14694 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Michael Suchacz	c4792cf104	fix: show Anthropic Opus 4.7+ thinking (#26026) ... ## Summary - Updates Coder's pinned `github.com/coder/fantasy` fork to include coder/fantasy#39. - Exposes Anthropic `thinking_display` as a typed chat model provider option with `summarized` and `omitted` values. - Validates configured `thinking_display` values and maps them to `fantasyanthropic.ProviderOptions.ThinkingDisplay`. - Regenerates the API/UI option schemas so the admin model config form gets a generated select field. ## Tests - `go mod tidy` - `make gen` - `go test ./codersdk ./coderd/x/chatd/chatprovider ./coderd -run 'TestChatModelProviderOptions|TestAnthropicThinkingDisplayFromChat|TestProviderOptionsFromChatModelConfig_AnthropicThinkingDisplay|TestMergeMissingProviderOptions_AnthropicThinkingDisplay|TestValidateChatModelProviderOptions_AnthropicThinkingDisplay'` - `go test ./coderd/x/chatd/... ./codersdk` - `go test ./coderd -run 'TestValidateChatModelProviderOptions_AnthropicThinkingDisplay'` - `pnpm --dir site exec -- biome lint --error-on-warnings src/api/chatModelOptionsGenerated.json src/api/typesGenerated.ts` - pre-commit hook, including fmt, lint, and slim build > Mux working on behalf of Mike.	2026-06-05 08:37:54 +02:00
Ethan	5578ac5f3d	fix(cli): bound Coder Connect SSH probe (#26090) ... Coder Connect DNS should answer from the local Coder Connect resolver, so `coder ssh --stdio` now gives the optional DNS availability probe a 100ms budget and falls back to the normal tunnel when DNS paths blackhole absolute `.coder.` lookups instead of answering NXDOMAIN. Closes https://github.com/coder/coder/issues/22581.	2026-06-05 16:08:20 +10:00
Callum StyanandMux	4627b01415	fix: reduce agentfake manager startup time (#25669) ... Signed-off-by: Callum Styan <callumstyan@gmail.com> Co-authored-by: Mux <noreply@coder.com>	2026-06-04 15:28:13 -07:00
Andrew AquinoandCarolina Urrea	6dedae4858	fix(site): count workspaces to delete scoped to organization (#25943) ... ref DEVEX-268 branched from #24799 ^Modifies that PR to include a Storybook test to verify correct behavior when deleting a template that's attached to a workspace --------- Co-authored-by: Carolina Urrea <73137943+canourrea23@users.noreply.github.com>	2026-06-04 15:18:05 -07:00
Michael Suchacz	242c4d791b	fix(coderd): isolate OIDC fake IDP in parallel subtests (#26075)	2026-06-04 23:03:02 +02:00
Zach	45475b803e	test(agent): remove race in TestAgent_Session_TTY_QuietLogin/Hushlogin (#25865) ... The subtest previously called session.Shell(), wrote "exit 0" through a client-side PTY, and then waited indefinitely on session.Wait(). Under the race detector the byte stream occasionally arrived at the agent before the remote shell was in its read loop and was silently discarded; the shell never exited, session.Wait() blocked until the go-test watchdog kicked in and killed the test binary. The agent writes the message of the day announcement banner synchronously in agentssh.startPTYSession before forking the user shell. The subtest now repeatedly sends "exit 0" and the writes/waiting on session.Wait are time bound. Also fixes a pre-existing test bug where the empty bytes intended to create ~/.hushlogin were written to the MOTD path. The previous test passed only because the MOTD file ended up empty, not because the hushlogin code path was exercised. With the file now placed at the correct path, the assertion genuinely validates isQuietLogin. Generated with assistance from Coder Agents.	2026-06-04 13:52:51 -06:00
Garrett Delfosse	b95697a370	ci: rewrite release workflow to be fully GitHub Actions-driven (#25162) ... Replace the local interactive release CLI and legacy shell scripts with a non-interactive Go tool (`scripts/release-action/`) and a rewritten `release.yaml` workflow. Release managers trigger releases from the GitHub Actions UI by selecting a branch, picking a release type (`rc`, `release`, or `create-release-branch`), and optionally providing a commit SHA. The Go tool has four subcommands: `calculate-version` (computes next version from git state), `generate-notes` (release notes from commit log and PR metadata), `publish` (creates GitHub release with checksums), and the workflow handles tag creation, branch creation, building, and downstream publishing. `scripts/version.sh` fallback now uses `git describe` (nearest ancestor tag) instead of global latest so dev builds on release branches show the correct version series.	2026-06-04 14:38:48 -04:00
Garrett Delfosse	d5b0e93c6c	fix!: reject OIDC login when email_verified claim is non-bool or absent (#25713) ... ## Problem The OIDC callback checks `email_verified` via a Go type assertion (`verifiedRaw.(bool)`). When an IdP returns the claim as a string (`"false"`), a number, or omits it entirely, the assertion fails silently and the email is implicitly treated as verified. Several real IdPs (SAML-to-OIDC bridges, certain Azure AD B2C configurations) emit string-typed booleans, making this reachable in practice. ## Fix Add `coerceEmailVerified()` to handle `bool`, `string` (`"true"`/`"false"`/`"1"`/`"0"` via `strconv.ParseBool`), `float64`, `json.Number`, and `int`/`int64` variants. Rewrite the check to be fail-closed: an absent claim, an unrecognized type, or any non-truthy value is treated as unverified and rejected. The existing `IgnoreEmailVerified` config option remains as an escape hatch. Fixes https://linear.app/codercom/issue/PLAT-228 > Generated with [Coder Agents](https://coder.com) by @f0ssel <details><summary>Implementation plan</summary> ### Production code (`coderd/userauth.go`) - Added `encoding/json` import - Added `coerceEmailVerified(v interface{}) (verified bool, ok bool)` helper near EOF - Replaced the type-assertion block (lines ~1342-1363) with fail-closed logic that uses `coerceEmailVerified` ### Unit tests (`coderd/userauth_internal_test.go`, new file) - Table-driven test covering: `bool`, `string` (`"true"`, `"false"`, `"1"`, `"0"`, `"TRUE"`, `"t"`, `"f"`, `"invalid"`, `""`), `json.Number`, `float64`, `int`, `int64`, `nil`, `[]string{}`, `map[string]string{}` ### Integration tests (`coderd/userauth_test.go`, `coderd/users_test.go`) - Added 3 new test cases: `EmailVerifiedMissingIgnored` (200), `EmailVerifiedAsStringTrue` (200), `EmailVerifiedAsStringFalse` (403) - Updated existing test cases that omitted `email_verified` and expected success to include `"email_verified": true` ### FakeIDP (`coderd/coderdtest/oidctest/idp.go`) - `encodeClaims` now defaults `email_verified` to `true` (like `exp`, `aud`, `iss`) so tests that don't care about the verification flow are unaffected </details>	2026-06-04 14:37:19 -04:00
Garrett DelfosseandCoder Agents	53d287a139	fix(coderd)!: restrict OIDC email fallback to first-time account linking (#25712) ... ## Problem `findLinkedUser` in `coderd/userauth.go` falls back to email-based user lookup when no `linked_id` match is found. This fallback was used for **all logins**, not just first-time linking. An attacker who registers the victim's email at the IdP (with a different OIDC subject) bypasses the `linked_id` check and gets matched to the victim's Coder account. Combined with the `email_verified` type assertion bypass (PLAT-228), this creates a chained account-takeover vector. ## Fix Restrict the email fallback in `findLinkedUser` so that when a user found by email already has a `user_link` with a non-empty `linked_id` that **differs** from the current login's `linked_id`, the function returns no user. This blocks account takeover while preserving: - **First-time linking**: No existing `user_link` exists, email fallback works as before. - **Legacy links**: Empty `linked_id` (pre-migration), email fallback still works. - **Normal logins**: Matching `linked_id` resolves via the primary path, no fallback needed. Also adds a `UpdateUserLinkedID` query to backfill `linked_id` on legacy links (only when currently empty) during login, gradually migrating them to the secure path. The `findLinkedUser` signature now accepts `loginType` explicitly instead of relying on `user.LoginType`, ensuring the correct link is checked in the legacy lookup. ## Breaking change Marked `release/breaking`. An account whose `user_link` already has a populated `linked_id` that does not match the subject the IdP presents will now be denied login (403) instead of silently resolving via the email fallback. The most likely trigger is changing `CODER_OIDC_ISSUER_URL` (the `linked_id` is `issuer||subject`), or two identities sharing one email. Accounts with an empty (legacy) `linked_id` are unaffected and are backfilled on their next login. Fixes: https://linear.app/codercom/issue/PLAT-229 <details><summary>Implementation details</summary> ### Files changed - `coderd/userauth.go`: Core fix in `findLinkedUser` + backfill logic in `oauthLogin` - `coderd/database/queries/user_links.sql`: New `UpdateUserLinkedID` query - `coderd/database/dbauthz/dbauthz.go`: Authorization for new query (`ActionUpdate` on the user object, matching `InsertUserLink`) - `coderd/userauth_test.go`: New OIDC and GitHub tests - Generated files: `queries.sql.go`, `querier.go`, `dbmock.go`, `querymetrics.go` ### New tests - `TestUserOIDC/OIDCEmailFallbackBlockedByExistingLink`: Attacker with a different `sub` but the same email is rejected (403) when the victim has an existing link (covers signups enabled and disabled). - `TestUserOIDC/OIDCFirstTimeLinkByEmailAllowed`: User created via SCIM/API (no `user_link`) can still link via email on first OIDC login, and the `linked_id` is populated. - `TestUserOIDC/OIDCLegacyLinkBackfill`: User with empty `linked_id` can login and their `linked_id` is backfilled with the correct value. - `TestUserOIDC/OIDCEmailFallbackBlockedByIssuerChange`: Existing link recorded under a previous issuer is rejected (403) after the issuer changes (documents the breaking behavior). - `TestUserOAuth2Github/EmailFallbackBlockedByExistingLink`: GitHub attacker with a different user ID but the victim's email is rejected (403). </details> > [!NOTE] > This PR was authored by Coder Agents on behalf of @f0ssel. --------- Co-authored-by: Coder Agents <agents@coder.com>	2026-06-04 14:36:56 -04:00
Garrett Delfosse	76bf462bbf	fix(coderd): prevent user-admin from resetting owner password (#25709) ... `PUT /api/v2/users/{user}/password` was protected only by `ActionUpdatePersonal`, which the built-in `user-admin` role holds site-wide. No guard prevented targeting an owner. The old-password check is skipped for non-self resets, so a user-admin could reset any owner's password and authenticate as them, gaining full deployment control. Add an owner-role guard to `putUserPassword` that refuses password-reset requests when the target holds the owner role unless the caller is also an owner. This is modeled on the guard in `putUserStatus`, but differs in that it conditionally allows owner-to-owner resets (whereas `putUserStatus` blocks all suspension of owners regardless of caller). Fixes https://linear.app/codercom/issue/PLAT-227 <details><summary>Implementation details</summary> - Guard inserted after the `Authorize` check, before `httpapi.Read` - `apiKey.UserID != user.ID` gates the check so self-password-change is unaffected - Acting user's roles fetched from DB to verify owner status (same pattern as `putUserStatus`) - Returns HTTP 400 consistent with sibling handler error style - Two new test cases: `UserAdminCannotResetOwnerPassword`, `OwnerCanResetOwnerPassword` </details> > Generated with [Coder Agents](https://coder.com) by @f0ssel	2026-06-04 14:36:25 -04:00
Mathias Fredriksson	20d678b886	fix(agent): install connstats callback at statsReporter creation (#25819) ... The stats reporter only installed the connstats callback on the TUN device after the report loop negotiated an interval with the server. Traffic that flowed before that point (e.g. an SSH handshake) was silently dropped because the TUN wrapper's stats.Load() returned nil. We now install the connstats callback immediately and we no longer re-install the callback every interval unless the interval changed. Fixes flaky TestAgent_Stats_SSH, TestAgent_Stats_ReconnectingPTY, and TestAgent_Stats_Magic by ensuring the connstats callback is always installed before network traffic can flow. Closes coder/internal#505 Closes CODAGT-517	2026-06-04 21:16:26 +03:00
Andrew Aquino	6bd413163f	fix(coderd): update references to workspace's include_deleted query param (#25826) ... fixes DEVEX-206	2026-06-04 09:12:45 -07:00
Seth Shelnutt	61a35185cf	fix: upgrade Go toolchain from 1.26.2 to 1.26.4 (#26066) ... Upgrades the Go toolchain from 1.26.2 to 1.26.4 to address two stdlib CVEs: - **CVE-2026-27145** (Low): `crypto/x509` `VerifyHostname` has quadratic cost with large DNS SAN lists, enabling DoS with untrusted certificates. - **CVE-2026-42507** (Low): `net/textproto` includes attacker-controlled input in errors without escaping, enabling log injection. ### Changes - `go.mod`: Bump `go` directive from 1.26.2 to 1.26.4 - `mise.toml`: Bump `go` tool version from 1.26.2 to 1.26.4 - `mise.lock`: Regenerated with updated Go checksums Resolves ENT-104 > Generated by Coder Agents on behalf of @Shelnutt2	2026-06-04 11:22:28 -04:00
Ethan	6366c380fe	fix: correct user:* scope typo (#26049) ... The wildcard entry in `externalLowLevel` was `"user.*"` (period) instead of `"user:*"` (colon). Every other entry uses the `resource:action` colon convention, and `parseLowLevelScope` rejects the period form, so the wildcard was silently dropped from `ExternalScopeNames()` and could not be requested via `coder tokens create --scope=user:*`. Closes https://github.com/coder/coder/issues/25623	2026-06-05 01:14:20 +10:00
Zach	b075db51e8	fix(cli): serialize TestUseKeyring subtests to avoid OS keyring flakes (#25924) ... `TestUseKeyring/Logout` flaked on Windows in CI: after `coder logout` returned `nil`, `env.keyring.Read(env.clientURL)` still returned the credential instead of `os.ErrNotExist`. The CI logs showed the logout HTTP call succeeded and the keyring service name and server URL were correct. The OS keyring is shared global state on Windows and macOS, and concurrent in-process access seems to produce intermittent failures on Windows (ERROR_NOT_FOUND, stale reads after delete). This change serializes TestUseKeyring subtests in an attempt to fix the intermittent failures. The root cause is unknown. Generated with assistance by Coder Agents	2026-06-04 08:43:51 -06:00
3 people	6b556ea873	fix(site): default agent logs tab to failed script, else All Logs (#25442) ... > 🤖 This PR was modified by Coder Agents on behalf of Jake Howell. The agent logs tab was snapping to **Startup Script** whenever `getAgentHealthIssues` returned _any_ issue, including non-script issues like: - agent `status` of `connecting`, `timeout`, or `disconnected` - lifecycle `shutting_down`, `shutdown_error`, or `shutdown_timeout` - any script with status `timed_out`, `exit_failure`, or `pipes_left_open` So users routinely landed on a filtered Startup Script view (even mid-connect) and had to click back to **All Logs** to see the full picture. ### Change - Default to **All Logs** on mount. - Once logs stream in, if any script has actually failed _and_ its source has rendered log entries, auto-select that script's tab. The visibility check is the same one the tab list uses, so we never point `selectedLogTab` at a tab that isn't rendered. - A ref ensures the auto-select fires at most once and never overrides a manual tab change by the user. - The failure predicate (`exit_code` truthy or `status` set and not `"ok"`) is extracted into an `isScriptFailed` helper so the auto-select and the per-tab error indicator stay aligned. ### Behavior matrix | Agent state | Before | After | | ------------------------------------------------------ | --------------- | ------------------------------ | | Healthy, scripts running normally | All Logs | All Logs | | `connecting` / `timeout` / `disconnected` | Startup Script | All Logs | | `shutting_down` / `shutdown_error` | Startup Script | All Logs | | Startup Script failed, has logs | Startup Script | Startup Script | | Non-startup script failed, has logs (e.g. install) | Startup Script | The failed script's tab | | Failed script with **no logs**, other sources have logs| Startup Script (broken: tab not rendered) | All Logs | ### Test coverage Four `play` functions on `AgentRow.stories.tsx`, each pinned to a hardcoded tab name so a predicate regression can't silently pass: - **`StartError`** — failed script with logs is auto-selected. - **`StartErrorWithoutFailedSourceLogs`** — failed script with no logs keeps All Logs active; we never point at an invisible tab. - **`ConnectingWithStartupLogs`** — connecting agent with no script failure stays on All Logs (locks in the bug fix for connection-only issues). - **`NonStartupScriptError`** — only a non-startup script fails (Startup Script is OK); the auto-select tracks the failure, not position or display name. Each play function was verified to actually run by deliberately failing the assertion once and confirming the test errored. <details> <summary>Decision log</summary> The shape evolved during review: 1. First pass: collapse to `useState("all")`. Reviewer noted this lost the auto-jump for legitimate failures. 2. Second pass: `useState(failedSourceId ?? "all")`. Codex flagged that `failedSourceId` could point to a tab with no rendered entries, breaking the Logs panel. 3. Final pass (this PR): `useState("all")` + `useEffect` + ref. Auto-jump only fires once, only when the failed source has rendered logs, and never overrides a manual selection. Deferred from coder-agents-review feedback: - **DEREM-5**: `agent.log_sources.find(...)` can disagree with the tab bar's sort order when multiple non-startup scripts fail concurrently. Low probability, one click to recover. Worth a follow-up if it becomes a real complaint. </details> ### Verification - `pnpm check` (biome) — clean - `pnpm lint:types` (tsc) — clean - `pnpm vitest run --project "storybook (chromium)" src/modules/resources/AgentRow` — 28/28 passed --------- Co-authored-by: Atif Ali <atif@coder.com> Co-authored-by: Jeremy Ruppel <jeremy.ruppel@gmail.com>	2026-06-04 19:13:54 +05:00
Michael Suchacz	502c5acca8	fix(coderd): preserve gateway model names (#26039) ... OpenAI-compatible gateway providers such as OpenRouter require slash-namespaced model IDs to reach the intended upstream model, but native OpenAI routing strips those prefixes. Preserve full model IDs for gateway provider types, reject OpenRouter-like providers configured as native `openai` when a slash model would be stripped, and validate chat model config changes under the provider reference lock while still allowing unrelated edits to existing configs. Split from #26005. > Mux created this PR on behalf of Mike.	2026-06-04 15:33:00 +02:00
Garrett Delfosse	2cbce86eee	chore: update install docs for v2.34.0 release (#26058) ... Updates the install docs for the v2.34.0 release, branched off the latest `main`. Supersedes #25995: same release-docs update, but cut from current `main` and with every "Latest Release" link refreshed. The automated PR carried stale patch links and a `vv2.34.0` typo. ## Changes - `docs/install/releases/index.md`: regenerate the release calendar. 2.34 → Mainline, 2.33 → Stable, and every "Latest Release" link points to the current patch per minor (`2.24.6, 2.29.16, 2.30.9, 2.31.14, 2.32.5, 2.33.6, 2.34.0`). - `docs/install/rancher.md`: version selector → Mainline `2.34.0`, Stable `2.33.6`. - `docs/install/kubernetes.md`: Helm `--version` → Mainline `2.34.0`, Stable `2.33.6` (chart + OCI), matching the Rancher guide. Addresses the review feedback on #25995: the `vv2.34.0` typo, bumping Stable to `2.33.6`, and keeping the Kubernetes guide in sync with Rancher. <details> <summary>Notes for reviewers</summary> - Verified with `markdownlint-cli2` (0 errors) and `markdown-table-formatter --check` (no reformatting needed). - The calendar was regenerated via `scripts/update-release-calendar.sh`. That script's `get_latest_patch` does not exclude prerelease tags, so it selected `v2.34.0-rc.0` over `v2.34.0`; that row was corrected by hand. A follow-up fix to the script would prevent this recurring. - The linkspector 404 on `coder.com/changelog/coder-2-34` is expected for a fresh release; that page publishes alongside the release. </details> --- *Generated by Coder Agents on behalf of @f0ssel.*	2026-06-04 12:46:23 +00:00
Sas Swart	c5631a853a	feat(coderd/aibridged): add boundary correlation fields to RecordInterceptionRequest (#25884) ... Add `optional string boundary_session_id` (field 15) and `optional int64 boundary_sequence_number` (field 16) to `RecordInterceptionRequest` in the AI Bridge proto definition. Regenerate Go bindings. No behavior change. ## Context The [Gateway and Firewall Correlation RFC](https://www.notion.so/coderhq/Gateway-and-Firewall-Correlation-RFC-31ad579be592803aa8b3d48348ccdde9) defines a system for linking Agent Firewall (boundary) audit events with AI Bridge interceptions so that admins can trace an LLM request back to the exact network activity that produced it. The correlation mechanism works as follows: 1. Each boundary process generates a session UUID on startup and assigns a monotonically increasing sequence number to every audit event it records. 2. When boundary proxies a request to AI Bridge, it injects `X-Coder-Agent-Firewall-Session-Id` and `X-Coder-Agent-Firewall-Sequence-Number` headers. 3. AI Bridge reads these headers, records them on the interception, and strips them before forwarding to the upstream LLM provider. 4. The persisted session ID and sequence number allow the frontend to discover which boundary session an interception belongs to, and to fetch only the boundary audit events that occurred between any two interceptions by filtering on the sequence number range. This PR implements the first step: adding the proto fields that carry the correlation data from AI Bridge to coderd's recording service. ## How these fields will be used The two immediate downstream issues depend on these fields: **AIGOV-260** adds `boundary_session_id UUID NULL` and `boundary_sequence_number BIGINT NULL` columns to the `aibridge_interceptions` database table, with a partial index on `boundary_session_id`. The `RecordInterception` server handler (`coderd/aibridgedserver/aibridgedserver.go`) will read the new proto fields via `GetBoundarySessionId()` and `GetBoundarySequenceNumber()` and pass them through to the database insert query. **AIGOV-259** adds the capture-and-strip logic in the AI Bridge interception processor (`aibridge/bridge.go`). It reads the `X-Coder-Agent-Firewall-Session-Id` and `X-Coder-Agent-Firewall-Sequence-Number` headers from the incoming request, adds `BoundarySessionID *string` and `BoundarySequenceNumber *int64` fields to the `InterceptionRecord` struct (`aibridge/recorder/types.go`), and strips the headers before forwarding upstream. The translator (`coderd/aibridged/translator.go`) will then map these struct fields onto the proto fields added here. Fixes https://linear.app/codercom/issue/AIGOV-252 > [!NOTE] > This PR was generated by [Coder Agents](https://coder.com).	2026-06-04 11:19:57 +02:00
Sas Swart	ce2e56785f	fix(enterprise/coderd/license): suppress AI Governance seat-count error for not-entitled licenses (#25885) ... When a Premium deployment has no AI Governance addon but has accumulated `ai_seat_state` rows (from prior Gateway testing or Task usage), the backend emitted an error in the `LicenseBanner`: "Your deployment has N active AI Governance seats but the license is not entitled to this feature." This is alarming and inactionable for customers who never purchased the addon. Suppress the `EntitlementNotEntitled` case that appended to `entitlements.Errors`. Customers who purchased AI Governance still see all their seat-limit warnings (90% threshold, over-limit, grace period) since those are gated on `entitled` / `grace_period` and are unaffected. Fixes https://linear.app/codercom/issue/AIGOV-392 > Generated by Coder Agents on behalf of @SasSwart	2026-06-04 11:18:56 +02:00
Sas Swart	52722b800b	chore: rename boundary command to agent-firewall (#25889) ... Renames the `coder boundary` CLI subcommand to `coder agent-firewall` as part of the Boundaries → Agent Firewall rebrand. `coder boundary` is retained as a hidden, deprecated alias that prints a deprecation notice to stderr before running. Both commands use separate builder functions backed by the same boundary base command and license verification logic. Closes https://linear.app/codercom/issue/AIGOV-236 <details><summary>Implementation notes</summary> **Approach:** Two separate `*serpent.Command` objects (not `Aliases`) so the deprecated `boundary` path can print a stderr warning while `agent-firewall` stays clean. **Changes:** - `enterprise/cli/boundary.go`: Split old `boundary()` into `buildAgentFirewallCmd()` and `buildBoundaryAliasCmd()`. Error messages in `verifyLicense` now reference "agent-firewall". - `enterprise/cli/root.go`: Register both commands. - `cli/root.go`: Update YAML-only option validation bypass for the new command name. - Tests: Rename to `TestAgentFirewallSubcommand`, add `TestBoundaryAlias`, update license verification tests to use `agent-firewall`. - Golden files and CLI reference docs regenerated. - `docs/ai-coder/agent-firewall/version.md` and `docs/manifest.json` updated. </details> > Generated with [Coder Agents](https://coder.com/agents) by @SasSwart	2026-06-04 11:14:36 +02:00
Ethan	3ab1323bc9	fix!: rename chat stream silence timeout error (#25973) ... Renames the Agents chat stream-silence error from `startup_timeout` to `stream_silence_timeout` now that the timeout applies to any gap between provider stream parts, not just first-token startup. Updates the SDK enum, generated API docs/types, chat error copy, and Agents UI stories/status labels so the user-facing wording describes a stalled provider response instead of startup delay. > **Breaking change:** This is a very minor breaking change for the Coder Agents API: the public chat error kind enum no longer includes `startup_timeout`, so clients matching that specific value should handle `stream_silence_timeout` instead.	2026-06-04 18:36:02 +10:00
Susana Ferreira	b7635b5036	fix(aibridge): strip proxy headers from bridge requests to fix Bedrock SigV4 signing (#26019) ... ## Problem On bridge routes, aibridge acts as a client and originates new outbound requests via the SDK. Proxy headers (`X-Forwarded-For`, `X-Forwarded-Host`, etc.) from the inbound client request were forwarded on the outbound request. The SigV4 signer signs all headers present, so any in-transit modification by an egress proxy (e.g. appending an IP to `X-Forwarded-For`) invalidated the signature, causing AWS Bedrock to reject the request with: > 403: "The request signature we calculated does not match the signature you provided." ## Changes - Strip proxy headers in `PrepareClientHeaders` on bridge routes - Add unit test for proxy header stripping in `client_headers_test.go` - Add integration test that verifies SigV4 signature remains valid after an egress proxy modifies headers in transit - Add integration test that verifies passthrough routes still set forwarded headers correctly Related to internal [Slack thread](https://codercom.slack.com/archives/C096PFVBZKN/p1779919049215969). > 🤖 Generated by Coder Agents, modified and reviewed by @ssncferreira	2026-06-04 10:15:38 +02:00
TJ	d1d4b89bd7	fix(site): scope menu item icon sizing to direct children (#26040) ... The descendant selector `[&_img]:size-icon-sm` in `menuItemClass` was matching the `<img>` nested inside `<Avatar>` on the User settings row of the mobile menu, pinning the avatar image to `1.125rem` instead of letting it fill its Avatar container. The same descendant rule also applied to nested SVGs. Switch both rules to direct-child selectors (`[&>svg]`, `[&>img]`), matching the symmetric `shrink-0` rules already next to them and the same pattern used in `Button.tsx`. Menu items that contain nested `<img>`s already set their own sizes explicitly (`w-4 h-4` in `ProxySettingsSub`, `!size-3.5` in `WorkspacePill`), so this only stops overriding components like `Avatar` that manage their own internal sizing. Also removes the now-dead `[&_img]:w-full [&_img]:h-full` workaround in `UserDropdownContent.tsx` that fought the same bug per-item; that menu item no longer renders an `<img>`, and the root fix makes the workaround unnecessary anyway. Refs [CODAGT-552](https://linear.app/codercom/issue/CODAGT-552/mobile-menu-user-avatar-image-is-undersized-inside-its-container) <details> <summary>Investigation notes</summary> **Repro (before):** mobile viewport, user has an image avatar set, open hamburger menu, observe the avatar in the User settings row is smaller than its bordered square. **Root cause:** `site/src/components/DropdownMenu/menuClasses.ts` set `[&_img]:size-icon-sm` using a Tailwind descendant selector (`_`). That matches every `<img>` *inside* a menu item, including the one nested inside `<AvatarPrimitive.Root>`. The Avatar's inner image is supposed to be `aspect-square size-full object-contain` and inherit its size from the Avatar root (`--avatar-default` ≈ 24px by default), but the descendant rule overrides that and pins it to 1.125rem. **Prior workaround:** `UserDropdownContent.tsx` previously added `[&_img]:w-full [&_img]:h-full` per-item to fight the same bug on desktop. That menu item no longer renders an `<img>`, so the override was already dead code; removed here for hygiene. **Safety check on the wider change:** every other menu item that contains a nested `<img>` already sets its own sizes explicitly: - `ProxySettingsSub` (`MobileMenu.tsx`): `<ExternalImage className="w-4 h-4" />` - `WorkspacePill.tsx`: `[&_svg]:!size-3.5 [&_img]:!size-3.5` on the menu content Direct-child icons (`ChevronRightIcon`, `CircleHelpIcon`, `XIcon`, lucide icons in `UserDropdownContent.tsx`) remain direct children of the menu item, so `[&>svg]:size-icon-sm` keeps sizing them as before. </details> --- _Authored by Coder Agent on behalf of @tracyjohnsonux._	2026-06-04 00:22:00 -07:00
Ethan	becc858fa8	fix(coderd/x/chatd): retry provider stream cancellations (#26010) ... Closes CODAGT-541. ## Problem An Agents chat stream could die with a terminal `context cancelled` error and surface to the user as a permanent chat failure, even when no context in our process had actually been canceled. The cancellation was a provider-returned error value (HTTP/2 RST_STREAM mid-body surfacing as `context.Canceled` from Go's net/http2), not a real caller cancel. The chain that produced the bug: - fantasy passed the provider's `context.Canceled` through unchanged. - `chaterror.Classify` short-circuited any `errors.Is(err, context.Canceled)` (or `"context canceled"` text) as terminal generic, before checking HTTP status codes or other retry signals. - `chatretry.Retry` did not retry. - The frontend rendered `type:"error"` and the chat was dead. The same short-circuit also masked retryable 5xx responses whose underlying transport error happened to wrap `context.Canceled`. ## Approach `context.Canceled` has no inherent intent. The same error value can mean a user pressing Stop, a server shutdown, the silence guard firing, or a provider-side stream reset. The only layer that can disambiguate is the one holding both the returned error and the caller context. That is `chatretry`. This PR centralizes the policy there and keeps `chaterror` context-free. ## Changes `coderd/x/chatd/chaterror/classify.go` - Add `ErrProviderTransportReset` sentinel to explicitly mark provider-side stream cancellations. - Remove the broad `context.Canceled` / `"context canceled"` short-circuit so status codes and other retry signals can win. - Classify `ErrProviderTransportReset` (with no status code) as a retryable timeout. - Keep a fallback that classifies bare `context.Canceled` as terminal-generic when no other signal is present, so legitimate caller cancels still terminate cleanly. `coderd/x/chatd/chatretry/chatretry.go` - Add `contextError(ctx)` that returns `context.Cause(ctx)` when set, falling back to `ctx.Err()`, so caller-owned cancel causes (`ErrInterrupted`, `errStreamSilenceTimeout`, server shutdown sentinels) propagate cleanly out of the retry loop. - Add `classifyProviderAttemptError(err)` that wraps a bare `context.Canceled` in `ErrProviderTransportReset` and reclassifies. Errors that already classify as retryable or carry a status code are left alone. - Restructure `Retry` so the policy is explicit and readable: check caller cancellation before attempting, run the attempt, check caller cancellation again before normalizing the provider error, then classify and retry. ## End-to-end behavior - Provider returns `context.Canceled` while caller context is healthy: classified as a retryable timeout, retried, the user sees a brief `type:"retry"` event and the chat continues. - User presses Stop: `contextError(ctx)` returns `ErrInterrupted`. Retry stops. `chatloop` flushes partial content and persists. - Stream-silence guard fires: `attemptCtx` is canceled with `errStreamSilenceTimeout`, `guardedStream` produces a classified retryable error, retry proceeds normally on the still-alive parent. - Server shutdown: parent context's cause propagates out, retry stops.	2026-06-04 12:52:37 +10:00
dependabot[bot]	a67f53870f	chore: bump github.com/nats-io/nats-server/v2 from 2.12.8 to 2.14.2 (#26046) ... Bumps [github.com/nats-io/nats-server/v2](https://github.com/nats-io/nats-server) from 2.12.8 to 2.14.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/nats-io/nats-server/releases">github.com/nats-io/nats-server/v2's releases</a>.</em></p> <blockquote> <h2>Release v2.14.2</h2> <h2>Changelog</h2> <p>Refer to the <a href="https://docs.nats.io/release-notes/whats_new/whats_new_214">2.14 Upgrade Guide</a> for backwards compatibility notes with 2.12.x. Please note that the 2.13.x version was skipped.</p> <h3>Go Version</h3> <ul> <li>1.26.3</li> </ul> <h3>Dependencies</h3> <ul> <li>golang.org/x/crypto v0.52.0</li> <li>golang.org/x/sys v0.45.0</li> <li>github.com/nats-io/jwt/v2 v2.8.2</li> <li>github.com/nats-io/nkeys v0.4.16</li> </ul> <h3>Improved</h3> <p>General</p> <ul> <li>The client ID is now available through the embedded <code>ClientAuthentication</code> API (<a href="https://redirect.github.com/nats-io/nats-server/issues/8217">#8217</a>)</li> </ul> <h3>Fixed</h3> <p>General</p> <ul> <li>A race condition when handling subscription interest over routes has been fixed (<a href="https://redirect.github.com/nats-io/nats-server/issues/8235">#8235</a>)</li> <li>Potential protocol-level corruption from rewriting <code>$JS.ACK</code> subjects has been fixed (<a href="https://redirect.github.com/nats-io/nats-server/issues/8242">#8242</a>)</li> <li>Potential protocol-level corruption from buffer misuse in compressed WebSocket clients has been fixed (<a href="https://redirect.github.com/nats-io/nats-server/issues/8244">#8244</a>)</li> <li>The <code>/accstatz</code> monitoring endpoint no longer omits accounts with only leaf connections (<a href="https://redirect.github.com/nats-io/nats-server/issues/8252">#8252</a>)</li> </ul> <p>JetStream</p> <ul> <li>Fixed a case where Raft peers were not correctly tracked after an inactivity stall during catchup (<a href="https://redirect.github.com/nats-io/nats-server/issues/8226">#8226</a>)</li> <li>Quorum needed is now calculated correctly when bootstrapping the metalayer when gateway URLs resolve to multiple IP addresses (<a href="https://redirect.github.com/nats-io/nats-server/issues/8238">#8238</a>)</li> <li>The filestore no longer performs a block skip check on streams with extremely high subject counts, as it could result in runaway CPU usage (<a href="https://redirect.github.com/nats-io/nats-server/issues/8227">#8227</a>)</li> <li>Fixed a case where the filestore would not release a lock after handling a write error (<a href="https://redirect.github.com/nats-io/nats-server/issues/8232">#8232</a>)</li> <li>Purge operations on both file and memory stores are now more consistent with each other (<a href="https://redirect.github.com/nats-io/nats-server/issues/8241">#8241</a>)</li> <li>Fixed a case where the consumer lock would not release a lock after handling a start sequence error (<a href="https://redirect.github.com/nats-io/nats-server/issues/8230">#8230</a>)</li> <li>Counter streams and message schedules now have configuration constraints applied to prevent incorrect usage patterns (<a href="https://redirect.github.com/nats-io/nats-server/issues/8240">#8240</a>)</li> <li>Improved stream and consumer scale down behaviour consistency (<a href="https://redirect.github.com/nats-io/nats-server/issues/8253">#8253</a>)</li> <li>Fixed an issue where the per-subject state last block was not stored correctly with a max messages per subject limit of 1 (<a href="https://redirect.github.com/nats-io/nats-server/issues/8254">#8254</a>)</li> <li>Fixed a drift that could occur in the peer sets after a peer remove of an online node (<a href="https://redirect.github.com/nats-io/nats-server/issues/8258">#8258</a>)</li> </ul> <h3>Complete Changes</h3> <p><a href="https://github.com/nats-io/nats-server/compare/v2.14.1...v2.14.2">https://github.com/nats-io/nats-server/compare/v2.14.1...v2.14.2</a></p> <h2>Release v2.14.2-RC.1</h2> <h2>Changelog</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nats-io/nats-server/commit/1d065926bb99ed14ebe9cf6a21529d28310fc8d3"><code>1d06592</code></a> Release v2.14.2</li> <li><a href="https://github.com/nats-io/nats-server/commit/4e1aefa11412f699f6e31549ea215389824d4c07"><code>4e1aefa</code></a> Cherry-picks for v2.14.2 (<a href="https://redirect.github.com/nats-io/nats-server/issues/8256">#8256</a>)</li> <li><a href="https://github.com/nats-io/nats-server/commit/ac092ff7c60aa4a0fa3f466198aa89d58bd15f47"><code>ac092ff</code></a> Update dependencies</li> <li><a href="https://github.com/nats-io/nats-server/commit/01e589d49a512276adfa9f60699560c5be63bfd5"><code>01e589d</code></a> [FIXED] Peer set desync/re-add after stream peer-remove</li> <li><a href="https://github.com/nats-io/nats-server/commit/3d122e82432917c2e4395523a33e929cc71ec5ca"><code>3d122e8</code></a> De-flake TestJetStreamConsumerPrioritized</li> <li><a href="https://github.com/nats-io/nats-server/commit/3836d96692a7b9d1405ea404161e6a7f48ba3115"><code>3836d96</code></a> [FIXED] Initial MaxMsgsPerSubject update not enforced</li> <li><a href="https://github.com/nats-io/nats-server/commit/92cf2e314fe7ef38f3ac6223f874efa0f58819e0"><code>92cf2e3</code></a> [FIXED] Filestore only stores last block when MaxMsgsPerSubject 1</li> <li><a href="https://github.com/nats-io/nats-server/commit/3288b4fe279b6f689dc985758add443acb9095db"><code>3288b4f</code></a> (2.14) [IMPROVED] Remove redundant error check in filestore</li> <li><a href="https://github.com/nats-io/nats-server/commit/6ea46d54029a662ae3545da70b01c32976f6cdbc"><code>6ea46d5</code></a> [FIXED] Stream and consumer scale down consistency</li> <li><a href="https://github.com/nats-io/nats-server/commit/5edd91c01a32945e1a4837a104c59114972c9bfb"><code>5edd91c</code></a> [FIXED] AccountStatz omits accounts with only leaf connections</li> <li>Additional commits viewable in <a href="https://github.com/nats-io/nats-server/compare/v2.12.8...v2.14.2">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-04 00:27:26 +00:00
dependabot[bot]	dc6202f7da	chore: bump github.com/prometheus/common from 0.67.5 to 0.68.1 (#26041) ... Bumps [github.com/prometheus/common](https://github.com/prometheus/common) from 0.67.5 to 0.68.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/prometheus/common/releases">github.com/prometheus/common's releases</a>.</em></p> <blockquote> <h2>v0.68.1</h2> <h2>What's Changed</h2> <ul> <li>build(deps): bump golang.org/x/net from 0.52.0 to 0.53.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/common/pull/903">prometheus/common#903</a></li> <li>build(deps): bump golang.org/x/net from 0.53.0 to 0.55.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/common/pull/914">prometheus/common#914</a></li> <li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@​prombot</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/915">prometheus/common#915</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/prometheus/common/compare/v0.68.0...v0.68.1">https://github.com/prometheus/common/compare/v0.68.0...v0.68.1</a></p> <h2>v0.68.0</h2> <h2>What's Changed</h2> <ul> <li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@​prombot</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/873">prometheus/common#873</a></li> <li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@​prombot</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/874">prometheus/common#874</a></li> <li>build(deps): bump github.com/golang-jwt/jwt/v5 from 5.3.0 to 5.3.1 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/common/pull/879">prometheus/common#879</a></li> <li>build(deps): bump golang.org/x/net from 0.48.0 to 0.49.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/common/pull/878">prometheus/common#878</a></li> <li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@​prombot</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/875">prometheus/common#875</a></li> <li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@​prombot</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/880">prometheus/common#880</a></li> <li>Remove logic adding unit to metrics name by <a href="https://github.com/vesari"><code>@​vesari</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/877">prometheus/common#877</a></li> <li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@​prombot</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/881">prometheus/common#881</a></li> <li>Update for Go 1.26 by <a href="https://github.com/SuperQ"><code>@​SuperQ</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/883">prometheus/common#883</a></li> <li>build(deps): bump golang.org/x/net from 0.49.0 to 0.51.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/common/pull/882">prometheus/common#882</a></li> <li>version: Add a slog helper by <a href="https://github.com/SuperQ"><code>@​SuperQ</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/886">prometheus/common#886</a></li> <li>Remove Arthur from maintainers list by <a href="https://github.com/ArthurSens"><code>@​ArthurSens</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/885">prometheus/common#885</a></li> <li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@​prombot</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/895">prometheus/common#895</a></li> <li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@​prombot</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/896">prometheus/common#896</a></li> <li>config: change NewOAuth2RoundTripper to accept variadic HTTPClientOption by <a href="https://github.com/alliasgher"><code>@​alliasgher</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/898">prometheus/common#898</a></li> <li>config: guard against nil oauth2 credential in RoundTrip by <a href="https://github.com/alliasgher"><code>@​alliasgher</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/897">prometheus/common#897</a></li> <li>build(deps): bump golang.org/x/net from 0.51.0 to 0.52.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/common/pull/890">prometheus/common#890</a></li> <li>build(deps): bump go.yaml.in/yaml/v2 from 2.4.3 to 2.4.4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/common/pull/891">prometheus/common#891</a></li> <li>build(deps): bump golang.org/x/oauth2 from 0.34.0 to 0.36.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/common/pull/892">prometheus/common#892</a></li> <li>Move interface assertions to a test file by <a href="https://github.com/msiegen"><code>@​msiegen</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/839">prometheus/common#839</a></li> <li>fix(http_config): fix client cert rotation when no CA is configured by <a href="https://github.com/machine424"><code>@​machine424</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/908">prometheus/common#908</a></li> <li>Remove CircleCI by <a href="https://github.com/ArthurSens"><code>@​ArthurSens</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/910">prometheus/common#910</a></li> <li>Fix: apply DialContextFunc to OAuth2 token-fetch transport by <a href="https://github.com/yuri-tceretian"><code>@​yuri-tceretian</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/911">prometheus/common#911</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/alliasgher"><code>@​alliasgher</code></a> made their first contribution in <a href="https://redirect.github.com/prometheus/common/pull/898">prometheus/common#898</a></li> <li><a href="https://github.com/msiegen"><code>@​msiegen</code></a> made their first contribution in <a href="https://redirect.github.com/prometheus/common/pull/839">prometheus/common#839</a></li> <li><a href="https://github.com/machine424"><code>@​machine424</code></a> made their first contribution in <a href="https://redirect.github.com/prometheus/common/pull/908">prometheus/common#908</a></li> <li><a href="https://github.com/yuri-tceretian"><code>@​yuri-tceretian</code></a> made their first contribution in <a href="https://redirect.github.com/prometheus/common/pull/911">prometheus/common#911</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/prometheus/common/compare/v0.67.5...v0.68.0">https://github.com/prometheus/common/compare/v0.67.5...v0.68.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/prometheus/common/commit/212057321e897d625d07379aaddaca01afca7710"><code>2120573</code></a> Update common Prometheus files (<a href="https://redirect.github.com/prometheus/common/issues/915">#915</a>)</li> <li><a href="https://github.com/prometheus/common/commit/228386adfe1e9c8ede570fbca47782a9abca1a35"><code>228386a</code></a> build(deps): bump golang.org/x/net from 0.53.0 to 0.55.0 (<a href="https://redirect.github.com/prometheus/common/issues/914">#914</a>)</li> <li><a href="https://github.com/prometheus/common/commit/b8c88b4866403159e523c588dc7563b0f78c0418"><code>b8c88b4</code></a> build(deps): bump golang.org/x/net from 0.52.0 to 0.53.0 (<a href="https://redirect.github.com/prometheus/common/issues/903">#903</a>)</li> <li><a href="https://github.com/prometheus/common/commit/1e0ae832fb26a2c20c2c0d6ee1289111c668be18"><code>1e0ae83</code></a> config: apply DialContextFunc to OAuth2 token-fetch transport (<a href="https://redirect.github.com/prometheus/common/issues/911">#911</a>)</li> <li><a href="https://github.com/prometheus/common/commit/b51d01ba2175d103309dcee11f6c01bd03487a64"><code>b51d01b</code></a> Remove CircleCI (<a href="https://redirect.github.com/prometheus/common/issues/910">#910</a>)</li> <li><a href="https://github.com/prometheus/common/commit/0f3c348807322ea84d92fc7688b1b37a08e17d1f"><code>0f3c348</code></a> Merge pull request <a href="https://redirect.github.com/prometheus/common/issues/908">#908</a> from machine424/ttlsco</li> <li><a href="https://github.com/prometheus/common/commit/732a9cf781621a8d8f895ef933b78cf4e9f5d6af"><code>732a9cf</code></a> fix(http_config): fix client cert rotation when no CA is configured</li> <li><a href="https://github.com/prometheus/common/commit/ce9215c53d8c8e507c5f72a69d80568c072be3d9"><code>ce9215c</code></a> Move interface assertions to a test file (<a href="https://redirect.github.com/prometheus/common/issues/839">#839</a>)</li> <li><a href="https://github.com/prometheus/common/commit/1ba5ed78ffdaf199c6dded3ff8ac88edbdb53712"><code>1ba5ed7</code></a> build(deps): bump golang.org/x/oauth2 from 0.34.0 to 0.36.0 (<a href="https://redirect.github.com/prometheus/common/issues/892">#892</a>)</li> <li><a href="https://github.com/prometheus/common/commit/8f8ada69df73ad76cabef710856070a42ef420c0"><code>8f8ada6</code></a> build(deps): bump go.yaml.in/yaml/v2 from 2.4.3 to 2.4.4 (<a href="https://redirect.github.com/prometheus/common/issues/891">#891</a>)</li> <li>Additional commits viewable in <a href="https://github.com/prometheus/common/compare/v0.67.5...v0.68.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-04 00:13:22 +00:00
dependabot[bot]	02ffd456d1	chore: bump github.com/aws/smithy-go from 1.25.1 to 1.27.0 (#26043) ... Bumps [github.com/aws/smithy-go](https://github.com/aws/smithy-go) from 1.25.1 to 1.27.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/aws/smithy-go/blob/main/CHANGELOG.md">github.com/aws/smithy-go's changelog</a>.</em></p> <blockquote> <h1>Release (2026-06-02)</h1> <h2>General Highlights</h2> <ul> <li><strong>Dependency Update</strong>: Updated to the latest SDK module versions</li> </ul> <h2>Module Highlights</h2> <ul> <li><code>github.com/aws/smithy-go</code>: v1.27.0 <ul> <li><strong>Feature</strong>: Add APIs for schema-based serialization.</li> <li><strong>Feature</strong>: Add support for all current AWS and Smithy protocols.</li> <li><strong>Bug Fix</strong>: Enforce max nesting depth of 128 on CBOR payloads.</li> </ul> </li> <li><code>github.com/aws/smithy-go/aws-http-auth</code>: <a href="https://github.com/aws/smithy-go/blob/main/aws-http-auth/CHANGELOG.md#v120-2026-06-02">v1.2.0</a> <ul> <li><strong>Feature</strong>: Add event stream signer.</li> </ul> </li> </ul> <h1>Release (2026-05-27)</h1> <h2>General Highlights</h2> <ul> <li><strong>Dependency Update</strong>: Updated to the latest SDK module versions</li> </ul> <h2>Module Highlights</h2> <ul> <li><code>github.com/aws/smithy-go</code>: v1.26.0 <ul> <li><strong>Feature</strong>: Add StringSlice to endpoint rulesfn.</li> </ul> </li> </ul> <h1>Release (2026-04-23)</h1> <h2>General Highlights</h2> <ul> <li><strong>Dependency Update</strong>: Updated to the latest SDK module versions</li> </ul> <h2>Module Highlights</h2> <ul> <li><code>github.com/aws/smithy-go</code>: v1.25.1 <ul> <li><strong>Bug Fix</strong>: Fixed a memory leak in the LRU cache implementation used by some AWS services.</li> </ul> </li> </ul> <h1>Release (2026-04-15)</h1> <h2>General Highlights</h2> <ul> <li><strong>Dependency Update</strong>: Updated to the latest SDK module versions</li> </ul> <h2>Module Highlights</h2> <ul> <li><code>github.com/aws/smithy-go</code>: v1.25.0 <ul> <li><strong>Feature</strong>: Add support for endpointBdd trait</li> </ul> </li> </ul> <h1>Release (2026-04-02)</h1> <h2>General Highlights</h2> <ul> <li><strong>Dependency Update</strong>: Updated to the latest SDK module versions</li> </ul> <h2>Module Highlights</h2> <ul> <li><code>github.com/aws/smithy-go</code>: v1.24.3 <ul> <li><strong>Bug Fix</strong>: Add additional sigv4 configuration.</li> </ul> </li> <li><code>github.com/aws/smithy-go/aws-http-auth</code>: <a href="https://github.com/aws/smithy-go/blob/main/aws-http-auth/CHANGELOG.md#v113-2026-04-02">v1.1.3</a> <ul> <li><strong>Bug Fix</strong>: Add additional sigv4 configuration.</li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/aws/smithy-go/commit/3f6ece24dd0646e1f43ce05d980bcb4880a6e7fe"><code>3f6ece2</code></a> Release 2026-06-02</li> <li><a href="https://github.com/aws/smithy-go/commit/3432807d26fd8d74013bd20d7d4c56ff379e2e16"><code>3432807</code></a> Revert &quot;changelog&quot;</li> <li><a href="https://github.com/aws/smithy-go/commit/9663ed6253396a37d3cca9e37a9410118a370bc1"><code>9663ed6</code></a> changelog</li> <li><a href="https://github.com/aws/smithy-go/commit/bcd9f540477b856423b2a8f679574df8026a5dbe"><code>bcd9f54</code></a> enforce a max nesting depth of 128 on cbor payloads (<a href="https://redirect.github.com/aws/smithy-go/issues/670">#670</a>)</li> <li><a href="https://github.com/aws/smithy-go/commit/ff093e96647027be14e7079a03359bc8c80d6b6f"><code>ff093e9</code></a> changelog</li> <li><a href="https://github.com/aws/smithy-go/commit/1db7cb38af94cbdbf000a31a56f5a1d20191fa68"><code>1db7cb3</code></a> hold off on unsafe string for now</li> <li><a href="https://github.com/aws/smithy-go/commit/473b1947c03deea1898ffd01fbba8de765d5eed7"><code>473b194</code></a> update README again</li> <li><a href="https://github.com/aws/smithy-go/commit/6620de4fc429f2553f793bb170a997e6c9d2e439"><code>6620de4</code></a> update README</li> <li><a href="https://github.com/aws/smithy-go/commit/22c5357d5d20fd4262b62ca7bb3530d7759a79bf"><code>22c5357</code></a> introduce schema-based serialization (<a href="https://redirect.github.com/aws/smithy-go/issues/666">#666</a>)</li> <li><a href="https://github.com/aws/smithy-go/commit/6857390fd160b416d0e369dc9dc5c2b3736178fc"><code>6857390</code></a> fix: remove deprecated io/ioutil from codegen templates (<a href="https://redirect.github.com/aws/smithy-go/issues/669">#669</a>)</li> <li>Additional commits viewable in <a href="https://github.com/aws/smithy-go/compare/v1.25.1...v1.27.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-04 00:13:19 +00:00
dependabot[bot]	3ffccf38ac	chore: bump github.com/jedib0t/go-pretty/v6 from 6.7.1 to 6.8.0 (#26047) ... Bumps [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty) from 6.7.1 to 6.8.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jedib0t/go-pretty/releases">github.com/jedib0t/go-pretty/v6's releases</a>.</em></p> <blockquote> <h2>v6.8.0</h2> <h2>What's Changed</h2> <ul> <li>progress: fix speed decay on done trackers and log overwrite; fixes <a href="https://redirect.github.com/jedib0t/go-pretty/issues/405">#405</a> by <a href="https://github.com/jedib0t"><code>@​jedib0t</code></a> in <a href="https://redirect.github.com/jedib0t/go-pretty/pull/406">jedib0t/go-pretty#406</a></li> <li>fix: wrap wide runes when wrapLen is odd in WrapHard by <a href="https://github.com/koriyoshi2041"><code>@​koriyoshi2041</code></a> in <a href="https://redirect.github.com/jedib0t/go-pretty/pull/408">jedib0t/go-pretty#408</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/koriyoshi2041"><code>@​koriyoshi2041</code></a> made their first contribution in <a href="https://redirect.github.com/jedib0t/go-pretty/pull/408">jedib0t/go-pretty#408</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/jedib0t/go-pretty/compare/v6.7.10...v6.8.0">https://github.com/jedib0t/go-pretty/compare/v6.7.10...v6.8.0</a></p> <h2>v6.7.10</h2> <h2>What's Changed</h2> <ul> <li>Fix panic on text align with unicode by <a href="https://github.com/edznux-dd"><code>@​edznux-dd</code></a> in <a href="https://redirect.github.com/jedib0t/go-pretty/pull/404">jedib0t/go-pretty#404</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/edznux-dd"><code>@​edznux-dd</code></a> made their first contribution in <a href="https://redirect.github.com/jedib0t/go-pretty/pull/404">jedib0t/go-pretty#404</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/jedib0t/go-pretty/compare/v6.7.9...v6.7.10">https://github.com/jedib0t/go-pretty/compare/v6.7.9...v6.7.10</a></p> <h2>v6.7.9</h2> <h2>What's Changed</h2> <ul> <li>table: markdown padding for human-friendly output; fixes <a href="https://redirect.github.com/jedib0t/go-pretty/issues/402">#402</a> by <a href="https://github.com/jedib0t"><code>@​jedib0t</code></a> in <a href="https://redirect.github.com/jedib0t/go-pretty/pull/403">jedib0t/go-pretty#403</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/jedib0t/go-pretty/compare/v6.7.8...v6.7.9">https://github.com/jedib0t/go-pretty/compare/v6.7.8...v6.7.9</a></p> <h2>v6.7.8</h2> <h2>What's Changed</h2> <ul> <li>progress: SortByIndex for better control of sorting by <a href="https://github.com/jedib0t"><code>@​jedib0t</code></a> in <a href="https://redirect.github.com/jedib0t/go-pretty/pull/398">jedib0t/go-pretty#398</a></li> <li>progress: address race conditions in render/stop/trackers; fixes 399 by <a href="https://github.com/jedib0t"><code>@​jedib0t</code></a> in <a href="https://redirect.github.com/jedib0t/go-pretty/pull/401">jedib0t/go-pretty#401</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/jedib0t/go-pretty/compare/v6.7.7...v6.7.8">https://github.com/jedib0t/go-pretty/compare/v6.7.7...v6.7.8</a></p> <h2>v6.7.7</h2> <h2>What's Changed</h2> <ul> <li>table: fix border with no data rows (original behavior) by <a href="https://github.com/jedib0t"><code>@​jedib0t</code></a> in <a href="https://redirect.github.com/jedib0t/go-pretty/pull/397">jedib0t/go-pretty#397</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/jedib0t/go-pretty/compare/v6.7.6...v6.7.7">https://github.com/jedib0t/go-pretty/compare/v6.7.6...v6.7.7</a></p> <h2>v6.7.6</h2> <h2>What's Changed</h2> <ul> <li>text: fix alignment issues with box/block chars by <a href="https://github.com/jedib0t"><code>@​jedib0t</code></a> in <a href="https://redirect.github.com/jedib0t/go-pretty/pull/389">jedib0t/go-pretty#389</a></li> <li>table: FilterBy: add row filtering support by <a href="https://github.com/jedib0t"><code>@​jedib0t</code></a> in <a href="https://redirect.github.com/jedib0t/go-pretty/pull/390">jedib0t/go-pretty#390</a></li> <li>table: split style.go into individual files by <a href="https://github.com/jedib0t"><code>@​jedib0t</code></a> in <a href="https://redirect.github.com/jedib0t/go-pretty/pull/392">jedib0t/go-pretty#392</a></li> <li>table: fix border with no data rows; fixes <a href="https://redirect.github.com/jedib0t/go-pretty/issues/395">#395</a> by <a href="https://github.com/jedib0t"><code>@​jedib0t</code></a> in <a href="https://redirect.github.com/jedib0t/go-pretty/pull/396">jedib0t/go-pretty#396</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/jedib0t/go-pretty/compare/v6.7.5...v6.7.6">https://github.com/jedib0t/go-pretty/compare/v6.7.5...v6.7.6</a></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/jedib0t/go-pretty/commit/45fb00d043b710d670b9e921f9e9c58111460522"><code>45fb00d</code></a> text: wrap wide runes when wrapLen is odd in WrapHard (<a href="https://redirect.github.com/jedib0t/go-pretty/issues/408">#408</a>)</li> <li><a href="https://github.com/jedib0t/go-pretty/commit/ad1754989240b73f22b3f4911dd5d3d40b7c22c8"><code>ad17549</code></a> progress: fix speed decay on done trackers and log overwrite; fixes <a href="https://redirect.github.com/jedib0t/go-pretty/issues/405">#405</a> (<a href="https://redirect.github.com/jedib0t/go-pretty/issues/406">#406</a>)</li> <li><a href="https://github.com/jedib0t/go-pretty/commit/66563fd9a0aa2096db65417e9cb0b5841957d8aa"><code>66563fd</code></a> text: fix panic on align with unicode (<a href="https://redirect.github.com/jedib0t/go-pretty/issues/404">#404</a>)</li> <li><a href="https://github.com/jedib0t/go-pretty/commit/017a359e50d97a9f5ed869ceed4b2e23acdea9de"><code>017a359</code></a> table: markdown padding for human-friendly output; fixes <a href="https://redirect.github.com/jedib0t/go-pretty/issues/402">#402</a> (<a href="https://redirect.github.com/jedib0t/go-pretty/issues/403">#403</a>)</li> <li><a href="https://github.com/jedib0t/go-pretty/commit/f05e1de9926ede0af62f680829a87133a0ad5fd7"><code>f05e1de</code></a> progress: address race conditions in render/stop/trackers; fixes 399 (<a href="https://redirect.github.com/jedib0t/go-pretty/issues/401">#401</a>)</li> <li><a href="https://github.com/jedib0t/go-pretty/commit/1cebbc5ded6de0bb3419c7d0bc34abaa97f389f4"><code>1cebbc5</code></a> progress: SortByIndex for better control of sorting (<a href="https://redirect.github.com/jedib0t/go-pretty/issues/398">#398</a>)</li> <li><a href="https://github.com/jedib0t/go-pretty/commit/b0a2ab976f5d85d1368824a904e645a636c1b3c8"><code>b0a2ab9</code></a> table: fix border with no data rows (original behavior) (<a href="https://redirect.github.com/jedib0t/go-pretty/issues/397">#397</a>)</li> <li><a href="https://github.com/jedib0t/go-pretty/commit/73867ddb662b6ce805252e910c4922548f0fd337"><code>73867dd</code></a> table: fix border with no data rows; fixes <a href="https://redirect.github.com/jedib0t/go-pretty/issues/395">#395</a> (<a href="https://redirect.github.com/jedib0t/go-pretty/issues/396">#396</a>)</li> <li><a href="https://github.com/jedib0t/go-pretty/commit/b2eda901ed06554942e31e54ab28af675494291a"><code>b2eda90</code></a> table: split style.go into individual files (<a href="https://redirect.github.com/jedib0t/go-pretty/issues/392">#392</a>)</li> <li><a href="https://github.com/jedib0t/go-pretty/commit/0b7174f7b48136ba1bf9e59679f18e88571b6e31"><code>0b7174f</code></a> README.me: link to package README.md instead of folder (<a href="https://redirect.github.com/jedib0t/go-pretty/issues/391">#391</a>)</li> <li>Additional commits viewable in <a href="https://github.com/jedib0t/go-pretty/compare/v6.7.1...v6.8.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-04 00:12:36 +00:00
dependabot[bot]	62338f3f08	chore: bump github.com/nats-io/nats.go from 1.51.0 to 1.52.0 (#26044) ... Bumps [github.com/nats-io/nats.go](https://github.com/nats-io/nats.go) from 1.51.0 to 1.52.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/nats-io/nats.go/releases">github.com/nats-io/nats.go's releases</a>.</em></p> <blockquote> <h2>Release v1.52.0</h2> <h2>Changelog</h2> <p>This release focuses on 2.14 nats-server features support.</p> <h3>ADDED</h3> <ul> <li>JetStream: <ul> <li>Added fast batch stream config field (<a href="https://redirect.github.com/nats-io/nats.go/issues/2052">#2052</a>)</li> <li>Added message scheduling headers and publish opts (<a href="https://redirect.github.com/nats-io/nats.go/issues/2051">#2051</a>)</li> <li>Updated <code>StreamConfig</code> with <code>Consumer</code> field and added <code>AckFlowControlPolicy</code> (<a href="https://redirect.github.com/nats-io/nats.go/issues/2070">#2070</a>)</li> <li>Added reset consumer API (<a href="https://redirect.github.com/nats-io/nats.go/issues/2069">#2069</a>)</li> </ul> </li> </ul> <h3>FIXED</h3> <ul> <li>Core NATS: <ul> <li>Fix Subscription.StatusChanged channel closure on Closed Subscription. Thanks <a href="https://github.com/nithimani38-prog"><code>@​nithimani38-prog</code></a> for the contribution (<a href="https://redirect.github.com/nats-io/nats.go/issues/2034">#2034</a>)</li> </ul> </li> </ul> <h3>IMPROVED</h3> <ul> <li>Fixed Flaky JS cluster tests (<a href="https://redirect.github.com/nats-io/nats.go/issues/2062">#2062</a>)</li> </ul> <h3>Complete Changes</h3> <p><a href="https://github.com/nats-io/nats.go/compare/v1.51.0...v1.52.0">https://github.com/nats-io/nats.go/compare/v1.51.0...v1.52.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nats-io/nats.go/commit/e9f2a36e31b1065f69b252ea090c01e8869eab0b"><code>e9f2a36</code></a> Release v1.52.0 (<a href="https://redirect.github.com/nats-io/nats.go/issues/2074">#2074</a>)</li> <li><a href="https://github.com/nats-io/nats.go/commit/609274f8c57b65c9d11b01b008b0e40fadfc9d5b"><code>609274f</code></a> [FIXED] Subscription.StatusChanged channel closure on Closed Subscription (<a href="https://redirect.github.com/nats-io/nats.go/issues/2">#2</a>...</li> <li><a href="https://github.com/nats-io/nats.go/commit/f7cde748abc86c2981cb1391ca828fceea02af66"><code>f7cde74</code></a> [IMPROVED] Use latest release build for badge in README (<a href="https://redirect.github.com/nats-io/nats.go/issues/2064">#2064</a>)</li> <li><a href="https://github.com/nats-io/nats.go/commit/c7476ea556818d561945e78863adab422f00de03"><code>c7476ea</code></a> [IMPROVED] Reject empty consumer info in CONSUMER.RESET response (<a href="https://redirect.github.com/nats-io/nats.go/issues/2072">#2072</a>)</li> <li><a href="https://github.com/nats-io/nats.go/commit/8fde36fd10a34224e22f4f8a8ad1f61ecaedd18f"><code>8fde36f</code></a> [ADDED] ResetConsumer JetStream API (<a href="https://redirect.github.com/nats-io/nats.go/issues/2069">#2069</a>)</li> <li><a href="https://github.com/nats-io/nats.go/commit/dcfd0fcc6f63c4a2e4436e5aa3ecd4e1dcc598df"><code>dcfd0fc</code></a> [ADDED] StreamSource.Consumer config field and AckFlowControlPolicy (<a href="https://redirect.github.com/nats-io/nats.go/issues/2070">#2070</a>)</li> <li><a href="https://github.com/nats-io/nats.go/commit/7a28503b5d5d633d2caaa2639571e5f19c8eebec"><code>7a28503</code></a> [ADDED] Publish options and consts for message scheduling (<a href="https://redirect.github.com/nats-io/nats.go/issues/2051">#2051</a>)</li> <li><a href="https://github.com/nats-io/nats.go/commit/6c91a518e305e56c6481cf63ba52416300b7f5d3"><code>6c91a51</code></a> [ADDED] AllowBatchPublish stream config field (<a href="https://redirect.github.com/nats-io/nats.go/issues/2052">#2052</a>)</li> <li><a href="https://github.com/nats-io/nats.go/commit/a614d0be24c7e9a22a406572bee44d897cff27c3"><code>a614d0b</code></a> [FIXED] Flaky JS cluster tests due to race in setupJSClusterWithSize (<a href="https://redirect.github.com/nats-io/nats.go/issues/2062">#2062</a>)</li> <li>See full diff in <a href="https://github.com/nats-io/nats.go/compare/v1.51.0...v1.52.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-04 00:10:17 +00:00
Jon Ayers	167ac7b879	feat: add nats experiment (#25703)	2026-06-03 15:37:19 -05:00
Steven Masley	c895ab7e5b	revert(site): downgrade vite to 8.0.10, plugin-react to 6.0.1, vitest to 4.1.5 (#26034) ... Reverts the version bumps from #25951. Vite 8.0.14's optimizer emits a broken pre-bundled `@mui/material/styles` chunk that references `init_emotion_react_browser_development_esm` without importing it from the sibling `@emotion/react` chunk. Loading any page that imports MUI styles fails immediately in dev with: ``` ReferenceError: init_emotion_react_browser_development_esm is not defined at /node_modules/.vite/deps/styles-<hash>.js ``` <sub>Coder Agents on behalf of @Emyrk.</sub>	2026-06-03 15:36:13 -05:00
Spike Curtis	5b692bf1cc	test: rename ExpectMatchContext to ExpectMatch (#25998) ... Cleans the last few instances of ExpectMatch that didn't use the new `(ctx, ...)` variant, then deletes the deprecated method and renames `ExpectMatchContext` to drop the `Context` suffix.	2026-06-03 15:30:37 -04:00
Spike Curtis	7d7cc27581	test: batch 07 of refactoring CLI tests not to use PTY (#25997) ... Closes [coder/internal#1400](https://github.com/coder/internal/issues/1400) Final batch of refactored CLI tests to avoid creating PTYs.	2026-06-03 15:16:42 -04:00
dependabot[bot]	88d9ce57e1	chore: bump the coder-modules group across 6 directories with 2 updates (#26031) ... Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-03 18:56:19 +00:00
blinkagent[bot]andblink-so[bot]	48930dd232	docs: highlight that user secrets can be managed from the dashboard (#26030) ... Co-authored-by: blink-so[bot] <211532188+blink-so[bot]@users.noreply.github.com>	2026-06-03 22:47:20 +05:00
Ehab Younes	b9c3eea5a1	test(cli): scope retryWithInterval logger per subtest (#26023)	2026-06-03 13:21:45 +00:00
Steven Masley	f1ebc42859	refactor(coderd/rbac): enumerate org-member and org-service-account perms (#25928) ... `organization-member` was created from `allPermsExcept(...)`. This is changed to an explicit enumeration of capabilities. - New resources no longer auto-grant to org members or service accounts. - Adding one now requires an explicit decision in `coderd/rbac/roles.go`.	2026-06-03 08:14:11 -05:00
Paweł Banaszewski	96e3a64b12	feat: add AI Gateway coderd key CRUD endpoints (#25565) ... Adds create, list and delete endpoints for AI Gateway keys. Those keys are used to authenticate into Coderd. All endpoints require Owner permission.	2026-06-03 13:50:33 +02:00
Atif Ali	6ef687cdfb	chore: remove Nix dev image from dogfood template and pipeline (#26022)	2026-06-03 16:49:27 +05:00
Dean Sheather	6c230d6e0f	chore(.github): remove fly.io workspace-proxy deployment (#25126) ... Removes the fly.io-based workspace-proxy deployment from CI. The dogfood workspace proxies in Paris (`cdg`), Sydney (`syd`), and Johannesburg (`jnb`) are no longer deployed via fly.io, and the São Paulo proxy session-token secret was already unreferenced in `deploy.yaml`. ## Changes - Deleted `.github/fly-wsproxies/{paris,sydney,jnb}-coder.toml`. - Removed the `deploy-wsproxies` job from `.github/workflows/deploy.yaml`, along with its `workflow_call.secrets` block declaring the five `FLY_*` inputs. - Removed the matching `secrets:` pass-through from the `deploy` job in `.github/workflows/ci.yaml`. The Kubernetes/EKS dogfood deploy job and `should_deploy.sh` logic are unchanged. ## Repository secrets that can now be deleted Once this lands, the following GitHub Actions repository secrets are no longer referenced anywhere in this repo and are safe to remove: - `FLY_API_TOKEN` - `FLY_PARIS_CODER_PROXY_SESSION_TOKEN` - `FLY_SYDNEY_CODER_PROXY_SESSION_TOKEN` - `FLY_JNB_CODER_PROXY_SESSION_TOKEN` - `FLY_SAO_PAULO_CODER_PROXY_SESSION_TOKEN` (was already passed through but unused inside `deploy.yaml`) Worth double-checking they aren't referenced by any other repos / org workflows before deleting from the org/repo settings. ## Out of scope (intentionally left alone) - `site/static/icon/fly.io.svg` — region icon, used at runtime for any user-deployed workspace proxy that picks the fly.io icon. - `docs/install/other/index.md` — unofficial "Run Coder on Fly.io" community install entry, unrelated to our CI. - `site/src/testHelpers/entities.ts` `*.fly.dev.coder.com` strings — UI test fixtures. ## Validation - `python3 -c "yaml.safe_load(...)"` on both edited workflows. - `make pre-commit` ran via the git hook on commit (actionlint, shellcheck, typos, helm, markdown, etc. all green). - Repo-wide grep confirms no remaining `FLY_`, `flyctl`, `fly.toml`, or `fly-wsproxies` references in `.github/` or `scripts/`.	2026-06-03 21:22:41 +10:00
Mathias Fredriksson	7a84a851ce	fix(coderd): subscribe to pubsub before accepting websocket in watchChats (#25663) ... The watchChats handler called SubscribeWithErr after websocket.Accept, creating a window where clients could trigger events before the subscription was active. Move the subscription before the accept so events accumulate in the pubsub internal queue and drain naturally once the encoder is ready. Fixes CODAGT-480	2026-06-03 13:18:57 +03:00
Mathias Fredriksson	faf0add985	test(coderd/coderdtest/oidctest): scope IDP NotFound errors to IDP paths (#25892) ... The FakeIDP mux.NotFound handler called t.Errorf for any unrecognized HTTP request, failing the owning test. It also never wrote an HTTP response, so the stale caller got a 200 with an empty body, hiding the problem on the caller side. When the IDP runs as a real HTTP server (WithServing), OS port reuse across concurrent test binaries can route stale connections to the IDP port. The source is enterprise provisionerd reconnects and DERP clients from parallel tests whose coderd servers have shut down. Check whether the NotFound request path starts with a known IDP route prefix (/oauth2/, /.well-known/, /login/, /external-auth-validate/). IDP paths: t.Errorf, logger.Error, and 404 response. Non-IDP paths: t.Logf, logger.Warn, and 421 Misdirected Request response. Both branches now return a proper HTTP error so the offending caller can be traced.	2026-06-03 13:06:46 +03:00
Cian Johnston	8b058dc949	feat: add coderd_api_websocket_probes_total metric (#25012) ... Relates to CODAGT-115 Adds metric `coderd_api_websocket_probes_total`. Every successful heartbeat for a given path will increment the metric. Comparing this with `coderd_api_concurrent_websockets` will give an indication of how many websocket connections are open but in a 'wedged' state (when heartbeats stopped versus when we closed the connection).	2026-06-03 10:46:07 +01:00
Michael Suchacz	7703e7a26e	fix: preserve AI provider preset types (#25925) ... > Mux created this PR on behalf of Mike. AI provider creation previously collapsed OpenAI-compatible presets like Google and generic OpenAI-compatible providers to `openai`, which lost the backend provider discriminator. Preserve selected provider types in the create payload, keep explicit stored types authoritative when reconstructing edit form values, and add frontend plus backend regressions for the supported preset types.	2026-06-03 09:24:08 +02:00
TJandJaayden Halko	8a9580a294	fix(site): fix provider link on models page pointing to stale path (#26011) ... Fixes https://linear.app/codercom/issue/CODAGT-547 The "Connect a provider" link shown on `/agents/settings/models` when no providers are configured was pointing to `/agents/settings/providers` (a stale duplicate view) instead of `/ai/settings` (the canonical provider configuration page). Audited all frontend source files for references to the stale path. This was the only link; other references to `/ai/settings` already point to the correct page. <details><summary>Generated by Coder Agents</summary> This PR was generated by Coder Agents on behalf of @tracyjohnsonux. </details> --------- Co-authored-by: Jaayden Halko <jaayden@coder.com>	2026-06-02 23:19:33 -07:00
Spike Curtis	b49344519b	test: batch 06 of refactoring CLI tests not to use PTY (#25990) ... Part of [coder/internal#1400](https://github.com/coder/internal/issues/1400) Batch of refactored CLI tests to avoid creating PTYs.	2026-06-02 15:44:36 -04:00
Spike Curtis	38360518af	test: batch 05 of refactoring CLI tests not to use PTY (#25984) ... Part of [coder/internal#1400](https://github.com/coder/internal/issues/1400) Batch of refactored CLI tests to avoid creating PTYs.	2026-06-02 15:32:36 -04:00
Andrew Aquino	887ea21237	feat: show Spinner before agent logs are rendered (#25820) ... related to DEVEX-313 https://github.com/user-attachments/assets/5fb074bd-7ee7-4f11-9c0a-30567cd71abc	2026-06-02 11:49:10 -07:00
Jon Ayers	ec19bc41d8	fix: escape appearance values in HTML output (#25804)	2026-06-02 13:19:16 -05:00