go_modules&previous-version=0.292.0&new-version=0.293.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-17 07:20:50 +00:00
dependabot[bot]	90ef0bc204	chore: bump the x group with 5 updates (#28190 ) Bumps the x group with 5 updates: \| Package \| From \| To \| \| --- \| --- \| --- \| \| [golang.org/x/crypto](https://github.com/golang/crypto) \| `0.54.0` \| `0.55.0` \| \| [golang.org/x/mod](https://github.com/golang/mod) \| `0.38.0` \| `0.40.0` \| \| [golang.org/x/net](https://github.com/golang/net) \| `0.57.0` \| `0.58.0` \| \| [golang.org/x/text](https://github.com/golang/text) \| `0.40.0` \| `0.41.0` \| \| [golang.org/x/tools](https://github.com/golang/tools) \| `0.48.0` \| `0.49.0` \| Updates `golang.org/x/crypto` from 0.54.0 to 0.55.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/crypto/commit/f44d03d253a1503e51b059ca880867c51d878242"><code>f44d03d</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/crypto/commit/5ed494470b06afb7621b303b04e38366d5863942"><code>5ed4944</code></a> crypto/internal/poly1305: provide optimised assembly for riscv64</li> <li><a href="https://github.com/golang/crypto/commit/b07833c067ec08648541694dc11e02b5ab6b956a"><code>b07833c</code></a> ssh: return window credit for discarded extended data</li> <li><a href="https://github.com/golang/crypto/commit/d701c51f7e4e57f61c4947390514fe631e06202f"><code>d701c51</code></a> acme: fix nil pointer dereference in pebble test error reporting</li> <li><a href="https://github.com/golang/crypto/commit/999d053994c9f2ececb2e85ab0bec72283539e33"><code>999d053</code></a> ssh: fix parsing of GSSAPI payloads offering multiple mechanisms</li> <li><a href="https://github.com/golang/crypto/commit/90f76b8ffe1453c472892d338785687e9727bcc0"><code>90f76b8</code></a> ssh: reject certificate signature keys before recursing</li> <li><a href="https://github.com/golang/crypto/commit/b53964a1ca4763384f2ee3bf482b8ca67a9f9fa8"><code>b53964a</code></a> ssh: permit empty but non-nil HostKeyAlgorithms, KeyExchanges, Ciphers, MACs</li> <li><a href="https://github.com/golang/crypto/commit/626e40fc986f72b464ecb2063e02e7923bf3025d"><code>626e40f</code></a> ssh: drain stderr on forwarded TCP and Unix channels</li> <li><a href="https://github.com/golang/crypto/commit/31914c699bfcc4906a7f6a178e910388518ed6a3"><code>31914c6</code></a> x509roots/fallback: update bundle</li> <li><a href="https://github.com/golang/crypto/commit/f2135b814ca127b11d04d6d6f0e6569922bace0f"><code>f2135b8</code></a> all: clean up minor issues found by staticcheck</li> <li>Additional commits viewable in <a href="https://github.com/golang/crypto/compare/v0.54.0...v0.55.0">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/mod` from 0.38.0 to 0.40.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/mod/commit/d3398d06de5fa5c71083d3d1c26f2cda73508e0f"><code>d3398d0</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/mod/commit/57549bfb0d25b5ff7eb4763aa1f029d7e5383232"><code>57549bf</code></a> sumdb: ignore unrelated hashes in Lookup</li> <li><a href="https://github.com/golang/mod/commit/96f62ae6e9cb1b123de383fa2542812c9ba3b7db"><code>96f62ae</code></a> sumdb/tlog: fix TileHashReader authentication bypass</li> <li><a href="https://github.com/golang/mod/commit/13be9020bbbfae457b59b82c999f8c309cb21ffc"><code>13be902</code></a> go.mod: update golang.org/x dependencies</li> <li>See full diff in <a href="https://github.com/golang/mod/compare/v0.38.0...v0.40.0">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/net` from 0.57.0 to 0.58.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/net/commit/acc78e0d2b2c855c0c4fbdcfe5f42a9e3d0f9778"><code>acc78e0</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/net/commit/90d10f01d98d92403c7b2823ab62a977cd01c7c6"><code>90d10f0</code></a> internal/http3: delete invalid Content-Length if declared in server handler</li> <li><a href="https://github.com/golang/net/commit/08abf4d948c22eae54ea207977c8ee700412a442"><code>08abf4d</code></a> internal/http3: infer headers when Content-Encoding is set but is empty</li> <li><a href="https://github.com/golang/net/commit/8d10596d262406469433c798878f7a33b1a8d6c4"><code>8d10596</code></a> http2: avoid deadlocks in wrapped ClientConn state callback</li> <li><a href="https://github.com/golang/net/commit/99c3b0a8f463fdf9bfde3b2cb50599ee53891eb0"><code>99c3b0a</code></a> http2/hpack: build the table lookup maps lazily, only for encoders</li> <li><a href="https://github.com/golang/net/commit/5a920b1a80900b1da0d73d18b73c193f7b52b901"><code>5a920b1</code></a> http3: rework registration to allow using a fake network</li> <li><a href="https://github.com/golang/net/commit/7fd284277aab94a6bd16c6a50b7604958f7a18a1"><code>7fd2842</code></a> quic: return an error from Accept after PacketConn reader exits</li> <li><a href="https://github.com/golang/net/commit/825111d7f2d2ccf50aa8eb63f62da04e2e3c5dc6"><code>825111d</code></a> quic: avoid busy-loop when keep-alive is blocked by congestion control</li> <li><a href="https://github.com/golang/net/commit/a02ddfa7eacb4cf63a5bea6b23761244a6df69f6"><code>a02ddfa</code></a> http/httpproxy: prioritize lowercase proxy environment variables</li> <li><a href="https://github.com/golang/net/commit/574e5eb9d32de67fb16096316d40bb9c412e4906"><code>574e5eb</code></a> quic: halt conn goroutines on close when listener exits early</li> <li>Additional commits viewable in <a href="https://github.com/golang/net/compare/v0.57.0...v0.58.0">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/text` from 0.40.0 to 0.41.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/text/commit/acdba6655fd45cdb5ab73c9d6a8981333bd65a39"><code>acdba66</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/text/commit/02aa981a75cb366b39e71729b935c15a7b4e146a"><code>02aa981</code></a> secure/precis: fix short destination buffer handling in Nickname profile</li> <li>See full diff in <a href="https://github.com/golang/text/compare/v0.40.0...v0.41.0">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/tools` from 0.48.0 to 0.49.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/tools/commit/18332fec72972efbb8ab9881984fec2d8cfc2b58"><code>18332fe</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/tools/commit/a5c4651b8e4951086fc536519d0eb869feefa7cb"><code>a5c4651</code></a> gopls/internal/protocol/command: fix struct field name in comment</li> <li><a href="https://github.com/golang/tools/commit/7d08a06ad24bb57ca109618799b3fb0f823a85a3"><code>7d08a06</code></a> present, cmd/present, cmd/present2md: document lack of security hardening</li> <li><a href="https://github.com/golang/tools/commit/e8a4348692a44c3a3a7157ede01d0407cb0dd034"><code>e8a4348</code></a> refactor/satisfy: fix "the the" typo</li> <li><a href="https://github.com/golang/tools/commit/54624f998d64d74146c63e7f477bcc201d1c44e9"><code>54624f9</code></a> internal/typesinternal: suppress jsonv2 warning</li> <li><a href="https://github.com/golang/tools/commit/c117dde2d0e430d319f475cec3f637c2c9efb56f"><code>c117dde</code></a> gopls/internal/golang: normalize instantiated fields before rename</li> <li><a href="https://github.com/golang/tools/commit/b5b860c7f55cd9ece1dcfcc4a7def912351cb8e9"><code>b5b860c</code></a> gopls/internal/mcp: report one-based reference line numbers</li> <li><a href="https://github.com/golang/tools/commit/bf54bcd2f14a330f0dcffa4cf631235de771bde2"><code>bf54bcd</code></a> gopls/internal/golang/completion: avoid SEGV from double deslicing</li> <li><a href="https://github.com/golang/tools/commit/4b32d669ce28c3b3e274a377a955063223a90350"><code>4b32d66</code></a> refactor/satisfy/find.go: fix panic on type errors</li> <li><a href="https://github.com/golang/tools/commit/e6da7e43e166478a3fa31e18fe3c07fe1379c7db"><code>e6da7e4</code></a> gopls/internal/protocol/semtok: instructions for modifier/type changes</li> <li>Additional commits viewable in <a href="https://github.com/golang/tools/compare/v0.48.0...v0.49.0">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-17 07:20:14 +00:00
dependabot[bot]	e52141fc6a	chore: bump github.com/nats-io/nats.go from 1.52.0 to 1.53.1 (#28192 ) Bumps [github.com/nats-io/nats.go](https://github.com/nats-io/nats.go) from 1.52.0 to 1.53.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/nats-io/nats.go/releases">github.com/nats-io/nats.go's releases</a>.</em></p> <blockquote> <h2>Release v1.53.1</h2> <h2>Changelog</h2> <p>This is a patch release containing no functional changes.</p> <h3>FIXED</h3> <ul> <li><code>Version</code> const and the README install line, which were not updated for v1.53.0 (<a href="https://redirect.github.com/nats-io/nats.go/issues/2118">#2118</a>)</li> </ul> <h3>Complete Changes</h3> <p><a href="https://github.com/nats-io/nats.go/compare/v1.53.0...v1.53.1">https://github.com/nats-io/nats.go/compare/v1.53.0...v1.53.1</a></p> <h2>Release v1.53.0</h2> <h2>Changelog</h2> <h3>ADDED</h3> <ul> <li>JetStream: <ul> <li><code>WithPublishAsyncAckHandler</code> option for JetStream async publish. Thanks <a href="https://github.com/occamist"><code>@occamist</code></a> for the contribution (<a href="https://redirect.github.com/nats-io/nats.go/issues/2109">#2109</a>)</li> <li><code>AckFlowControlPolicy</code> to legacy API (<a href="https://redirect.github.com/nats-io/nats.go/issues/2091">#2091</a>)</li> </ul> </li> <li>Micro: <ul> <li><code>micro.WithEndpointMetadataKey</code>. Thanks <a href="https://github.com/joeriddles"><code>@joeriddles</code></a> for the contribution (<a href="https://redirect.github.com/nats-io/nats.go/issues/2079">#2079</a>)</li> </ul> </li> </ul> <h3>FIXED</h3> <ul> <li>Core NATS: <ul> <li>Websocket connection with path. Thanks <a href="https://github.com/joeriddles"><code>@joeriddles</code></a> for the contribution (<a href="https://redirect.github.com/nats-io/nats.go/issues/2092">#2092</a>)</li> <li><code>MsgsTimeout</code> iterator yielding a spurious <code>(nil, nil)</code> after a timeout. Thanks <a href="https://github.com/sueun-dev"><code>@sueun-dev</code></a> and <a href="https://github.com/c-tonneslan"><code>@c-tonneslan</code></a> for the contributions (<a href="https://redirect.github.com/nats-io/nats.go/issues/2099">#2099</a>, <a href="https://redirect.github.com/nats-io/nats.go/issues/2093">#2093</a>)</li> </ul> </li> <li>JetStream: <ul> <li>Data race in <code>resetOrderedConsumer</code> when resets overlap (<a href="https://redirect.github.com/nats-io/nats.go/issues/2111">#2111</a>)</li> <li>Avoid panic in <code>PullSubscribe</code> consumer create path. Thanks <a href="https://github.com/wyf027"><code>@wyf027</code></a> for the contribution (<a href="https://redirect.github.com/nats-io/nats.go/issues/2088">#2088</a>)</li> <li>Honor per-request <code>JSOpt</code> API prefix across JetStream APIs. Thanks <a href="https://github.com/wyf027"><code>@wyf027</code></a> for the contribution (<a href="https://redirect.github.com/nats-io/nats.go/issues/2087">#2087</a>)</li> <li>Add nil checks for empty JetStream API responses. Thanks <a href="https://github.com/colecschmidt"><code>@colecschmidt</code></a> for the contribution (<a href="https://redirect.github.com/nats-io/nats.go/issues/2073">#2073</a>)</li> </ul> </li> <li>KeyValue: <ul> <li>Recognize error code 10164 for replicated KV CAS conflicts (<a href="https://redirect.github.com/nats-io/nats.go/issues/2098">#2098</a>)</li> <li>Reject keys with consecutive dots in <code>keyValid</code> and <code>searchKeyValid</code>. Thanks <a href="https://github.com/c-tonneslan"><code>@c-tonneslan</code></a> for the contribution (<a href="https://redirect.github.com/nats-io/nats.go/issues/2076">#2076</a>)</li> </ul> </li> <li>Micro: <ul> <li>Endpoint subject prefix over-match. Thanks <a href="https://github.com/vsaraikin"><code>@vsaraikin</code></a> for the contribution (<a href="https://redirect.github.com/nats-io/nats.go/issues/2105">#2105</a>)</li> </ul> </li> </ul> <h3>IMPROVED</h3> <ul> <li>Performance enhancement when publishing core NATS messages with headers. Thanks <a href="https://github.com/jonchammer"><code>@jonchammer</code></a> for the contribution (<a href="https://redirect.github.com/nats-io/nats.go/issues/2083">#2083</a>)</li> <li>Migrate tests to ntf (<a href="https://redirect.github.com/nats-io/nats.go/issues/2082">#2082</a>)</li> <li>Add docs.nats.io examples to main (<a href="https://redirect.github.com/nats-io/nats.go/issues/2106">#2106</a>)</li> <li>Improve readme wording for JetStream consumers. Thanks <a href="https://github.com/trevorah"><code>@trevorah</code></a> for the contribution (<a href="https://redirect.github.com/nats-io/nats.go/issues/2104">#2104</a>)</li> </ul> <h3>Complete Changes</h3> <p><a href="https://github.com/nats-io/nats.go/compare/v1.52.0...v1.53.0">https://github.com/nats-io/nats.go/compare/v1.52.0...v1.53.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nats-io/nats.go/commit/db1375fcffae2eb0b4ced1b7bad4d47c4447e4ac"><code>db1375f</code></a> Release v1.53.1 (<a href="https://redirect.github.com/nats-io/nats.go/issues/2118">#2118</a>)</li> <li><a href="https://github.com/nats-io/nats.go/commit/ae0af2c70af65374f6dfc001be1fc4accf7ddb63"><code>ae0af2c</code></a> [IMPROVED] Migrate tests to ntf (<a href="https://redirect.github.com/nats-io/nats.go/issues/2082">#2082</a>)</li> <li><a href="https://github.com/nats-io/nats.go/commit/0c5d8d7245c17a418cb850ac69a1aa52b17e19c5"><code>0c5d8d7</code></a> [ADDED] <code>WithPublishAsyncAckHandler</code> option for JetStream async publish (<a href="https://redirect.github.com/nats-io/nats.go/issues/2109">#2109</a>)</li> <li><a href="https://github.com/nats-io/nats.go/commit/15d96caf3a5947dcfde1c84b613dd77205e9e892"><code>15d96ca</code></a> [FIXED] Data race in resetOrderedConsumer when resets overlap (<a href="https://redirect.github.com/nats-io/nats.go/issues/2111">#2111</a>)</li> <li><a href="https://github.com/nats-io/nats.go/commit/f66c8e7396168080b104c91ac6a4c6863bf72373"><code>f66c8e7</code></a> [FIXED] Recognize error code 10164 for replicated KV CAS conflicts (<a href="https://redirect.github.com/nats-io/nats.go/issues/2097">#2097</a>) (#...</li> <li><a href="https://github.com/nats-io/nats.go/commit/9d92e853d400b5dc8ec5334ef8967e226299923f"><code>9d92e85</code></a> iter: don't yield a phantom (nil, nil) after MsgsTimeout's ErrTimeout (<a href="https://redirect.github.com/nats-io/nats.go/issues/2093">#2093</a>)</li> <li><a href="https://github.com/nats-io/nats.go/commit/c68c4de4fc2ce3834956a2487859d1eaf28a2942"><code>c68c4de</code></a> [FIXED] micro: endpoint subject prefix over-match (<a href="https://redirect.github.com/nats-io/nats.go/issues/2105">#2105</a>)</li> <li><a href="https://github.com/nats-io/nats.go/commit/e663e6717e4f96add4738d3865dc142ae5c17a6b"><code>e663e67</code></a> Improve example wording (<a href="https://redirect.github.com/nats-io/nats.go/issues/2104">#2104</a>)</li> <li><a href="https://github.com/nats-io/nats.go/commit/c1a0716149a402b9a0c3e7c7c234cbce5afd9650"><code>c1a0716</code></a> Add docs.nats.io examples to main (<a href="https://redirect.github.com/nats-io/nats.go/issues/2106">#2106</a>)</li> <li><a href="https://github.com/nats-io/nats.go/commit/77e280d0b1515dd8b47a28606ef2ca7c3a767d3d"><code>77e280d</code></a> [FIXED] MsgsTimeout iterator yields spurious (nil, nil) after a timeout (<a href="https://redirect.github.com/nats-io/nats.go/issues/2099">#2099</a>)</li> <li>Additional commits viewable in <a href="https://github.com/nats-io/nats.go/compare/v1.52.0...v1.53.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/nats-io/nats.go&package-manager=go_modules&previous-version=1.52.0&new-version=1.53.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-17 07:18:18 +00:00
Michael Suchacz	e92fd8e96f	chore: retire mark3labs/mcp-go dependency (#28061 ) ## Stack Context PR 6 of 6 in a stack that migrates every Coder MCP surface from the archived `github.com/mark3labs/mcp-go` library to the official `github.com/modelcontextprotocol/go-sdk` v1.7.0. Stack: #28056 -> #28057 -> #28058 -> #28059 -> #28060 -> #28061 ## Why With every production surface migrated, this PR removes the mark3labs dependency entirely and converts the remaining test fixtures. - Migrates the remaining mark3labs test fixtures (coderd MCP e2e tests, chatd fixtures, mcpclient fixtures, and the Force On MCP policy tests) to official stateless SDK servers. - Removes `github.com/mark3labs/mcp-go` from `go.mod` and drops the corresponding dependabot ignore entry. Zero references remain repo-wide. - Updates the MCP docs for the 2026-07-28 protocol: stateless Streamable HTTP behavior, the supported 2024-11-05 through 2026-07-28 protocol range, and explicit non-features (resources, prompts, structured output, elicitation, MCP Tasks). - The e2e ping assertion is removed because MCP 2026-07-28 removed the ping method. > Mux created this PR on Mike's behalf.	2026-08-13 10:47:14 +00:00
Michael Suchacz	08a1525f78	feat: migrate coderd MCP server to official MCP Go SDK (#28056 ) ## Stack Context PR 1 of 6 in a stack that migrates every Coder MCP surface from the archived `github.com/mark3labs/mcp-go` library to the official `github.com/modelcontextprotocol/go-sdk` v1.7.0, adding MCP 2026-07-28 support while keeping compatibility with clients speaking 2024-11-05 through 2025-06-18. Stack: #28056 -> #28057 -> #28058 -> #28059 -> #28060 -> #28061 ## Why The coderd Streamable HTTP MCP server (`/api/experimental/mcp/http`) is the foundation layer: it introduces the official SDK dependency and the shared `RegisterSDKTool` helper the CLI server reuses. - The server runs the SDK handler in stateless mode with `JSONResponse: true`, preserving the previous `application/json` POST wire format. GET and DELETE return 405, and no `Mcp-Session-Id` is issued, both permitted by the Streamable HTTP spec. - `DisableLocalhostProtection` is set because coderd commonly listens on loopback behind a reverse proxy with a public Host header; the endpoint's bearer authentication is the relevant access control. - Tool registration builds raw JSON object schemas and omits empty `required`, keeping `tools/list` output byte-identical to the previous server (verified with a golden comparison). - SDK logs are adapted to `cdr.dev/slog/v3`; only warnings and errors are forwarded because the SDK logs several INFO lines per stateless request. - Tests cover the modern 2026-07-28 flow, legacy 2025-06-18 initialize, unsupported protocol version rejection (`-32022`), and non-POST method behavior. ## Known behavior deltas vs the old endpoint Both deltas come from the SDK enforcing the Streamable HTTP spec where mark3labs was lenient, on an experimental endpoint: - POST requests whose `Accept` header lists `application/json` without `text/event-stream` are now rejected with 400 (the spec requires clients to list both; a missing `Accept` header is still tolerated). mark3labs did not validate `Accept` at all. - The old server generated an unvalidated `Mcp-Session-Id` response header; the stateless SDK handler issues none. Clients that merely echo the header back are unaffected. ## Validation Beyond unit/integration tests, a remote dogfood UAT ran protocol conformance against a live dev server built from the stack tip: version negotiation matrix (2024-11-05 through bogus/omitted values), auth, session/method semantics, tool schema sanity, tools/call happy and error paths (unknown tool, schema-violating args, malformed JSON, jsonrpc "1.0"), and a concurrency smoke test. No 500s or connection drops; error shapes are clean JSON-RPC/HTTP errors. > Mux created this PR on Mike's behalf.	2026-08-13 09:50:18 +00:00
Michael Suchacz	b3607f51b2	fix: keep chat token usage for streams ending with usage-less chunks (#28068 ) Bumps the coder/fantasy fork pin to pick up coder/fantasy#52. ## Problem Chats on `poolside/laguna-xs-2.1` showed no context usage: every assistant message persisted NULL token columns, and automatic compaction never triggered, so chats ran to context overflow. AIBridge recorded correct usage for the same requests, so the loss was client-side in fantasy. When tools are declared, laguna-xs reports cumulative usage on every delta chunk and ends the stream with a `finish_reason` chunk whose `usage` is null, with no trailing usage-only chunk. Fantasy's chat-completions stream loops reassigned usage from every chunk, and the default stream usage hook returns zero usage for usage-less chunks, so the trailing finish chunk wiped the real usage one chunk earlier. The Finish part then reported `Usage{0,0,0}`, which chatd persists as NULL (`nullInt64IfNonZero`). ## Fix coder/fantasy#52 adopts the stream usage hook's result only when the chunk actually carries usage, in both the chat-completions stream loop and the JSON-mode object stream loop. This mirrors the aibridge fix in #27967, which is why the gateway recorded usage correctly while fantasy lost it. Spec-compliant backends that emit usage once on the final chunk are unaffected. This PR pins the fork at the merged commit and documents the fork-only patch in the go.mod comment block. ## Validation - coder/fantasy#52: new regression tests for both stream loops, proven red against the unguarded code; full module tests, vet, gofmt, and golangci-lint green; fork CI green before merge. - Here: `go build ./...`, `go vet ./coderd/x/chatd/...`, and `go test ./coderd/x/chatd/...` (including the chatdebug field-coverage guard) all pass with the bumped pin. > Mux acted on Mike's behalf to create this PR.	2026-08-12 17:08:01 +02:00
Michael Suchacz	88e113554a	fix: report per-request Anthropic usage in chat token accounting (#27966 )	2026-08-12 12:52:22 +02:00
dependabot[bot]	b0afab063f	chore: bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.69.0 to 0.70.0 (#28018 ) Bumps [go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp](https://github.com/open-telemetry/opentelemetry-go-contrib) from 0.69.0 to 0.70.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md">go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp's changelog</a>.</em></p> <blockquote> <h2>[1.45.0/2.5.2/0.70.0/0.37.2/0.25.0/0.20.0/0.16.2/0.17.0] - 2026-08-03</h2> <h3>Added</h3> <ul> <li>Add <code>go.opentelemetry.io/contrib/detectors/ibmcloud/vpc</code>, a new resource detector for IBM Cloud VPC virtual server instances, ported from <code>github.com/open-telemetry/opentelemetry-collector-contrib/processor/resourcedetectionprocessor/internal/ibmcloud/vpc</code>. Detects <code>cloud.provider</code>, <code>cloud.platform</code>, <code>cloud.region</code>, <code>cloud.availability_zone</code>, <code>cloud.account.id</code>, <code>cloud.resource_id</code>, <code>host.id</code>, <code>host.image.id</code>, <code>host.image.name</code>, <code>host.name</code>, and <code>host.type</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9011">#9011</a>)</li> <li>Add <code>go.opentelemetry.io/contrib/detectors/k8sapi</code>, a new resource detector that queries the Kubernetes API. Detects <code>k8s.node.name</code> and <code>k8s.node.uid</code> when <code>K8S_NODE_NAME</code> is set via the downward API, and <code>k8s.cluster.uid</code> derived from the kube-system namespace UID (works on any Kubernetes distribution). (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9108">#9108</a>)</li> <li>Add new <code>elasticbeanstalk</code> resource detector for AWS Elastic Beanstalk, ported from <code>processor/resourcedetectionprocessor/internal/aws/elasticbeanstalk</code> in opentelemetry-collector-contrib. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8993">#8993</a>)</li> <li>The resource created by <code>go.opentelemetry.io/contrib/otelconf</code> now includes <a href="https://pkg.go.dev/go.opentelemetry.io/otel/sdk/resource#Default">default SDK attributes</a>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8990">#8990</a>)</li> <li>Add support for the <code>aws.ecs</code> resource detector in <code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8915">#8915</a>)</li> <li>Add support for the <code>aws.eks</code> resource detector in <code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9138">#9138</a>)</li> <li>Add support for the <code>azure.vm</code> resource detector in <code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9074">#9074</a>)</li> <li>Add support for the <code>gcp</code> resource detector in <code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9137">#9137</a>)</li> <li>Add <code>go.opentelemetry.io/contrib/detectors/azure/azureappservice</code>, a new resource detector for Azure App Service. Detects <code>cloud.</code>, <code>service.name</code>, <code>azure.resource_group.name</code>, <code>azure.app_service.instance.id</code>, and <code>deployment.environment.name</code> from the <code>WEBSITE_</code> and <code>REGION_NAME</code> environment variables. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9289">#9289</a>)</li> <li>Add <code>azurecontainerapps</code> resource detector for Azure Container Apps. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8939">#8939</a>)</li> <li>Add <code>go.opentelemetry.io/contrib/detectors/azure/azurefunctions</code>, a new resource detector for Azure Functions. Detects <code>cloud.</code>, <code>service.name</code>, <code>azure.resource_group.name</code>, <code>faas.instance</code>, and <code>deployment.environment.name</code> from the <code>FUNCTIONS_</code>, <code>WEBSITE_*</code>, <code>CONTAINER_NAME</code>, and <code>REGION_NAME</code> environment variables. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9290">#9290</a>)</li> <li>Add <code>NewResourceDetector</code> along with the <code>WithAttributeFilter</code> and <code>WithTagKeyFilter</code> options in <code>go.opentelemetry.io/contrib/detectors/azure/azurevm</code>. <code>WithAttributeFilter</code> restricts the returned resource to the attributes the filter accepts. <code>WithTagKeyFilter</code> opts in to <code>azure.tag.<name></code> attributes for the VM tags whose keys satisfy the provided predicate; no VM tags are emitted without it. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9162">#9162</a>)</li> <li>Add <code>go.opentelemetry.io/contrib/detectors/vultr</code> — a new resource detector for Vultr Cloud Compute instances, ported from <code>processor/resourcedetectionprocessor/internal/vultr</code> in <code>opentelemetry-collector-contrib</code>. Detects <code>cloud.provider</code>, <code>cloud.platform</code>, <code>cloud.region</code>, <code>host.id</code>, and <code>host.name</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8995">#8995</a>)</li> </ul> <h3>Changed</h3> <ul> <li>Upgrade <code>go.opentelemetry.io/otel/semconv</code> to <code>v1.43.0</code>, including updates across instrumentation and detector modules. See <a href="https://github.com/open-telemetry/semantic-conventions/releases/tag/v1.43.0">semantic-conventions v1.43.0 release</a> for complete details. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9337">#9337</a>)</li> <li>Upgrade <code>go.opentelemetry.io/otel/semconv</code> to <code>v1.42.0</code>, including updates across instrumentation and detector modules. See <a href="https://github.com/open-telemetry/semantic-conventions/releases/tag/v1.42.0">semantic-conventions v1.42.0 release</a> for complete details. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9196">#9196</a>)</li> <li>Use direct normalized-key lookups in <code>Carrier.Get</code> and <code>Carrier.Keys</code> in <code>go.opentelemetry.io/contrib/propagators/envcar</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9112">#9112</a>)</li> <li>Update log bridge conversions to use attribute key-values instead of the removed log key-values in <code>go.opentelemetry.io/contrib/bridges/otellogr</code>, <code>go.opentelemetry.io/contrib/bridges/otellogrus</code>, <code>go.opentelemetry.io/contrib/bridges/otelslog</code>, and <code>go.opentelemetry.io/contrib/bridges/otelzap</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9180">#9180</a>)</li> <li>The <code>Version()</code> function in <code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code> has been replaced by <code>const Version</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9076">#9076</a>)</li> <li>Set <code>error.type</code> attribute instead of adding <code>exception</code> span events in <code>go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8977">#8977</a>)</li> <li>Prefer the gRPC dial target over the resolved peer IP for the <code>server.address</code> and <code>server.port</code> attributes in <code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8904">#8904</a>)</li> <li>The detector in <code>go.opentelemetry.io/contrib/detectors/azure/azurevm</code> now also detects <code>cloud.account.id</code>, <code>cloud.availability_zone</code>, <code>azure.vm.name</code>, <code>azure.vm.size</code>, <code>azure.vm.scaleset.name</code>, and <code>azure.resource_group.name</code>, and prefers <code>osProfile.computerName</code> for <code>host.name</code> (falling back to the VM name), reconciling it with the collector-contrib Azure resource detector. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9162">#9162</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Fix Prometheus reader resource label filter configuration in <code>go.opentelemetry.io/contrib/otelconf/v0.2.0</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9062">#9062</a>)</li> <li>Apply <code>resource.detection/development.attributes.included</code> and <code>excluded</code> filtering to resource detector attributes in <code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9131">#9131</a>)</li> <li>Honor the context configured with <code>WithContext</code> when constructing resources in <code>go.opentelemetry.io/contrib/otelconf</code> and <code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9160">#9160</a>)</li> <li>Handle nil response bodies from custom <code>RoundTripper</code> implementations in <code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code> without panicking. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9184">#9184</a>)</li> <li>Fix incorrect (overestimated) sum calculation for runtime histograms in <code>go.opentelemetry.io/contrib/instrumentation/runtime</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9063">#9063</a>)</li> <li>Fix <code>Severity.UnmarshalText</code> round trip for positive <code>FATAL</code> offsets above the named range in <code>go.opentelemetry.io/contrib/processors/minsev</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9197">#9197</a>)</li> <li>Reduce binary size by fetching ConfigMaps via <code>rest.HTTPClientFor</code> instead of the Kubernetes clientset in <code>go.opentelemetry.io/contrib/detectors/aws/eks</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9284">#9284</a>)</li> <li><code>TextMapPropagator</code> in <code>go.opentelemetry.io/contrib/propagators/autoprop</code> returns the no-op propagator for empty input, matching the behavior of <code>none</code>. An unknown <code>OTEL_PROPAGATORS</code> value still returns an error with a nil propagator so <code>NewTextMapPropagator</code> falls back to the default TraceContext and Baggage propagators instead of disabling propagation. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9163">#9163</a>)</li> <li>Preserve error-valued attributes nested in a group as grouped attributes instead of silently dropping them in <code>go.opentelemetry.io/contrib/bridges/otelslog</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9238">#9238</a>)</li> <li>Fix a data race in <code>go.opentelemetry.io/contrib/bridges/otelslog</code> where concurrent <code>Handle</code> calls could corrupt each other's log attributes because <code>kvBuffer.KeyValues</code> returned a slice aliasing a shared buffer. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9229">#9229</a>)</li> <li>Avoid a panic in <code>go.opentelemetry.io/contrib/bridges/otelzap</code> when a malformed error field contains a nil or non-error value. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9068">#9068</a>)</li> <li>Use <code>azure.container_app.instance.id</code> instead of <code>service.instance.id</code> for the replica name detected by <code>go.opentelemetry.io/contrib/detectors/azure/azurecontainerapps</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9208">#9208</a>)</li> <li>Preserve the underlying metadata errors returned with partial resources from <code>go.opentelemetry.io/contrib/detectors/gcp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9069">#9069</a>)</li> <li>Copy <code>MultipartForm</code> back to the request <code>otelmux.Middleware</code> was given after the wrapped handler returns, so <code>net/http</code> can find and remove the temp files <code>ParseMultipartForm</code> created on the context-derived request copy, when <code>otelmux.Middleware</code> wraps a handler directly, in <code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code>. This does not cover a handler panic, nor the common <code>router.Use(...)</code> integration, where <code>gorilla/mux</code>'s own routing step makes an additional request copy the middleware cannot write back through; see <a href="https://redirect.github.com/gorilla/mux/pull/777">gorilla/mux#777</a>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9361">#9361</a>)</li> <li>Report the <code>b3</code> header from <code>Fields()</code> for the default <code>B3Unspecified</code> single-header injection encoding, matching what <code>Inject</code> writes, in <code>go.opentelemetry.io/contrib/propagators/b3</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9273">#9273</a>)</li> <li>Fix <code>go.opentelemetry.io/contrib/propagators/aws/xray</code> producing deterministic trace and span IDs when the seed read from <code>crypto/rand</code> silently failed, by switching to <code>math/rand/v2</code>'s concurrency-safe top-level generator. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9359">#9359</a>)</li> <li>Strip connection number suffix from connection ID in <code>go.opentelemetry.io/contrib/instrumentation/go.mongodb.org/mongo-driver/v2/mongo/otelmongo</code> to prevent unbounded metric cardinality. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9352">#9352</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/c8a87a60ba1b3374fd16df11fc3eeae6c41abbc9"><code>c8a87a6</code></a> Release v1.45.0/v2.5.2/v0.70.0/v0.37.2/v0.25.0/v0.20.0/v0.16.2/v0.17.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9413">#9413</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/cde125c563f232eb6b423a208d375f8e53ae2557"><code>cde125c</code></a> fix(deps): update aws-sdk-go-v2 monorepo (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9384">#9384</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/88572a7662d00e805777ed96932d532316c13787"><code>88572a7</code></a> chore(deps): update googleapis to 6ac0973 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9409">#9409</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/e4f511a0f3cc2b09b87cb164427b49dfd2e14f7d"><code>e4f511a</code></a> chore(deps): update github/codeql-action action to v4.37.5 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9410">#9410</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/265eb0b5fe0682801fd8177aec74ce8769c5a0a4"><code>265eb0b</code></a> fix(deps): update go.opentelemetry.io/otel digest to 48db2c6 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9317">#9317</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/941ba46979c59dca89d26040ed919870283e36e9"><code>941ba46</code></a> chore(deps): update github.com/charmbracelet/ultraviolet digest to 8b69304 (#...</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/ededd3b571ad562351a0afe09682774a6f48d63e"><code>ededd3b</code></a> chore(deps): update module github.com/lucasb-eyer/go-colorful to v1.4.1 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9406">#9406</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/7c6e819d4eb26eede10e98c424adb76304025fda"><code>7c6e819</code></a> fix(deps): update module github.com/atombender/go-jsonschema to v0.24.1 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9405">#9405</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/ec1e544a0d6883126198c3fc3a7d62fc8db29195"><code>ec1e544</code></a> chore(deps): update github.com/lufia/plan9stats digest to 341c2f0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9403">#9403</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/5d7e16aa1138a5446a648dd92ebc42031c93e327"><code>5d7e16a</code></a> chore(deps): update github.com/golangci/rowserrcheck digest to d2031e3 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9402">#9402</a>)</li> <li>Additional commits viewable in <a href="https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.69.0...zpages/v0.70.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp&package-manager=go_modules&previous-version=0.69.0&new-version=0.70.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-11 11:18:52 +00:00
dependabot[bot]	f65580a344	chore: bump google.golang.org/api from 0.291.0 to 0.292.0 (#28017 ) Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.291.0 to 0.292.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's releases</a>.</em></p> <blockquote> <h2>v0.292.0</h2> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.291.0...v0.292.0">0.292.0</a> (2026-08-04)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3682">#3682</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/b70719bb5600e7681c883946903c4e55c493c801">b70719b</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3684">#3684</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/c9bc778099e72798eef096de828fb333389f7010">c9bc778</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3685">#3685</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/8140ddf12e1a5c4a54748a94b6655818fcc480ed">8140ddf</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3687">#3687</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/57047fb96a7bd29eea0bfed36a9207389f3cafcf">57047fb</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3688">#3688</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/256abd760aedde96c6e73ecf11822ed4cb223469">256abd7</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.291.0...v0.292.0">0.292.0</a> (2026-08-04)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3682">#3682</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/b70719bb5600e7681c883946903c4e55c493c801">b70719b</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3684">#3684</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/c9bc778099e72798eef096de828fb333389f7010">c9bc778</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3685">#3685</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/8140ddf12e1a5c4a54748a94b6655818fcc480ed">8140ddf</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3687">#3687</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/57047fb96a7bd29eea0bfed36a9207389f3cafcf">57047fb</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3688">#3688</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/256abd760aedde96c6e73ecf11822ed4cb223469">256abd7</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/googleapis/google-api-go-client/commit/8631dd4e00d6b5c37ba1c260bc5efe1de0877098"><code>8631dd4</code></a> chore(main): release 0.292.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3683">#3683</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/256abd760aedde96c6e73ecf11822ed4cb223469"><code>256abd7</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3688">#3688</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/3f73f91e83152f6f7ad9f37018812c81d771d336"><code>3f73f91</code></a> chore(all): update all (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3686">#3686</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/57047fb96a7bd29eea0bfed36a9207389f3cafcf"><code>57047fb</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3687">#3687</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/8140ddf12e1a5c4a54748a94b6655818fcc480ed"><code>8140ddf</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3685">#3685</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/c9bc778099e72798eef096de828fb333389f7010"><code>c9bc778</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3684">#3684</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/b70719bb5600e7681c883946903c4e55c493c801"><code>b70719b</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3682">#3682</a>)</li> <li>See full diff in <a href="https://github.com/googleapis/google-api-go-client/compare/v0.291.0...v0.292.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/api&package-manager=go_modules&previous-version=0.291.0&new-version=0.292.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-11 11:17:17 +00:00
dependabot[bot]	8a30a7da4c	chore: bump github.com/elazarl/goproxy from 1.8.0 to 1.9.0 (#28019 ) Bumps [github.com/elazarl/goproxy](https://github.com/elazarl/goproxy) from 1.8.0 to 1.9.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/elazarl/goproxy/releases">github.com/elazarl/goproxy's releases</a>.</em></p> <blockquote> <h2>v1.9.0: HTTP/2 MITM Full Support</h2> <h2>What's Changed</h2> <ul> <li>HTTP/2 MITM Full Support by <a href="https://github.com/ErikPelli"><code>@ErikPelli</code></a> in <a href="https://redirect.github.com/elazarl/goproxy/pull/785">elazarl/goproxy#785</a></li> <li>Use Go standard library to check port by <a href="https://github.com/ErikPelli"><code>@ErikPelli</code></a> in <a href="https://redirect.github.com/elazarl/goproxy/pull/795">elazarl/goproxy#795</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/elazarl/goproxy/compare/v1.8.6...v1.9.0">https://github.com/elazarl/goproxy/compare/v1.8.6...v1.9.0</a></p> <h3>Highlights & Acknowledgements</h3> <ul> <li><strong>HTTP/2 MITM Support:</strong> This release introduces native support for inspecting and manipulating HTTP/2 traffic within GoProxy's MITM functionality. A special thanks to the team at <a href="https://github.com/LumiaSecurity"><code>@LumiaSecurity</code></a> (including <a href="https://github.com/omriza"><code>@omriza</code></a> for the review) for supporting the development of these HTTP/2 MITM features and contributing to this major enhancement. Achieving full HTTP/2 MITM capability represents a huge milestone for GoProxy, taking our library to the next level for whoever needs it. <strong>To enable it, make sure that <code>AllowHTTP2</code> is set to <code>true</code> in the proxy configuration.</strong></li> </ul> <h3>⚠️ Possible Breaking Change</h3> <ul> <li>Previously there was an incomplete implementation of HTTP/2 inside the <code>h2.go</code> file, with an exported H2Transport struct. Probably no one was using it, but if you were, be careful that in this release it has been removed to create the full HTTP/2 MITM implementation.</li> </ul> <h2>v1.8.6</h2> <h2>What's Changed</h2> <ul> <li>Fix unexpected scheme edge case in MITM by <a href="https://github.com/ErikPelli"><code>@ErikPelli</code></a> in <a href="https://redirect.github.com/elazarl/goproxy/pull/793">elazarl/goproxy#793</a></li> <li>Stream MITM response bodies by <a href="https://github.com/krissetto"><code>@krissetto</code></a> in <a href="https://redirect.github.com/elazarl/goproxy/pull/794">elazarl/goproxy#794</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/krissetto"><code>@krissetto</code></a> made their first contribution in <a href="https://redirect.github.com/elazarl/goproxy/pull/794">elazarl/goproxy#794</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/elazarl/goproxy/compare/v1.8.5...v1.8.6">https://github.com/elazarl/goproxy/compare/v1.8.5...v1.8.6</a></p> <h2>v1.8.5</h2> <h2>What's Changed</h2> <ul> <li>fix(https): coalesce the MITM response head into a single write by <a href="https://github.com/shaharfreiman"><code>@shaharfreiman</code></a> in <a href="https://redirect.github.com/elazarl/goproxy/pull/787">elazarl/goproxy#787</a></li> <li>Remove redundant certificate Leaf set starting from Go 1.23 by <a href="https://github.com/ErikPelli"><code>@ErikPelli</code></a> in <a href="https://redirect.github.com/elazarl/goproxy/pull/789">elazarl/goproxy#789</a></li> <li>Fix headers overwrite when there are no trailers by <a href="https://github.com/ErikPelli"><code>@ErikPelli</code></a> in <a href="https://redirect.github.com/elazarl/goproxy/pull/791">elazarl/goproxy#791</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/shaharfreiman"><code>@shaharfreiman</code></a> made their first contribution in <a href="https://redirect.github.com/elazarl/goproxy/pull/787">elazarl/goproxy#787</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/elazarl/goproxy/compare/v1.8.4...v1.8.5">https://github.com/elazarl/goproxy/compare/v1.8.4...v1.8.5</a></p> <h2>v1.8.4</h2> <h2>What's Changed</h2> <ul> <li>fix: don't set Transfer-Encoding: chunked on 304 responses by <a href="https://github.com/Yanhu007"><code>@Yanhu007</code></a> in <a href="https://redirect.github.com/elazarl/goproxy/pull/770">elazarl/goproxy#770</a></li> <li>docs: add missing godoc comments to exported symbols by <a href="https://github.com/scovl"><code>@scovl</code></a> in <a href="https://redirect.github.com/elazarl/goproxy/pull/768">elazarl/goproxy#768</a></li> <li>http: forward upstream response trailers by <a href="https://github.com/0b01"><code>@0b01</code></a> in <a href="https://redirect.github.com/elazarl/goproxy/pull/773">elazarl/goproxy#773</a></li> <li>Remove insecure skip verify from origin transport by <a href="https://github.com/ErikPelli"><code>@ErikPelli</code></a> in <a href="https://redirect.github.com/elazarl/goproxy/pull/774">elazarl/goproxy#774</a></li> <li>Avoid chunked response when there is http.NoBody by <a href="https://github.com/ErikPelli"><code>@ErikPelli</code></a> in <a href="https://redirect.github.com/elazarl/goproxy/pull/776">elazarl/goproxy#776</a></li> <li>fix(https): close client connection when target connection errors by <a href="https://github.com/wucm667"><code>@wucm667</code></a> in <a href="https://redirect.github.com/elazarl/goproxy/pull/779">elazarl/goproxy#779</a></li> <li>fix: restore examples module health and clarify sample apps by <a href="https://github.com/Thiago-Tertuliano"><code>@Thiago-Tertuliano</code></a> in <a href="https://redirect.github.com/elazarl/goproxy/pull/780">elazarl/goproxy#780</a></li> <li>fix: append headers instead of overwriting when keepDestHeaders is true by <a href="https://github.com/Yanhu007"><code>@Yanhu007</code></a> in <a href="https://redirect.github.com/elazarl/goproxy/pull/771">elazarl/goproxy#771</a></li> </ul> <h2>New Contributors</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/elazarl/goproxy/commit/6225cd309d7c0e201659f1e00086b12fdae62df2"><code>6225cd3</code></a> Use Go standard library to check port (<a href="https://redirect.github.com/elazarl/goproxy/issues/795">#795</a>)</li> <li><a href="https://github.com/elazarl/goproxy/commit/5e4406819eb880480bfe8be39e5c06c161e96ad5"><code>5e44068</code></a> HTTP/2 MITM Full Support (<a href="https://redirect.github.com/elazarl/goproxy/issues/785">#785</a>)</li> <li><a href="https://github.com/elazarl/goproxy/commit/a4bf4321f461a060a8c55d371ae3cfa747d561d5"><code>a4bf432</code></a> Stream MITM response bodies (<a href="https://redirect.github.com/elazarl/goproxy/issues/794">#794</a>)</li> <li><a href="https://github.com/elazarl/goproxy/commit/3f0ac0b322e30aff226ea2ce9f4114c7a5585ff4"><code>3f0ac0b</code></a> Fix unexpected scheme edge case in MITM (<a href="https://redirect.github.com/elazarl/goproxy/issues/793">#793</a>)</li> <li><a href="https://github.com/elazarl/goproxy/commit/d435b12bc2fd1ecae5c03a39fdd452a43e36be00"><code>d435b12</code></a> Fix headers overwrite when there are no trailers (<a href="https://redirect.github.com/elazarl/goproxy/issues/791">#791</a>)</li> <li><a href="https://github.com/elazarl/goproxy/commit/54976310a7923a7526777f9eb0a3fc0f4d625ffc"><code>5497631</code></a> Remove redundant certificate Leaf set starting from Go 1.23 (<a href="https://redirect.github.com/elazarl/goproxy/issues/789">#789</a>)</li> <li><a href="https://github.com/elazarl/goproxy/commit/5ba11e8846d7c139c0404fcc47099ef8dc7375c2"><code>5ba11e8</code></a> fix(https): coalesce the MITM response head into a single write (<a href="https://redirect.github.com/elazarl/goproxy/issues/787">#787</a>)</li> <li><a href="https://github.com/elazarl/goproxy/commit/636207d4c044d260140a1f7a6f13efb609dbadc0"><code>636207d</code></a> fix: append headers instead of overwriting when keepDestHeaders is true (<a href="https://redirect.github.com/elazarl/goproxy/issues/771">#771</a>)</li> <li><a href="https://github.com/elazarl/goproxy/commit/6584eeeb52783bbb3ef0ca44c6edc3241e65bc9d"><code>6584eee</code></a> fix: restore examples module health and clarify sample apps (<a href="https://redirect.github.com/elazarl/goproxy/issues/780">#780</a>)</li> <li><a href="https://github.com/elazarl/goproxy/commit/038e3b90031f25eead7d60a7db162de131321fe7"><code>038e3b9</code></a> fix(https): close client connection when target connection errors (<a href="https://redirect.github.com/elazarl/goproxy/issues/779">#779</a>)</li> <li>Additional commits viewable in <a href="https://github.com/elazarl/goproxy/compare/v1.8.0...v1.9.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/elazarl/goproxy&package-manager=go_modules&previous-version=1.8.0&new-version=1.9.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-11 11:14:42 +00:00
Michael Suchacz	c97f4da3ac	chore: sync fantasy fork with upstream v0.40.0 and openai-go with v3.50.0 (#27981 ) Our fantasy fork had drifted far behind upstream charmbracelet/fantasy (base v0.31.0 vs current v0.40.0). This PR updates the pinned forks after reconciling which fork hacks upstream has fixed and which we still need, and adapts this repo to the new APIs. ## Fork updates - `charm.land/fantasy` -> [coder/fantasy#51](https://github.com/coder/fantasy/pull/51) (merged): `coder_2_33` synced with upstream v0.40.0, pinned at the merge commit `bb10946892ef`. - `github.com/openai/openai-go/v3` -> [coder/openai-go#10](https://github.com/coder/openai-go/pull/10) (merged): `coder/pinned` rebased from v3.16.0 onto upstream v3.50.0 (required by upstream fantasy), pinned at the merge commit `92b5addb22d2`. - `coder/anthropic-sdk-go` pin unchanged; the fantasy fork now tracks the same revision this repo ships. ## Hack reconciliation summary Dropped from our fantasy diff (upstream now has equivalents, often stricter): truncated-stream fail-closed detection, Anthropic EffortXHigh / computer use / thinking effort / thinking display, replay fidelity for signed reasoning and web_search errors, PDF and text documents with sanitized filename titles, refusal finish-reason mapping (upstream also maps Bedrock `content_filtered`/`guardrail_intervened`), gpt-5.5/5.6 Responses routing, the Go 1.25 downgrade, and the openai-go SSE decoder and appendCompact patches. Still fork-only and preserved: OpenAI computer use, OpenAI Responses replay continuity validation, Anthropic pre-4.6 budget-thinking conversion plus explicit thinking disable for effort none, Anthropic RefusalMetadata parsing, Bedrock cross-region inference profile region mirroring, and openai-go deferred body serialization with the WithJSONSet fix. Picked up new upstream features: stream transport retry with in-band SSE error classification, Bedrock expired-credential refresh, per-message cache markers for OpenAI-compatible models, tool panic recovery, extra usage fields in provider metadata, and ClientMetadata on tool results. ## Changes in this repo - `aibridge/intercept/responses`: `ResponseOutputItemUnion.Arguments` became a union type in openai-go v3.50; read function-call arguments via `.OfString` (plus test literal updates). - `coderd/x/chatd/chatdebug`: register the new fantasy `Call.Headers`, `ObjectCall.Headers`, and `ToolResultPart.ClientMetadata` fields in the normalization coverage map (all skipped). - `aibridge/internal/integrationtest`: make the RST test listener drain the request before resetting the connection. The new SDK's write path exposed the previous 1-byte-read race as sporadic `use of closed network connection` failures; the fix holds over 40 consecutive runs. - `go.mod`: rewrite the fork provenance comments to describe the post-sync state. ## Validation - `go build ./...` and `go vet ./...` clean (vet findings identical to base). - Fresh (`-count=1`) runs of `./coderd/x/chatd/...`, `./aibridge/...`, `./coderd/aibridged/...`, `./coderd/database/db2sdk/`: 37 packages pass. - `TestClientAndConnectionError` stress-tested 40x clean. - Both fork PRs have green CI. > Mux acted on Mike's behalf to create this PR.	2026-08-11 11:20:05 +02:00
dependabot[bot]	1e578a69a4	chore: bump github.com/go-git/go-git/v5 from 5.19.1 to 5.19.2 (#27950 ) Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.19.1 to 5.19.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-git/go-git/releases">github.com/go-git/go-git/v5's releases</a>.</em></p> <blockquote> <h2>v5.19.2</h2> <h2>What's Changed</h2> <ul> <li>build: Update module golang.org/x/crypto to v0.52.0 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/2150">go-git/go-git#2150</a></li> <li>build: Update module github.com/go-git/go-git/v5 to v5.19.1 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/2141">go-git/go-git#2141</a></li> <li>build: Update module golang.org/x/net to v0.55.0 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/2152">go-git/go-git#2152</a></li> <li>git: Worktree: Add stores index entires with backslashes on Windows by <a href="https://github.com/joshblum"><code>@joshblum</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2262">go-git/go-git#2262</a></li> <li>storage: dotgit, reject path traversal in reference names by <a href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2254">go-git/go-git#2254</a></li> <li>build: Update module golang.org/x/net to v0.56.0 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/2267">go-git/go-git#2267</a></li> <li>build: Update module golang.org/x/text to v0.39.0 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/2268">go-git/go-git#2268</a></li> <li>[v5] git: worktree, make the filesystem wrapper a symlink-safe boundary by <a href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2277">go-git/go-git#2277</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.19.1...v5.19.2">https://github.com/go-git/go-git/compare/v5.19.1...v5.19.2</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-git/go-git/commit/3eeb238da61eb9c7a324f3ee04f990ce89175642"><code>3eeb238</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2277">#2277</a> from go-git/checkout-v5</li> <li><a href="https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab"><code>008a78f</code></a> git: worktree, make the filesystem wrapper a symlink-safe boundary</li> <li><a href="https://github.com/go-git/go-git/commit/2263fb5f022dde90b1c2845f028d3e37e161f2b8"><code>2263fb5</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2268">#2268</a> from go-git/renovate/releases/v5.x-go-golang.org-x-t...</li> <li><a href="https://github.com/go-git/go-git/commit/77b76250d93ec83e2c897638d8a3847b1bfaa38d"><code>77b7625</code></a> build: Update module golang.org/x/text to v0.39.0 [SECURITY]</li> <li><a href="https://github.com/go-git/go-git/commit/85ea767be2b2281693e61afe83911e12c86d6eb7"><code>85ea767</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2267">#2267</a> from go-git/renovate/releases/v5.x-go-golang.org-x-n...</li> <li><a href="https://github.com/go-git/go-git/commit/198675a07b3b8f4eb8f51bf188663a13bb0d9e1a"><code>198675a</code></a> build: Update module golang.org/x/net to v0.56.0 [SECURITY]</li> <li><a href="https://github.com/go-git/go-git/commit/4a0e66d555de5f9a30c31e2df64f445f42bd01e7"><code>4a0e66d</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2254">#2254</a> from pjbgf/v5-dotgit-ref-name-containment</li> <li><a href="https://github.com/go-git/go-git/commit/3b306ef83bd05194a30ce820eed7ed61c3084b5f"><code>3b306ef</code></a> storage: dotgit, align reference-name safety with refname_is_safe</li> <li><a href="https://github.com/go-git/go-git/commit/f3d0cc150b39ae1dc47406a5c170464286914610"><code>f3d0cc1</code></a> storage: dotgit, reject path traversal in reference names</li> <li><a href="https://github.com/go-git/go-git/commit/979cfe9c561d3ced778c88d9cde6db3297e6ed1d"><code>979cfe9</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2262">#2262</a> from joshblum/joshblum/to-slash-v5</li> <li>Additional commits viewable in <a href="https://github.com/go-git/go-git/compare/v5.19.1...v5.19.2">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-git/go-git/v5&package-manager=go_modules&previous-version=5.19.1&new-version=5.19.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/coder/coder/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-09 07:42:17 +00:00
dependabot[bot]	fbc5ed4674	chore: bump google.golang.org/grpc from 1.82.1 to 1.83.0 (#27833 ) Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.82.1 to 1.83.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/grpc/grpc-go/releases">google.golang.org/grpc's releases</a>.</em></p> <blockquote> <h2>Release 1.83.0</h2> <h1>Security</h1> <ul> <li>server: Stop reading from connections when flooded by HTTP/2 frames to mitigate resource exhaustion. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable <code>GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT</code>.</li> <li>xds/rbac: Support <code>Metadata</code> and <code>RequestedServerName</code> permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.</li> <li>xds/rbac: Fix panic when parsing unsupported fields in <code>NotRule</code>/<code>NotId</code> permissions.</li> <li>xds/rbac: Support the deprecated <code>source_ip</code> principal identifier by treating it as equivalent to <code>direct_remote_ip</code>.</li> <li>xds: Fix panic when parsing route header matchers configured with empty <code>exact_match</code>, <code>prefix_match</code>, or <code>suffix_match</code> strings. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9223">#9223</a>)</li> </ul> <h1>New Features</h1> <ul> <li>xds/googlec2p: Enable DirectPath over Interconnect support for on-premises clients via the <code>force-xds</code> target URI query parameter. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9133">#9133</a>)</li> <li>xds: Enable xDS configuration to control which fields get propagated from ORCA backend metric reports to LRS load reports. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9145">#9145</a>)</li> <li>authz: Add <code>OnPolicyUpdate</code> callback to <code>FileWatcherOptions</code> to notify when an authz policy is loaded or updated. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9142">#9142</a>) <ul> <li>Special Thanks: <a href="https://github.com/hnefatl"><code>@hnefatl</code></a></li> </ul> </li> <li>xds: Add support for the GCP Authentication HTTP Filter, which automatically fetches and attaches GCP Service Account Identity JWT tokens to outgoing RPCs. <ul> <li>This feature can be enabled by setting environment variable <code>GRPC_EXPERIMENTAL_XDS_GCP_AUTHENTICATION_FILTER=true</code>. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9119">#9119</a>)</li> </ul> </li> <li>xds: Add support for xDS-based HTTP CONNECT proxies. <ul> <li>This feature can be enabled by setting environment variable <code>GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT=true</code>. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9151">#9151</a>)</li> </ul> </li> <li>xds: Add support for <code>contains_match</code> in route header matchers. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9223">#9223</a>)</li> </ul> <h1>Bug Fixes</h1> <ul> <li>credentials/alts: Fix panic when processing malformed frames by validating that the message frame length exceeds the message type field size. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9197">#9197</a>)</li> <li>grpc: Fix compilation on Plan 9 targets (<code>GOOS=plan9</code>), broken since v1.81.0. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9255">#9255</a>) <ul> <li>Special Thanks: <a href="https://github.com/Yusufihsangorgel"><code>@Yusufihsangorgel</code></a></li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/grpc/grpc-go/commit/4c226daff88f54441d70f710815e07b81fb162b2"><code>4c226da</code></a> Change version to 1.83.0 (<a href="https://redirect.github.com/grpc/grpc-go/issues/9228">#9228</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/c198988aa9297cb9428c7afaaee4363d0082b838"><code>c198988</code></a> Cherrypick 9223 into v1.83.x (<a href="https://redirect.github.com/grpc/grpc-go/issues/9279">#9279</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/8ce3ebf24af3c206bacf279adcf9c3a88981df68"><code>8ce3ebf</code></a> Cherrypick PR 9255 into v1.83.x (<a href="https://redirect.github.com/grpc/grpc-go/issues/9263">#9263</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/e39384978cf59c70634f900a7aa93d7483886696"><code>e393849</code></a> Cherry-pick recent changes from master (<a href="https://redirect.github.com/grpc/grpc-go/issues/9240">#9240</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/2a112a82f5c53ab3b89b5aa4a02b4195e2706879"><code>2a112a8</code></a> authz: add onPolicyUpdate callback to authz file watcher (<a href="https://redirect.github.com/grpc/grpc-go/issues/9142">#9142</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/1a80fca960d39ae4d7d6f2d9323ca2d243fd44bb"><code>1a80fca</code></a> vet: adds a check to disallow usage of regex.Compile in xDS code (<a href="https://redirect.github.com/grpc/grpc-go/issues/9216">#9216</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/26ffdb33175d6fb4e56bcb598fb1a56162397091"><code>26ffdb3</code></a> [tls] Add safety check in custom cert verification that peer cert chain is no...</li> <li><a href="https://github.com/grpc/grpc-go/commit/50139749cb5bc50dd672689549340fceac494c1b"><code>5013974</code></a> internal/grpcsync: add ScheduleAndWait to CallbackSerializer (<a href="https://redirect.github.com/grpc/grpc-go/issues/9162">#9162</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/bd58bc07c4bc552859f758594a6605b5b27cd041"><code>bd58bc0</code></a> internal/transport: increase test timeout locally in TestAccountCheckWindowSi...</li> <li><a href="https://github.com/grpc/grpc-go/commit/484f1502aea22dbf8dc54df9aff26214b9c35e1a"><code>484f150</code></a> httpfilter/extproc: add check to ensure that response trailer mode must be SE...</li> <li>Additional commits viewable in <a href="https://github.com/grpc/grpc-go/compare/v1.82.1...v1.83.0">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-04 11:33:37 +00:00
dependabot[bot]	f4ad3549bc	chore: bump github.com/open-policy-agent/opa from 1.18.1 to 1.19.0 (#27832 ) Bumps [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) from 1.18.1 to 1.19.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/open-policy-agent/opa/releases">github.com/open-policy-agent/opa's releases</a>.</em></p> <blockquote> <h2>v1.19.0</h2> <p>This release contains a mix of new features and bug fixes. Notably:</p> <ul> <li>A fixed SQL injection vector in the Compile API</li> <li>Stricter safety checking for Rego assignments (<code>:=</code>)</li> <li>A cgo-free, faster WebAssembly runtime (wazero replaces wasmtime-go)</li> <li>Startup warnings for unknown configuration options</li> <li>A new <code>strings.split_n</code> built-in function</li> <li>A REPL line reader that handles pasted input correctly, migrating existing history files</li> </ul> <h3>Fix SQL injection vector in Compile API: Quote SQL filter field identifiers (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8945">#8945</a>)</h3> <p>The field names in the SQL emitted by the Compile API come from partially evaluated refs, so a policy that selects a dynamic key — such as <code>input.fruits[input.column]</code> — puts caller-controlled text in an identifier position. That text was emitted verbatim, which turns</p> <pre lang="sql"><code>WHERE fruit.name = 'allowed' </code></pre> <p>into</p> <pre lang="sql"><code>WHERE fruit.name = 'allowed' OR 1=1 -- = 'allowed' </code></pre> <p>and an application appending the filter to its query returns rows the policy denies.</p> <p>Field segments that are not bare identifiers are now quoted at the UCAST-to-SQL boundary, with any embedded quote character escaped. Ordinary column names stay unquoted, so existing filters keep their current shape and remain case-insensitive on Postgres.</p> <p>Authored by <a href="https://github.com/thevilledev"><code>@thevilledev</code></a></p> <h3>Behavior change: stricter safety for assignment (<code>:=</code>) (<a href="https://redirect.github.com/open-policy-agent/opa/issues/3546">#3546</a>)</h3> <p>The assignment operator (<code>:=</code>) is documented as "syntactic sugar for <code>=</code>, local variable creation, and additional compiler checks," and the safety checker reflects that: after rewriting, <code>:=</code> is treated identically to <code>=</code> (unification), so an assignment's right-hand side can be made safe by unifying "backwards" through the left-hand side. This means policies like <code>x := y; x = 7</code> compile (binding <code>y</code> to <code>7</code>) even though <code>y</code> is never assigned, and <code>x := y; obj[x]</code> can silently degrade an expected constant-time lookup into full iteration.</p> <p>This change makes the right-hand-side of <code>:=</code> be treated as a read that must be made safe by other expressions, and can no longer be satisfied through the left-hand-side. Affected policies that previously compiled now fail with a <code>rego_unsafe_var_error</code>. Reference iteration on the right-hand-side (e.g. <code>some k; v := obj[k]</code>) is unaffected.</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md">github.com/open-policy-agent/opa's changelog</a>.</em></p> <blockquote> <h2>1.19.0</h2> <p>This release contains a mix of new features and bug fixes. Notably:</p> <ul> <li>A fixed SQL injection vector in the Compile API</li> <li>Stricter safety checking for Rego assignments (<code>:=</code>)</li> <li>A cgo-free, faster WebAssembly runtime (wazero replaces wasmtime-go)</li> <li>Startup warnings for unknown configuration options</li> <li>A new <code>strings.split_n</code> built-in function</li> <li>A REPL line reader that handles pasted input correctly, migrating existing history files</li> </ul> <h3>Fix SQL injection vector in Compile API: Quote SQL filter field identifiers (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8945">#8945</a>)</h3> <p>The field names in the SQL emitted by the Compile API come from partially evaluated refs, so a policy that selects a dynamic key — such as <code>input.fruits[input.column]</code> — puts caller-controlled text in an identifier position. That text was emitted verbatim, which turns</p> <pre lang="sql"><code>WHERE fruit.name = 'allowed' </code></pre> <p>into</p> <pre lang="sql"><code>WHERE fruit.name = 'allowed' OR 1=1 -- = 'allowed' </code></pre> <p>and an application appending the filter to its query returns rows the policy denies.</p> <p>Field segments that are not bare identifiers are now quoted at the UCAST-to-SQL boundary, with any embedded quote character escaped. Ordinary column names stay unquoted, so existing filters keep their current shape and remain case-insensitive on Postgres.</p> <p>Authored by <a href="https://github.com/thevilledev"><code>@thevilledev</code></a></p> <h3>Behavior change: stricter safety for assignment (<code>:=</code>) (<a href="https://redirect.github.com/open-policy-agent/opa/issues/3546">#3546</a>)</h3> <p>The assignment operator (<code>:=</code>) is documented as "syntactic sugar for <code>=</code>, local variable creation, and additional compiler checks," and the safety checker reflects that: after rewriting, <code>:=</code> is treated identically to <code>=</code> (unification), so an assignment's right-hand side can be made safe by unifying "backwards" through the left-hand side. This means policies like <code>x := y; x = 7</code> compile (binding <code>y</code> to <code>7</code>) even though <code>y</code> is never assigned, and <code>x := y; obj[x]</code> can silently degrade an expected constant-time lookup into full iteration.</p> <p>This change makes the right-hand-side of <code>:=</code> be treated as a read that must be made safe by other expressions, and can no longer be satisfied through the left-hand-side. Affected policies that previously compiled now fail with a <code>rego_unsafe_var_error</code>. Reference iteration on the right-hand-side (e.g. <code>some k; v := obj[k]</code>) is unaffected.</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/open-policy-agent/opa/commit/1e32c796e8979b1bda2f768138500b1deb95ff24"><code>1e32c79</code></a> Prepare v1.19.0 release (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8955">#8955</a>)</li> <li><a href="https://github.com/open-policy-agent/opa/commit/db035b09fc8b4b7f1b37558c4fde033209e17cc8"><code>db035b0</code></a> Add support for Go 1.27 & jsonv2 (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8947">#8947</a>)</li> <li><a href="https://github.com/open-policy-agent/opa/commit/27fe5ceac871d020e10dd4a92d4eb6fa7070400a"><code>27fe5ce</code></a> ast: Fix leaky <code>future.keywords.not</code> import in Rego v0 (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8953">#8953</a>)</li> <li><a href="https://github.com/open-policy-agent/opa/commit/ab2187089a8dea0d7f1ea611fe8f62db874498b7"><code>ab21870</code></a> format: Keep rule body inline when the head spans multiple lines (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8904">#8904</a>)</li> <li><a href="https://github.com/open-policy-agent/opa/commit/95090fa4eb7a8afe2d7a08742086be0344e9e065"><code>95090fa</code></a> Add strings.split_n built-in function (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8915">#8915</a>)</li> <li><a href="https://github.com/open-policy-agent/opa/commit/12a86ed2a70384eb24754d7be115c90f98736011"><code>12a86ed</code></a> build(deps): bump find-my-way and prisma in /e2e/api/compile/prisma</li> <li><a href="https://github.com/open-policy-agent/opa/commit/18815e2b02711650be1c55148e67de5b4e614a6f"><code>18815e2</code></a> build(deps): bump the dependencies group across 2 directories with 5 updates</li> <li><a href="https://github.com/open-policy-agent/opa/commit/f1e2ac07e4ad18be65495451ba648a85af0e583b"><code>f1e2ac0</code></a> build(deps): bump postcss from 8.5.15 to 8.5.23 in /docs</li> <li><a href="https://github.com/open-policy-agent/opa/commit/d9c7856eaea45ed0ee8c3709d8ef0151b17ba43c"><code>d9c7856</code></a> build(deps): bump js-yaml from 5.2.1 to 5.2.2 in /docs</li> <li><a href="https://github.com/open-policy-agent/opa/commit/69d2cc04a0de02892e4bad95cc416b9baa9a0b3b"><code>69d2cc0</code></a> tester: make Result JSON round-trippable (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8946">#8946</a>)</li> <li>Additional commits viewable in <a href="https://github.com/open-policy-agent/opa/compare/v1.18.1...v1.19.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/open-policy-agent/opa&package-manager=go_modules&previous-version=1.18.1&new-version=1.19.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-04 11:19:39 +00:00
dependabot[bot]	f483e89062	chore: bump google.golang.org/api from 0.290.0 to 0.291.0 (#27834 ) Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.290.0 to 0.291.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's releases</a>.</em></p> <blockquote> <h2>v0.291.0</h2> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.290.0...v0.291.0">0.291.0</a> (2026-07-28)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3666">#3666</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/e3721ba5d733583d6999df8e179fd7c9d891c0a9">e3721ba</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3670">#3670</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/40673741ea906e5313a602459110dcfb17a54f7d">4067374</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3674">#3674</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/432658c5a9051b867b016979d6d948cdae99a401">432658c</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3676">#3676</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/9998a114c63f1c113fb627e30597b02dee6301d5">9998a11</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3678">#3678</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/b5c5526a1d862e21cf126b2287490e63ac52ee2c">b5c5526</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3679">#3679</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/499d9b17067ababff6992f1a0c50f8de794cff45">499d9b1</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li><strong>transport:</strong> Use ds.GetUniverseDomain() instead of raw ds.UniverseDomain field (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3660">#3660</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/6bad35801f85c9915d8ad7635225a2b94e27082c">6bad358</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.290.0...v0.291.0">0.291.0</a> (2026-07-28)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3666">#3666</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/e3721ba5d733583d6999df8e179fd7c9d891c0a9">e3721ba</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3670">#3670</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/40673741ea906e5313a602459110dcfb17a54f7d">4067374</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3674">#3674</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/432658c5a9051b867b016979d6d948cdae99a401">432658c</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3676">#3676</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/9998a114c63f1c113fb627e30597b02dee6301d5">9998a11</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3678">#3678</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/b5c5526a1d862e21cf126b2287490e63ac52ee2c">b5c5526</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3679">#3679</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/499d9b17067ababff6992f1a0c50f8de794cff45">499d9b1</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li><strong>transport:</strong> Use ds.GetUniverseDomain() instead of raw ds.UniverseDomain field (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3660">#3660</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/6bad35801f85c9915d8ad7635225a2b94e27082c">6bad358</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/googleapis/google-api-go-client/commit/ed60cb7d6d725a32ae5cf00674b8647a5201a461"><code>ed60cb7</code></a> chore(main): release 0.291.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3669">#3669</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/90fe3d7d729c8ed02316aa1c673672aadc574e62"><code>90fe3d7</code></a> revert change to TestNewClient (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3680">#3680</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/499d9b17067ababff6992f1a0c50f8de794cff45"><code>499d9b1</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3679">#3679</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/452691c14c509600ef60c5dff4c1b4fd4ef79f4b"><code>452691c</code></a> chore(all): update all (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3677">#3677</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/b5c5526a1d862e21cf126b2287490e63ac52ee2c"><code>b5c5526</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3678">#3678</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/9998a114c63f1c113fb627e30597b02dee6301d5"><code>9998a11</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3676">#3676</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/432658c5a9051b867b016979d6d948cdae99a401"><code>432658c</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3674">#3674</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/40673741ea906e5313a602459110dcfb17a54f7d"><code>4067374</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3670">#3670</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/6bad35801f85c9915d8ad7635225a2b94e27082c"><code>6bad358</code></a> fix(transport): use ds.GetUniverseDomain() instead of raw ds.UniverseDomain f...</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/e3721ba5d733583d6999df8e179fd7c9d891c0a9"><code>e3721ba</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3666">#3666</a>)</li> <li>See full diff in <a href="https://github.com/googleapis/google-api-go-client/compare/v0.290.0...v0.291.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/api&package-manager=go_modules&previous-version=0.290.0&new-version=0.291.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-04 11:18:39 +00:00
dependabot[bot]	f5e0519180	chore: bump github.com/aws/aws-sdk-go-v2/service/sts from 1.44.0 to 1.45.3 (#27831 ) Bumps [github.com/aws/aws-sdk-go-v2/service/sts](https://github.com/aws/aws-sdk-go-v2) from 1.44.0 to 1.45.3. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/4aeeb0d7a4293f0b31c2e0be83e65da6f7fd4ae2"><code>4aeeb0d</code></a> Release 2023-11-28.2</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/e09e153704d4da6ae2bb0ae3875058950d31206b"><code>e09e153</code></a> Regenerated Clients</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/8293e2ca285a7333a9931a0a3b37b2bcf7cdc05d"><code>8293e2c</code></a> Update endpoints model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/713fb0f31a188015915d785556ebf16ddb08085a"><code>713fb0f</code></a> Update API model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/830202d722c904c7e3da40e8dde7b9338d08752c"><code>830202d</code></a> Merge customizations for service s3</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/2de0027dc478a6ae80e9f2d24d904a425169a23b"><code>2de0027</code></a> Release 2023-11-28</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/f0c890c5eaf354ff23feb727ded9f50aaee9f1c4"><code>f0c890c</code></a> Regenerated Clients</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/e032d9ea8d98d366f2467a72834d2cc0ee865edd"><code>e032d9e</code></a> Update endpoints model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/507661ff1edbc896fbdfe3ea2e4c2e74be3b4e3c"><code>507661f</code></a> Update API model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/4128360684a451476e33c0f979921bc46ff63656"><code>4128360</code></a> fix: respect functional option modifications to RetryMaxAttempts (<a href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/2390">#2390</a>)</li> <li>Additional commits viewable in <a href="https://github.com/aws/aws-sdk-go-v2/compare/service/s3/v1.44.0...service/iot/v1.45.3">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/aws/aws-sdk-go-v2/service/sts&package-manager=go_modules&previous-version=1.44.0&new-version=1.45.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-04 11:18:08 +00:00
dependabot[bot]	2dc850d085	chore: bump github.com/valyala/fasthttp from 1.72.0 to 1.73.0 (#27575 ) Bumps [github.com/valyala/fasthttp](https://github.com/valyala/fasthttp) from 1.72.0 to 1.73.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/valyala/fasthttp/releases">github.com/valyala/fasthttp's releases</a>.</em></p> <blockquote> <h2>v1.73.0</h2> <h2>What's Changed</h2> <ul> <li>test: fix host comparison in FuzzURIParse by <a href="https://github.com/ReneWerner87"><code>@ReneWerner87</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2313">valyala/fasthttp#2313</a></li> <li>perf: avoid redundant scans when parsing request headers by <a href="https://github.com/ReneWerner87"><code>@ReneWerner87</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2312">valyala/fasthttp#2312</a></li> <li>Fix temp file leak in SaveMultipartFile on cross-device rename failure by <a href="https://github.com/itxaiohanglover"><code>@itxaiohanglover</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2311">valyala/fasthttp#2311</a></li> <li>re-enable forcetypeassert by <a href="https://github.com/Harshal96"><code>@Harshal96</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2316">valyala/fasthttp#2316</a></li> <li>test: normalize Go test names by <a href="https://github.com/Harshal96"><code>@Harshal96</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2317">valyala/fasthttp#2317</a></li> <li>feat: prefix sentinel error strings by <a href="https://github.com/Harshal96"><code>@Harshal96</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2319">valyala/fasthttp#2319</a></li> <li>fix(pprofhandler): use exact path matching to prevent debug data exposure by <a href="https://github.com/xbrxr03"><code>@xbrxr03</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2302">valyala/fasthttp#2302</a></li> <li>avoid following a symlink when writing the FS compressed cache by <a href="https://github.com/alhudz"><code>@alhudz</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2321">valyala/fasthttp#2321</a></li> <li>refactor: improve internal interface names by <a href="https://github.com/Harshal96"><code>@Harshal96</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2318">valyala/fasthttp#2318</a></li> <li>fix: lowercase error strings by <a href="https://github.com/Harshal96"><code>@Harshal96</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2320">valyala/fasthttp#2320</a></li> <li>perf: reduce redundant scans and allocations in hot paths by <a href="https://github.com/ReneWerner87"><code>@ReneWerner87</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2322">valyala/fasthttp#2322</a></li> <li>validate domain and path cookie attribute values on parse by <a href="https://github.com/alhudz"><code>@alhudz</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2315">valyala/fasthttp#2315</a></li> <li>chore(deps): bump securego/gosec from 2.27.1 to 2.28.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2328">valyala/fasthttp#2328</a></li> <li>chore(deps): bump actions/setup-go from 6 to 7 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2329">valyala/fasthttp#2329</a></li> <li>fix: preserve pre-set status code in NewFastHTTPHandler by <a href="https://github.com/xbrxr03"><code>@xbrxr03</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2323">valyala/fasthttp#2323</a></li> <li>chore(deps): bump github.com/klauspost/compress from 1.19.0 to 1.19.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2331">valyala/fasthttp#2331</a></li> <li>reject backslash '..' traversal in fs handler on windows by <a href="https://github.com/alhudz"><code>@alhudz</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2327">valyala/fasthttp#2327</a></li> <li>fix: reject Windows alternate data stream paths in FS by <a href="https://github.com/dev-willbird1936"><code>@dev-willbird1936</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2335">valyala/fasthttp#2335</a></li> <li>chore(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2307">valyala/fasthttp#2307</a></li> <li>chore(deps): bump github.com/andybalholm/brotli from 1.2.1 to 1.2.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2308">valyala/fasthttp#2308</a></li> <li>chore(deps): bump github.com/klauspost/compress from 1.18.6 to 1.18.7 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2309">valyala/fasthttp#2309</a></li> <li>chore(deps): bump github.com/klauspost/compress from 1.18.7 to 1.19.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2314">valyala/fasthttp#2314</a></li> <li>chore(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2326">valyala/fasthttp#2326</a></li> <li>chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2324">valyala/fasthttp#2324</a></li> <li>chore(deps): bump golang.org/x/net from 0.56.0 to 0.57.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2325">valyala/fasthttp#2325</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/itxaiohanglover"><code>@itxaiohanglover</code></a> made their first contribution in <a href="https://redirect.github.com/valyala/fasthttp/pull/2311">valyala/fasthttp#2311</a></li> <li><a href="https://github.com/Harshal96"><code>@Harshal96</code></a> made their first contribution in <a href="https://redirect.github.com/valyala/fasthttp/pull/2316">valyala/fasthttp#2316</a></li> <li><a href="https://github.com/dev-willbird1936"><code>@dev-willbird1936</code></a> made their first contribution in <a href="https://redirect.github.com/valyala/fasthttp/pull/2335">valyala/fasthttp#2335</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/valyala/fasthttp/compare/v1.72.0...v1.73.0">https://github.com/valyala/fasthttp/compare/v1.72.0...v1.73.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/valyala/fasthttp/commit/f83ac8c3560feccaa017ba86dd9b95ad004790f2"><code>f83ac8c</code></a> Optimize bounds checks in hot paths</li> <li><a href="https://github.com/valyala/fasthttp/commit/d9babd95c5f3d26ff26cfc528ca77f165df2f95f"><code>d9babd9</code></a> fix: reject Windows alternate data stream paths in FS (<a href="https://redirect.github.com/valyala/fasthttp/issues/2335">#2335</a>)</li> <li><a href="https://github.com/valyala/fasthttp/commit/e7cf856857a46388b9e03507b8d4b6d5bc3d69dd"><code>e7cf856</code></a> reject backslash '..' traversal in fs handler on windows (<a href="https://redirect.github.com/valyala/fasthttp/issues/2327">#2327</a>)</li> <li><a href="https://github.com/valyala/fasthttp/commit/165a4c81aada474f8566a66a5d4c2dee35fee37e"><code>165a4c8</code></a> Improve AppendUnquotedArg with optimised bounds check</li> <li><a href="https://github.com/valyala/fasthttp/commit/7a1349da70685cce500515263c20ec389f8f69e1"><code>7a1349d</code></a> chore(deps): bump github.com/klauspost/compress from 1.19.0 to 1.19.1 (<a href="https://redirect.github.com/valyala/fasthttp/issues/2331">#2331</a>)</li> <li><a href="https://github.com/valyala/fasthttp/commit/f1ad91d51977febd2730b9e0d79c7d241c5e430c"><code>f1ad91d</code></a> fix: preserve pre-set status code in NewFastHTTPHandler (<a href="https://redirect.github.com/valyala/fasthttp/issues/2323">#2323</a>)</li> <li><a href="https://github.com/valyala/fasthttp/commit/5f57d8fda4c2c9e3092f82e13f589a92ed48d347"><code>5f57d8f</code></a> chore(deps): bump actions/setup-go from 6 to 7 (<a href="https://redirect.github.com/valyala/fasthttp/issues/2329">#2329</a>)</li> <li><a href="https://github.com/valyala/fasthttp/commit/3aa940dfd248799878cd9ef46f6dfcec89a37f8d"><code>3aa940d</code></a> chore(deps): bump securego/gosec from 2.27.1 to 2.28.0 (<a href="https://redirect.github.com/valyala/fasthttp/issues/2328">#2328</a>)</li> <li><a href="https://github.com/valyala/fasthttp/commit/7a012e987a372bf40d3eedf6caeb2f4c6162ff40"><code>7a012e9</code></a> validate domain and path cookie attribute values on parse (<a href="https://redirect.github.com/valyala/fasthttp/issues/2315">#2315</a>)</li> <li><a href="https://github.com/valyala/fasthttp/commit/9cf733f7dc3533354eb6d495fcf0af93bdcb2f03"><code>9cf733f</code></a> perf: reduce redundant scans and allocations in hot paths (<a href="https://redirect.github.com/valyala/fasthttp/issues/2322">#2322</a>)</li> <li>Additional commits viewable in <a href="https://github.com/valyala/fasthttp/compare/v1.72.0...v1.73.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/valyala/fasthttp&package-manager=go_modules&previous-version=1.72.0&new-version=1.73.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-28 11:18:19 +00:00
dependabot[bot]	300ad74f05	chore: bump github.com/aws/aws-sdk-go-v2 from 1.42.1 to 1.43.0 (#27576 ) Bumps [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) from 1.42.1 to 1.43.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/4fef3455fe2dcb5ea3de4e9fbacf889b84c8a255"><code>4fef345</code></a> Release 2026-07-21</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/62754193b1dfd903e741ad656a3e43cda43e3d6c"><code>6275419</code></a> Regenerated Clients</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/f8598305ac9db1544afae331c09df396ee2f7b3e"><code>f859830</code></a> Update API model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/278591d8fcdcb1f3ec22c3562dcd648b169f4a31"><code>278591d</code></a> Add an option to clients to disable clock skew (<a href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/3483">#3483</a>)</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/d132ac727d15f1c7ff251e0b6739c0e9362ae322"><code>d132ac7</code></a> Fix Clock Skew according to internal specification (<a href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/3472">#3472</a>)</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/03519c98d97b40b31ab42755e4bc6d26e39af5d6"><code>03519c9</code></a> Release 2026-07-20</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/dda3efb63a49f64351f314aa8b6266dee9efbfc2"><code>dda3efb</code></a> Regenerated Clients</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/348cec09e4e0e856665f55f5e548135388a4ef25"><code>348cec0</code></a> Update API model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/f4fd2723ed647078bced4bdf4b83e6a61c379546"><code>f4fd272</code></a> Release 2026-07-17</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/8e4cbc854bca2c82b351089583123964fb4f392a"><code>8e4cbc8</code></a> Regenerated Clients</li> <li>Additional commits viewable in <a href="https://github.com/aws/aws-sdk-go-v2/compare/v1.42.1...v1.43.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/aws/aws-sdk-go-v2&package-manager=go_modules&previous-version=1.42.1&new-version=1.43.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-28 11:18:10 +00:00
dependabot[bot]	5b1fdc9d5e	chore: bump google.golang.org/api from 0.289.0 to 0.290.0 (#27573 ) Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.289.0 to 0.290.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's releases</a>.</em></p> <blockquote> <h2>v0.290.0</h2> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.289.0...v0.290.0">0.290.0</a> (2026-07-20)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3661">#3661</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/dea11c224ee6b69cc88ebd03460e95cf11f8733c">dea11c2</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3663">#3663</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/93d30d482d74cf2f49ada20c06fcdfa9ceb0ed87">93d30d4</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.289.0...v0.290.0">0.290.0</a> (2026-07-20)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3661">#3661</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/dea11c224ee6b69cc88ebd03460e95cf11f8733c">dea11c2</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3663">#3663</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/93d30d482d74cf2f49ada20c06fcdfa9ceb0ed87">93d30d4</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/googleapis/google-api-go-client/commit/b1b12e7c28c287baa23edf8941b2f4a8071c97a9"><code>b1b12e7</code></a> chore(main): release 0.290.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3662">#3662</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/153c78e85b81c1a98919bc8abf26a3055996d5ce"><code>153c78e</code></a> chore: expand CODEOWNERS (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3664">#3664</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/93d30d482d74cf2f49ada20c06fcdfa9ceb0ed87"><code>93d30d4</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3663">#3663</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/dea11c224ee6b69cc88ebd03460e95cf11f8733c"><code>dea11c2</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3661">#3661</a>)</li> <li>See full diff in <a href="https://github.com/googleapis/google-api-go-client/compare/v0.289.0...v0.290.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/api&package-manager=go_modules&previous-version=0.289.0&new-version=0.290.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-28 11:17:59 +00:00
dependabot[bot]	fa15461d67	chore: bump github.com/coder/terraform-provider-coder/v2 from 2.18.0 to 2.19.0 (#27574 ) Bumps [github.com/coder/terraform-provider-coder/v2](https://github.com/coder/terraform-provider-coder) from 2.18.0 to 2.19.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/coder/terraform-provider-coder/releases">github.com/coder/terraform-provider-coder/v2's releases</a>.</em></p> <blockquote> <h2>v2.19.0</h2> <h2>What's Changed</h2> <ul> <li>chore: add check-latest to setup-go for reliable Go version resolution by <a href="https://github.com/denisra"><code>@denisra</code></a> in <a href="https://redirect.github.com/coder/terraform-provider-coder/pull/529">coder/terraform-provider-coder#529</a></li> <li>build(deps): Bump golang.org/x/mod from 0.36.0 to 0.38.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/coder/terraform-provider-coder/pull/524">coder/terraform-provider-coder#524</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/denisra"><code>@denisra</code></a> made their first contribution in <a href="https://redirect.github.com/coder/terraform-provider-coder/pull/529">coder/terraform-provider-coder#529</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/coder/terraform-provider-coder/compare/v2.18.0...v2.19.0">https://github.com/coder/terraform-provider-coder/compare/v2.18.0...v2.19.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/coder/terraform-provider-coder/commit/fd21951c3e89b52658e58361388540bbd97cd2c2"><code>fd21951</code></a> build(deps): Bump golang.org/x/mod from 0.36.0 to 0.38.0 (<a href="https://redirect.github.com/coder/terraform-provider-coder/issues/524">#524</a>)</li> <li><a href="https://github.com/coder/terraform-provider-coder/commit/756e3a855206aec7151c1bc6f132a259533f7bb6"><code>756e3a8</code></a> chore: add check-latest to setup-go for reliable Go version resolution (<a href="https://redirect.github.com/coder/terraform-provider-coder/issues/529">#529</a>)</li> <li>See full diff in <a href="https://github.com/coder/terraform-provider-coder/compare/v2.18.0...v2.19.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/coder/terraform-provider-coder/v2&package-manager=go_modules&previous-version=2.18.0&new-version=2.19.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-28 11:16:42 +00:00
dependabot[bot]	923667013e	chore: bump google.golang.org/grpc from 1.82.0 to 1.82.1 (#27431 ) Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.82.0 to 1.82.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/grpc/grpc-go/releases">google.golang.org/grpc's releases</a>.</em></p> <blockquote> <h2>Release 1.82.1</h2> <h1>Security</h1> <ul> <li>server: Stop reading from the connection when flooded by HTTP/2 frames. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable <code>GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT</code>.</li> <li>xds/rbac: Support <code>Metadata</code> and <code>RequestedServerName</code> permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.</li> <li>xds/rbac: Fix panic when parsing unsupported fields in <code>NotRule</code>/<code>NotId</code> permissions.</li> <li>xds/rbac: Support the deprecated <code>source_ip</code> principal identifier by treating it as equivalent to <code>direct_remote_ip</code>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/grpc/grpc-go/commit/ebd8f06a09426fbece97157c95c3917abff28f4e"><code>ebd8f06</code></a> Change version to 1.82.1 (<a href="https://redirect.github.com/grpc/grpc-go/issues/9238">#9238</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/4ea465d4ab98013f72a142fe0fc89c19770b2935"><code>4ea465d</code></a> Cherry-pick commits (<a href="https://redirect.github.com/grpc/grpc-go/issues/9236">#9236</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/9494a2cf32a0ec9d35420af401445ef3c9f66f05"><code>9494a2c</code></a> Change version to 1.82.1-dev (<a href="https://redirect.github.com/grpc/grpc-go/issues/9171">#9171</a>)</li> <li>See full diff in <a href="https://github.com/grpc/grpc-go/compare/v1.82.0...v1.82.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/grpc&package-manager=go_modules&previous-version=1.82.0&new-version=1.82.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/coder/coder/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-22 18:39:27 +00:00
dependabot[bot]	acd0d7f841	chore: bump google.golang.org/api from 0.288.0 to 0.289.0 (#27365 ) Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.288.0 to 0.289.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's releases</a>.</em></p> <blockquote> <h2>v0.289.0</h2> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.288.0...v0.289.0">0.289.0</a> (2026-07-16)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3649">#3649</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/6e259cbb923dd10f071e2f724be23914f8ccd78b">6e259cb</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3652">#3652</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/5116a48938fa4674df57289ca63e75d209c06e10">5116a48</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3653">#3653</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/6c876b4102b2db7dabc6a0f69eb0e854d298f48d">6c876b4</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3655">#3655</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/69af635fafd38d3623f52c173715883d93d7ead5">69af635</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3656">#3656</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/1fc8f4539d0bf40f8272c1eb36f1e84cfa0ecea7">1fc8f45</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3657">#3657</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/aa8d256cb84dcc38ee3888c983515cae283d7436">aa8d256</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3659">#3659</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/af8d03336daad8d37f8de7e4692a8b67a7d35b7e">af8d033</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.288.0...v0.289.0">0.289.0</a> (2026-07-16)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3649">#3649</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/6e259cbb923dd10f071e2f724be23914f8ccd78b">6e259cb</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3652">#3652</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/5116a48938fa4674df57289ca63e75d209c06e10">5116a48</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3653">#3653</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/6c876b4102b2db7dabc6a0f69eb0e854d298f48d">6c876b4</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3655">#3655</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/69af635fafd38d3623f52c173715883d93d7ead5">69af635</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3656">#3656</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/1fc8f4539d0bf40f8272c1eb36f1e84cfa0ecea7">1fc8f45</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3657">#3657</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/aa8d256cb84dcc38ee3888c983515cae283d7436">aa8d256</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3659">#3659</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/af8d03336daad8d37f8de7e4692a8b67a7d35b7e">af8d033</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/googleapis/google-api-go-client/commit/783bf4bedcc95794980288f1e9928582e9a231b9"><code>783bf4b</code></a> chore(main): release 0.289.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3650">#3650</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/af8d03336daad8d37f8de7e4692a8b67a7d35b7e"><code>af8d033</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3659">#3659</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/080002a0ba10410dcd7c018483bfbdf27c2160ff"><code>080002a</code></a> chore: constrain go version updates in renovate (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3658">#3658</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/aa8d256cb84dcc38ee3888c983515cae283d7436"><code>aa8d256</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3657">#3657</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/1fc8f4539d0bf40f8272c1eb36f1e84cfa0ecea7"><code>1fc8f45</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3656">#3656</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/7ac76e4d28ec9dd11c07746b48262426805a0084"><code>7ac76e4</code></a> chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 in /internal/koko...</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/8a47d2a5ae242a70b49a82a25eb72754dcc9acfc"><code>8a47d2a</code></a> chore(all): update all (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3654">#3654</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/69af635fafd38d3623f52c173715883d93d7ead5"><code>69af635</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3655">#3655</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/6c876b4102b2db7dabc6a0f69eb0e854d298f48d"><code>6c876b4</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3653">#3653</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/5116a48938fa4674df57289ca63e75d209c06e10"><code>5116a48</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3652">#3652</a>)</li> <li>Additional commits viewable in <a href="https://github.com/googleapis/google-api-go-client/compare/v0.288.0...v0.289.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/api&package-manager=go_modules&previous-version=0.288.0&new-version=0.289.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-21 11:19:05 +00:00
dependabot[bot]	0344e06d4c	chore: bump github.com/prometheus/client_golang from 1.23.2 to 1.24.0 (#27366 ) Bumps [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) from 1.23.2 to 1.24.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/prometheus/client_golang/releases">github.com/prometheus/client_golang's releases</a>.</em></p> <blockquote> <h2>v1.24.0 - 2026-07-20</h2> <h3>Changes</h3> <ul> <li>[CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. <a href="https://redirect.github.com/prometheus/client_golang/issues/1862">#1862</a></li> <li>[CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated <code>model.NameValidationScheme</code> global. Default behavior is unchanged; code that set <code>NameValidationScheme = LegacyValidation</code> no longer gets legacy enforcement at metric, label, and push-grouping construction. <a href="https://redirect.github.com/prometheus/client_golang/issues/2051">#2051</a></li> <li>[CHANGE] api/prometheus/v1: Support matchers (<code>matches[]</code> parameter) in <code>Rules</code> method (<code>Rules(ctx context.Context, matches []string) (RulesResult, error)</code>). <a href="https://redirect.github.com/prometheus/client_golang/issues/1843">#1843</a></li> <li>[CHANGE] api/prometheus/v1: Refactor <code>LabelNames</code> method to return <code>model.LabelNames</code> instead of <code>[]string</code> for consistency across the API. <a href="https://redirect.github.com/prometheus/client_golang/issues/1850">#1850</a></li> <li>[CHANGE] exp/api/remote: Simplify <code>Store</code> interface, rename <code>Handler</code> to <code>WriteHandler</code>, and encapsulate write response handling. <a href="https://redirect.github.com/prometheus/client_golang/issues/1855">#1855</a></li> <li>[FEATURE] prometheus: Add new Go 1.26 runtime metrics (<code>/sched/goroutines-created:goroutines</code>, <code>/sched/goroutines/not-in-go:goroutines</code>, <code>/sched/goroutines/runnable:goroutines</code>, <code>/sched/goroutines/running:goroutines</code>, <code>/sched/goroutines/waiting:goroutines</code>, <code>/sched/threads/total:threads</code>). <a href="https://redirect.github.com/prometheus/client_golang/issues/1942">#1942</a></li> <li>[FEATURE] prometheus: Add <code>WithUnit(unit string)</code> option and explicit OpenMetrics unit support in <code>CounterOpts</code>, <code>GaugeOpts</code>, <code>SummaryOpts</code>, and <code>HistogramOpts</code>. <a href="https://redirect.github.com/prometheus/client_golang/issues/1392">#1392</a></li> <li>[FEATURE] prometheus: Expose descriptor construction error through public <code>Err()</code> method on <code>Desc</code>. <a href="https://redirect.github.com/prometheus/client_golang/issues/1902">#1902</a></li> <li>[FEATURE] promhttp: Add opt-in <code>HandlerOpts.CoalesceGather</code> to deduplicate concurrent <code>Gather</code> calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. <a href="https://redirect.github.com/prometheus/client_golang/issues/1969">#1969</a></li> <li>[FEATURE] promhttp: HTTP handlers created by <code>promhttp</code> package now support metrics filtering by providing one or more <code>name[]</code> query parameters. The default behavior when none are provided remains the same, returning all metrics. <a href="https://redirect.github.com/prometheus/client_golang/issues/1925">#1925</a></li> <li>[FEATURE] api/prometheus/v1: Add query formatting endpoint support (<code>/format_query</code>) and <code>FormatQuery(ctx context.Context, query string) (string, error)</code> method. <a href="https://redirect.github.com/prometheus/client_golang/issues/1846">#1846</a>, <a href="https://redirect.github.com/prometheus/client_golang/issues/1856">#1856</a></li> <li>[FEATURE] api/prometheus/v1: Add support for <code>/status/tsdb/blocks</code> endpoint via <code>TSDBBlocks(ctx context.Context) ([]TSDBBlock, error)</code> method. <a href="https://redirect.github.com/prometheus/client_golang/issues/1896">#1896</a></li> <li>[FEATURE] exp/api/remote: Export <code>BackoffConfig</code> to allow customization when using <code>WithAPIBackoff</code>. <a href="https://redirect.github.com/prometheus/client_golang/issues/1895">#1895</a></li> <li>[FEATURE] exp/api/remote: Add <code>RetryCallBack</code> to allow custom logging or handling on retry attempts in the remote write client. <a href="https://redirect.github.com/prometheus/client_golang/issues/1888">#1888</a>, <a href="https://redirect.github.com/prometheus/client_golang/issues/1890">#1890</a></li> <li>[ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. <a href="https://redirect.github.com/prometheus/client_golang/issues/1860">#1860</a></li> <li>[ENHANCEMENT] api: Use cloned <code>http.DefaultTransport</code> when constructing default HTTP clients to prevent accidental mutations of shared global transport state. <a href="https://redirect.github.com/prometheus/client_golang/issues/1885">#1885</a></li> <li>[BUGFIX] prometheus: Recover from collector panics during <code>Gather()</code> and return an error instead of crashing the process. <a href="https://redirect.github.com/prometheus/client_golang/issues/1961">#1961</a></li> <li>[BUGFIX] prometheus: Fix <code>cpu-seconds</code> unit suffix handling for metric <code>go_cpu_classes_gc_mark_assist_cpu_seconds</code>. <a href="https://redirect.github.com/prometheus/client_golang/issues/1991">#1991</a></li> <li>[BUGFIX] promhttp: <code>InstrumentHandlerDuration</code> and <code>InstrumentHandlerCounter</code> no longer panic when given an observer/counter that does not implement <code>ExemplarObserver</code>/<code>ExemplarAdder</code> (e.g. a <code>SummaryVec</code>). The exemplar is dropped and the value is recorded via the plain <code>Observe</code>/<code>Add</code> path, matching the safe-cast already used by <code>Timer.ObserveDurationWithExemplar</code>. <a href="https://redirect.github.com/prometheus/client_golang/issues/2005">#2005</a></li> <li>[BUGFIX] api/prometheus/v1: Fall back to <code>GET</code> requests when <code>POST</code> requests return <code>403 Forbidden</code> or method not allowed. <a href="https://redirect.github.com/prometheus/client_golang/issues/2030">#2030</a></li> <li>[BUGFIX] api: Respect context cancellation inside <code>httpClient.Do</code>. <a href="https://redirect.github.com/prometheus/client_golang/issues/1971">#1971</a></li> <li>[BUGFIX] exp/api/remote: Fix compression buffer pooling where compressed buffers were released prematurely, causing corrupted remote-write payloads. <a href="https://redirect.github.com/prometheus/client_golang/issues/1889">#1889</a></li> <li>[BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. <a href="https://redirect.github.com/prometheus/client_golang/issues/1917">#1917</a></li> <li>[BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be returned on v1 requests. <a href="https://redirect.github.com/prometheus/client_golang/issues/1927">#1927</a></li> </ul> <!-- raw HTML omitted --> <ul> <li>build(deps): bump github.com/prometheus/procfs from 0.16.1 to 0.17.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/client_golang/pull/1839">prometheus/client_golang#1839</a></li> <li>build(deps): bump golang.org/x/sys from 0.33.0 to 0.34.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/client_golang/pull/1838">prometheus/client_golang#1838</a></li> <li>prometheus/collectors: use godoc link for runtime/metrics supported metrics by <a href="https://github.com/xieyuschen"><code>@xieyuschen</code></a> in <a href="https://redirect.github.com/prometheus/client_golang/pull/1844">prometheus/client_golang#1844</a></li> <li>Fix doc typo by <a href="https://github.com/torrca"><code>@torrca</code></a> in <a href="https://redirect.github.com/prometheus/client_golang/pull/1849">prometheus/client_golang#1849</a></li> <li>Merge release-1.23 into main by <a href="https://github.com/vesari"><code>@vesari</code></a> in <a href="https://redirect.github.com/prometheus/client_golang/pull/1851">prometheus/client_golang#1851</a></li> <li>build(deps): bump github/codeql-action from 3.29.2 to 3.29.5 in the github-actions group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/client_golang/pull/1852">prometheus/client_golang#1852</a></li> <li>Refactor LabelNames to return model.LabelNames type for consistency by <a href="https://github.com/yshngg"><code>@yshngg</code></a> in <a href="https://redirect.github.com/prometheus/client_golang/pull/1850">prometheus/client_golang#1850</a></li> <li>remote: simplified Store interface; renamed Handler to WriteHandler by <a href="https://github.com/bwplotka"><code>@bwplotka</code></a> in <a href="https://redirect.github.com/prometheus/client_golang/pull/1855">prometheus/client_golang#1855</a></li> <li>feat(api/prometheus): add format_query endpoint for query formatting by <a href="https://github.com/yshngg"><code>@yshngg</code></a> in <a href="https://redirect.github.com/prometheus/client_golang/pull/1846">prometheus/client_golang#1846</a></li> <li>feat(api): add FormatQuery method to Prometheus v1 API by <a href="https://github.com/yshngg"><code>@yshngg</code></a> in <a href="https://redirect.github.com/prometheus/client_golang/pull/1856">prometheus/client_golang#1856</a></li> <li>Support matchers in rules API by <a href="https://github.com/jotak"><code>@jotak</code></a> in <a href="https://redirect.github.com/prometheus/client_golang/pull/1843">prometheus/client_golang#1843</a></li> <li>Use prometheus/common.expfmt.NewTextParser by <a href="https://github.com/aknuds1"><code>@aknuds1</code></a> in <a href="https://redirect.github.com/prometheus/client_golang/pull/1859">prometheus/client_golang#1859</a></li> <li>Merge release-1.23 into main by <a href="https://github.com/aknuds1"><code>@aknuds1</code></a> in <a href="https://redirect.github.com/prometheus/client_golang/pull/1861">prometheus/client_golang#1861</a></li> <li>chore: Drop support for <go1.22 by <a href="https://github.com/mrueg"><code>@mrueg</code></a> in <a href="https://redirect.github.com/prometheus/client_golang/pull/1862">prometheus/client_golang#1862</a></li> <li>collectors/version: Allow custom additional labels by <a href="https://github.com/mrueg"><code>@mrueg</code></a> in <a href="https://redirect.github.com/prometheus/client_golang/pull/1860">prometheus/client_golang#1860</a></li> <li>build(deps): bump github.com/prometheus/common from 0.65.0 to 0.66.0 by <a href="https://github.com/ywwg"><code>@ywwg</code></a> in <a href="https://redirect.github.com/prometheus/client_golang/pull/1865">prometheus/client_golang#1865</a></li> <li>Sync release-1.23 into main by <a href="https://github.com/aknuds1"><code>@aknuds1</code></a> in <a href="https://redirect.github.com/prometheus/client_golang/pull/1868">prometheus/client_golang#1868</a></li> <li>Sync main with release-1.23 by <a href="https://github.com/aknuds1"><code>@aknuds1</code></a> in <a href="https://redirect.github.com/prometheus/client_golang/pull/1871">prometheus/client_golang#1871</a></li> <li>chore: clean up golangci-lint configuration by <a href="https://github.com/mmorel-35"><code>@mmorel-35</code></a> in <a href="https://redirect.github.com/prometheus/client_golang/pull/1802">prometheus/client_golang#1802</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/prometheus/client_golang/blob/v1.24.0/CHANGELOG.md">github.com/prometheus/client_golang's changelog</a>.</em></p> <blockquote> <h2>1.24.0 / 2026-07-20</h2> <ul> <li>[CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. <a href="https://redirect.github.com/prometheus/client_golang/issues/1862">#1862</a></li> <li>[CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated <code>model.NameValidationScheme</code> global. Default behavior is unchanged; code that set <code>NameValidationScheme = LegacyValidation</code> no longer gets legacy enforcement at metric, label, and push-grouping construction. <a href="https://redirect.github.com/prometheus/client_golang/issues/2051">#2051</a></li> <li>[CHANGE] api/prometheus/v1: Support matchers (<code>matches[]</code> parameter) in <code>Rules</code> method (<code>Rules(ctx context.Context, matches []string) (RulesResult, error)</code>). <a href="https://redirect.github.com/prometheus/client_golang/issues/1843">#1843</a></li> <li>[CHANGE] api/prometheus/v1: Refactor <code>LabelNames</code> method to return <code>model.LabelNames</code> instead of <code>[]string</code> for consistency across the API. <a href="https://redirect.github.com/prometheus/client_golang/issues/1850">#1850</a></li> <li>[CHANGE] exp/api/remote: Simplify <code>Store</code> interface, rename <code>Handler</code> to <code>WriteHandler</code>, and encapsulate write response handling. <a href="https://redirect.github.com/prometheus/client_golang/issues/1855">#1855</a></li> <li>[FEATURE] prometheus: Add new Go 1.26 runtime metrics (<code>/sched/goroutines-created:goroutines</code>, <code>/sched/goroutines/not-in-go:goroutines</code>, <code>/sched/goroutines/runnable:goroutines</code>, <code>/sched/goroutines/running:goroutines</code>, <code>/sched/goroutines/waiting:goroutines</code>, <code>/sched/threads/total:threads</code>). <a href="https://redirect.github.com/prometheus/client_golang/issues/1942">#1942</a></li> <li>[FEATURE] prometheus: Add <code>WithUnit(unit string)</code> option and explicit OpenMetrics unit support in <code>CounterOpts</code>, <code>GaugeOpts</code>, <code>SummaryOpts</code>, and <code>HistogramOpts</code>. <a href="https://redirect.github.com/prometheus/client_golang/issues/1392">#1392</a></li> <li>[FEATURE] prometheus: Expose descriptor construction error through public <code>Err()</code> method on <code>Desc</code>. <a href="https://redirect.github.com/prometheus/client_golang/issues/1902">#1902</a></li> <li>[FEATURE] promhttp: Add opt-in <code>HandlerOpts.CoalesceGather</code> to deduplicate concurrent <code>Gather</code> calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. <a href="https://redirect.github.com/prometheus/client_golang/issues/1969">#1969</a></li> <li>[FEATURE] promhttp: HTTP handlers created by <code>promhttp</code> package now support metrics filtering by providing one or more <code>name[]</code> query parameters. The default behavior when none are provided remains the same, returning all metrics. <a href="https://redirect.github.com/prometheus/client_golang/issues/1925">#1925</a></li> <li>[FEATURE] api/prometheus/v1: Add query formatting endpoint support (<code>/format_query</code>) and <code>FormatQuery(ctx context.Context, query string) (string, error)</code> method. <a href="https://redirect.github.com/prometheus/client_golang/issues/1846">#1846</a>, <a href="https://redirect.github.com/prometheus/client_golang/issues/1856">#1856</a></li> <li>[FEATURE] api/prometheus/v1: Add support for <code>/status/tsdb/blocks</code> endpoint via <code>TSDBBlocks(ctx context.Context) ([]TSDBBlock, error)</code> method. <a href="https://redirect.github.com/prometheus/client_golang/issues/1896">#1896</a></li> <li>[FEATURE] exp/api/remote: Export <code>BackoffConfig</code> to allow customization when using <code>WithAPIBackoff</code>. <a href="https://redirect.github.com/prometheus/client_golang/issues/1895">#1895</a></li> <li>[FEATURE] exp/api/remote: Add <code>RetryCallBack</code> to allow custom logging or handling on retry attempts in the remote write client. <a href="https://redirect.github.com/prometheus/client_golang/issues/1888">#1888</a>, <a href="https://redirect.github.com/prometheus/client_golang/issues/1890">#1890</a></li> <li>[ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. <a href="https://redirect.github.com/prometheus/client_golang/issues/1860">#1860</a></li> <li>[ENHANCEMENT] api: Use cloned <code>http.DefaultTransport</code> when constructing default HTTP clients to prevent accidental mutations of shared global transport state. <a href="https://redirect.github.com/prometheus/client_golang/issues/1885">#1885</a></li> <li>[BUGFIX] prometheus: Recover from collector panics during <code>Gather()</code> and return an error instead of crashing the process. <a href="https://redirect.github.com/prometheus/client_golang/issues/1961">#1961</a></li> <li>[BUGFIX] prometheus: Fix <code>cpu-seconds</code> unit suffix handling for metric <code>go_cpu_classes_gc_mark_assist_cpu_seconds</code>. <a href="https://redirect.github.com/prometheus/client_golang/issues/1991">#1991</a></li> <li>[BUGFIX] promhttp: <code>InstrumentHandlerDuration</code> and <code>InstrumentHandlerCounter</code> no longer panic when given an observer/counter that does not implement <code>ExemplarObserver</code>/<code>ExemplarAdder</code> (e.g. a <code>SummaryVec</code>). The exemplar is dropped and the value is recorded via the plain <code>Observe</code>/<code>Add</code> path, matching the safe-cast already used by <code>Timer.ObserveDurationWithExemplar</code>. <a href="https://redirect.github.com/prometheus/client_golang/issues/2005">#2005</a></li> <li>[BUGFIX] api/prometheus/v1: Fall back to <code>GET</code> requests when <code>POST</code> requests return <code>403 Forbidden</code> or method not allowed. <a href="https://redirect.github.com/prometheus/client_golang/issues/2030">#2030</a></li> <li>[BUGFIX] api: Respect context cancellation inside <code>httpClient.Do</code>. <a href="https://redirect.github.com/prometheus/client_golang/issues/1971">#1971</a></li> <li>[BUGFIX] exp/api/remote: Fix compression buffer pooling where compressed buffers were released prematurely, causing corrupted remote-write payloads. <a href="https://redirect.github.com/prometheus/client_golang/issues/1889">#1889</a></li> <li>[BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. <a href="https://redirect.github.com/prometheus/client_golang/issues/1917">#1917</a></li> <li>[BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be returned on v1 requests. <a href="https://redirect.github.com/prometheus/client_golang/issues/1927">#1927</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/prometheus/client_golang/commit/48dd383f94cc36bb0179724166383effd9f64847"><code>48dd383</code></a> Cut v1.24.0 (<a href="https://redirect.github.com/prometheus/client_golang/issues/2061">#2061</a>)</li> <li><a href="https://github.com/prometheus/client_golang/commit/a7253054383fd6702034c16194117d37727cd5fc"><code>a725305</code></a> Cut v1.24.0-rc.0 (<a href="https://redirect.github.com/prometheus/client_golang/issues/2058">#2058</a>)</li> <li><a href="https://github.com/prometheus/client_golang/commit/77c584f2501bf3726bb39b83a89b70c0e6f9ab0c"><code>77c584f</code></a> build(deps): update all Go dependencies in all go.mod files (<a href="https://redirect.github.com/prometheus/client_golang/issues/2059">#2059</a>)</li> <li><a href="https://github.com/prometheus/client_golang/commit/78262a77b89922f94a19ecd25eaeb849fb58f2cc"><code>78262a7</code></a> feat(promhttp): add CoalesceGather option to deduplicate concurrent Gather ca...</li> <li><a href="https://github.com/prometheus/client_golang/commit/34e9a7fe186a7a3ff47694f127d44d5641ff388f"><code>34e9a7f</code></a> Merge pull request <a href="https://redirect.github.com/prometheus/client_golang/issues/2055">#2055</a> from prombot/repo_sync</li> <li><a href="https://github.com/prometheus/client_golang/commit/43749bc83131a4af24527351aabb47dc58590c85"><code>43749bc</code></a> Update common Prometheus files</li> <li><a href="https://github.com/prometheus/client_golang/commit/de192175ccd6f6d4894cd9ceb804712c982e4958"><code>de19217</code></a> examples: improve simple main.go example (<a href="https://redirect.github.com/prometheus/client_golang/issues/1999">#1999</a>)</li> <li><a href="https://github.com/prometheus/client_golang/commit/20355eb4487c108a6ed54d9ebc6893bd649c10d0"><code>20355eb</code></a> fix: correct typos in comments and test error messages (<a href="https://redirect.github.com/prometheus/client_golang/issues/2049">#2049</a>)</li> <li><a href="https://github.com/prometheus/client_golang/commit/4cd2d3a57eccc893f00e23eb765f62e970e61f33"><code>4cd2d3a</code></a> test: fix two flaky tests (darwin start_time regex, memstats HeapReleased dri...</li> <li><a href="https://github.com/prometheus/client_golang/commit/b0d896bb08469911db07752f2c92c4d3986c629b"><code>b0d896b</code></a> Replace deprecated model.NameValidationScheme with explicit UTF8Validation (#...</li> <li>Additional commits viewable in <a href="https://github.com/prometheus/client_golang/compare/v1.23.2...v1.24.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/prometheus/client_golang&package-manager=go_modules&previous-version=1.23.2&new-version=1.24.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-21 11:16:43 +00:00
dependabot[bot]	0aa74b0e5e	chore: bump github.com/scim2/filter-parser/v2 from 2.2.0 to 2.3.1 (#27368 ) Bumps [github.com/scim2/filter-parser/v2](https://github.com/scim2/filter-parser) from 2.2.0 to 2.3.1. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/scim2/filter-parser/commit/65b9da65508fb179de8e6841f81a4661a5d13ca1"><code>65b9da6</code></a> chore: lower go directive to 1.18 (actual minimum)</li> <li><a href="https://github.com/scim2/filter-parser/commit/fb6a9f86f8dffff137ca8f65faf65660480ea0d9"><code>fb6a9f8</code></a> chore: migrate parser dependency to github.com/q-uint/parser</li> <li><a href="https://github.com/scim2/filter-parser/commit/a551bba7d74bbd9fce7e56f4844351c77c338d9f"><code>a551bba</code></a> fix: allow hyphens in URI segments (<a href="https://redirect.github.com/scim2/filter-parser/issues/29">#29</a>)</li> <li><a href="https://github.com/scim2/filter-parser/commit/5c111b10bf6b419428e400380472a51512f3be00"><code>5c111b1</code></a> fix: preserve operator precedence in LogicalExpression.String() (<a href="https://redirect.github.com/scim2/filter-parser/issues/28">#28</a>)</li> <li>See full diff in <a href="https://github.com/scim2/filter-parser/compare/v2.2.0...v2.3.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/scim2/filter-parser/v2&package-manager=go_modules&previous-version=2.2.0&new-version=2.3.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-21 11:13:28 +00:00
Michael Suchacz	5f5efa49da	fix: stop sending adaptive thinking to pre-4.6 Anthropic models (#27314 ) ## Problem A chat model config with `reasoning_effort` set on a pre-4.6 Anthropic model (for example `claude-haiku-4-5`) fails every generation with HTTP 400 `adaptive thinking is not supported on this model`, surfaced in chat as "Anthropic returned an unexpected error." The fantasy Anthropic provider always serialized effort as `thinking: {type: "adaptive"}` plus `output_config.effort`, a shape only Claude 4.6+ accepts. ## Changes - Bump the coder/fantasy pin to include coder/fantasy#47: the provider now converts effort into `{type: "enabled", budget_tokens}` on models older than Claude 4.6, with the budget derived from the call's `max_tokens` (aibridge-mirroring ratios, 1024-token API floor; below the floor thinking is omitted, which keeps small-budget calls like title generation working). Adaptive-capable models keep the current shape, and Opus 4.5 keeps `output_config.effort` alongside the derived budget since it supports effort without adaptive thinking. Models older than Claude 3.7 predate extended thinking, so effort sends no thinking at all there. `minimal` is normalized to `low`, `xhigh` falls back to `max` on adaptive models that predate the xhigh tier (Claude 4.7+); effort `none` disables thinking, including an explicit `thinking: {type: "disabled"}` on Claude 5+ models that otherwise run adaptive thinking by default. The Bedrock provider wraps the Anthropic one, so both are covered, and Vertex-style `@date` model IDs parse correctly. - `TestActiveServer_CompactionModelOverride` previously codified the buggy shape (asserting `output_config.effort` sent to `claude-3-5-haiku-latest`). The summary-routing subtest is now a three-case table: pre-thinking override models (Claude 3.5) expect no thinking, legacy budget-thinking ones (Haiku 4.5) expect enabled thinking with the derived budget, adaptive-capable ones still expect `output_config.effort`. - New regression test `TestActiveServer_AnthropicModelReasoningEffort`: a `claude-haiku-4-5` config with `reasoning_effort` produces enabled thinking with the derived budget and no `output_config` on the wire, and a `claude-sonnet-5` config with effort `none` sends an explicit thinking disable. - `chattest.AnthropicRequest` gains a `Thinking` field so tests can assert the thinking config. - One-sentence note in the chatd ARCHITECTURE reasoning-effort section. No chatd production code changes: `ApplyReasoningEffort` keeps setting `Effort`, which is now valid for every Anthropic model. ## Validation - `go test ./coderd/x/chatd/...` passes (19 packages). - Fork PR validated separately: full fantasy test suite plus new provider unit tests (version gating incl. Vertex/Bedrock IDs, budget derivation, floor behavior, normalization, effort `none` incl. Claude 5+ disable, Opus 4.5 effort preservation, sampling-param stripping), golangci-lint clean. Closes [CODAGT-812](https://linear.app/codercom/issue/CODAGT-812/reasoning-effort-on-pre-46-anthropic-models-fails-generations-with). > This PR was authored by Mux, an AI coding agent, acting on Mike's behalf.	2026-07-18 22:47:02 +02:00
Ehab Younes	35ade9e3d2	feat: collect workspace logs in support bundles (#26694 ) Add workspace-side file collection to `coder support bundle` via repeatable --workspace-file flags. The agent resolves the requested paths or globs inside the remote workspace and streams back a tar with a manifest and the collected files; nothing is read from the machine running the command. - Add POST /api/v0/bundle-files to the agent's agentfiles package. - Expand env vars in the agent's environment; paths must then be absolute or start with ~/ (the agent user's home directory). - Support ** globs and tail oversized files. - Record requested patterns, per-path errors, truncation, and the applied limits in a manifest. - Unpack the archive into the bundle under agent/workspace_files/, recording dropped entries in collection_errors.txt. - Write a manifest-only archive marking collection as unsupported for agents that predate the endpoint. - Bound collection: 64 KB request body, 10000 files, 10 MiB per file, 100 MiB total including archive overhead, 110 MiB client-side read cap, 5 minute timeout. Closes #26020	2026-07-16 13:00:32 +03:00
dependabot[bot]	0fab0fa0ae	chore: bump github.com/DataDog/dd-trace-go/v2 from 2.0.0 to 2.8.1 (#27282 ) Bumps [github.com/DataDog/dd-trace-go/v2](https://github.com/DataDog/dd-trace-go) from 2.0.0 to 2.8.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/DataDog/dd-trace-go/releases">github.com/DataDog/dd-trace-go/v2's releases</a>.</em></p> <blockquote> <h2>v2.8.1</h2> <!-- raw HTML omitted --> <h3>Application Performance Monitoring (APM)</h3> <ul> <li>Revert "fix(ddtrace/tracer): cache trace ID hex encoding (<a href="https://redirect.github.com/DataDog/dd-trace-go/issues/4481">#4481</a>)" by <a href="https://github.com/darccio"><code>@darccio</code></a></li> <li>fix(tracer): enforce baggage item and byte limits on extraction by <a href="https://github.com/mtoffl01"><code>@mtoffl01</code></a> in <a href="https://redirect.github.com/DataDog/dd-trace-go/issues/4720">#4720</a></li> <li>fix(tracer): drop dd= list-entries over 256 bytes from incoming tracestate by <a href="https://github.com/mtoffl01"><code>@mtoffl01</code></a> in <a href="https://redirect.github.com/DataDog/dd-trace-go/issues/4721">#4721</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/DataDog/dd-trace-go/compare/v2.8.0...v2.8.1">https://github.com/DataDog/dd-trace-go/compare/v2.8.0...v2.8.1</a></p> <h2>v2.8.0</h2> <!-- raw HTML omitted --> <h2>Summary</h2> <p><strong>New integrations.</strong> Two new integrations land in this release: Azure API Management (APIM) callout processor for security (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4620">#4620</a>), and twmb/franz-go for Kafka (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4250">#4250</a>).</p> <p><strong>Data Streams Monitoring.</strong> All three major Kafka integrations — confluent-kafka-go (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4470">#4470</a>), segmentio/kafka-go (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4477">#4477</a>), and Sarama (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4560">#4560</a>) — now attach <code>kafka_cluster_id</code> for cluster-level visibility. <code>TrackDataStreamsTransaction</code> also gains span tagging and custom timestamp support (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4499">#4499</a>).</p> <p><strong>OpenTelemetry (OTel) and OTLP.</strong> The tracer can now export traces directly via the OpenTelemetry Protocol (OTLP), bypassing the Datadog Agent entirely (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4600">#4600</a>, <a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4583">#4583</a>). OTel process context v2 (OTLP proto format) is supported (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4478">#4478</a>), and the <code>parentbased_always_on</code> sampler works in OTLP mode (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4567">#4567</a>).</p> <p><strong>Large Language Model (LLM) Observability.</strong> Prompt tracking is now available for LLMObs spans (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4608">#4608</a>). Experiment scope propagates from APM baggage into spans automatically (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4651">#4651</a>).</p> <p><strong>Profiler.</strong> An experimental goroutine leak profile is available as opt-in (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4420">#4420</a>). The goroutine wait profile type has been removed — this is a breaking change for anyone using it explicitly (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4589">#4589</a>).</p> <p><strong>HTTP and tracing.</strong> A new environment variable <code>DD_TRACE_HTTP_URL_QUERY_STRING_ALLOWLIST</code> lets you whitelist query string parameters to keep unredacted (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4562">#4562</a>). A new <code>tracer.StartSpanFromPropagatedContext</code> API simplifies span creation from propagated contexts (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4492">#4492</a>). AWS EventBridge max payload size is bumped to 1 MB (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4458">#4458</a>). Envoy Service Extensions integration gains Unix Domain Socket (UDS) support (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4463">#4463</a>).</p> <p><strong>OpenFeature.</strong> Flag evaluation metrics now emit via OTel Metrics (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4489">#4489</a>), with allocation key tagging (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4515">#4515</a>) and Remote Configuration (RC) integration via <code>FFE_FLAGS</code> subscription at tracer startup (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4495">#4495</a>).</p> <p><strong>Bug fixes.</strong> gorm now respects <code>DD_TRACE_REMOVE_INTEGRATION_SERVICE_NAMES_ENABLED</code> (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4618">#4618</a>). Redis and Valkey pipeline commands are joined with newlines, fixing agent obfuscation (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4593">#4593</a>). A race condition in HTTP client trace timings is resolved (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4591">#4591</a>). AppSec block responses now include a correct <code>Content-Length</code> header (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4496">#4496</a>), and spurious Remote Configuration errors are silenced when RC is disabled (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4612">#4612</a>). <code>ContextWithSpan</code> no longer panics on nil context (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4313">#4313</a>). The OTel bridge preserves keep/drop sampling decisions for unsampled spans (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4631">#4631</a>). User-provided DogStatsD addresses now correctly take priority over defaults (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4575">#4575</a>).</p> <p><strong>Performance.</strong> Trace ID hex encoding is cached (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4481">#4481</a>), the span metadata map is preallocated (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4541">#4541</a>), and locking is removed from both sampling priority access (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4546">#4546</a>) and the internal logger (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4547">#4547</a>) — reducing allocations and contention on hot paths.</p> <p><strong>CI Visibility.</strong> Bazel offline cache and payload-file modes are supported (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4503">#4503</a>). Known test pagination is implemented for large test suites (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4509">#4509</a>).</p> <h2>What's Changed</h2> <h3>Application Performance Monitoring (APM)</h3> <ul> <li>feat: collect service override source by <a href="https://github.com/raphaelgavache"><code>@raphaelgavache</code></a> in <a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4500">DataDog/dd-trace-go#4500</a></li> <li>feat: support service source for 19 integrations by <a href="https://github.com/raphaelgavache"><code>@raphaelgavache</code></a> in <a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4526">DataDog/dd-trace-go#4526</a></li> <li>feat: support service source for 13integrations by <a href="https://github.com/raphaelgavache"><code>@raphaelgavache</code></a> in <a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4534">DataDog/dd-trace-go#4534</a></li> <li>feat: add service source on 10 integrations by <a href="https://github.com/raphaelgavache"><code>@raphaelgavache</code></a> in <a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4540">DataDog/dd-trace-go#4540</a></li> <li>feat: force usage of ServiceWithSource in contrib by <a href="https://github.com/raphaelgavache"><code>@raphaelgavache</code></a> in <a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4549">DataDog/dd-trace-go#4549</a></li> <li>fix(eventbridge): update max payload size to 1m by <a href="https://github.com/Dogbu-cyber"><code>@Dogbu-cyber</code></a> in <a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4458">DataDog/dd-trace-go#4458</a></li> <li>feat(telemetry): add stable session identifier headers by <a href="https://github.com/khanayan123"><code>@khanayan123</code></a> in <a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4574">DataDog/dd-trace-go#4574</a></li> <li>feat: collect service source in client stats by <a href="https://github.com/raphaelgavache"><code>@raphaelgavache</code></a> in <a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4519">DataDog/dd-trace-go#4519</a></li> <li>feat: OTel process context v2 (otlp proto) by <a href="https://github.com/nsavoire"><code>@nsavoire</code></a> in <a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4478">DataDog/dd-trace-go#4478</a></li> <li>fix: join redis and valkey pipeline commands with newlines for correct agent obfuscation by <a href="https://github.com/rarguelloF"><code>@rarguelloF</code></a> in <a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4593">DataDog/dd-trace-go#4593</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/DataDog/dd-trace-go/commit/2b2b2c2c9c420dcc5df24165681ed11c3f1c8438"><code>2b2b2c2</code></a> chore: make fix-modules && make generate</li> <li><a href="https://github.com/DataDog/dd-trace-go/commit/21438ed81625961b1393806128b142fa7e3829d7"><code>21438ed</code></a> internal/version: v2.8.1</li> <li><a href="https://github.com/DataDog/dd-trace-go/commit/0bc11f30cc930602a07c90a3b106b72bca13ecc0"><code>0bc11f3</code></a> internal/orchestrion/_integration: v2.8.1-rc.2</li> <li><a href="https://github.com/DataDog/dd-trace-go/commit/f17a712cf0ef081a42e1e972da5cb7d0d09fb1b5"><code>f17a712</code></a> orchestrion/all: v2.8.1-rc.2</li> <li><a href="https://github.com/DataDog/dd-trace-go/commit/1b8d8e59ef212bae8097c7025e13fcbb99a0e554"><code>1b8d8e5</code></a> internal/traceprof/traceproftest: v2.8.1-rc.2</li> <li><a href="https://github.com/DataDog/dd-trace-go/commit/7b30b1f0aec1bfd1f7f4a38edaccccd9c691c8fb"><code>7b30b1f</code></a> contrib/aws/datadog-lambda-go/test/integration_tests/error: v2.8.1-rc.2</li> <li><a href="https://github.com/DataDog/dd-trace-go/commit/96cc2a4c04453a99cba785cafe17ffb6e9a316a9"><code>96cc2a4</code></a> contrib/aws/datadog-lambda-go/test/integration_tests/hello: v2.8.1-rc.2</li> <li><a href="https://github.com/DataDog/dd-trace-go/commit/f3013b5aed4b2051a3da540cafeedbb05d4b89f9"><code>f3013b5</code></a> instrumentation/internal/validationtest: v2.8.1-rc.2</li> <li><a href="https://github.com/DataDog/dd-trace-go/commit/c9f98439255531363157d4f1b312c594c5ec10e6"><code>c9f9843</code></a> contrib/labstack/echo.v4: v2.8.1-rc.2</li> <li><a href="https://github.com/DataDog/dd-trace-go/commit/e07b30bb083cb5e2aba59f083319f921118d174a"><code>e07b30b</code></a> contrib/valyala/fasthttp: v2.8.1-rc.2</li> <li>Additional commits viewable in <a href="https://github.com/DataDog/dd-trace-go/compare/v2.0.0...v2.8.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/DataDog/dd-trace-go/v2&package-manager=go_modules&previous-version=2.0.0&new-version=2.8.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/coder/coder/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-15 23:40:09 +00:00
dependabot[bot]	295bce2611	chore: bump github.com/hashicorp/terraform-json from 0.27.2 to 0.28.0 (#27227 ) Bumps [github.com/hashicorp/terraform-json](https://github.com/hashicorp/terraform-json) from 0.27.2 to 0.28.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/hashicorp/terraform-json/releases">github.com/hashicorp/terraform-json's releases</a>.</em></p> <blockquote> <h2>v0.28.0</h2> <p>ENHANCEMENTS:</p> <ul> <li><code>plan</code>: Added "action_reason" data to resource changes described in a plan by <a href="https://github.com/renescheepers"><code>@renescheepers</code></a> in <a href="https://redirect.github.com/hashicorp/terraform-json/pull/200">hashicorp/terraform-json#200</a></li> <li><code>provider schema</code>: Added ability to parse state store schemas from a provider's schema by <a href="https://github.com/SarahFrench"><code>@SarahFrench</code></a> in <a href="https://redirect.github.com/hashicorp/terraform-json/pull/190">hashicorp/terraform-json#190</a> <ul> <li>This is related to an experimental feature that's still in development in Terraform core.</li> </ul> </li> <li><code>validate</code>: Added <code>Diagnostic.Address</code> data to diagnostics returned when validating configuration by <a href="https://github.com/bbasata"><code>@bbasata</code></a> in <a href="https://redirect.github.com/hashicorp/terraform-json/pull/204">hashicorp/terraform-json#204</a></li> </ul> <p>INTERNAL:</p> <ul> <li>test: Add tests for parsing logs from init commands, tests for parsing of RFC3339 timestamps with different levels of precision by <a href="https://github.com/SarahFrench"><code>@SarahFrench</code></a> in <a href="https://redirect.github.com/hashicorp/terraform-json/pull/180">hashicorp/terraform-json#180</a></li> <li>build(deps): bump actions/checkout from 5.0.0 to 6.0.0 in the github-actions-breaking group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/hashicorp/terraform-json/pull/182">hashicorp/terraform-json#182</a></li> <li>build(deps): bump actions/setup-go from 6.0.0 to 6.1.0 in the github-actions-backward-compatible group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/hashicorp/terraform-json/pull/183">hashicorp/terraform-json#183</a></li> <li>build(deps): bump github.com/hashicorp/go-version from 1.7.0 to 1.8.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/hashicorp/terraform-json/pull/184">hashicorp/terraform-json#184</a></li> <li>build(deps): bump actions/checkout from 6.0.0 to 6.0.1 in the github-actions-backward-compatible group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/hashicorp/terraform-json/pull/186">hashicorp/terraform-json#186</a></li> <li>build(deps): bump the github-actions-backward-compatible group across 1 directory with 2 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/hashicorp/terraform-json/pull/189">hashicorp/terraform-json#189</a></li> <li>Update copyright headers to IBM by <a href="https://github.com/radeksimko"><code>@radeksimko</code></a> in <a href="https://redirect.github.com/hashicorp/terraform-json/pull/192">hashicorp/terraform-json#192</a></li> <li>build(deps): bump actions/setup-go from 6.2.0 to 6.3.0 in the github-actions-backward-compatible group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/hashicorp/terraform-json/pull/194">hashicorp/terraform-json#194</a></li> <li>build(deps): bump actions/setup-go from 6.3.0 to 6.4.0 in the github-actions-backward-compatible group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/hashicorp/terraform-json/pull/195">hashicorp/terraform-json#195</a></li> <li>build(deps): bump github.com/hashicorp/go-version from 1.8.0 to 1.9.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/hashicorp/terraform-json/pull/196">hashicorp/terraform-json#196</a></li> <li>build(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions-backward-compatible group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/hashicorp/terraform-json/pull/199">hashicorp/terraform-json#199</a></li> <li>build(deps): bump actions/checkout from 6.0.3 to 7.0.0 in the github-actions-breaking group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/hashicorp/terraform-json/pull/201">hashicorp/terraform-json#201</a></li> <li>build(deps): bump actions/setup-go from 6.4.0 to 6.5.0 in the github-actions-backward-compatible group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/hashicorp/terraform-json/pull/202">hashicorp/terraform-json#202</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/helenjw"><code>@helenjw</code></a> made their first contribution in <a href="https://redirect.github.com/hashicorp/terraform-json/pull/179">hashicorp/terraform-json#179</a></li> <li><a href="https://github.com/renescheepers"><code>@renescheepers</code></a> made their first contribution in <a href="https://redirect.github.com/hashicorp/terraform-json/pull/200">hashicorp/terraform-json#200</a></li> <li><a href="https://github.com/bbasata"><code>@bbasata</code></a> made their first contribution in <a href="https://redirect.github.com/hashicorp/terraform-json/pull/204">hashicorp/terraform-json#204</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/hashicorp/terraform-json/compare/v0.27.2...v0.28.0">https://github.com/hashicorp/terraform-json/compare/v0.27.2...v0.28.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/hashicorp/terraform-json/commit/1e0dcb8caaf6c22e21bc6c042cb85b5467b670cf"><code>1e0dcb8</code></a> validate: add <code>Diagnostic.Address</code> (<a href="https://redirect.github.com/hashicorp/terraform-json/issues/204">#204</a>)</li> <li><a href="https://github.com/hashicorp/terraform-json/commit/34ea8d07cdb50ef7f326f3b448c847d83aa6543d"><code>34ea8d0</code></a> build(deps): bump actions/setup-go from 6.4.0 to 6.5.0 in the github-actions-...</li> <li><a href="https://github.com/hashicorp/terraform-json/commit/ff68feb930e6e451efa6a0d3a12814c6e6914b90"><code>ff68feb</code></a> Merge pull request <a href="https://redirect.github.com/hashicorp/terraform-json/issues/201">#201</a> from hashicorp/dependabot/github_actions/github-actio...</li> <li><a href="https://github.com/hashicorp/terraform-json/commit/f3efae01e492b24275fb33ca93c6130ee479c48f"><code>f3efae0</code></a> build(deps): bump actions/checkout in the github-actions-breaking group</li> <li><a href="https://github.com/hashicorp/terraform-json/commit/09661535096ac52ee85bc4d4968c0a629f1c60e8"><code>0966153</code></a> Merge pull request <a href="https://redirect.github.com/hashicorp/terraform-json/issues/200">#200</a> from renescheepers/rs/add-action-reason</li> <li><a href="https://github.com/hashicorp/terraform-json/commit/b4487cdd6112b7d1d0a4e270ec0f953ac9718d57"><code>b4487cd</code></a> Link ActionReason constants to Terraform's canonical enum</li> <li><a href="https://github.com/hashicorp/terraform-json/commit/eefb8b2ce8d8e1de832e1033408b3ccb122f73b5"><code>eefb8b2</code></a> Add ActionReason to ResourceChange</li> <li><a href="https://github.com/hashicorp/terraform-json/commit/5738e0ad057af2f241a1d79cbaeb9e52c451bfb3"><code>5738e0a</code></a> build(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions-...</li> <li><a href="https://github.com/hashicorp/terraform-json/commit/e77c39ee5a16d93861c6e3e99fd2aea148399e6d"><code>e77c39e</code></a> Merge pull request <a href="https://redirect.github.com/hashicorp/terraform-json/issues/196">#196</a> from hashicorp/dependabot/go_modules/github.com/hashi...</li> <li><a href="https://github.com/hashicorp/terraform-json/commit/703bd74a48e5461b40eeb5b5663f7f58be3fad52"><code>703bd74</code></a> build(deps): bump github.com/hashicorp/go-version from 1.8.0 to 1.9.0</li> <li>Additional commits viewable in <a href="https://github.com/hashicorp/terraform-json/compare/v0.27.2...v0.28.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/hashicorp/terraform-json&package-manager=go_modules&previous-version=0.27.2&new-version=0.28.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-14 11:20:24 +00:00
dependabot[bot]	20435f9f43	chore: bump the x group with 8 updates (#27223 ) Bumps the x group with 8 updates: \| Package \| From \| To \| \| --- \| --- \| --- \| \| [golang.org/x/crypto](https://github.com/golang/crypto) \| `0.53.0` \| `0.54.0` \| \| [golang.org/x/mod](https://github.com/golang/mod) \| `0.37.0` \| `0.38.0` \| \| [golang.org/x/net](https://github.com/golang/net) \| `0.56.0` \| `0.57.0` \| \| [golang.org/x/sync](https://github.com/golang/sync) \| `0.21.0` \| `0.22.0` \| \| [golang.org/x/sys](https://github.com/golang/sys) \| `0.46.0` \| `0.47.0` \| \| [golang.org/x/term](https://github.com/golang/term) \| `0.44.0` \| `0.45.0` \| \| [golang.org/x/text](https://github.com/golang/text) \| `0.39.0` \| `0.40.0` \| \| [golang.org/x/tools](https://github.com/golang/tools) \| `0.47.0` \| `0.48.0` \| Updates `golang.org/x/crypto` from 0.53.0 to 0.54.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/crypto/commit/cdce021fa6c7d9c7eb2743bfbe551f0a98fd5d62"><code>cdce021</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/crypto/commit/d9474cc4853d9ef1a29356975408d4771e5770c6"><code>d9474cc</code></a> openpgp: make the deprecation message more explicit</li> <li><a href="https://github.com/golang/crypto/commit/7626c5025624025bb44739a805f431cf93c06d6e"><code>7626c50</code></a> ssh: verify declared key type matches decoded key in authorized_keys</li> <li><a href="https://github.com/golang/crypto/commit/0471e7969e6740594dfe354646bf03e5e89de52d"><code>0471e79</code></a> ssh/agent: enforce strict limits on DSA key parameters</li> <li><a href="https://github.com/golang/crypto/commit/6435c37ab681759aff37ba751d0f2238b3043767"><code>6435c37</code></a> ssh: sanitize client disconnect messages</li> <li><a href="https://github.com/golang/crypto/commit/7d695da948bfa44ed6eedcebc8f43bcb50e94a57"><code>7d695da</code></a> ssh/agent: drain channel stderr in agent forwarders</li> <li><a href="https://github.com/golang/crypto/commit/5b7f84159940519e89df4d95465538c1797cee8b"><code>5b7f841</code></a> acme/autocert: fix data race in Manager.createCert</li> <li><a href="https://github.com/golang/crypto/commit/0b316e7ee409f8e5789a0535679d34155cecc75e"><code>0b316e7</code></a> argon2: update RFC 9106 parameter recommendations</li> <li><a href="https://github.com/golang/crypto/commit/55aec0a86b4c522b4f7366e69db55349e9f7ff5c"><code>55aec0a</code></a> x509roots/fallback: update bundle</li> <li><a href="https://github.com/golang/crypto/commit/5f2de1a9f1e29059fbb9f3d34321bd0da935556b"><code>5f2de1a</code></a> internal: remove wycheproof tests</li> <li>See full diff in <a href="https://github.com/golang/crypto/compare/v0.53.0...v0.54.0">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/mod` from 0.37.0 to 0.38.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/mod/commit/792ac169a90372d88fb14e712cb793061ba0c104"><code>792ac16</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/mod/commit/fe2ec04f7c3c3aa6fad97631aafcff6e49e2d1db"><code>fe2ec04</code></a> all: fix some comments to improve readability</li> <li>See full diff in <a href="https://github.com/golang/mod/compare/v0.37.0...v0.38.0">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/net` from 0.56.0 to 0.57.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/net/commit/b8f09f6f062ceb4531b7af4bd17a5c8fe9c4b2b5"><code>b8f09f6</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/net/commit/f05f21be5927155a88b371674c298ada54b71cf5"><code>f05f21b</code></a> idna: reject all-ASCII xn-- labels on all Go versions</li> <li><a href="https://github.com/golang/net/commit/0f748cfbba95084c87723e3b7eb7dad9241fc2dd"><code>0f748cf</code></a> internal/http3: clean up stream I/O methods usages in tests</li> <li><a href="https://github.com/golang/net/commit/0bb961e45132c680e2a0117e1df951538a19da61"><code>0bb961e</code></a> internal/http3: add net/http.ResponseController support</li> <li><a href="https://github.com/golang/net/commit/0ca694d2a5adcce7f36d4d65e5f8d72390d94051"><code>0ca694d</code></a> webdav: document Dir's lack of defense against filesystem modification</li> <li><a href="https://github.com/golang/net/commit/bd5f1dcf71cf0d6d2424021d0a04f191396a46a7"><code>bd5f1dc</code></a> http2: initialize Transport on NewClientConn</li> <li><a href="https://github.com/golang/net/commit/488ff63197ffddbcef2d01107f8a89906a4f28d1"><code>488ff63</code></a> bpf: add security considerations to package docs</li> <li><a href="https://github.com/golang/net/commit/93d1f25be95961edfdf488b9398e53fb9f05f193"><code>93d1f25</code></a> xsrftoken: avoid token collisions</li> <li><a href="https://github.com/golang/net/commit/5a3baee349e65853c34b4377bebe7676a64dbc87"><code>5a3baee</code></a> internal/http3: prevent panic in QPACK decoder due to overflow</li> <li>See full diff in <a href="https://github.com/golang/net/compare/v0.56.0...v0.57.0">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/sync` from 0.21.0 to 0.22.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/sync/commit/1eb64d4bc0cde6da1bb8ebc7f178bb577508e5d0"><code>1eb64d4</code></a> semaphore: panic on negative weights</li> <li>See full diff in <a href="https://github.com/golang/sync/compare/v0.21.0...v0.22.0">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/sys` from 0.46.0 to 0.47.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/sys/commit/9e7e939dcafac07e8ab4cffa6e5fc74908413f00"><code>9e7e939</code></a> cpu: handle vendor suffixes in parseRelease</li> <li><a href="https://github.com/golang/sys/commit/f6fb8a1e42b1731ca8f87ace29c3307429ecdb5a"><code>f6fb8a1</code></a> unix: use epoll_pwait rather than epoll_wait</li> <li><a href="https://github.com/golang/sys/commit/f3eeabfcab6a9a0585ddee7337d5ccfeebe576ed"><code>f3eeabf</code></a> windows: avoid length overflow in NewNTString</li> <li><a href="https://github.com/golang/sys/commit/3cb66475f895724679601e2580be904c8aaa5f7a"><code>3cb6647</code></a> unix: update glibc to 2.43</li> <li><a href="https://github.com/golang/sys/commit/c507910bb52510a2ae06048a4246ad0fe210a872"><code>c507910</code></a> windows: document safe usage of TrusteeValue</li> <li>See full diff in <a href="https://github.com/golang/sys/compare/v0.46.0...v0.47.0">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/term` from 0.44.0 to 0.45.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/term/commit/9f69229da31ca6a34b522f59dbe07cad5ea21587"><code>9f69229</code></a> go.mod: update golang.org/x dependencies</li> <li>See full diff in <a href="https://github.com/golang/term/compare/v0.44.0...v0.45.0">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/text` from 0.39.0 to 0.40.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/text/commit/724af9c35838492dcaacc1ac51a8a0187c994c54"><code>724af9c</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/text/commit/bf5b9d658a03d36bd3459b3babdb23a9f56038cb"><code>bf5b9d6</code></a> internal/export/idna: always treat Punycode encoding pure ASCII as an error</li> <li>See full diff in <a href="https://github.com/golang/text/compare/v0.39.0...v0.40.0">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/tools` from 0.47.0 to 0.48.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/tools/commit/05f9cb5d358503005bd6f82b17916d226ca7b210"><code>05f9cb5</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/tools/commit/745d7ae955f815a23f71eea6c5825e1a60308578"><code>745d7ae</code></a> gopls: add CompiledAsmFiles in cache.Package</li> <li><a href="https://github.com/golang/tools/commit/797ee67e8547c21742c14f38d01bf3e54dad6aad"><code>797ee67</code></a> go/ssa: make Const(unsafe.Pointer, nil).IsNil() true</li> <li><a href="https://github.com/golang/tools/commit/9751125d7187ef7b7f3e66c20925c2099be7e934"><code>9751125</code></a> gopls/internal/test: Completion benchmarks use empty range</li> <li><a href="https://github.com/golang/tools/commit/8786a967dbbb73b985c6345d652594422f995717"><code>8786a96</code></a> internal/stdlib: update stdlib index for Go 1.27 Release Candidate 2</li> <li><a href="https://github.com/golang/tools/commit/425085f6dee3cf40e111b5d2e8cc139ff52c55ee"><code>425085f</code></a> gopls/internal/server: modify return of parseAction</li> <li><a href="https://github.com/golang/tools/commit/30c4f871093496f7e4492bad5d49cac24587eeda"><code>30c4f87</code></a> go/analysis/passes/nilness: skip magic cgo functions</li> <li><a href="https://github.com/golang/tools/commit/9e6441dfc70bdc98114c748afe34d7cd49b2d0b0"><code>9e6441d</code></a> gopls/internal/protocol/generate: remove manual rename overwritten</li> <li><a href="https://github.com/golang/tools/commit/df9684197301c2e2c2a34a56a329f667fd93637b"><code>df96841</code></a> gopls/internal/protocol: use Debug log level</li> <li><a href="https://github.com/golang/tools/commit/278f0628682b5732f29a5ef0083c860de88c5b94"><code>278f062</code></a> gopls/internal/protocol: update to LSP 3.18</li> <li>Additional commits viewable in <a href="https://github.com/golang/tools/compare/v0.47.0...v0.48.0">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-14 11:20:11 +00:00
dependabot[bot]	26c8fc85a2	chore: bump github.com/prometheus/common from 0.69.0 to 0.70.0 (#27225 ) Bumps [github.com/prometheus/common](https://github.com/prometheus/common) from 0.69.0 to 0.70.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/prometheus/common/releases">github.com/prometheus/common's releases</a>.</em></p> <blockquote> <h2>v0.70.0</h2> <h2>What's Changed</h2> <ul> <li>config: fix TLSVersion.String() printing pointer address by <a href="https://github.com/s3onghyun"><code>@s3onghyun</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/929">prometheus/common#929</a></li> <li>build(deps): bump golang.org/x/net from 0.55.0 to 0.56.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/common/pull/933">prometheus/common#933</a></li> <li>Manually go mod tidy by <a href="https://github.com/SuperQ"><code>@SuperQ</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/934">prometheus/common#934</a></li> <li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@prombot</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/937">prometheus/common#937</a></li> <li>route: add support for the QUERY HTTP method by <a href="https://github.com/roidelapluie"><code>@roidelapluie</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/932">prometheus/common#932</a></li> <li>Combine and extend Prometheus text and OpenMetrics 1.0 encoder benchmarks by <a href="https://github.com/dashpole"><code>@dashpole</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/943">prometheus/common#943</a></li> <li>build(deps): bump the codeql group with 4 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/common/pull/938">prometheus/common#938</a></li> <li>build(deps): bump actions/setup-go from 6.2.0 to 6.5.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/common/pull/940">prometheus/common#940</a></li> <li>build(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/common/pull/942">prometheus/common#942</a></li> <li>build(deps): bump ossf/scorecard-action from 2.1.2 to 2.4.3 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/common/pull/939">prometheus/common#939</a></li> <li>build(deps): bump actions/checkout from 3.1.0 to 7.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/common/pull/941">prometheus/common#941</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/s3onghyun"><code>@s3onghyun</code></a> made their first contribution in <a href="https://redirect.github.com/prometheus/common/pull/929">prometheus/common#929</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/prometheus/common/compare/v0.69.0...v0.70.0">https://github.com/prometheus/common/compare/v0.69.0...v0.70.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/prometheus/common/blob/main/CHANGELOG.md">github.com/prometheus/common's changelog</a>.</em></p> <blockquote> <h2>v0.70.0 / 2026-07-10</h2> <h3>Enhancements</h3> <ul> <li>route: add support for the QUERY HTTP method. <a href="https://redirect.github.com/prometheus/common/issues/932">#932</a></li> </ul> <h3>Bugfixes</h3> <ul> <li>config: fix <code>TLSVersion.String()</code> printing a pointer address instead of the numeric version for unknown TLS versions. <a href="https://redirect.github.com/prometheus/common/issues/929">#929</a></li> </ul> <h3>Internal</h3> <ul> <li>expfmt: add <code>BenchmarkConvertMetricFamily</code> comparing the Prometheus text and OpenMetrics 1.0 encoders. <a href="https://redirect.github.com/prometheus/common/issues/943">#943</a></li> <li>Update Go dependencies. <a href="https://redirect.github.com/prometheus/common/issues/933">#933</a> <a href="https://redirect.github.com/prometheus/common/issues/934">#934</a></li> <li>Synchronize common files from prometheus/prometheus. <a href="https://redirect.github.com/prometheus/common/issues/923">#923</a> <a href="https://redirect.github.com/prometheus/common/issues/927">#927</a> <a href="https://redirect.github.com/prometheus/common/issues/930">#930</a> <a href="https://redirect.github.com/prometheus/common/issues/937">#937</a></li> <li>Update GitHub Actions. <a href="https://redirect.github.com/prometheus/common/issues/938">#938</a> <a href="https://redirect.github.com/prometheus/common/issues/939">#939</a> <a href="https://redirect.github.com/prometheus/common/issues/940">#940</a> <a href="https://redirect.github.com/prometheus/common/issues/941">#941</a> <a href="https://redirect.github.com/prometheus/common/issues/942">#942</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/prometheus/common/compare/v0.69.0...v0.70.0">https://github.com/prometheus/common/compare/v0.69.0...v0.70.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/prometheus/common/commit/5eff7a827920b6f175ea02b222f7c827a0fe80ad"><code>5eff7a8</code></a> Merge pull request <a href="https://redirect.github.com/prometheus/common/issues/941">#941</a> from prometheus/dependabot/github_actions/actions/che...</li> <li><a href="https://github.com/prometheus/common/commit/a23c5b344ad9200c0073133920fe60a9882c9d28"><code>a23c5b3</code></a> Merge pull request <a href="https://redirect.github.com/prometheus/common/issues/939">#939</a> from prometheus/dependabot/github_actions/ossf/scorec...</li> <li><a href="https://github.com/prometheus/common/commit/9e1eb871ced38b03648a38558ac3de66edeff2b5"><code>9e1eb87</code></a> Merge pull request <a href="https://redirect.github.com/prometheus/common/issues/942">#942</a> from prometheus/dependabot/github_actions/actions/upl...</li> <li><a href="https://github.com/prometheus/common/commit/ab2736d28a9fce77b0186e36b5d3318b74115298"><code>ab2736d</code></a> Merge pull request <a href="https://redirect.github.com/prometheus/common/issues/940">#940</a> from prometheus/dependabot/github_actions/actions/set...</li> <li><a href="https://github.com/prometheus/common/commit/e596873192a72855876b1c38cdb634bb73f5ba00"><code>e596873</code></a> Merge pull request <a href="https://redirect.github.com/prometheus/common/issues/938">#938</a> from prometheus/dependabot/github_actions/codeql-ac07...</li> <li><a href="https://github.com/prometheus/common/commit/97c066a87b2345f146b345141f0f14aaab7ad387"><code>97c066a</code></a> Add BenchmarkConvertMetricFamily comparing Prometheus text and OpenMetrics 1....</li> <li><a href="https://github.com/prometheus/common/commit/62e9d0f61d355b574225f66628a5f94be2bc1c29"><code>62e9d0f</code></a> Merge pull request <a href="https://redirect.github.com/prometheus/common/issues/932">#932</a> from roidelapluie/roidelapluie/route-query</li> <li><a href="https://github.com/prometheus/common/commit/6c312397a5da723c995ee9c16263f252c1d6b4a1"><code>6c31239</code></a> build(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1</li> <li><a href="https://github.com/prometheus/common/commit/755e9d686dec00400191cc8483872831aff1b9cd"><code>755e9d6</code></a> build(deps): bump actions/checkout from 3.1.0 to 7.0.0</li> <li><a href="https://github.com/prometheus/common/commit/556d7402ea9a80cab60297e4dc98149b5410e24f"><code>556d740</code></a> build(deps): bump actions/setup-go from 6.2.0 to 6.5.0</li> <li>Additional commits viewable in <a href="https://github.com/prometheus/common/compare/v0.69.0...v0.70.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/prometheus/common&package-manager=go_modules&previous-version=0.69.0&new-version=0.70.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-14 11:20:04 +00:00
dependabot[bot]	7470f072a2	chore: bump github.com/coreos/go-oidc/v3 from 3.19.0 to 3.20.0 (#27224 ) Bumps [github.com/coreos/go-oidc/v3](https://github.com/coreos/go-oidc) from 3.19.0 to 3.20.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/coreos/go-oidc/releases">github.com/coreos/go-oidc/v3's releases</a>.</em></p> <blockquote> <h2>v3.20.0</h2> <h2>What's Changed</h2> <ul> <li>oidc: modernize with new Go APIs by <a href="https://github.com/ericchiang"><code>@ericchiang</code></a> in <a href="https://redirect.github.com/coreos/go-oidc/pull/487">coreos/go-oidc#487</a></li> <li>oidc: improve documentation for APIs by <a href="https://github.com/ericchiang"><code>@ericchiang</code></a> in <a href="https://redirect.github.com/coreos/go-oidc/pull/488">coreos/go-oidc#488</a></li> <li>SECURITY.md: add a security policy and point to project-level reporting by <a href="https://github.com/ericchiang"><code>@ericchiang</code></a> in <a href="https://redirect.github.com/coreos/go-oidc/pull/489">coreos/go-oidc#489</a></li> <li>oidc: ignore JWKs with unknown signing algorithms rather than failing by <a href="https://github.com/ericchiang"><code>@ericchiang</code></a> in <a href="https://redirect.github.com/coreos/go-oidc/pull/491">coreos/go-oidc#491</a></li> <li>readme: update README and docs by <a href="https://github.com/ericchiang"><code>@ericchiang</code></a> in <a href="https://redirect.github.com/coreos/go-oidc/pull/492">coreos/go-oidc#492</a></li> <li>oidc: add API for determining when issuer URLs mismatch by <a href="https://github.com/ericchiang"><code>@ericchiang</code></a> in <a href="https://redirect.github.com/coreos/go-oidc/pull/493">coreos/go-oidc#493</a></li> <li>oidc: add constants for "email" and "profile" scopes by <a href="https://github.com/ericchiang"><code>@ericchiang</code></a> in <a href="https://redirect.github.com/coreos/go-oidc/pull/494">coreos/go-oidc#494</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/coreos/go-oidc/compare/v3.19.0...v3.20.0">https://github.com/coreos/go-oidc/compare/v3.19.0...v3.20.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/coreos/go-oidc/commit/75dfa5c0626c48e0ad8b761fdd9e1dc51cb8498a"><code>75dfa5c</code></a> oidc: add constants for "email" and "profile" scopes</li> <li><a href="https://github.com/coreos/go-oidc/commit/a89f0468ccc8e531b54f469053674a12c2258c72"><code>a89f046</code></a> oidc: add API for determining when issuer URLs mismatch</li> <li><a href="https://github.com/coreos/go-oidc/commit/6a69b6d27e137b9919e468417e438b02c51a54b2"><code>6a69b6d</code></a> readme: update README and docs</li> <li><a href="https://github.com/coreos/go-oidc/commit/f9049c99079786740d492714fb33b671464312dd"><code>f9049c9</code></a> oidc: ignore JWKs with unknown signing algorithms rather than failing</li> <li><a href="https://github.com/coreos/go-oidc/commit/2f178e0a9df71f65464a9a8d25c388e798303323"><code>2f178e0</code></a> SECURITY.md: add a security policy and point to project-level reporting</li> <li><a href="https://github.com/coreos/go-oidc/commit/b3bc7daa5743acd0b6c604ad7e5c9b609b6d39f4"><code>b3bc7da</code></a> oidc: improve documentation for APIs</li> <li><a href="https://github.com/coreos/go-oidc/commit/0db90530b3f5ab1808b26365441e366926b86f0b"><code>0db9053</code></a> oidc: modernize with new Go APIs</li> <li>See full diff in <a href="https://github.com/coreos/go-oidc/compare/v3.19.0...v3.20.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/coreos/go-oidc/v3&package-manager=go_modules&previous-version=3.19.0&new-version=3.20.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-14 11:19:52 +00:00
dependabot[bot]	ce846fc401	chore: bump google.golang.org/api from 0.287.0 to 0.288.0 (#27226 ) Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.287.0 to 0.288.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's releases</a>.</em></p> <blockquote> <h2>v0.288.0</h2> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.287.1...v0.288.0">0.288.0</a> (2026-07-09)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3647">#3647</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/510a0c19483ea5631b7b0a453f9d6df1b9ef596a">510a0c1</a>)</li> </ul> <h2>v0.287.1</h2> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.287.0...v0.287.1">0.287.1</a> (2026-07-07)</h2> <h3>Documentation</h3> <ul> <li>Remove old TODO file (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3645">#3645</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/9d7a6b8ba7ca7fda1fda4373714a8aff1e930e6f">9d7a6b8</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.287.1...v0.288.0">0.288.0</a> (2026-07-09)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3647">#3647</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/510a0c19483ea5631b7b0a453f9d6df1b9ef596a">510a0c1</a>)</li> </ul> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.287.0...v0.287.1">0.287.1</a> (2026-07-07)</h2> <h3>Documentation</h3> <ul> <li>Remove old TODO file (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3645">#3645</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/9d7a6b8ba7ca7fda1fda4373714a8aff1e930e6f">9d7a6b8</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/googleapis/google-api-go-client/commit/31d2afed7eb393f33e56bdbaf0b17bc7c5345abc"><code>31d2afe</code></a> chore(main): release 0.288.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3648">#3648</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/510a0c19483ea5631b7b0a453f9d6df1b9ef596a"><code>510a0c1</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3647">#3647</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/93d63e8234f46095c363aff86b433c750ccd7332"><code>93d63e8</code></a> chore(main): release 0.287.1 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3646">#3646</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/9d7a6b8ba7ca7fda1fda4373714a8aff1e930e6f"><code>9d7a6b8</code></a> docs: remove old TODO file (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3645">#3645</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/576018ff14470f5cf33aa1a1d388d219a5291e40"><code>576018f</code></a> chore(all): update all (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3644">#3644</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/cc70265cdfbc6c3d6ccbd7b068ff70a9c3695893"><code>cc70265</code></a> chore(deps): bump golang.org/x/net in /internal/kokoro/discogen (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3642">#3642</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/9858f66b46ba1fdea7dacf1a02b47c0881e2c27a"><code>9858f66</code></a> chore: downgrade go version in go.work (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3641">#3641</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/3cb00c0ab3ced21614ceb1f8e3e664f6d8ff7712"><code>3cb00c0</code></a> chore: downgrade min Go version (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3640">#3640</a>)</li> <li>See full diff in <a href="https://github.com/googleapis/google-api-go-client/compare/v0.287.0...v0.288.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/api&package-manager=go_modules&previous-version=0.287.0&new-version=0.288.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-14 11:19:41 +00:00
Denis Afonso	553c9ecbc8	fix: bump Go version from 1.26.4 to 1.26.5 (#27157 ) ## Summary Bump Go toolchain from 1.26.4 to 1.26.5. Go 1.26.5 ([released 2026-07-07](https://go.dev/doc/devel/release#go1.26.5)) includes security fixes addressing: - [CVE-2026-39822](https://nvd.nist.gov/vuln/detail/CVE-2026-39822) — `os` package - [CVE-2026-42505](https://nvd.nist.gov/vuln/detail/CVE-2026-42505) — `crypto/tls` package These were flagged by the IronBank scan of `coder/coder-enterprise/coder-service-2:2.34.5`. ## Changes - `go.mod`: `go 1.26.4` to `go 1.26.5` (language version floor) - `mise.toml` / `mise.lock`: Go toolchain pin 1.26.4 to 1.26.5 (this is what actually compiles the scanned artifact and clears the CVEs) ## Related - #27159 — backport to `release/2.35` - #27158 — backport to `release/2.34` Linear: ENT-129	2026-07-14 12:49:05 +02:00
Michael Suchacz	f84801eecf	chore: bump coder/fantasy for gpt-5.6 Responses routing (#27132 ) gpt-5.6 models were unusable with agents: fantasy's Responses allowlist did not include the new family, so `IsResponsesModel` returned false and chatd fell back to the Chat Completions path (no reasoning params, no encrypted reasoning continuity). ## Changes - Bump the `charm.land/fantasy` replace pin to coder/fantasy `6da0c3b10237` (coder_2_33), pulling in: - coder/fantasy#46: route `gpt-5.6-sol`, `gpt-5.6-terra`, `gpt-5.6-luna` through the OpenAI Responses API as reasoning models. - coder/fantasy#41: surface Anthropic refusal stop_reason as content-filter (already on coder_2_33, rides along with the bump). - Update the fork changelog comment in go.mod. ## Verification - Probed all three gpt-5.6 models through the ai-gateway: `/v1/responses` with `reasoning.effort`, `include: ["reasoning.encrypted_content"]`, and `store: false` completes for each. - `go build ./coderd/...` and `go test ./coderd/x/chatd/chatopenai/ ./coderd/x/chatd/chatprovider/` pass against the new pin. > This PR was authored by Mux on Mike's behalf.	2026-07-09 18:25:34 +00:00
Danny Kopping	f2e8d72100	chore: apply openai-go bugfix to fix openrouter response parsing (#27092 ) Applies https://github.com/coder/openai-go/pull/3 Closes https://github.com/coder/coder/issues/26469 `kylecarbs/openai-go` was renamed to `coder/openai-go` I've created a [branch](https://github.com/coder/openai-go/tree/coder/pinned) to track the changes we've made. We're far behind `main` now, so we should make an effort to update this as some point. I've manually tested using OpenRouter + GLM 5.2 as the bug report states and it works fine. <img width="824" height="321" alt="image" src="https://github.com/user-attachments/assets/804c527a-3a59-43bd-91c8-3b9bfb48df81" /> <img width="927" height="149" alt="image" src="https://github.com/user-attachments/assets/35829bc2-5597-430c-8ede-bb2ebabc73a5" /> <details> ``` : OPENROUTER PROCESSING : OPENROUTER PROCESSING : OPENROUTER PROCESSING : OPENROUTER PROCESSING : OPENROUTER PROCESSING : OPENROUTER PROCESSING : OPENROUTER PROCESSING : OPENROUTER PROCESSING : OPENROUTER PROCESSING : OPENROUTER PROCESSING : OPENROUTER PROCESSING : OPENROUTER PROCESSING : OPENROUTER PROCESSING : OPENROUTER PROCESSING : OPENROUTER PROCESSING : OPENROUTER PROCESSING data: {"id":"gen-1783515596-pm90JeoPBXFHqVq3dDlL","object":"chat.completion.chunk","created":1783515596,"model":"z-ai/glm-5.2-20260616","provider":"Novita","choices":[{"index":0,"delta":{"content":"Yep","role":"assistant"},"finish_reason":null,"native_finish_reason":null}]} data: {"id":"gen-1783515596-pm90JeoPBXFHqVq3dDlL","object":"chat.completion.chunk","created":1783515596,"model":"z-ai/glm-5.2-20260616","provider":"Novita","choices":[{"index":0,"delta":{"content":", I","role":"assistant"},"finish_reason":null,"native_finish_reason":null}]} data: {"id":"gen-1783515596-pm90JeoPBXFHqVq3dDlL","object":"chat.completion.chunk","created":1783515596,"model":"z-ai/glm-5.2-20260616","provider":"Novita","choices":[{"index":0,"delta":{"content":"'m here","role":"assistant"},"finish_reason":null,"native_finish_reason":null}]} data: {"id":"gen-1783515596-pm90JeoPBXFHqVq3dDlL","object":"chat.completion.chunk","created":1783515596,"model":"z-ai/glm-5.2-20260616","provider":"Novita","choices":[{"index":0,"delta":{"content":". What","role":"assistant"},"finish_reason":null,"native_finish_reason":null}]} data: {"id":"gen-1783515596-pm90JeoPBXFHqVq3dDlL","object":"chat.completion.chunk","created":1783515596,"model":"z-ai/glm-5.2-20260616","provider":"Novita","choices":[{"index":0,"delta":{"content":" do you","role":"assistant"},"finish_reason":null,"native_finish_reason":null}]} : OPENROUTER PROCESSING data: {"id":"gen-1783515596-pm90JeoPBXFHqVq3dDlL","object":"chat.completion.chunk","created":1783515596,"model":"z-ai/glm-5.2-20260616","provider":"Novita","choices":[{"index":0,"delta":{"content":" need?","role":"assistant"},"finish_reason":null,"native_finish_reason":null}]} data: {"id":"gen-1783515596-pm90JeoPBXFHqVq3dDlL","object":"chat.completion.chunk","created":1783515596,"model":"z-ai/glm-5.2-20260616","provider":"Novita","choices":[{"index":0,"delta":{"content":"","role":"assistant"},"finish_reason":"stop","native_finish_reason":"stop"}]} data: {"id":"gen-1783515596-pm90JeoPBXFHqVq3dDlL","object":"chat.completion.chunk","created":1783515596,"model":"z-ai/glm-5.2-20260616","provider":"Novita","service_tier":null,"choices":[{"index":0,"delta":{"content":"","role":"assistant"},"finish_reason":"stop","native_finish_reason":"stop"}],"usage":{"prompt_tokens":4855,"completion_tokens":13,"total_tokens":4868,"cost":0.00479794,"is_byok":false,"prompt_tokens_details":{"cached_tokens":0,"cache_write_tokens":0,"audio_tokens":0,"video_tokens":0},"cost_details":{"upstream_inference_cost":0.00479794,"upstream_inference_prompt_cost":0.0047579,"upstream_inference_completions_cost":0.00004004},"completion_tokens_details":{"reasoning_tokens":0,"image_tokens":0,"audio_tokens":0}}} data: [DONE] ``` </details> Signed-off-by: Danny Kopping <danny@coder.com>	2026-07-08 13:36:42 +00:00
dependabot[bot]	fd77652993	chore: bump github.com/zclconf/go-cty from 1.18.1 to 1.19.0 (#27053 ) Bumps [github.com/zclconf/go-cty](https://github.com/zclconf/go-cty) from 1.18.1 to 1.19.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/zclconf/go-cty/blob/main/CHANGELOG.md">github.com/zclconf/go-cty's changelog</a>.</em></p> <blockquote> <h1>1.19.0 (July 6, 2026)</h1> <ul> <li>When building with Go 1.27 or later, the various string operations that are defined in terms of UAX#29 grapheme cluster segmentation will now use the Unicode 17 character properties and rules. For older versions of Go, Unicode 15 is still used.</li> <li>The <code>cty.ValueMarks</code> type, which represents a set of value marks separately from any value, now has method <code>Has</code> for concisely testing if a specific mark is present, and <code>Insert</code> for inserting elements from an <code>iter.Seq[any]</code> into an existing set of marks for easier gradual construction without creating any temporary mark sets.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/zclconf/go-cty/commit/749fb01316b34f996526dc0a799b54ee008436a8"><code>749fb01</code></a> v1.19.0</li> <li><a href="https://github.com/zclconf/go-cty/commit/f6d59fa6af526d7ef9a296ee0fee01ccd3c64840"><code>f6d59fa</code></a> ValueMarks.Has and ValueMarks.Insert</li> <li><a href="https://github.com/zclconf/go-cty/commit/db1a4101f6f4a1ecd63bf25bfd53e7709a2e7e0b"><code>db1a410</code></a> Use Unicode 17 text segmentation rules on Go 1.27</li> <li><a href="https://github.com/zclconf/go-cty/commit/c8df66764124f2e53f491d4d4a4620c13e3b914d"><code>c8df667</code></a> json: Compensate for different JSON error message in Go1.27</li> <li><a href="https://github.com/zclconf/go-cty/commit/9d8f06e30ed204b49a68845101c48c8d439f598b"><code>9d8f06e</code></a> convert: Fix incorrect format string in TestSortTypes</li> <li>See full diff in <a href="https://github.com/zclconf/go-cty/compare/v1.18.1...v1.19.0">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-07 11:36:29 +00:00
dependabot[bot]	7b5efe0e14	chore: bump google.golang.org/api from 0.286.0 to 0.287.0 (#27056 ) Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.286.0 to 0.287.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's releases</a>.</em></p> <blockquote> <h2>v0.287.0</h2> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.286.0...v0.287.0">0.287.0</a> (2026-06-30)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3635">#3635</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/504873e45d4a0993065311ed3f6a0467f2c41ab1">504873e</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3637">#3637</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/5c975bee9f05d3c570eb0d95be248f3cb418739f">5c975be</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3639">#3639</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/9737c4bf678023b300958b55d1548a902ff36c5d">9737c4b</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.286.0...v0.287.0">0.287.0</a> (2026-06-30)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3635">#3635</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/504873e45d4a0993065311ed3f6a0467f2c41ab1">504873e</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3637">#3637</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/5c975bee9f05d3c570eb0d95be248f3cb418739f">5c975be</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3639">#3639</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/9737c4bf678023b300958b55d1548a902ff36c5d">9737c4b</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/googleapis/google-api-go-client/commit/1a444d6fac14a1652ec4a1e0d9eba6fb1bda7045"><code>1a444d6</code></a> chore(main): release 0.287.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3636">#3636</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/9737c4bf678023b300958b55d1548a902ff36c5d"><code>9737c4b</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3639">#3639</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/f0d27e84fd7323958b8700c2da4b496d96561a3d"><code>f0d27e8</code></a> chore(all): update all (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3638">#3638</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/5c975bee9f05d3c570eb0d95be248f3cb418739f"><code>5c975be</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3637">#3637</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/504873e45d4a0993065311ed3f6a0467f2c41ab1"><code>504873e</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3635">#3635</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/8f8eab49770458a0890a0dde6780568a99057776"><code>8f8eab4</code></a> chore(all): update all to 87f3d3e (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3633">#3633</a>)</li> <li>See full diff in <a href="https://github.com/googleapis/google-api-go-client/compare/v0.286.0...v0.287.0">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-07 11:36:20 +00:00
dependabot[bot]	c9109247e9	chore: bump google.golang.org/grpc from 1.81.1 to 1.82.0 (#27054 ) Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.81.1 to 1.82.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/grpc/grpc-go/releases">google.golang.org/grpc's releases</a>.</em></p> <blockquote> <h2>Release 1.82.0</h2> <h1>Behavior Changes</h1> <ul> <li>server: Remove support for <code>GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING</code> environment varibale. Strict incoming RPC path validation (which has been the default since <code>v1.79.3</code>) can no longer be disabled. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9112">#9112</a>)</li> <li>transport: Add environment variable to change the default max header list size from <code>16MB</code> to <code>8KB</code>. This may be enabled by setting <code>GRPC_GO_EXPERIMENTAL_ENABLE_8KB_DEFAULT_HEADER_LIST_SIZE=true</code>. This will be enabled by default in a subsequent release. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9019">#9019</a>)</li> <li>balancer: Load Balancing policy registry is now case-sensitive. Set <code>GRPC_GO_EXPERIMENTAL_CASE_SENSITIVE_BALANCER_REGISTRIES=false</code> (and file an issue) to revert to case-insensitive behavior. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9017">#9017</a>)</li> </ul> <h1>New Features</h1> <ul> <li>experimental/stats: Expose a new API, <code>NewContextWithLabelCallback</code>, to register a callback that is invoked when telemetry labels are added. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8877">#8877</a>) <ul> <li>Special Thanks: <a href="https://github.com/seth-epps"><code>@seth-epps</code></a></li> </ul> </li> <li>client: Return a portion of the response body in the error message, when the client receives an unexpected non-gRPC HTTP response, to make debugging easier. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8929">#8929</a>) <ul> <li>Special Thanks: <a href="https://github.com/chengxilo"><code>@chengxilo</code></a></li> </ul> </li> <li>server: Add environment variable <code>GRPC_GO_SERVER_GOROUTINE_LABELS</code> that controls setting <code>runtime/pprof.Labels</code> on goroutines spawned by the server. Set <code>GRPC_GO_SERVER_GOROUTINE_LABELS=grpc.method=true</code> to add the <code>grpc.method</code> label on goroutines spawned to handle incoming requests. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9082">#9082</a>) <ul> <li>Special Thanks: <a href="https://github.com/dfinkel"><code>@dfinkel</code></a></li> </ul> </li> </ul> <h1>Bug Fixes</h1> <ul> <li>xds/server: Fix a memory leak of HTTP filter instances occurring when route configurations are updated in-place during a Route Discovery Service (RDS) update. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9138">#9138</a>)</li> <li>grpc: In the deprecated <code>gzip</code> Compressor (used via the deprecated <code>WithCompressor</code> dial option), enforce the <code>MaxRecvMsgSize</code> limit on the decompressed message buffer, preventing excessive memory allocation from highly compressed payloads. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9114">#9114</a>) <ul> <li>Special Thanks: <a href="https://github.com/evilgensec"><code>@evilgensec</code></a></li> </ul> </li> <li>stats/opentelemetry: Record retry attempts, <code>grpc.previous-rpc-attempts</code>, at the call level and not the attempt level. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8923">#8923</a>)</li> <li>encoding: Ensure <code>Close()</code> is always called on readers returned from <code>Compressor.Decompress</code> if possible. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9135">#9135</a>)</li> <li>channelz: Fix the <code>LastMessageSentTimestamp</code> and <code>LastMessageReceivedTimestamp</code> fields in <code>SocketMetrics</code> to ensure they contain correct timestamp values. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9109">#9109</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/grpc/grpc-go/commit/bd239854f0ab7f1ee63457d47f7c1d2675e1f736"><code>bd23985</code></a> Change version to 1.82.0 (<a href="https://redirect.github.com/grpc/grpc-go/issues/9170">#9170</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/0f3086db7a755b6af83a90809471dd7f645b345a"><code>0f3086d</code></a> Fix minor issues not covered by PR <a href="https://redirect.github.com/grpc/grpc-go/issues/9137">#9137</a> (<a href="https://redirect.github.com/grpc/grpc-go/issues/9147">#9147</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/fef07fbb2b94b668e8daca1f6b70433dcd36c1c8"><code>fef07fb</code></a> internal: Split v3procservicepb import into pb and grpc for extproc (<a href="https://redirect.github.com/grpc/grpc-go/issues/9163">#9163</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/91dd64f4b83cb5134e279d1126ebb1ccf47d4d31"><code>91dd64f</code></a> transport: surface subsequent data when receiving non-gRPC header (<a href="https://redirect.github.com/grpc/grpc-go/issues/8929">#8929</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/adc97de9521a9f377dab5e911039842dc4de23e5"><code>adc97de</code></a> test/kokoro: add config for regional-td test (<a href="https://redirect.github.com/grpc/grpc-go/issues/9158">#9158</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/57c9ff14e05b535ee6995ba49bc882b287a175de"><code>57c9ff1</code></a> xds: ensure full-string matching for RBAC Filter rules (<a href="https://redirect.github.com/grpc/grpc-go/issues/9148">#9148</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/b58f32d9ff07c612d64e677bd826bcbec88af9bd"><code>b58f32d</code></a> server: Set a pprof label on new stream goroutines (<a href="https://redirect.github.com/grpc/grpc-go/issues/9082">#9082</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/6c98be31ce0aec1592b783b0edb16916eb5acd89"><code>6c98be3</code></a> refactor(transport): extract shared stream state handling logic in `loopyWrit...</li> <li><a href="https://github.com/grpc/grpc-go/commit/bcaa6f4df4546c86e12ef3e95852c7baf7a08d67"><code>bcaa6f4</code></a> rls: only reset backoff on recovery from TRANSIENT_FAILURE (<a href="https://redirect.github.com/grpc/grpc-go/issues/9137">#9137</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/429e6e06363a01f0dd9f9b6b9cf0c0e6617cda12"><code>429e6e0</code></a> balancer: expose endpoint weight and hostname as experimental APIs (<a href="https://redirect.github.com/grpc/grpc-go/issues/9074">#9074</a>)</li> <li>Additional commits viewable in <a href="https://github.com/grpc/grpc-go/compare/v1.81.1...v1.82.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/grpc&package-manager=go_modules&previous-version=1.81.1&new-version=1.82.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-07 11:20:21 +00:00
dependabot[bot]	10d9ad0fc0	chore: bump github.com/go-chi/httprate from 0.15.0 to 0.16.0 (#27055 ) [//]: # (dependabot-start) ⚠️ Dependabot is rebasing this PR ⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Bumps [github.com/go-chi/httprate](https://github.com/go-chi/httprate) from 0.15.0 to 0.16.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-chi/httprate/releases">github.com/go-chi/httprate's releases</a>.</em></p> <blockquote> <h2>v0.16.0</h2> <h2>What's Changed</h2> <ul> <li>perf: replace fmt with strconv to reduce allocations by <a href="https://github.com/EricGusmao"><code>@EricGusmao</code></a> in <a href="https://redirect.github.com/go-chi/httprate/pull/55">go-chi/httprate#55</a></li> <li>local counter: align windows to reset at sub-millisecond counter start by <a href="https://github.com/VojtechVitek"><code>@VojtechVitek</code></a> in <a href="https://redirect.github.com/go-chi/httprate/pull/58">go-chi/httprate#58</a></li> <li>test: drop golang.org/x/sync dependency (errgroup → sync.WaitGroup) by <a href="https://github.com/VojtechVitek"><code>@VojtechVitek</code></a> in <a href="https://redirect.github.com/go-chi/httprate/pull/59">go-chi/httprate#59</a></li> <li>perf: use zero-alloc xxh3.HashString on the local counter hot path by <a href="https://github.com/VojtechVitek"><code>@VojtechVitek</code></a> in <a href="https://redirect.github.com/go-chi/httprate/pull/60">go-chi/httprate#60</a></li> <li>Deprecate spoofable RealIP rate-limiting; add LimitBy + KeyFromContext and modernize the key API by <a href="https://github.com/VojtechVitek"><code>@VojtechVitek</code></a> in <a href="https://redirect.github.com/go-chi/httprate/pull/61">go-chi/httprate#61</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/EricGusmao"><code>@EricGusmao</code></a> made their first contribution in <a href="https://redirect.github.com/go-chi/httprate/pull/55">go-chi/httprate#55</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-chi/httprate/compare/v0.15.0...v0.16.0">https://github.com/go-chi/httprate/compare/v0.15.0...v0.16.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-chi/httprate/commit/741b4a550f982dab146dee10f2b154b01c06facd"><code>741b4a5</code></a> Deprecate spoofable RealIP rate-limiting; add LimitBy + KeyFromContext and mo...</li> <li><a href="https://github.com/go-chi/httprate/commit/81255de73f43306ad57c9cf01693a7d5172678df"><code>81255de</code></a> perf: use zero-alloc xxh3.HashString on the local counter hot path (<a href="https://redirect.github.com/go-chi/httprate/issues/60">#60</a>)</li> <li><a href="https://github.com/go-chi/httprate/commit/0c2093ae43d739627fba9eb197280f97f460c611"><code>0c2093a</code></a> test: replace golang.org/x/sync/errgroup with sync.WaitGroup (<a href="https://redirect.github.com/go-chi/httprate/issues/59">#59</a>)</li> <li><a href="https://github.com/go-chi/httprate/commit/89e5cca2fbfd6645307b73a15b69a979d4c1dcf4"><code>89e5cca</code></a> local counter: align windows to reset at sub-millisecond counter start (<a href="https://redirect.github.com/go-chi/httprate/issues/58">#58</a>)</li> <li><a href="https://github.com/go-chi/httprate/commit/be2ba84c12680b356b271bdf6104c9b465f3c1de"><code>be2ba84</code></a> replace fmt with strconv to reduce allocations (<a href="https://redirect.github.com/go-chi/httprate/issues/55">#55</a>)</li> <li>See full diff in <a href="https://github.com/go-chi/httprate/compare/v0.15.0...v0.16.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-chi/httprate&package-manager=go_modules&previous-version=0.15.0&new-version=0.16.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-07 11:20:04 +00:00
dependabot[bot]	dfef6ae0a7	chore: bump github.com/aws/aws-sdk-go-v2/service/sts from 1.43.3 to 1.44.0 (#27052 ) Bumps [github.com/aws/aws-sdk-go-v2/service/sts](https://github.com/aws/aws-sdk-go-v2) from 1.43.3 to 1.44.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/fa3ee1a83b9edac9669159650622bcfe3003b44c"><code>fa3ee1a</code></a> Release 2023-11-21</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/6e0c553b49b1fd84753d3ea440be93011d36cf40"><code>6e0c553</code></a> Regenerated Clients</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/32fa00b32e99f9004aadc5750d508a9393d03d57"><code>32fa00b</code></a> Update endpoints model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/72eae5c284e11b1f167fe17282ae1ee821a11659"><code>72eae5c</code></a> Update API model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/1c69d08daccf94d9114d2463adc02e59e85b4deb"><code>1c69d08</code></a> fix: don't expect response to be json in endpointcreds provider (<a href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/2381">#2381</a>)</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/3bd97c063d962a34ca496720a3ce00ef4affe5fd"><code>3bd97c0</code></a> fix: don't send 0 max items for object version and multipart upload paginator...</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/b3e07aa0a0dd26ec46095c28ce65301da2e78dba"><code>b3e07aa</code></a> Release 2023-11-20</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/2fc1c0dab14dff82fc2c2465cb7c40a4157196a0"><code>2fc1c0d</code></a> Regenerated Clients</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/1a6bd026243230178e775059d27038c0ced194ea"><code>1a6bd02</code></a> Update endpoints model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/ac2c871bff4a9fbb6284f1dcc061fdcabea346f3"><code>ac2c871</code></a> Update API model</li> <li>Additional commits viewable in <a href="https://github.com/aws/aws-sdk-go-v2/compare/service/amp/v1.43.3...service/s3/v1.44.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/aws/aws-sdk-go-v2/service/sts&package-manager=go_modules&previous-version=1.43.3&new-version=1.44.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-07 11:19:17 +00:00
dependabot[bot]	4dade44e72	chore: bump github.com/go-chi/chi/v5 from 5.2.4 to 5.3.1 (#27051 ) Bumps [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) from 5.2.4 to 5.3.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-chi/chi/releases">github.com/go-chi/chi/v5's releases</a>.</em></p> <blockquote> <h2>v5.3.1</h2> <h2>What's Changed</h2> <ul> <li>Honor Discard() in httpFancyWriter.ReadFrom by <a href="https://github.com/DucMinhNe"><code>@DucMinhNe</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1110">go-chi/chi#1110</a></li> <li>Tidy build directives by <a href="https://github.com/JRaspass"><code>@JRaspass</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1113">go-chi/chi#1113</a></li> <li>feat(middleware): add text/xml and application/xml to default compressible types by <a href="https://github.com/VojtechVitek"><code>@VojtechVitek</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1127">go-chi/chi#1127</a></li> <li>Fix defaultLogEntry.Panic not respecting NoColor setting by <a href="https://github.com/doganarif"><code>@doganarif</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1050">go-chi/chi#1050</a></li> <li>middleware: document printPrettyStack and harden NoColor panic test by <a href="https://github.com/VojtechVitek"><code>@VojtechVitek</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1131">go-chi/chi#1131</a></li> <li>feat(mux): support http QUERY method ietf rfc10008 by <a href="https://github.com/VojtechVitek"><code>@VojtechVitek</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1132">go-chi/chi#1132</a></li> <li>ci: pin GitHub Actions to full commit SHAs by <a href="https://github.com/XananasX7"><code>@XananasX7</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1116">go-chi/chi#1116</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/DucMinhNe"><code>@DucMinhNe</code></a> made their first contribution in <a href="https://redirect.github.com/go-chi/chi/pull/1110">go-chi/chi#1110</a></li> <li><a href="https://github.com/doganarif"><code>@doganarif</code></a> made their first contribution in <a href="https://redirect.github.com/go-chi/chi/pull/1050">go-chi/chi#1050</a></li> <li><a href="https://github.com/XananasX7"><code>@XananasX7</code></a> made their first contribution in <a href="https://redirect.github.com/go-chi/chi/pull/1116">go-chi/chi#1116</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-chi/chi/compare/v5.3.0...v5.3.1">https://github.com/go-chi/chi/compare/v5.3.0...v5.3.1</a></p> <h2>v5.3.0</h2> <h2>What's Changed</h2> <ul> <li>Use strings.ReplaceAll where applicable by <a href="https://github.com/JRaspass"><code>@JRaspass</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1046">go-chi/chi#1046</a></li> <li>Propagate inline middlewares across mounted subrouters by <a href="https://github.com/LukasJenicek"><code>@LukasJenicek</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1049">go-chi/chi#1049</a></li> <li>add go 1.26 to ci by <a href="https://github.com/pkieltyka"><code>@pkieltyka</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1052">go-chi/chi#1052</a></li> <li>Remove last uses of io/ioutil by <a href="https://github.com/JRaspass"><code>@JRaspass</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1054">go-chi/chi#1054</a></li> <li>Simplify chi.walk with slices.Concat by <a href="https://github.com/JRaspass"><code>@JRaspass</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1053">go-chi/chi#1053</a></li> <li>Apply the stringscutprefix modernizer by <a href="https://github.com/JRaspass"><code>@JRaspass</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1051">go-chi/chi#1051</a></li> <li>Bump minimum Go to 1.23, always use request.Pattern by <a href="https://github.com/JRaspass"><code>@JRaspass</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1048">go-chi/chi#1048</a></li> <li>middleware: fix httpFancyWriter.ReadFrom double-counting bytes with Tee by <a href="https://github.com/alliasgher"><code>@alliasgher</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1085">go-chi/chi#1085</a></li> <li>Fix typo in Route doc comment by <a href="https://github.com/gouwazi"><code>@gouwazi</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1073">go-chi/chi#1073</a></li> <li>fix: set Request.Pattern from RoutePattern() by <a href="https://github.com/leno23"><code>@leno23</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1097">go-chi/chi#1097</a></li> <li>feat: middleware.ClientIP, a replacement for middleware.RealIP by <a href="https://github.com/VojtechVitek"><code>@VojtechVitek</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/967">go-chi/chi#967</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/LukasJenicek"><code>@LukasJenicek</code></a> made their first contribution in <a href="https://redirect.github.com/go-chi/chi/pull/1049">go-chi/chi#1049</a></li> <li><a href="https://github.com/alliasgher"><code>@alliasgher</code></a> made their first contribution in <a href="https://redirect.github.com/go-chi/chi/pull/1085">go-chi/chi#1085</a></li> <li><a href="https://github.com/gouwazi"><code>@gouwazi</code></a> made their first contribution in <a href="https://redirect.github.com/go-chi/chi/pull/1073">go-chi/chi#1073</a></li> <li><a href="https://github.com/leno23"><code>@leno23</code></a> made their first contribution in <a href="https://redirect.github.com/go-chi/chi/pull/1097">go-chi/chi#1097</a></li> </ul> <h2>SECURITY: middleware.ClientIP, a replacement for middleware.RealIP</h2> <p><a href="https://github.com/VojtechVitek"><code>@VojtechVitek</code></a> submitted PR <a href="https://redirect.github.com/go-chi/chi/issues/967">#967</a>, which introduces middleware.ClientIP — a replacement for middleware.RealIP that closes the three open spoofing advisories:</p> <ul> <li><a href="https://github.com/go-chi/chi/security/advisories/GHSA-9g5q-2w5x-hmxf">GHSA-9g5q-2w5x-hmxf</a> — IP spoofing via XFF in <code>RemoteAddr</code> resolution (convto)</li> <li><a href="https://github.com/go-chi/chi/security/advisories/GHSA-rjr7-jggh-pgcp">GHSA-rjr7-jggh-pgcp</a> — RealIP allows IP spoofing via unvalidated XFF (rezmoss)</li> <li><a href="https://github.com/go-chi/chi/security/advisories/GHSA-3fxj-6jh8-hvhx">GHSA-3fxj-6jh8-hvhx</a> — IP spoofing in <code>middleware.RealIP</code> (Saku0512, Critical / 9.3)</li> </ul> <p>It also addresses issues outlined at:</p> <ul> <li><a href="https://redirect.github.com/go-chi/chi/issues/708">go-chi/chi#708</a></li> <li><a href="https://adam-p.ca/blog/2022/03/x-forwarded-for/">https://adam-p.ca/blog/2022/03/x-forwarded-for/</a></li> <li><a href="https://redirect.github.com/go-chi/chi/issues/711">go-chi/chi#711</a></li> <li><a href="https://redirect.github.com/go-chi/chi/issues/453">go-chi/chi#453</a></li> <li><a href="https://redirect.github.com/go-chi/chi/pull/908">go-chi/chi#908</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-chi/chi/commit/8b258c7bb28f97a5f2a856ff7ef962578fec9215"><code>8b258c7</code></a> ci: pin GitHub Actions to full commit SHAs (<a href="https://redirect.github.com/go-chi/chi/issues/1116">#1116</a>)</li> <li><a href="https://github.com/go-chi/chi/commit/caf87e6e1bd9f29326f2ffdb93d8098139f08e4f"><code>caf87e6</code></a> feat(mux): support http QUERY method ietf rfc10008 (<a href="https://redirect.github.com/go-chi/chi/issues/1132">#1132</a>)</li> <li><a href="https://github.com/go-chi/chi/commit/7fcb8a20364d7b72e2d5a0e413ae80346e1c99c8"><code>7fcb8a2</code></a> middleware: document printPrettyStack and harden NoColor panic test (<a href="https://redirect.github.com/go-chi/chi/issues/1131">#1131</a>)</li> <li><a href="https://github.com/go-chi/chi/commit/878fe71fc9e506a63ea6957ed09c9ce84f789e97"><code>878fe71</code></a> Fix defaultLogEntry.Panic not respecting NoColor setting (<a href="https://redirect.github.com/go-chi/chi/issues/1050">#1050</a>)</li> <li><a href="https://github.com/go-chi/chi/commit/d7b767bcbea51e486bdc9fd06d25136767ec14b5"><code>d7b767b</code></a> feat(middleware): add text/xml and application/xml to default compressible ty...</li> <li><a href="https://github.com/go-chi/chi/commit/3b50c7cc35ff25f384202409733c3332c150e0ec"><code>3b50c7c</code></a> Tidy build directives (<a href="https://redirect.github.com/go-chi/chi/issues/1113">#1113</a>)</li> <li><a href="https://github.com/go-chi/chi/commit/2b9fca258f92830fc8232582e9e05a4d4a572a5d"><code>2b9fca2</code></a> Honor Discard() in httpFancyWriter.ReadFrom (<a href="https://redirect.github.com/go-chi/chi/issues/1110">#1110</a>)</li> <li><a href="https://github.com/go-chi/chi/commit/3b171578ca44dfd75ca3c5cbddc7b44c600a7b49"><code>3b17157</code></a> feat: middleware.ClientIP, a replacement for middleware.RealIP (<a href="https://redirect.github.com/go-chi/chi/issues/967">#967</a>)</li> <li><a href="https://github.com/go-chi/chi/commit/818fdcfc4786168651768377ba647cf9dd5b3953"><code>818fdcf</code></a> fix: set Request.Pattern from RoutePattern() (<a href="https://redirect.github.com/go-chi/chi/issues/1097">#1097</a>)</li> <li><a href="https://github.com/go-chi/chi/commit/f975af0cb10cbefaccf0422385420fe62722d648"><code>f975af0</code></a> Fix typo in Route doc comment (<a href="https://redirect.github.com/go-chi/chi/issues/1073">#1073</a>)</li> <li>Additional commits viewable in <a href="https://github.com/go-chi/chi/compare/v5.2.4...v5.3.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-chi/chi/v5&package-manager=go_modules&previous-version=5.2.4&new-version=5.3.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-07 11:18:07 +00:00
dependabot[bot]	242a10585c	chore: bump github.com/klauspost/compress from 1.18.6 to 1.19.0 (#27050 ) Bumps [github.com/klauspost/compress](https://github.com/klauspost/compress) from 1.18.6 to 1.19.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/klauspost/compress/releases">github.com/klauspost/compress's releases</a>.</em></p> <blockquote> <h2>v1.19.0</h2> <h2>What's Changed</h2> <ul> <li>zstd: Add true concurrent stream encoding by <a href="https://github.com/klauspost"><code>@klauspost</code></a> in <a href="https://redirect.github.com/klauspost/compress/pull/1136">klauspost/compress#1136</a></li> <li>zstd: arm64 decoder asm by <a href="https://github.com/lizthegrey"><code>@lizthegrey</code></a> in <a href="https://redirect.github.com/klauspost/compress/pull/1160">klauspost/compress#1160</a></li> <li>zstd: avoid unused BuildDict encoder allocation by <a href="https://github.com/snissn"><code>@snissn</code></a> in <a href="https://redirect.github.com/klauspost/compress/pull/1147">klauspost/compress#1147</a></li> <li>flate: Add inflate checkpoints by <a href="https://github.com/klauspost"><code>@klauspost</code></a> in <a href="https://redirect.github.com/klauspost/compress/pull/1154">klauspost/compress#1154</a></li> <li>snappy/s2: Limit length of varint in <code>decodedLen</code> by <a href="https://github.com/eustas"><code>@eustas</code></a> in <a href="https://redirect.github.com/klauspost/compress/pull/1148">klauspost/compress#1148</a></li> <li>gzhttp: match qvalue parameter case-insensitively (RFC 7231) by <a href="https://github.com/z9z"><code>@z9z</code></a> in <a href="https://redirect.github.com/klauspost/compress/pull/1149">klauspost/compress#1149</a></li> <li>zip: add NameDecoder callback for legacy encoding rewrite by <a href="https://github.com/SAY-5"><code>@SAY-5</code></a> in <a href="https://redirect.github.com/klauspost/compress/pull/1150">klauspost/compress#1150</a></li> <li>huff0: Allow building tables from histogram. by <a href="https://github.com/klauspost"><code>@klauspost</code></a> in <a href="https://redirect.github.com/klauspost/compress/pull/1155">klauspost/compress#1155</a></li> <li>huff0: Allow building table from oversized histogram. by <a href="https://github.com/klauspost"><code>@klauspost</code></a> in <a href="https://redirect.github.com/klauspost/compress/pull/1156">klauspost/compress#1156</a></li> <li>s2sx: Clean symlink targets by <a href="https://github.com/klauspost"><code>@klauspost</code></a> in <a href="https://redirect.github.com/klauspost/compress/pull/1163">klauspost/compress#1163</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/snissn"><code>@snissn</code></a> made their first contribution in <a href="https://redirect.github.com/klauspost/compress/pull/1147">klauspost/compress#1147</a></li> <li><a href="https://github.com/eustas"><code>@eustas</code></a> made their first contribution in <a href="https://redirect.github.com/klauspost/compress/pull/1148">klauspost/compress#1148</a></li> <li><a href="https://github.com/z9z"><code>@z9z</code></a> made their first contribution in <a href="https://redirect.github.com/klauspost/compress/pull/1149">klauspost/compress#1149</a></li> <li><a href="https://github.com/SAY-5"><code>@SAY-5</code></a> made their first contribution in <a href="https://redirect.github.com/klauspost/compress/pull/1150">klauspost/compress#1150</a></li> <li><a href="https://github.com/HNO3Miracle"><code>@HNO3Miracle</code></a> made their first contribution in <a href="https://redirect.github.com/klauspost/compress/pull/1165">klauspost/compress#1165</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/klauspost/compress/compare/v1.18.6...v1.19.0">https://github.com/klauspost/compress/compare/v1.18.6...v1.19.0</a></p> <h2>v1.18.7</h2> <ul> <li>Fix s2.NewDict OOB read.</li> </ul> <p>Security release without other changes.</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/klauspost/compress/compare/v1.18.6...v1.18.7">https://github.com/klauspost/compress/compare/v1.18.6...v1.18.7</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/klauspost/compress/commit/f0953f938f77977980c3b9f8c09eec06f2e88a69"><code>f0953f9</code></a> flate: fix buffer formatting in tests (<a href="https://redirect.github.com/klauspost/compress/issues/1165">#1165</a>)</li> <li><a href="https://github.com/klauspost/compress/commit/ab2e3cc7ab261c8f287639760d8532afb7125425"><code>ab2e3cc</code></a> zstd: Add arm64 decoder asm (<a href="https://redirect.github.com/klauspost/compress/issues/1160">#1160</a>)</li> <li><a href="https://github.com/klauspost/compress/commit/bb2723d55de85353fd5a1817cbc382997a6a75aa"><code>bb2723d</code></a> Merge commit from fork</li> <li><a href="https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536"><code>539243b</code></a> s2sx: Clean symlink targets (<a href="https://redirect.github.com/klauspost/compress/issues/1163">#1163</a>)</li> <li><a href="https://github.com/klauspost/compress/commit/bd9228c884559c21e572a0eaf827ee903bca805c"><code>bd9228c</code></a> Apply go fix and check in CI (<a href="https://redirect.github.com/klauspost/compress/issues/1158">#1158</a>)</li> <li><a href="https://github.com/klauspost/compress/commit/4cc176c3325ba1d87aacfdea015a3a2038fefb08"><code>4cc176c</code></a> zstd: Add true concurrent stream encoding (<a href="https://redirect.github.com/klauspost/compress/issues/1136">#1136</a>)</li> <li><a href="https://github.com/klauspost/compress/commit/4705fcbaf5155f466ca877527f66e88634cdf1c2"><code>4705fcb</code></a> build(deps): bump the github-actions group with 3 updates (<a href="https://redirect.github.com/klauspost/compress/issues/1157">#1157</a>)</li> <li><a href="https://github.com/klauspost/compress/commit/e9c2e569c112ecc1ad8ab818ed7328e7178973e4"><code>e9c2e56</code></a> huff0: Allow building table from oversized histogram. (<a href="https://redirect.github.com/klauspost/compress/issues/1156">#1156</a>)</li> <li><a href="https://github.com/klauspost/compress/commit/ecdb779d8745b0b074dcee75d9f7fd2bd524aff8"><code>ecdb779</code></a> huff0: Allow building tables from histogram. (<a href="https://redirect.github.com/klauspost/compress/issues/1155">#1155</a>)</li> <li><a href="https://github.com/klauspost/compress/commit/38efa458d47cc5555ce4a08796ddf2bf5ca22d87"><code>38efa45</code></a> zip: add NameDecoder callback for legacy encoding rewrite (<a href="https://redirect.github.com/klauspost/compress/issues/1150">#1150</a>)</li> <li>Additional commits viewable in <a href="https://github.com/klauspost/compress/compare/v1.18.6...v1.19.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/klauspost/compress&package-manager=go_modules&previous-version=1.18.6&new-version=1.19.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-07 11:17:50 +00:00
dependabot[bot]	a575899f47	chore: bump golang.org/x/text from 0.38.0 to 0.39.0 in the x group (#27049 ) Bumps the x group with 1 update: [golang.org/x/text](https://github.com/golang/text). Updates `golang.org/x/text` from 0.38.0 to 0.39.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/text/commit/b326f3d3c814ab79b3c516f4ac03c2314d8df65f"><code>b326f3d</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/text/commit/5ae8e578e495731553eddba11b2d0e86c91a00ce"><code>5ae8e57</code></a> unicode/norm: avoid infinite loop on invalid input</li> <li><a href="https://github.com/golang/text/commit/0dc94a239c8bc3b7ef3aa0d059e54af960f459f4"><code>0dc94a2</code></a> all: fix some comments</li> <li>See full diff in <a href="https://github.com/golang/text/compare/v0.38.0...v0.39.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/text&package-manager=go_modules&previous-version=0.38.0&new-version=0.39.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-07 11:17:43 +00:00
Sas Swart	fc188fdaee	fix: create agent firewall sessions without requiring agent read access (#26990 ) ## Overview Part of the boundary correlation feature. Fixes lazy creation of `boundary_sessions` rows so it works within the agent's RBAC constraints, and consumes the new `ConfinedProcessName` field reported by boundary. Pairs with coder/boundary#206, which adds `ConfinedProcessName` to `ReportBoundaryLogsRequest`. This branch bumps the `github.com/coder/boundary` module to pick up that work. ## Problem `ensureSession` did a pre-insert existence check via `GetBoundarySessionByID`. Agents are not permitted to read boundary sessions, so that read path is not viable when the session is created from an agent-reported log batch. ## Changes - Remove the pre-insert read. `ensureSession` now inserts directly and treats a primary-key unique violation as success, covering sessions already created by a prior batch, a reconnection, or another coderd replica — without requiring read access. - Per-connection guard. Add a mutex-protected `ensuredSessions` set so repeated log batches on the same connection skip the existence check and insert entirely, touching the database only for the logs. On a transient insert failure the session is left unmarked so the next batch retries. - Consume `ConfinedProcessName`. Pass `req.GetConfinedProcessName()` through to the session insert. - Bump boundary module from `v0.9.0` to `v0.9.1-0.20260706095856-35ba90f9e8b2`. - Tests. - Add `TestReportBoundaryLogsAgentRBAC` (`coderd/boundary_logs_test.go`), an integration test that connects as a real workspace agent, verifies the session and log are persisted under agent RBAC, and asserts the agent subject cannot read boundary sessions — guarding against reintroducing a pre-insert read. - Add `TestReportBoundaryLogsSessionGuard` (session inserted once across two batches, logs inserted per batch) and `TestReportBoundaryLogsSessionRetriedOnError` (insert retried after a transient error). - Regenerate `agent-firewall` CLI docs/golden files and adjust the clidocgen template to render the YAML path when a flag has no long name. > 🤖 This PR was opened by Coder Agents on behalf of @SasSwart.	2026-07-07 10:42:01 +00:00
Denis Afonso	f77d0065ed	fix: correct gvisor replace directive to match module path (#26822 ) ## Summary Fixes the gvisor `replace` directive in `go.mod` to target the correct module path. ## Problem PR #23055 added a replace directive to use the coder/gvisor fork (which fixes an integer overflow causing `panic: length < 0` crashes). However, the directive targeted the wrong module path: ``` replace gvisor.dev => github.com/coder/gvisor v0.0.0-20260313164934-7a658db7b714 ``` The actual module path declared in gvisor's `go.mod` is `gvisor.dev/gvisor`, not `gvisor.dev`. Go module replace directives require an exact module path match, so the previous directive was a no-op and the patched fork was never used. ## Fix ```diff -replace gvisor.dev => github.com/coder/gvisor v0.0.0-20260313164934-7a658db7b714 +replace gvisor.dev/gvisor => github.com/coder/gvisor v0.0.0-20260313164934-7a658db7b714 ``` ## Validation Verified locally with `go list -m`: Before (no-op replace): ``` $ go list -m gvisor.dev/gvisor gvisor.dev/gvisor v0.0.0-20240509041132-65b30f7869dc ``` After (correct replace): ``` $ go list -m gvisor.dev/gvisor gvisor.dev/gvisor v0.0.0-20240509041132-65b30f7869dc => github.com/coder/gvisor v0.0.0-20260313164934-7a658db7b714 ``` The `=>` confirms the fork is now applied. Fixes https://github.com/coder/coder/issues/20885 --- <details> <summary>Investigation context</summary> - The coder/gvisor fork (commit `7a658db7b714`) declares `module gvisor.dev/gvisor` in its go.mod - Customer runtime stack traces show `gvisor.dev/gvisor@v0.0.0-20240509041132-65b30f7869dc` (unpatched upstream), confirming the fork was not applied - The crash is `panic: length < 0` in `gvisor.dev/gvisor/pkg/tcpip/transport/tcp.(sender).splitSeg` - Related Linear ticket: ENT-118 </details> --- Generated by [Coder Agents](https://coder.com/agents) on behalf of @denisra*	2026-07-01 17:11:47 +01:00
dependabot[bot]	681d77154b	chore: bump github.com/valyala/fasthttp from 1.71.0 to 1.72.0 (#26859 ) Bumps [github.com/valyala/fasthttp](https://github.com/valyala/fasthttp) from 1.71.0 to 1.72.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/valyala/fasthttp/releases">github.com/valyala/fasthttp's releases</a>.</em></p> <blockquote> <h2>v1.72.0</h2> <h2>What's Changed</h2> <ul> <li>Update to go1.25 as minimal version by <a href="https://github.com/erikdubbelboer"><code>@erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2205">valyala/fasthttp#2205</a></li> <li>client: add aggregate connection count metrics by <a href="https://github.com/z9z"><code>@z9z</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2201">valyala/fasthttp#2201</a></li> <li>fix(server): return ErrMissingFile when MultipartForm.File is nil by <a href="https://github.com/u5surf"><code>@u5surf</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2260">valyala/fasthttp#2260</a></li> <li>bug: FS cache cleaner goroutine leaks when CleanStop is nil (default) (<a href="https://redirect.github.com/valyala/fasthttp/issues/2218">#2218</a>), <a href="https://redirect.github.com/valyala/fasthttp/issues/2247">#2247</a> by <a href="https://github.com/erikdubbelboer"><code>@erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2271">valyala/fasthttp#2271</a></li> <li>bug: data race on pipeline client c.chR during worker drain (<a href="https://redirect.github.com/valyala/fasthttp/issues/2220">#2220</a>) by <a href="https://github.com/erikdubbelboer"><code>@erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2272">valyala/fasthttp#2272</a></li> <li>bug: TCPDialer.tcpAddrsClean() goroutine leaks — no shutdown mechanism (<a href="https://redirect.github.com/valyala/fasthttp/issues/2222">#2222</a>) by <a href="https://github.com/erikdubbelboer"><code>@erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2273">valyala/fasthttp#2273</a></li> <li>bug: double concurrency counter increment in ServeConn causes counter leak (<a href="https://redirect.github.com/valyala/fasthttp/issues/2238">#2238</a>) by <a href="https://github.com/erikdubbelboer"><code>@erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2275">valyala/fasthttp#2275</a></li> <li>bug: body stream leak in compression methods when response is discarded (<a href="https://redirect.github.com/valyala/fasthttp/issues/2244">#2244</a>) by <a href="https://github.com/erikdubbelboer"><code>@erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2276">valyala/fasthttp#2276</a></li> <li>bug: InMemoryListener deadlock under high concurrency (<a href="https://redirect.github.com/valyala/fasthttp/issues/2245">#2245</a>) by <a href="https://github.com/erikdubbelboer"><code>@erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2277">valyala/fasthttp#2277</a></li> <li>bug: fasthttpadaptor writer leak, data race, and crash on handler panic (<a href="https://redirect.github.com/valyala/fasthttp/issues/2246">#2246</a>) by <a href="https://github.com/erikdubbelboer"><code>@erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2278">valyala/fasthttp#2278</a></li> <li>bug: fasthttpproxy dialers return nil DialFunc on error, causing panic (<a href="https://redirect.github.com/valyala/fasthttp/issues/2248">#2248</a>) by <a href="https://github.com/erikdubbelboer"><code>@erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2279">valyala/fasthttp#2279</a></li> <li>bug: closeIdleConns TOCTOU race with serveConn idle timestamp (<a href="https://redirect.github.com/valyala/fasthttp/issues/2250">#2250</a>) by <a href="https://github.com/erikdubbelboer"><code>@erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2280">valyala/fasthttp#2280</a></li> <li>bug: AppendCert/AppendCertEmbed not thread-safe (<a href="https://redirect.github.com/valyala/fasthttp/issues/2251">#2251</a>) by <a href="https://github.com/erikdubbelboer"><code>@erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2281">valyala/fasthttp#2281</a></li> <li>bug: SetBodySizePoolLimit data race — plain int written without synchronization (<a href="https://redirect.github.com/valyala/fasthttp/issues/2252">#2252</a>) by <a href="https://github.com/erikdubbelboer"><code>@erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2282">valyala/fasthttp#2282</a></li> <li>bug: file descriptor leak in prefork parent process (<a href="https://redirect.github.com/valyala/fasthttp/issues/2253">#2253</a>) by <a href="https://github.com/erikdubbelboer"><code>@erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2283">valyala/fasthttp#2283</a></li> <li>security: SO_REUSEADDR on Windows enables port hijacking (<a href="https://redirect.github.com/valyala/fasthttp/issues/2254">#2254</a>) by <a href="https://github.com/erikdubbelboer"><code>@erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2284">valyala/fasthttp#2284</a></li> <li>bug: file descriptor leak on z/OS s390x when FcntlInt fails (<a href="https://redirect.github.com/valyala/fasthttp/issues/2255">#2255</a>) by <a href="https://github.com/erikdubbelboer"><code>@erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2285">valyala/fasthttp#2285</a></li> <li>bug: filesLockMap grows unboundedly, leaking memory (<a href="https://redirect.github.com/valyala/fasthttp/issues/2256">#2256</a>) by <a href="https://github.com/erikdubbelboer"><code>@erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2286">valyala/fasthttp#2286</a></li> <li>security: TLS verification silently disabled for malformed addresses (<a href="https://redirect.github.com/valyala/fasthttp/issues/2236">#2236</a>) by <a href="https://github.com/erikdubbelboer"><code>@erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2274">valyala/fasthttp#2274</a></li> <li>fix(fs): remove temporary file when compression fails by <a href="https://github.com/u5surf"><code>@u5surf</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2264">valyala/fasthttp#2264</a></li> <li>fix double release of streamed client response body by <a href="https://github.com/Mereng"><code>@Mereng</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2211">valyala/fasthttp#2211</a></li> <li>fix(client): switch to GET on 303 redirect per RFC 9110 by <a href="https://github.com/u5surf"><code>@u5surf</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2265">valyala/fasthttp#2265</a></li> <li>ci: re-enable gocritic deferInLoop check for non-test code by <a href="https://github.com/u5surf"><code>@u5surf</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2288">valyala/fasthttp#2288</a></li> <li>Fix flaky race tests by <a href="https://github.com/erikdubbelboer"><code>@erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2292">valyala/fasthttp#2292</a></li> <li>fix(lbclient): prevent deadlock when all clients are removed by <a href="https://github.com/u5surf"><code>@u5surf</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2287">valyala/fasthttp#2287</a></li> <li>reject duplicate Content-Length in response header parser by <a href="https://github.com/alhudz"><code>@alhudz</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2294">valyala/fasthttp#2294</a></li> <li>strip cr/lf from header keys in normalizeHeaderKey by <a href="https://github.com/alhudz"><code>@alhudz</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2295">valyala/fasthttp#2295</a></li> <li>fix(client): guard nil waiter in decConnsCount by <a href="https://github.com/SAY-5"><code>@SAY-5</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2266">valyala/fasthttp#2266</a></li> <li>strip semicolons from cookie setters to block attribute injection by <a href="https://github.com/alhudz"><code>@alhudz</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2298">valyala/fasthttp#2298</a></li> <li>feat(prefork): graceful shutdown, leak fixes, hook robustness (re-open of <a href="https://redirect.github.com/valyala/fasthttp/issues/2180">#2180</a> follow-up) by <a href="https://github.com/ReneWerner87"><code>@ReneWerner87</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2199">valyala/fasthttp#2199</a></li> <li>fix: prevent data race on FSCompressedFileSuffixes map by <a href="https://github.com/xbrxr03"><code>@xbrxr03</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2300">valyala/fasthttp#2300</a></li> <li>reject duplicate Transfer-Encoding in request header parser by <a href="https://github.com/alhudz"><code>@alhudz</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2303">valyala/fasthttp#2303</a></li> <li>preserve duplicate request headers in ConvertRequest by <a href="https://github.com/alhudz"><code>@alhudz</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2305">valyala/fasthttp#2305</a></li> <li>fix(server): close listener on serve error in ListenAndServe helpers by <a href="https://github.com/fereidani"><code>@fereidani</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2304">valyala/fasthttp#2304</a></li> <li>validate trailer values in parseTrailer by <a href="https://github.com/alhudz"><code>@alhudz</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2301">valyala/fasthttp#2301</a></li> <li>Avoid default content type for empty requests by <a href="https://github.com/nkgotcode"><code>@nkgotcode</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2296">valyala/fasthttp#2296</a></li> <li>chore(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2210">valyala/fasthttp#2210</a></li> <li>chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2209">valyala/fasthttp#2209</a></li> <li>chore(deps): bump golang.org/x/sys from 0.44.0 to 0.45.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2208">valyala/fasthttp#2208</a></li> <li>chore(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2207">valyala/fasthttp#2207</a></li> <li>chore(deps): bump securego/gosec from 2.26.1 to 2.27.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2261">valyala/fasthttp#2261</a></li> <li>chore(deps): bump securego/gosec from 2.27.0 to 2.27.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2267">valyala/fasthttp#2267</a></li> <li>chore(deps): bump golang.org/x/sys from 0.45.0 to 0.46.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2289">valyala/fasthttp#2289</a></li> <li>chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2290">valyala/fasthttp#2290</a></li> <li>chore(deps): bump golang.org/x/net from 0.55.0 to 0.56.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2291">valyala/fasthttp#2291</a></li> <li>chore(deps): bump actions/checkout from 6 to 7 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2297">valyala/fasthttp#2297</a></li> </ul> <h2>New Contributors</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/valyala/fasthttp/commit/37a31d78c5d221b24b9cb6652481b5acd4dd674f"><code>37a31d7</code></a> Avoid default content type for empty requests (<a href="https://redirect.github.com/valyala/fasthttp/issues/2296">#2296</a>)</li> <li><a href="https://github.com/valyala/fasthttp/commit/d93cb94af2c31641d00025140785609ddd746eb3"><code>d93cb94</code></a> validate trailer values in parseTrailer (<a href="https://redirect.github.com/valyala/fasthttp/issues/2301">#2301</a>)</li> <li><a href="https://github.com/valyala/fasthttp/commit/9d21d3546ab1d8422b0b5b2801e46aef568619ce"><code>9d21d35</code></a> Remove unused uint322ip, inline ip2uint32</li> <li><a href="https://github.com/valyala/fasthttp/commit/eb82c9a13addbe488f69cbf530444bb2561fd083"><code>eb82c9a</code></a> Reject invalid cookie values during parsing</li> <li><a href="https://github.com/valyala/fasthttp/commit/598e2e06218dbcaf4da6b3723477effd9d7b6233"><code>598e2e0</code></a> fix(server): close listener on serve error in ListenAndServe helpers (<a href="https://redirect.github.com/valyala/fasthttp/issues/2304">#2304</a>)</li> <li><a href="https://github.com/valyala/fasthttp/commit/134a8fedab6eb02fda4b8d96c48d2a72082d2e0c"><code>134a8fe</code></a> preserve duplicate request headers in ConvertRequest (<a href="https://redirect.github.com/valyala/fasthttp/issues/2305">#2305</a>)</li> <li><a href="https://github.com/valyala/fasthttp/commit/7bca504536636cf77726f3018365626a8b975b5f"><code>7bca504</code></a> reject duplicate Transfer-Encoding in request header parser (<a href="https://redirect.github.com/valyala/fasthttp/issues/2303">#2303</a>)</li> <li><a href="https://github.com/valyala/fasthttp/commit/9ee3c15997f8ab21519c2728017e9fbff03fe142"><code>9ee3c15</code></a> docs: document FSCompressedFileSuffixes is not safe for concurrent modificati...</li> <li><a href="https://github.com/valyala/fasthttp/commit/2c1590038fa5d0e04896c8b0aafc138ce286bfa7"><code>2c15900</code></a> feat(prefork): graceful shutdown, leak fixes, hook robustness (re-open of <a href="https://redirect.github.com/valyala/fasthttp/issues/21">#21</a>...</li> <li><a href="https://github.com/valyala/fasthttp/commit/ec58c6e67ee8f608a673cc01f07f045d04fa17b5"><code>ec58c6e</code></a> strip semicolons from cookie setters to block attribute injection (<a href="https://redirect.github.com/valyala/fasthttp/issues/2298">#2298</a>)</li> <li>Additional commits viewable in <a href="https://github.com/valyala/fasthttp/compare/v1.71.0...v1.72.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/valyala/fasthttp&package-manager=go_modules&previous-version=1.71.0&new-version=1.72.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-30 11:18:33 +00:00
dependabot[bot]	33780758c1	chore: bump github.com/open-policy-agent/opa from 1.17.0 to 1.18.1 (#26858 ) Bumps [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) from 1.17.0 to 1.18.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/open-policy-agent/opa/releases">github.com/open-policy-agent/opa's releases</a>.</em></p> <blockquote> <h2>v1.18.1</h2> <p>This release fixes a memory leak introduced in OPA v1.17.0. It is advised to update if you notice excess memory usage when running OPA server.</p> <h3>Fixes</h3> <ul> <li>ast: fix AnnotationSet memory leak via runtime.AddCleanup cycle (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8817">#8817</a>) authored by <a href="https://github.com/srenatus"><code>@srenatus</code></a> reported by <a href="https://github.com/keydon"><code>@keydon</code></a> and <a href="https://github.com/gorsr01"><code>@gorsr01</code></a></li> </ul> <h2>v1.18.0</h2> <p>This release contains a mix of bugfixes and small features. Notably:</p> <ul> <li>A breaking fix to the outbound <code>User-Agent</code> header so it conforms to RFC 9110 (see below)</li> <li>Container-aware resource limits: automatic <code>GOMAXPROCS</code> is restored and automatic <code>GOMEMLIMIT</code> is now supported</li> <li>Several <code>opa fmt</code> correctness fixes</li> <li>Improvements to <code>opa test --coverage</code> (ranges in report, inline rule head tracking, conjunction-expression coverage)</li> </ul> <h3>Breaking: Fix User-Agent according to RFC9110 (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8792">#8792</a>)</h3> <p>OPA's outbound HTTP requests (bundle, discovery, decision log, status, <code>http.send</code>, AWS KMS/ECR) previously sent <code>User-Agent: Open Policy Agent/<version> (<os>, <arch>)</code>, which is not a valid RFC 9110 <code>User-Agent</code> value because the <code>product</code> token cannot contain spaces. The header is now <code>Open-Policy-Agent/<version> (<os>, <arch>)</code>. Server-side log filters or WAF rules that exact-match the old string will need to be updated.</p> <p>Authored by <a href="https://github.com/sspaink"><code>@sspaink</code></a>, reported by <a href="https://github.com/SpecLad"><code>@SpecLad</code></a></p> <h3>Runtime, SDK, Tooling</h3> <ul> <li>bundle: fix per-module rego version lookup (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8797">#8797</a>) authored by <a href="https://github.com/sspaink"><code>@sspaink</code></a>, reported by <a href="https://github.com/xubinzheng"><code>@xubinzheng</code></a></li> <li>bundle: improve determinism of <code>file_rego_versions</code> patterns with overlap (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8733">#8733</a>) authored by <a href="https://github.com/philipaconrad"><code>@philipaconrad</code></a></li> <li>cover: Track inline rule head in post trace walk (<a href="https://redirect.github.com/open-policy-agent/opa/issues/6531">#6531</a>) authored by <a href="https://github.com/charlieegan3"><code>@charlieegan3</code></a>, reported by <a href="https://github.com/anderseknert"><code>@anderseknert</code></a></li> <li>cover: Update report to include ranges (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8748">#8748</a>) reported and authored by <a href="https://github.com/charlieegan3"><code>@charlieegan3</code></a></li> <li>cover: Add support for coverage of conjunction exprs (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8809">#8809</a>) authored by <a href="https://github.com/charlieegan3"><code>@charlieegan3</code></a></li> <li>download/oci: Set Accept headers (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8720">#8720</a>) authored by <a href="https://github.com/charlieegan3"><code>@charlieegan3</code></a></li> <li>fmt: preserve the multiline but single entry iterables (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8557">#8557</a>) authored by <a href="https://github.com/unichronic"><code>@unichronic</code></a>, reported by <a href="https://github.com/anderseknert"><code>@anderseknert</code></a></li> <li>format: Fix dropped with-clause after comment in object value (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8765">#8765</a>) authored by <a href="https://github.com/sspaink"><code>@sspaink</code></a>, reported by <a href="https://github.com/srabraham"><code>@srabraham</code></a></li> <li>format: keep lone <code>with</code> on the closing-bracket line of multi-line expressions (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8804">#8804</a>) authored by <a href="https://github.com/anneheartrecord"><code>@anneheartrecord</code></a>, reported by <a href="https://github.com/burnster"><code>@burnster</code></a></li> <li>oracle: Fix find-definition on expressions inside <code>ast.Not</code> nodes (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8731">#8731</a>) authored by <a href="https://github.com/johanfylling"><code>@johanfylling</code></a></li> <li>runtime: Restore goautomaxprocs, add automemlimit (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8784">#8784</a>) authored by <a href="https://github.com/charlieegan3"><code>@charlieegan3</code></a></li> </ul> <h3>Compiler, Topdown and Rego</h3> <ul> <li>ast: Apply location to inner <code>ast.Not</code> expressions (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8717">#8717</a>) authored by <a href="https://github.com/johanfylling"><code>@johanfylling</code></a>, reported by <a href="https://github.com/anderseknert"><code>@anderseknert</code></a></li> <li>ast: Clean up code for value comparisons (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8737">#8737</a>) authored by <a href="https://github.com/anderseknert"><code>@anderseknert</code></a></li> <li>ast: Fix PE regression for <code>future.keywords.not</code> negation inside <code>every</code> (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8781">#8781</a>) authored by <a href="https://github.com/johanfylling"><code>@johanfylling</code></a></li> <li>internal/edittree: Add recursive tree node recycling (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8693">#8693</a>) authored by <a href="https://github.com/philipaconrad"><code>@philipaconrad</code></a></li> <li>internal: compile,planner: improve determinism of <code>plan</code>/<code>wasm</code> bundle builds (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8732">#8732</a>) authored by <a href="https://github.com/philipaconrad"><code>@philipaconrad</code></a></li> <li>perf: avoid allocations in <code>object.get</code> (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8729">#8729</a>) authored by <a href="https://github.com/anderseknert"><code>@anderseknert</code></a></li> <li>topdown: Fix PE not namespacing vars in comprehensions nested inside <code>every</code> (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8816">#8816</a>) authored by <a href="https://github.com/johanfylling"><code>@johanfylling</code></a></li> <li>topdown: remove <code>dst.Compare(src)</code> shortcut (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8739">#8739</a>) authored by <a href="https://github.com/srenatus"><code>@srenatus</code></a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md">github.com/open-policy-agent/opa's changelog</a>.</em></p> <blockquote> <h1>Change Log</h1> <p>All notable changes to this project will be documented in this file. This project adheres to <a href="http://semver.org/">Semantic Versioning</a>.</p> <h2>Unreleased</h2> <h2>1.18.0</h2> <p>This release contains a mix of bugfixes and small features. Notably:</p> <ul> <li>A breaking fix to the outbound <code>User-Agent</code> header so it conforms to RFC 9110 (see below)</li> <li>Container-aware resource limits: automatic <code>GOMAXPROCS</code> is restored and automatic <code>GOMEMLIMIT</code> is now supported</li> <li>Several <code>opa fmt</code> correctness fixes</li> <li>Improvements to <code>opa test --coverage</code> (ranges in report, inline rule head tracking, conjunction-expression coverage)</li> </ul> <h3>Breaking: Fix User-Agent according to RFC9110 (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8792">#8792</a>)</h3> <p>OPA's outbound HTTP requests (bundle, discovery, decision log, status, <code>http.send</code>, AWS KMS/ECR) previously sent <code>User-Agent: Open Policy Agent/<version> (<os>, <arch>)</code>, which is not a valid RFC 9110 <code>User-Agent</code> value because the <code>product</code> token cannot contain spaces. The header is now <code>Open-Policy-Agent/<version> (<os>, <arch>)</code>. Server-side log filters or WAF rules that exact-match the old string will need to be updated.</p> <p>Authored by <a href="https://github.com/sspaink"><code>@sspaink</code></a>, reported by <a href="https://github.com/SpecLad"><code>@SpecLad</code></a></p> <h3>Runtime, SDK, Tooling</h3> <ul> <li>bundle: fix per-module rego version lookup (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8797">#8797</a>) authored by <a href="https://github.com/sspaink"><code>@sspaink</code></a>, reported by <a href="https://github.com/xubinzheng"><code>@xubinzheng</code></a></li> <li>bundle: improve determinism of <code>file_rego_versions</code> patterns with overlap (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8733">#8733</a>) authored by <a href="https://github.com/philipaconrad"><code>@philipaconrad</code></a></li> <li>cover: Track inline rule head in post trace walk (<a href="https://redirect.github.com/open-policy-agent/opa/issues/6531">#6531</a>) authored by <a href="https://github.com/charlieegan3"><code>@charlieegan3</code></a>, reported by <a href="https://github.com/anderseknert"><code>@anderseknert</code></a></li> <li>cover: Update report to include ranges (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8748">#8748</a>) reported and authored by <a href="https://github.com/charlieegan3"><code>@charlieegan3</code></a></li> <li>cover: Add support for coverage of conjunction exprs (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8809">#8809</a>) authored by <a href="https://github.com/charlieegan3"><code>@charlieegan3</code></a></li> <li>download/oci: Set Accept headers (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8720">#8720</a>) authored by <a href="https://github.com/charlieegan3"><code>@charlieegan3</code></a></li> <li>fmt: preserve the multiline but single entry iterables (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8557">#8557</a>) authored by <a href="https://github.com/unichronic"><code>@unichronic</code></a>, reported by <a href="https://github.com/anderseknert"><code>@anderseknert</code></a></li> <li>format: Fix dropped with-clause after comment in object value (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8765">#8765</a>) authored by <a href="https://github.com/sspaink"><code>@sspaink</code></a>, reported by <a href="https://github.com/srabraham"><code>@srabraham</code></a></li> <li>format: keep lone <code>with</code> on the closing-bracket line of multi-line expressions (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8804">#8804</a>) authored by <a href="https://github.com/anneheartrecord"><code>@anneheartrecord</code></a>, reported by <a href="https://github.com/burnster"><code>@burnster</code></a></li> <li>oracle: Fix find-definition on expressions inside <code>ast.Not</code> nodes (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8731">#8731</a>) authored by <a href="https://github.com/johanfylling"><code>@johanfylling</code></a></li> <li>runtime: Restore goautomaxprocs, add automemlimit (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8784">#8784</a>) authored by <a href="https://github.com/charlieegan3"><code>@charlieegan3</code></a></li> </ul> <h3>Compiler, Topdown and Rego</h3> <ul> <li>ast: Apply location to inner <code>ast.Not</code> expressions (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8717">#8717</a>) authored by <a href="https://github.com/johanfylling"><code>@johanfylling</code></a>, reported by <a href="https://github.com/anderseknert"><code>@anderseknert</code></a></li> <li>ast: Clean up code for value comparisons (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8737">#8737</a>) authored by <a href="https://github.com/anderseknert"><code>@anderseknert</code></a></li> <li>ast: Fix PE regression for <code>future.keywords.not</code> negation inside <code>every</code> (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8781">#8781</a>) authored by <a href="https://github.com/johanfylling"><code>@johanfylling</code></a></li> <li>internal/edittree: Add recursive tree node recycling (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8693">#8693</a>) authored by <a href="https://github.com/philipaconrad"><code>@philipaconrad</code></a></li> <li>internal: compile,planner: improve determinism of <code>plan</code>/<code>wasm</code> bundle builds (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8732">#8732</a>) authored by <a href="https://github.com/philipaconrad"><code>@philipaconrad</code></a></li> <li>perf: avoid allocations in <code>object.get</code> (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8729">#8729</a>) authored by <a href="https://github.com/anderseknert"><code>@anderseknert</code></a></li> <li>topdown: Fix PE not namespacing vars in comprehensions nested inside <code>every</code> (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8816">#8816</a>) authored by <a href="https://github.com/johanfylling"><code>@johanfylling</code></a></li> <li>topdown: remove <code>dst.Compare(src)</code> shortcut (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8739">#8739</a>) authored by <a href="https://github.com/srenatus"><code>@srenatus</code></a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/open-policy-agent/opa/commit/acc8bf9f88bbef57c500dbdd7231509e48ade525"><code>acc8bf9</code></a> Release v1.18.1</li> <li><a href="https://github.com/open-policy-agent/opa/commit/713dc6a42757e4b175ec8f74d58e341f89004467"><code>713dc6a</code></a> ast: fix AnnotationSet memory leak via runtime.AddCleanup cycle</li> <li><a href="https://github.com/open-policy-agent/opa/commit/cc2c5c60a4c486f15a5e8de457e96ed0fefaf5fe"><code>cc2c5c6</code></a> Prepare v1.18 release (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8820">#8820</a>)</li> <li><a href="https://github.com/open-policy-agent/opa/commit/e72a98fb10b43cfc4067568de8909c669e8a1b79"><code>e72a98f</code></a> format: keep lone <code>with</code> on the closing-bracket line of multi-line expression...</li> <li><a href="https://github.com/open-policy-agent/opa/commit/03646dde18924c2c74a13526e4cea408dcbb4481"><code>03646dd</code></a> topdown: Fix PE not namespacing vars in comprehensions nested inside <code>every</code> ...</li> <li><a href="https://github.com/open-policy-agent/opa/commit/bf2bb5261cf84958c295dd74e763837e2c021fd8"><code>bf2bb52</code></a> benchmarks: split off script, emit markdown table</li> <li><a href="https://github.com/open-policy-agent/opa/commit/02ce276093b85d101172045f0307d53f5f9cc89d"><code>02ce276</code></a> version: fix ill-formed User-Agent header (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8796">#8796</a>)</li> <li><a href="https://github.com/open-policy-agent/opa/commit/1fdbb77dd6b7aaf65dffd8c23563df72a59639a3"><code>1fdbb77</code></a> build(deps): bump the dependencies group across 2 directories with 6 updates</li> <li><a href="https://github.com/open-policy-agent/opa/commit/954196aaa43841958547b1a0ba564e591d342a67"><code>954196a</code></a> cover: Add support for coverage of conjunction exprs (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8809">#8809</a>)</li> <li><a href="https://github.com/open-policy-agent/opa/commit/dec8333b32aed9189721220f3e8101460ebb170f"><code>dec8333</code></a> deduplicate change-detection output in pr CI checks (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8808">#8808</a>)</li> <li>Additional commits viewable in <a href="https://github.com/open-policy-agent/opa/compare/v1.17.0...v1.18.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/open-policy-agent/opa&package-manager=go_modules&previous-version=1.17.0&new-version=1.18.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-30 11:17:30 +00:00
dependabot[bot]	d440e71109	chore: bump golang.org/x/tools from 0.46.0 to 0.47.0 in the x group (#26857 ) Bumps the x group with 1 update: [golang.org/x/tools](https://github.com/golang/tools). Updates `golang.org/x/tools` from 0.46.0 to 0.47.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/tools/commit/fbf9f2e2c8124fbe1877f5ed2857111038d9fe12"><code>fbf9f2e</code></a> gopls/internal/cmd: add tests of 'gopls help'</li> <li><a href="https://github.com/golang/tools/commit/e891f79e03c0d60a806f959113eb8a748a3dd3fe"><code>e891f79</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/tools/commit/0602b30930e307645a5b43697b316a5599dea9a1"><code>0602b30</code></a> gopls: revert CLI usability revamp to stabilize release</li> <li><a href="https://github.com/golang/tools/commit/60c2434eca161a47c4697fdf65718dc259c1cf5b"><code>60c2434</code></a> gopls/internal/cmd: fix regression in initialization</li> <li><a href="https://github.com/golang/tools/commit/29e158310c709074e3cc2f7f1cd5ab9af11eb13b"><code>29e1583</code></a> gopls/internal/mcp: go_diagnostics: use idiomatic iterators</li> <li><a href="https://github.com/golang/tools/commit/0772d6a918b878bf9983d765a65af011d84483b4"><code>0772d6a</code></a> go/ssa: add test for fix of <a href="https://redirect.github.com/golang/go/issues/73871">golang/go#73871</a> in go/types@go1.25</li> <li><a href="https://github.com/golang/tools/commit/0fdde844aba91691351f38a7f1da04354170017e"><code>0fdde84</code></a> gopls/internal/tool: rename Application to Command and embed in SubCommand</li> <li><a href="https://github.com/golang/tools/commit/bd9e76d9f0ec7faf1dc77d440463c182ac9c348c"><code>bd9e76d</code></a> go/callgraph/vta: document ssa.InstantiateGenerics requirement</li> <li><a href="https://github.com/golang/tools/commit/d711ac7849d4f5456228745090323144c4c2d190"><code>d711ac7</code></a> go/ssa: remove incorrect hasTypeParams check</li> <li><a href="https://github.com/golang/tools/commit/439decda73f3e6449050bcb3a0241ed96d5e74e1"><code>439decd</code></a> gopls/internal/cache/xrefs: avoid materializing Inspector</li> <li>Additional commits viewable in <a href="https://github.com/golang/tools/compare/v0.46.0...v0.47.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/tools&package-manager=go_modules&previous-version=0.46.0&new-version=0.47.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-30 11:15:40 +00:00
Yevhenii Shcherbina	8bf6f43016	feat: support cross-account Bedrock AssumeRole in AI Bridge (#26527 ) # Support IAM role assumption for AWS Bedrock in AI Bridge ## Summary Implements https://linear.app/codercom/issue/AIGOV-371/support-dynamic-bedrock-assumerole-across-aws-accounts-for-ai-gateway A Bedrock provider can now be configured with an IAM role to assume. Before calling Bedrock, the gateway assumes that role via STS and signs requests with the resulting temporary credentials. Whether the role lives in the same account or another one is entirely a matter of the role's trust policy. ## Problem Many organizations prohibit long-lived AWS access keys and expect workloads to authenticate through assumed IAM roles instead. A common case is an organization that runs Bedrock across several AWS accounts, one per business unit, and needs each unit's usage billed to its own account by assuming a role there. AI Bridge previously authenticated a Bedrock provider only with static keys or the gateway's own ambient AWS identity, which is shared by every provider, with no way to assume a role. These deployments had no clean path. ## How it works When a provider is configured with a role ARN, the gateway uses its base identity to assume that role via STS and signs Bedrock requests with the temporary credentials it returns. The base identity is whatever the AWS default credential chain resolves, IRSA, EKS Pod Identity, EC2 Instance Profile, or static keys. Credentials are resolved once when the provider is set up and are then cached and rotated, so individual requests are served from the cache rather than triggering a new STS call. A deployment that needs several roles configures several providers, each pointing at its own role. ## Configuration The role ARN is part of the Bedrock provider settings and is set through the AI provider API. It is optional: a provider with no role ARN behaves exactly as before. ## Scope and trade-offs - This PR is backend only. The settings UI for the role ARN ships in a follow-up. - Configuration is not exposed through environment variables. Environment-based provider configuration is being phased out in favor of database-managed providers, so the role ARN is intentionally database and API only. Follow-up PR: https://github.com/coder/coder/pull/26578	2026-06-24 12:03:27 -04:00

1 2 3 4 5 ...