mirror of
https://github.com/coder/coder.git
synced 2026-09-22 05:05:20 +08:00
bfbacd64f4c56cce2a6fdab853669e8c3cfc77e5
15228
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Garrett Delfosse
|
bfbacd64f4 |
refactor: consolidate release tooling into a single releaser command (#27034)
## What Consolidates the two separate release programs into a single command at `scripts/releaser`: - `scripts/releaser/v1/` — the former interactive releaser (package `v1`). - `scripts/releaser/v2/` — the former `scripts/release-action` CI tool (package `v2`). - `scripts/releaser/main.go` — new entrypoint. Runs the **v2** tooling by default and the **v1** interactive wizard with `--legacy`. ## CLI shape Three documented subcommands, each backed by v2 `prepare-release` with the release type baked in: - `releaser rc` — tag a release candidate - `releaser branch` — cut a new release branch and tag its first RC - `releaser release` — tag a stable release or patch The former release-action verbs (`calculate-version`, `prepare-release`, `generate-notes`, `publish`) are retained as **hidden** top-level commands with identical flags and stdout, so `tag-and-release.yaml` migrates with a path-only change (`scripts/release-action` -> `scripts/releaser`). `--legacy` runs the v1 wizard and is mutually exclusive with the subcommands. `scripts/release.sh` now launches `releaser --legacy`. All file moves are rename-detected by git, so the per-file diff is just the package declaration. ## Testing - `go build ./scripts/...`, `go vet ./scripts/releaser/...`, `go test ./scripts/releaser/...` - `golangci-lint run ./scripts/releaser/...`, `make lint/emdash`, `shellcheck`, `actionlint` - Smoke: `releaser --help` shows only rc/branch/release; hidden verbs still run; `releaser rc --ref main --dry-run` emits the same JSON contract; `--legacy rc` errors cleanly. <details> <summary>Implementation plan</summary> # Plan: Consolidate release tooling into a single `scripts/releaser` command ## Goal Merge the two separate release programs into one binary at `scripts/releaser`: - `scripts/releaser/v1/` — the current interactive releaser (package `v1`). - `scripts/releaser/v2/` — the current CI `scripts/release-action` (package `v2`). - `scripts/releaser/main.go` — new entrypoint (package `main`). - Uses v2 by default, v1 with `--legacy`. - Exposes 3 subcommands: `rc`, `branch` (cut release branch), `release`. ## Design decision (Option A, chosen) The workflow needs `prepare-release`, `generate-notes`, and `publish` invokable separately (a build happens between prepare and publish). The latter two are version-driven and type-agnostic, so they do not map cleanly onto `rc`/`branch`/`release`. - Visible subcommands `rc`, `branch`, `release` run v2 `prepare-release` with the type baked in and print the same JSON. - Hidden verbs `calculate-version`, `prepare-release`, `generate-notes`, `publish` keep byte-identical flags/stdout, so the workflow change is path-only. Lowest risk; honors "3 subcommands" from a UX perspective. ## `--legacy` semantics - `releaser --legacy` runs the v1 interactive wizard (preserves today's behavior; the wizard auto-detects RC vs release from the branch). - `--legacy` is mutually exclusive with the subcommands (clear error if combined), because v1 auto-detects type and cannot cut a branch. ## Work items 1. Create `v1` and `v2` packages via `git mv`, renaming `package main`. Move the `owner`/`repo` consts into each package. Add `v1.Run(inv, dryRun)` (old wizard `main()` body) and v2 command builders (`CICommands`, `TypeCommand`) so internals stay unexported. 2. New `scripts/releaser/main.go`: top-level `releaser` with `--legacy`, the 3 subcommands, and the hidden compat verbs; delegates to `v1.Run` for legacy. 3. Update references: `tag-and-release.yaml` (3 command paths + header comment) and `scripts/release.sh` (`--legacy`). 4. Verify: build, vet, test, `go run` smoke tests, fmt, lint. 5. Open a single PR from a feature branch. ## Risks / notes - stdout contract for rc/branch/release and the hidden verbs must stay identical (workflow parses stdout); logs go to stderr. - Patch releases from pre-existing `release/X.Y` branches run those branches' own (old) workflow + `scripts/release-action`, so they stay self-consistent. New releases cut from branches containing this change get the new workflow + `scripts/releaser`. No forwarding stub needed since code and workflow ship together. </details> --- This PR was created by Coder Agents on behalf of @f0ssel. |
||
|
Bobby Ho
|
90861ffa75 |
test(enterprise/dbcrypt): add Rotate/Decrypt/Delete regression tests (#26979)
Related to #25389. `enterprise/dbcrypt/cliutil.go`'s `Rotate`, `Decrypt`, and `Delete` are the only interface for migrating database encryption keys, but had zero test coverage. Adds `enterprise/dbcrypt/cliutil_test.go` with per-table regression tests for all three functions. ## Covered The 7 tables currently handled by `Rotate`/`Decrypt`/`Delete`: - `user_links`, `external_auth_links` - `user_secrets` - `gitsshkeys` - `ai_providers`, `ai_provider_keys`, `user_ai_provider_keys` Each table has a happy-path test verifying live rows (and, where the schema allows it, soft-deleted rows) round-trip correctly. `Rotate` and `Decrypt` additionally have a failure-path test per table confirming the operation aborts cleanly with a `DecryptFailedError`, leaving data untouched, when an active `dbcrypt_keys` entry isn't included in the operation. `Delete` takes no cipher argument, so instead each test confirms an encrypted row is wiped while a never-encrypted row is left untouched by the `WHERE ... IS NOT NULL` clauses in its SQL. ## Gaps (follow-up) `crypto_keys`, `mcp_server_configs`, and `mcp_server_user_tokens` are encrypted at rest but are not yet handled by `Rotate`/`Decrypt`/`Delete` at all. This is the bug reported in #25381: an incomplete `--old-keys`/`--keys` list against these tables fails with a foreign key violation on revoke. A follow-up PR will add both the `cliutil.go` fix and matching regression tests for these three tables. |
||
|
dependabot[bot]
|
fd77652993 |
chore: bump github.com/zclconf/go-cty from 1.18.1 to 1.19.0 (#27053)
Bumps [github.com/zclconf/go-cty](https://github.com/zclconf/go-cty) from 1.18.1 to 1.19.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/zclconf/go-cty/blob/main/CHANGELOG.md">github.com/zclconf/go-cty's changelog</a>.</em></p> <blockquote> <h1>1.19.0 (July 6, 2026)</h1> <ul> <li>When building with Go 1.27 or later, the various string operations that are defined in terms of UAX#29 grapheme cluster segmentation will now use the Unicode 17 character properties and rules. For older versions of Go, Unicode 15 is still used.</li> <li>The <code>cty.ValueMarks</code> type, which represents a set of value marks separately from any value, now has method <code>Has</code> for concisely testing if a specific mark is present, and <code>Insert</code> for inserting elements from an <code>iter.Seq[any]</code> into an existing set of marks for easier gradual construction without creating any temporary mark sets.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/zclconf/go-cty/commit/749fb01316b34f996526dc0a799b54ee008436a8"><code>749fb01</code></a> v1.19.0</li> <li><a href="https://github.com/zclconf/go-cty/commit/f6d59fa6af526d7ef9a296ee0fee01ccd3c64840"><code>f6d59fa</code></a> ValueMarks.Has and ValueMarks.Insert</li> <li><a href="https://github.com/zclconf/go-cty/commit/db1a4101f6f4a1ecd63bf25bfd53e7709a2e7e0b"><code>db1a410</code></a> Use Unicode 17 text segmentation rules on Go 1.27</li> <li><a href="https://github.com/zclconf/go-cty/commit/c8df66764124f2e53f491d4d4a4620c13e3b914d"><code>c8df667</code></a> json: Compensate for different JSON error message in Go1.27</li> <li><a href="https://github.com/zclconf/go-cty/commit/9d8f06e30ed204b49a68845101c48c8d439f598b"><code>9d8f06e</code></a> convert: Fix incorrect format string in TestSortTypes</li> <li>See full diff in <a href="https://github.com/zclconf/go-cty/compare/v1.18.1...v1.19.0">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
7b5efe0e14 |
chore: bump google.golang.org/api from 0.286.0 to 0.287.0 (#27056)
Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.286.0 to 0.287.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's releases</a>.</em></p> <blockquote> <h2>v0.287.0</h2> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.286.0...v0.287.0">0.287.0</a> (2026-06-30)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3635">#3635</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/504873e45d4a0993065311ed3f6a0467f2c41ab1">504873e</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3637">#3637</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/5c975bee9f05d3c570eb0d95be248f3cb418739f">5c975be</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3639">#3639</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/9737c4bf678023b300958b55d1548a902ff36c5d">9737c4b</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.286.0...v0.287.0">0.287.0</a> (2026-06-30)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3635">#3635</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/504873e45d4a0993065311ed3f6a0467f2c41ab1">504873e</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3637">#3637</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/5c975bee9f05d3c570eb0d95be248f3cb418739f">5c975be</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3639">#3639</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/9737c4bf678023b300958b55d1548a902ff36c5d">9737c4b</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/googleapis/google-api-go-client/commit/1a444d6fac14a1652ec4a1e0d9eba6fb1bda7045"><code>1a444d6</code></a> chore(main): release 0.287.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3636">#3636</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/9737c4bf678023b300958b55d1548a902ff36c5d"><code>9737c4b</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3639">#3639</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/f0d27e84fd7323958b8700c2da4b496d96561a3d"><code>f0d27e8</code></a> chore(all): update all (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3638">#3638</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/5c975bee9f05d3c570eb0d95be248f3cb418739f"><code>5c975be</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3637">#3637</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/504873e45d4a0993065311ed3f6a0467f2c41ab1"><code>504873e</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3635">#3635</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/8f8eab49770458a0890a0dde6780568a99057776"><code>8f8eab4</code></a> chore(all): update all to 87f3d3e (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3633">#3633</a>)</li> <li>See full diff in <a href="https://github.com/googleapis/google-api-go-client/compare/v0.286.0...v0.287.0">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
c9109247e9 |
chore: bump google.golang.org/grpc from 1.81.1 to 1.82.0 (#27054)
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.81.1 to 1.82.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/grpc/grpc-go/releases">google.golang.org/grpc's releases</a>.</em></p> <blockquote> <h2>Release 1.82.0</h2> <h1>Behavior Changes</h1> <ul> <li>server: Remove support for <code>GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING</code> environment varibale. Strict incoming RPC path validation (which has been the default since <code>v1.79.3</code>) can no longer be disabled. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9112">#9112</a>)</li> <li>transport: Add environment variable to change the default max header list size from <code>16MB</code> to <code>8KB</code>. This may be enabled by setting <code>GRPC_GO_EXPERIMENTAL_ENABLE_8KB_DEFAULT_HEADER_LIST_SIZE=true</code>. This will be enabled by default in a subsequent release. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9019">#9019</a>)</li> <li>balancer: Load Balancing policy registry is now case-sensitive. Set <code>GRPC_GO_EXPERIMENTAL_CASE_SENSITIVE_BALANCER_REGISTRIES=false</code> (and file an issue) to revert to case-insensitive behavior. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9017">#9017</a>)</li> </ul> <h1>New Features</h1> <ul> <li>experimental/stats: Expose a new API, <code>NewContextWithLabelCallback</code>, to register a callback that is invoked when telemetry labels are added. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8877">#8877</a>) <ul> <li>Special Thanks: <a href="https://github.com/seth-epps"><code>@seth-epps</code></a></li> </ul> </li> <li>client: Return a portion of the response body in the error message, when the client receives an unexpected non-gRPC HTTP response, to make debugging easier. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8929">#8929</a>) <ul> <li>Special Thanks: <a href="https://github.com/chengxilo"><code>@chengxilo</code></a></li> </ul> </li> <li>server: Add environment variable <code>GRPC_GO_SERVER_GOROUTINE_LABELS</code> that controls setting <code>runtime/pprof.Labels</code> on goroutines spawned by the server. Set <code>GRPC_GO_SERVER_GOROUTINE_LABELS=grpc.method=true</code> to add the <code>grpc.method</code> label on goroutines spawned to handle incoming requests. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9082">#9082</a>) <ul> <li>Special Thanks: <a href="https://github.com/dfinkel"><code>@dfinkel</code></a></li> </ul> </li> </ul> <h1>Bug Fixes</h1> <ul> <li>xds/server: Fix a memory leak of HTTP filter instances occurring when route configurations are updated in-place during a Route Discovery Service (RDS) update. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9138">#9138</a>)</li> <li>grpc: In the deprecated <code>gzip</code> Compressor (used via the deprecated <code>WithCompressor</code> dial option), enforce the <code>MaxRecvMsgSize</code> limit on the decompressed message buffer, preventing excessive memory allocation from highly compressed payloads. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9114">#9114</a>) <ul> <li>Special Thanks: <a href="https://github.com/evilgensec"><code>@evilgensec</code></a></li> </ul> </li> <li>stats/opentelemetry: Record retry attempts, <code>grpc.previous-rpc-attempts</code>, at the call level and not the attempt level. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8923">#8923</a>)</li> <li>encoding: Ensure <code>Close()</code> is always called on readers returned from <code>Compressor.Decompress</code> if possible. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9135">#9135</a>)</li> <li>channelz: Fix the <code>LastMessageSentTimestamp</code> and <code>LastMessageReceivedTimestamp</code> fields in <code>SocketMetrics</code> to ensure they contain correct timestamp values. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9109">#9109</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/grpc/grpc-go/commit/bd239854f0ab7f1ee63457d47f7c1d2675e1f736"><code>bd23985</code></a> Change version to 1.82.0 (<a href="https://redirect.github.com/grpc/grpc-go/issues/9170">#9170</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/0f3086db7a755b6af83a90809471dd7f645b345a"><code>0f3086d</code></a> Fix minor issues not covered by PR <a href="https://redirect.github.com/grpc/grpc-go/issues/9137">#9137</a> (<a href="https://redirect.github.com/grpc/grpc-go/issues/9147">#9147</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/fef07fbb2b94b668e8daca1f6b70433dcd36c1c8"><code>fef07fb</code></a> internal: Split v3procservicepb import into pb and grpc for extproc (<a href="https://redirect.github.com/grpc/grpc-go/issues/9163">#9163</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/91dd64f4b83cb5134e279d1126ebb1ccf47d4d31"><code>91dd64f</code></a> transport: surface subsequent data when receiving non-gRPC header (<a href="https://redirect.github.com/grpc/grpc-go/issues/8929">#8929</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/adc97de9521a9f377dab5e911039842dc4de23e5"><code>adc97de</code></a> test/kokoro: add config for regional-td test (<a href="https://redirect.github.com/grpc/grpc-go/issues/9158">#9158</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/57c9ff14e05b535ee6995ba49bc882b287a175de"><code>57c9ff1</code></a> xds: ensure full-string matching for RBAC Filter rules (<a href="https://redirect.github.com/grpc/grpc-go/issues/9148">#9148</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/b58f32d9ff07c612d64e677bd826bcbec88af9bd"><code>b58f32d</code></a> server: Set a pprof label on new stream goroutines (<a href="https://redirect.github.com/grpc/grpc-go/issues/9082">#9082</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/6c98be31ce0aec1592b783b0edb16916eb5acd89"><code>6c98be3</code></a> refactor(transport): extract shared stream state handling logic in `loopyWrit...</li> <li><a href="https://github.com/grpc/grpc-go/commit/bcaa6f4df4546c86e12ef3e95852c7baf7a08d67"><code>bcaa6f4</code></a> rls: only reset backoff on recovery from TRANSIENT_FAILURE (<a href="https://redirect.github.com/grpc/grpc-go/issues/9137">#9137</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/429e6e06363a01f0dd9f9b6b9cf0c0e6617cda12"><code>429e6e0</code></a> balancer: expose endpoint weight and hostname as experimental APIs (<a href="https://redirect.github.com/grpc/grpc-go/issues/9074">#9074</a>)</li> <li>Additional commits viewable in <a href="https://github.com/grpc/grpc-go/compare/v1.81.1...v1.82.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
10d9ad0fc0 |
chore: bump github.com/go-chi/httprate from 0.15.0 to 0.16.0 (#27055)
[//]: # (dependabot-start) ⚠️ **Dependabot is rebasing this PR** ⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Bumps [github.com/go-chi/httprate](https://github.com/go-chi/httprate) from 0.15.0 to 0.16.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-chi/httprate/releases">github.com/go-chi/httprate's releases</a>.</em></p> <blockquote> <h2>v0.16.0</h2> <h2>What's Changed</h2> <ul> <li>perf: replace fmt with strconv to reduce allocations by <a href="https://github.com/EricGusmao"><code>@EricGusmao</code></a> in <a href="https://redirect.github.com/go-chi/httprate/pull/55">go-chi/httprate#55</a></li> <li>local counter: align windows to reset at sub-millisecond counter start by <a href="https://github.com/VojtechVitek"><code>@VojtechVitek</code></a> in <a href="https://redirect.github.com/go-chi/httprate/pull/58">go-chi/httprate#58</a></li> <li>test: drop golang.org/x/sync dependency (errgroup → sync.WaitGroup) by <a href="https://github.com/VojtechVitek"><code>@VojtechVitek</code></a> in <a href="https://redirect.github.com/go-chi/httprate/pull/59">go-chi/httprate#59</a></li> <li>perf: use zero-alloc xxh3.HashString on the local counter hot path by <a href="https://github.com/VojtechVitek"><code>@VojtechVitek</code></a> in <a href="https://redirect.github.com/go-chi/httprate/pull/60">go-chi/httprate#60</a></li> <li>Deprecate spoofable RealIP rate-limiting; add LimitBy + KeyFromContext and modernize the key API by <a href="https://github.com/VojtechVitek"><code>@VojtechVitek</code></a> in <a href="https://redirect.github.com/go-chi/httprate/pull/61">go-chi/httprate#61</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/EricGusmao"><code>@EricGusmao</code></a> made their first contribution in <a href="https://redirect.github.com/go-chi/httprate/pull/55">go-chi/httprate#55</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-chi/httprate/compare/v0.15.0...v0.16.0">https://github.com/go-chi/httprate/compare/v0.15.0...v0.16.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-chi/httprate/commit/741b4a550f982dab146dee10f2b154b01c06facd"><code>741b4a5</code></a> Deprecate spoofable RealIP rate-limiting; add LimitBy + KeyFromContext and mo...</li> <li><a href="https://github.com/go-chi/httprate/commit/81255de73f43306ad57c9cf01693a7d5172678df"><code>81255de</code></a> perf: use zero-alloc xxh3.HashString on the local counter hot path (<a href="https://redirect.github.com/go-chi/httprate/issues/60">#60</a>)</li> <li><a href="https://github.com/go-chi/httprate/commit/0c2093ae43d739627fba9eb197280f97f460c611"><code>0c2093a</code></a> test: replace golang.org/x/sync/errgroup with sync.WaitGroup (<a href="https://redirect.github.com/go-chi/httprate/issues/59">#59</a>)</li> <li><a href="https://github.com/go-chi/httprate/commit/89e5cca2fbfd6645307b73a15b69a979d4c1dcf4"><code>89e5cca</code></a> local counter: align windows to reset at sub-millisecond counter start (<a href="https://redirect.github.com/go-chi/httprate/issues/58">#58</a>)</li> <li><a href="https://github.com/go-chi/httprate/commit/be2ba84c12680b356b271bdf6104c9b465f3c1de"><code>be2ba84</code></a> replace fmt with strconv to reduce allocations (<a href="https://redirect.github.com/go-chi/httprate/issues/55">#55</a>)</li> <li>See full diff in <a href="https://github.com/go-chi/httprate/compare/v0.15.0...v0.16.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
dfef6ae0a7 |
chore: bump github.com/aws/aws-sdk-go-v2/service/sts from 1.43.3 to 1.44.0 (#27052)
Bumps [github.com/aws/aws-sdk-go-v2/service/sts](https://github.com/aws/aws-sdk-go-v2) from 1.43.3 to 1.44.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/fa3ee1a83b9edac9669159650622bcfe3003b44c"><code>fa3ee1a</code></a> Release 2023-11-21</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/6e0c553b49b1fd84753d3ea440be93011d36cf40"><code>6e0c553</code></a> Regenerated Clients</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/32fa00b32e99f9004aadc5750d508a9393d03d57"><code>32fa00b</code></a> Update endpoints model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/72eae5c284e11b1f167fe17282ae1ee821a11659"><code>72eae5c</code></a> Update API model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/1c69d08daccf94d9114d2463adc02e59e85b4deb"><code>1c69d08</code></a> fix: don't expect response to be json in endpointcreds provider (<a href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/2381">#2381</a>)</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/3bd97c063d962a34ca496720a3ce00ef4affe5fd"><code>3bd97c0</code></a> fix: don't send 0 max items for object version and multipart upload paginator...</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/b3e07aa0a0dd26ec46095c28ce65301da2e78dba"><code>b3e07aa</code></a> Release 2023-11-20</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/2fc1c0dab14dff82fc2c2465cb7c40a4157196a0"><code>2fc1c0d</code></a> Regenerated Clients</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/1a6bd026243230178e775059d27038c0ced194ea"><code>1a6bd02</code></a> Update endpoints model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/ac2c871bff4a9fbb6284f1dcc061fdcabea346f3"><code>ac2c871</code></a> Update API model</li> <li>Additional commits viewable in <a href="https://github.com/aws/aws-sdk-go-v2/compare/service/amp/v1.43.3...service/s3/v1.44.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
4dade44e72 |
chore: bump github.com/go-chi/chi/v5 from 5.2.4 to 5.3.1 (#27051)
Bumps [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) from 5.2.4 to 5.3.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-chi/chi/releases">github.com/go-chi/chi/v5's releases</a>.</em></p> <blockquote> <h2>v5.3.1</h2> <h2>What's Changed</h2> <ul> <li>Honor Discard() in httpFancyWriter.ReadFrom by <a href="https://github.com/DucMinhNe"><code>@DucMinhNe</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1110">go-chi/chi#1110</a></li> <li>Tidy build directives by <a href="https://github.com/JRaspass"><code>@JRaspass</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1113">go-chi/chi#1113</a></li> <li>feat(middleware): add text/xml and application/xml to default compressible types by <a href="https://github.com/VojtechVitek"><code>@VojtechVitek</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1127">go-chi/chi#1127</a></li> <li>Fix defaultLogEntry.Panic not respecting NoColor setting by <a href="https://github.com/doganarif"><code>@doganarif</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1050">go-chi/chi#1050</a></li> <li>middleware: document printPrettyStack and harden NoColor panic test by <a href="https://github.com/VojtechVitek"><code>@VojtechVitek</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1131">go-chi/chi#1131</a></li> <li>feat(mux): support http QUERY method ietf rfc10008 by <a href="https://github.com/VojtechVitek"><code>@VojtechVitek</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1132">go-chi/chi#1132</a></li> <li>ci: pin GitHub Actions to full commit SHAs by <a href="https://github.com/XananasX7"><code>@XananasX7</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1116">go-chi/chi#1116</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/DucMinhNe"><code>@DucMinhNe</code></a> made their first contribution in <a href="https://redirect.github.com/go-chi/chi/pull/1110">go-chi/chi#1110</a></li> <li><a href="https://github.com/doganarif"><code>@doganarif</code></a> made their first contribution in <a href="https://redirect.github.com/go-chi/chi/pull/1050">go-chi/chi#1050</a></li> <li><a href="https://github.com/XananasX7"><code>@XananasX7</code></a> made their first contribution in <a href="https://redirect.github.com/go-chi/chi/pull/1116">go-chi/chi#1116</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-chi/chi/compare/v5.3.0...v5.3.1">https://github.com/go-chi/chi/compare/v5.3.0...v5.3.1</a></p> <h2>v5.3.0</h2> <h2>What's Changed</h2> <ul> <li>Use strings.ReplaceAll where applicable by <a href="https://github.com/JRaspass"><code>@JRaspass</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1046">go-chi/chi#1046</a></li> <li>Propagate inline middlewares across mounted subrouters by <a href="https://github.com/LukasJenicek"><code>@LukasJenicek</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1049">go-chi/chi#1049</a></li> <li>add go 1.26 to ci by <a href="https://github.com/pkieltyka"><code>@pkieltyka</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1052">go-chi/chi#1052</a></li> <li>Remove last uses of io/ioutil by <a href="https://github.com/JRaspass"><code>@JRaspass</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1054">go-chi/chi#1054</a></li> <li>Simplify chi.walk with slices.Concat by <a href="https://github.com/JRaspass"><code>@JRaspass</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1053">go-chi/chi#1053</a></li> <li>Apply the stringscutprefix modernizer by <a href="https://github.com/JRaspass"><code>@JRaspass</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1051">go-chi/chi#1051</a></li> <li>Bump minimum Go to 1.23, always use request.Pattern by <a href="https://github.com/JRaspass"><code>@JRaspass</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1048">go-chi/chi#1048</a></li> <li>middleware: fix httpFancyWriter.ReadFrom double-counting bytes with Tee by <a href="https://github.com/alliasgher"><code>@alliasgher</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1085">go-chi/chi#1085</a></li> <li>Fix typo in Route doc comment by <a href="https://github.com/gouwazi"><code>@gouwazi</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1073">go-chi/chi#1073</a></li> <li>fix: set Request.Pattern from RoutePattern() by <a href="https://github.com/leno23"><code>@leno23</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1097">go-chi/chi#1097</a></li> <li>feat: middleware.ClientIP, a replacement for middleware.RealIP by <a href="https://github.com/VojtechVitek"><code>@VojtechVitek</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/967">go-chi/chi#967</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/LukasJenicek"><code>@LukasJenicek</code></a> made their first contribution in <a href="https://redirect.github.com/go-chi/chi/pull/1049">go-chi/chi#1049</a></li> <li><a href="https://github.com/alliasgher"><code>@alliasgher</code></a> made their first contribution in <a href="https://redirect.github.com/go-chi/chi/pull/1085">go-chi/chi#1085</a></li> <li><a href="https://github.com/gouwazi"><code>@gouwazi</code></a> made their first contribution in <a href="https://redirect.github.com/go-chi/chi/pull/1073">go-chi/chi#1073</a></li> <li><a href="https://github.com/leno23"><code>@leno23</code></a> made their first contribution in <a href="https://redirect.github.com/go-chi/chi/pull/1097">go-chi/chi#1097</a></li> </ul> <h2>SECURITY: middleware.ClientIP, a replacement for middleware.RealIP</h2> <p><a href="https://github.com/VojtechVitek"><code>@VojtechVitek</code></a> submitted PR <a href="https://redirect.github.com/go-chi/chi/issues/967">#967</a>, which introduces middleware.ClientIP — a replacement for middleware.RealIP that closes the three open spoofing advisories:</p> <ul> <li><a href="https://github.com/go-chi/chi/security/advisories/GHSA-9g5q-2w5x-hmxf">GHSA-9g5q-2w5x-hmxf</a> — IP spoofing via XFF in <code>RemoteAddr</code> resolution (convto)</li> <li><a href="https://github.com/go-chi/chi/security/advisories/GHSA-rjr7-jggh-pgcp">GHSA-rjr7-jggh-pgcp</a> — RealIP allows IP spoofing via unvalidated XFF (rezmoss)</li> <li><a href="https://github.com/go-chi/chi/security/advisories/GHSA-3fxj-6jh8-hvhx">GHSA-3fxj-6jh8-hvhx</a> — IP spoofing in <code>middleware.RealIP</code> (Saku0512, Critical / 9.3)</li> </ul> <p>It also addresses issues outlined at:</p> <ul> <li><a href="https://redirect.github.com/go-chi/chi/issues/708">go-chi/chi#708</a></li> <li><a href="https://adam-p.ca/blog/2022/03/x-forwarded-for/">https://adam-p.ca/blog/2022/03/x-forwarded-for/</a></li> <li><a href="https://redirect.github.com/go-chi/chi/issues/711">go-chi/chi#711</a></li> <li><a href="https://redirect.github.com/go-chi/chi/issues/453">go-chi/chi#453</a></li> <li><a href="https://redirect.github.com/go-chi/chi/pull/908">go-chi/chi#908</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-chi/chi/commit/8b258c7bb28f97a5f2a856ff7ef962578fec9215"><code>8b258c7</code></a> ci: pin GitHub Actions to full commit SHAs (<a href="https://redirect.github.com/go-chi/chi/issues/1116">#1116</a>)</li> <li><a href="https://github.com/go-chi/chi/commit/caf87e6e1bd9f29326f2ffdb93d8098139f08e4f"><code>caf87e6</code></a> feat(mux): support http QUERY method ietf rfc10008 (<a href="https://redirect.github.com/go-chi/chi/issues/1132">#1132</a>)</li> <li><a href="https://github.com/go-chi/chi/commit/7fcb8a20364d7b72e2d5a0e413ae80346e1c99c8"><code>7fcb8a2</code></a> middleware: document printPrettyStack and harden NoColor panic test (<a href="https://redirect.github.com/go-chi/chi/issues/1131">#1131</a>)</li> <li><a href="https://github.com/go-chi/chi/commit/878fe71fc9e506a63ea6957ed09c9ce84f789e97"><code>878fe71</code></a> Fix defaultLogEntry.Panic not respecting NoColor setting (<a href="https://redirect.github.com/go-chi/chi/issues/1050">#1050</a>)</li> <li><a href="https://github.com/go-chi/chi/commit/d7b767bcbea51e486bdc9fd06d25136767ec14b5"><code>d7b767b</code></a> feat(middleware): add text/xml and application/xml to default compressible ty...</li> <li><a href="https://github.com/go-chi/chi/commit/3b50c7cc35ff25f384202409733c3332c150e0ec"><code>3b50c7c</code></a> Tidy build directives (<a href="https://redirect.github.com/go-chi/chi/issues/1113">#1113</a>)</li> <li><a href="https://github.com/go-chi/chi/commit/2b9fca258f92830fc8232582e9e05a4d4a572a5d"><code>2b9fca2</code></a> Honor Discard() in httpFancyWriter.ReadFrom (<a href="https://redirect.github.com/go-chi/chi/issues/1110">#1110</a>)</li> <li><a href="https://github.com/go-chi/chi/commit/3b171578ca44dfd75ca3c5cbddc7b44c600a7b49"><code>3b17157</code></a> feat: middleware.ClientIP, a replacement for middleware.RealIP (<a href="https://redirect.github.com/go-chi/chi/issues/967">#967</a>)</li> <li><a href="https://github.com/go-chi/chi/commit/818fdcfc4786168651768377ba647cf9dd5b3953"><code>818fdcf</code></a> fix: set Request.Pattern from RoutePattern() (<a href="https://redirect.github.com/go-chi/chi/issues/1097">#1097</a>)</li> <li><a href="https://github.com/go-chi/chi/commit/f975af0cb10cbefaccf0422385420fe62722d648"><code>f975af0</code></a> Fix typo in Route doc comment (<a href="https://redirect.github.com/go-chi/chi/issues/1073">#1073</a>)</li> <li>Additional commits viewable in <a href="https://github.com/go-chi/chi/compare/v5.2.4...v5.3.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
242a10585c |
chore: bump github.com/klauspost/compress from 1.18.6 to 1.19.0 (#27050)
Bumps [github.com/klauspost/compress](https://github.com/klauspost/compress) from 1.18.6 to 1.19.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/klauspost/compress/releases">github.com/klauspost/compress's releases</a>.</em></p> <blockquote> <h2>v1.19.0</h2> <h2>What's Changed</h2> <ul> <li>zstd: Add true concurrent stream encoding by <a href="https://github.com/klauspost"><code>@klauspost</code></a> in <a href="https://redirect.github.com/klauspost/compress/pull/1136">klauspost/compress#1136</a></li> <li>zstd: arm64 decoder asm by <a href="https://github.com/lizthegrey"><code>@lizthegrey</code></a> in <a href="https://redirect.github.com/klauspost/compress/pull/1160">klauspost/compress#1160</a></li> <li>zstd: avoid unused BuildDict encoder allocation by <a href="https://github.com/snissn"><code>@snissn</code></a> in <a href="https://redirect.github.com/klauspost/compress/pull/1147">klauspost/compress#1147</a></li> <li>flate: Add inflate checkpoints by <a href="https://github.com/klauspost"><code>@klauspost</code></a> in <a href="https://redirect.github.com/klauspost/compress/pull/1154">klauspost/compress#1154</a></li> <li>snappy/s2: Limit length of varint in <code>decodedLen</code> by <a href="https://github.com/eustas"><code>@eustas</code></a> in <a href="https://redirect.github.com/klauspost/compress/pull/1148">klauspost/compress#1148</a></li> <li>gzhttp: match qvalue parameter case-insensitively (RFC 7231) by <a href="https://github.com/z9z"><code>@z9z</code></a> in <a href="https://redirect.github.com/klauspost/compress/pull/1149">klauspost/compress#1149</a></li> <li>zip: add NameDecoder callback for legacy encoding rewrite by <a href="https://github.com/SAY-5"><code>@SAY-5</code></a> in <a href="https://redirect.github.com/klauspost/compress/pull/1150">klauspost/compress#1150</a></li> <li>huff0: Allow building tables from histogram. by <a href="https://github.com/klauspost"><code>@klauspost</code></a> in <a href="https://redirect.github.com/klauspost/compress/pull/1155">klauspost/compress#1155</a></li> <li>huff0: Allow building table from oversized histogram. by <a href="https://github.com/klauspost"><code>@klauspost</code></a> in <a href="https://redirect.github.com/klauspost/compress/pull/1156">klauspost/compress#1156</a></li> <li>s2sx: Clean symlink targets by <a href="https://github.com/klauspost"><code>@klauspost</code></a> in <a href="https://redirect.github.com/klauspost/compress/pull/1163">klauspost/compress#1163</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/snissn"><code>@snissn</code></a> made their first contribution in <a href="https://redirect.github.com/klauspost/compress/pull/1147">klauspost/compress#1147</a></li> <li><a href="https://github.com/eustas"><code>@eustas</code></a> made their first contribution in <a href="https://redirect.github.com/klauspost/compress/pull/1148">klauspost/compress#1148</a></li> <li><a href="https://github.com/z9z"><code>@z9z</code></a> made their first contribution in <a href="https://redirect.github.com/klauspost/compress/pull/1149">klauspost/compress#1149</a></li> <li><a href="https://github.com/SAY-5"><code>@SAY-5</code></a> made their first contribution in <a href="https://redirect.github.com/klauspost/compress/pull/1150">klauspost/compress#1150</a></li> <li><a href="https://github.com/HNO3Miracle"><code>@HNO3Miracle</code></a> made their first contribution in <a href="https://redirect.github.com/klauspost/compress/pull/1165">klauspost/compress#1165</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/klauspost/compress/compare/v1.18.6...v1.19.0">https://github.com/klauspost/compress/compare/v1.18.6...v1.19.0</a></p> <h2>v1.18.7</h2> <ul> <li>Fix s2.NewDict OOB read.</li> </ul> <p>Security release without other changes.</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/klauspost/compress/compare/v1.18.6...v1.18.7">https://github.com/klauspost/compress/compare/v1.18.6...v1.18.7</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/klauspost/compress/commit/f0953f938f77977980c3b9f8c09eec06f2e88a69"><code>f0953f9</code></a> flate: fix buffer formatting in tests (<a href="https://redirect.github.com/klauspost/compress/issues/1165">#1165</a>)</li> <li><a href="https://github.com/klauspost/compress/commit/ab2e3cc7ab261c8f287639760d8532afb7125425"><code>ab2e3cc</code></a> zstd: Add arm64 decoder asm (<a href="https://redirect.github.com/klauspost/compress/issues/1160">#1160</a>)</li> <li><a href="https://github.com/klauspost/compress/commit/bb2723d55de85353fd5a1817cbc382997a6a75aa"><code>bb2723d</code></a> Merge commit from fork</li> <li><a href="https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536"><code>539243b</code></a> s2sx: Clean symlink targets (<a href="https://redirect.github.com/klauspost/compress/issues/1163">#1163</a>)</li> <li><a href="https://github.com/klauspost/compress/commit/bd9228c884559c21e572a0eaf827ee903bca805c"><code>bd9228c</code></a> Apply go fix and check in CI (<a href="https://redirect.github.com/klauspost/compress/issues/1158">#1158</a>)</li> <li><a href="https://github.com/klauspost/compress/commit/4cc176c3325ba1d87aacfdea015a3a2038fefb08"><code>4cc176c</code></a> zstd: Add true concurrent stream encoding (<a href="https://redirect.github.com/klauspost/compress/issues/1136">#1136</a>)</li> <li><a href="https://github.com/klauspost/compress/commit/4705fcbaf5155f466ca877527f66e88634cdf1c2"><code>4705fcb</code></a> build(deps): bump the github-actions group with 3 updates (<a href="https://redirect.github.com/klauspost/compress/issues/1157">#1157</a>)</li> <li><a href="https://github.com/klauspost/compress/commit/e9c2e569c112ecc1ad8ab818ed7328e7178973e4"><code>e9c2e56</code></a> huff0: Allow building table from oversized histogram. (<a href="https://redirect.github.com/klauspost/compress/issues/1156">#1156</a>)</li> <li><a href="https://github.com/klauspost/compress/commit/ecdb779d8745b0b074dcee75d9f7fd2bd524aff8"><code>ecdb779</code></a> huff0: Allow building tables from histogram. (<a href="https://redirect.github.com/klauspost/compress/issues/1155">#1155</a>)</li> <li><a href="https://github.com/klauspost/compress/commit/38efa458d47cc5555ce4a08796ddf2bf5ca22d87"><code>38efa45</code></a> zip: add NameDecoder callback for legacy encoding rewrite (<a href="https://redirect.github.com/klauspost/compress/issues/1150">#1150</a>)</li> <li>Additional commits viewable in <a href="https://github.com/klauspost/compress/compare/v1.18.6...v1.19.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
a575899f47 |
chore: bump golang.org/x/text from 0.38.0 to 0.39.0 in the x group (#27049)
Bumps the x group with 1 update: [golang.org/x/text](https://github.com/golang/text). Updates `golang.org/x/text` from 0.38.0 to 0.39.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/text/commit/b326f3d3c814ab79b3c516f4ac03c2314d8df65f"><code>b326f3d</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/text/commit/5ae8e578e495731553eddba11b2d0e86c91a00ce"><code>5ae8e57</code></a> unicode/norm: avoid infinite loop on invalid input</li> <li><a href="https://github.com/golang/text/commit/0dc94a239c8bc3b7ef3aa0d059e54af960f459f4"><code>0dc94a2</code></a> all: fix some comments</li> <li>See full diff in <a href="https://github.com/golang/text/compare/v0.38.0...v0.39.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Sas Swart
|
fc188fdaee |
fix: create agent firewall sessions without requiring agent read access (#26990)
## Overview Part of the **boundary correlation** feature. Fixes lazy creation of `boundary_sessions` rows so it works within the agent's RBAC constraints, and consumes the new `ConfinedProcessName` field reported by boundary. Pairs with coder/boundary#206, which adds `ConfinedProcessName` to `ReportBoundaryLogsRequest`. This branch bumps the `github.com/coder/boundary` module to pick up that work. ## Problem `ensureSession` did a pre-insert existence check via `GetBoundarySessionByID`. Agents are **not permitted to read boundary sessions**, so that read path is not viable when the session is created from an agent-reported log batch. ## Changes - **Remove the pre-insert read.** `ensureSession` now inserts directly and treats a primary-key unique violation as success, covering sessions already created by a prior batch, a reconnection, or another coderd replica — without requiring read access. - **Per-connection guard.** Add a mutex-protected `ensuredSessions` set so repeated log batches on the same connection skip the existence check and insert entirely, touching the database only for the logs. On a transient insert failure the session is left unmarked so the next batch retries. - **Consume `ConfinedProcessName`.** Pass `req.GetConfinedProcessName()` through to the session insert. - **Bump boundary module** from `v0.9.0` to `v0.9.1-0.20260706095856-35ba90f9e8b2`. - **Tests.** - Add `TestReportBoundaryLogsAgentRBAC` (`coderd/boundary_logs_test.go`), an integration test that connects as a real workspace agent, verifies the session and log are persisted under agent RBAC, and asserts the agent subject cannot read boundary sessions — guarding against reintroducing a pre-insert read. - Add `TestReportBoundaryLogsSessionGuard` (session inserted once across two batches, logs inserted per batch) and `TestReportBoundaryLogsSessionRetriedOnError` (insert retried after a transient error). - Regenerate `agent-firewall` CLI docs/golden files and adjust the clidocgen template to render the YAML path when a flag has no long name. > 🤖 This PR was opened by Coder Agents on behalf of @SasSwart. |
||
|
Michael Suchacz
|
0ae4554de9 | fix(coderd/x/chatd/chatloop): remove compaction timeout (#27007) | ||
|
Michael Suchacz
|
07f4c9f550 |
fix(site): set spend today range to end of day (#26992)
Selecting Today in the AI spend usage date range picker sent an end date rounded to the next hour, which made refreshed usage pages show stale partial-day data. This lets the shared date range picker keep its existing next-hour default for template insights while the spend usage and drill-in pickers request an end-of-day boundary for Today. Closes https://linear.app/codercom/issue/CODAGT-751/date-range-picker-uses-end-of-hour-for-today Generated by Coder Agents. |
||
|
Jon Ayers
|
8996506d43 | fix: use a unique channel name per latency measurement (#27040) | ||
|
Ethan
|
8b60d1d877 |
ci: cache embedded postgres binaries in flake checks (#26986)
flake-go keeps failing every `TestServer` subtest that boots `coder server` with built-in PostgreSQL ([example run](https://github.com/coder/coder/actions/runs/28685288282/job/85134336803)) with `no version found matching 13.21.0`, which is embedded-postgres's error for any non-200 while downloading the Postgres binary archive from Maven. The archive gets cached under the server's config root, which is a fresh temp dir in every test, so with `test-count: 35` one flake run downloads it dozens of times and Maven rate-limits the runner. Using an external Postgres (like coder/terraform-provider-coderd#370 did) would defeat the point, since these subtests exist to exercise the built-in Postgres path. Instead, `startBuiltinPostgres` now honors `EMBEDDED_PG_CACHE_DIR` as the archive cache path (test runs only, data/runtime dirs stay per-test), and flake-go.yaml wires in the existing `embedded-pg-cache` actions the same way the Windows/macOS lanes in ci.yaml already do. All iterations then share a single download, and usually zero once the actions cache is warm. The upload step only saves on `main`. |
||
|
dependabot[bot]
|
6b4c940379 |
chore: bump the coder-modules group across 2 directories with 1 update (#27035)
Bumps the coder-modules group with 1 update in the /dogfood/coder directory: coder/vscode-web/coder. Bumps the coder-modules group with 1 update in the /dogfood/vscode-coder directory: coder/vscode-web/coder. Updates `coder/vscode-web/coder` from 1.5.1 to 1.6.0 Updates `coder/vscode-web/coder` from 1.5.1 to 1.6.0 Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Andrew Aquino
|
517df93367 |
fix(site/src/pages/TemplateBuilder): allow TemplateCard to be selected if it has no variables (#27031)
Fixes a bug where if `base.variables` is not defined, clicking a `TemplateCard` fails (no base template gets selected) and this error gets logged: ``` Uncaught TypeError: Cannot read properties of undefined (reading 'length') ``` <img width="1840" height="1191" alt="image" src="https://github.com/user-attachments/assets/b51a1f05-ab58-4b17-a126-350604f9832b" /> |
||
|
Jeremy Ruppel
|
8afdf0f7e1 |
fix(site/src/pages/TemplateBuilder): use variable defaults as field values, not just placeholders (#27032)
Variables with defaults showed the default as placeholder text in an empty field. If the user did not type anything, an empty value was sent instead of the default. Now the default pre-populates the field value so it is visible and editable. Fixes both `BaseTemplateParametersStep` and `ModuleSettingsStep` by falling back to `defaultPlaceholder(v.default)` instead of `""` when no user value exists. Fixes DEVEX-584 > [!NOTE] > This PR was authored by Coder Agents on behalf of @jeremyruppel. |
||
|
Michael SuchaczandMathias Fredriksson
|
1eb5d579b0 |
fix: unblock manual chat title generation for unowned chats (#26963)
## Problem
The Generate button in the chat Rename dialog (POST
`/api/experimental/chats/{chat}/title/propose`) could fail in ways
unrelated to actual concurrent title generation:
- The manual title lock returned 409 for any `pending` chat and any
`running` chat without a worker. Legacy `pending` rows are never
acquired by workers, so those chats 409'd forever. Running chats are
unowned in the normal window between message submission and worker
acquisition (indefinitely when runners are down), producing spurious
409s.
- A missing default chat model config surfaced as a generic 500, and the
dialog hid the actionable cause carried in the error detail.
## Fix
Backend (`coderd/x/chatd`, `coderd`, `coderd/database`):
- Remove the manual title lock entirely. Races between title writers are
already resolved by `recordManualTitleUsage`, which re-reads the chat
under `GetChatByIDForUpdate` and only persists the generated title when
it is unchanged since the request snapshot, so concurrent regenerates
and renames settle by last write wins. The lock only suppressed
duplicate model calls (the dialog already disables the button in flight,
and usage limits bound spend), and its synthetic `worker_id` marker was
the source of the spurious 409s. The 409 responses, the marker and
staleness handling, and the now-unused
`UpdateChatStatusPreserveUpdatedAt` query are gone.
- New `ErrNoDefaultChatModelConfig` sentinel mapped to 400 "No default
chat model config is configured." in both title endpoints, matching the
POST `/chats` precedent.
Frontend (`site`):
- The Rename dialog error alert now renders the API error detail under
the message, reading `error.response.data.detail` directly so
detail-less API errors do not show the generic developer-console hint.
- Removed the dead regenerate-title UI plumbing (`onRegenerateTitle`
outlet wiring and the `regeneratingTitleChatIds` spinner pipeline). The
Rename dialog propose flow is the only live title-generation UX; the
endpoint, codersdk methods, and the `api.ts`/`queries/chats.ts` layer
are kept for API consumers.
## Tests
- chatd internal: a strict-mock test pinning the compare-and-swap guard
(a concurrently changed title must not be clobbered by a generated one),
plus the existing persist-and-broadcast coverage without lock
transactions.
- HTTP: `PendingWithoutWorker` expects 200 for both endpoints,
`NoDefaultModelConfig` (400) subtests, a stopped-workspace propose
regression, and an `Unauthenticated` propose subtest.
- Storybook: stories asserting the API error detail renders in the
dialog alert, and that detail-less API errors and plain errors do not
leak the developer-console hint.
> Authored by Mux on Mike's behalf.
---------
Co-authored-by: Mathias Fredriksson <mafredri@gmail.com>
|
||
|
Andrew Aquino
|
4f98fa1e03 |
fix(site/src/pages/OrganizationSettingsPage): enable sticky positioning for horizontal form sections (#26949)
Followup to #26907, which re-enabled sticky positioning within `#main-content` throughout the site. From https://github.com/coder/coder/pull/26907#issuecomment-4860536495: >Updating [`HorizontalSection` in OrganizationSettingsPageView.tsx]'s sticky styles will be a little more involved, so I'll save that for a separate PR. ## before Note that I inflated this section's height to 1000px in DevTools to be able to demo sticky positioning not working. This page isn't tall enough at the moment for the lack of sticky positioning to be much of a problem. But this will future-proof it (since `FormSection`, whose sticky styles were fixed in #26907, was built for this purpose) and allow us to remove some redundant components/files. No other files imported `HorizontalContainer` or `HorizontalSection`, so OrganizationSettingsPage/Horizontal.tsx can be safely deleted. Also note that the **Info** section is sticky as expected, since it was already using `FormSection`. The **Workspace Sharing** and **Delete Organization** sections are the ones whose stickiness is fixed by this PR https://github.com/user-attachments/assets/9ffed486-87f7-4762-a97a-4268d0328829 ## after https://github.com/user-attachments/assets/581cb33e-50b5-466e-9be9-2518dc22bfa6 |
||
|
Danielle Maywood
|
d51762440b | feat: add custom AI provider icons and instance-based model picker grouping (#27026) | ||
|
Jeremy Ruppel
|
581f906947 |
fix(coderd): declare project_id variable in GCP template builder bases (#27015)
## Summary
GCP base templates (`gcp-linux`, `gcp-windows`) in the Template Builder
had a Terraform `variable "project_id"` with no default, but their
`base.json` manifests didn't declare it. The UI never prompted for it,
so the provisioner import always failed with:
```
required template variables need values: project_id
```
## Changes
- Add `project_id` as a required variable in both GCP `base.json`
manifests
- Convert templates from raw Terraform variable blocks to Go template
injection (`{{ .Variables.project_id }}`), matching the existing
kubernetes pattern
- Fix `DefaultBaseRenderContext` to supply a `"REQUIRED"` placeholder
for required variables without defaults (previously rendered as `<no
value>`)
- Replace duplicate test subtests with proper GCP coverage including a
missing-variable error case
<details>
<summary>Implementation plan</summary>
### Root cause
The GCP base templates contained `variable "project_id" {}` (no default
= required) in their `.tf.tmpl` files, but the `base.json` manifests had
an empty `variables` array. The Template Builder UI
(`BaseTemplateParametersStep`) is data-driven from `base.json`, so it
never showed a field for `project_id`. The composed Terraform output
still contained the required variable, causing the provisioner import to
fail.
### Fix approach
Follow the pattern established by the kubernetes base template:
1. Declare variables in `base.json` so the UI prompts for them
2. Use Go template syntax (`{{ .Variables.project_id }}`) to inject
values at compose time
3. Remove raw Terraform `variable` blocks from the template since the
value is now baked in
### Files changed
| File | Change |
|---|---|
| `bases/gcp-linux/base.json` | Added `project_id` as a required
variable |
| `bases/gcp-windows/base.json` | Added `project_id` as a required
variable |
| `bases/gcp-linux/main.tf.tmpl` | Removed Terraform variable block, use
Go template injection |
| `bases/gcp-windows/main.tf.tmpl` | Same |
| `bases.go` | `DefaultBaseRenderContext` supplies placeholder for
required vars without defaults |
| `compose_test.go` | Replaced duplicate subtests with proper GCP tests
|
| `templatebuilder_handler_test.go` | Updated `gcp-windows` spec to
expect `project_id` variable |
| Golden files | Regenerated |
</details>
> 🤖 Generated by Coder Agents on behalf of @jeremyruppel
|
||
|
Ben PotterandJeremy Ruppel
|
7b19ec3933 |
feat: improve the image management experience with template builder (#27018)
Makes it easier to pick the right workspace image, both in the template builder and in the docs. - Template builder: the Docker and Kubernetes bases now expose a `container_image` variable in the wizard (freeform text, defaults to `codercom/example-base:ubuntu`), and their prerequisites explain why image choice matters, with tradeoffs between `codercom/example-base:ubuntu` (minimal) and `codercom/example-universal:ubuntu` (catch-all), plus pointers to [coder/images](https://github.com/coder/images) and the image management docs. - Docs: reworked [image management](https://coder.com/docs/@ben%2Fdevrel-201-image-guidance-prereqs/admin/templates/managing-templates/image-management) into a clearer maturity ladder (minimal → golden → project-specific → developer customization), with pullable image references in every example, `codercom/oss-dogfood` as a project-specific example, and Dev Containers + [mise](https://mise.jdx.dev/) as ways to customize without new images. Companion PR for the starter templates: coder/registry#943 Part of DEVREL-201. 🤖 Generated with Coder Agents using Claude, on behalf of @bpmct (wizard variable by @jeremyruppel in #27024) --------- Co-authored-by: Jeremy Ruppel <jeremyruppel@users.noreply.github.com> |
||
|
Callum Styan
|
bf58e8a402 | fix(coderd): require deployment-wide workspace read permissions for WatchAllWorkspaceBuilds endpoint (#26985) | ||
|
McKayla はな
|
feef3602a3 | fix(site): create workspace form width (#27014) | ||
|
Andrew Aquino
|
95fde35194 |
feat(site): add OSC 52 clipboard support to web terminal (#26437)
Registers an OSC 52 handler on the xterm.js terminal parser so that programs like tmux can copy text to the browser's system clipboard via escape sequences (e.g. `printf "\\033]52;c;$(echo -n 'Coder is Cool' | base64)\\a"`). The handler decodes the base64 payload and writes it using the existing `copyToClipboard` utility, which provides an HTTP fallback for insecure contexts. Clipboard read queries (`?`) are ignored since responding would require writing back to the PTY. No new dependencies are needed; xterm.js 5.5.0 already exposes `terminal.parser.registerOscHandler`. Closes https://github.com/coder/coder/issues/16577 Generated by Coder Agents on behalf of @aqandrew. ## relevant context from agent chat, summarized by me ref DEVEX-465 Installing [@xterm/addon-clipboard](https://npmx.dev/package/@xterm/addon-clipboard) would have been another way to implement this feature. This would follow established addon-loading patterns in `WorkspaceTerminal`: https://github.com/coder/coder/blob/612b6d4e95ac4eb1c4227dfd5979a04c2de6e600/site/src/modules/terminal/WorkspaceTerminal.tsx#L232-L241 However, registering a custom handler instead has a few advantages re: security and flexibility: - security - **ignoring OSC 52 with clipboard read queries** (`payload === "?"`) prevents processes in the workspace from reading the user's clipboard without consent - flexibility - **ignoring OSC 52 with invalid base64** -- If the addon catches an error while decoding base64, an empty string will be copied to the clipboard, i.e., the clipboard contents get cleared, which would be surprising/frustrating to users. The custom handler doesn't write anything to the clipboard in this case. - **ignoring OSC 52 with missing separator** -- The addon returns true in this case (marks the OSC 52 as handled); the custom handler returns false (doesn't mark the OSC 52 as handled) The approach/tests seem sound to me. I would just ask that someone among reviewers manually test this with tmux, since I'm not a tmux user 🙏🏽 |
||
|
Michael Suchacz
|
6e0bbb5fff | fix(site): hide slash skills menu when user has no personal skills (#26953) | ||
|
Yevhenii Shcherbina
|
2ec7f5c69b |
test: fix TestUserAIBudgetOverride audit flake (#27013)
Closes https://linear.app/codercom/issue/AIGOV-502/flake-testuseraibudgetoverrideauditupsertspendlimit The `Audit/UpsertEverything` and `Audit/UpsertSpendLimit` subtests grabbed `rows[0]` from `GetAuditLogsOffset`, assuming strict time-desc order. Both upserts emit `AuditActionWrite` against the same override with no ordering tiebreaker, so when the create and update entries share a timestamp the create entry could sort first and fail the assertion. Select the update entry by the spend limit it results in via a new `auditLogByNewSpendLimit` helper instead of by row position. <hr/> We could make `auditLogByNewSpendLimit` more generic, but since we don't have any other use cases for it right now, I think we can postpone that until the need arises. Related PR: https://github.com/coder/coder/pull/26630/changes |
||
|
Hugo Dutka
|
96130e2bc5 |
chore(coderd/x/chatd): address generation review items (#26517)
Addresses the deferred `coderd/x/chatd/generation.go` review comments from PR #26109: [required generation dependencies](https://github.com/coder/coder/pull/26109#discussion_r3380311853), [scoped chat variables](https://github.com/coder/coder/pull/26109#discussion_r3387161874), [generation state error handling](https://github.com/coder/coder/pull/26109#discussion_r3387191468), [generation attempt return values](https://github.com/coder/coder/pull/26109#discussion_r3387251382), [generation fence verification](https://github.com/coder/coder/pull/26109#discussion_r3387288234), and [chatdebug outcome recording](https://github.com/coder/coder/pull/26109#discussion_r3387544273). This makes generation task dependencies explicit, packages generation attempt episode state into a struct, and centralizes generation task fence checks for generation transitions. Generated by Coder Agents, closely reviewed by Hugo. |
||
|
Ironbelly
|
2de8b3c74a |
Merge pull request #25638 from ironbelly/docs/cli-ssh-argv-quoting
docs: clarify argv quoting behavior with `--` |
||
|
Jeremy Ruppel
|
79fc8541ed |
docs: update template creation docs for template builder (#26993)
## Summary
Update documentation across 9 files to present the template builder as
the primary template creation method, replacing the old starter
templates flow as the default entry point.
The template builder is a guided wizard that lets admins select base
infrastructure, add registry modules, configure variables, and produce
validated Terraform without writing HCL.
## Changes
**Primary docs (significant rewrites):**
- `docs/admin/templates/creating-templates.md`: Added "Using the
template builder" as the first section with full 5-step wizard
documentation, screenshots, airgap/registry notes, and alternative
creation links. Moved CLI starter template flow to its own section.
Fixed "You can the" typo.
- `docs/get-started/index.md`: Rewrote Steps 4-6 to use the builder with
the Docker base template instead of the Coder Quickstart (which is not a
builder base template). Generalized workspace parameter instructions.
- `docs/start/first-template.md`: Rewrote to use the builder. Removed
old starter templates references, TODO notes, typo, and commented-out
sections.
**Secondary docs (targeted edits):**
- `docs/admin/templates/index.md`: Replaced starter templates section
with builder-first "Create a template" section.
- `docs/admin/templates/managing-templates/index.md`: Renamed "Starter
templates" to "Creating templates" pointing to the builder.
- `docs/install/airgap.md`: Added "Template builder" section documenting
`CODER_DISABLE_TEMPLATE_BUILDER` and
`CODER_TEMPLATE_BUILDER_REGISTRY_URL`.
- `docs/tutorials/template-from-scratch.md`: Added TIP callout
recommending the builder. Fixed `coder templates create` -> `coder
templates push` inconsistency.
- `docs/admin/integrations/devcontainers/envbuilder/add-envbuilder.md`:
Updated Dashboard tab to reference the builder and "Upload an existing
template" alternative.
- `docs/about/screenshots.md`: Updated caption and image reference for
template builder.
**Screenshots added:**
- `templatebuilder_01_bases.png` (base selection step)
- `templatebuilder_02_modules.png` (module selection step)
- `templatebuilder_03_module_customization.png` (module settings step)
- `templatebuilder_04_customizations.png` (template customizations step)
<details>
<summary>Implementation plan</summary>
# Plan: Update docs/ for Template Builder Launch
## Summary
The Template Builder is a new guided wizard at `/templates/new/builder`
that lets admins create templates by selecting a base infrastructure
template, composing it with registry modules, configuring variables, and
producing a validated Terraform bundle without writing HCL. The docs
need to be updated to present this as the primary/recommended template
creation path, while preserving the existing paths (upload, CLI,
duplicate) as alternatives.
## Key behavioral facts from the code
- **Route**: `/templates/new/builder` (new), `/templates/new` (old,
still exists)
- **Entry point**: The "New Template" button on the Templates page links
to `/templates/new/builder` when the builder is enabled; otherwise falls
back to `/starter-templates`
- **5-step wizard**:
1. **Select base infrastructure** (e.g., Docker, AWS EC2, Kubernetes)
2. **Base template parameters** (optional, skipped if base has none)
3. **Select modules** (IDE, AI Agent, Source Control, etc.;
multi-select, grouped by category)
4. **Module settings** (optional, skipped if no configurable variables)
5. **Template customizations** (name, display name, description, icon,
organization)
- **Alternative creation links** are shown on step 1: "Start from
scratch", "Upload an existing template", "Browse community templates",
"Use template agent skill"
- **Disabled via**: `CODER_DISABLE_TEMPLATE_BUILDER` env var /
`--disable-template-builder` flag. When disabled, redirects to old
`/templates/new` flow
- **Registry URL override**: `CODER_TEMPLATE_BUILDER_REGISTRY_URL`
(default: `registry.coder.com`)
- **Requires outbound access** to `registry.coder.com` for `terraform
init` at compose time
- **Modules are bundled** with the Coder release binary; the builder
does not fetch metadata from the registry at runtime
- **Sensitive variables** (secrets) are not collected by the builder;
they are deferred to workspace creation time
- **Module conflicts** show a warning but do not block creation
- **One-way**: No re-entry into the builder for existing templates; edit
HCL directly after creation
## Files to update
### Tier 1: Primary creation flow docs (significant rewrites)
#### 1. `docs/admin/templates/creating-templates.md`
**Current state**: Documents three creation paths: "From a starter
template" (primary), "From an existing template", "From scratch
(advanced)".
**Changes**:
- Add a new section **"Using the template builder"** as the first and
primary section (before "From a starter template").
- Describe the 5-step wizard flow: select base infrastructure, configure
base parameters, select modules, configure module settings, set template
customizations.
- Mention that the builder is enabled by default and requires outbound
access to `registry.coder.com`.
- Note that sensitive variables are collected from developers at
workspace creation, not during template building.
- Add a callout about disabling the builder for airgapped deployments
(`CODER_DISABLE_TEMPLATE_BUILDER`).
- Note the `CODER_TEMPLATE_BUILDER_REGISTRY_URL` option for self-hosted
registry mirrors.
- Keep existing "From a starter template", "From an existing template",
and "From scratch" sections largely intact, but reframe them as
alternative paths.
- Update the "From a starter template" Web UI instructions to note the
new entry point routing (the "New Template" button now goes to the
builder when enabled).
- Fix existing typo: "You can the [Coder CLI]" should be "You can use
the [Coder CLI]".
#### 2. `docs/start/first-template.md`
**Current state**: Beginner tutorial walking through creating a template
from the Docker starter template via the old flow. Has a typo (`s` at
end of line 32), commented-out workspace creation section, and TODO
notes.
**Changes**:
- Rewrite steps 2 and 3 to use the Template Builder as the primary path.
- Step 2: Navigate to **Templates**, select **New Template**, which
opens the Template Builder.
- Step 3: Walk through the builder wizard steps (select Docker base,
optionally select modules like code-server, configure template
name/description, create).
- Remove the typo on line 32 (`s`).
- Keep the "Modify your template" section (step 6) intact since it
covers post-creation editing which is unchanged.
- Remove or update the reference to "Starter Templates" as a separate
page since the builder subsumes that entry point.
#### 3. `docs/get-started/index.md`
**Current state**: Quickstart guide. Step 4 says "Select **Templates** →
**New Template**" then pick "Coder Quickstart" from starter templates.
**Changes**:
- Update Step 4 to describe using the Template Builder.
- The flow becomes: Select **Templates** → **New Template** → builder
opens → select **Coder Quickstart** as the base template → optionally
add modules → set name/description → **Create Template**.
- Update the "What just happened?" explanation to mention the builder
composed and validated the Terraform.
- Screenshot reference `create-quickstart-template.png` will need a new
screenshot (note this in the PR; screenshots are out of scope for this
change but should be flagged).
### Tier 2: Secondary references (targeted edits)
#### 4. `docs/admin/templates/index.md`
**Current state**: Overview page mentioning starter templates as the
primary creation path.
**Changes**:
- Update the "Starter templates" section to mention the Template Builder
as the recommended way to create templates, with starter templates
serving as base templates within the builder.
- Update the link to point to the builder section: `[Create a template
with the template
builder](./creating-templates.md#using-the-template-builder)`.
- Update the screenshot reference and caption. The "Starter Templates"
page screenshot may no longer be the first thing admins see.
#### 5. `docs/admin/templates/managing-templates/index.md`
**Current state**: Documents starter templates, editing, updating,
deleting.
**Changes**:
- Update the "Starter templates" section to mention the Template Builder
as the primary creation path, with starter templates available as base
templates within it.
- Update the image reference from `starter-templates.png` if it shows
the old flow.
#### 6. `docs/tutorials/template-from-scratch.md`
**Current state**: Detailed tutorial for writing a template from scratch
with Terraform.
**Changes**:
- Add a brief note at the top recommending the Template Builder for
users who want to create templates without writing Terraform, with a
link to
`docs/admin/templates/creating-templates.md#using-the-template-builder`.
- In section "7. Create the template in Coder" → "Dashboard" tab, update
the UI steps. The "Upload template" option is now accessed via the old
creation flow at `/templates/new` (or through the "Upload an existing
template" link in the builder's alternatives).
- Fix the inconsistency where text says `coder templates create` but the
code block uses `coder templates push`.
#### 7.
`docs/admin/integrations/devcontainers/envbuilder/add-envbuilder.md`
**Current state**: Documents creating envbuilder templates via
Dashboard, CLI, and Registry tabs.
**Changes**:
- In the Dashboard tab, update the instructions. The "Create Template"
button now opens the builder by default. Users need to use the "Upload
an existing template" alternative link or navigate to `/templates/new`
directly.
- Update "From scratch" reference since that option is now an
alternative link in the builder.
- The CLI and Registry tabs remain unchanged.
#### 8. `docs/install/airgap.md`
**Current state**: Documents air-gapped installations. No mention of
Template Builder.
**Changes**:
- Add a note in the relevant section about the Template Builder
requiring outbound access to `registry.coder.com`.
- Document `CODER_DISABLE_TEMPLATE_BUILDER` for fully air-gapped
deployments.
- Document `CODER_TEMPLATE_BUILDER_REGISTRY_URL` for deployments using a
self-hosted registry mirror.
#### 9. `docs/about/screenshots.md`
**Current state**: Contains a caption "Template administrators can
either create a new Template from scratch or choose a Starter Template".
**Changes**:
- Update the caption to mention the Template Builder as the primary
creation method.
- Screenshot reference may need updating (flag for new screenshot).
### Tier 3: Minor/link-only updates
#### 10. `docs/admin/users/organizations.md`
- If it references the old "Create Template" screen with an org picker,
add a note that the Template Builder also includes organization
selection in its final step.
#### 11. `docs/ai-coder/tasks.md`
- If it mentions creating templates, add a passing reference to the
Template Builder as an option.
## Files NOT to update
- `docs/reference/api/templatebuilder.md`: Auto-generated API reference.
Already correct.
- `docs/reference/api/schemas.md`: Auto-generated. Already correct.
- `docs/reference/cli/server.md`: Auto-generated. Already has
`--disable-template-builder` and `--template-builder-registry-url`.
- `docs/reference/cli/templates_create.md`: Already deprecated.
- `docs/reference/cli/templates.md`: No changes needed.
## Implementation order
1. `docs/admin/templates/creating-templates.md` (primary creation docs,
most content)
2. `docs/get-started/index.md` (quickstart)
3. `docs/start/first-template.md` (beginner tutorial)
4. `docs/admin/templates/index.md` (overview)
5. `docs/admin/templates/managing-templates/index.md` (managing
overview)
6. `docs/install/airgap.md` (airgap note)
7. `docs/tutorials/template-from-scratch.md` (from-scratch tutorial)
8. `docs/admin/integrations/devcontainers/envbuilder/add-envbuilder.md`
(envbuilder)
9. `docs/about/screenshots.md` (screenshot captions)
10. Minor link/reference updates in tier 3 files
## Style notes
- Follow the Diataxis framework; keep tutorials as tutorials, reference
as reference.
- Use present tense, active voice, second person.
- Bold for UI elements: **Templates**, **New Template**, **Create
Template**.
- No emdash/endash.
- Do not add screenshots; flag where new screenshots are needed as
comments/TODOs.
- Run `make fmt/markdown` and `make lint/markdown` after all changes.
- Verify all pages are already in `docs/manifest.json` (no new pages
being added, only existing pages being updated).
</details>
> 🤖 Generated by Coder Agents
|
||
|
Ethan
|
2cbc464c72 |
fix(coderd): invalidate chatd provider cache on AI provider changes (#26987)
chatd subscribes to `ChatConfigEventChannel` and invalidates its provider cache on a `providers` event kind, but nothing ever published that kind. AI provider CRUD only publishes on `AIProvidersChangedChannel` (consumed by aibridged and aibridgeproxyd), so chatd's provider cache only converged via its 10 second TTL. Subscribe chatd to the same `AIProvidersChangedChannel` publish instead of adding a second publish, per the review feedback on #26207: one publish, multiple subscribers. The now-unused `ChatConfigEventProviders` kind is removed so `ChatConfigEvent` stays scoped to model configs, user prompts, and advisor config, and can't regrow a dead subscriber. Follow-up to CRF-5 from the review of #25673. Supersedes #26207. Closes CODAGT-499 |
||
|
Danielle Maywood
|
7c78698a6d | feat: notify users when chats are shared (#26914) | ||
|
Cian Johnston
|
b21e0717d5 |
feat: remove chat chain mode (#26980)
Removes OpenAI Responses "chain mode" from chatd. Closes CODAGT-445.
- Deletes `chatopenai/responses.go` (chain detection, activation, prompt filtering, response ID extraction) and its tests.
- Deletes the `ChainBroken` classification in `chaterror` and the chatloop retry bookkeeping that disabled chain mode mid-generation.
- Drops the `chain_broken` label from the `coderd_chatd_stream_retries_total` metric.
- Stops reading and writing `chat_messages.provider_response_id`
- Deletes the dead `ClearChatMessageProviderResponseIDsByChatID` query. Dropping the column is a follow-up migration.
- Deletes three chatloop hooks no caller sets (`ReloadMessages`, `DisableChainMode`, `PrepareMessages`), the dead `const AgentChatContextSentinelPath`, and stale chain-mode comments.
🤖 Generated by Coder Agents on behalf of @johnstcn.
|
||
|
Hugo Dutka
|
c0e2811e01 |
fix(coderd/x/chatd): runner bootstrap race (#26989)
Addresses https://github.com/coder/internal/issues/1589. Supersedes https://github.com/coder/coder/pull/26455. The previous fix did not handle the case where there were 2 runners for the same chat: one shutting down and one being bootstrapped. The one shutting down could queue a stale state update which would cause the new runner to immediately exit. |
||
|
Michael Suchacz
|
4669e1c538 | feat(coderd/x/chatd): improve title generation repeatability and quality (#26982) | ||
|
Susana Ferreira
|
64ca5ac9f8 |
refactor(coderd): add budget.CurrentPeriod for [start, end) windows (#26972)
## Description
Extracts the AI budget period computation into a shared
`budget.CurrentPeriod` helper. Pure refactor with no wire-value changes.
## Changes
- Add `budget.CurrentPeriod(now, period)` returning a
`PeriodWindow{Start, End}` in UTC. Unknown periods return an error,
matching the pattern used by `ResolveUserAIBudget` for unknown policies.
- Update the callers and respective tests to use `CurrentPeriod`.
> [!NOTE]
> Initially generated by Claude Opus 4.7, modified and reviewed by
@ssncferreira
|
||
|
Ehab Younes
|
f444c6f585 |
fix(site): flush deferred Radix focus-scope timer before jsdom teardown (#26983)
Radix's FocusScope defers its unmount event dispatch and focus restore with setTimeout(0). The cleanup() in the shared afterEach schedules that timer, and for the last test in a file it could still be pending when vitest tears down the jsdom environment. The callback then constructs a CustomEvent from Node's built-in constructor instead of jsdom's, and jsdom rejects the dispatch with "parameter 1 is not of type 'Event'" as an unhandled error, failing the run. Await one timer turn in afterAll, while the jsdom environment is still alive, to deterministically drain the 0ms timers scheduled by cleanup(). Timers with the same delay run in FIFO order, so this is not a race. Fixes coder/internal#1613 |
||
|
Danny Kopping
|
dd216b96fe |
feat: record provider_item_id for tool usage (#26856)
## Summary Plumbs the Responses output item id (added as `ToolUsageRecord.ItemID` in #26855) through to the database, captured independently of the `provider_tool_call_id` correlation key. Hosted tools (`web_search_call`, etc.) only have an item id; agentic tools have both. `provider_item_id` is specific to the OpenAI Responses API; it stays empty for chat completions and Anthropic messages, which have no separate item id. ## Changes - Migration `000534`: nullable `provider_item_id` column on `aibridge_tool_usages`. - Proto: `item_id` field 11 on `RecordToolUsageRequest`. - Server handler: persists `provider_item_id` and adds it to structured logging. - Translator: maps `ToolUsageRecord.ItemID` to the proto field. ## Tests - `TestRecordToolUsageProviderItemID`: real-database round-trip asserting `provider_item_id` persists for both hosted and agentic tools, independently of `provider_tool_call_id`. Stacked on #26855. Linear: AIGOV-96 --- _This PR was produced by opencode (agent) using the_ _`anthropic/claude-opus-4-8`_ _model, under human direction and review._ |
||
|
Danny Kopping
|
08a6359cac |
feat: record all tool call types (#26855)
## Summary The Responses interceptor previously recorded only `function_call` and `custom_tool_call` output items, so interceptions that did real work via built-in tools (`web_search_call`, `computer_call`, `shell_call`, `mcp_call`, etc.) recorded no tool usage at all. `recordNonInjectedToolUsage` now whitelists every tool-call output type and records it, with the tool name falling back to the item type when none is set. `ToolUsageRecord` also gains an `ItemID` field so the two distinct Responses identifiers are captured without conflation (addresses review feedback on coder/aibridge#273): - `ItemID`: the output item's unique `id` (always present). - `ToolCallID`: the `call_id` correlation id (empty for hosted tools the provider runs server-side). ## Tests - Extends `TestRecordToolUsage` with cases for the new hosted/agentic tool types. - Adds blocking and streaming `web_search` fixtures (scrubbed of credentials and identifying metadata) plus `TestResponsesOutputMatchesUpstream` cases asserting a hosted tool records with an empty `ToolCallID` and a populated `ItemID`. Linear: AIGOV-96 --- *This PR was produced by opencode (agent) using the `anthropic/claude-opus-4-8` model, under human direction and review.* |
||
|
Jaayden HalkoandTracy Johnson
|
14d17abae6 |
chore: remove frontend related regenerate chat title code (#26867)
Co-authored-by: Tracy Johnson <tracy@coder.com> |
||
|
Jake Howell
|
39da38b189 |
fix(site/e2e): accept 404 from external auth reset hook (#26793)
> 🤖 This PR was written by Coder Agents on behalf of Jake Howell. Stack: 1. #26575 `fix(site/e2e): close mock external-auth servers in teardown` 2. #26793 `fix(site/e2e): accept 404 from external auth reset hook` ← this PR 3. #26795 `fix(site/src): refresh provider state after device-flow exchange` 4. #26798 `fix(site/e2e): reset both providers in external auth hook` 5. #26648 `chore(site/e2e): re-enable externalAuth suite` `deleteExternalAuthByID` used to be inverted: `sql.ErrNoRows` (link doesn't exist for this user/provider) fell through to the `500` path, while non-`ErrNoRows` DB errors went to `httpapi.ResourceNotFound`. #19775 (Sep 2025) refactored it to return `404` for not-found and `500` for real DB errors, which is the contract you'd expect. The relevant lines from #19775 in `coderd/externalauth.go`: ```diff - err := api.Database.DeleteExternalAuthLink(ctx, ...) + link, err := api.Database.GetExternalAuthLink(ctx, ...) if err != nil { - if !errors.Is(err, sql.ErrNoRows) { + if errors.Is(err, sql.ErrNoRows) { httpapi.ResourceNotFound(w) return } httpapi.Write(ctx, w, http.StatusInternalServerError, ...) return } ``` `resetExternalAuthKey` in `site/e2e/hooks.ts` still treats `500` as the not-found code, so the first `beforeEach` in the externalAuth suite throws. The suite was skipped at the time #19775 landed (#17235), so nobody noticed the contract drift until #26648 tried to re-enable it. This just flips the accepted status codes to `200 || 404` and rewrites the stale comment. The 401/403/500 paths still surface as failures, which is what we want. Refs https://linear.app/codercom/issue/DEVEX-413 Refs https://github.com/coder/coder/pull/19775 <details> <summary>Why a separate PR</summary> Keeps the bisection signal clean: #26575 proves the EADDRINUSE flake is fixed, this PR fixes the hook contract drift surfaced by re-enabling the suite, and #26648 just flips `.skip`. Squashing into #26648 would conflate two unrelated fixes. The CI run on #26648 already confirms the flake fix is doing its job: `successful external auth from workspace` passes (5.6s) and the `beforeAll`/`afterAll` mock servers come up and tear down cleanly with no EADDRINUSE. The only failures are this 404 hook drift. </details> |
||
|
Itay Dafna
|
d7ad85f7f6 |
feat: support multiple OIDC redirect URIs (#25408)
This PR adds a new opt-in setting, `CODER_OIDC_REDIRECT_ALLOWED_HOSTS`, that lets a single Coder deployment complete OIDC login on more than one hostname. When the allowlist is non-empty, Coder picks the OIDC `redirect_uri` based on the incoming request's Host header (validated against the list) instead of always using the static URL derived from `CODER_ACCESS_URL`. When unset, the (default) behavior is identical to today. The motivation is that a single Coder deployment is frequently reachable via multiple hostnames - for example, an internal hostname for users on a corporate VPN and a different hostname routed through a zero-trust gateway for users off-VPN - but OIDC login today only works on whichever single hostname `CODER_ACCESS_URL` points to, because the `redirect_uri` sent to the IdP is fixed at server startup. Users who reach the deployment on any other valid hostname can see the login page but fail the OIDC callback, since the IdP redirects them back to a hostname they can't reach (or whose cookies they don't have). |
||
|
Yevhenii Shcherbina
|
121107f151 |
docs: document the Bedrock external ID for role assumption (#26973)
Document the Bedrock external ID for role assumption. |
||
|
Yevhenii Shcherbina
|
ab69fa2f0d |
fix(aibridge/provider): disable keep-alive on the STS assume-role client (#26971)
A Bedrock provider that assumes an IAM role kept failing with `AssumeRole` `AccessDenied` for several minutes after its target role's trust policy was changed, and only recovered on a gateway restart or a long wait. The request itself was correct: the AWS CLI, using the same identity and the same `ExternalId`/role/region, accepted the identical request immediately against the same endpoint. The difference is the connection. The Go SDK reuses a keep-alive connection for the STS client, so every `AssumeRole` rides one connection pinned to a single STS endpoint. After a trust-policy change, that connection kept returning `AccessDenied` for minutes while a fresh connection (the AWS CLI) accepted the identical request at once; it recovered only when the connection recycled or the process restarted. The exact STS-internal reason is unconfirmed (likely per-endpoint propagation of the change) — what is verified is that a fresh connection per call recovers promptly. Disable keep-alive on the STS client so each `AssumeRole` opens a fresh connection and a trust-policy update takes effect quickly. `AssumeRole` runs at most once per credential-cache lifetime, so keep-alive bought nothing here. The change is scoped to the STS client only; Bedrock model requests are signed by a separate client and keep their connection pooling. ## What the data proves | | CLI | Gateway | |--------------------|-------------------------------------------|------------------------------------------| | Identity / key | `bedrock-base-user-useless` / `AKIA…44NL` | same | | STS endpoint | `sts.us-east-2.amazonaws.com` | same | | Request params | `ExternalId=QL53…`, role, session, 900 | same | | Recovery after fix | 7 seconds (21:27:54) | ~4.5 minutes (21:32:17) | | Re-hitting AWS? | new call each time | yes — 77 fresh `AssumeRole`s, all denied | Same identity, params, and endpoint, concurrent — yet the gateway was denied for ~4.5 minutes while the CLI recovered in 7 seconds, and the gateway made a fresh `AssumeRole` on every request (so it was not caching a failure). The only difference was connection reuse. After disabling keep-alive, the same break/fix experiment brought gateway recovery down from ~4.5 minutes to ~7 seconds, in lockstep with the AWS CLI. |
||
|
Susana Ferreira
|
1989db0e2b |
feat(coderd): enforce ai budget on pre-request path (#26915)
## Description Adds pre-request AI budget enforcement to `aibridged`. Requests are rejected with HTTP 403 when the user's aggregated spend for the current period has reached their effective limit. ## Changes - Add `IsBudgetExceeded` RPC to `aibridgedserver`. Resolves the user's effective budget, aggregates spend over the caller-supplied `[period_start, now]` window, and returns whether the limit has been reached along with the effective limit. - Wire the check into `aibridged`'s HTTP handler. The caller computes the period start (monthly for now) and passes it in the request. - Reject exceeded requests with HTTP 403 Forbidden and a message directing the user to contact an administrator. - Add `dbtime.StartOfMonth` alongside `StartOfDay` for period computation. - Add real-DB tests covering the enforcement path: month-boundary excludes prior-period spend, and a new user override unblocks a previously-exceeded user. Closes https://linear.app/codercom/issue/AIGOV-428/add-pre-request-budget-enforcement > [!NOTE] > Initially generated by Claude Opus 4.7, modified and reviewed by @ssncferreira |
||
|
Susana Ferreira
|
be9c95c8f5 |
feat(coderd): accumulate user daily AI spend on token usage (#26741)
## Description Adds post-response spend accumulation to `RecordTokenUsage`. ## Changes - Wrap the token usage insert and daily spend increment in a single transaction. - Skip the spend update when the user is unbudgeted, the model is unpriced, or the computed cost is non-positive. Depends on #26562 Closes https://linear.app/codercom/issue/AIGOV-427/add-post-response-spend-accumulation > [!NOTE] > Initially generated by Claude Opus 4.7, modified and reviewed by @ssncferreira |
||
|
Jake Howell
|
b1ef07c79d |
feat(site): add linear.svg icon (#26967)
> 🤖 This PR was written by Coder Agents on behalf of Jake Howell.
Adds a bundled `linear.svg` icon at `site/static/icon/linear.svg` so
template authors can reference Linear as a first-party `/icon/`.
`site/src/theme/icons.json` is regenerated by `make
site/src/theme/icons.json` — the diff is a single-line insertion between
`lakefs.svg` and `lxc.svg`.
## Verification
- `go test ./scripts/gensite -run TestSVGIconAttributes/linear.svg` —
PASS (`width="256"`, `height="256"`, `viewBox="0 0 256 256"`)
- `make lint/site-icons` — PASS
- `go test ./scripts/gensite -count=1` — PASS (full SVG attribute sweep)
|
||
|
Susana Ferreira
|
fcdd029d74 |
feat: add ai_user_daily_spend table and queries (#26562)
## Description Adds the spend tracking table and queries needed by [AIGOV-427](https://linear.app/codercom/issue/AIGOV-427/add-post-response-spend-accumulation) (post-response accumulation) and [AIGOV-428](https://linear.app/codercom/issue/AIGOV-428/add-pre-request-budget-enforcement) (pre-request enforcement). ## Changes - Add `ai_user_daily_spend` table to aggregate per-user, per-effective-group AI spend by UTC day. - Add `UpsertUserAIDailySpend` and `GetUserAISpendSince` queries. Closes https://linear.app/codercom/issue/AIGOV-426/add-daily-spend-table-and-queries > [!NOTE] > Initially generated by Claude Opus 4.7, modified and reviewed by @ssncferreira |
||
|
Yevhenii ShcherbinaandJake Howell
|
dee41c34e6 |
feat: show Bedrock external ID in the provider edit form (#26919)
Surfaces the server-generated STS external ID on the Bedrock provider edit form. When a provider assumes a role, the form shows the external ID read-only with a copy icon and a short note to add it to the target role's trust policy as an sts:ExternalId condition. The value is display-only: it is passed to the form as its own prop rather than as an editable form value, so it is never submitted back. This matches the backend contract, where the external ID is server-owned and a changed value is rejected. Builds on the backend in #26869. Follow-up to #26578. --------- Co-authored-by: Jake Howell <jake@hwll.me> |