opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity
15,650 Commits 479 Branches 388 Tags
c62079c053b98e61a5700b33095475edf4213ebd
Commit Graph
15650 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Cian Johnston c62079c053 refactor(coderd): optimize chatdebug (#27129) 
Adds a bund of optimizations to chatdebug:

In `coderd/x/chatd/chatdebug`:
- Adds a benchmark (excluding LLM and database stuff)
- Replaces string concatenation with strings.Builder when accumulating
stream parts (~105,000ns -> ~50,00ns)
- Removes double JSON encode in RecordingTransport (114,000ns ->
64,000ns)

In `coderd/util/strings`:
- Adds a benchmark for Truncate
- Removes unnecessary allocations in Truncate (~110,000ns -> 1,550ns in
truncation case, 1 alloc -> 0 allocs in no truncation case)

> 🤖 Claude helped with this.
 2026-08-05 11:59:37 +01:00
Jake HowellandDanielle Maywood 05baba1e63 test(site): fix failing Storybook play functions (#27874) 
Fixes several Storybook play function failures that show up in Pixel
(and some that fail under `vitest --project=storybook`).

### Component / behavior
- **DurationField**: restore digit-only filtering so non-numeric input
is stripped again. A demui pass had stopped filtering and relied on
`pattern`, which does not prevent typing.

### Pixel viewport mismatches
Pixel ignores Storybook viewport params. Shared helpers
`pixelWithDesktop` / `pixelWithPhone` live in `testHelpers/pixel.ts`.
- **NavbarView**: admin dropdown stories are desktop-only. Pixel tablet
is 744px, below Tailwind `md` (768px), so Admin settings is hidden and
the play click fails. `MobileMenu` already covers the collapsed navbar.
- **AgentPageHeader**: mobile meatball menu story is phone-only. At
laptop width `sm:hidden` keeps "More options" out of the a11y tree even
when `matchMedia` is mocked as mobile.

### Story assertion fixes
- **WorkspaceSettingsPageView**: Formik passes helpers as a second
`onSubmit` argument; the assertion now allows that.
- **AgentChatPageView**: sidebar tab persistence stories use Git instead
of Terminal. Clicking Terminal mounts xterm, which throws an unhandled
`dimensions` error and fails the run even when tab assertions pass.
- **NetworkCallsTable / Blocked Badge**: badge copy is split across an
`sr-only` span and the count; assertion matches combined `textContent`.
- **CreateOAuth2AppPageView / Default**: wait for Formik
validate-on-mount before asserting the submit button is disabled.
- **NotificationEvents / Change Method** (+ Error): combobox accessible
name is now `Notification method for ${template}`; match with a regex.
- **DynamicClientRegistrationSetting / Keeps Focus While Updating**:
wait for the Enable label after the harness finishes the request.

Pixel logs play failures but still exits 0, so these can stay green in
CI while failing in the Pixel report.

---------

Co-authored-by: Danielle Maywood <danielle@themaywoods.com>
 2026-08-05 10:06:34 +00:00
Jake Howell 7a4ae2649e refactor(site): replace MUI Stack, TextField, and Link with shared components (#27817) 
> 🤖 This PR was modified by Coder Agents on behalf of Jake Howell.

Continue the MUI → Tailwind/shadcn migration across a few auth and
settings surfaces.

- Create token form: MUI `TextField`/`MenuItem` → `FormField`, `Select`,
and `Input` (drops Emotion for section min-width)
- Create organization form: `TextField` → `FormField` / `Textarea`,
matching the organization info form
- SSO security section and external auth: MUI `Link`/`TextField` →
shared `Link`, `Input`, and `Label`
- Permission and IdP pill lists: MUI `Stack` → `flex flex-row gap-2`
- Minor link layout polish on Git device auth / external auth pages

---

_Also removes the now-unused `@emotion/css` dependency from
`site/package.json` (and the lockfile), which was the last usage of it.
This fixes the `knip` CI lint failure ("Unused dependencies:
@emotion/css")._
 2026-08-05 14:07:04 +10:00
Ethan 1702bbb816 test(coderd/x/chatd): accept query cancellation in subagent wait (#27818) 
Closes CODAGT-877
Closes https://github.com/coder/internal/issues/1437

The linked flake happens because the context deadline can be observed as
`context.DeadlineExceeded`, or as a PostgreSQL query cancellation when a
database call is in flight. The fix is just to assert that the deadline
expired and the returned error is a recognised query cancellation,
rather than depending on which layer notices it first.
 2026-08-05 11:40:00 +10:00
Ethan cb992b35fd test(site): isolate httptest server clients (#27769) 
Closes ENG-3094
Closes https://github.com/coder/internal/issues/582

The flake was caused by `TestServingBin` using `&http.Client{}`, which
shares `http.DefaultTransport` with every parallel test in the binary.
When another `httptest.Server` closed, it called `CloseIdleConnections`
on the shared transport and could break our request. I couldn't
replicate this locally, but the error comes directly from that cleanup
path.

The fix is just to use each test server's `Client()`, which has its own
transport. I've also updated `TestServingFiles`, as it had the same
setup.
 2026-08-05 11:39:45 +10:00
Ben Potter 79723db2d2 docs: replace enterprise-base image references with example-base (#27025) 
Follow-up to #27018, sweeping the remaining
`codercom/enterprise-base:ubuntu` references to
`codercom/example-base:ubuntu` and `coder/enterprise-images` links to
[coder/images](https://github.com/coder/images). The `example-` prefix
is the recommended one for new deployments per the coder/images README.

Covers the 11 docs pages flagged by doc-check on #27018 plus the
embedded `examples/templates/docker` and `examples/templates/kubernetes`
starter templates (image string only; the `image` variable lives in the
coder/registry templates, see coder/registry#943).

OpenShift imagestream names in `docs/install/openshift.md` keep the
`enterprise-base` local name; only the upstream image reference changed.

Part of DEVREL-201.

🤖 Generated with Coder Agents using Claude, on behalf of @bpmct
 2026-08-04 13:47:55 -07:00
Andrew Aquino ca3de3c8c5 fix(site): allow only template admins/owners to navigate to template version pages by clicking VersionRow (#27550) 
fixes DEVEX-486

From `TemplateVersionsPage`
(/templates/:organization/:template/versions), users navigate to
individual template version pages (`TemplateVersionPage`, i.e.,
/templates/:organization/:template/versions/:version) by clicking
`VersionRow`.

This PR makes this click-to-navigate behavior on `VersionRow` available
to admin/owner users only, per @matifali's suggestion
 2026-08-04 13:27:00 -07:00
Michael Suchacz d40c4f77b9 feat(dogfood/coder): add agent-browser live preview app (#27838) 
Gives dogfood workspaces a live view of what the coding agent's browser
is doing, using the
[agent-browser](https://github.com/vercel-labs/agent-browser) dashboard
embedded as a regular workspace app. This is the dogfood-only POC phase
to validate the approach; no product code changes.

- `install-deps` installs a pinned agent-browser, seeds the
version-matched skill into `~/.claude/skills` and `~/.agents/skills`,
and starts the dashboard (self-daemonizing, idempotent) on
`127.0.0.1:4848`.
- New `agent-browser` coder_app embeds the dashboard: it auto-appears as
a tab on the Tasks page and can be added as a workspace_app tab in the
Agents right panel.

Notes for review:

- The version is pinned to 0.33.2. I verified that release's dashboard
sends no `X-Frame-Options`/CSP headers (embeddability is not a
documented upstream contract, so it must be re-verified on bumps).
- The slug is deliberately not `preview`; Tasks special-cases that slug
for the app-under-development toolbar (`WorkspaceAppFrame.tsx`).
- The dashboard itself is unauthenticated, so exposure is controlled
entirely by the app share level (`owner`).
- Example-template and docs changes were dropped from this PR on
purpose; they can follow once the approach is validated on dogfood.

Validation: `terraform fmt`/`validate` on the template and a local
frameability check of the pinned dashboard release.

> Mux worked on this on Mike's behalf.

<!-- mux-attribution: model=claude-sonnet-4-x thinking=high -->
 2026-08-04 21:58:57 +02:00
Matt Vollmer 1c993c7c5c refactor: remove introductory access banner from /agents page (#27865) 
## Summary

Removes the "Introductory access to Coder Agents through September 2026"
text and its now-unused `docs` import from the `/agents` page
(`AgentCreateForm.tsx`).

## Changes

- Removed the `<p>` element containing the introductory access link and
text below the chat input
- Removed the now-unused `docs` import (it was only referenced by that
link)

## Testing

No stories or tests referenced the removed text, so no test updates are
needed.

---

PR generated with Coder Agents
 2026-08-04 19:39:12 +00:00
Yevhenii Shcherbina 11427066a1 fix: require bedrock model fields for the invoke-model protocol (#27846) 
Implements:
https://linear.app/codercom/issue/AIGOV-564/aibridge-bedrock-provider-skipped-404-on-all-routes-when-settings-omit

Improves validation when creating and updating AI providers: a Bedrock
provider using the `invoke-model` protocol now requires `model` and
`small_fast_model`.

This brings API validation in sync with the UI, which already required
both fields.
 2026-08-04 15:21:23 -04:00
Nick Vigilante 10b366cb7c docs(docs/.style/style-guide): fix self-violating examples (#27849) 
Two internal-consistency fixes in the prose style guide, found while
auditing it against ASD-STE100 (Simplified Technical English).

The directional-language section in `accessibility-and-inclusion.md`
used "See the [Latin abbreviations rule]" as a **Do** example and
recommended "see the following section" in its replacements table. Both
violate the navigational-"see" ban that `word-choice.md` applies to all
docs, so the examples now use "refer to".

The one-sentence-per-line **Do** and **Don't** examples in
`formatting.md` were byte-identical single source lines, so the
**Don't** examples demonstrated no violation. Blockquotes re-join lines
when rendered, which is why the broken examples went unnoticed. The
examples are now fenced `md` blocks that show the actual source line
breaks (clause breaks and fixed-column wrap).

---

🤖 Built with AI assistance.
 2026-08-04 15:07:05 -04:00
dylanhuff-at-coder 87494c4f88 test(agent): de-flake TestAgent_Session_EnvironmentVariables (#27803) 
The environment-variable and secret-injection tests reused one
long-lived SSH shell, so a closed channel caused later checks to fail
with `EOF` and could allow scan-based assertions to pass without finding
a value. They now share only the SSH client and use a fresh,
deadline-bound session for each variable, isolating failures while
preserving environment-precedence coverage.

Closes https://linear.app/codercom/issue/PLAT-310.

Reviewed and updated by Coder Agents on behalf of @dylanhuff-at-coder.
 2026-08-04 11:50:57 -07:00
TJ 5f3b8755ac feat(site): tighten base infra step grid and card typography (#27797) 
Updates the base infrastructure step, base parameters step, and module
screens in the template builder for typography consistency.

**Base infra step**
- Grid gains a `xl:grid-cols-4` tier while keeping `lg:grid-cols-3`, so
no width band gets looser than before.
- Card title: `text-sm font-bold`.
- Card description and `View details` link: `text-xs font-normal`.

**Base parameters step**
- Body copy in the README markdown unified to `text-xs`.
- List item text and `::marker` inherit `text-content-secondary` so
bullets match paragraph color.
- Inline `<code>` inherits body size instead of hardcoded `text-sm`.
- `ConfigurationField` description slots (`SelectField`, `RadioField`,
`SwitchField`, `SwitchGroupField`) now use `text-xs`. The `TextField`
path already rendered `text-xs` via `FormField` and is unchanged.
- Headings unchanged.

**Module screens (for consistency)**
- `ModuleSelectStep`: same additive `xl:grid-cols-4` tier; empty-state
copy moves to `text-xs`.
- `ModuleCard`: matches `TemplateCard` (title `text-sm font-bold`,
description and link `text-xs font-normal`).
- `ModuleConfiguration`: 'No configuration required' notice moves to
`text-xs`.
- `ModuleSettingsStep`: sensitive-variable notice moves to `text-xs`.
- `TemplateCustomizationsStep` `BaseTemplateCard` heading matches card
title style (`text-sm font-bold`).

---
_This PR was generated on behalf of @tracyjohnsonux by the Coder agent._
 2026-08-04 16:29:02 +00:00
Jake Howell 3640b69533 refactor(site): demui AgentRow and AgentStatus (#27789) 
Migrate agent row log expand/collapse and agent status troubleshooting
link off MUI onto shared Collapsible and Link primitives.

Replaces `Collapse` in `AgentRow` with `Collapsible` /
`CollapsibleTrigger` / `CollapsibleContent`, and swaps the MUI `Link` in
`AgentStatus` for the shared `Link` component.
 2026-08-05 02:11:55 +10:00
Jake Howell df1700916e refactor(site): demui create template gallery and form (#27788) 
Migrate the create template gallery page and create template form off
MUI and Emotion onto Tailwind and shared form/link primitives
(`FormField`, `Textarea`, `Link`).
 2026-08-05 02:11:44 +10:00
Bobby Ho 8a510314df fix(enterprise/coderd): deflake TestPrebuildsAutobuild prebuild waits (#27601) 
## Summary

Each of the five `TestPrebuildsAutobuild` subtests spent about 30
seconds of its 60 second context budget waiting for a prebuilt workspace
whose build job had already been created and queued. On a quiet machine
the remaining budget is enough and the test passes; under
`test-go-race-pg` it is not, and the subtest fails at `found 0 running
prebuilds so far, want 1`.

Worth being precise about the shape, because it changes the fix: this is
not a data race. The 30 second stall is deterministic and every run pays
it in full. Only the *failure* is intermittent, because it depends on
whether the leftover budget covers the rest of the test.

Refs: https://github.com/coder/internal/issues/1578

## Problem

`StoreReconciler` publishes `provisioner_job_posted` to pubsub so that
provisionerd wakes up and acquires a newly created job. That publish
does not happen inline. `publishProvisionerJob` performs a non-blocking
send onto an internal buffered channel, and the goroutine that drains
that channel and calls `provisionerjobs.PostJob` is created inside
`StoreReconciler.Run`:

```go
// enterprise/coderd/prebuilds/reconcile.go, inside Run()
wg.Add(1)
go func() {
	defer wg.Done()
	for {
		select {
		case <-ctx.Done():
			return
		case job := <-c.provisionNotifyCh:
			err := provisionerjobs.PostJob(c.pubsub, job)
			...
		}
	}
}()
```

These tests drive the reconciler directly through `SnapshotState` /
`CalculateActions` / `ReconcilePreset` and never start `Run`. The
notification therefore lands in a cap-10 channel with no reader, the
non-blocking send succeeds silently, and provisionerd does not learn
about the job until the Acquirer's 30 second backup poll fires.

Laid out as a relay across goroutines, the hand-off is severed at the
first hop:

```mermaid
flowchart LR
    subgraph G1["goroutine: test body"]
        T1["ReconcilePreset()"]
        T2["testutil.Eventually<br/>1s poll of the DB"]
    end

    subgraph G2["goroutine: Run() drain worker"]
        D["case job := &lt;-provisionNotifyCh:<br/>PostJob(pubsub, job)"]
    end

    subgraph G3["goroutine: pubsub listener"]
        H["Acquirer.jobPosted<br/>-> clearOrPend(domain)"]
    end

    subgraph G4["goroutine: domain.poll"]
        P["ticker 30s, REAL clock<br/>-> clearOrPend(domain)"]
    end

    subgraph G5["goroutine: provisionerd AcquireJob"]
        A["select { &lt;-ctx.Done() ; &lt;-clearance }"]
    end

    CH1[["provisionNotifyCh<br/>chan ProvisionerJob, cap 10"]]
    CH2[["clearance<br/>chan struct{}, cap 1"]]
    DB[("Postgres")]

    T1 -- "non-blocking send" --> CH1
    CH1 -. "NO READER:<br/>Run() never started" .-> D
    D -. "never reached" .-> H
    H -. "never fires" .-> CH2
    P -- "every 30s:<br/>the only live writer" --> CH2
    CH2 --> A
    A -- "AcquireProvisionerJob" --> DB
    T2 -- "GetRunningPrebuiltWorkspaces" --> DB

    style G2 fill:#f2f2f2,stroke-dasharray: 5 5
    style CH1 fill:#ffe5e5,stroke:#cc0000,stroke-width:2px
```

Two properties turn this into a quiet latency bug rather than an obvious
failure:

- The channel is **buffered**, so a send with no reader succeeds instead
of blocking or panicking. The writer never learns that nobody is
listening.
- `domain.poll` ticks on the **real** clock, so the test's mock clock
cannot skip it. That is the entire 30 seconds.

From the CI job that filed the ticket, every job created through the
HTTP API is picked up in about a millisecond, and only the
reconciler-created prebuild job is not:

```text
19:11:40.760  pubsub: publish  event=provisioner_job_posted      <- template import job
19:11:40.761  acquirer: got job posting                          <- picked up in 1ms
...
19:11:40.903  prebuild job scheduled  job_id=ac196e6e-...
              (no "pubsub: publish", no "acquirer: got job posting")
19:11:41 .. 19:12:10   30 x "found 0 running prebuilds so far, want 1"
19:12:10.803  acquirer: successfully acquired job  ac196e6e-...   <- 29.899s later, via backup poll
```

Corroboration from the existing test suite: `FailureTTLOnlyAfterClaimed`
had already run into this. It builds its Acquirer on a mock clock and
calls `acquirerClock.Advance(30 * time.Second)` right after reconciling,
with a comment about the backup-poll ticker. A previous author found the
same dependency and worked around it by making the poll fire instantly
rather than by restoring the notification.

### Where that lands in the test

Each subtest is three helpers called in order. They never call each
other; they communicate through Postgres plus one returned value.
`runReconciliationLoop` performs no writes itself, they all happen
inside `ReconcilePreset`, whose transaction has committed by the time it
returns.

```mermaid
sequenceDiagram
    autonumber
    participant T as test body
    participant H1 as runReconciliationLoop
    participant H2 as getRunningPrebuilds
    participant H3 as claimPrebuild
    participant R as StoreReconciler
    participant DB as Postgres
    participant PD as provisionerd

    T->>H1: (t, ctx, db, reconciler, presets)
    H1->>R: ReconcilePreset
    R->>DB: InsertWorkspace(owner=prebuilds)
    R->>DB: builder.Build -> build(start) + job(pending)
    R->>DB: COMMIT
    R->>R: publishProvisionerJob -> provisionNotifyCh<br/>non-blocking send, no reader, DROPPED
    R-->>H1: nil
    Note over H1,PD: nothing publishes provisioner_job_posted
    H1-->>T: void

    T->>H2: (t, ctx, db, want=1)
    loop 30 polls, 1s apart
        H2->>DB: GetRunningPrebuiltWorkspaces
        DB-->>H2: 0 rows (job still pending)
    end
    PD->>DB: acquire, via the 30s backup poll
    PD->>DB: CompleteJob, IsPrebuild so deadline stays zero
    H2->>DB: GetRunningPrebuiltWorkspaces
    DB-->>H2: 1 row (succeeded)
    H2->>DB: UPDATE agents SET lifecycle_state='ready'
    H2-->>T: rows, test captures prebuild.ID

    T->>H3: (client, userClient, user, version, presetID)
    H3->>DB: CreateUserWorkspace(presetID)<br/>-> ClaimPrebuiltWorkspace, requires ready
    DB-->>H3: same workspace, new owner
    H3-->>T: workspace
    Note over T: require.Equal(prebuild.ID, workspace.ID)<br/>~30s of the 60s budget already gone
```

The defect is in `runReconciliationLoop`, but the waiting, and therefore
the failing log line, is in `getRunningPrebuilds`. Note also that
`claimPrebuild` was never affected: it builds through the HTTP API,
which publishes on the normal `wsbuilder` path, so its job was always
acquired in about a millisecond. The bug was never "prebuild jobs are
slow", it was "jobs created by the reconciler, driven directly, are
never announced".

## Fix

Publish the pending provisioner jobs on the reconciler's behalf, in the
test helper, immediately after reconciling. No production code changes.

```mermaid
flowchart LR
    subgraph G1["goroutine: test body"]
        T1["ReconcilePreset()"]
        T3["NEW: post pending jobs<br/>provisionerjobs.PostJob(pb, job)"]
    end

    subgraph G3["goroutine: pubsub listener"]
        H["Acquirer.jobPosted<br/>-> clearOrPend(domain)"]
    end

    subgraph G5["goroutine: provisionerd AcquireJob"]
        A["unblocks on &lt;-clearance"]
    end

    CH2[["clearance<br/>chan struct{}, cap 1"]]
    DB[("Postgres")]

    T1 --> T3
    T3 -- "publish provisioner_job_posted" --> H
    H -- "send" --> CH2
    CH2 --> A
    A -- "AcquireProvisionerJob, ~1ms" --> DB

    style T3 fill:#e5ffe5,stroke:#007700,stroke-width:2px
```

This works because provisionerd is already subscribed and already parked
in `select { <-ctx.Done(); <-clearance }`. It needs exactly one write to
`clearance`, and today the only live writer is the 30 second poll
ticker. Publishing to pubsub gives `jobPosted` a reason to fire, and
`clearOrPendLocked` performs that write immediately.

Posting every still-`pending` job, rather than trying to identify the
one just created, keeps the helper idempotent and avoids coupling to
whichever clock stamped `created_at`. Re-posting a job that was already
acquired is harmless: the Acquirer re-queries and finds nothing.

The same three helpers after the change. `getRunningPrebuilds` collapses
to a single poll, and nothing else about the test moves:

```mermaid
sequenceDiagram
    autonumber
    participant T as test body
    participant H1 as runReconciliationLoop
    participant H2 as getRunningPrebuilds
    participant H3 as claimPrebuild
    participant R as StoreReconciler
    participant PS as Pubsub
    participant DB as Postgres
    participant PD as provisionerd

    T->>H1: (t, ctx, db, pb, reconciler, presets)
    H1->>R: ReconcilePreset
    R->>DB: InsertWorkspace + build(start) + job(pending), COMMIT
    R->>R: publishProvisionerJob still dropped<br/>(production path, unchanged)
    R-->>H1: nil
    Note over H1,DB: job row is committed and visible,<br/>which is why the query below finds it
    H1->>DB: GetProvisionerJobsCreatedAfter(zero time)
    DB-->>H1: all jobs, filtered in Go to status=pending
    H1->>PS: PostJob -> provisioner_job_posted
    PS->>PD: acquirer wakes, clearance write
    H1-->>T: void
    PD->>DB: acquire in ~1ms, then CompleteJob

    T->>H2: (t, ctx, db, want=1)
    H2->>DB: GetRunningPrebuiltWorkspaces
    DB-->>H2: 1 row (succeeded), queued_for ~3ms
    H2->>DB: UPDATE agents SET lifecycle_state='ready'
    H2-->>T: rows, test captures prebuild.ID

    T->>H3: (client, userClient, user, version, presetID)
    H3->>DB: CreateUserWorkspace(presetID) -> claim
    DB-->>H3: same workspace, new owner
    H3-->>T: workspace
    Note over T: same assertions, ~55s of budget still unspent
```

`getRunningPrebuilds` still polls, still forces agents ready,
`claimPrebuild` still claims, and every assertion is unchanged. Its
floor is now one `testutil.IntervalSlow` tick, about a second, because
`testutil.Eventually` fires on a ticker rather than checking
immediately.

Note that `publishProvisionerJob` at `reconcile.go:940` is still
dropped. That call site is correct; it simply has no drain worker behind
it when `Run` is not started. The `PostJob` added here is a manual redo
of what it already intended.

Starting `reconciler.Run(ctx)` instead would be closer to production,
but `Run` also starts a reconciliation ticker on the **mock** clock, and
these tests jump that clock by hours. Each jump would fire an
unscheduled `ReconcileAll` that rebuilds a replacement prebuild
mid-assertion, which is the opposite of what a deflake should introduce.

## Measurements

Single subtest with `-race` against Postgres, the closest local
approximation of `test-go-race-pg`, three iterations:

| Run | before | after  |
|-----|--------|--------|
| 1   | 58.85s | 30.68s |
| 2   | 55.42s | 35.64s |
| 3   | 57.47s | 31.30s |

The baseline passed all three, at 1.1s to 4.6s of margin against the 60
second context. That is the flake caught in the act: locally green, one
scheduling hiccup from red. After the change the margin is 24s to 29s.

All five subtests against real Postgres go from roughly 35s each to
6.76s each, and `queued_for` on the prebuild job drops from 29.975s to
single-digit milliseconds.

## Also in this change

Two smaller items in the same helper, both aimed at the next person to
see this symptom.

Diagnostics while waiting for prebuilds: poll count, elapsed time, and
`queued_for` (`started_at - created_at` on the provisioner job), plus a
warning naming this defect if the wait exceeds 10 seconds. `queued_for`
is the field that discriminates: about 0 means the notification arrived
and any slowness is elsewhere, about 30 seconds means it was lost and
the backup poll took over.

There is deliberately no duration computed against `completed_at`. A
single `provisioner_jobs` row mixes time bases in these tests:
`created_at` and `started_at` come from the real clock, while
`completed_at` is stamped by `CompleteJob` from the injected mock clock.
My first version of the logging did subtract them and printed
`ran_for=-22543h3m21s`.

`getRunningPrebuilds` also now resets its accumulator each poll. It
appended rows on every iteration without clearing, so an iteration that
appended and then returned early on a transient error would double count
and leave the expected count permanently unreachable, producing this
same `found N running prebuilds` symptom for an unrelated reason.
 2026-08-04 08:26:10 -07:00
Cian Johnston b169066773 chore: add more known model prices to ChatModelAdminPanel (#27839) 
Depends on https://github.com/coder/coder/pull/27837

Expand `curation.json` to include more known models.
Also marked `knownModelsGenerated.json` as generated.
 2026-08-04 16:13:06 +01:00
Jake Howell d23d0d5313 refactor(site): replace MUI update-check snackbar with <UpdateCheckNotice/> (#27728) 
Replaces the MUI `Snackbar` / `Link` update-check toast in
`DashboardLayout` with a Tailwind `UpdateCheckNotice`, and adds
Storybook coverage for the layout and notice.

The notice stays declarative (not Sonner), offsets above the deployment
banner when the user can view deployment stats, and otherwise sits at
the normal bottom margin.

| Old | New |
| --- | --- |
| <img width="460" height="158" alt="UPDATE_NOTICE_OLD"
src="https://github.com/user-attachments/assets/d7ac9e5a-f69a-47de-89d5-9b6c6df4e1aa"
/> | <img width="440" height="157" alt="UPDATE_NOTICE_NEW"
src="https://github.com/user-attachments/assets/a5eee05b-0232-4668-bc3e-fd3ffdbad9b8"
/> |
 2026-08-05 01:00:31 +10:00
Jake Howell 209c990888 refactor(site): demui template settings forms (#27636) 
> 🤖 This PR was written by Coder Agents on behalf of Jake Howell.

Removes the remaining MUI/Emotion usage from the Template Settings
pages, moving them over to Tailwind and the shared component primitives.

## What

- **`<TemplateScheduleForm />`** — deMUI'd, along with the shared
**`<DurationField />`** it relies on.
- **`<TemplateVariablesForm />` / `<TemplateVariableField />`** —
deMUI'd.
- **`<TemplateSettingsForm />`** (general settings) — deMUI'd.

No behavioural changes intended; this is a styling/plumbing refactor.
 2026-08-05 01:00:18 +10:00
Paweł Banaszewski 8f5f15a92f fix: remove unbound Client() method from aibridged.Server (#27845) 
Adds client context to `Client()` method in `aibridged.Server`,
effectivly renaming `ClientContext()` method as `Client()`.
Similarly `aibridged.ClientFuncWithContext` became
`aibridged.ClientFunc`.

`aibridged.Server.Client()` acquired a DRPC client with
`context.Background()`, callers in theory could wait indefinitely for
the daemon to connect to coderd.

Every call site already had a context except the recorder callback.
`aibridge.NewRecorder` takes a `func(context.Context) (Recorder, error)`
and acquires against the record call's context.
 2026-08-04 16:57:16 +02:00
Susana Ferreira db88ec3f6a fix: price AI usage by configured provider type (#27836) 
## Problem

AI Gateway records the aibridge provider on each interception, which is
the upstream wire format and only ever `anthropic`, `openai`, or
`copilot`. Prices are matched on exact provider and model equality, so a
provider configured as Azure, Bedrock, Google, OpenRouter, or Vercel is
priced as if it were native OpenAI or Anthropic, matching either the
wrong price or no price at all.

## Changes

- Resolve the configured provider type from `ai_providers` by provider
name, which is unique among live providers, and key the price lookup on
it instead of the aibridge provider. No schema change is needed.
- Label `unpriced_token_usage_records_total` with the same provider
value used for the lookup, so it names a provider an operator actually
configured.
- Treat a provider that cannot be resolved as unpriced, consistent with
how a missing price is handled today.

Closes
https://linear.app/codercom/issue/AIGOV-570/resolve-ai-model-prices-using-the-configured-provider-type
Depends on the follow-up that extends the shipped price book to the
remaining provider types:
https://linear.app/codercom/issue/AIGOV-571/ship-prices-for-all-ai-governance-provider-types

> [!NOTE]
> Initially generated by Claude Opus 5, modified and reviewed by
@ssncferreira
 2026-08-04 14:44:27 +01:00
Danielle Maywood 4aec1ea592 fix(site): tidy AI model provider configuration layout (#27843) 2026-08-04 14:40:48 +01:00
Cian JohnstonandSusana Ferreira 60161fd375 chore: update model prices to include more providers (#27837) 
Adds the full set of supported provider types to
`scripts/aibridgepricesgen` and updates stored model prices.

Notes:
* We need to rename a few keys from models.dev JSON to match our
internal provider types.
* `prices.json` is now marked as generated.

---------

Co-authored-by: Susana Ferreira <susana@coder.com>
 2026-08-04 14:17:50 +01:00
Marcin Tojek 866eb970a4 docs: correct 2.35 stable version to v2.35.3 (#27842) 
## Summary

Follow-up to #27828, addressing review feedback from @matifali.

The automated `releasetui` update in #27828 promoted `2.36.0` to
Mainline but
left two stale references to the 2.35 stable channel:

- `docs/install/rancher.md`: **Stable** was left at `2.34.6` instead of
being
  promoted to the current 2.35 stable patch.
- `docs/install/releases/index.md`: the 2.35 row was marked **Stable**
but its
  latest release still pointed at `v2.35.2`.

The latest 2.35 patch is `v2.35.3` (see the `v2.35.3` release tag), so
both are
now updated accordingly.

## Changes

- `docs/install/rancher.md`: Stable `2.34.6` -> `2.35.3`
- `docs/install/releases/index.md`: 2.35 latest release `v2.35.2` ->
`v2.35.3`

<details>
<summary>Review comments addressed</summary>

- `docs/install/rancher.md` (matifali): "A bit late, but shouldn't the
stable be now 2.35.3?"
- `docs/install/releases/index.md` (matifali): "The latest stable is
2.35.3 and not 2.35.2"

</details>

> [!NOTE]
> This PR was generated by Coder Agents on behalf of @mtojek.
 2026-08-04 15:09:05 +02:00
dependabot[bot] fbc5ed4674 chore: bump google.golang.org/grpc from 1.82.1 to 1.83.0 (#27833) 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from
1.82.1 to 1.83.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/grpc/grpc-go/releases">google.golang.org/grpc's
releases</a>.</em></p>
<blockquote>
<h2>Release 1.83.0</h2>
<h1>Security</h1>
<ul>
<li>server: Stop reading from connections when flooded by HTTP/2 frames
to mitigate resource exhaustion. The default value for this limit is 100
frames, excluding DATA and HEADERS, and may be changed by setting
environment variable
<code>GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT</code>.</li>
<li>xds/rbac: Support <code>Metadata</code> and
<code>RequestedServerName</code> permissions matcher fields. If present
in a DENY rule, previously these would be ignored and fail-open.</li>
<li>xds/rbac: Fix panic when parsing unsupported fields in
<code>NotRule</code>/<code>NotId</code> permissions.</li>
<li>xds/rbac: Support the deprecated <code>source_ip</code> principal
identifier by treating it as equivalent to
<code>direct_remote_ip</code>.</li>
<li>xds: Fix panic when parsing route header matchers configured with
empty <code>exact_match</code>, <code>prefix_match</code>, or
<code>suffix_match</code> strings. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9223">#9223</a>)</li>
</ul>
<h1>New Features</h1>
<ul>
<li>xds/googlec2p: Enable DirectPath over Interconnect support for
on-premises clients via the <code>force-xds</code> target URI query
parameter. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9133">#9133</a>)</li>
<li>xds: Enable xDS configuration to control which fields get propagated
from ORCA backend metric reports to LRS load reports. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9145">#9145</a>)</li>
<li>authz: Add <code>OnPolicyUpdate</code> callback to
<code>FileWatcherOptions</code> to notify when an authz policy is loaded
or updated. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9142">#9142</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/hnefatl"><code>@​hnefatl</code></a></li>
</ul>
</li>
<li>xds: Add support for the GCP Authentication HTTP Filter, which
automatically fetches and attaches GCP Service Account Identity JWT
tokens to outgoing RPCs.
<ul>
<li>This feature can be enabled by setting environment variable
<code>GRPC_EXPERIMENTAL_XDS_GCP_AUTHENTICATION_FILTER=true</code>. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9119">#9119</a>)</li>
</ul>
</li>
<li>xds: Add support for xDS-based HTTP CONNECT proxies.
<ul>
<li>This feature can be enabled by setting environment variable
<code>GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT=true</code>. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9151">#9151</a>)</li>
</ul>
</li>
<li>xds: Add support for <code>contains_match</code> in route header
matchers. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9223">#9223</a>)</li>
</ul>
<h1>Bug Fixes</h1>
<ul>
<li>credentials/alts: Fix panic when processing malformed frames by
validating that the message frame length exceeds the message type field
size. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9197">#9197</a>)</li>
<li>grpc: Fix compilation on Plan 9 targets (<code>GOOS=plan9</code>),
broken since v1.81.0. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9255">#9255</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/Yusufihsangorgel"><code>@​Yusufihsangorgel</code></a></li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/grpc/grpc-go/commit/4c226daff88f54441d70f710815e07b81fb162b2"><code>4c226da</code></a>
Change version to 1.83.0 (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9228">#9228</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/c198988aa9297cb9428c7afaaee4363d0082b838"><code>c198988</code></a>
Cherrypick 9223 into v1.83.x (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9279">#9279</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/8ce3ebf24af3c206bacf279adcf9c3a88981df68"><code>8ce3ebf</code></a>
Cherrypick PR 9255 into v1.83.x (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9263">#9263</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/e39384978cf59c70634f900a7aa93d7483886696"><code>e393849</code></a>
Cherry-pick recent changes from master (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9240">#9240</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/2a112a82f5c53ab3b89b5aa4a02b4195e2706879"><code>2a112a8</code></a>
authz: add onPolicyUpdate callback to authz file watcher (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9142">#9142</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/1a80fca960d39ae4d7d6f2d9323ca2d243fd44bb"><code>1a80fca</code></a>
vet: adds a check to disallow usage of regex.Compile in xDS code (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9216">#9216</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/26ffdb33175d6fb4e56bcb598fb1a56162397091"><code>26ffdb3</code></a>
[tls] Add safety check in custom cert verification that peer cert chain
is no...</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/50139749cb5bc50dd672689549340fceac494c1b"><code>5013974</code></a>
internal/grpcsync: add ScheduleAndWait to CallbackSerializer (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9162">#9162</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/bd58bc07c4bc552859f758594a6605b5b27cd041"><code>bd58bc0</code></a>
internal/transport: increase test timeout locally in
TestAccountCheckWindowSi...</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/484f1502aea22dbf8dc54df9aff26214b9c35e1a"><code>484f150</code></a>
httpfilter/extproc: add check to ensure that response trailer mode must
be SE...</li>
<li>Additional commits viewable in <a
href="https://github.com/grpc/grpc-go/compare/v1.82.1...v1.83.0">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-04 11:33:37 +00:00
dependabot[bot] 44cf21f7f1 ci: bump the github-actions group across 1 directory with 11 updates (#27835) 
Bumps the github-actions group with 11 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `7.0.0` |
`7.0.1` |
| [docker/login-action](https://github.com/docker/login-action) |
`4.4.0` | `4.5.2` |
| [actions/attest](https://github.com/actions/attest) | `4.1.1` |
`4.2.0` |
|
[aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials)
| `6.2.2` | `6.2.3` |
| [fluxcd/flux2/action](https://github.com/fluxcd/flux2) | `2.9.2` |
`2.9.3` |
|
[linear/linear-release-action](https://github.com/linear/linear-release-action)
| `0.14.5` | `0.15.0` |
| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) |
`2.4.3` | `2.4.4` |
|
[github/codeql-action/upload-sarif](https://github.com/github/codeql-action)
| `4.37.0` | `4.37.3` |
| [github/codeql-action/init](https://github.com/github/codeql-action) |
`4.37.0` | `4.37.3` |
|
[github/codeql-action/analyze](https://github.com/github/codeql-action)
| `4.37.0` | `4.37.3` |
| [actions/stale](https://github.com/actions/stale) | `10.4.0` |
`11.0.0` |


Updates `actions/checkout` from 7.0.0 to 7.0.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/releases">actions/checkout's
releases</a>.</em></p>
<blockquote>
<h2>v7.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>skip running unsafe pr check if input is default by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li>
<li>trim only ascii whitespace for branch by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li>
<li>escape values passed to --unset by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li>
<li>Various dependency updates</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v7...v7.0.1">https://github.com/actions/checkout/compare/v7...v7.0.1</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>v7.0.1</h2>
<ul>
<li>Skip running unsafe pr check if input is default by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li>
<li>Trim only ascii whitespace for branch by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li>
<li>Escape values passed to --unset by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li>
<li>Various dependency updates</li>
</ul>
<h2>v7.0.0</h2>
<ul>
<li>Block checking out fork PR for pull_request_target and workflow_run
by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
<li>Various dependency updates</li>
</ul>
<h2>v6.0.3</h2>
<ul>
<li>Fix checkout init for SHA-256 repositories by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
</ul>
<h2>v6.0.2</h2>
<ul>
<li>Fix tag handling: preserve annotations and explicit fetch-tags by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li>
</ul>
<h2>v6.0.1</h2>
<ul>
<li>Add worktree support for persist-credentials includeIf by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li>
</ul>
<h2>v6.0.0</h2>
<ul>
<li>Persist creds to a separate file by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li>
<li>Update README to include Node.js 24 support details and requirements
by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li>
</ul>
<h2>v5.0.1</h2>
<ul>
<li>Port v6 cleanup to v5 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li>
</ul>
<h2>v5.0.0</h2>
<ul>
<li>Update actions checkout to use node 24 by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
</ul>
<h2>v4.3.1</h2>
<ul>
<li>Port v6 cleanup to v4 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li>
</ul>
<h2>v4.3.0</h2>
<ul>
<li>docs: update README.md by <a
href="https://github.com/motss"><code>@​motss</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
<li>Add internal repos for checking out multiple repositories by <a
href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
<li>Documentation update - add recommended permissions to Readme by <a
href="https://github.com/benwells"><code>@​benwells</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
<li>Adjust positioning of user email note and permissions heading by <a
href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li>
<li>Update README.md by <a
href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
<li>Update CODEOWNERS for actions by <a
href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li>
<li>Update package dependencies by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
</ul>
<h2>v4.2.2</h2>
<ul>
<li><code>url-helper.ts</code> now leverages well-known environment
variables by <a href="https://github.com/jww3"><code>@​jww3</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li>
<li>Expand unit test coverage for <code>isGhes</code> by <a
href="https://github.com/jww3"><code>@​jww3</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li>
</ul>
<h2>v4.2.1</h2>
<ul>
<li>Check out other refs/* by commit if provided, fall back to ref by <a
href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/checkout/commit/3d3c42e5aac5ba805825da76410c181273ba90b1"><code>3d3c42e</code></a>
prep v7.0.1 release (<a
href="https://redirect.github.com/actions/checkout/issues/2531">#2531</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/28802689a136bfcdb721715abd713740beecbe07"><code>2880268</code></a>
escape values passed to --unset (<a
href="https://redirect.github.com/actions/checkout/issues/2530">#2530</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/12cd2235efa0937479335606d7c3ac9f6c0973b1"><code>12cd223</code></a>
trim only ascii whitespace for branch (<a
href="https://redirect.github.com/actions/checkout/issues/2521">#2521</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/62661c4e71a304b2823ed026347b8d34c3eac541"><code>62661c4</code></a>
skip running unsafe pr check if input is default (<a
href="https://redirect.github.com/actions/checkout/issues/2518">#2518</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/e8d4307400f9427dba7cb98e488d6ab85f1cec5f"><code>e8d4307</code></a>
Bump the minor-actions-dependencies group with 2 updates (<a
href="https://redirect.github.com/actions/checkout/issues/2499">#2499</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/631c942040754b6e095e929c1677c07e10ed4f87"><code>631c942</code></a>
eslint 9 (<a
href="https://redirect.github.com/actions/checkout/issues/2474">#2474</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/4f1f4aec02e41874fa0262ea8ff5172d7978ad1e"><code>4f1f4ae</code></a>
Bump actions/upload-artifact from 4 to 7 (<a
href="https://redirect.github.com/actions/checkout/issues/2476">#2476</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/ba097532fb203f7e88c9c3c0b899b49469908a92"><code>ba09753</code></a>
Bump actions/checkout from 6 to 7 (<a
href="https://redirect.github.com/actions/checkout/issues/2488">#2488</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/b9e0990d219a03df7633c93f6f005a8fecbcab22"><code>b9e0990</code></a>
Bump docker/login-action from 3.3.0 to 4.2.0 (<a
href="https://redirect.github.com/actions/checkout/issues/2479">#2479</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/e8cb398be4a550817e382abf69e4c12c76fce1f2"><code>e8cb398</code></a>
Bump docker/build-push-action from 6.5.0 to 7.2.0 (<a
href="https://redirect.github.com/actions/checkout/issues/2478">#2478</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1">compare
view</a></li>
</ul>
</details>
<br />

Updates `docker/login-action` from 4.4.0 to 4.5.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/docker/login-action/releases">docker/login-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.5.2</h2>
<ul>
<li>Surface Docker Hub OIDC error responses by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/1058">docker/login-action#1058</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/login-action/compare/v4.5.1...v4.5.2">https://github.com/docker/login-action/compare/v4.5.1...v4.5.2</a></p>
<h2>v4.5.1</h2>
<ul>
<li>Support <code>dhi.io</code> as Docker Hub OIDC registry by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/1054">docker/login-action#1054</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/login-action/compare/v4.5.0...v4.5.1">https://github.com/docker/login-action/compare/v4.5.0...v4.5.1</a></p>
<h2>v4.5.0</h2>
<ul>
<li><a href="https://github.com/docker/login-action#docker-hub">Docker
Hub OIDC</a> login support by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/1048">docker/login-action#1048</a></li>
<li>Bump <code>@​aws-sdk/client-ecr</code> and
<code>@​aws-sdk/client-ecr-public</code> to 3.1091.0 in <a
href="https://redirect.github.com/docker/login-action/pull/1037">docker/login-action#1037</a></li>
<li>Bump <code>@​docker/actions-toolkit</code> from 0.92.0 to 0.94.0 in
<a
href="https://redirect.github.com/docker/login-action/pull/1044">docker/login-action#1044</a>
<a
href="https://redirect.github.com/docker/login-action/pull/1050">docker/login-action#1050</a></li>
<li>Bump brace-expansion from 1.1.13 to 1.1.16 in <a
href="https://redirect.github.com/docker/login-action/pull/1046">docker/login-action#1046</a></li>
<li>Bump js-yaml from 5.2.0 to 5.2.1 in <a
href="https://redirect.github.com/docker/login-action/pull/1038">docker/login-action#1038</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/login-action/compare/v4.4.0...v4.5.0">https://github.com/docker/login-action/compare/v4.4.0...v4.5.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/docker/login-action/commit/371161bbe7024a29a25c5e19bfcbc0804fe9ad2c"><code>371161b</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1058">#1058</a>
from crazy-max/fix-dockerhub-oidc-error-handling</li>
<li><a
href="https://github.com/docker/login-action/commit/5dc73df38ebcfa6f96479901e253d172c3e35849"><code>5dc73df</code></a>
chore: update generated content</li>
<li><a
href="https://github.com/docker/login-action/commit/2aa1edee0b06c23880529064a4f7d7d3d2f9bc87"><code>2aa1ede</code></a>
surface Docker Hub OIDC error responses</li>
<li><a
href="https://github.com/docker/login-action/commit/abd2ef45e78c5afb21d64d4ca52ee8550d9572c7"><code>abd2ef4</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1055">#1055</a>
from crazy-max/test-registry-auth-oidc</li>
<li><a
href="https://github.com/docker/login-action/commit/d49d3a9839fef51322fa44989a44fdc43fccfc22"><code>d49d3a9</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1054">#1054</a>
from crazy-max/oidc-missing-dhi</li>
<li><a
href="https://github.com/docker/login-action/commit/b58b17c30b4db92a4ed049b213cae512b12e460b"><code>b58b17c</code></a>
test: cover Docker Hub OIDC with registry-auth</li>
<li><a
href="https://github.com/docker/login-action/commit/be646c21cec26cea303e29290d5f6ba6fde8e606"><code>be646c2</code></a>
chore: update generated content</li>
<li><a
href="https://github.com/docker/login-action/commit/d77c059cb9956cedaa427dc022d89f39acba678f"><code>d77c059</code></a>
support dhi.io as Docker Hub OIDC registry</li>
<li><a
href="https://github.com/docker/login-action/commit/06fb636fac595d6fb4b28a5dfcb21a6f5091859c"><code>06fb636</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1037">#1037</a>
from docker/dependabot/npm_and_yarn/aws-sdk-dependen...</li>
<li><a
href="https://github.com/docker/login-action/commit/a8bc9539118a762b0e5788b53a50907977cc1b8d"><code>a8bc953</code></a>
[dependabot skip] chore: update generated content</li>
<li>Additional commits viewable in <a
href="https://github.com/docker/login-action/compare/af1e73f918a031802d376d3c8bbc3fe56130a9b0...371161bbe7024a29a25c5e19bfcbc0804fe9ad2c">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/attest` from 4.1.1 to 4.2.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/attest/releases">actions/attest's
releases</a>.</em></p>
<blockquote>
<h2>v4.2.0</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: split checksums on any line ending so LF files parse on Windows
by <a href="https://github.com/bdehamer"><code>@​bdehamer</code></a> in
<a
href="https://redirect.github.com/actions/attest/pull/443">actions/attest#443</a></li>
<li>Bump <code>@​actions/glob</code> from 0.6.1 to 0.7.0 in the
npm-production group across 1 directory by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/attest/pull/435">actions/attest#435</a></li>
<li>Bump csv-parse from 6.2.1 to 7.0.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/attest/pull/437">actions/attest#437</a></li>
<li>Read subjects from GITHUB_ARTIFACTS_LIST by <a
href="https://github.com/bdehamer"><code>@​bdehamer</code></a> in <a
href="https://redirect.github.com/actions/attest/pull/447">actions/attest#447</a></li>
<li>Support SHA-2 subject digests by <a
href="https://github.com/bdehamer"><code>@​bdehamer</code></a> in <a
href="https://redirect.github.com/actions/attest/pull/446">actions/attest#446</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/attest/compare/v4.1.1...v4.2.0">https://github.com/actions/attest/compare/v4.1.1...v4.2.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/attest/commit/f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6"><code>f7c74d2</code></a>
feat: support SHA-2 subject digests (<a
href="https://redirect.github.com/actions/attest/issues/446">#446</a>)</li>
<li><a
href="https://github.com/actions/attest/commit/88633d1756270d272f232bbaba8360d70e180b14"><code>88633d1</code></a>
Bump js-yaml from 4.2.0 to 5.2.1 (<a
href="https://redirect.github.com/actions/attest/issues/452">#452</a>)</li>
<li><a
href="https://github.com/actions/attest/commit/5dff8240ad7d3c21bf0f776b9ab04d47a3febba5"><code>5dff824</code></a>
Bump the actions-minor group with 3 updates (<a
href="https://redirect.github.com/actions/attest/issues/453">#453</a>)</li>
<li><a
href="https://github.com/actions/attest/commit/e67e5399f37b282b9382bd1b2d4ed66daf4e21b5"><code>e67e539</code></a>
Bump the npm-development group across 1 directory with 2 updates (<a
href="https://redirect.github.com/actions/attest/issues/448">#448</a>)</li>
<li><a
href="https://github.com/actions/attest/commit/95f61558e35f51e484fa916f9bf319b265996850"><code>95f6155</code></a>
Bump <code>@​types/node</code> from 25.9.2 to 26.1.1 (<a
href="https://redirect.github.com/actions/attest/issues/449">#449</a>)</li>
<li><a
href="https://github.com/actions/attest/commit/b644c729d1fae21e9635a15b38ce726b49c99e38"><code>b644c72</code></a>
Read subjects from GITHUB_ARTIFACTS_LIST (<a
href="https://redirect.github.com/actions/attest/issues/447">#447</a>)</li>
<li><a
href="https://github.com/actions/attest/commit/7d3af28c422bf02197a99f195b689b34377e11a2"><code>7d3af28</code></a>
Bump csv-parse from 6.2.1 to 7.0.1 (<a
href="https://redirect.github.com/actions/attest/issues/437">#437</a>)</li>
<li><a
href="https://github.com/actions/attest/commit/52cbb4d3ca5ac64fbabac3b5e172f4fb74c8f99e"><code>52cbb4d</code></a>
Bump <code>@​actions/glob</code> from 0.6.1 to 0.7.0 in the
npm-production group across 1 d...</li>
<li><a
href="https://github.com/actions/attest/commit/a5ce33e52236c69ed17d18f87d6ba1ae1ba781dd"><code>a5ce33e</code></a>
ci: download rebuilt dist/ artifact outside the checkout workspace (<a
href="https://redirect.github.com/actions/attest/issues/445">#445</a>)</li>
<li><a
href="https://github.com/actions/attest/commit/4c65731ec8848677473bd6f7fcef1e73c4cc79e0"><code>4c65731</code></a>
ci: auto-rebuild dist/ for Dependabot production bumps (<a
href="https://redirect.github.com/actions/attest/issues/444">#444</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/attest/compare/a1948c3f048ba23858d222213b7c278aabede763...f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6">compare
view</a></li>
</ul>
</details>
<br />

Updates `aws-actions/configure-aws-credentials` from 6.2.2 to 6.2.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/aws-actions/configure-aws-credentials/releases">aws-actions/configure-aws-credentials's
releases</a>.</em></p>
<blockquote>
<h2>v6.2.3</h2>
<h2><a
href="https://github.com/aws-actions/configure-aws-credentials/compare/v6.2.2...v6.2.3">6.2.3</a>
(2026-07-22)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>attach git credentials before Tag Major Version push (<a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1877">#1877</a>)
(<a
href="https://github.com/aws-actions/configure-aws-credentials/commit/9ae780b171afa8c5a3a6a2d154a765b709492482">9ae780b</a>)</li>
<li>PackedPolicyTooLarge detection in STS tags (<a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1899">#1899</a>)
(<a
href="https://github.com/aws-actions/configure-aws-credentials/commit/fa8d6a57bbf44b34439fb080bbdadc7c92c285eb">fa8d6a5</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md">aws-actions/configure-aws-credentials's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<p>All notable changes to this project will be documented in this file.
See <a
href="https://github.com/conventional-changelog/standard-version">standard-version</a>
for commit guidelines.</p>
<h2><a
href="https://github.com/aws-actions/configure-aws-credentials/compare/v6.2.2...v6.2.3">6.2.3</a>
(2026-07-22)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>attach git credentials before Tag Major Version push (<a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1877">#1877</a>)
(<a
href="https://github.com/aws-actions/configure-aws-credentials/commit/9ae780b171afa8c5a3a6a2d154a765b709492482">9ae780b</a>)</li>
<li>PackedPolicyTooLarge detection in STS tags (<a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1899">#1899</a>)
(<a
href="https://github.com/aws-actions/configure-aws-credentials/commit/fa8d6a57bbf44b34439fb080bbdadc7c92c285eb">fa8d6a5</a>)</li>
</ul>
<h2><a
href="https://github.com/aws-actions/configure-aws-credentials/compare/v6.2.1...v6.2.2">6.2.2</a>
(2026-07-07)</h2>
<h3>Miscellaneous Chores</h3>
<ul>
<li>release 6.2.2 (<a
href="https://github.com/aws-actions/configure-aws-credentials/commit/d01d678e65d6d2bd9d5ca7a95d6f07b00e25f2c2">d01d678</a>)</li>
</ul>
<h2><a
href="https://github.com/aws-actions/configure-aws-credentials/compare/v6.2.0...v6.2.1">6.2.1</a>
(2026-06-26)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>enforce allowed-account-ids on all auth paths (<a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1847">#1847</a>)
(<a
href="https://github.com/aws-actions/configure-aws-credentials/commit/4d281fbc56a82e63c3fc14f2cc22361f34c97493">4d281fb</a>)</li>
</ul>
<h2><a
href="https://github.com/aws-actions/configure-aws-credentials/compare/v6.1.3...v6.2.0">6.2.0</a>
(2026-06-01)</h2>
<h3>Features</h3>
<ul>
<li>add additional session tags by default (<a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1775">#1775</a>)
(<a
href="https://github.com/aws-actions/configure-aws-credentials/commit/e0ba7685077379a14a82d01fefd511490344ebfc">e0ba768</a>)</li>
<li>add more retry logic and better logging (<a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1764">#1764</a>)
(<a
href="https://github.com/aws-actions/configure-aws-credentials/commit/540d0c13aedb8d55501d220bd2f0b3cdedfe84e8">540d0c1</a>)</li>
<li>add regex validation to role-session-name (<a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1765">#1765</a>)
(<a
href="https://github.com/aws-actions/configure-aws-credentials/commit/e35449909c6ede5083a48ba4b8bbfaaa1cf09ba1">e354499</a>)</li>
<li>Allow custom session tags to be passed when assuming a role (<a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1759">#1759</a>)
(<a
href="https://github.com/aws-actions/configure-aws-credentials/commit/61f50f630f383628add73c1eab3f1935ba07da2b">61f50f6</a>)</li>
<li>expose run id in STS client user-agent (<a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1774">#1774</a>)
(<a
href="https://github.com/aws-actions/configure-aws-credentials/commit/29d1be30273e7ef371d59fccf6ec54572c64ec89">29d1be3</a>)</li>
<li>support custom STS endpoints (<a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1762">#1762</a>)
(<a
href="https://github.com/aws-actions/configure-aws-credentials/commit/8d52d05d7a4521fa52b39de50cb6114b12e5c332">8d52d05</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>skip credential check on output-env-credentials: false (<a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1778">#1778</a>)
(<a
href="https://github.com/aws-actions/configure-aws-credentials/commit/58e7c47adf77846879008deadfeeef8a6969fe6c">58e7c47</a>)</li>
<li>assumeRole failing from session tag size too large (<a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1808">#1808</a>)
(<a
href="https://github.com/aws-actions/configure-aws-credentials/commit/d6f5dc331b44474b19a52caaf85fa4d637b13c8e">d6f5dc3</a>)</li>
</ul>
<h2><a
href="https://github.com/aws-actions/configure-aws-credentials/compare/v6.1.2...v6.1.3">6.1.3</a>
(2026-05-28)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>fix: allow kubelet token symlink in <a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1805">#1805</a></li>
</ul>
<h2><a
href="https://github.com/aws-actions/configure-aws-credentials/compare/v6.1.1...v6.1.2">6.1.2</a>
(2026-05-26)</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/aws-actions/configure-aws-credentials/commit/e6de054238d6b7531b4efff3b6587d9aade6a06c"><code>e6de054</code></a>
chore(main): release 6.2.3 (<a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1878">#1878</a>)</li>
<li><a
href="https://github.com/aws-actions/configure-aws-credentials/commit/ab3b2ba025afb33b6856abfc1626992c70909302"><code>ab3b2ba</code></a>
chore: Update dist</li>
<li><a
href="https://github.com/aws-actions/configure-aws-credentials/commit/fa8d6a57bbf44b34439fb080bbdadc7c92c285eb"><code>fa8d6a5</code></a>
fix: PackedPolicyTooLarge detection in STS tags (<a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1899">#1899</a>)</li>
<li><a
href="https://github.com/aws-actions/configure-aws-credentials/commit/42e118a65655a9bcd2929e1ab7c4588fdd3255d3"><code>42e118a</code></a>
chore(deps-dev): bump markdownlint-cli from 0.49.0 to 0.49.1 (<a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1896">#1896</a>)</li>
<li><a
href="https://github.com/aws-actions/configure-aws-credentials/commit/d86ddfcecc93d50cd1d1ca675d859403357c3d89"><code>d86ddfc</code></a>
chore: Update dist</li>
<li><a
href="https://github.com/aws-actions/configure-aws-credentials/commit/874aaac21e617e1544df3c6a9f043c9bc96adf70"><code>874aaac</code></a>
chore(deps): bump <code>@​aws-sdk/client-sts</code> from 3.1086.0 to
3.1091.0 (<a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1892">#1892</a>)</li>
<li><a
href="https://github.com/aws-actions/configure-aws-credentials/commit/d4341b65accaa2ddbb952380d8ef12f95043d338"><code>d4341b6</code></a>
chore: Update dist</li>
<li><a
href="https://github.com/aws-actions/configure-aws-credentials/commit/fe51823c9714409fc32ade60b0bb4e79890beff1"><code>fe51823</code></a>
chore(deps-dev): bump <code>@​aws-sdk/credential-provider-env</code> (<a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1894">#1894</a>)</li>
<li><a
href="https://github.com/aws-actions/configure-aws-credentials/commit/a8be382115e1ad5c77c560af842deddb56cd375c"><code>a8be382</code></a>
chore(deps-dev): bump <code>@​biomejs/biome</code> from 2.5.3 to 2.5.4
(<a
href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1893">#1893</a>)</li>
<li><a
href="https://github.com/aws-actions/configure-aws-credentials/commit/e000376c2c1f88ccef5f22a6bda02c24932d8ea5"><code>e000376</code></a>
chore: Update dist</li>
<li>Additional commits viewable in <a
href="https://github.com/aws-actions/configure-aws-credentials/compare/517a711dbcd0e402f90c77e7e2f81e849156e31d...e6de054238d6b7531b4efff3b6587d9aade6a06c">compare
view</a></li>
</ul>
</details>
<br />

Updates `fluxcd/flux2/action` from 2.9.2 to 2.9.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/fluxcd/flux2/releases">fluxcd/flux2/action's
releases</a>.</em></p>
<blockquote>
<h2>v2.9.3</h2>
<h2>Highlights</h2>
<p>Flux v2.9.3 is a patch release. It fixes empty lines vanishing from
rendered Helm chart manifests, HelmReleases being marked as tested when
their Helm test hooks never ran, and <code>spec.images</code> entries
that set only some image fields discarding the remaining fields already
declared for the same image in the <code>kustomization.yaml</code>. The
latter affects both kustomize-controller and the <code>flux build|diff
kustomization</code> commands. Users are encouraged to upgrade for the
best experience.</p>
<p>ℹ️ Please follow the <a
href="https://github.com/fluxcd/flux2/discussions/5572">Upgrade
Procedure for Flux v2.7+</a> for a smooth upgrade from Flux v2.6 to the
latest version.</p>
<p>Fixes:</p>
<ul>
<li>Fix empty lines vanishing from rendered chart manifests
(helm-controller)</li>
<li>Fix <code>HasBeenTested</code> for all corner cases, where a release
could be marked as tested although its Helm test hooks never ran
(helm-controller)</li>
<li>Fix a <code>spec.images</code> entry setting only some of the image
fields discarding the remaining fields already declared for the same
image in the <code>kustomization.yaml</code> at <code>spec.path</code>,
e.g. overriding only <code>newName</code> produced an untagged image
reference (kustomize-controller, flux CLI)</li>
</ul>
<p>Improvements:</p>
<ul>
<li>Update fluxcd/pkg dependencies</li>
<li>Include source-watcher in the OCI flux-manifests artifact</li>
</ul>
<h2>Components changelog</h2>
<ul>
<li>kustomize-controller <a
href="https://github.com/fluxcd/kustomize-controller/blob/v1.9.4/CHANGELOG.md">v1.9.4</a></li>
<li>helm-controller <a
href="https://github.com/fluxcd/helm-controller/blob/v1.6.3/CHANGELOG.md">v1.6.3</a></li>
</ul>
<h2>CLI changelog</h2>
<ul>
<li>[release/v2.9.x] Include source-watcher to oci flux-manifests by <a
href="https://github.com/fluxcdbot"><code>@​fluxcdbot</code></a> in <a
href="https://redirect.github.com/fluxcd/flux2/pull/5996">fluxcd/flux2#5996</a></li>
<li>Update fluxcd/pkg dependencies by <a
href="https://github.com/fluxcdbot"><code>@​fluxcdbot</code></a> in <a
href="https://redirect.github.com/fluxcd/flux2/pull/6006">fluxcd/flux2#6006</a></li>
<li>Update toolkit components by <a
href="https://github.com/fluxcdbot"><code>@​fluxcdbot</code></a> in <a
href="https://redirect.github.com/fluxcd/flux2/pull/6011">fluxcd/flux2#6011</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/fluxcd/flux2/compare/v2.9.2...v2.9.3">https://github.com/fluxcd/flux2/compare/v2.9.2...v2.9.3</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/fluxcd/flux2/commit/16602fa989daa99762f1c6d1186ae2ad1c735815"><code>16602fa</code></a>
Merge pull request <a
href="https://redirect.github.com/fluxcd/flux2/issues/6011">#6011</a>
from fluxcd/update-components-release/v2.9.x</li>
<li><a
href="https://github.com/fluxcd/flux2/commit/62059b85b70fc44661dc0785d7cff458a4babd3e"><code>62059b8</code></a>
Update toolkit components</li>
<li><a
href="https://github.com/fluxcd/flux2/commit/fe6d94c898fc1519ebe796b3febbbd90b02ba393"><code>fe6d94c</code></a>
Merge pull request <a
href="https://redirect.github.com/fluxcd/flux2/issues/6006">#6006</a>
from fluxcd/update-pkg-deps/release/v2.9.x</li>
<li><a
href="https://github.com/fluxcd/flux2/commit/8d305b5fb80a3f2365aebde5c6157dc5b48d00aa"><code>8d305b5</code></a>
Update fluxcd/pkg dependencies</li>
<li><a
href="https://github.com/fluxcd/flux2/commit/282aee38f43e39bb7b8261d1fe71dfcbca7fd177"><code>282aee3</code></a>
Merge pull request <a
href="https://redirect.github.com/fluxcd/flux2/issues/5996">#5996</a>
from fluxcd/backport-5995-to-release/v2.9.x</li>
<li><a
href="https://github.com/fluxcd/flux2/commit/9cd1567708f57997cb949834b21f6c8913af098a"><code>9cd1567</code></a>
Include source-watcher to oci flux-manifests</li>
<li>See full diff in <a
href="https://github.com/fluxcd/flux2/compare/6a650dba1b4ae9945185c4bb3cc3f386aaf71b3d...16602fa989daa99762f1c6d1186ae2ad1c735815">compare
view</a></li>
</ul>
</details>
<br />

Updates `linear/linear-release-action` from 0.14.5 to 0.15.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/linear/linear-release-action/releases">linear/linear-release-action's
releases</a>.</em></p>
<blockquote>
<h2>v0.15.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Release v0.15.0 by <a
href="https://github.com/RomainCscn"><code>@​RomainCscn</code></a> in <a
href="https://redirect.github.com/linear/linear-release-action/pull/55">linear/linear-release-action#55</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/linear/linear-release-action/compare/v0.14.6...v0.15.0">https://github.com/linear/linear-release-action/compare/v0.14.6...v0.15.0</a></p>
<h2>v0.14.6</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix release PR body wording for drifted CLI version by <a
href="https://github.com/RomainCscn"><code>@​RomainCscn</code></a> in <a
href="https://redirect.github.com/linear/linear-release-action/pull/53">linear/linear-release-action#53</a></li>
<li>Release v0.14.6 by <a
href="https://github.com/RomainCscn"><code>@​RomainCscn</code></a> in <a
href="https://redirect.github.com/linear/linear-release-action/pull/54">linear/linear-release-action#54</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/linear/linear-release-action/compare/v0.14.5...v0.14.6">https://github.com/linear/linear-release-action/compare/v0.14.5...v0.14.6</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/linear/linear-release-action/commit/af56a9a388625921f3757a2f988e4d7aca958377"><code>af56a9a</code></a>
Release v0.15.0 (<a
href="https://redirect.github.com/linear/linear-release-action/issues/55">#55</a>)</li>
<li><a
href="https://github.com/linear/linear-release-action/commit/3858a5d7892435dc63302ac76b0cdb587435caa9"><code>3858a5d</code></a>
Release v0.14.6 (<a
href="https://redirect.github.com/linear/linear-release-action/issues/54">#54</a>)</li>
<li><a
href="https://github.com/linear/linear-release-action/commit/ef0819652ce938d9c5e5371b575045c88bf30887"><code>ef08196</code></a>
Fix release PR body wording for drifted CLI version (<a
href="https://redirect.github.com/linear/linear-release-action/issues/53">#53</a>)</li>
<li>See full diff in <a
href="https://github.com/linear/linear-release-action/compare/c0cb8354a362c24c6d3e0948f37fd66d07588e3f...af56a9a388625921f3757a2f988e4d7aca958377">compare
view</a></li>
</ul>
</details>
<br />

Updates `ossf/scorecard-action` from 2.4.3 to 2.4.4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/ossf/scorecard-action/releases">ossf/scorecard-action's
releases</a>.</em></p>
<blockquote>
<h2>v2.4.4</h2>
<h2>What's Changed</h2>
<p>This update bumps the Scorecard version to the v5.5.0 release. For a
complete list of changes, please refer to the <a
href="https://github.com/ossf/scorecard/releases/tag/v5.4.0">Scorecard
v5.4.0 release notes</a> and the <a
href="https://github.com/ossf/scorecard/releases/tag/v5.5.0">Scorecard
v5.5.0 release notes</a>.</p>
<ul>
<li>log POST failures instead of failing entire action by <a
href="https://github.com/spencerschrock"><code>@​spencerschrock</code></a>
in <a
href="https://redirect.github.com/ossf/scorecard-action/pull/1625">ossf/scorecard-action#1625</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/ossf/scorecard-action/compare/v2.4.3...v2.4.4">https://github.com/ossf/scorecard-action/compare/v2.4.3...v2.4.4</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/ossf/scorecard-action/commit/2d1146689b8cda280b9bc96326124645441f03bc"><code>2d11466</code></a>
Bump action tag for v2.4.4 release (<a
href="https://redirect.github.com/ossf/scorecard-action/issues/1688">#1688</a>)</li>
<li><a
href="https://github.com/ossf/scorecard-action/commit/1bd3285473b114fb77ed934c4ba0aea31aa0f866"><code>1bd3285</code></a>
🌱 Bump the docker-images group across 1 directory with 2
updates (<a
href="https://redirect.github.com/ossf/scorecard-action/issues/1">#1</a>...</li>
<li><a
href="https://github.com/ossf/scorecard-action/commit/913edce4c1ce57261797e2ddcb74e493d9ce9700"><code>913edce</code></a>
🌱 Bump github.com/containerd/containerd from 1.7.32 to 1.7.33
(<a
href="https://redirect.github.com/ossf/scorecard-action/issues/1671">#1671</a>)</li>
<li><a
href="https://github.com/ossf/scorecard-action/commit/0957b8f1c327cafd868bd6bdb7e441c016628783"><code>0957b8f</code></a>
🌱 Bump golang.org/x/net from 0.56.0 to 0.57.0 (<a
href="https://redirect.github.com/ossf/scorecard-action/issues/1680">#1680</a>)</li>
<li><a
href="https://github.com/ossf/scorecard-action/commit/f0061eb3ff8c4d311e47276c8bcc96e96ed5dc32"><code>f0061eb</code></a>
🌱 Bump google.golang.org/grpc from 1.81.1 to 1.82.1 (<a
href="https://redirect.github.com/ossf/scorecard-action/issues/1687">#1687</a>)</li>
<li><a
href="https://github.com/ossf/scorecard-action/commit/20ee7324026c52f8d0c4b372a7bf382a01b72ff9"><code>20ee732</code></a>
🌱 Bump github.com/sigstore/cosign/v2 from 2.6.3 to 2.6.4 (<a
href="https://redirect.github.com/ossf/scorecard-action/issues/1685">#1685</a>)</li>
<li><a
href="https://github.com/ossf/scorecard-action/commit/9f295ef01b1f77f15b1647c790db825d9577a441"><code>9f295ef</code></a>
🌱 Bump the github-actions group with 6 updates (<a
href="https://redirect.github.com/ossf/scorecard-action/issues/1686">#1686</a>)</li>
<li><a
href="https://github.com/ossf/scorecard-action/commit/69bf556cea38c0fbe034b2ce923253eca7c4d651"><code>69bf556</code></a>
🌱 Bump github.com/sigstore/sigstore-go from 1.1.4 to 1.2.0 (<a
href="https://redirect.github.com/ossf/scorecard-action/issues/1681">#1681</a>)</li>
<li><a
href="https://github.com/ossf/scorecard-action/commit/94e8b9600123b21167ebf56077904fc6ca421a95"><code>94e8b96</code></a>
🌱 Bump github.com/sigstore/rekor from 1.5.0 to 1.5.2 (<a
href="https://redirect.github.com/ossf/scorecard-action/issues/1673">#1673</a>)</li>
<li><a
href="https://github.com/ossf/scorecard-action/commit/c7a1b37bbc88c32d53056d9071ce2ba0df381dfb"><code>c7a1b37</code></a>
🌱 Bump github.com/sigstore/fulcio from 1.8.5 to 1.8.6 (<a
href="https://redirect.github.com/ossf/scorecard-action/issues/1675">#1675</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/ossf/scorecard-action/compare/4eaacf0543bb3f2c246792bd56e8cdeffafb205a...2d1146689b8cda280b9bc96326124645441f03bc">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action/upload-sarif` from 4.37.0 to 4.37.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/upload-sarif's
releases</a>.</em></p>
<blockquote>
<h2>v4.37.3</h2>
<p>No user facing changes.</p>
<h2>v4.37.2</h2>
<ul>
<li>The new address format for the <code>config-file</code> input that
was introduced in CodeQL Action 4.37.0 is now enabled by default. In
addition to the format described there, the <code>remote=</code> prefix
can now be used to explicitly indicate that the input refers to a remote
file. All previous input formats continue to be accepted as well. <a
href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li>
<li>The CodeQL Action can now make use of <a
href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured
private registries</a> in Default Setup to retrieve CodeQL configuration
files from remote repositories that require authentication. This will
allow customers to store their CodeQL configuration in a single
repository that can then be referenced by Default Setup workflows in
other repositories. We expect to roll this and other, related changes
out to everyone in July. <a
href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li>
</ul>
<h2>v4.37.1</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.20.6 and earlier. These versions of
CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise
Server 3.16, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/upload-sarif's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.37.5 - 03 Aug 2026</h2>
<ul>
<li>Fixed a bug where a network error while streaming the download of
the CodeQL bundle could terminate the <code>init</code> Action instead
of falling back to downloading the bundle before extracting it. <a
href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li>
</ul>
<h2>4.37.4 - 29 Jul 2026</h2>
<ul>
<li>This version of the CodeQL Action adds support for the
<code>tools</code> input for the <code>codeql-action/init</code> step to
be specified using a <code>github-codeql-tools</code> <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository
property</a>. This feature will gradually be rolled out following the
release of this version. Once rolled out, this allows for the CodeQL CLI
version that is used in GitHub-managed workflows, such as Default Setup,
to be set to a custom value. For example, customers who run into issues
with rate limits when a new CodeQL CLI version is released can set the
value to <code>toolcache</code> to always use the CodeQL CLI version
that is available in the runner toolcache. For Advanced Setup workflows,
the value provided for <code>tools</code> in the workflow definition
always takes precedence unless the value of the repository property
starts with <code>!</code>. <a
href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li>
</ul>
<h2>4.37.3 - 22 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.2 - 21 Jul 2026</h2>
<ul>
<li>The new address format for the <code>config-file</code> input that
was introduced in CodeQL Action 4.37.0 is now enabled by default. In
addition to the format described there, the <code>remote=</code> prefix
can now be used to explicitly indicate that the input refers to a remote
file. All previous input formats continue to be accepted as well. <a
href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li>
<li>The CodeQL Action can now make use of <a
href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured
private registries</a> in Default Setup to retrieve CodeQL configuration
files from remote repositories that require authentication. This will
allow customers to store their CodeQL configuration in a single
repository that can then be referenced by Default Setup workflows in
other repositories. We expect to roll this and other, related changes
out to everyone in July. <a
href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li>
</ul>
<h2>4.37.1 - 16 Jul 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.20.6 and earlier. These versions of
CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise
Server 3.16, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li>
</ul>
<h2>4.37.0 - 08 Jul 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li>
<li>In addition to the existing input format, the
<code>config-file</code> input for the <code>codeql-action/init</code>
step will soon support a new <code>[owner/]repo[@ref][:path]</code>
format. All components except the repository name are optional. If
omitted, <code>owner</code> defaults to the same owner as the repository
the analysis is running for, <code>ref</code> to <code>main</code>, and
<code>path</code> to <code>.github/codeql-action.yaml</code>. Support
for this format ships in this version of the CodeQL Action, but will
only be enabled over the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li>
</ul>
<h2>4.36.3 - 01 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.36.2 - 04 Jun 2026</h2>
<ul>
<li>Cache CodeQL CLI version information across Actions steps. <a
href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li>
<li>Reduce requests while waiting for analysis processing by using
exponential backoff when polling SARIF processing status. <a
href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li>
</ul>
<h2>4.36.1 - 02 Jun 2026</h2>
<p>No user facing changes.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81"><code>e4fba86</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4031">#4031</a>
from github/update-v4.37.3-72f6a9da0</li>
<li><a
href="https://github.com/github/codeql-action/commit/fb50ab5d62a274adf3ef3e22cfe750ae87a0ede7"><code>fb50ab5</code></a>
Update changelog for v4.37.3</li>
<li><a
href="https://github.com/github/codeql-action/commit/72f6a9da0def52d9193d6a758f0378b65091f8d1"><code>72f6a9d</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4030">#4030</a>
from github/mbg/fix/no-proxy</li>
<li><a
href="https://github.com/github/codeql-action/commit/3b5ee58597653d9cc6785f3f1277f796d81f3646"><code>3b5ee58</code></a>
Use default <code>request</code> options instead of
<code>undefined</code></li>
<li><a
href="https://github.com/github/codeql-action/commit/bfb6be4b5ecd3650f02f530571453e8c64ef0778"><code>bfb6be4</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4028">#4028</a>
from github/mergeback/v4.37.2-to-main-e0647621</li>
<li><a
href="https://github.com/github/codeql-action/commit/526ab84f9858816d9cf5f7b9df4dd5e2235f0eba"><code>526ab84</code></a>
Rebuild</li>
<li><a
href="https://github.com/github/codeql-action/commit/d6217b9b8c14166e4851db94c11155d03bd13c07"><code>d6217b9</code></a>
Update changelog and version after v4.37.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/e0647621c2984b5ed2f768cb892365bf2a616ad1"><code>e064762</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4027">#4027</a>
from github/update-v4.37.2-385bcdc5a</li>
<li><a
href="https://github.com/github/codeql-action/commit/e0faed839190caa67a5cd42f1cc16246028ca3df"><code>e0faed8</code></a>
Add a couple of change notes</li>
<li><a
href="https://github.com/github/codeql-action/commit/73aad0eaa9df172668665a150d17b8bc5a650c20"><code>73aad0e</code></a>
Update changelog for v4.37.2</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action/init` from 4.37.0 to 4.37.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/init's
releases</a>.</em></p>
<blockquote>
<h2>v4.37.3</h2>
<p>No user facing changes.</p>
<h2>v4.37.2</h2>
<ul>
<li>The new address format for the <code>config-file</code> input that
was introduced in CodeQL Action 4.37.0 is now enabled by default. In
addition to the format described there, the <code>remote=</code> prefix
can now be used to explicitly indicate that the input refers to a remote
file. All previous input formats continue to be accepted as well. <a
href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li>
<li>The CodeQL Action can now make use of <a
href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured
private registries</a> in Default Setup to retrieve CodeQL configuration
files from remote repositories that require authentication. This will
allow customers to store their CodeQL configuration in a single
repository that can then be referenced by Default Setup workflows in
other repositories. We expect to roll this and other, related changes
out to everyone in July. <a
href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li>
</ul>
<h2>v4.37.1</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.20.6 and earlier. These versions of
CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise
Server 3.16, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/init's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.37.5 - 03 Aug 2026</h2>
<ul>
<li>Fixed a bug where a network error while streaming the download of
the CodeQL bundle could terminate the <code>init</code> Action instead
of falling back to downloading the bundle before extracting it. <a
href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li>
</ul>
<h2>4.37.4 - 29 Jul 2026</h2>
<ul>
<li>This version of the CodeQL Action adds support for the
<code>tools</code> input for the <code>codeql-action/init</code> step to
be specified using a <code>github-codeql-tools</code> <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository
property</a>. This feature will gradually be rolled out following the
release of this version. Once rolled out, this allows for the CodeQL CLI
version that is used in GitHub-managed workflows, such as Default Setup,
to be set to a custom value. For example, customers who run into issues
with rate limits when a new CodeQL CLI version is released can set the
value to <code>toolcache</code> to always use the CodeQL CLI version
that is available in the runner toolcache. For Advanced Setup workflows,
the value provided for <code>tools</code> in the workflow definition
always takes precedence unless the value of the repository property
starts with <code>!</code>. <a
href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li>
</ul>
<h2>4.37.3 - 22 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.2 - 21 Jul 2026</h2>
<ul>
<li>The new address format for the <code>config-file</code> input that
was introduced in CodeQL Action 4.37.0 is now enabled by default. In
addition to the format described there, the <code>remote=</code> prefix
can now be used to explicitly indicate that the input refers to a remote
file. All previous input formats continue to be accepted as well. <a
href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li>
<li>The CodeQL Action can now make use of <a
href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured
private registries</a> in Default Setup to retrieve CodeQL configuration
files from remote repositories that require authentication. This will
allow customers to store their CodeQL configuration in a single
repository that can then be referenced by Default Setup workflows in
other repositories. We expect to roll this and other, related changes
out to everyone in July. <a
href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li>
</ul>
<h2>4.37.1 - 16 Jul 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.20.6 and earlier. These versions of
CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise
Server 3.16, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li>
</ul>
<h2>4.37.0 - 08 Jul 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li>
<li>In addition to the existing input format, the
<code>config-file</code> input for the <code>codeql-action/init</code>
step will soon support a new <code>[owner/]repo[@ref][:path]</code>
format. All components except the repository name are optional. If
omitted, <code>owner</code> defaults to the same owner as the repository
the analysis is running for, <code>ref</code> to <code>main</code>, and
<code>path</code> to <code>.github/codeql-action.yaml</code>. Support
for this format ships in this version of the CodeQL Action, but will
only be enabled over the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li>
</ul>
<h2>4.36.3 - 01 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.36.2 - 04 Jun 2026</h2>
<ul>
<li>Cache CodeQL CLI version information across Actions steps. <a
href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li>
<li>Reduce requests while waiting for analysis processing by using
exponential backoff when polling SARIF processing status. <a
href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li>
</ul>
<h2>4.36.1 - 02 Jun 2026</h2>
<p>No user facing changes.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81"><code>e4fba86</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4031">#4031</a>
from github/update-v4.37.3-72f6a9da0</li>
<li><a
href="https://github.com/github/codeql-action/commit/fb50ab5d62a274adf3ef3e22cfe750ae87a0ede7"><code>fb50ab5</code></a>
Update changelog for v4.37.3</li>
<li><a
href="https://github.com/github/codeql-action/commit/72f6a9da0def52d9193d6a758f0378b65091f8d1"><code>72f6a9d</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4030">#4030</a>
from github/mbg/fix/no-proxy</li>
<li><a
href="https://github.com/github/codeql-action/commit/3b5ee58597653d9cc6785f3f1277f796d81f3646"><code>3b5ee58</code></a>
Use default <code>request</code> options instead of
<code>undefined</code></li>
<li><a
href="https://github.com/github/codeql-action/commit/bfb6be4b5ecd3650f02f530571453e8c64ef0778"><code>bfb6be4</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4028">#4028</a>
from github/mergeback/v4.37.2-to-main-e0647621</li>
<li><a
href="https://github.com/github/codeql-action/commit/526ab84f9858816d9cf5f7b9df4dd5e2235f0eba"><code>526ab84</code></a>
Rebuild</li>
<li><a
href="https://github.com/github/codeql-action/commit/d6217b9b8c14166e4851db94c11155d03bd13c07"><code>d6217b9</code></a>
Update changelog and version after v4.37.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/e0647621c2984b5ed2f768cb892365bf2a616ad1"><code>e064762</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4027">#4027</a>
from github/update-v4.37.2-385bcdc5a</li>
<li><a
href="https://github.com/github/codeql-action/commit/e0faed839190caa67a5cd42f1cc16246028ca3df"><code>e0faed8</code></a>
Add a couple of change notes</li>
<li><a
href="https://github.com/github/codeql-action/commit/73aad0eaa9df172668665a150d17b8bc5a650c20"><code>73aad0e</code></a>
Update changelog for v4.37.2</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action/analyze` from 4.37.0 to 4.37.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/analyze's
releases</a>.</em></p>
<blockquote>
<h2>v4.37.3</h2>
<p>No user facing changes.</p>
<h2>v4.37.2</h2>
<ul>
<li>The new address format for the <code>config-file</code> input that
was introduced in CodeQL Action 4.37.0 is now enabled by default. In
addition to the format described there, the <code>remote=</code> prefix
can now be used to explicitly indicate that the input refers to a remote
file. All previous input formats continue to be accepted as well. <a
href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li>
<li>The CodeQL Action can now make use of <a
href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured
private registries</a> in Default Setup to retrieve CodeQL configuration
files from remote repositories that require authentication. This will
allow customers to store their CodeQL configuration in a single
repository that can then be referenced by Default Setup workflows in
other repositories. We expect to roll this and other, related changes
out to everyone in July. <a
href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li>
</ul>
<h2>v4.37.1</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.20.6 and earlier. These versions of
CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise
Server 3.16, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/analyze's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.37.5 - 03 Aug 2026</h2>
<ul>
<li>Fixed a bug where a network error while streaming the download of
the CodeQL bundle could terminate the <code>init</code> Action instead
of falling back to downloading the bundle before extracting it. <a
href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li>
</ul>
<h2>4.37.4 - 29 Jul 2026</h2>
<ul>
<li>This version of the CodeQL Action adds support for the
<code>tools</code> input for the <code>codeql-action/init</code> step to
be specified using a <code>github-codeql-tools</code> <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository
property</a>. This feature will gradually be rolled out following the
release of this version. Once rolled out, this allows for the CodeQL CLI
version that is used in GitHub-managed workflows, such as Default Setup,
to be set to a custom value. For example, customers who run into issues
with rate limits when a new CodeQL CLI version is released can set the
value to <code>toolcache</code> to always use the CodeQL CLI version
that is available in the runner toolcache. For Advanced Setup workflows,
the value provided for <code>tools</code> in the workflow definition
always takes precedence unless the value of the repository property
starts with <code>!</code>. <a
href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li>
</ul>
<h2>4.37.3 - 22 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.2 - 21 Jul 2026</h2>
<ul>
<li>The new address format for the <code>config-file</code> input that
was introduced in CodeQL Action 4.37.0 is now enabled by default. In
addition to the format described there, the <code>remote=</code> prefix
can now be used to explicitly indicate that the input refers to a remote
file. All previous input formats continue to be accepted as well. <a
href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li>
<li>The CodeQL Action can now make use of <a
href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured
private registries</a> in Default Setup to retrieve CodeQL configuration
files from remote repositories that require authentication. This will
allow customers to store their CodeQL configuration in a single
repository that can then be referenced by Default Setup workflows in
other repositories. We expect to roll this and other, related changes
out to everyone in July. <a
href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li>
</ul>
<h2>4.37.1 - 16 Jul 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.20.6 and earlier. These versions of
CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise
Server 3.16, and will be unsupported by the next minor release of the
CodeQL Action. <a href="https://redirect.github.com/github/co...

_Description has been truncated_

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-04 11:24:49 +00:00
dependabot[bot] f4ad3549bc chore: bump github.com/open-policy-agent/opa from 1.18.1 to 1.19.0 (#27832) 
Bumps
[github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa)
from 1.18.1 to 1.19.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/open-policy-agent/opa/releases">github.com/open-policy-agent/opa's
releases</a>.</em></p>
<blockquote>
<h2>v1.19.0</h2>
<p>This release contains a mix of new features and bug fixes.
Notably:</p>
<ul>
<li>A fixed SQL injection vector in the Compile API</li>
<li>Stricter safety checking for Rego assignments (<code>:=</code>)</li>
<li>A cgo-free, faster WebAssembly runtime (wazero replaces
wasmtime-go)</li>
<li>Startup warnings for unknown configuration options</li>
<li>A new <code>strings.split_n</code> built-in function</li>
<li>A REPL line reader that handles pasted input correctly, migrating
existing history files</li>
</ul>
<h3>Fix SQL injection vector in Compile API: Quote SQL filter field
identifiers (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8945">#8945</a>)</h3>
<p>The field names in the SQL emitted by the Compile API come from
partially evaluated refs, so a
policy that selects a dynamic key — such as
<code>input.fruits[input.column]</code> — puts caller-controlled
text in an identifier position. That text was emitted verbatim, which
turns</p>
<pre lang="sql"><code>WHERE fruit.name = 'allowed'
</code></pre>
<p>into</p>
<pre lang="sql"><code>WHERE fruit.name = 'allowed' OR 1=1 -- = 'allowed'
</code></pre>
<p>and an application appending the filter to its query returns rows the
policy denies.</p>
<p>Field segments that are not bare identifiers are now quoted at the
UCAST-to-SQL boundary, with any
embedded quote character escaped. Ordinary column names stay unquoted,
so existing filters keep
their current shape and remain case-insensitive on Postgres.</p>
<p>Authored by <a
href="https://github.com/thevilledev"><code>@​thevilledev</code></a></p>
<h3>Behavior change: stricter safety for assignment (<code>:=</code>)
(<a
href="https://redirect.github.com/open-policy-agent/opa/issues/3546">#3546</a>)</h3>
<p>The assignment operator (<code>:=</code>) is documented as
&quot;syntactic sugar for <code>=</code>, local variable creation,
and additional compiler checks,&quot; and the safety checker reflects
that: after
rewriting, <code>:=</code> is treated identically to <code>=</code>
(unification), so an assignment's
right-hand side can be made safe by unifying &quot;backwards&quot;
through the left-hand
side. This means policies like <code>x := y; x = 7</code> compile
(binding <code>y</code> to <code>7</code>)
even though <code>y</code> is never assigned, and <code>x := y;
obj[x]</code> can silently degrade an
expected constant-time lookup into full iteration.</p>
<p>This change makes the right-hand-side of <code>:=</code> be treated
as a read that
must be made safe by other expressions, and can no longer be satisfied
through
the left-hand-side. Affected policies that previously compiled now fail
with a
<code>rego_unsafe_var_error</code>. Reference iteration on the
right-hand-side (e.g.
<code>some k; v := obj[k]</code>) is unaffected.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md">github.com/open-policy-agent/opa's
changelog</a>.</em></p>
<blockquote>
<h2>1.19.0</h2>
<p>This release contains a mix of new features and bug fixes.
Notably:</p>
<ul>
<li>A fixed SQL injection vector in the Compile API</li>
<li>Stricter safety checking for Rego assignments (<code>:=</code>)</li>
<li>A cgo-free, faster WebAssembly runtime (wazero replaces
wasmtime-go)</li>
<li>Startup warnings for unknown configuration options</li>
<li>A new <code>strings.split_n</code> built-in function</li>
<li>A REPL line reader that handles pasted input correctly, migrating
existing history files</li>
</ul>
<h3>Fix SQL injection vector in Compile API: Quote SQL filter field
identifiers (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8945">#8945</a>)</h3>
<p>The field names in the SQL emitted by the Compile API come from
partially evaluated refs, so a
policy that selects a dynamic key — such as
<code>input.fruits[input.column]</code> — puts caller-controlled
text in an identifier position. That text was emitted verbatim, which
turns</p>
<pre lang="sql"><code>WHERE fruit.name = 'allowed'
</code></pre>
<p>into</p>
<pre lang="sql"><code>WHERE fruit.name = 'allowed' OR 1=1 -- = 'allowed'
</code></pre>
<p>and an application appending the filter to its query returns rows the
policy denies.</p>
<p>Field segments that are not bare identifiers are now quoted at the
UCAST-to-SQL boundary, with any
embedded quote character escaped. Ordinary column names stay unquoted,
so existing filters keep
their current shape and remain case-insensitive on Postgres.</p>
<p>Authored by <a
href="https://github.com/thevilledev"><code>@​thevilledev</code></a></p>
<h3>Behavior change: stricter safety for assignment (<code>:=</code>)
(<a
href="https://redirect.github.com/open-policy-agent/opa/issues/3546">#3546</a>)</h3>
<p>The assignment operator (<code>:=</code>) is documented as
&quot;syntactic sugar for <code>=</code>, local variable creation,
and additional compiler checks,&quot; and the safety checker reflects
that: after
rewriting, <code>:=</code> is treated identically to <code>=</code>
(unification), so an assignment's
right-hand side can be made safe by unifying &quot;backwards&quot;
through the left-hand
side. This means policies like <code>x := y; x = 7</code> compile
(binding <code>y</code> to <code>7</code>)
even though <code>y</code> is never assigned, and <code>x := y;
obj[x]</code> can silently degrade an
expected constant-time lookup into full iteration.</p>
<p>This change makes the right-hand-side of <code>:=</code> be treated
as a read that
must be made safe by other expressions, and can no longer be satisfied
through
the left-hand-side. Affected policies that previously compiled now fail
with a
<code>rego_unsafe_var_error</code>. Reference iteration on the
right-hand-side (e.g.
<code>some k; v := obj[k]</code>) is unaffected.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/open-policy-agent/opa/commit/1e32c796e8979b1bda2f768138500b1deb95ff24"><code>1e32c79</code></a>
Prepare v1.19.0 release (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8955">#8955</a>)</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/db035b09fc8b4b7f1b37558c4fde033209e17cc8"><code>db035b0</code></a>
Add support for Go 1.27 &amp; jsonv2 (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8947">#8947</a>)</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/27fe5ceac871d020e10dd4a92d4eb6fa7070400a"><code>27fe5ce</code></a>
ast: Fix leaky <code>future.keywords.not</code> import in Rego v0 (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8953">#8953</a>)</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/ab2187089a8dea0d7f1ea611fe8f62db874498b7"><code>ab21870</code></a>
format: Keep rule body inline when the head spans multiple lines (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8904">#8904</a>)</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/95090fa4eb7a8afe2d7a08742086be0344e9e065"><code>95090fa</code></a>
Add strings.split_n built-in function (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8915">#8915</a>)</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/12a86ed2a70384eb24754d7be115c90f98736011"><code>12a86ed</code></a>
build(deps): bump find-my-way and prisma in /e2e/api/compile/prisma</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/18815e2b02711650be1c55148e67de5b4e614a6f"><code>18815e2</code></a>
build(deps): bump the dependencies group across 2 directories with 5
updates</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/f1e2ac07e4ad18be65495451ba648a85af0e583b"><code>f1e2ac0</code></a>
build(deps): bump postcss from 8.5.15 to 8.5.23 in /docs</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/d9c7856eaea45ed0ee8c3709d8ef0151b17ba43c"><code>d9c7856</code></a>
build(deps): bump js-yaml from 5.2.1 to 5.2.2 in /docs</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/69d2cc04a0de02892e4bad95cc416b9baa9a0b3b"><code>69d2cc0</code></a>
tester: make Result JSON round-trippable (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8946">#8946</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-policy-agent/opa/compare/v1.18.1...v1.19.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/open-policy-agent/opa&package-manager=go_modules&previous-version=1.18.1&new-version=1.19.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-04 11:19:39 +00:00
dependabot[bot] f483e89062 chore: bump google.golang.org/api from 0.290.0 to 0.291.0 (#27834) 
Bumps
[google.golang.org/api](https://github.com/googleapis/google-api-go-client)
from 0.290.0 to 0.291.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's
releases</a>.</em></p>
<blockquote>
<h2>v0.291.0</h2>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.290.0...v0.291.0">0.291.0</a>
(2026-07-28)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3666">#3666</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/e3721ba5d733583d6999df8e179fd7c9d891c0a9">e3721ba</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3670">#3670</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/40673741ea906e5313a602459110dcfb17a54f7d">4067374</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3674">#3674</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/432658c5a9051b867b016979d6d948cdae99a401">432658c</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3676">#3676</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/9998a114c63f1c113fb627e30597b02dee6301d5">9998a11</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3678">#3678</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/b5c5526a1d862e21cf126b2287490e63ac52ee2c">b5c5526</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3679">#3679</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/499d9b17067ababff6992f1a0c50f8de794cff45">499d9b1</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>transport:</strong> Use ds.GetUniverseDomain() instead of
raw ds.UniverseDomain field (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3660">#3660</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/6bad35801f85c9915d8ad7635225a2b94e27082c">6bad358</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.290.0...v0.291.0">0.291.0</a>
(2026-07-28)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3666">#3666</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/e3721ba5d733583d6999df8e179fd7c9d891c0a9">e3721ba</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3670">#3670</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/40673741ea906e5313a602459110dcfb17a54f7d">4067374</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3674">#3674</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/432658c5a9051b867b016979d6d948cdae99a401">432658c</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3676">#3676</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/9998a114c63f1c113fb627e30597b02dee6301d5">9998a11</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3678">#3678</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/b5c5526a1d862e21cf126b2287490e63ac52ee2c">b5c5526</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3679">#3679</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/499d9b17067ababff6992f1a0c50f8de794cff45">499d9b1</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>transport:</strong> Use ds.GetUniverseDomain() instead of
raw ds.UniverseDomain field (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3660">#3660</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/6bad35801f85c9915d8ad7635225a2b94e27082c">6bad358</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/ed60cb7d6d725a32ae5cf00674b8647a5201a461"><code>ed60cb7</code></a>
chore(main): release 0.291.0 (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3669">#3669</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/90fe3d7d729c8ed02316aa1c673672aadc574e62"><code>90fe3d7</code></a>
revert change to TestNewClient (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3680">#3680</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/499d9b17067ababff6992f1a0c50f8de794cff45"><code>499d9b1</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3679">#3679</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/452691c14c509600ef60c5dff4c1b4fd4ef79f4b"><code>452691c</code></a>
chore(all): update all (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3677">#3677</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/b5c5526a1d862e21cf126b2287490e63ac52ee2c"><code>b5c5526</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3678">#3678</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/9998a114c63f1c113fb627e30597b02dee6301d5"><code>9998a11</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3676">#3676</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/432658c5a9051b867b016979d6d948cdae99a401"><code>432658c</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3674">#3674</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/40673741ea906e5313a602459110dcfb17a54f7d"><code>4067374</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3670">#3670</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/6bad35801f85c9915d8ad7635225a2b94e27082c"><code>6bad358</code></a>
fix(transport): use ds.GetUniverseDomain() instead of raw
ds.UniverseDomain f...</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/e3721ba5d733583d6999df8e179fd7c9d891c0a9"><code>e3721ba</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3666">#3666</a>)</li>
<li>See full diff in <a
href="https://github.com/googleapis/google-api-go-client/compare/v0.290.0...v0.291.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/api&package-manager=go_modules&previous-version=0.290.0&new-version=0.291.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-04 11:18:39 +00:00
dependabot[bot] f5e0519180 chore: bump github.com/aws/aws-sdk-go-v2/service/sts from 1.44.0 to 1.45.3 (#27831) 
Bumps
[github.com/aws/aws-sdk-go-v2/service/sts](https://github.com/aws/aws-sdk-go-v2)
from 1.44.0 to 1.45.3.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/4aeeb0d7a4293f0b31c2e0be83e65da6f7fd4ae2"><code>4aeeb0d</code></a>
Release 2023-11-28.2</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/e09e153704d4da6ae2bb0ae3875058950d31206b"><code>e09e153</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/8293e2ca285a7333a9931a0a3b37b2bcf7cdc05d"><code>8293e2c</code></a>
Update endpoints model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/713fb0f31a188015915d785556ebf16ddb08085a"><code>713fb0f</code></a>
Update API model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/830202d722c904c7e3da40e8dde7b9338d08752c"><code>830202d</code></a>
Merge customizations for service s3</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/2de0027dc478a6ae80e9f2d24d904a425169a23b"><code>2de0027</code></a>
Release 2023-11-28</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/f0c890c5eaf354ff23feb727ded9f50aaee9f1c4"><code>f0c890c</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/e032d9ea8d98d366f2467a72834d2cc0ee865edd"><code>e032d9e</code></a>
Update endpoints model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/507661ff1edbc896fbdfe3ea2e4c2e74be3b4e3c"><code>507661f</code></a>
Update API model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/4128360684a451476e33c0f979921bc46ff63656"><code>4128360</code></a>
fix: respect functional option modifications to RetryMaxAttempts (<a
href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/2390">#2390</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/aws/aws-sdk-go-v2/compare/service/s3/v1.44.0...service/iot/v1.45.3">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/aws/aws-sdk-go-v2/service/sts&package-manager=go_modules&previous-version=1.44.0&new-version=1.45.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-04 11:18:08 +00:00
Marcin Tojek 11b38272f6 chore(docs): update release docs for v2.36.0 (#27828) 
Automated docs update for v2.36.0 release.

Created by `releasetui`.
 2026-08-04 12:54:59 +02:00
Michael Suchacz 6b8f820493 feat: remove native chat cost tracking in favor of AI Gateway cost data (#27330) 
## Stack Context

This stack makes AI Gateway data and budgets the source of truth for AI
spend controls.

1. Re-back the per-chat cost endpoint with AI Gateway data (#27328,
merged).
2. Remove native chat usage limits (#27329, merged).
3. **This PR, now based on `main`:** remove native chat cost tracking
and its dedicated admin UI.

## Summary

Removes native per-message price calculation, model pricing fields, cost
persistence, aggregate cost queries, and admin cost API types. It also
deletes the Analytics and Spend pages plus their legacy redirects. The
AI Gateway-backed per-chat cost row and compact budget indicators
remain.

The spend documentation is renamed to `spend-management.md` and updated
for the remaining surfaces, group budget APIs, CSV export, upgrade
handling for native pricing and cost history, and the absence of a
deployment-wide spend dashboard. The per-chat cost API documents that
data follows AI Gateway retention and reports zero after all matching
requests are purged.

No schema is dropped in this release. `chat_messages.total_cost_micros`
remains nullable and unwritten so replicas from the previous release can
continue inserting messages during rolling upgrades. #27600 tracks
removal after the compatibility window.

> Mux prepared this PR on Mike's behalf.
 2026-08-04 12:27:38 +02:00
Paweł BanaszewskiandCian Johnston 0b8b48913f fix: fix port assignment race from aigatewaystart_internal_test (#27801) 
The AI Gateway tests reserved a port with `testutil.RandomPort`, which
binds and closes `127.0.0.1:0`, then bound it later in `serve`.
If something took the port in between, `serve` failed at `net.Listen`
and the error went unread, leaving only a 10s `Eventually` timeout.

The gateway now exposes its bound address via `httpAddr` and a
`listenerReady` latch, so tests listen on port 0 and read the address
afterwards. `requireListening` reports `serve`'s error where an address
must still be fixed upfront.

---
Investigated and authored with Coder Agents.

---------

Co-authored-by: Cian Johnston <cian@coder.com>
 2026-08-04 09:51:14 +00:00
Michael Suchacz f0e6ac64b3 feat: remove native chat usage limits in favor of AI Gateway budgets (#27329) 
## Stack Context

This stack makes AI Gateway data and budgets the source of truth for AI
spend controls.

1. Re-back the per-chat cost endpoint with AI Gateway data (#27328,
merged).
2. **This PR:** remove native chat usage limits.
3. Remove native chat cost tracking and its dedicated admin UI (#27330).

## Summary

Removes the native usage-limit API, SDK types, SQL, and chat enforcement
for deployment, user, and group chat limits. Compact AI Gateway budget
indicators remain in the Agents sidebar, user menu, and group settings.
Gateway budget rejections and provider quota failures continue to
classify as usage-limit errors, including a 409 response for synchronous
title generation.

Budget-period labels now use the API's UTC boundaries, so users see the
same dates in every browser timezone. The documentation explains the AI
Gateway replacement, its licensing requirements, and the differences
from native limits.

No schema is dropped in this release. The usage-limit table, index, user
and group columns, constraints, audit mappings, and generated scan
fields remain for mixed-version rolling upgrades. #27600 tracks their
removal after the compatibility window.

## Breaking change

Native day, week, and month chat spend limits are removed and are not
migrated. AI Gateway budgets are month-based, group-scoped with per-user
overrides, and require the AI Gateway entitlement. Deployments without
that entitlement no longer have chat spend enforcement.

> Mux prepared this PR on Mike's behalf.
 2026-08-04 11:36:49 +02:00
Paweł Banaszewski a2287d6739 chore: fix port availability check flake from aigatewaystart_internal… (#27784) 
Extends state tracking in `standaloneGateway` which is used in tests to
simplify checks.
Flaky `requireListenerAvailable` was removed.
 2026-08-04 11:33:34 +02:00
Michael Suchacz 404bb2f663 refactor(coderd/x/chatd): own provider option construction in one function (#27705) 
Stacked on #27704.

Provider option conversion and reasoning effort injection both create
OpenAI option structs, so each of the four call sites had to pair them
in the right order and pick the same transport for each.

`chatprovider.ProviderOptionsForCall` now owns both steps, and the two
helpers it wraps are unexported. The advisor, main generation,
compaction override, and quickgen paths each collapse to one call.

The ARCHITECTURE section on transport selection is updated to match:
`ProviderOptionsForCall` is described as the only entry point in
`chatprovider` that builds provider options for a call, delegating
OpenAI conversion to `chatopenai.ProviderOptionsFromChatConfig`, and it
now records that the quickgen turn status label and chat summary paths
deliberately send no provider options.

> Mux prepared this PR on Mike's behalf.
 2026-08-04 08:13:00 +00:00
Michael Suchacz 0e16e356b0 refactor(coderd/x/chatd): read the OpenAI transport from the model (#27704) 
Stacked on #27703.

Provider option conversion, reasoning effort injection, and file part
acceptance each recomputed the OpenAI wire format from `(provider,
modelID, override)`. They now read it from `chatprovider.Model`, so a
decision cannot drift from the client it was built for.

`ProviderOptionsFromChatConfig` takes a `Transport`,
`ApplyReasoningEffort` takes a `Model`, and `AcceptsFilePartMediaType`
becomes a `Model` method. `UsesResponsesAPI` and `UsesResponsesOptions`
are deleted. The override extraction is unexported and reachable only
from `ModelFromConfig`, which now takes the model's
`ChatModelOpenAIConfig` directly, removing the six scattered extractions
at call sites.

That also resolves the computer-use mismatch. The computer-use model is
a hardcoded default with no config row of its own: its client was built
without an override while request preparation applied the chat model's.
Preparation now reads the computer-use model's own transport, so the two
agree without one model's client settings following a different model.
Passing the chat model's `openai_config` into the computer-use client
would have made them agree on the wrong value.

`TestModelTransportConsumersAgree` pins the invariant in one test: the
HTTP path the client actually hits, the concrete provider option struct
type, the type created by reasoning effort, and text/image file
acceptance.

> Mux prepared this PR on Mike's behalf.
 2026-08-04 08:00:19 +00:00
Michael Suchacz b5c9e8e471 refactor(coderd/x/chatd): carry the resolved OpenAI transport on a model wrapper (#27703) 
Stacked on #27683.

The OpenAI wire format is decided when the client is built, then thrown
away, so downstream sites recompute it from `(provider, modelID,
override)`. Any disagreement fails silently: the SDK type-asserts the
concrete provider options struct and discards every OpenAI option, and
text attachments are dropped because Responses natively accepts only
images and PDFs.

This adds `chatprovider.Model`, which pairs a fantasy client with the
transport resolved from that client's own identity. Its fields are
unexported and only the constructor sets the transport, deriving it from
the client, so no caller can pick a transport that disagrees with the
client it wraps. `chatopenai.Transport`'s zero value is invalid and
panics when read rather than defaulting to a wire format, following the
existing precedent for construction invariants.

`Model` is threaded through construction, the resolve paths, and the
four struct fields that store a model for later request preparation.
Terminal call sites keep taking `fantasy.LanguageModel` and receive
`LanguageModel()`, which avoids a new package edge from `chatloop` and
`chatadvisor` into `chatprovider`.

No decisions move yet. The consumers still recompute the transport, and
`UsesResponsesAPI` now delegates to `TransportFor` so the two agree by
construction. #27704 makes the consumers read it from the model.

> Mux prepared this PR on Mike's behalf.
 2026-08-04 07:46:32 +00:00
Michael Suchacz c6cee10e8b feat: add per-model OpenAI Responses API toggle (#27683) 
chatd hardcoded `WithUseResponsesAPI()`, so the provider SDK's static
known-model list decided whether an OpenAI model spoke the Responses API
or Chat Completions. A model absent from that list silently fell back to
Chat Completions until the fantasy fork was patched.

This exposes the SDK's `WithResponsesAPIFunc` hook as a per-model
setting, `openai_config.use_responses_api`, stored in the existing
`chat_model_configs.options` JSONB. Unset keeps the known-model list,
`true` forces Responses, `false` forces Chat Completions. There is no
migration.

It sits in a new construction-time `openai_config` section rather than
in `provider_options.openai` because it selects the API when the client
is built, while `provider_options` holds per-request parameters. That
placement is also load-bearing: a config setting only this field would
otherwise materialize an OpenAI request-options struct and turn on
provider-side response storage, since `Store` defaults to true there.

Three places independently decided the transport and would silently
disagree with the client actually built:

| Site | Effect when it disagrees |
| --- | --- |
| `ModelFromConfig` | the transport being overridden |
| `AcceptsFilePartMediaType` | text attachments dropped, since Responses
natively accepts only images and PDFs |
| `UsesResponsesOptions` | the SDK type-asserts the concrete options
struct, so every OpenAI option is discarded |

They share one predicate here, `chatopenai.UsesResponsesAPI`, with the
override threaded to each. The rest of the stack removes that threading
by resolving the transport once and carrying it. Compaction overrides
and the quickgen debug model built clients without `ConfigOptions`, so
they now pass it and pick up both this setting and the existing
Anthropic beta headers.

The toggle also makes transport-conditional option handling
admin-switchable, so two hardening changes ride along.
`ServiceTierFromChat` now maps every tier the codersdk enum advertises
(`auto`, `default`, `flex`, `scale`, `priority`); it previously returned
nil for `default` and `scale`, so flipping a model to Responses silently
dropped a configured `service_tier` that the API accepts (fantasy
forwards the value unchanged). And a new
`TestProviderOptionsTransportParity` pins, per `provider_options.openai`
field, which transport honors it, against a table in ARCHITECTURE.md, so
a field honored on one transport and silently ignored on the other fails
the test unless recorded as intentional.

Review rounds also caught two lifecycle gaps around the new field.
`isZeroChatModelCallConfig` now inspects `OpenAIConfig`, so a stored
options blob whose only setting is this toggle survives into GET/list
responses instead of reading as `model_config: null`;
`TestIsZeroChatModelCallConfigCoversEveryField` sets each config field
in isolation and fails if any field is invisible to the zero check. And
the model editor's update path sends an explicit empty `model_config`
when an edit clears the last field, since an omitted property preserves
the stored options server-side; covered by the
`EditClearingLastOptionSendsEmptyConfig` story.

Azure keeps following the known-model list, because the Azure provider
exposes no equivalent hook. The model editor renders Azure with the
OpenAI option schema, so instead of shipping a visible but inert
control, the option schema generator gains a `providers` struct tag that
it emits as `visible_for_providers`. Gating uses the raw provider type
rather than the alias table, so the control appears only for
openai-typed providers. No hand-written frontend field: the editor
renders it from the generated schema.

Closes
https://linear.app/codercom/issue/CODAGT-874/add-completionsresponses-api-toggle-in-model-editor

> Mux prepared this PR on Mike's behalf.
 2026-08-04 09:30:27 +02:00
blinkagent[bot]andblink-so[bot] 84cdc17602 docs: bump AI Gateway client modules to latest and remove Coder Tasks refs (#27810) 
Updates the AI Gateway client docs under
`docs/ai-coder/ai-gateway/clients/` to reference the latest module
versions on registry.coder.com and removes mentions of Coder Tasks from
those pages.

Uses pessimistic (`~>`) version constraints so users automatically pick
up compatible non-breaking updates within the same major.

### Version bumps

| Module | Old | New |
|---|---|---|
|
[`coder/claude-code`](https://registry.coder.com/modules/coder/claude-code)
| `4.7.3` | `~> 5.2` (latest `5.2.0`) |
|
[`coder-labs/codex`](https://registry.coder.com/modules/coder-labs/codex)
| `~> 5.0` | `~> 5.3` (latest `5.3.0`) |
| [`coder/mux`](https://registry.coder.com/modules/coder/mux) | `~> 1.0`
| `~> 1.5` (latest `1.5.0`) |

### Coder Tasks removal

- `claude-code.md`: removed the *Coder Tasks* example block (v5 of the
module is a major refactor that dropped the `ai_prompt` input and
`task_app_id` output).
- Remaining inputs in the example (`agent_id`, `workdir`,
`enable_ai_gateway`) still match the latest module.
- `codex.md` and `mux.md` did not reference Tasks, so only version bumps
were needed there.

cc @matifali

---------

Co-authored-by: blink-so[bot] <211532188+blink-so[bot]@users.noreply.github.com>
 2026-08-04 12:09:23 +05:00
Michael Suchacz 9bab7a8e06 fix(coderd): preseed AI providers for title tests (#27564) 2026-08-04 08:55:03 +02:00
Sas SwartandClaude Opus 4.8 a60f393773 feat(site): show network calls list on AI session detail (#27426) 
Renders the per-call network calls as a collapsible panel above the
session threads, using the `network_call_logs` field added to the
threads API.

Each row shows the request method, allowed/blocked status, URL, and
timestamp, and expands to show the protocol, matched rule, and full
detail. The header shows the total count and a blocked-count badge from
the session summary; when the server caps the list, the panel notes how
many calls are shown. The panel is omitted when the session did not pass
through Agent Firewall.

### PR map (merge strictly bottom-up)

This change is a 4-PR stack. Each PR depends on all the ones below it,
so merge in this exact order:

1. #27417 — backend network summary (base `main`)
2. #27418 — frontend summary rows (base #27417)
3. #27425 — backend per-call list `network_call_logs` (base #27418)
4. #27426 — frontend network-calls panel (base #27425)

Refs AIGOV-464

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-08-04 08:30:09 +02:00
Ethan a779320d87 feat(scaletest): llm-mock tool calls and paced streaming (#26850) 
`coder exp scaletest llm-mock` used to return only canned text, so Coder
Agents scaletests pointed at it never exercised the path that matters
most: the agentic tool-call loop where the model asks for a tool, the
workspace runs it, the result is fed back, and the model is re-prompted
before it finally answers. This teaches the mock to reproduce that loop
deterministically so scaletests actually drive real tool execution and
hold streams open the way a live model would.

It adds `--tool-calls-per-turn` and `--tool-call-command` so the OpenAI
Chat Completions endpoint emits a controllable number of `execute` tool
calls per turn (only when the request advertises an `execute` tool,
otherwise it falls back to text, so it stays a safe drop-in). It also
adds paced streaming with
`--min-stream-duration`/`--max-stream-duration` (randomized per
response) and `--response-payload-size`, so runs can simulate slow or
long-lived responses instead of flushing everything at once.

Closes CODAGT-307

Closes GRU-48
 2026-08-04 16:24:14 +10:00
Ethan 1f946bb50b ci(.github): retry Go module downloads (#27816) 
Closes CODAGT-878
Closes https://github.com/coder/internal/issues/1621

The Go module proxy failure in the linked issue is outside our control,
but `lint` and `test-e2e` currently download modules during their `make`
targets without any retry. Other CI jobs already wrap `go mod download`
with `./.github/scripts/retry.sh`, so this just copies that precedent to
both affected jobs.
 2026-08-04 14:23:48 +10:00
Jake Howell cce5a21933 chore(site): remove unused SelectMenu component (#27800) 
`SelectMenu` was only referenced by its Storybook story. Nothing in the
app consumed it.

Delete the component and story so we drop the unused MUI `MenuItem` /
`MenuList` wrapper and avoid treating dead demui code as a shared
primitive.
 2026-08-04 13:22:52 +10:00
dependabot[bot] d899f02e42 chore: bump terraform-google-modules/container-vm/google from 3.2.0 to 3.3.0 in /examples/templates/gcp-vm-container (#27813) 
Bumps
[terraform-google-modules/container-vm/google](https://github.com/terraform-google-modules/terraform-google-container-vm)
from 3.2.0 to 3.3.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/terraform-google-modules/terraform-google-container-vm/releases">terraform-google-modules/container-vm/google's
releases</a>.</em></p>
<blockquote>
<h2>v3.3.0</h2>
<h2><a
href="https://github.com/terraform-google-modules/terraform-google-container-vm/compare/v3.2.0...v3.3.0">3.3.0</a>
(2026-03-06)</h2>
<h3>Features</h3>
<ul>
<li><strong>deps:</strong> Update Terraform Google Provider to v7
(major) (<a
href="https://redirect.github.com/terraform-google-modules/terraform-google-container-vm/issues/151">#151</a>)
(<a
href="https://github.com/terraform-google-modules/terraform-google-container-vm/commit/25aeb5e8eb9525fdac47cfeb79eb7b20295d9a10">25aeb5e</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>TF&gt;=1.3:</strong> Update cft/developer-tools Docker tag
to v1.25 (<a
href="https://redirect.github.com/terraform-google-modules/terraform-google-container-vm/issues/145">#145</a>)
(<a
href="https://github.com/terraform-google-modules/terraform-google-container-vm/commit/49bb1a86c908b8a626b78977d83b1c01f3b5e39b">49bb1a8</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/terraform-google-modules/terraform-google-container-vm/blob/main/CHANGELOG.md">terraform-google-modules/container-vm/google's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/terraform-google-modules/terraform-google-container-vm/compare/v3.2.0...v3.3.0">3.3.0</a>
(2026-03-06)</h2>
<h3>Features</h3>
<ul>
<li><strong>deps:</strong> Update Terraform Google Provider to v7
(major) (<a
href="https://redirect.github.com/terraform-google-modules/terraform-google-container-vm/issues/151">#151</a>)
(<a
href="https://github.com/terraform-google-modules/terraform-google-container-vm/commit/25aeb5e8eb9525fdac47cfeb79eb7b20295d9a10">25aeb5e</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>TF&gt;=1.3:</strong> Update cft/developer-tools Docker tag
to v1.25 (<a
href="https://redirect.github.com/terraform-google-modules/terraform-google-container-vm/issues/145">#145</a>)
(<a
href="https://github.com/terraform-google-modules/terraform-google-container-vm/commit/49bb1a86c908b8a626b78977d83b1c01f3b5e39b">49bb1a8</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/terraform-google-modules/terraform-google-container-vm/commit/ab943364f6add0de89de1d3c79ca23e6852e5a12"><code>ab94336</code></a>
chore(main): release 3.3.0 (<a
href="https://redirect.github.com/terraform-google-modules/terraform-google-container-vm/issues/152">#152</a>)</li>
<li><a
href="https://github.com/terraform-google-modules/terraform-google-container-vm/commit/10d2424042cc02a4d3efff00db9b33d7e48f4452"><code>10d2424</code></a>
chore: Migrate gsutil usage to gcloud storage (<a
href="https://redirect.github.com/terraform-google-modules/terraform-google-container-vm/issues/159">#159</a>)</li>
<li><a
href="https://github.com/terraform-google-modules/terraform-google-container-vm/commit/f15666132398848678ba5fd299d7ff36cb46be67"><code>f156661</code></a>
chore: update .github/workflows/lint.yaml</li>
<li><a
href="https://github.com/terraform-google-modules/terraform-google-container-vm/commit/1a9a202d61c2663333d943bc08badaef427aa2c4"><code>1a9a202</code></a>
chore: update .github/workflows/lint.yaml</li>
<li><a
href="https://github.com/terraform-google-modules/terraform-google-container-vm/commit/9c708636cc9655b257b374773ea0068813fb736c"><code>9c70863</code></a>
chore: update .github/workflows/stale.yml</li>
<li><a
href="https://github.com/terraform-google-modules/terraform-google-container-vm/commit/df594b380ee57cb246d02c188d0189ecdda04c0f"><code>df594b3</code></a>
chore: update .github/workflows/stale.yml</li>
<li><a
href="https://github.com/terraform-google-modules/terraform-google-container-vm/commit/83a8daf400c4980e28e800b2b28f0c9690ce962c"><code>83a8daf</code></a>
chore: update .github/workflows/lint.yaml</li>
<li><a
href="https://github.com/terraform-google-modules/terraform-google-container-vm/commit/ab4a4eb85321af9db8b0ebfd64d80925441c0931"><code>ab4a4eb</code></a>
chore: update .github/workflows/lint.yaml</li>
<li><a
href="https://github.com/terraform-google-modules/terraform-google-container-vm/commit/604cf93040d5cc3b5e671c6eff9b7e1db4c0d60b"><code>604cf93</code></a>
chore: update .github/workflows/lint.yaml</li>
<li><a
href="https://github.com/terraform-google-modules/terraform-google-container-vm/commit/4016c71b40be077379b38cf549c04382ceee3d82"><code>4016c71</code></a>
chore: update .github/workflows/lint.yaml</li>
<li>Additional commits viewable in <a
href="https://github.com/terraform-google-modules/terraform-google-container-vm/compare/v3.2.0...v3.3.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=terraform-google-modules/container-vm/google&package-manager=terraform&previous-version=3.2.0&new-version=3.3.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-04 00:34:28 +00:00
Steven Masley 52423eb87b feat: promote MinimumImplicitMember experiment to GA (#27472) 
Promotes the `minimum-implicit-member` experiment to GA and removes it.

## What changes

- The `minimum-implicit-member` experiment constant, its
`RoleOptions.MinimumImplicitMember` toggle, and the global
`rbac.MinimumImplicitMember()` accessor are deleted. The minimal-member
behavior is now the only behavior: `organization-member` and
`organization-service-account` carry only the floor (read-self records,
notifications, and similar) and grant **no workspace permissions**.
Workspace access lives exclusively on the
`organization-workspace-access` role.
- The experiment gate on customizing `default_org_member_roles` (`PATCH
/organizations/{org}`) is removed; the built-in-roles-only validation
remains.
- The dashboard's Default Roles section and the implied-roles display on
the members page are no longer experiment-gated.
- Admin docs: new "Default member roles" section in
`docs/admin/users/organizations.md`, cross-linked from
`groups-roles.md`.

## Why this is safe for existing deployments

Migration `000516` (shipped earlier) backfilled
`default_org_member_roles` with `['organization-workspace-access']` on
every organization. Members therefore keep exactly the effective
permissions they had with the experiment off; the workspace elevation
flows through the default role instead of being baked into
`organization-member`.

**Rollback caveat:** rolling back past this release restores the bundled
elevation, silently re-granting workspace access to members of
organizations that cleared their default roles.

## Review

Deep-review R1 findings are addressed in `chore: address deep-review
findings` (copy fixes, read-only Default Roles for viewers, removable
overlapping explicit grants, RBAC prose restoration, test
de-tautologizing, docs). Point-by-point disposition is in the PR
comments.

---

Generated by Coder Agents on behalf of @Emyrk.
 2026-08-03 15:56:56 -05:00
dylanhuff-at-coderandNick Vigilante fe4a73f8ab docs: note user secret target uniqueness and delivery boundary (#27532) 
Two gaps in the user secrets guide, both independent of any pending
secrets work.

## Changes

**Target uniqueness (`Update a secret`, `File secrets`).** The guide
teaches `coder secret update api-key --file ""` but never states that
env names and file paths are unique per user, so the conflict you get
when setting a target back has no explanation in the docs. The `File
secrets` paragraph also read as though duplicate file paths are
tolerated with a warning; an identical path is rejected outright, while
two *different* paths resolving to the same location are both accepted
and produce the agent warning. Both indexes are partial (`WHERE env_name
!= ''` / `WHERE file_path != ''`), so a cleared target really is
released for another secret to claim — now stated.

**Delivery boundary (`How your secrets reach a workspace`).** Coder
controls where a secret is delivered, not whether it is still valid.
Nothing done in Coder revokes a credential a workspace already received,
so an exposed credential is rotated at its source. This applies to
deletion as much as to clearing a target.

No new headings, no changes to the existing tables or callouts.

> This PR was generated by Coder Agents on behalf of
@dylanhuff-at-coder.

---------

Co-authored-by: Nick Vigilante <nickvigilante@users.noreply.github.com>
 2026-08-03 13:06:30 -07:00
Rowan SmithandAtif Ali f44e8c12d6 fix: support adding multiline secrets via the UI (#27253) 
**Summary**

Root cause (confirmed by reading SecretDialog.tsx): the Value field on
the User Secrets "Add secret"/"Edit secret" dialog was rendered as
<Input type="text">, a single-line HTML control, so pasting a multiline
kubeconfig/PEM/YAML got visually collapsed and the newlines were lost
before the value ever reached the form state or the API request.

Fix applied in
site/src/pages/UserSettingsPage/SecretsPage/SecretDialog.tsx:

* Swapped the Value field's <Input> for the same <Textarea> component
already used for the Description field (which correctly preserves
multiline text).
* Added rows={4} so the box is usable for multiline content, and
font-mono for readability of config-like values.
* Kept the "mask typed value" obscuring behavior but switched
-webkit-text-security:circle to :disc (Chromium's supported keyword for
<textarea>; circle is input-specific and silently no-ops on textareas).
* Removed the now-unused Input import.
* All existing onFocus/onChange/onBlur masking/saved-value logic was
preserved as-is; FormHelpers types already supported
HTMLTextAreaElement, so no type changes were needed.

Test fix in
site/src/pages/UserSettingsPage/SecretsPage/SecretsPageView.stories.tsx:
the EditSecretClearValue story's toBeVisible() assertion on the helper
text was racing the render/layout commit (this test already used a
waitFor for an analogous transient-visibility check on the neighboring
Clear button). The taller textarea shifted that timing enough to expose
the race consistently when run as part of the full suite. Wrapped the
assertion in waitFor(...) to match the existing pattern.

*Created with the help of Mux and Sonnet, tested by a human*

Working with a secret file like this:
```
➜  Downloads cat ~/.kube/config
apiVersion: v1
clusters:
  - cluster:
        certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJkakNDQVIyZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWpNU0V3SHdZRFZRUUREQmhyTTNNdGMyVnkKZG1WeUxXTmhRREUzTWpBNU16VTFOelV3SGhjTk1qUXdOekUwTURVek9UTTFXaGNOTXpRd056RXlNRFV6T1RNMQpXakFqTVNFd0h3WURWUVFEREJock0zTXRjMlZ5ZG1WeUxXTmhRREUzTWpBNU16VTFOelV3V1RBVEJnY3Foa2pPClBRSUJCZ2dxaGtqT1BRTUJCd05DQUFTK1JRaUlLa0RVV0tKR0Y0ZFdnbWZSVTA1Wjg1ellQSWt6aWlHUXdBZ1gKMXdyQThhNVRRbzVuYlJmeWxRQXZtZDB1SE04a05GTmZIYXJwc3lxZkZyS0dvMEl3UURBT0JnTlZIUThCQWY4RQpCQU1DQXFRd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVTBmUHdjMWpnd1BraFN2Q0cwbjQ1CnZTV09ES1V3Q2dZSUtvWkl6ajBFQXdJRFJ3QXdSQUlnQ3RCRm5KR0VJVVRSZ1RRaXZFSWJIODVwQnlMdmx1RjMKQ2ZTRFhDc3hlaWtDSUF4a0JKWnJ2eUUzQzNWRWdVT0t2d2VzVUN4cFBOendpbkg5Qkd4TXJuTk4KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
        server: https://192.168.50.23:6443
    name: k3s-3-pi
```

Created via the UI in 2.35.1:
```
coder_dev=> select * from user_secrets;
-[ RECORD 1 ]+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
id           | 12853b89-a56b-408a-a9b0-11591ed04898
user_id      | 2702b6f3-b094-47ee-975e-47dc7887dbed
name         | kubeconfig
description  |
value        | apiVersion: v1 clusters:   - cluster:         certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJkakNDQVIyZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWpNU0V3SHdZRFZRUUREQmhyTTNNdGMyVnkKZG1WeUxXTmhRREUzTWpBNU16VTFOelV3SGhjTk1qUXdOekUwTURVek9UTTFXaGNOTXpRd056RXlNRFV6T1RNMQpXakFqTVNFd0h3WURWUVFEREJock0zTXRjMlZ5ZG1WeUxXTmhRREUzTWpBNU16VTFOelV3V1RBVEJnY3Foa2pPClBRSUJCZ2dxaGtqT1BRTUJCd05DQUFTK1JRaUlLa0RVV0tKR0Y0ZFdnbWZSVTA1Wjg1ellQSWt6aWlHUXdBZ1gKMXdyQThhNVRRbzVuYlJmeWxRQXZtZDB1SE04a05GTmZIYXJwc3lxZkZyS0dvMEl3UURBT0JnTlZIUThCQWY4RQpCQU1DQXFRd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVTBmUHdjMWpnd1BraFN2Q0cwbjQ1CnZTV09ES1V3Q2dZSUtvWkl6ajBFQXdJRFJ3QXdSQUlnQ3RCRm5KR0VJVVRSZ1RRaXZFSWJIODVwQnlMdmx1RjMKQ2ZTRFhDc3hlaWtDSUF4a0JKWnJ2eUUzQzNWRWdVT0t2d2VzVUN4cFBOendpbkg5Qkd4TXJuTk4KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=         server: https://192.168.50.23:6443     name: k3s-3-pi
env_name     |
file_path    | ~/.kube/config
created_at   | 2026-07-15 15:55:07.438234+10
updated_at   | 2026-07-15 15:55:07.438234+10
value_key_id |
```

Post change:
```
coder=# select * from user_secrets ;
-[ RECORD 1 ]+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
id           | 7c4858bc-ee87-45f0-b85d-0e9b1474d69c
user_id      | 0f0a590b-0358-4a24-bb25-ccc936bcc8d6
name         | kubeconfig
description  |
value        | apiVersion: v1                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          +
             | clusters:                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               +
             |   - cluster:                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            +
             |         certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJkakNDQVIyZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWpNU0V3SHdZRFZRUUREQmhyTTNNdGMyVnkKZG1WeUxXTmhRREUzTWpBNU16VTFOelV3SGhjTk1qUXdOekUwTURVek9UTTFXaGNOTXpRd056RXlNRFV6T1RNMQpXakFqTVNFd0h3WURWUVFEREJock0zTXRjMlZ5ZG1WeUxXTmhRREUzTWpBNU16VTFOelV3V1RBVEJnY3Foa2pPClBRSUJCZ2dxaGtqT1BRTUJCd05DQUFTK1JRaUlLa0RVV0tKR0Y0ZFdnbWZSVTA1Wjg1ellQSWt6aWlHUXdBZ1gKMXdyQThhNVRRbzVuYlJmeWxRQXZtZDB1SE04a05GTmZIYXJwc3lxZkZyS0dvMEl3UURBT0JnTlZIUThCQWY4RQpCQU1DQXFRd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVTBmUHdjMWpnd1BraFN2Q0cwbjQ1CnZTV09ES1V3Q2dZSUtvWkl6ajBFQXdJRFJ3QXdSQUlnQ3RCRm5KR0VJVVRSZ1RRaXZFSWJIODVwQnlMdmx1RjMKQ2ZTRFhDc3hlaWtDSUF4a0JKWnJ2eUUzQzNWRWdVT0t2d2VzVUN4cFBOendpbkg5Qkd4TXJuTk4KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=+
             |         server: https://192.168.50.23:6443                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              +
             |     name: k3s-3-pi
env_name     |
file_path    | ~/.kube/config
created_at   | 2026-07-15 15:49:08.772126+10
updated_at   | 2026-07-15 15:53:39.375332+10
value_key_id |
```

And displayed correct in the Coder workspace:
<img width="508" height="238" alt="image"
src="https://github.com/user-attachments/assets/a0e9208e-cb73-4636-94e4-a67dcb510da4"
/>


Add secret UI is now a multiline input box:
<img width="534" height="839" alt="image"
src="https://github.com/user-attachments/assets/6e2a89a3-bef2-40c0-852e-0c9ac8e2f0cd"
/>

Co-authored-by: Atif Ali <atif@coder.com>
 2026-08-03 11:52:07 -07:00
Ben Potter 8a4adeec32 fix(agent): detect IPv6-bound listening ports (#27765) 
Closes https://github.com/coder/coder/issues/15675

Dev servers that bind to the IPv6 wildcard address (Next.js, Node's
default `http.Server`, Go's `net.Listen` on wildcard addresses, and
others) never showed up in the dashboard Ports panel, even though they
were listening and reachable. The agent's port scanner only called
`netstat.TCPSocks`, which reads `/proc/net/tcp` (IPv4 only); an `[::]`
dual-stack socket lives exclusively in `/proc/net/tcp6`, so the panel
reported "No open ports were detected."

Also scan `netstat.TCP6Socks` and merge the results into the existing
dedupe loop. The IPv6 scan failure is non-fatal so hosts with IPv6
disabled (missing `/proc/net/tcp6`, Windows with the v6 stack off) keep
their IPv4 results instead of the Ports panel 500ing.

Both captures below: `python3 -m http.server 5123 --bind ::` running in
the same workspace, built from main vs this branch ([full
recordings](https://github.com/coder/coder/tree/recordings/recordings/ipv6-listening-ports)).

## Before


![before](https://raw.githubusercontent.com/coder/coder/recordings/recordings/ipv6-listening-ports/before.jpg)

## After


![after](https://raw.githubusercontent.com/coder/coder/recordings/recordings/ipv6-listening-ports/after.jpg)

<details>
<summary>Debugging and decision log</summary>

- Reproduced on a dogfood workspace: `next-server` listening on `*:3000`
per `ss -tlnp`, `curl` returning 200, but `GET
/api/v2/workspaceagents/{agent}/listening-ports` returning `{"ports":
[]}`. Port 3000 (hex `0BB8`) present in `/proc/net/tcp6`, absent from
`/proc/net/tcp`.
- Confirmed `agent/ports_supported.go` only calls `netstat.TCPSocks`;
the library's `TCP6Socks` (parses `/proc/net/tcp6` on Linux,
`GetTcp6Table2` on Windows) was never referenced.
- Control test: an IPv4-bound (`0.0.0.0`) listener was detected
correctly, isolating the bug to the missing IPv6 scan.
- Made the IPv6 scan failure non-fatal after review: returning an error
would break the entire ports endpoint (HTTP 500 on every poll) on
IPv6-disabled hosts, a regression from the current behavior of "IPv4
ports only." Silent fallback matches the spirit of
`ports_unsupported.go`, which returns an empty list rather than
erroring.
- The fix lives in the OS-backed `osListeningPortsGetter` behind the
`ListeningPortsGetter` interface from #20842, so the fake used by coderd
tests is unaffected.
- Dedupe by port in the existing `seen` map covers dual-stack sockets
that appear in both tables on Windows.
- `TestOSListeningPortsGetter_IPv6` listens on `[::]:0` and asserts
detection; it skips when the host can't bind IPv6. Verified it fails
against the pre-fix code.

</details>

> 🤖 This PR was opened by [Coder
Agents](https://coder.com/docs/ai-coder/agents) on behalf of @bpmct.
 2026-08-03 11:50:36 -07:00
Nick Vigilante 71c7e92084 ci: broaden linkspector Stack Overflow ignore for weekly docs check (#27799) 
## Problem

The weekly docs link check
([`weekly-docs`](https://github.com/coder/coder/blob/main/.github/workflows/weekly-docs.yaml)
-> [linkspector](https://github.com/UmbrellaDocs/linkspector)) is
failing.

- **Failing run:**
https://github.com/coder/coder/actions/runs/30805217850/job/91691078170
- **Broken link:** `https://stackoverflow.com/a/55570286` in
`docs/admin/users/idp-sync.md` (line 576), reported `Status: 403`.

Stack Overflow returns `403` to the GitHub runner IPs (bot detection),
so a valid link is flagged as broken. This is the same false-positive
mode already handled for `npmjs.com`, `merriam-webster.com`,
`splunk.com`, etc. in `.github/.linkspector.yml`.

## Fix / why a bare `stackoverflow.com` pattern

linkspector matches `ignorePatterns` as regex substrings against each
URL. The config already ignored `stackoverflow.com/questions`, but the
failing URL is an **answer** link (`/a/...`) that the `/questions`
pattern does not cover, and it has no `www.` prefix, so a
`www.stackoverflow.com` entry would not match it either.

Broadening to a bare `stackoverflow.com`:

- fixes the failing `/a/55570286` link;
- keeps the existing `/questions/...` link in
`docs/about/contributing/frontend.md` covered (so the now-redundant
`stackoverflow.com/questions` line is removed);
- also covers any `www.` variant.

## Validation

- Confirmed the `stackoverflow.com` regex matches `/a/`, `/questions/`,
and `www.` variants; config parses; `typos` clean.
- The `weekly-docs` `pull_request` trigger is path-filtered to
`docs/**`, so this `.github/`-only change does not auto-run linkspector
here. Validated end-to-end via a manual `workflow_dispatch` on this
branch, which passed:
https://github.com/coder/coder/actions/runs/30829301773

<details>
<summary>Unrelated failing check: <code>Pixel / Review</code> (visual
regression)</summary>

`Pixel / Review` reports failed visual tests ([build
6916](https://pixel.coder.com/@coder/coder/builds/6916)). This PR only
edits `.github/.linkspector.yml` (link-checker config) and changes no
UI, components, or rendered output, so these are pre-existing
visual-baseline diffs / flakes unrelated to this change. All
path-relevant required checks (`fmt`, `gen`, `lint`, `changes`, `title`,
`Storybook`, `Flake Check`) pass.

</details>

Linear:
[DOCS-606](https://linear.app/codercom/issue/DOCS-606/fix-weekly-docs-link-check-allowlist-stack-overflow-in-linkspector)

> This PR was created with AI assistance (Coder Agents).
 2026-08-03 18:40:54 +00:00