coder

mirror of https://github.com/coder/coder.git synced 2026-11-03 22:25:31 +08:00

Author	SHA1	Message	Date
dependabot[bot]	2dc850d085	chore: bump github.com/valyala/fasthttp from 1.72.0 to 1.73.0 (#27575 ) Bumps [github.com/valyala/fasthttp](https://github.com/valyala/fasthttp) from 1.72.0 to 1.73.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/valyala/fasthttp/releases">github.com/valyala/fasthttp's releases</a>.</em></p> <blockquote> <h2>v1.73.0</h2> <h2>What's Changed</h2> <ul> <li>test: fix host comparison in FuzzURIParse by <a href="https://github.com/ReneWerner87"><code>@ReneWerner87</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2313">valyala/fasthttp#2313</a></li> <li>perf: avoid redundant scans when parsing request headers by <a href="https://github.com/ReneWerner87"><code>@ReneWerner87</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2312">valyala/fasthttp#2312</a></li> <li>Fix temp file leak in SaveMultipartFile on cross-device rename failure by <a href="https://github.com/itxaiohanglover"><code>@itxaiohanglover</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2311">valyala/fasthttp#2311</a></li> <li>re-enable forcetypeassert by <a href="https://github.com/Harshal96"><code>@Harshal96</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2316">valyala/fasthttp#2316</a></li> <li>test: normalize Go test names by <a href="https://github.com/Harshal96"><code>@Harshal96</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2317">valyala/fasthttp#2317</a></li> <li>feat: prefix sentinel error strings by <a href="https://github.com/Harshal96"><code>@Harshal96</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2319">valyala/fasthttp#2319</a></li> <li>fix(pprofhandler): use exact path matching to prevent debug data exposure by <a href="https://github.com/xbrxr03"><code>@xbrxr03</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2302">valyala/fasthttp#2302</a></li> <li>avoid following a symlink when writing the FS compressed cache by <a href="https://github.com/alhudz"><code>@alhudz</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2321">valyala/fasthttp#2321</a></li> <li>refactor: improve internal interface names by <a href="https://github.com/Harshal96"><code>@Harshal96</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2318">valyala/fasthttp#2318</a></li> <li>fix: lowercase error strings by <a href="https://github.com/Harshal96"><code>@Harshal96</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2320">valyala/fasthttp#2320</a></li> <li>perf: reduce redundant scans and allocations in hot paths by <a href="https://github.com/ReneWerner87"><code>@ReneWerner87</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2322">valyala/fasthttp#2322</a></li> <li>validate domain and path cookie attribute values on parse by <a href="https://github.com/alhudz"><code>@alhudz</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2315">valyala/fasthttp#2315</a></li> <li>chore(deps): bump securego/gosec from 2.27.1 to 2.28.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2328">valyala/fasthttp#2328</a></li> <li>chore(deps): bump actions/setup-go from 6 to 7 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2329">valyala/fasthttp#2329</a></li> <li>fix: preserve pre-set status code in NewFastHTTPHandler by <a href="https://github.com/xbrxr03"><code>@xbrxr03</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2323">valyala/fasthttp#2323</a></li> <li>chore(deps): bump github.com/klauspost/compress from 1.19.0 to 1.19.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2331">valyala/fasthttp#2331</a></li> <li>reject backslash '..' traversal in fs handler on windows by <a href="https://github.com/alhudz"><code>@alhudz</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2327">valyala/fasthttp#2327</a></li> <li>fix: reject Windows alternate data stream paths in FS by <a href="https://github.com/dev-willbird1936"><code>@dev-willbird1936</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2335">valyala/fasthttp#2335</a></li> <li>chore(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2307">valyala/fasthttp#2307</a></li> <li>chore(deps): bump github.com/andybalholm/brotli from 1.2.1 to 1.2.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2308">valyala/fasthttp#2308</a></li> <li>chore(deps): bump github.com/klauspost/compress from 1.18.6 to 1.18.7 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2309">valyala/fasthttp#2309</a></li> <li>chore(deps): bump github.com/klauspost/compress from 1.18.7 to 1.19.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2314">valyala/fasthttp#2314</a></li> <li>chore(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2326">valyala/fasthttp#2326</a></li> <li>chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2324">valyala/fasthttp#2324</a></li> <li>chore(deps): bump golang.org/x/net from 0.56.0 to 0.57.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2325">valyala/fasthttp#2325</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/itxaiohanglover"><code>@itxaiohanglover</code></a> made their first contribution in <a href="https://redirect.github.com/valyala/fasthttp/pull/2311">valyala/fasthttp#2311</a></li> <li><a href="https://github.com/Harshal96"><code>@Harshal96</code></a> made their first contribution in <a href="https://redirect.github.com/valyala/fasthttp/pull/2316">valyala/fasthttp#2316</a></li> <li><a href="https://github.com/dev-willbird1936"><code>@dev-willbird1936</code></a> made their first contribution in <a href="https://redirect.github.com/valyala/fasthttp/pull/2335">valyala/fasthttp#2335</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/valyala/fasthttp/compare/v1.72.0...v1.73.0">https://github.com/valyala/fasthttp/compare/v1.72.0...v1.73.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/valyala/fasthttp/commit/f83ac8c3560feccaa017ba86dd9b95ad004790f2"><code>f83ac8c</code></a> Optimize bounds checks in hot paths</li> <li><a href="https://github.com/valyala/fasthttp/commit/d9babd95c5f3d26ff26cfc528ca77f165df2f95f"><code>d9babd9</code></a> fix: reject Windows alternate data stream paths in FS (<a href="https://redirect.github.com/valyala/fasthttp/issues/2335">#2335</a>)</li> <li><a href="https://github.com/valyala/fasthttp/commit/e7cf856857a46388b9e03507b8d4b6d5bc3d69dd"><code>e7cf856</code></a> reject backslash '..' traversal in fs handler on windows (<a href="https://redirect.github.com/valyala/fasthttp/issues/2327">#2327</a>)</li> <li><a href="https://github.com/valyala/fasthttp/commit/165a4c81aada474f8566a66a5d4c2dee35fee37e"><code>165a4c8</code></a> Improve AppendUnquotedArg with optimised bounds check</li> <li><a href="https://github.com/valyala/fasthttp/commit/7a1349da70685cce500515263c20ec389f8f69e1"><code>7a1349d</code></a> chore(deps): bump github.com/klauspost/compress from 1.19.0 to 1.19.1 (<a href="https://redirect.github.com/valyala/fasthttp/issues/2331">#2331</a>)</li> <li><a href="https://github.com/valyala/fasthttp/commit/f1ad91d51977febd2730b9e0d79c7d241c5e430c"><code>f1ad91d</code></a> fix: preserve pre-set status code in NewFastHTTPHandler (<a href="https://redirect.github.com/valyala/fasthttp/issues/2323">#2323</a>)</li> <li><a href="https://github.com/valyala/fasthttp/commit/5f57d8fda4c2c9e3092f82e13f589a92ed48d347"><code>5f57d8f</code></a> chore(deps): bump actions/setup-go from 6 to 7 (<a href="https://redirect.github.com/valyala/fasthttp/issues/2329">#2329</a>)</li> <li><a href="https://github.com/valyala/fasthttp/commit/3aa940dfd248799878cd9ef46f6dfcec89a37f8d"><code>3aa940d</code></a> chore(deps): bump securego/gosec from 2.27.1 to 2.28.0 (<a href="https://redirect.github.com/valyala/fasthttp/issues/2328">#2328</a>)</li> <li><a href="https://github.com/valyala/fasthttp/commit/7a012e987a372bf40d3eedf6caeb2f4c6162ff40"><code>7a012e9</code></a> validate domain and path cookie attribute values on parse (<a href="https://redirect.github.com/valyala/fasthttp/issues/2315">#2315</a>)</li> <li><a href="https://github.com/valyala/fasthttp/commit/9cf733f7dc3533354eb6d495fcf0af93bdcb2f03"><code>9cf733f</code></a> perf: reduce redundant scans and allocations in hot paths (<a href="https://redirect.github.com/valyala/fasthttp/issues/2322">#2322</a>)</li> <li>Additional commits viewable in <a href="https://github.com/valyala/fasthttp/compare/v1.72.0...v1.73.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/valyala/fasthttp&package-manager=go_modules&previous-version=1.72.0&new-version=1.73.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-28 11:18:19 +00:00
dependabot[bot]	300ad74f05	chore: bump github.com/aws/aws-sdk-go-v2 from 1.42.1 to 1.43.0 (#27576 ) Bumps [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) from 1.42.1 to 1.43.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/4fef3455fe2dcb5ea3de4e9fbacf889b84c8a255"><code>4fef345</code></a> Release 2026-07-21</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/62754193b1dfd903e741ad656a3e43cda43e3d6c"><code>6275419</code></a> Regenerated Clients</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/f8598305ac9db1544afae331c09df396ee2f7b3e"><code>f859830</code></a> Update API model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/278591d8fcdcb1f3ec22c3562dcd648b169f4a31"><code>278591d</code></a> Add an option to clients to disable clock skew (<a href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/3483">#3483</a>)</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/d132ac727d15f1c7ff251e0b6739c0e9362ae322"><code>d132ac7</code></a> Fix Clock Skew according to internal specification (<a href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/3472">#3472</a>)</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/03519c98d97b40b31ab42755e4bc6d26e39af5d6"><code>03519c9</code></a> Release 2026-07-20</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/dda3efb63a49f64351f314aa8b6266dee9efbfc2"><code>dda3efb</code></a> Regenerated Clients</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/348cec09e4e0e856665f55f5e548135388a4ef25"><code>348cec0</code></a> Update API model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/f4fd2723ed647078bced4bdf4b83e6a61c379546"><code>f4fd272</code></a> Release 2026-07-17</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/8e4cbc854bca2c82b351089583123964fb4f392a"><code>8e4cbc8</code></a> Regenerated Clients</li> <li>Additional commits viewable in <a href="https://github.com/aws/aws-sdk-go-v2/compare/v1.42.1...v1.43.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/aws/aws-sdk-go-v2&package-manager=go_modules&previous-version=1.42.1&new-version=1.43.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-28 11:18:10 +00:00
dependabot[bot]	5b1fdc9d5e	chore: bump google.golang.org/api from 0.289.0 to 0.290.0 (#27573 ) Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.289.0 to 0.290.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's releases</a>.</em></p> <blockquote> <h2>v0.290.0</h2> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.289.0...v0.290.0">0.290.0</a> (2026-07-20)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3661">#3661</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/dea11c224ee6b69cc88ebd03460e95cf11f8733c">dea11c2</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3663">#3663</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/93d30d482d74cf2f49ada20c06fcdfa9ceb0ed87">93d30d4</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.289.0...v0.290.0">0.290.0</a> (2026-07-20)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3661">#3661</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/dea11c224ee6b69cc88ebd03460e95cf11f8733c">dea11c2</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3663">#3663</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/93d30d482d74cf2f49ada20c06fcdfa9ceb0ed87">93d30d4</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/googleapis/google-api-go-client/commit/b1b12e7c28c287baa23edf8941b2f4a8071c97a9"><code>b1b12e7</code></a> chore(main): release 0.290.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3662">#3662</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/153c78e85b81c1a98919bc8abf26a3055996d5ce"><code>153c78e</code></a> chore: expand CODEOWNERS (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3664">#3664</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/93d30d482d74cf2f49ada20c06fcdfa9ceb0ed87"><code>93d30d4</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3663">#3663</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/dea11c224ee6b69cc88ebd03460e95cf11f8733c"><code>dea11c2</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3661">#3661</a>)</li> <li>See full diff in <a href="https://github.com/googleapis/google-api-go-client/compare/v0.289.0...v0.290.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/api&package-manager=go_modules&previous-version=0.289.0&new-version=0.290.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-28 11:17:59 +00:00
dependabot[bot]	fa15461d67	chore: bump github.com/coder/terraform-provider-coder/v2 from 2.18.0 to 2.19.0 (#27574 ) Bumps [github.com/coder/terraform-provider-coder/v2](https://github.com/coder/terraform-provider-coder) from 2.18.0 to 2.19.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/coder/terraform-provider-coder/releases">github.com/coder/terraform-provider-coder/v2's releases</a>.</em></p> <blockquote> <h2>v2.19.0</h2> <h2>What's Changed</h2> <ul> <li>chore: add check-latest to setup-go for reliable Go version resolution by <a href="https://github.com/denisra"><code>@denisra</code></a> in <a href="https://redirect.github.com/coder/terraform-provider-coder/pull/529">coder/terraform-provider-coder#529</a></li> <li>build(deps): Bump golang.org/x/mod from 0.36.0 to 0.38.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/coder/terraform-provider-coder/pull/524">coder/terraform-provider-coder#524</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/denisra"><code>@denisra</code></a> made their first contribution in <a href="https://redirect.github.com/coder/terraform-provider-coder/pull/529">coder/terraform-provider-coder#529</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/coder/terraform-provider-coder/compare/v2.18.0...v2.19.0">https://github.com/coder/terraform-provider-coder/compare/v2.18.0...v2.19.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/coder/terraform-provider-coder/commit/fd21951c3e89b52658e58361388540bbd97cd2c2"><code>fd21951</code></a> build(deps): Bump golang.org/x/mod from 0.36.0 to 0.38.0 (<a href="https://redirect.github.com/coder/terraform-provider-coder/issues/524">#524</a>)</li> <li><a href="https://github.com/coder/terraform-provider-coder/commit/756e3a855206aec7151c1bc6f132a259533f7bb6"><code>756e3a8</code></a> chore: add check-latest to setup-go for reliable Go version resolution (<a href="https://redirect.github.com/coder/terraform-provider-coder/issues/529">#529</a>)</li> <li>See full diff in <a href="https://github.com/coder/terraform-provider-coder/compare/v2.18.0...v2.19.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/coder/terraform-provider-coder/v2&package-manager=go_modules&previous-version=2.18.0&new-version=2.19.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-28 11:16:42 +00:00
dependabot[bot]	923667013e	chore: bump google.golang.org/grpc from 1.82.0 to 1.82.1 (#27431 ) Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.82.0 to 1.82.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/grpc/grpc-go/releases">google.golang.org/grpc's releases</a>.</em></p> <blockquote> <h2>Release 1.82.1</h2> <h1>Security</h1> <ul> <li>server: Stop reading from the connection when flooded by HTTP/2 frames. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable <code>GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT</code>.</li> <li>xds/rbac: Support <code>Metadata</code> and <code>RequestedServerName</code> permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.</li> <li>xds/rbac: Fix panic when parsing unsupported fields in <code>NotRule</code>/<code>NotId</code> permissions.</li> <li>xds/rbac: Support the deprecated <code>source_ip</code> principal identifier by treating it as equivalent to <code>direct_remote_ip</code>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/grpc/grpc-go/commit/ebd8f06a09426fbece97157c95c3917abff28f4e"><code>ebd8f06</code></a> Change version to 1.82.1 (<a href="https://redirect.github.com/grpc/grpc-go/issues/9238">#9238</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/4ea465d4ab98013f72a142fe0fc89c19770b2935"><code>4ea465d</code></a> Cherry-pick commits (<a href="https://redirect.github.com/grpc/grpc-go/issues/9236">#9236</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/9494a2cf32a0ec9d35420af401445ef3c9f66f05"><code>9494a2c</code></a> Change version to 1.82.1-dev (<a href="https://redirect.github.com/grpc/grpc-go/issues/9171">#9171</a>)</li> <li>See full diff in <a href="https://github.com/grpc/grpc-go/compare/v1.82.0...v1.82.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/grpc&package-manager=go_modules&previous-version=1.82.0&new-version=1.82.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/coder/coder/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-22 18:39:27 +00:00
dependabot[bot]	acd0d7f841	chore: bump google.golang.org/api from 0.288.0 to 0.289.0 (#27365 ) Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.288.0 to 0.289.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's releases</a>.</em></p> <blockquote> <h2>v0.289.0</h2> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.288.0...v0.289.0">0.289.0</a> (2026-07-16)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3649">#3649</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/6e259cbb923dd10f071e2f724be23914f8ccd78b">6e259cb</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3652">#3652</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/5116a48938fa4674df57289ca63e75d209c06e10">5116a48</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3653">#3653</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/6c876b4102b2db7dabc6a0f69eb0e854d298f48d">6c876b4</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3655">#3655</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/69af635fafd38d3623f52c173715883d93d7ead5">69af635</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3656">#3656</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/1fc8f4539d0bf40f8272c1eb36f1e84cfa0ecea7">1fc8f45</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3657">#3657</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/aa8d256cb84dcc38ee3888c983515cae283d7436">aa8d256</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3659">#3659</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/af8d03336daad8d37f8de7e4692a8b67a7d35b7e">af8d033</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.288.0...v0.289.0">0.289.0</a> (2026-07-16)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3649">#3649</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/6e259cbb923dd10f071e2f724be23914f8ccd78b">6e259cb</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3652">#3652</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/5116a48938fa4674df57289ca63e75d209c06e10">5116a48</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3653">#3653</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/6c876b4102b2db7dabc6a0f69eb0e854d298f48d">6c876b4</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3655">#3655</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/69af635fafd38d3623f52c173715883d93d7ead5">69af635</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3656">#3656</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/1fc8f4539d0bf40f8272c1eb36f1e84cfa0ecea7">1fc8f45</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3657">#3657</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/aa8d256cb84dcc38ee3888c983515cae283d7436">aa8d256</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3659">#3659</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/af8d03336daad8d37f8de7e4692a8b67a7d35b7e">af8d033</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/googleapis/google-api-go-client/commit/783bf4bedcc95794980288f1e9928582e9a231b9"><code>783bf4b</code></a> chore(main): release 0.289.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3650">#3650</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/af8d03336daad8d37f8de7e4692a8b67a7d35b7e"><code>af8d033</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3659">#3659</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/080002a0ba10410dcd7c018483bfbdf27c2160ff"><code>080002a</code></a> chore: constrain go version updates in renovate (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3658">#3658</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/aa8d256cb84dcc38ee3888c983515cae283d7436"><code>aa8d256</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3657">#3657</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/1fc8f4539d0bf40f8272c1eb36f1e84cfa0ecea7"><code>1fc8f45</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3656">#3656</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/7ac76e4d28ec9dd11c07746b48262426805a0084"><code>7ac76e4</code></a> chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 in /internal/koko...</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/8a47d2a5ae242a70b49a82a25eb72754dcc9acfc"><code>8a47d2a</code></a> chore(all): update all (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3654">#3654</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/69af635fafd38d3623f52c173715883d93d7ead5"><code>69af635</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3655">#3655</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/6c876b4102b2db7dabc6a0f69eb0e854d298f48d"><code>6c876b4</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3653">#3653</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/5116a48938fa4674df57289ca63e75d209c06e10"><code>5116a48</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3652">#3652</a>)</li> <li>Additional commits viewable in <a href="https://github.com/googleapis/google-api-go-client/compare/v0.288.0...v0.289.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/api&package-manager=go_modules&previous-version=0.288.0&new-version=0.289.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-21 11:19:05 +00:00
dependabot[bot]	0344e06d4c	chore: bump github.com/prometheus/client_golang from 1.23.2 to 1.24.0 (#27366 ) Bumps [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) from 1.23.2 to 1.24.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/prometheus/client_golang/releases">github.com/prometheus/client_golang's releases</a>.</em></p> <blockquote> <h2>v1.24.0 - 2026-07-20</h2> <h3>Changes</h3> <ul> <li>[CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. <a href="https://redirect.github.com/prometheus/client_golang/issues/1862">#1862</a></li> <li>[CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated <code>model.NameValidationScheme</code> global. Default behavior is unchanged; code that set <code>NameValidationScheme = LegacyValidation</code> no longer gets legacy enforcement at metric, label, and push-grouping construction. <a href="https://redirect.github.com/prometheus/client_golang/issues/2051">#2051</a></li> <li>[CHANGE] api/prometheus/v1: Support matchers (<code>matches[]</code> parameter) in <code>Rules</code> method (<code>Rules(ctx context.Context, matches []string) (RulesResult, error)</code>). <a href="https://redirect.github.com/prometheus/client_golang/issues/1843">#1843</a></li> <li>[CHANGE] api/prometheus/v1: Refactor <code>LabelNames</code> method to return <code>model.LabelNames</code> instead of <code>[]string</code> for consistency across the API. <a href="https://redirect.github.com/prometheus/client_golang/issues/1850">#1850</a></li> <li>[CHANGE] exp/api/remote: Simplify <code>Store</code> interface, rename <code>Handler</code> to <code>WriteHandler</code>, and encapsulate write response handling. <a href="https://redirect.github.com/prometheus/client_golang/issues/1855">#1855</a></li> <li>[FEATURE] prometheus: Add new Go 1.26 runtime metrics (<code>/sched/goroutines-created:goroutines</code>, <code>/sched/goroutines/not-in-go:goroutines</code>, <code>/sched/goroutines/runnable:goroutines</code>, <code>/sched/goroutines/running:goroutines</code>, <code>/sched/goroutines/waiting:goroutines</code>, <code>/sched/threads/total:threads</code>). <a href="https://redirect.github.com/prometheus/client_golang/issues/1942">#1942</a></li> <li>[FEATURE] prometheus: Add <code>WithUnit(unit string)</code> option and explicit OpenMetrics unit support in <code>CounterOpts</code>, <code>GaugeOpts</code>, <code>SummaryOpts</code>, and <code>HistogramOpts</code>. <a href="https://redirect.github.com/prometheus/client_golang/issues/1392">#1392</a></li> <li>[FEATURE] prometheus: Expose descriptor construction error through public <code>Err()</code> method on <code>Desc</code>. <a href="https://redirect.github.com/prometheus/client_golang/issues/1902">#1902</a></li> <li>[FEATURE] promhttp: Add opt-in <code>HandlerOpts.CoalesceGather</code> to deduplicate concurrent <code>Gather</code> calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. <a href="https://redirect.github.com/prometheus/client_golang/issues/1969">#1969</a></li> <li>[FEATURE] promhttp: HTTP handlers created by <code>promhttp</code> package now support metrics filtering by providing one or more <code>name[]</code> query parameters. The default behavior when none are provided remains the same, returning all metrics. <a href="https://redirect.github.com/prometheus/client_golang/issues/1925">#1925</a></li> <li>[FEATURE] api/prometheus/v1: Add query formatting endpoint support (<code>/format_query</code>) and <code>FormatQuery(ctx context.Context, query string) (string, error)</code> method. <a href="https://redirect.github.com/prometheus/client_golang/issues/1846">#1846</a>, <a href="https://redirect.github.com/prometheus/client_golang/issues/1856">#1856</a></li> <li>[FEATURE] api/prometheus/v1: Add support for <code>/status/tsdb/blocks</code> endpoint via <code>TSDBBlocks(ctx context.Context) ([]TSDBBlock, error)</code> method. <a href="https://redirect.github.com/prometheus/client_golang/issues/1896">#1896</a></li> <li>[FEATURE] exp/api/remote: Export <code>BackoffConfig</code> to allow customization when using <code>WithAPIBackoff</code>. <a href="https://redirect.github.com/prometheus/client_golang/issues/1895">#1895</a></li> <li>[FEATURE] exp/api/remote: Add <code>RetryCallBack</code> to allow custom logging or handling on retry attempts in the remote write client. <a href="https://redirect.github.com/prometheus/client_golang/issues/1888">#1888</a>, <a href="https://redirect.github.com/prometheus/client_golang/issues/1890">#1890</a></li> <li>[ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. <a href="https://redirect.github.com/prometheus/client_golang/issues/1860">#1860</a></li> <li>[ENHANCEMENT] api: Use cloned <code>http.DefaultTransport</code> when constructing default HTTP clients to prevent accidental mutations of shared global transport state. <a href="https://redirect.github.com/prometheus/client_golang/issues/1885">#1885</a></li> <li>[BUGFIX] prometheus: Recover from collector panics during <code>Gather()</code> and return an error instead of crashing the process. <a href="https://redirect.github.com/prometheus/client_golang/issues/1961">#1961</a></li> <li>[BUGFIX] prometheus: Fix <code>cpu-seconds</code> unit suffix handling for metric <code>go_cpu_classes_gc_mark_assist_cpu_seconds</code>. <a href="https://redirect.github.com/prometheus/client_golang/issues/1991">#1991</a></li> <li>[BUGFIX] promhttp: <code>InstrumentHandlerDuration</code> and <code>InstrumentHandlerCounter</code> no longer panic when given an observer/counter that does not implement <code>ExemplarObserver</code>/<code>ExemplarAdder</code> (e.g. a <code>SummaryVec</code>). The exemplar is dropped and the value is recorded via the plain <code>Observe</code>/<code>Add</code> path, matching the safe-cast already used by <code>Timer.ObserveDurationWithExemplar</code>. <a href="https://redirect.github.com/prometheus/client_golang/issues/2005">#2005</a></li> <li>[BUGFIX] api/prometheus/v1: Fall back to <code>GET</code> requests when <code>POST</code> requests return <code>403 Forbidden</code> or method not allowed. <a href="https://redirect.github.com/prometheus/client_golang/issues/2030">#2030</a></li> <li>[BUGFIX] api: Respect context cancellation inside <code>httpClient.Do</code>. <a href="https://redirect.github.com/prometheus/client_golang/issues/1971">#1971</a></li> <li>[BUGFIX] exp/api/remote: Fix compression buffer pooling where compressed buffers were released prematurely, causing corrupted remote-write payloads. <a href="https://redirect.github.com/prometheus/client_golang/issues/1889">#1889</a></li> <li>[BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. <a href="https://redirect.github.com/prometheus/client_golang/issues/1917">#1917</a></li> <li>[BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be returned on v1 requests. <a href="https://redirect.github.com/prometheus/client_golang/issues/1927">#1927</a></li> </ul> <!-- raw HTML omitted --> <ul> <li>build(deps): bump github.com/prometheus/procfs from 0.16.1 to 0.17.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/client_golang/pull/1839">prometheus/client_golang#1839</a></li> <li>build(deps): bump golang.org/x/sys from 0.33.0 to 0.34.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/client_golang/pull/1838">prometheus/client_golang#1838</a></li> <li>prometheus/collectors: use godoc link for runtime/metrics supported metrics by <a href="https://github.com/xieyuschen"><code>@xieyuschen</code></a> in <a href="https://redirect.github.com/prometheus/client_golang/pull/1844">prometheus/client_golang#1844</a></li> <li>Fix doc typo by <a href="https://github.com/torrca"><code>@torrca</code></a> in <a href="https://redirect.github.com/prometheus/client_golang/pull/1849">prometheus/client_golang#1849</a></li> <li>Merge release-1.23 into main by <a href="https://github.com/vesari"><code>@vesari</code></a> in <a href="https://redirect.github.com/prometheus/client_golang/pull/1851">prometheus/client_golang#1851</a></li> <li>build(deps): bump github/codeql-action from 3.29.2 to 3.29.5 in the github-actions group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/client_golang/pull/1852">prometheus/client_golang#1852</a></li> <li>Refactor LabelNames to return model.LabelNames type for consistency by <a href="https://github.com/yshngg"><code>@yshngg</code></a> in <a href="https://redirect.github.com/prometheus/client_golang/pull/1850">prometheus/client_golang#1850</a></li> <li>remote: simplified Store interface; renamed Handler to WriteHandler by <a href="https://github.com/bwplotka"><code>@bwplotka</code></a> in <a href="https://redirect.github.com/prometheus/client_golang/pull/1855">prometheus/client_golang#1855</a></li> <li>feat(api/prometheus): add format_query endpoint for query formatting by <a href="https://github.com/yshngg"><code>@yshngg</code></a> in <a href="https://redirect.github.com/prometheus/client_golang/pull/1846">prometheus/client_golang#1846</a></li> <li>feat(api): add FormatQuery method to Prometheus v1 API by <a href="https://github.com/yshngg"><code>@yshngg</code></a> in <a href="https://redirect.github.com/prometheus/client_golang/pull/1856">prometheus/client_golang#1856</a></li> <li>Support matchers in rules API by <a href="https://github.com/jotak"><code>@jotak</code></a> in <a href="https://redirect.github.com/prometheus/client_golang/pull/1843">prometheus/client_golang#1843</a></li> <li>Use prometheus/common.expfmt.NewTextParser by <a href="https://github.com/aknuds1"><code>@aknuds1</code></a> in <a href="https://redirect.github.com/prometheus/client_golang/pull/1859">prometheus/client_golang#1859</a></li> <li>Merge release-1.23 into main by <a href="https://github.com/aknuds1"><code>@aknuds1</code></a> in <a href="https://redirect.github.com/prometheus/client_golang/pull/1861">prometheus/client_golang#1861</a></li> <li>chore: Drop support for <go1.22 by <a href="https://github.com/mrueg"><code>@mrueg</code></a> in <a href="https://redirect.github.com/prometheus/client_golang/pull/1862">prometheus/client_golang#1862</a></li> <li>collectors/version: Allow custom additional labels by <a href="https://github.com/mrueg"><code>@mrueg</code></a> in <a href="https://redirect.github.com/prometheus/client_golang/pull/1860">prometheus/client_golang#1860</a></li> <li>build(deps): bump github.com/prometheus/common from 0.65.0 to 0.66.0 by <a href="https://github.com/ywwg"><code>@ywwg</code></a> in <a href="https://redirect.github.com/prometheus/client_golang/pull/1865">prometheus/client_golang#1865</a></li> <li>Sync release-1.23 into main by <a href="https://github.com/aknuds1"><code>@aknuds1</code></a> in <a href="https://redirect.github.com/prometheus/client_golang/pull/1868">prometheus/client_golang#1868</a></li> <li>Sync main with release-1.23 by <a href="https://github.com/aknuds1"><code>@aknuds1</code></a> in <a href="https://redirect.github.com/prometheus/client_golang/pull/1871">prometheus/client_golang#1871</a></li> <li>chore: clean up golangci-lint configuration by <a href="https://github.com/mmorel-35"><code>@mmorel-35</code></a> in <a href="https://redirect.github.com/prometheus/client_golang/pull/1802">prometheus/client_golang#1802</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/prometheus/client_golang/blob/v1.24.0/CHANGELOG.md">github.com/prometheus/client_golang's changelog</a>.</em></p> <blockquote> <h2>1.24.0 / 2026-07-20</h2> <ul> <li>[CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. <a href="https://redirect.github.com/prometheus/client_golang/issues/1862">#1862</a></li> <li>[CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated <code>model.NameValidationScheme</code> global. Default behavior is unchanged; code that set <code>NameValidationScheme = LegacyValidation</code> no longer gets legacy enforcement at metric, label, and push-grouping construction. <a href="https://redirect.github.com/prometheus/client_golang/issues/2051">#2051</a></li> <li>[CHANGE] api/prometheus/v1: Support matchers (<code>matches[]</code> parameter) in <code>Rules</code> method (<code>Rules(ctx context.Context, matches []string) (RulesResult, error)</code>). <a href="https://redirect.github.com/prometheus/client_golang/issues/1843">#1843</a></li> <li>[CHANGE] api/prometheus/v1: Refactor <code>LabelNames</code> method to return <code>model.LabelNames</code> instead of <code>[]string</code> for consistency across the API. <a href="https://redirect.github.com/prometheus/client_golang/issues/1850">#1850</a></li> <li>[CHANGE] exp/api/remote: Simplify <code>Store</code> interface, rename <code>Handler</code> to <code>WriteHandler</code>, and encapsulate write response handling. <a href="https://redirect.github.com/prometheus/client_golang/issues/1855">#1855</a></li> <li>[FEATURE] prometheus: Add new Go 1.26 runtime metrics (<code>/sched/goroutines-created:goroutines</code>, <code>/sched/goroutines/not-in-go:goroutines</code>, <code>/sched/goroutines/runnable:goroutines</code>, <code>/sched/goroutines/running:goroutines</code>, <code>/sched/goroutines/waiting:goroutines</code>, <code>/sched/threads/total:threads</code>). <a href="https://redirect.github.com/prometheus/client_golang/issues/1942">#1942</a></li> <li>[FEATURE] prometheus: Add <code>WithUnit(unit string)</code> option and explicit OpenMetrics unit support in <code>CounterOpts</code>, <code>GaugeOpts</code>, <code>SummaryOpts</code>, and <code>HistogramOpts</code>. <a href="https://redirect.github.com/prometheus/client_golang/issues/1392">#1392</a></li> <li>[FEATURE] prometheus: Expose descriptor construction error through public <code>Err()</code> method on <code>Desc</code>. <a href="https://redirect.github.com/prometheus/client_golang/issues/1902">#1902</a></li> <li>[FEATURE] promhttp: Add opt-in <code>HandlerOpts.CoalesceGather</code> to deduplicate concurrent <code>Gather</code> calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. <a href="https://redirect.github.com/prometheus/client_golang/issues/1969">#1969</a></li> <li>[FEATURE] promhttp: HTTP handlers created by <code>promhttp</code> package now support metrics filtering by providing one or more <code>name[]</code> query parameters. The default behavior when none are provided remains the same, returning all metrics. <a href="https://redirect.github.com/prometheus/client_golang/issues/1925">#1925</a></li> <li>[FEATURE] api/prometheus/v1: Add query formatting endpoint support (<code>/format_query</code>) and <code>FormatQuery(ctx context.Context, query string) (string, error)</code> method. <a href="https://redirect.github.com/prometheus/client_golang/issues/1846">#1846</a>, <a href="https://redirect.github.com/prometheus/client_golang/issues/1856">#1856</a></li> <li>[FEATURE] api/prometheus/v1: Add support for <code>/status/tsdb/blocks</code> endpoint via <code>TSDBBlocks(ctx context.Context) ([]TSDBBlock, error)</code> method. <a href="https://redirect.github.com/prometheus/client_golang/issues/1896">#1896</a></li> <li>[FEATURE] exp/api/remote: Export <code>BackoffConfig</code> to allow customization when using <code>WithAPIBackoff</code>. <a href="https://redirect.github.com/prometheus/client_golang/issues/1895">#1895</a></li> <li>[FEATURE] exp/api/remote: Add <code>RetryCallBack</code> to allow custom logging or handling on retry attempts in the remote write client. <a href="https://redirect.github.com/prometheus/client_golang/issues/1888">#1888</a>, <a href="https://redirect.github.com/prometheus/client_golang/issues/1890">#1890</a></li> <li>[ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. <a href="https://redirect.github.com/prometheus/client_golang/issues/1860">#1860</a></li> <li>[ENHANCEMENT] api: Use cloned <code>http.DefaultTransport</code> when constructing default HTTP clients to prevent accidental mutations of shared global transport state. <a href="https://redirect.github.com/prometheus/client_golang/issues/1885">#1885</a></li> <li>[BUGFIX] prometheus: Recover from collector panics during <code>Gather()</code> and return an error instead of crashing the process. <a href="https://redirect.github.com/prometheus/client_golang/issues/1961">#1961</a></li> <li>[BUGFIX] prometheus: Fix <code>cpu-seconds</code> unit suffix handling for metric <code>go_cpu_classes_gc_mark_assist_cpu_seconds</code>. <a href="https://redirect.github.com/prometheus/client_golang/issues/1991">#1991</a></li> <li>[BUGFIX] promhttp: <code>InstrumentHandlerDuration</code> and <code>InstrumentHandlerCounter</code> no longer panic when given an observer/counter that does not implement <code>ExemplarObserver</code>/<code>ExemplarAdder</code> (e.g. a <code>SummaryVec</code>). The exemplar is dropped and the value is recorded via the plain <code>Observe</code>/<code>Add</code> path, matching the safe-cast already used by <code>Timer.ObserveDurationWithExemplar</code>. <a href="https://redirect.github.com/prometheus/client_golang/issues/2005">#2005</a></li> <li>[BUGFIX] api/prometheus/v1: Fall back to <code>GET</code> requests when <code>POST</code> requests return <code>403 Forbidden</code> or method not allowed. <a href="https://redirect.github.com/prometheus/client_golang/issues/2030">#2030</a></li> <li>[BUGFIX] api: Respect context cancellation inside <code>httpClient.Do</code>. <a href="https://redirect.github.com/prometheus/client_golang/issues/1971">#1971</a></li> <li>[BUGFIX] exp/api/remote: Fix compression buffer pooling where compressed buffers were released prematurely, causing corrupted remote-write payloads. <a href="https://redirect.github.com/prometheus/client_golang/issues/1889">#1889</a></li> <li>[BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. <a href="https://redirect.github.com/prometheus/client_golang/issues/1917">#1917</a></li> <li>[BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be returned on v1 requests. <a href="https://redirect.github.com/prometheus/client_golang/issues/1927">#1927</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/prometheus/client_golang/commit/48dd383f94cc36bb0179724166383effd9f64847"><code>48dd383</code></a> Cut v1.24.0 (<a href="https://redirect.github.com/prometheus/client_golang/issues/2061">#2061</a>)</li> <li><a href="https://github.com/prometheus/client_golang/commit/a7253054383fd6702034c16194117d37727cd5fc"><code>a725305</code></a> Cut v1.24.0-rc.0 (<a href="https://redirect.github.com/prometheus/client_golang/issues/2058">#2058</a>)</li> <li><a href="https://github.com/prometheus/client_golang/commit/77c584f2501bf3726bb39b83a89b70c0e6f9ab0c"><code>77c584f</code></a> build(deps): update all Go dependencies in all go.mod files (<a href="https://redirect.github.com/prometheus/client_golang/issues/2059">#2059</a>)</li> <li><a href="https://github.com/prometheus/client_golang/commit/78262a77b89922f94a19ecd25eaeb849fb58f2cc"><code>78262a7</code></a> feat(promhttp): add CoalesceGather option to deduplicate concurrent Gather ca...</li> <li><a href="https://github.com/prometheus/client_golang/commit/34e9a7fe186a7a3ff47694f127d44d5641ff388f"><code>34e9a7f</code></a> Merge pull request <a href="https://redirect.github.com/prometheus/client_golang/issues/2055">#2055</a> from prombot/repo_sync</li> <li><a href="https://github.com/prometheus/client_golang/commit/43749bc83131a4af24527351aabb47dc58590c85"><code>43749bc</code></a> Update common Prometheus files</li> <li><a href="https://github.com/prometheus/client_golang/commit/de192175ccd6f6d4894cd9ceb804712c982e4958"><code>de19217</code></a> examples: improve simple main.go example (<a href="https://redirect.github.com/prometheus/client_golang/issues/1999">#1999</a>)</li> <li><a href="https://github.com/prometheus/client_golang/commit/20355eb4487c108a6ed54d9ebc6893bd649c10d0"><code>20355eb</code></a> fix: correct typos in comments and test error messages (<a href="https://redirect.github.com/prometheus/client_golang/issues/2049">#2049</a>)</li> <li><a href="https://github.com/prometheus/client_golang/commit/4cd2d3a57eccc893f00e23eb765f62e970e61f33"><code>4cd2d3a</code></a> test: fix two flaky tests (darwin start_time regex, memstats HeapReleased dri...</li> <li><a href="https://github.com/prometheus/client_golang/commit/b0d896bb08469911db07752f2c92c4d3986c629b"><code>b0d896b</code></a> Replace deprecated model.NameValidationScheme with explicit UTF8Validation (#...</li> <li>Additional commits viewable in <a href="https://github.com/prometheus/client_golang/compare/v1.23.2...v1.24.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/prometheus/client_golang&package-manager=go_modules&previous-version=1.23.2&new-version=1.24.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-21 11:16:43 +00:00
dependabot[bot]	0aa74b0e5e	chore: bump github.com/scim2/filter-parser/v2 from 2.2.0 to 2.3.1 (#27368 ) Bumps [github.com/scim2/filter-parser/v2](https://github.com/scim2/filter-parser) from 2.2.0 to 2.3.1. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/scim2/filter-parser/commit/65b9da65508fb179de8e6841f81a4661a5d13ca1"><code>65b9da6</code></a> chore: lower go directive to 1.18 (actual minimum)</li> <li><a href="https://github.com/scim2/filter-parser/commit/fb6a9f86f8dffff137ca8f65faf65660480ea0d9"><code>fb6a9f8</code></a> chore: migrate parser dependency to github.com/q-uint/parser</li> <li><a href="https://github.com/scim2/filter-parser/commit/a551bba7d74bbd9fce7e56f4844351c77c338d9f"><code>a551bba</code></a> fix: allow hyphens in URI segments (<a href="https://redirect.github.com/scim2/filter-parser/issues/29">#29</a>)</li> <li><a href="https://github.com/scim2/filter-parser/commit/5c111b10bf6b419428e400380472a51512f3be00"><code>5c111b1</code></a> fix: preserve operator precedence in LogicalExpression.String() (<a href="https://redirect.github.com/scim2/filter-parser/issues/28">#28</a>)</li> <li>See full diff in <a href="https://github.com/scim2/filter-parser/compare/v2.2.0...v2.3.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/scim2/filter-parser/v2&package-manager=go_modules&previous-version=2.2.0&new-version=2.3.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-21 11:13:28 +00:00
Michael Suchacz	5f5efa49da	fix: stop sending adaptive thinking to pre-4.6 Anthropic models (#27314 ) ## Problem A chat model config with `reasoning_effort` set on a pre-4.6 Anthropic model (for example `claude-haiku-4-5`) fails every generation with HTTP 400 `adaptive thinking is not supported on this model`, surfaced in chat as "Anthropic returned an unexpected error." The fantasy Anthropic provider always serialized effort as `thinking: {type: "adaptive"}` plus `output_config.effort`, a shape only Claude 4.6+ accepts. ## Changes - Bump the coder/fantasy pin to include coder/fantasy#47: the provider now converts effort into `{type: "enabled", budget_tokens}` on models older than Claude 4.6, with the budget derived from the call's `max_tokens` (aibridge-mirroring ratios, 1024-token API floor; below the floor thinking is omitted, which keeps small-budget calls like title generation working). Adaptive-capable models keep the current shape, and Opus 4.5 keeps `output_config.effort` alongside the derived budget since it supports effort without adaptive thinking. Models older than Claude 3.7 predate extended thinking, so effort sends no thinking at all there. `minimal` is normalized to `low`, `xhigh` falls back to `max` on adaptive models that predate the xhigh tier (Claude 4.7+); effort `none` disables thinking, including an explicit `thinking: {type: "disabled"}` on Claude 5+ models that otherwise run adaptive thinking by default. The Bedrock provider wraps the Anthropic one, so both are covered, and Vertex-style `@date` model IDs parse correctly. - `TestActiveServer_CompactionModelOverride` previously codified the buggy shape (asserting `output_config.effort` sent to `claude-3-5-haiku-latest`). The summary-routing subtest is now a three-case table: pre-thinking override models (Claude 3.5) expect no thinking, legacy budget-thinking ones (Haiku 4.5) expect enabled thinking with the derived budget, adaptive-capable ones still expect `output_config.effort`. - New regression test `TestActiveServer_AnthropicModelReasoningEffort`: a `claude-haiku-4-5` config with `reasoning_effort` produces enabled thinking with the derived budget and no `output_config` on the wire, and a `claude-sonnet-5` config with effort `none` sends an explicit thinking disable. - `chattest.AnthropicRequest` gains a `Thinking` field so tests can assert the thinking config. - One-sentence note in the chatd ARCHITECTURE reasoning-effort section. No chatd production code changes: `ApplyReasoningEffort` keeps setting `Effort`, which is now valid for every Anthropic model. ## Validation - `go test ./coderd/x/chatd/...` passes (19 packages). - Fork PR validated separately: full fantasy test suite plus new provider unit tests (version gating incl. Vertex/Bedrock IDs, budget derivation, floor behavior, normalization, effort `none` incl. Claude 5+ disable, Opus 4.5 effort preservation, sampling-param stripping), golangci-lint clean. Closes [CODAGT-812](https://linear.app/codercom/issue/CODAGT-812/reasoning-effort-on-pre-46-anthropic-models-fails-generations-with). > This PR was authored by Mux, an AI coding agent, acting on Mike's behalf.	2026-07-18 22:47:02 +02:00
Ehab Younes	35ade9e3d2	feat: collect workspace logs in support bundles (#26694 ) Add workspace-side file collection to `coder support bundle` via repeatable --workspace-file flags. The agent resolves the requested paths or globs inside the remote workspace and streams back a tar with a manifest and the collected files; nothing is read from the machine running the command. - Add POST /api/v0/bundle-files to the agent's agentfiles package. - Expand env vars in the agent's environment; paths must then be absolute or start with ~/ (the agent user's home directory). - Support ** globs and tail oversized files. - Record requested patterns, per-path errors, truncation, and the applied limits in a manifest. - Unpack the archive into the bundle under agent/workspace_files/, recording dropped entries in collection_errors.txt. - Write a manifest-only archive marking collection as unsupported for agents that predate the endpoint. - Bound collection: 64 KB request body, 10000 files, 10 MiB per file, 100 MiB total including archive overhead, 110 MiB client-side read cap, 5 minute timeout. Closes #26020	2026-07-16 13:00:32 +03:00
dependabot[bot]	0fab0fa0ae	chore: bump github.com/DataDog/dd-trace-go/v2 from 2.0.0 to 2.8.1 (#27282 ) Bumps [github.com/DataDog/dd-trace-go/v2](https://github.com/DataDog/dd-trace-go) from 2.0.0 to 2.8.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/DataDog/dd-trace-go/releases">github.com/DataDog/dd-trace-go/v2's releases</a>.</em></p> <blockquote> <h2>v2.8.1</h2> <!-- raw HTML omitted --> <h3>Application Performance Monitoring (APM)</h3> <ul> <li>Revert "fix(ddtrace/tracer): cache trace ID hex encoding (<a href="https://redirect.github.com/DataDog/dd-trace-go/issues/4481">#4481</a>)" by <a href="https://github.com/darccio"><code>@darccio</code></a></li> <li>fix(tracer): enforce baggage item and byte limits on extraction by <a href="https://github.com/mtoffl01"><code>@mtoffl01</code></a> in <a href="https://redirect.github.com/DataDog/dd-trace-go/issues/4720">#4720</a></li> <li>fix(tracer): drop dd= list-entries over 256 bytes from incoming tracestate by <a href="https://github.com/mtoffl01"><code>@mtoffl01</code></a> in <a href="https://redirect.github.com/DataDog/dd-trace-go/issues/4721">#4721</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/DataDog/dd-trace-go/compare/v2.8.0...v2.8.1">https://github.com/DataDog/dd-trace-go/compare/v2.8.0...v2.8.1</a></p> <h2>v2.8.0</h2> <!-- raw HTML omitted --> <h2>Summary</h2> <p><strong>New integrations.</strong> Two new integrations land in this release: Azure API Management (APIM) callout processor for security (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4620">#4620</a>), and twmb/franz-go for Kafka (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4250">#4250</a>).</p> <p><strong>Data Streams Monitoring.</strong> All three major Kafka integrations — confluent-kafka-go (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4470">#4470</a>), segmentio/kafka-go (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4477">#4477</a>), and Sarama (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4560">#4560</a>) — now attach <code>kafka_cluster_id</code> for cluster-level visibility. <code>TrackDataStreamsTransaction</code> also gains span tagging and custom timestamp support (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4499">#4499</a>).</p> <p><strong>OpenTelemetry (OTel) and OTLP.</strong> The tracer can now export traces directly via the OpenTelemetry Protocol (OTLP), bypassing the Datadog Agent entirely (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4600">#4600</a>, <a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4583">#4583</a>). OTel process context v2 (OTLP proto format) is supported (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4478">#4478</a>), and the <code>parentbased_always_on</code> sampler works in OTLP mode (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4567">#4567</a>).</p> <p><strong>Large Language Model (LLM) Observability.</strong> Prompt tracking is now available for LLMObs spans (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4608">#4608</a>). Experiment scope propagates from APM baggage into spans automatically (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4651">#4651</a>).</p> <p><strong>Profiler.</strong> An experimental goroutine leak profile is available as opt-in (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4420">#4420</a>). The goroutine wait profile type has been removed — this is a breaking change for anyone using it explicitly (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4589">#4589</a>).</p> <p><strong>HTTP and tracing.</strong> A new environment variable <code>DD_TRACE_HTTP_URL_QUERY_STRING_ALLOWLIST</code> lets you whitelist query string parameters to keep unredacted (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4562">#4562</a>). A new <code>tracer.StartSpanFromPropagatedContext</code> API simplifies span creation from propagated contexts (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4492">#4492</a>). AWS EventBridge max payload size is bumped to 1 MB (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4458">#4458</a>). Envoy Service Extensions integration gains Unix Domain Socket (UDS) support (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4463">#4463</a>).</p> <p><strong>OpenFeature.</strong> Flag evaluation metrics now emit via OTel Metrics (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4489">#4489</a>), with allocation key tagging (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4515">#4515</a>) and Remote Configuration (RC) integration via <code>FFE_FLAGS</code> subscription at tracer startup (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4495">#4495</a>).</p> <p><strong>Bug fixes.</strong> gorm now respects <code>DD_TRACE_REMOVE_INTEGRATION_SERVICE_NAMES_ENABLED</code> (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4618">#4618</a>). Redis and Valkey pipeline commands are joined with newlines, fixing agent obfuscation (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4593">#4593</a>). A race condition in HTTP client trace timings is resolved (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4591">#4591</a>). AppSec block responses now include a correct <code>Content-Length</code> header (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4496">#4496</a>), and spurious Remote Configuration errors are silenced when RC is disabled (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4612">#4612</a>). <code>ContextWithSpan</code> no longer panics on nil context (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4313">#4313</a>). The OTel bridge preserves keep/drop sampling decisions for unsampled spans (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4631">#4631</a>). User-provided DogStatsD addresses now correctly take priority over defaults (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4575">#4575</a>).</p> <p><strong>Performance.</strong> Trace ID hex encoding is cached (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4481">#4481</a>), the span metadata map is preallocated (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4541">#4541</a>), and locking is removed from both sampling priority access (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4546">#4546</a>) and the internal logger (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4547">#4547</a>) — reducing allocations and contention on hot paths.</p> <p><strong>CI Visibility.</strong> Bazel offline cache and payload-file modes are supported (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4503">#4503</a>). Known test pagination is implemented for large test suites (<a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4509">#4509</a>).</p> <h2>What's Changed</h2> <h3>Application Performance Monitoring (APM)</h3> <ul> <li>feat: collect service override source by <a href="https://github.com/raphaelgavache"><code>@raphaelgavache</code></a> in <a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4500">DataDog/dd-trace-go#4500</a></li> <li>feat: support service source for 19 integrations by <a href="https://github.com/raphaelgavache"><code>@raphaelgavache</code></a> in <a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4526">DataDog/dd-trace-go#4526</a></li> <li>feat: support service source for 13integrations by <a href="https://github.com/raphaelgavache"><code>@raphaelgavache</code></a> in <a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4534">DataDog/dd-trace-go#4534</a></li> <li>feat: add service source on 10 integrations by <a href="https://github.com/raphaelgavache"><code>@raphaelgavache</code></a> in <a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4540">DataDog/dd-trace-go#4540</a></li> <li>feat: force usage of ServiceWithSource in contrib by <a href="https://github.com/raphaelgavache"><code>@raphaelgavache</code></a> in <a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4549">DataDog/dd-trace-go#4549</a></li> <li>fix(eventbridge): update max payload size to 1m by <a href="https://github.com/Dogbu-cyber"><code>@Dogbu-cyber</code></a> in <a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4458">DataDog/dd-trace-go#4458</a></li> <li>feat(telemetry): add stable session identifier headers by <a href="https://github.com/khanayan123"><code>@khanayan123</code></a> in <a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4574">DataDog/dd-trace-go#4574</a></li> <li>feat: collect service source in client stats by <a href="https://github.com/raphaelgavache"><code>@raphaelgavache</code></a> in <a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4519">DataDog/dd-trace-go#4519</a></li> <li>feat: OTel process context v2 (otlp proto) by <a href="https://github.com/nsavoire"><code>@nsavoire</code></a> in <a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4478">DataDog/dd-trace-go#4478</a></li> <li>fix: join redis and valkey pipeline commands with newlines for correct agent obfuscation by <a href="https://github.com/rarguelloF"><code>@rarguelloF</code></a> in <a href="https://redirect.github.com/DataDog/dd-trace-go/pull/4593">DataDog/dd-trace-go#4593</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/DataDog/dd-trace-go/commit/2b2b2c2c9c420dcc5df24165681ed11c3f1c8438"><code>2b2b2c2</code></a> chore: make fix-modules && make generate</li> <li><a href="https://github.com/DataDog/dd-trace-go/commit/21438ed81625961b1393806128b142fa7e3829d7"><code>21438ed</code></a> internal/version: v2.8.1</li> <li><a href="https://github.com/DataDog/dd-trace-go/commit/0bc11f30cc930602a07c90a3b106b72bca13ecc0"><code>0bc11f3</code></a> internal/orchestrion/_integration: v2.8.1-rc.2</li> <li><a href="https://github.com/DataDog/dd-trace-go/commit/f17a712cf0ef081a42e1e972da5cb7d0d09fb1b5"><code>f17a712</code></a> orchestrion/all: v2.8.1-rc.2</li> <li><a href="https://github.com/DataDog/dd-trace-go/commit/1b8d8e59ef212bae8097c7025e13fcbb99a0e554"><code>1b8d8e5</code></a> internal/traceprof/traceproftest: v2.8.1-rc.2</li> <li><a href="https://github.com/DataDog/dd-trace-go/commit/7b30b1f0aec1bfd1f7f4a38edaccccd9c691c8fb"><code>7b30b1f</code></a> contrib/aws/datadog-lambda-go/test/integration_tests/error: v2.8.1-rc.2</li> <li><a href="https://github.com/DataDog/dd-trace-go/commit/96cc2a4c04453a99cba785cafe17ffb6e9a316a9"><code>96cc2a4</code></a> contrib/aws/datadog-lambda-go/test/integration_tests/hello: v2.8.1-rc.2</li> <li><a href="https://github.com/DataDog/dd-trace-go/commit/f3013b5aed4b2051a3da540cafeedbb05d4b89f9"><code>f3013b5</code></a> instrumentation/internal/validationtest: v2.8.1-rc.2</li> <li><a href="https://github.com/DataDog/dd-trace-go/commit/c9f98439255531363157d4f1b312c594c5ec10e6"><code>c9f9843</code></a> contrib/labstack/echo.v4: v2.8.1-rc.2</li> <li><a href="https://github.com/DataDog/dd-trace-go/commit/e07b30bb083cb5e2aba59f083319f921118d174a"><code>e07b30b</code></a> contrib/valyala/fasthttp: v2.8.1-rc.2</li> <li>Additional commits viewable in <a href="https://github.com/DataDog/dd-trace-go/compare/v2.0.0...v2.8.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/DataDog/dd-trace-go/v2&package-manager=go_modules&previous-version=2.0.0&new-version=2.8.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/coder/coder/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-15 23:40:09 +00:00
dependabot[bot]	295bce2611	chore: bump github.com/hashicorp/terraform-json from 0.27.2 to 0.28.0 (#27227 ) Bumps [github.com/hashicorp/terraform-json](https://github.com/hashicorp/terraform-json) from 0.27.2 to 0.28.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/hashicorp/terraform-json/releases">github.com/hashicorp/terraform-json's releases</a>.</em></p> <blockquote> <h2>v0.28.0</h2> <p>ENHANCEMENTS:</p> <ul> <li><code>plan</code>: Added "action_reason" data to resource changes described in a plan by <a href="https://github.com/renescheepers"><code>@renescheepers</code></a> in <a href="https://redirect.github.com/hashicorp/terraform-json/pull/200">hashicorp/terraform-json#200</a></li> <li><code>provider schema</code>: Added ability to parse state store schemas from a provider's schema by <a href="https://github.com/SarahFrench"><code>@SarahFrench</code></a> in <a href="https://redirect.github.com/hashicorp/terraform-json/pull/190">hashicorp/terraform-json#190</a> <ul> <li>This is related to an experimental feature that's still in development in Terraform core.</li> </ul> </li> <li><code>validate</code>: Added <code>Diagnostic.Address</code> data to diagnostics returned when validating configuration by <a href="https://github.com/bbasata"><code>@bbasata</code></a> in <a href="https://redirect.github.com/hashicorp/terraform-json/pull/204">hashicorp/terraform-json#204</a></li> </ul> <p>INTERNAL:</p> <ul> <li>test: Add tests for parsing logs from init commands, tests for parsing of RFC3339 timestamps with different levels of precision by <a href="https://github.com/SarahFrench"><code>@SarahFrench</code></a> in <a href="https://redirect.github.com/hashicorp/terraform-json/pull/180">hashicorp/terraform-json#180</a></li> <li>build(deps): bump actions/checkout from 5.0.0 to 6.0.0 in the github-actions-breaking group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/hashicorp/terraform-json/pull/182">hashicorp/terraform-json#182</a></li> <li>build(deps): bump actions/setup-go from 6.0.0 to 6.1.0 in the github-actions-backward-compatible group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/hashicorp/terraform-json/pull/183">hashicorp/terraform-json#183</a></li> <li>build(deps): bump github.com/hashicorp/go-version from 1.7.0 to 1.8.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/hashicorp/terraform-json/pull/184">hashicorp/terraform-json#184</a></li> <li>build(deps): bump actions/checkout from 6.0.0 to 6.0.1 in the github-actions-backward-compatible group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/hashicorp/terraform-json/pull/186">hashicorp/terraform-json#186</a></li> <li>build(deps): bump the github-actions-backward-compatible group across 1 directory with 2 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/hashicorp/terraform-json/pull/189">hashicorp/terraform-json#189</a></li> <li>Update copyright headers to IBM by <a href="https://github.com/radeksimko"><code>@radeksimko</code></a> in <a href="https://redirect.github.com/hashicorp/terraform-json/pull/192">hashicorp/terraform-json#192</a></li> <li>build(deps): bump actions/setup-go from 6.2.0 to 6.3.0 in the github-actions-backward-compatible group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/hashicorp/terraform-json/pull/194">hashicorp/terraform-json#194</a></li> <li>build(deps): bump actions/setup-go from 6.3.0 to 6.4.0 in the github-actions-backward-compatible group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/hashicorp/terraform-json/pull/195">hashicorp/terraform-json#195</a></li> <li>build(deps): bump github.com/hashicorp/go-version from 1.8.0 to 1.9.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/hashicorp/terraform-json/pull/196">hashicorp/terraform-json#196</a></li> <li>build(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions-backward-compatible group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/hashicorp/terraform-json/pull/199">hashicorp/terraform-json#199</a></li> <li>build(deps): bump actions/checkout from 6.0.3 to 7.0.0 in the github-actions-breaking group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/hashicorp/terraform-json/pull/201">hashicorp/terraform-json#201</a></li> <li>build(deps): bump actions/setup-go from 6.4.0 to 6.5.0 in the github-actions-backward-compatible group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/hashicorp/terraform-json/pull/202">hashicorp/terraform-json#202</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/helenjw"><code>@helenjw</code></a> made their first contribution in <a href="https://redirect.github.com/hashicorp/terraform-json/pull/179">hashicorp/terraform-json#179</a></li> <li><a href="https://github.com/renescheepers"><code>@renescheepers</code></a> made their first contribution in <a href="https://redirect.github.com/hashicorp/terraform-json/pull/200">hashicorp/terraform-json#200</a></li> <li><a href="https://github.com/bbasata"><code>@bbasata</code></a> made their first contribution in <a href="https://redirect.github.com/hashicorp/terraform-json/pull/204">hashicorp/terraform-json#204</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/hashicorp/terraform-json/compare/v0.27.2...v0.28.0">https://github.com/hashicorp/terraform-json/compare/v0.27.2...v0.28.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/hashicorp/terraform-json/commit/1e0dcb8caaf6c22e21bc6c042cb85b5467b670cf"><code>1e0dcb8</code></a> validate: add <code>Diagnostic.Address</code> (<a href="https://redirect.github.com/hashicorp/terraform-json/issues/204">#204</a>)</li> <li><a href="https://github.com/hashicorp/terraform-json/commit/34ea8d07cdb50ef7f326f3b448c847d83aa6543d"><code>34ea8d0</code></a> build(deps): bump actions/setup-go from 6.4.0 to 6.5.0 in the github-actions-...</li> <li><a href="https://github.com/hashicorp/terraform-json/commit/ff68feb930e6e451efa6a0d3a12814c6e6914b90"><code>ff68feb</code></a> Merge pull request <a href="https://redirect.github.com/hashicorp/terraform-json/issues/201">#201</a> from hashicorp/dependabot/github_actions/github-actio...</li> <li><a href="https://github.com/hashicorp/terraform-json/commit/f3efae01e492b24275fb33ca93c6130ee479c48f"><code>f3efae0</code></a> build(deps): bump actions/checkout in the github-actions-breaking group</li> <li><a href="https://github.com/hashicorp/terraform-json/commit/09661535096ac52ee85bc4d4968c0a629f1c60e8"><code>0966153</code></a> Merge pull request <a href="https://redirect.github.com/hashicorp/terraform-json/issues/200">#200</a> from renescheepers/rs/add-action-reason</li> <li><a href="https://github.com/hashicorp/terraform-json/commit/b4487cdd6112b7d1d0a4e270ec0f953ac9718d57"><code>b4487cd</code></a> Link ActionReason constants to Terraform's canonical enum</li> <li><a href="https://github.com/hashicorp/terraform-json/commit/eefb8b2ce8d8e1de832e1033408b3ccb122f73b5"><code>eefb8b2</code></a> Add ActionReason to ResourceChange</li> <li><a href="https://github.com/hashicorp/terraform-json/commit/5738e0ad057af2f241a1d79cbaeb9e52c451bfb3"><code>5738e0a</code></a> build(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions-...</li> <li><a href="https://github.com/hashicorp/terraform-json/commit/e77c39ee5a16d93861c6e3e99fd2aea148399e6d"><code>e77c39e</code></a> Merge pull request <a href="https://redirect.github.com/hashicorp/terraform-json/issues/196">#196</a> from hashicorp/dependabot/go_modules/github.com/hashi...</li> <li><a href="https://github.com/hashicorp/terraform-json/commit/703bd74a48e5461b40eeb5b5663f7f58be3fad52"><code>703bd74</code></a> build(deps): bump github.com/hashicorp/go-version from 1.8.0 to 1.9.0</li> <li>Additional commits viewable in <a href="https://github.com/hashicorp/terraform-json/compare/v0.27.2...v0.28.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/hashicorp/terraform-json&package-manager=go_modules&previous-version=0.27.2&new-version=0.28.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-14 11:20:24 +00:00
dependabot[bot]	20435f9f43	chore: bump the x group with 8 updates (#27223 ) Bumps the x group with 8 updates: \| Package \| From \| To \| \| --- \| --- \| --- \| \| [golang.org/x/crypto](https://github.com/golang/crypto) \| `0.53.0` \| `0.54.0` \| \| [golang.org/x/mod](https://github.com/golang/mod) \| `0.37.0` \| `0.38.0` \| \| [golang.org/x/net](https://github.com/golang/net) \| `0.56.0` \| `0.57.0` \| \| [golang.org/x/sync](https://github.com/golang/sync) \| `0.21.0` \| `0.22.0` \| \| [golang.org/x/sys](https://github.com/golang/sys) \| `0.46.0` \| `0.47.0` \| \| [golang.org/x/term](https://github.com/golang/term) \| `0.44.0` \| `0.45.0` \| \| [golang.org/x/text](https://github.com/golang/text) \| `0.39.0` \| `0.40.0` \| \| [golang.org/x/tools](https://github.com/golang/tools) \| `0.47.0` \| `0.48.0` \| Updates `golang.org/x/crypto` from 0.53.0 to 0.54.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/crypto/commit/cdce021fa6c7d9c7eb2743bfbe551f0a98fd5d62"><code>cdce021</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/crypto/commit/d9474cc4853d9ef1a29356975408d4771e5770c6"><code>d9474cc</code></a> openpgp: make the deprecation message more explicit</li> <li><a href="https://github.com/golang/crypto/commit/7626c5025624025bb44739a805f431cf93c06d6e"><code>7626c50</code></a> ssh: verify declared key type matches decoded key in authorized_keys</li> <li><a href="https://github.com/golang/crypto/commit/0471e7969e6740594dfe354646bf03e5e89de52d"><code>0471e79</code></a> ssh/agent: enforce strict limits on DSA key parameters</li> <li><a href="https://github.com/golang/crypto/commit/6435c37ab681759aff37ba751d0f2238b3043767"><code>6435c37</code></a> ssh: sanitize client disconnect messages</li> <li><a href="https://github.com/golang/crypto/commit/7d695da948bfa44ed6eedcebc8f43bcb50e94a57"><code>7d695da</code></a> ssh/agent: drain channel stderr in agent forwarders</li> <li><a href="https://github.com/golang/crypto/commit/5b7f84159940519e89df4d95465538c1797cee8b"><code>5b7f841</code></a> acme/autocert: fix data race in Manager.createCert</li> <li><a href="https://github.com/golang/crypto/commit/0b316e7ee409f8e5789a0535679d34155cecc75e"><code>0b316e7</code></a> argon2: update RFC 9106 parameter recommendations</li> <li><a href="https://github.com/golang/crypto/commit/55aec0a86b4c522b4f7366e69db55349e9f7ff5c"><code>55aec0a</code></a> x509roots/fallback: update bundle</li> <li><a href="https://github.com/golang/crypto/commit/5f2de1a9f1e29059fbb9f3d34321bd0da935556b"><code>5f2de1a</code></a> internal: remove wycheproof tests</li> <li>See full diff in <a href="https://github.com/golang/crypto/compare/v0.53.0...v0.54.0">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/mod` from 0.37.0 to 0.38.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/mod/commit/792ac169a90372d88fb14e712cb793061ba0c104"><code>792ac16</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/mod/commit/fe2ec04f7c3c3aa6fad97631aafcff6e49e2d1db"><code>fe2ec04</code></a> all: fix some comments to improve readability</li> <li>See full diff in <a href="https://github.com/golang/mod/compare/v0.37.0...v0.38.0">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/net` from 0.56.0 to 0.57.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/net/commit/b8f09f6f062ceb4531b7af4bd17a5c8fe9c4b2b5"><code>b8f09f6</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/net/commit/f05f21be5927155a88b371674c298ada54b71cf5"><code>f05f21b</code></a> idna: reject all-ASCII xn-- labels on all Go versions</li> <li><a href="https://github.com/golang/net/commit/0f748cfbba95084c87723e3b7eb7dad9241fc2dd"><code>0f748cf</code></a> internal/http3: clean up stream I/O methods usages in tests</li> <li><a href="https://github.com/golang/net/commit/0bb961e45132c680e2a0117e1df951538a19da61"><code>0bb961e</code></a> internal/http3: add net/http.ResponseController support</li> <li><a href="https://github.com/golang/net/commit/0ca694d2a5adcce7f36d4d65e5f8d72390d94051"><code>0ca694d</code></a> webdav: document Dir's lack of defense against filesystem modification</li> <li><a href="https://github.com/golang/net/commit/bd5f1dcf71cf0d6d2424021d0a04f191396a46a7"><code>bd5f1dc</code></a> http2: initialize Transport on NewClientConn</li> <li><a href="https://github.com/golang/net/commit/488ff63197ffddbcef2d01107f8a89906a4f28d1"><code>488ff63</code></a> bpf: add security considerations to package docs</li> <li><a href="https://github.com/golang/net/commit/93d1f25be95961edfdf488b9398e53fb9f05f193"><code>93d1f25</code></a> xsrftoken: avoid token collisions</li> <li><a href="https://github.com/golang/net/commit/5a3baee349e65853c34b4377bebe7676a64dbc87"><code>5a3baee</code></a> internal/http3: prevent panic in QPACK decoder due to overflow</li> <li>See full diff in <a href="https://github.com/golang/net/compare/v0.56.0...v0.57.0">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/sync` from 0.21.0 to 0.22.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/sync/commit/1eb64d4bc0cde6da1bb8ebc7f178bb577508e5d0"><code>1eb64d4</code></a> semaphore: panic on negative weights</li> <li>See full diff in <a href="https://github.com/golang/sync/compare/v0.21.0...v0.22.0">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/sys` from 0.46.0 to 0.47.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/sys/commit/9e7e939dcafac07e8ab4cffa6e5fc74908413f00"><code>9e7e939</code></a> cpu: handle vendor suffixes in parseRelease</li> <li><a href="https://github.com/golang/sys/commit/f6fb8a1e42b1731ca8f87ace29c3307429ecdb5a"><code>f6fb8a1</code></a> unix: use epoll_pwait rather than epoll_wait</li> <li><a href="https://github.com/golang/sys/commit/f3eeabfcab6a9a0585ddee7337d5ccfeebe576ed"><code>f3eeabf</code></a> windows: avoid length overflow in NewNTString</li> <li><a href="https://github.com/golang/sys/commit/3cb66475f895724679601e2580be904c8aaa5f7a"><code>3cb6647</code></a> unix: update glibc to 2.43</li> <li><a href="https://github.com/golang/sys/commit/c507910bb52510a2ae06048a4246ad0fe210a872"><code>c507910</code></a> windows: document safe usage of TrusteeValue</li> <li>See full diff in <a href="https://github.com/golang/sys/compare/v0.46.0...v0.47.0">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/term` from 0.44.0 to 0.45.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/term/commit/9f69229da31ca6a34b522f59dbe07cad5ea21587"><code>9f69229</code></a> go.mod: update golang.org/x dependencies</li> <li>See full diff in <a href="https://github.com/golang/term/compare/v0.44.0...v0.45.0">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/text` from 0.39.0 to 0.40.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/text/commit/724af9c35838492dcaacc1ac51a8a0187c994c54"><code>724af9c</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/text/commit/bf5b9d658a03d36bd3459b3babdb23a9f56038cb"><code>bf5b9d6</code></a> internal/export/idna: always treat Punycode encoding pure ASCII as an error</li> <li>See full diff in <a href="https://github.com/golang/text/compare/v0.39.0...v0.40.0">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/tools` from 0.47.0 to 0.48.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/tools/commit/05f9cb5d358503005bd6f82b17916d226ca7b210"><code>05f9cb5</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/tools/commit/745d7ae955f815a23f71eea6c5825e1a60308578"><code>745d7ae</code></a> gopls: add CompiledAsmFiles in cache.Package</li> <li><a href="https://github.com/golang/tools/commit/797ee67e8547c21742c14f38d01bf3e54dad6aad"><code>797ee67</code></a> go/ssa: make Const(unsafe.Pointer, nil).IsNil() true</li> <li><a href="https://github.com/golang/tools/commit/9751125d7187ef7b7f3e66c20925c2099be7e934"><code>9751125</code></a> gopls/internal/test: Completion benchmarks use empty range</li> <li><a href="https://github.com/golang/tools/commit/8786a967dbbb73b985c6345d652594422f995717"><code>8786a96</code></a> internal/stdlib: update stdlib index for Go 1.27 Release Candidate 2</li> <li><a href="https://github.com/golang/tools/commit/425085f6dee3cf40e111b5d2e8cc139ff52c55ee"><code>425085f</code></a> gopls/internal/server: modify return of parseAction</li> <li><a href="https://github.com/golang/tools/commit/30c4f871093496f7e4492bad5d49cac24587eeda"><code>30c4f87</code></a> go/analysis/passes/nilness: skip magic cgo functions</li> <li><a href="https://github.com/golang/tools/commit/9e6441dfc70bdc98114c748afe34d7cd49b2d0b0"><code>9e6441d</code></a> gopls/internal/protocol/generate: remove manual rename overwritten</li> <li><a href="https://github.com/golang/tools/commit/df9684197301c2e2c2a34a56a329f667fd93637b"><code>df96841</code></a> gopls/internal/protocol: use Debug log level</li> <li><a href="https://github.com/golang/tools/commit/278f0628682b5732f29a5ef0083c860de88c5b94"><code>278f062</code></a> gopls/internal/protocol: update to LSP 3.18</li> <li>Additional commits viewable in <a href="https://github.com/golang/tools/compare/v0.47.0...v0.48.0">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-14 11:20:11 +00:00
dependabot[bot]	26c8fc85a2	chore: bump github.com/prometheus/common from 0.69.0 to 0.70.0 (#27225 ) Bumps [github.com/prometheus/common](https://github.com/prometheus/common) from 0.69.0 to 0.70.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/prometheus/common/releases">github.com/prometheus/common's releases</a>.</em></p> <blockquote> <h2>v0.70.0</h2> <h2>What's Changed</h2> <ul> <li>config: fix TLSVersion.String() printing pointer address by <a href="https://github.com/s3onghyun"><code>@s3onghyun</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/929">prometheus/common#929</a></li> <li>build(deps): bump golang.org/x/net from 0.55.0 to 0.56.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/common/pull/933">prometheus/common#933</a></li> <li>Manually go mod tidy by <a href="https://github.com/SuperQ"><code>@SuperQ</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/934">prometheus/common#934</a></li> <li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@prombot</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/937">prometheus/common#937</a></li> <li>route: add support for the QUERY HTTP method by <a href="https://github.com/roidelapluie"><code>@roidelapluie</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/932">prometheus/common#932</a></li> <li>Combine and extend Prometheus text and OpenMetrics 1.0 encoder benchmarks by <a href="https://github.com/dashpole"><code>@dashpole</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/943">prometheus/common#943</a></li> <li>build(deps): bump the codeql group with 4 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/common/pull/938">prometheus/common#938</a></li> <li>build(deps): bump actions/setup-go from 6.2.0 to 6.5.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/common/pull/940">prometheus/common#940</a></li> <li>build(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/common/pull/942">prometheus/common#942</a></li> <li>build(deps): bump ossf/scorecard-action from 2.1.2 to 2.4.3 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/common/pull/939">prometheus/common#939</a></li> <li>build(deps): bump actions/checkout from 3.1.0 to 7.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/common/pull/941">prometheus/common#941</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/s3onghyun"><code>@s3onghyun</code></a> made their first contribution in <a href="https://redirect.github.com/prometheus/common/pull/929">prometheus/common#929</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/prometheus/common/compare/v0.69.0...v0.70.0">https://github.com/prometheus/common/compare/v0.69.0...v0.70.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/prometheus/common/blob/main/CHANGELOG.md">github.com/prometheus/common's changelog</a>.</em></p> <blockquote> <h2>v0.70.0 / 2026-07-10</h2> <h3>Enhancements</h3> <ul> <li>route: add support for the QUERY HTTP method. <a href="https://redirect.github.com/prometheus/common/issues/932">#932</a></li> </ul> <h3>Bugfixes</h3> <ul> <li>config: fix <code>TLSVersion.String()</code> printing a pointer address instead of the numeric version for unknown TLS versions. <a href="https://redirect.github.com/prometheus/common/issues/929">#929</a></li> </ul> <h3>Internal</h3> <ul> <li>expfmt: add <code>BenchmarkConvertMetricFamily</code> comparing the Prometheus text and OpenMetrics 1.0 encoders. <a href="https://redirect.github.com/prometheus/common/issues/943">#943</a></li> <li>Update Go dependencies. <a href="https://redirect.github.com/prometheus/common/issues/933">#933</a> <a href="https://redirect.github.com/prometheus/common/issues/934">#934</a></li> <li>Synchronize common files from prometheus/prometheus. <a href="https://redirect.github.com/prometheus/common/issues/923">#923</a> <a href="https://redirect.github.com/prometheus/common/issues/927">#927</a> <a href="https://redirect.github.com/prometheus/common/issues/930">#930</a> <a href="https://redirect.github.com/prometheus/common/issues/937">#937</a></li> <li>Update GitHub Actions. <a href="https://redirect.github.com/prometheus/common/issues/938">#938</a> <a href="https://redirect.github.com/prometheus/common/issues/939">#939</a> <a href="https://redirect.github.com/prometheus/common/issues/940">#940</a> <a href="https://redirect.github.com/prometheus/common/issues/941">#941</a> <a href="https://redirect.github.com/prometheus/common/issues/942">#942</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/prometheus/common/compare/v0.69.0...v0.70.0">https://github.com/prometheus/common/compare/v0.69.0...v0.70.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/prometheus/common/commit/5eff7a827920b6f175ea02b222f7c827a0fe80ad"><code>5eff7a8</code></a> Merge pull request <a href="https://redirect.github.com/prometheus/common/issues/941">#941</a> from prometheus/dependabot/github_actions/actions/che...</li> <li><a href="https://github.com/prometheus/common/commit/a23c5b344ad9200c0073133920fe60a9882c9d28"><code>a23c5b3</code></a> Merge pull request <a href="https://redirect.github.com/prometheus/common/issues/939">#939</a> from prometheus/dependabot/github_actions/ossf/scorec...</li> <li><a href="https://github.com/prometheus/common/commit/9e1eb871ced38b03648a38558ac3de66edeff2b5"><code>9e1eb87</code></a> Merge pull request <a href="https://redirect.github.com/prometheus/common/issues/942">#942</a> from prometheus/dependabot/github_actions/actions/upl...</li> <li><a href="https://github.com/prometheus/common/commit/ab2736d28a9fce77b0186e36b5d3318b74115298"><code>ab2736d</code></a> Merge pull request <a href="https://redirect.github.com/prometheus/common/issues/940">#940</a> from prometheus/dependabot/github_actions/actions/set...</li> <li><a href="https://github.com/prometheus/common/commit/e596873192a72855876b1c38cdb634bb73f5ba00"><code>e596873</code></a> Merge pull request <a href="https://redirect.github.com/prometheus/common/issues/938">#938</a> from prometheus/dependabot/github_actions/codeql-ac07...</li> <li><a href="https://github.com/prometheus/common/commit/97c066a87b2345f146b345141f0f14aaab7ad387"><code>97c066a</code></a> Add BenchmarkConvertMetricFamily comparing Prometheus text and OpenMetrics 1....</li> <li><a href="https://github.com/prometheus/common/commit/62e9d0f61d355b574225f66628a5f94be2bc1c29"><code>62e9d0f</code></a> Merge pull request <a href="https://redirect.github.com/prometheus/common/issues/932">#932</a> from roidelapluie/roidelapluie/route-query</li> <li><a href="https://github.com/prometheus/common/commit/6c312397a5da723c995ee9c16263f252c1d6b4a1"><code>6c31239</code></a> build(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1</li> <li><a href="https://github.com/prometheus/common/commit/755e9d686dec00400191cc8483872831aff1b9cd"><code>755e9d6</code></a> build(deps): bump actions/checkout from 3.1.0 to 7.0.0</li> <li><a href="https://github.com/prometheus/common/commit/556d7402ea9a80cab60297e4dc98149b5410e24f"><code>556d740</code></a> build(deps): bump actions/setup-go from 6.2.0 to 6.5.0</li> <li>Additional commits viewable in <a href="https://github.com/prometheus/common/compare/v0.69.0...v0.70.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/prometheus/common&package-manager=go_modules&previous-version=0.69.0&new-version=0.70.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-14 11:20:04 +00:00
dependabot[bot]	7470f072a2	chore: bump github.com/coreos/go-oidc/v3 from 3.19.0 to 3.20.0 (#27224 ) Bumps [github.com/coreos/go-oidc/v3](https://github.com/coreos/go-oidc) from 3.19.0 to 3.20.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/coreos/go-oidc/releases">github.com/coreos/go-oidc/v3's releases</a>.</em></p> <blockquote> <h2>v3.20.0</h2> <h2>What's Changed</h2> <ul> <li>oidc: modernize with new Go APIs by <a href="https://github.com/ericchiang"><code>@ericchiang</code></a> in <a href="https://redirect.github.com/coreos/go-oidc/pull/487">coreos/go-oidc#487</a></li> <li>oidc: improve documentation for APIs by <a href="https://github.com/ericchiang"><code>@ericchiang</code></a> in <a href="https://redirect.github.com/coreos/go-oidc/pull/488">coreos/go-oidc#488</a></li> <li>SECURITY.md: add a security policy and point to project-level reporting by <a href="https://github.com/ericchiang"><code>@ericchiang</code></a> in <a href="https://redirect.github.com/coreos/go-oidc/pull/489">coreos/go-oidc#489</a></li> <li>oidc: ignore JWKs with unknown signing algorithms rather than failing by <a href="https://github.com/ericchiang"><code>@ericchiang</code></a> in <a href="https://redirect.github.com/coreos/go-oidc/pull/491">coreos/go-oidc#491</a></li> <li>readme: update README and docs by <a href="https://github.com/ericchiang"><code>@ericchiang</code></a> in <a href="https://redirect.github.com/coreos/go-oidc/pull/492">coreos/go-oidc#492</a></li> <li>oidc: add API for determining when issuer URLs mismatch by <a href="https://github.com/ericchiang"><code>@ericchiang</code></a> in <a href="https://redirect.github.com/coreos/go-oidc/pull/493">coreos/go-oidc#493</a></li> <li>oidc: add constants for "email" and "profile" scopes by <a href="https://github.com/ericchiang"><code>@ericchiang</code></a> in <a href="https://redirect.github.com/coreos/go-oidc/pull/494">coreos/go-oidc#494</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/coreos/go-oidc/compare/v3.19.0...v3.20.0">https://github.com/coreos/go-oidc/compare/v3.19.0...v3.20.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/coreos/go-oidc/commit/75dfa5c0626c48e0ad8b761fdd9e1dc51cb8498a"><code>75dfa5c</code></a> oidc: add constants for "email" and "profile" scopes</li> <li><a href="https://github.com/coreos/go-oidc/commit/a89f0468ccc8e531b54f469053674a12c2258c72"><code>a89f046</code></a> oidc: add API for determining when issuer URLs mismatch</li> <li><a href="https://github.com/coreos/go-oidc/commit/6a69b6d27e137b9919e468417e438b02c51a54b2"><code>6a69b6d</code></a> readme: update README and docs</li> <li><a href="https://github.com/coreos/go-oidc/commit/f9049c99079786740d492714fb33b671464312dd"><code>f9049c9</code></a> oidc: ignore JWKs with unknown signing algorithms rather than failing</li> <li><a href="https://github.com/coreos/go-oidc/commit/2f178e0a9df71f65464a9a8d25c388e798303323"><code>2f178e0</code></a> SECURITY.md: add a security policy and point to project-level reporting</li> <li><a href="https://github.com/coreos/go-oidc/commit/b3bc7daa5743acd0b6c604ad7e5c9b609b6d39f4"><code>b3bc7da</code></a> oidc: improve documentation for APIs</li> <li><a href="https://github.com/coreos/go-oidc/commit/0db90530b3f5ab1808b26365441e366926b86f0b"><code>0db9053</code></a> oidc: modernize with new Go APIs</li> <li>See full diff in <a href="https://github.com/coreos/go-oidc/compare/v3.19.0...v3.20.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/coreos/go-oidc/v3&package-manager=go_modules&previous-version=3.19.0&new-version=3.20.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-14 11:19:52 +00:00
dependabot[bot]	ce846fc401	chore: bump google.golang.org/api from 0.287.0 to 0.288.0 (#27226 ) Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.287.0 to 0.288.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's releases</a>.</em></p> <blockquote> <h2>v0.288.0</h2> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.287.1...v0.288.0">0.288.0</a> (2026-07-09)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3647">#3647</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/510a0c19483ea5631b7b0a453f9d6df1b9ef596a">510a0c1</a>)</li> </ul> <h2>v0.287.1</h2> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.287.0...v0.287.1">0.287.1</a> (2026-07-07)</h2> <h3>Documentation</h3> <ul> <li>Remove old TODO file (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3645">#3645</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/9d7a6b8ba7ca7fda1fda4373714a8aff1e930e6f">9d7a6b8</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.287.1...v0.288.0">0.288.0</a> (2026-07-09)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3647">#3647</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/510a0c19483ea5631b7b0a453f9d6df1b9ef596a">510a0c1</a>)</li> </ul> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.287.0...v0.287.1">0.287.1</a> (2026-07-07)</h2> <h3>Documentation</h3> <ul> <li>Remove old TODO file (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3645">#3645</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/9d7a6b8ba7ca7fda1fda4373714a8aff1e930e6f">9d7a6b8</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/googleapis/google-api-go-client/commit/31d2afed7eb393f33e56bdbaf0b17bc7c5345abc"><code>31d2afe</code></a> chore(main): release 0.288.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3648">#3648</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/510a0c19483ea5631b7b0a453f9d6df1b9ef596a"><code>510a0c1</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3647">#3647</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/93d63e8234f46095c363aff86b433c750ccd7332"><code>93d63e8</code></a> chore(main): release 0.287.1 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3646">#3646</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/9d7a6b8ba7ca7fda1fda4373714a8aff1e930e6f"><code>9d7a6b8</code></a> docs: remove old TODO file (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3645">#3645</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/576018ff14470f5cf33aa1a1d388d219a5291e40"><code>576018f</code></a> chore(all): update all (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3644">#3644</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/cc70265cdfbc6c3d6ccbd7b068ff70a9c3695893"><code>cc70265</code></a> chore(deps): bump golang.org/x/net in /internal/kokoro/discogen (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3642">#3642</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/9858f66b46ba1fdea7dacf1a02b47c0881e2c27a"><code>9858f66</code></a> chore: downgrade go version in go.work (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3641">#3641</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/3cb00c0ab3ced21614ceb1f8e3e664f6d8ff7712"><code>3cb00c0</code></a> chore: downgrade min Go version (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3640">#3640</a>)</li> <li>See full diff in <a href="https://github.com/googleapis/google-api-go-client/compare/v0.287.0...v0.288.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/api&package-manager=go_modules&previous-version=0.287.0&new-version=0.288.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-14 11:19:41 +00:00
Denis Afonso	553c9ecbc8	fix: bump Go version from 1.26.4 to 1.26.5 (#27157 ) ## Summary Bump Go toolchain from 1.26.4 to 1.26.5. Go 1.26.5 ([released 2026-07-07](https://go.dev/doc/devel/release#go1.26.5)) includes security fixes addressing: - [CVE-2026-39822](https://nvd.nist.gov/vuln/detail/CVE-2026-39822) — `os` package - [CVE-2026-42505](https://nvd.nist.gov/vuln/detail/CVE-2026-42505) — `crypto/tls` package These were flagged by the IronBank scan of `coder/coder-enterprise/coder-service-2:2.34.5`. ## Changes - `go.mod`: `go 1.26.4` to `go 1.26.5` (language version floor) - `mise.toml` / `mise.lock`: Go toolchain pin 1.26.4 to 1.26.5 (this is what actually compiles the scanned artifact and clears the CVEs) ## Related - #27159 — backport to `release/2.35` - #27158 — backport to `release/2.34` Linear: ENT-129	2026-07-14 12:49:05 +02:00
Michael Suchacz	f84801eecf	chore: bump coder/fantasy for gpt-5.6 Responses routing (#27132 ) gpt-5.6 models were unusable with agents: fantasy's Responses allowlist did not include the new family, so `IsResponsesModel` returned false and chatd fell back to the Chat Completions path (no reasoning params, no encrypted reasoning continuity). ## Changes - Bump the `charm.land/fantasy` replace pin to coder/fantasy `6da0c3b10237` (coder_2_33), pulling in: - coder/fantasy#46: route `gpt-5.6-sol`, `gpt-5.6-terra`, `gpt-5.6-luna` through the OpenAI Responses API as reasoning models. - coder/fantasy#41: surface Anthropic refusal stop_reason as content-filter (already on coder_2_33, rides along with the bump). - Update the fork changelog comment in go.mod. ## Verification - Probed all three gpt-5.6 models through the ai-gateway: `/v1/responses` with `reasoning.effort`, `include: ["reasoning.encrypted_content"]`, and `store: false` completes for each. - `go build ./coderd/...` and `go test ./coderd/x/chatd/chatopenai/ ./coderd/x/chatd/chatprovider/` pass against the new pin. > This PR was authored by Mux on Mike's behalf.	2026-07-09 18:25:34 +00:00
Danny Kopping	f2e8d72100	chore: apply openai-go bugfix to fix openrouter response parsing (#27092 ) Applies https://github.com/coder/openai-go/pull/3 Closes https://github.com/coder/coder/issues/26469 `kylecarbs/openai-go` was renamed to `coder/openai-go` I've created a [branch](https://github.com/coder/openai-go/tree/coder/pinned) to track the changes we've made. We're far behind `main` now, so we should make an effort to update this as some point. I've manually tested using OpenRouter + GLM 5.2 as the bug report states and it works fine. <img width="824" height="321" alt="image" src="https://github.com/user-attachments/assets/804c527a-3a59-43bd-91c8-3b9bfb48df81" /> <img width="927" height="149" alt="image" src="https://github.com/user-attachments/assets/35829bc2-5597-430c-8ede-bb2ebabc73a5" /> <details> ``` : OPENROUTER PROCESSING : OPENROUTER PROCESSING : OPENROUTER PROCESSING : OPENROUTER PROCESSING : OPENROUTER PROCESSING : OPENROUTER PROCESSING : OPENROUTER PROCESSING : OPENROUTER PROCESSING : OPENROUTER PROCESSING : OPENROUTER PROCESSING : OPENROUTER PROCESSING : OPENROUTER PROCESSING : OPENROUTER PROCESSING : OPENROUTER PROCESSING : OPENROUTER PROCESSING : OPENROUTER PROCESSING data: {"id":"gen-1783515596-pm90JeoPBXFHqVq3dDlL","object":"chat.completion.chunk","created":1783515596,"model":"z-ai/glm-5.2-20260616","provider":"Novita","choices":[{"index":0,"delta":{"content":"Yep","role":"assistant"},"finish_reason":null,"native_finish_reason":null}]} data: {"id":"gen-1783515596-pm90JeoPBXFHqVq3dDlL","object":"chat.completion.chunk","created":1783515596,"model":"z-ai/glm-5.2-20260616","provider":"Novita","choices":[{"index":0,"delta":{"content":", I","role":"assistant"},"finish_reason":null,"native_finish_reason":null}]} data: {"id":"gen-1783515596-pm90JeoPBXFHqVq3dDlL","object":"chat.completion.chunk","created":1783515596,"model":"z-ai/glm-5.2-20260616","provider":"Novita","choices":[{"index":0,"delta":{"content":"'m here","role":"assistant"},"finish_reason":null,"native_finish_reason":null}]} data: {"id":"gen-1783515596-pm90JeoPBXFHqVq3dDlL","object":"chat.completion.chunk","created":1783515596,"model":"z-ai/glm-5.2-20260616","provider":"Novita","choices":[{"index":0,"delta":{"content":". What","role":"assistant"},"finish_reason":null,"native_finish_reason":null}]} data: {"id":"gen-1783515596-pm90JeoPBXFHqVq3dDlL","object":"chat.completion.chunk","created":1783515596,"model":"z-ai/glm-5.2-20260616","provider":"Novita","choices":[{"index":0,"delta":{"content":" do you","role":"assistant"},"finish_reason":null,"native_finish_reason":null}]} : OPENROUTER PROCESSING data: {"id":"gen-1783515596-pm90JeoPBXFHqVq3dDlL","object":"chat.completion.chunk","created":1783515596,"model":"z-ai/glm-5.2-20260616","provider":"Novita","choices":[{"index":0,"delta":{"content":" need?","role":"assistant"},"finish_reason":null,"native_finish_reason":null}]} data: {"id":"gen-1783515596-pm90JeoPBXFHqVq3dDlL","object":"chat.completion.chunk","created":1783515596,"model":"z-ai/glm-5.2-20260616","provider":"Novita","choices":[{"index":0,"delta":{"content":"","role":"assistant"},"finish_reason":"stop","native_finish_reason":"stop"}]} data: {"id":"gen-1783515596-pm90JeoPBXFHqVq3dDlL","object":"chat.completion.chunk","created":1783515596,"model":"z-ai/glm-5.2-20260616","provider":"Novita","service_tier":null,"choices":[{"index":0,"delta":{"content":"","role":"assistant"},"finish_reason":"stop","native_finish_reason":"stop"}],"usage":{"prompt_tokens":4855,"completion_tokens":13,"total_tokens":4868,"cost":0.00479794,"is_byok":false,"prompt_tokens_details":{"cached_tokens":0,"cache_write_tokens":0,"audio_tokens":0,"video_tokens":0},"cost_details":{"upstream_inference_cost":0.00479794,"upstream_inference_prompt_cost":0.0047579,"upstream_inference_completions_cost":0.00004004},"completion_tokens_details":{"reasoning_tokens":0,"image_tokens":0,"audio_tokens":0}}} data: [DONE] ``` </details> Signed-off-by: Danny Kopping <danny@coder.com>	2026-07-08 13:36:42 +00:00
dependabot[bot]	fd77652993	chore: bump github.com/zclconf/go-cty from 1.18.1 to 1.19.0 (#27053 ) Bumps [github.com/zclconf/go-cty](https://github.com/zclconf/go-cty) from 1.18.1 to 1.19.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/zclconf/go-cty/blob/main/CHANGELOG.md">github.com/zclconf/go-cty's changelog</a>.</em></p> <blockquote> <h1>1.19.0 (July 6, 2026)</h1> <ul> <li>When building with Go 1.27 or later, the various string operations that are defined in terms of UAX#29 grapheme cluster segmentation will now use the Unicode 17 character properties and rules. For older versions of Go, Unicode 15 is still used.</li> <li>The <code>cty.ValueMarks</code> type, which represents a set of value marks separately from any value, now has method <code>Has</code> for concisely testing if a specific mark is present, and <code>Insert</code> for inserting elements from an <code>iter.Seq[any]</code> into an existing set of marks for easier gradual construction without creating any temporary mark sets.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/zclconf/go-cty/commit/749fb01316b34f996526dc0a799b54ee008436a8"><code>749fb01</code></a> v1.19.0</li> <li><a href="https://github.com/zclconf/go-cty/commit/f6d59fa6af526d7ef9a296ee0fee01ccd3c64840"><code>f6d59fa</code></a> ValueMarks.Has and ValueMarks.Insert</li> <li><a href="https://github.com/zclconf/go-cty/commit/db1a4101f6f4a1ecd63bf25bfd53e7709a2e7e0b"><code>db1a410</code></a> Use Unicode 17 text segmentation rules on Go 1.27</li> <li><a href="https://github.com/zclconf/go-cty/commit/c8df66764124f2e53f491d4d4a4620c13e3b914d"><code>c8df667</code></a> json: Compensate for different JSON error message in Go1.27</li> <li><a href="https://github.com/zclconf/go-cty/commit/9d8f06e30ed204b49a68845101c48c8d439f598b"><code>9d8f06e</code></a> convert: Fix incorrect format string in TestSortTypes</li> <li>See full diff in <a href="https://github.com/zclconf/go-cty/compare/v1.18.1...v1.19.0">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-07 11:36:29 +00:00
dependabot[bot]	7b5efe0e14	chore: bump google.golang.org/api from 0.286.0 to 0.287.0 (#27056 ) Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.286.0 to 0.287.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's releases</a>.</em></p> <blockquote> <h2>v0.287.0</h2> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.286.0...v0.287.0">0.287.0</a> (2026-06-30)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3635">#3635</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/504873e45d4a0993065311ed3f6a0467f2c41ab1">504873e</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3637">#3637</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/5c975bee9f05d3c570eb0d95be248f3cb418739f">5c975be</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3639">#3639</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/9737c4bf678023b300958b55d1548a902ff36c5d">9737c4b</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.286.0...v0.287.0">0.287.0</a> (2026-06-30)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3635">#3635</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/504873e45d4a0993065311ed3f6a0467f2c41ab1">504873e</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3637">#3637</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/5c975bee9f05d3c570eb0d95be248f3cb418739f">5c975be</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3639">#3639</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/9737c4bf678023b300958b55d1548a902ff36c5d">9737c4b</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/googleapis/google-api-go-client/commit/1a444d6fac14a1652ec4a1e0d9eba6fb1bda7045"><code>1a444d6</code></a> chore(main): release 0.287.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3636">#3636</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/9737c4bf678023b300958b55d1548a902ff36c5d"><code>9737c4b</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3639">#3639</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/f0d27e84fd7323958b8700c2da4b496d96561a3d"><code>f0d27e8</code></a> chore(all): update all (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3638">#3638</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/5c975bee9f05d3c570eb0d95be248f3cb418739f"><code>5c975be</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3637">#3637</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/504873e45d4a0993065311ed3f6a0467f2c41ab1"><code>504873e</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3635">#3635</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/8f8eab49770458a0890a0dde6780568a99057776"><code>8f8eab4</code></a> chore(all): update all to 87f3d3e (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3633">#3633</a>)</li> <li>See full diff in <a href="https://github.com/googleapis/google-api-go-client/compare/v0.286.0...v0.287.0">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-07 11:36:20 +00:00
dependabot[bot]	c9109247e9	chore: bump google.golang.org/grpc from 1.81.1 to 1.82.0 (#27054 ) Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.81.1 to 1.82.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/grpc/grpc-go/releases">google.golang.org/grpc's releases</a>.</em></p> <blockquote> <h2>Release 1.82.0</h2> <h1>Behavior Changes</h1> <ul> <li>server: Remove support for <code>GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING</code> environment varibale. Strict incoming RPC path validation (which has been the default since <code>v1.79.3</code>) can no longer be disabled. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9112">#9112</a>)</li> <li>transport: Add environment variable to change the default max header list size from <code>16MB</code> to <code>8KB</code>. This may be enabled by setting <code>GRPC_GO_EXPERIMENTAL_ENABLE_8KB_DEFAULT_HEADER_LIST_SIZE=true</code>. This will be enabled by default in a subsequent release. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9019">#9019</a>)</li> <li>balancer: Load Balancing policy registry is now case-sensitive. Set <code>GRPC_GO_EXPERIMENTAL_CASE_SENSITIVE_BALANCER_REGISTRIES=false</code> (and file an issue) to revert to case-insensitive behavior. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9017">#9017</a>)</li> </ul> <h1>New Features</h1> <ul> <li>experimental/stats: Expose a new API, <code>NewContextWithLabelCallback</code>, to register a callback that is invoked when telemetry labels are added. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8877">#8877</a>) <ul> <li>Special Thanks: <a href="https://github.com/seth-epps"><code>@seth-epps</code></a></li> </ul> </li> <li>client: Return a portion of the response body in the error message, when the client receives an unexpected non-gRPC HTTP response, to make debugging easier. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8929">#8929</a>) <ul> <li>Special Thanks: <a href="https://github.com/chengxilo"><code>@chengxilo</code></a></li> </ul> </li> <li>server: Add environment variable <code>GRPC_GO_SERVER_GOROUTINE_LABELS</code> that controls setting <code>runtime/pprof.Labels</code> on goroutines spawned by the server. Set <code>GRPC_GO_SERVER_GOROUTINE_LABELS=grpc.method=true</code> to add the <code>grpc.method</code> label on goroutines spawned to handle incoming requests. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9082">#9082</a>) <ul> <li>Special Thanks: <a href="https://github.com/dfinkel"><code>@dfinkel</code></a></li> </ul> </li> </ul> <h1>Bug Fixes</h1> <ul> <li>xds/server: Fix a memory leak of HTTP filter instances occurring when route configurations are updated in-place during a Route Discovery Service (RDS) update. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9138">#9138</a>)</li> <li>grpc: In the deprecated <code>gzip</code> Compressor (used via the deprecated <code>WithCompressor</code> dial option), enforce the <code>MaxRecvMsgSize</code> limit on the decompressed message buffer, preventing excessive memory allocation from highly compressed payloads. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9114">#9114</a>) <ul> <li>Special Thanks: <a href="https://github.com/evilgensec"><code>@evilgensec</code></a></li> </ul> </li> <li>stats/opentelemetry: Record retry attempts, <code>grpc.previous-rpc-attempts</code>, at the call level and not the attempt level. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8923">#8923</a>)</li> <li>encoding: Ensure <code>Close()</code> is always called on readers returned from <code>Compressor.Decompress</code> if possible. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9135">#9135</a>)</li> <li>channelz: Fix the <code>LastMessageSentTimestamp</code> and <code>LastMessageReceivedTimestamp</code> fields in <code>SocketMetrics</code> to ensure they contain correct timestamp values. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9109">#9109</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/grpc/grpc-go/commit/bd239854f0ab7f1ee63457d47f7c1d2675e1f736"><code>bd23985</code></a> Change version to 1.82.0 (<a href="https://redirect.github.com/grpc/grpc-go/issues/9170">#9170</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/0f3086db7a755b6af83a90809471dd7f645b345a"><code>0f3086d</code></a> Fix minor issues not covered by PR <a href="https://redirect.github.com/grpc/grpc-go/issues/9137">#9137</a> (<a href="https://redirect.github.com/grpc/grpc-go/issues/9147">#9147</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/fef07fbb2b94b668e8daca1f6b70433dcd36c1c8"><code>fef07fb</code></a> internal: Split v3procservicepb import into pb and grpc for extproc (<a href="https://redirect.github.com/grpc/grpc-go/issues/9163">#9163</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/91dd64f4b83cb5134e279d1126ebb1ccf47d4d31"><code>91dd64f</code></a> transport: surface subsequent data when receiving non-gRPC header (<a href="https://redirect.github.com/grpc/grpc-go/issues/8929">#8929</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/adc97de9521a9f377dab5e911039842dc4de23e5"><code>adc97de</code></a> test/kokoro: add config for regional-td test (<a href="https://redirect.github.com/grpc/grpc-go/issues/9158">#9158</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/57c9ff14e05b535ee6995ba49bc882b287a175de"><code>57c9ff1</code></a> xds: ensure full-string matching for RBAC Filter rules (<a href="https://redirect.github.com/grpc/grpc-go/issues/9148">#9148</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/b58f32d9ff07c612d64e677bd826bcbec88af9bd"><code>b58f32d</code></a> server: Set a pprof label on new stream goroutines (<a href="https://redirect.github.com/grpc/grpc-go/issues/9082">#9082</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/6c98be31ce0aec1592b783b0edb16916eb5acd89"><code>6c98be3</code></a> refactor(transport): extract shared stream state handling logic in `loopyWrit...</li> <li><a href="https://github.com/grpc/grpc-go/commit/bcaa6f4df4546c86e12ef3e95852c7baf7a08d67"><code>bcaa6f4</code></a> rls: only reset backoff on recovery from TRANSIENT_FAILURE (<a href="https://redirect.github.com/grpc/grpc-go/issues/9137">#9137</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/429e6e06363a01f0dd9f9b6b9cf0c0e6617cda12"><code>429e6e0</code></a> balancer: expose endpoint weight and hostname as experimental APIs (<a href="https://redirect.github.com/grpc/grpc-go/issues/9074">#9074</a>)</li> <li>Additional commits viewable in <a href="https://github.com/grpc/grpc-go/compare/v1.81.1...v1.82.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/grpc&package-manager=go_modules&previous-version=1.81.1&new-version=1.82.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-07 11:20:21 +00:00
dependabot[bot]	10d9ad0fc0	chore: bump github.com/go-chi/httprate from 0.15.0 to 0.16.0 (#27055 ) [//]: # (dependabot-start) ⚠️ Dependabot is rebasing this PR ⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Bumps [github.com/go-chi/httprate](https://github.com/go-chi/httprate) from 0.15.0 to 0.16.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-chi/httprate/releases">github.com/go-chi/httprate's releases</a>.</em></p> <blockquote> <h2>v0.16.0</h2> <h2>What's Changed</h2> <ul> <li>perf: replace fmt with strconv to reduce allocations by <a href="https://github.com/EricGusmao"><code>@EricGusmao</code></a> in <a href="https://redirect.github.com/go-chi/httprate/pull/55">go-chi/httprate#55</a></li> <li>local counter: align windows to reset at sub-millisecond counter start by <a href="https://github.com/VojtechVitek"><code>@VojtechVitek</code></a> in <a href="https://redirect.github.com/go-chi/httprate/pull/58">go-chi/httprate#58</a></li> <li>test: drop golang.org/x/sync dependency (errgroup → sync.WaitGroup) by <a href="https://github.com/VojtechVitek"><code>@VojtechVitek</code></a> in <a href="https://redirect.github.com/go-chi/httprate/pull/59">go-chi/httprate#59</a></li> <li>perf: use zero-alloc xxh3.HashString on the local counter hot path by <a href="https://github.com/VojtechVitek"><code>@VojtechVitek</code></a> in <a href="https://redirect.github.com/go-chi/httprate/pull/60">go-chi/httprate#60</a></li> <li>Deprecate spoofable RealIP rate-limiting; add LimitBy + KeyFromContext and modernize the key API by <a href="https://github.com/VojtechVitek"><code>@VojtechVitek</code></a> in <a href="https://redirect.github.com/go-chi/httprate/pull/61">go-chi/httprate#61</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/EricGusmao"><code>@EricGusmao</code></a> made their first contribution in <a href="https://redirect.github.com/go-chi/httprate/pull/55">go-chi/httprate#55</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-chi/httprate/compare/v0.15.0...v0.16.0">https://github.com/go-chi/httprate/compare/v0.15.0...v0.16.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-chi/httprate/commit/741b4a550f982dab146dee10f2b154b01c06facd"><code>741b4a5</code></a> Deprecate spoofable RealIP rate-limiting; add LimitBy + KeyFromContext and mo...</li> <li><a href="https://github.com/go-chi/httprate/commit/81255de73f43306ad57c9cf01693a7d5172678df"><code>81255de</code></a> perf: use zero-alloc xxh3.HashString on the local counter hot path (<a href="https://redirect.github.com/go-chi/httprate/issues/60">#60</a>)</li> <li><a href="https://github.com/go-chi/httprate/commit/0c2093ae43d739627fba9eb197280f97f460c611"><code>0c2093a</code></a> test: replace golang.org/x/sync/errgroup with sync.WaitGroup (<a href="https://redirect.github.com/go-chi/httprate/issues/59">#59</a>)</li> <li><a href="https://github.com/go-chi/httprate/commit/89e5cca2fbfd6645307b73a15b69a979d4c1dcf4"><code>89e5cca</code></a> local counter: align windows to reset at sub-millisecond counter start (<a href="https://redirect.github.com/go-chi/httprate/issues/58">#58</a>)</li> <li><a href="https://github.com/go-chi/httprate/commit/be2ba84c12680b356b271bdf6104c9b465f3c1de"><code>be2ba84</code></a> replace fmt with strconv to reduce allocations (<a href="https://redirect.github.com/go-chi/httprate/issues/55">#55</a>)</li> <li>See full diff in <a href="https://github.com/go-chi/httprate/compare/v0.15.0...v0.16.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-chi/httprate&package-manager=go_modules&previous-version=0.15.0&new-version=0.16.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-07 11:20:04 +00:00
dependabot[bot]	dfef6ae0a7	chore: bump github.com/aws/aws-sdk-go-v2/service/sts from 1.43.3 to 1.44.0 (#27052 ) Bumps [github.com/aws/aws-sdk-go-v2/service/sts](https://github.com/aws/aws-sdk-go-v2) from 1.43.3 to 1.44.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/fa3ee1a83b9edac9669159650622bcfe3003b44c"><code>fa3ee1a</code></a> Release 2023-11-21</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/6e0c553b49b1fd84753d3ea440be93011d36cf40"><code>6e0c553</code></a> Regenerated Clients</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/32fa00b32e99f9004aadc5750d508a9393d03d57"><code>32fa00b</code></a> Update endpoints model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/72eae5c284e11b1f167fe17282ae1ee821a11659"><code>72eae5c</code></a> Update API model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/1c69d08daccf94d9114d2463adc02e59e85b4deb"><code>1c69d08</code></a> fix: don't expect response to be json in endpointcreds provider (<a href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/2381">#2381</a>)</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/3bd97c063d962a34ca496720a3ce00ef4affe5fd"><code>3bd97c0</code></a> fix: don't send 0 max items for object version and multipart upload paginator...</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/b3e07aa0a0dd26ec46095c28ce65301da2e78dba"><code>b3e07aa</code></a> Release 2023-11-20</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/2fc1c0dab14dff82fc2c2465cb7c40a4157196a0"><code>2fc1c0d</code></a> Regenerated Clients</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/1a6bd026243230178e775059d27038c0ced194ea"><code>1a6bd02</code></a> Update endpoints model</li> <li><a href="https://github.com/aws/aws-sdk-go-v2/commit/ac2c871bff4a9fbb6284f1dcc061fdcabea346f3"><code>ac2c871</code></a> Update API model</li> <li>Additional commits viewable in <a href="https://github.com/aws/aws-sdk-go-v2/compare/service/amp/v1.43.3...service/s3/v1.44.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/aws/aws-sdk-go-v2/service/sts&package-manager=go_modules&previous-version=1.43.3&new-version=1.44.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-07 11:19:17 +00:00
dependabot[bot]	4dade44e72	chore: bump github.com/go-chi/chi/v5 from 5.2.4 to 5.3.1 (#27051 ) Bumps [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) from 5.2.4 to 5.3.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-chi/chi/releases">github.com/go-chi/chi/v5's releases</a>.</em></p> <blockquote> <h2>v5.3.1</h2> <h2>What's Changed</h2> <ul> <li>Honor Discard() in httpFancyWriter.ReadFrom by <a href="https://github.com/DucMinhNe"><code>@DucMinhNe</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1110">go-chi/chi#1110</a></li> <li>Tidy build directives by <a href="https://github.com/JRaspass"><code>@JRaspass</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1113">go-chi/chi#1113</a></li> <li>feat(middleware): add text/xml and application/xml to default compressible types by <a href="https://github.com/VojtechVitek"><code>@VojtechVitek</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1127">go-chi/chi#1127</a></li> <li>Fix defaultLogEntry.Panic not respecting NoColor setting by <a href="https://github.com/doganarif"><code>@doganarif</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1050">go-chi/chi#1050</a></li> <li>middleware: document printPrettyStack and harden NoColor panic test by <a href="https://github.com/VojtechVitek"><code>@VojtechVitek</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1131">go-chi/chi#1131</a></li> <li>feat(mux): support http QUERY method ietf rfc10008 by <a href="https://github.com/VojtechVitek"><code>@VojtechVitek</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1132">go-chi/chi#1132</a></li> <li>ci: pin GitHub Actions to full commit SHAs by <a href="https://github.com/XananasX7"><code>@XananasX7</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1116">go-chi/chi#1116</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/DucMinhNe"><code>@DucMinhNe</code></a> made their first contribution in <a href="https://redirect.github.com/go-chi/chi/pull/1110">go-chi/chi#1110</a></li> <li><a href="https://github.com/doganarif"><code>@doganarif</code></a> made their first contribution in <a href="https://redirect.github.com/go-chi/chi/pull/1050">go-chi/chi#1050</a></li> <li><a href="https://github.com/XananasX7"><code>@XananasX7</code></a> made their first contribution in <a href="https://redirect.github.com/go-chi/chi/pull/1116">go-chi/chi#1116</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-chi/chi/compare/v5.3.0...v5.3.1">https://github.com/go-chi/chi/compare/v5.3.0...v5.3.1</a></p> <h2>v5.3.0</h2> <h2>What's Changed</h2> <ul> <li>Use strings.ReplaceAll where applicable by <a href="https://github.com/JRaspass"><code>@JRaspass</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1046">go-chi/chi#1046</a></li> <li>Propagate inline middlewares across mounted subrouters by <a href="https://github.com/LukasJenicek"><code>@LukasJenicek</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1049">go-chi/chi#1049</a></li> <li>add go 1.26 to ci by <a href="https://github.com/pkieltyka"><code>@pkieltyka</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1052">go-chi/chi#1052</a></li> <li>Remove last uses of io/ioutil by <a href="https://github.com/JRaspass"><code>@JRaspass</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1054">go-chi/chi#1054</a></li> <li>Simplify chi.walk with slices.Concat by <a href="https://github.com/JRaspass"><code>@JRaspass</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1053">go-chi/chi#1053</a></li> <li>Apply the stringscutprefix modernizer by <a href="https://github.com/JRaspass"><code>@JRaspass</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1051">go-chi/chi#1051</a></li> <li>Bump minimum Go to 1.23, always use request.Pattern by <a href="https://github.com/JRaspass"><code>@JRaspass</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1048">go-chi/chi#1048</a></li> <li>middleware: fix httpFancyWriter.ReadFrom double-counting bytes with Tee by <a href="https://github.com/alliasgher"><code>@alliasgher</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1085">go-chi/chi#1085</a></li> <li>Fix typo in Route doc comment by <a href="https://github.com/gouwazi"><code>@gouwazi</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1073">go-chi/chi#1073</a></li> <li>fix: set Request.Pattern from RoutePattern() by <a href="https://github.com/leno23"><code>@leno23</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/1097">go-chi/chi#1097</a></li> <li>feat: middleware.ClientIP, a replacement for middleware.RealIP by <a href="https://github.com/VojtechVitek"><code>@VojtechVitek</code></a> in <a href="https://redirect.github.com/go-chi/chi/pull/967">go-chi/chi#967</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/LukasJenicek"><code>@LukasJenicek</code></a> made their first contribution in <a href="https://redirect.github.com/go-chi/chi/pull/1049">go-chi/chi#1049</a></li> <li><a href="https://github.com/alliasgher"><code>@alliasgher</code></a> made their first contribution in <a href="https://redirect.github.com/go-chi/chi/pull/1085">go-chi/chi#1085</a></li> <li><a href="https://github.com/gouwazi"><code>@gouwazi</code></a> made their first contribution in <a href="https://redirect.github.com/go-chi/chi/pull/1073">go-chi/chi#1073</a></li> <li><a href="https://github.com/leno23"><code>@leno23</code></a> made their first contribution in <a href="https://redirect.github.com/go-chi/chi/pull/1097">go-chi/chi#1097</a></li> </ul> <h2>SECURITY: middleware.ClientIP, a replacement for middleware.RealIP</h2> <p><a href="https://github.com/VojtechVitek"><code>@VojtechVitek</code></a> submitted PR <a href="https://redirect.github.com/go-chi/chi/issues/967">#967</a>, which introduces middleware.ClientIP — a replacement for middleware.RealIP that closes the three open spoofing advisories:</p> <ul> <li><a href="https://github.com/go-chi/chi/security/advisories/GHSA-9g5q-2w5x-hmxf">GHSA-9g5q-2w5x-hmxf</a> — IP spoofing via XFF in <code>RemoteAddr</code> resolution (convto)</li> <li><a href="https://github.com/go-chi/chi/security/advisories/GHSA-rjr7-jggh-pgcp">GHSA-rjr7-jggh-pgcp</a> — RealIP allows IP spoofing via unvalidated XFF (rezmoss)</li> <li><a href="https://github.com/go-chi/chi/security/advisories/GHSA-3fxj-6jh8-hvhx">GHSA-3fxj-6jh8-hvhx</a> — IP spoofing in <code>middleware.RealIP</code> (Saku0512, Critical / 9.3)</li> </ul> <p>It also addresses issues outlined at:</p> <ul> <li><a href="https://redirect.github.com/go-chi/chi/issues/708">go-chi/chi#708</a></li> <li><a href="https://adam-p.ca/blog/2022/03/x-forwarded-for/">https://adam-p.ca/blog/2022/03/x-forwarded-for/</a></li> <li><a href="https://redirect.github.com/go-chi/chi/issues/711">go-chi/chi#711</a></li> <li><a href="https://redirect.github.com/go-chi/chi/issues/453">go-chi/chi#453</a></li> <li><a href="https://redirect.github.com/go-chi/chi/pull/908">go-chi/chi#908</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-chi/chi/commit/8b258c7bb28f97a5f2a856ff7ef962578fec9215"><code>8b258c7</code></a> ci: pin GitHub Actions to full commit SHAs (<a href="https://redirect.github.com/go-chi/chi/issues/1116">#1116</a>)</li> <li><a href="https://github.com/go-chi/chi/commit/caf87e6e1bd9f29326f2ffdb93d8098139f08e4f"><code>caf87e6</code></a> feat(mux): support http QUERY method ietf rfc10008 (<a href="https://redirect.github.com/go-chi/chi/issues/1132">#1132</a>)</li> <li><a href="https://github.com/go-chi/chi/commit/7fcb8a20364d7b72e2d5a0e413ae80346e1c99c8"><code>7fcb8a2</code></a> middleware: document printPrettyStack and harden NoColor panic test (<a href="https://redirect.github.com/go-chi/chi/issues/1131">#1131</a>)</li> <li><a href="https://github.com/go-chi/chi/commit/878fe71fc9e506a63ea6957ed09c9ce84f789e97"><code>878fe71</code></a> Fix defaultLogEntry.Panic not respecting NoColor setting (<a href="https://redirect.github.com/go-chi/chi/issues/1050">#1050</a>)</li> <li><a href="https://github.com/go-chi/chi/commit/d7b767bcbea51e486bdc9fd06d25136767ec14b5"><code>d7b767b</code></a> feat(middleware): add text/xml and application/xml to default compressible ty...</li> <li><a href="https://github.com/go-chi/chi/commit/3b50c7cc35ff25f384202409733c3332c150e0ec"><code>3b50c7c</code></a> Tidy build directives (<a href="https://redirect.github.com/go-chi/chi/issues/1113">#1113</a>)</li> <li><a href="https://github.com/go-chi/chi/commit/2b9fca258f92830fc8232582e9e05a4d4a572a5d"><code>2b9fca2</code></a> Honor Discard() in httpFancyWriter.ReadFrom (<a href="https://redirect.github.com/go-chi/chi/issues/1110">#1110</a>)</li> <li><a href="https://github.com/go-chi/chi/commit/3b171578ca44dfd75ca3c5cbddc7b44c600a7b49"><code>3b17157</code></a> feat: middleware.ClientIP, a replacement for middleware.RealIP (<a href="https://redirect.github.com/go-chi/chi/issues/967">#967</a>)</li> <li><a href="https://github.com/go-chi/chi/commit/818fdcfc4786168651768377ba647cf9dd5b3953"><code>818fdcf</code></a> fix: set Request.Pattern from RoutePattern() (<a href="https://redirect.github.com/go-chi/chi/issues/1097">#1097</a>)</li> <li><a href="https://github.com/go-chi/chi/commit/f975af0cb10cbefaccf0422385420fe62722d648"><code>f975af0</code></a> Fix typo in Route doc comment (<a href="https://redirect.github.com/go-chi/chi/issues/1073">#1073</a>)</li> <li>Additional commits viewable in <a href="https://github.com/go-chi/chi/compare/v5.2.4...v5.3.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-chi/chi/v5&package-manager=go_modules&previous-version=5.2.4&new-version=5.3.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-07 11:18:07 +00:00
dependabot[bot]	242a10585c	chore: bump github.com/klauspost/compress from 1.18.6 to 1.19.0 (#27050 ) Bumps [github.com/klauspost/compress](https://github.com/klauspost/compress) from 1.18.6 to 1.19.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/klauspost/compress/releases">github.com/klauspost/compress's releases</a>.</em></p> <blockquote> <h2>v1.19.0</h2> <h2>What's Changed</h2> <ul> <li>zstd: Add true concurrent stream encoding by <a href="https://github.com/klauspost"><code>@klauspost</code></a> in <a href="https://redirect.github.com/klauspost/compress/pull/1136">klauspost/compress#1136</a></li> <li>zstd: arm64 decoder asm by <a href="https://github.com/lizthegrey"><code>@lizthegrey</code></a> in <a href="https://redirect.github.com/klauspost/compress/pull/1160">klauspost/compress#1160</a></li> <li>zstd: avoid unused BuildDict encoder allocation by <a href="https://github.com/snissn"><code>@snissn</code></a> in <a href="https://redirect.github.com/klauspost/compress/pull/1147">klauspost/compress#1147</a></li> <li>flate: Add inflate checkpoints by <a href="https://github.com/klauspost"><code>@klauspost</code></a> in <a href="https://redirect.github.com/klauspost/compress/pull/1154">klauspost/compress#1154</a></li> <li>snappy/s2: Limit length of varint in <code>decodedLen</code> by <a href="https://github.com/eustas"><code>@eustas</code></a> in <a href="https://redirect.github.com/klauspost/compress/pull/1148">klauspost/compress#1148</a></li> <li>gzhttp: match qvalue parameter case-insensitively (RFC 7231) by <a href="https://github.com/z9z"><code>@z9z</code></a> in <a href="https://redirect.github.com/klauspost/compress/pull/1149">klauspost/compress#1149</a></li> <li>zip: add NameDecoder callback for legacy encoding rewrite by <a href="https://github.com/SAY-5"><code>@SAY-5</code></a> in <a href="https://redirect.github.com/klauspost/compress/pull/1150">klauspost/compress#1150</a></li> <li>huff0: Allow building tables from histogram. by <a href="https://github.com/klauspost"><code>@klauspost</code></a> in <a href="https://redirect.github.com/klauspost/compress/pull/1155">klauspost/compress#1155</a></li> <li>huff0: Allow building table from oversized histogram. by <a href="https://github.com/klauspost"><code>@klauspost</code></a> in <a href="https://redirect.github.com/klauspost/compress/pull/1156">klauspost/compress#1156</a></li> <li>s2sx: Clean symlink targets by <a href="https://github.com/klauspost"><code>@klauspost</code></a> in <a href="https://redirect.github.com/klauspost/compress/pull/1163">klauspost/compress#1163</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/snissn"><code>@snissn</code></a> made their first contribution in <a href="https://redirect.github.com/klauspost/compress/pull/1147">klauspost/compress#1147</a></li> <li><a href="https://github.com/eustas"><code>@eustas</code></a> made their first contribution in <a href="https://redirect.github.com/klauspost/compress/pull/1148">klauspost/compress#1148</a></li> <li><a href="https://github.com/z9z"><code>@z9z</code></a> made their first contribution in <a href="https://redirect.github.com/klauspost/compress/pull/1149">klauspost/compress#1149</a></li> <li><a href="https://github.com/SAY-5"><code>@SAY-5</code></a> made their first contribution in <a href="https://redirect.github.com/klauspost/compress/pull/1150">klauspost/compress#1150</a></li> <li><a href="https://github.com/HNO3Miracle"><code>@HNO3Miracle</code></a> made their first contribution in <a href="https://redirect.github.com/klauspost/compress/pull/1165">klauspost/compress#1165</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/klauspost/compress/compare/v1.18.6...v1.19.0">https://github.com/klauspost/compress/compare/v1.18.6...v1.19.0</a></p> <h2>v1.18.7</h2> <ul> <li>Fix s2.NewDict OOB read.</li> </ul> <p>Security release without other changes.</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/klauspost/compress/compare/v1.18.6...v1.18.7">https://github.com/klauspost/compress/compare/v1.18.6...v1.18.7</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/klauspost/compress/commit/f0953f938f77977980c3b9f8c09eec06f2e88a69"><code>f0953f9</code></a> flate: fix buffer formatting in tests (<a href="https://redirect.github.com/klauspost/compress/issues/1165">#1165</a>)</li> <li><a href="https://github.com/klauspost/compress/commit/ab2e3cc7ab261c8f287639760d8532afb7125425"><code>ab2e3cc</code></a> zstd: Add arm64 decoder asm (<a href="https://redirect.github.com/klauspost/compress/issues/1160">#1160</a>)</li> <li><a href="https://github.com/klauspost/compress/commit/bb2723d55de85353fd5a1817cbc382997a6a75aa"><code>bb2723d</code></a> Merge commit from fork</li> <li><a href="https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536"><code>539243b</code></a> s2sx: Clean symlink targets (<a href="https://redirect.github.com/klauspost/compress/issues/1163">#1163</a>)</li> <li><a href="https://github.com/klauspost/compress/commit/bd9228c884559c21e572a0eaf827ee903bca805c"><code>bd9228c</code></a> Apply go fix and check in CI (<a href="https://redirect.github.com/klauspost/compress/issues/1158">#1158</a>)</li> <li><a href="https://github.com/klauspost/compress/commit/4cc176c3325ba1d87aacfdea015a3a2038fefb08"><code>4cc176c</code></a> zstd: Add true concurrent stream encoding (<a href="https://redirect.github.com/klauspost/compress/issues/1136">#1136</a>)</li> <li><a href="https://github.com/klauspost/compress/commit/4705fcbaf5155f466ca877527f66e88634cdf1c2"><code>4705fcb</code></a> build(deps): bump the github-actions group with 3 updates (<a href="https://redirect.github.com/klauspost/compress/issues/1157">#1157</a>)</li> <li><a href="https://github.com/klauspost/compress/commit/e9c2e569c112ecc1ad8ab818ed7328e7178973e4"><code>e9c2e56</code></a> huff0: Allow building table from oversized histogram. (<a href="https://redirect.github.com/klauspost/compress/issues/1156">#1156</a>)</li> <li><a href="https://github.com/klauspost/compress/commit/ecdb779d8745b0b074dcee75d9f7fd2bd524aff8"><code>ecdb779</code></a> huff0: Allow building tables from histogram. (<a href="https://redirect.github.com/klauspost/compress/issues/1155">#1155</a>)</li> <li><a href="https://github.com/klauspost/compress/commit/38efa458d47cc5555ce4a08796ddf2bf5ca22d87"><code>38efa45</code></a> zip: add NameDecoder callback for legacy encoding rewrite (<a href="https://redirect.github.com/klauspost/compress/issues/1150">#1150</a>)</li> <li>Additional commits viewable in <a href="https://github.com/klauspost/compress/compare/v1.18.6...v1.19.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/klauspost/compress&package-manager=go_modules&previous-version=1.18.6&new-version=1.19.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-07 11:17:50 +00:00
dependabot[bot]	a575899f47	chore: bump golang.org/x/text from 0.38.0 to 0.39.0 in the x group (#27049 ) Bumps the x group with 1 update: [golang.org/x/text](https://github.com/golang/text). Updates `golang.org/x/text` from 0.38.0 to 0.39.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/text/commit/b326f3d3c814ab79b3c516f4ac03c2314d8df65f"><code>b326f3d</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/text/commit/5ae8e578e495731553eddba11b2d0e86c91a00ce"><code>5ae8e57</code></a> unicode/norm: avoid infinite loop on invalid input</li> <li><a href="https://github.com/golang/text/commit/0dc94a239c8bc3b7ef3aa0d059e54af960f459f4"><code>0dc94a2</code></a> all: fix some comments</li> <li>See full diff in <a href="https://github.com/golang/text/compare/v0.38.0...v0.39.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/text&package-manager=go_modules&previous-version=0.38.0&new-version=0.39.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-07 11:17:43 +00:00
Sas Swart	fc188fdaee	fix: create agent firewall sessions without requiring agent read access (#26990 ) ## Overview Part of the boundary correlation feature. Fixes lazy creation of `boundary_sessions` rows so it works within the agent's RBAC constraints, and consumes the new `ConfinedProcessName` field reported by boundary. Pairs with coder/boundary#206, which adds `ConfinedProcessName` to `ReportBoundaryLogsRequest`. This branch bumps the `github.com/coder/boundary` module to pick up that work. ## Problem `ensureSession` did a pre-insert existence check via `GetBoundarySessionByID`. Agents are not permitted to read boundary sessions, so that read path is not viable when the session is created from an agent-reported log batch. ## Changes - Remove the pre-insert read. `ensureSession` now inserts directly and treats a primary-key unique violation as success, covering sessions already created by a prior batch, a reconnection, or another coderd replica — without requiring read access. - Per-connection guard. Add a mutex-protected `ensuredSessions` set so repeated log batches on the same connection skip the existence check and insert entirely, touching the database only for the logs. On a transient insert failure the session is left unmarked so the next batch retries. - Consume `ConfinedProcessName`. Pass `req.GetConfinedProcessName()` through to the session insert. - Bump boundary module from `v0.9.0` to `v0.9.1-0.20260706095856-35ba90f9e8b2`. - Tests. - Add `TestReportBoundaryLogsAgentRBAC` (`coderd/boundary_logs_test.go`), an integration test that connects as a real workspace agent, verifies the session and log are persisted under agent RBAC, and asserts the agent subject cannot read boundary sessions — guarding against reintroducing a pre-insert read. - Add `TestReportBoundaryLogsSessionGuard` (session inserted once across two batches, logs inserted per batch) and `TestReportBoundaryLogsSessionRetriedOnError` (insert retried after a transient error). - Regenerate `agent-firewall` CLI docs/golden files and adjust the clidocgen template to render the YAML path when a flag has no long name. > 🤖 This PR was opened by Coder Agents on behalf of @SasSwart.	2026-07-07 10:42:01 +00:00
Denis Afonso	f77d0065ed	fix: correct gvisor replace directive to match module path (#26822 ) ## Summary Fixes the gvisor `replace` directive in `go.mod` to target the correct module path. ## Problem PR #23055 added a replace directive to use the coder/gvisor fork (which fixes an integer overflow causing `panic: length < 0` crashes). However, the directive targeted the wrong module path: ``` replace gvisor.dev => github.com/coder/gvisor v0.0.0-20260313164934-7a658db7b714 ``` The actual module path declared in gvisor's `go.mod` is `gvisor.dev/gvisor`, not `gvisor.dev`. Go module replace directives require an exact module path match, so the previous directive was a no-op and the patched fork was never used. ## Fix ```diff -replace gvisor.dev => github.com/coder/gvisor v0.0.0-20260313164934-7a658db7b714 +replace gvisor.dev/gvisor => github.com/coder/gvisor v0.0.0-20260313164934-7a658db7b714 ``` ## Validation Verified locally with `go list -m`: Before (no-op replace): ``` $ go list -m gvisor.dev/gvisor gvisor.dev/gvisor v0.0.0-20240509041132-65b30f7869dc ``` After (correct replace): ``` $ go list -m gvisor.dev/gvisor gvisor.dev/gvisor v0.0.0-20240509041132-65b30f7869dc => github.com/coder/gvisor v0.0.0-20260313164934-7a658db7b714 ``` The `=>` confirms the fork is now applied. Fixes https://github.com/coder/coder/issues/20885 --- <details> <summary>Investigation context</summary> - The coder/gvisor fork (commit `7a658db7b714`) declares `module gvisor.dev/gvisor` in its go.mod - Customer runtime stack traces show `gvisor.dev/gvisor@v0.0.0-20240509041132-65b30f7869dc` (unpatched upstream), confirming the fork was not applied - The crash is `panic: length < 0` in `gvisor.dev/gvisor/pkg/tcpip/transport/tcp.(sender).splitSeg` - Related Linear ticket: ENT-118 </details> --- Generated by [Coder Agents](https://coder.com/agents) on behalf of @denisra*	2026-07-01 17:11:47 +01:00
dependabot[bot]	681d77154b	chore: bump github.com/valyala/fasthttp from 1.71.0 to 1.72.0 (#26859 ) Bumps [github.com/valyala/fasthttp](https://github.com/valyala/fasthttp) from 1.71.0 to 1.72.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/valyala/fasthttp/releases">github.com/valyala/fasthttp's releases</a>.</em></p> <blockquote> <h2>v1.72.0</h2> <h2>What's Changed</h2> <ul> <li>Update to go1.25 as minimal version by <a href="https://github.com/erikdubbelboer"><code>@erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2205">valyala/fasthttp#2205</a></li> <li>client: add aggregate connection count metrics by <a href="https://github.com/z9z"><code>@z9z</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2201">valyala/fasthttp#2201</a></li> <li>fix(server): return ErrMissingFile when MultipartForm.File is nil by <a href="https://github.com/u5surf"><code>@u5surf</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2260">valyala/fasthttp#2260</a></li> <li>bug: FS cache cleaner goroutine leaks when CleanStop is nil (default) (<a href="https://redirect.github.com/valyala/fasthttp/issues/2218">#2218</a>), <a href="https://redirect.github.com/valyala/fasthttp/issues/2247">#2247</a> by <a href="https://github.com/erikdubbelboer"><code>@erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2271">valyala/fasthttp#2271</a></li> <li>bug: data race on pipeline client c.chR during worker drain (<a href="https://redirect.github.com/valyala/fasthttp/issues/2220">#2220</a>) by <a href="https://github.com/erikdubbelboer"><code>@erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2272">valyala/fasthttp#2272</a></li> <li>bug: TCPDialer.tcpAddrsClean() goroutine leaks — no shutdown mechanism (<a href="https://redirect.github.com/valyala/fasthttp/issues/2222">#2222</a>) by <a href="https://github.com/erikdubbelboer"><code>@erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2273">valyala/fasthttp#2273</a></li> <li>bug: double concurrency counter increment in ServeConn causes counter leak (<a href="https://redirect.github.com/valyala/fasthttp/issues/2238">#2238</a>) by <a href="https://github.com/erikdubbelboer"><code>@erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2275">valyala/fasthttp#2275</a></li> <li>bug: body stream leak in compression methods when response is discarded (<a href="https://redirect.github.com/valyala/fasthttp/issues/2244">#2244</a>) by <a href="https://github.com/erikdubbelboer"><code>@erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2276">valyala/fasthttp#2276</a></li> <li>bug: InMemoryListener deadlock under high concurrency (<a href="https://redirect.github.com/valyala/fasthttp/issues/2245">#2245</a>) by <a href="https://github.com/erikdubbelboer"><code>@erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2277">valyala/fasthttp#2277</a></li> <li>bug: fasthttpadaptor writer leak, data race, and crash on handler panic (<a href="https://redirect.github.com/valyala/fasthttp/issues/2246">#2246</a>) by <a href="https://github.com/erikdubbelboer"><code>@erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2278">valyala/fasthttp#2278</a></li> <li>bug: fasthttpproxy dialers return nil DialFunc on error, causing panic (<a href="https://redirect.github.com/valyala/fasthttp/issues/2248">#2248</a>) by <a href="https://github.com/erikdubbelboer"><code>@erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2279">valyala/fasthttp#2279</a></li> <li>bug: closeIdleConns TOCTOU race with serveConn idle timestamp (<a href="https://redirect.github.com/valyala/fasthttp/issues/2250">#2250</a>) by <a href="https://github.com/erikdubbelboer"><code>@erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2280">valyala/fasthttp#2280</a></li> <li>bug: AppendCert/AppendCertEmbed not thread-safe (<a href="https://redirect.github.com/valyala/fasthttp/issues/2251">#2251</a>) by <a href="https://github.com/erikdubbelboer"><code>@erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2281">valyala/fasthttp#2281</a></li> <li>bug: SetBodySizePoolLimit data race — plain int written without synchronization (<a href="https://redirect.github.com/valyala/fasthttp/issues/2252">#2252</a>) by <a href="https://github.com/erikdubbelboer"><code>@erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2282">valyala/fasthttp#2282</a></li> <li>bug: file descriptor leak in prefork parent process (<a href="https://redirect.github.com/valyala/fasthttp/issues/2253">#2253</a>) by <a href="https://github.com/erikdubbelboer"><code>@erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2283">valyala/fasthttp#2283</a></li> <li>security: SO_REUSEADDR on Windows enables port hijacking (<a href="https://redirect.github.com/valyala/fasthttp/issues/2254">#2254</a>) by <a href="https://github.com/erikdubbelboer"><code>@erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2284">valyala/fasthttp#2284</a></li> <li>bug: file descriptor leak on z/OS s390x when FcntlInt fails (<a href="https://redirect.github.com/valyala/fasthttp/issues/2255">#2255</a>) by <a href="https://github.com/erikdubbelboer"><code>@erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2285">valyala/fasthttp#2285</a></li> <li>bug: filesLockMap grows unboundedly, leaking memory (<a href="https://redirect.github.com/valyala/fasthttp/issues/2256">#2256</a>) by <a href="https://github.com/erikdubbelboer"><code>@erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2286">valyala/fasthttp#2286</a></li> <li>security: TLS verification silently disabled for malformed addresses (<a href="https://redirect.github.com/valyala/fasthttp/issues/2236">#2236</a>) by <a href="https://github.com/erikdubbelboer"><code>@erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2274">valyala/fasthttp#2274</a></li> <li>fix(fs): remove temporary file when compression fails by <a href="https://github.com/u5surf"><code>@u5surf</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2264">valyala/fasthttp#2264</a></li> <li>fix double release of streamed client response body by <a href="https://github.com/Mereng"><code>@Mereng</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2211">valyala/fasthttp#2211</a></li> <li>fix(client): switch to GET on 303 redirect per RFC 9110 by <a href="https://github.com/u5surf"><code>@u5surf</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2265">valyala/fasthttp#2265</a></li> <li>ci: re-enable gocritic deferInLoop check for non-test code by <a href="https://github.com/u5surf"><code>@u5surf</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2288">valyala/fasthttp#2288</a></li> <li>Fix flaky race tests by <a href="https://github.com/erikdubbelboer"><code>@erikdubbelboer</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2292">valyala/fasthttp#2292</a></li> <li>fix(lbclient): prevent deadlock when all clients are removed by <a href="https://github.com/u5surf"><code>@u5surf</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2287">valyala/fasthttp#2287</a></li> <li>reject duplicate Content-Length in response header parser by <a href="https://github.com/alhudz"><code>@alhudz</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2294">valyala/fasthttp#2294</a></li> <li>strip cr/lf from header keys in normalizeHeaderKey by <a href="https://github.com/alhudz"><code>@alhudz</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2295">valyala/fasthttp#2295</a></li> <li>fix(client): guard nil waiter in decConnsCount by <a href="https://github.com/SAY-5"><code>@SAY-5</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2266">valyala/fasthttp#2266</a></li> <li>strip semicolons from cookie setters to block attribute injection by <a href="https://github.com/alhudz"><code>@alhudz</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2298">valyala/fasthttp#2298</a></li> <li>feat(prefork): graceful shutdown, leak fixes, hook robustness (re-open of <a href="https://redirect.github.com/valyala/fasthttp/issues/2180">#2180</a> follow-up) by <a href="https://github.com/ReneWerner87"><code>@ReneWerner87</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2199">valyala/fasthttp#2199</a></li> <li>fix: prevent data race on FSCompressedFileSuffixes map by <a href="https://github.com/xbrxr03"><code>@xbrxr03</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2300">valyala/fasthttp#2300</a></li> <li>reject duplicate Transfer-Encoding in request header parser by <a href="https://github.com/alhudz"><code>@alhudz</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2303">valyala/fasthttp#2303</a></li> <li>preserve duplicate request headers in ConvertRequest by <a href="https://github.com/alhudz"><code>@alhudz</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2305">valyala/fasthttp#2305</a></li> <li>fix(server): close listener on serve error in ListenAndServe helpers by <a href="https://github.com/fereidani"><code>@fereidani</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2304">valyala/fasthttp#2304</a></li> <li>validate trailer values in parseTrailer by <a href="https://github.com/alhudz"><code>@alhudz</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2301">valyala/fasthttp#2301</a></li> <li>Avoid default content type for empty requests by <a href="https://github.com/nkgotcode"><code>@nkgotcode</code></a> in <a href="https://redirect.github.com/valyala/fasthttp/pull/2296">valyala/fasthttp#2296</a></li> <li>chore(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2210">valyala/fasthttp#2210</a></li> <li>chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2209">valyala/fasthttp#2209</a></li> <li>chore(deps): bump golang.org/x/sys from 0.44.0 to 0.45.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2208">valyala/fasthttp#2208</a></li> <li>chore(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2207">valyala/fasthttp#2207</a></li> <li>chore(deps): bump securego/gosec from 2.26.1 to 2.27.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2261">valyala/fasthttp#2261</a></li> <li>chore(deps): bump securego/gosec from 2.27.0 to 2.27.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2267">valyala/fasthttp#2267</a></li> <li>chore(deps): bump golang.org/x/sys from 0.45.0 to 0.46.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2289">valyala/fasthttp#2289</a></li> <li>chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2290">valyala/fasthttp#2290</a></li> <li>chore(deps): bump golang.org/x/net from 0.55.0 to 0.56.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2291">valyala/fasthttp#2291</a></li> <li>chore(deps): bump actions/checkout from 6 to 7 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/valyala/fasthttp/pull/2297">valyala/fasthttp#2297</a></li> </ul> <h2>New Contributors</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/valyala/fasthttp/commit/37a31d78c5d221b24b9cb6652481b5acd4dd674f"><code>37a31d7</code></a> Avoid default content type for empty requests (<a href="https://redirect.github.com/valyala/fasthttp/issues/2296">#2296</a>)</li> <li><a href="https://github.com/valyala/fasthttp/commit/d93cb94af2c31641d00025140785609ddd746eb3"><code>d93cb94</code></a> validate trailer values in parseTrailer (<a href="https://redirect.github.com/valyala/fasthttp/issues/2301">#2301</a>)</li> <li><a href="https://github.com/valyala/fasthttp/commit/9d21d3546ab1d8422b0b5b2801e46aef568619ce"><code>9d21d35</code></a> Remove unused uint322ip, inline ip2uint32</li> <li><a href="https://github.com/valyala/fasthttp/commit/eb82c9a13addbe488f69cbf530444bb2561fd083"><code>eb82c9a</code></a> Reject invalid cookie values during parsing</li> <li><a href="https://github.com/valyala/fasthttp/commit/598e2e06218dbcaf4da6b3723477effd9d7b6233"><code>598e2e0</code></a> fix(server): close listener on serve error in ListenAndServe helpers (<a href="https://redirect.github.com/valyala/fasthttp/issues/2304">#2304</a>)</li> <li><a href="https://github.com/valyala/fasthttp/commit/134a8fedab6eb02fda4b8d96c48d2a72082d2e0c"><code>134a8fe</code></a> preserve duplicate request headers in ConvertRequest (<a href="https://redirect.github.com/valyala/fasthttp/issues/2305">#2305</a>)</li> <li><a href="https://github.com/valyala/fasthttp/commit/7bca504536636cf77726f3018365626a8b975b5f"><code>7bca504</code></a> reject duplicate Transfer-Encoding in request header parser (<a href="https://redirect.github.com/valyala/fasthttp/issues/2303">#2303</a>)</li> <li><a href="https://github.com/valyala/fasthttp/commit/9ee3c15997f8ab21519c2728017e9fbff03fe142"><code>9ee3c15</code></a> docs: document FSCompressedFileSuffixes is not safe for concurrent modificati...</li> <li><a href="https://github.com/valyala/fasthttp/commit/2c1590038fa5d0e04896c8b0aafc138ce286bfa7"><code>2c15900</code></a> feat(prefork): graceful shutdown, leak fixes, hook robustness (re-open of <a href="https://redirect.github.com/valyala/fasthttp/issues/21">#21</a>...</li> <li><a href="https://github.com/valyala/fasthttp/commit/ec58c6e67ee8f608a673cc01f07f045d04fa17b5"><code>ec58c6e</code></a> strip semicolons from cookie setters to block attribute injection (<a href="https://redirect.github.com/valyala/fasthttp/issues/2298">#2298</a>)</li> <li>Additional commits viewable in <a href="https://github.com/valyala/fasthttp/compare/v1.71.0...v1.72.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/valyala/fasthttp&package-manager=go_modules&previous-version=1.71.0&new-version=1.72.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-30 11:18:33 +00:00
dependabot[bot]	33780758c1	chore: bump github.com/open-policy-agent/opa from 1.17.0 to 1.18.1 (#26858 ) Bumps [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) from 1.17.0 to 1.18.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/open-policy-agent/opa/releases">github.com/open-policy-agent/opa's releases</a>.</em></p> <blockquote> <h2>v1.18.1</h2> <p>This release fixes a memory leak introduced in OPA v1.17.0. It is advised to update if you notice excess memory usage when running OPA server.</p> <h3>Fixes</h3> <ul> <li>ast: fix AnnotationSet memory leak via runtime.AddCleanup cycle (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8817">#8817</a>) authored by <a href="https://github.com/srenatus"><code>@srenatus</code></a> reported by <a href="https://github.com/keydon"><code>@keydon</code></a> and <a href="https://github.com/gorsr01"><code>@gorsr01</code></a></li> </ul> <h2>v1.18.0</h2> <p>This release contains a mix of bugfixes and small features. Notably:</p> <ul> <li>A breaking fix to the outbound <code>User-Agent</code> header so it conforms to RFC 9110 (see below)</li> <li>Container-aware resource limits: automatic <code>GOMAXPROCS</code> is restored and automatic <code>GOMEMLIMIT</code> is now supported</li> <li>Several <code>opa fmt</code> correctness fixes</li> <li>Improvements to <code>opa test --coverage</code> (ranges in report, inline rule head tracking, conjunction-expression coverage)</li> </ul> <h3>Breaking: Fix User-Agent according to RFC9110 (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8792">#8792</a>)</h3> <p>OPA's outbound HTTP requests (bundle, discovery, decision log, status, <code>http.send</code>, AWS KMS/ECR) previously sent <code>User-Agent: Open Policy Agent/<version> (<os>, <arch>)</code>, which is not a valid RFC 9110 <code>User-Agent</code> value because the <code>product</code> token cannot contain spaces. The header is now <code>Open-Policy-Agent/<version> (<os>, <arch>)</code>. Server-side log filters or WAF rules that exact-match the old string will need to be updated.</p> <p>Authored by <a href="https://github.com/sspaink"><code>@sspaink</code></a>, reported by <a href="https://github.com/SpecLad"><code>@SpecLad</code></a></p> <h3>Runtime, SDK, Tooling</h3> <ul> <li>bundle: fix per-module rego version lookup (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8797">#8797</a>) authored by <a href="https://github.com/sspaink"><code>@sspaink</code></a>, reported by <a href="https://github.com/xubinzheng"><code>@xubinzheng</code></a></li> <li>bundle: improve determinism of <code>file_rego_versions</code> patterns with overlap (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8733">#8733</a>) authored by <a href="https://github.com/philipaconrad"><code>@philipaconrad</code></a></li> <li>cover: Track inline rule head in post trace walk (<a href="https://redirect.github.com/open-policy-agent/opa/issues/6531">#6531</a>) authored by <a href="https://github.com/charlieegan3"><code>@charlieegan3</code></a>, reported by <a href="https://github.com/anderseknert"><code>@anderseknert</code></a></li> <li>cover: Update report to include ranges (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8748">#8748</a>) reported and authored by <a href="https://github.com/charlieegan3"><code>@charlieegan3</code></a></li> <li>cover: Add support for coverage of conjunction exprs (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8809">#8809</a>) authored by <a href="https://github.com/charlieegan3"><code>@charlieegan3</code></a></li> <li>download/oci: Set Accept headers (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8720">#8720</a>) authored by <a href="https://github.com/charlieegan3"><code>@charlieegan3</code></a></li> <li>fmt: preserve the multiline but single entry iterables (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8557">#8557</a>) authored by <a href="https://github.com/unichronic"><code>@unichronic</code></a>, reported by <a href="https://github.com/anderseknert"><code>@anderseknert</code></a></li> <li>format: Fix dropped with-clause after comment in object value (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8765">#8765</a>) authored by <a href="https://github.com/sspaink"><code>@sspaink</code></a>, reported by <a href="https://github.com/srabraham"><code>@srabraham</code></a></li> <li>format: keep lone <code>with</code> on the closing-bracket line of multi-line expressions (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8804">#8804</a>) authored by <a href="https://github.com/anneheartrecord"><code>@anneheartrecord</code></a>, reported by <a href="https://github.com/burnster"><code>@burnster</code></a></li> <li>oracle: Fix find-definition on expressions inside <code>ast.Not</code> nodes (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8731">#8731</a>) authored by <a href="https://github.com/johanfylling"><code>@johanfylling</code></a></li> <li>runtime: Restore goautomaxprocs, add automemlimit (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8784">#8784</a>) authored by <a href="https://github.com/charlieegan3"><code>@charlieegan3</code></a></li> </ul> <h3>Compiler, Topdown and Rego</h3> <ul> <li>ast: Apply location to inner <code>ast.Not</code> expressions (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8717">#8717</a>) authored by <a href="https://github.com/johanfylling"><code>@johanfylling</code></a>, reported by <a href="https://github.com/anderseknert"><code>@anderseknert</code></a></li> <li>ast: Clean up code for value comparisons (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8737">#8737</a>) authored by <a href="https://github.com/anderseknert"><code>@anderseknert</code></a></li> <li>ast: Fix PE regression for <code>future.keywords.not</code> negation inside <code>every</code> (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8781">#8781</a>) authored by <a href="https://github.com/johanfylling"><code>@johanfylling</code></a></li> <li>internal/edittree: Add recursive tree node recycling (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8693">#8693</a>) authored by <a href="https://github.com/philipaconrad"><code>@philipaconrad</code></a></li> <li>internal: compile,planner: improve determinism of <code>plan</code>/<code>wasm</code> bundle builds (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8732">#8732</a>) authored by <a href="https://github.com/philipaconrad"><code>@philipaconrad</code></a></li> <li>perf: avoid allocations in <code>object.get</code> (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8729">#8729</a>) authored by <a href="https://github.com/anderseknert"><code>@anderseknert</code></a></li> <li>topdown: Fix PE not namespacing vars in comprehensions nested inside <code>every</code> (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8816">#8816</a>) authored by <a href="https://github.com/johanfylling"><code>@johanfylling</code></a></li> <li>topdown: remove <code>dst.Compare(src)</code> shortcut (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8739">#8739</a>) authored by <a href="https://github.com/srenatus"><code>@srenatus</code></a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md">github.com/open-policy-agent/opa's changelog</a>.</em></p> <blockquote> <h1>Change Log</h1> <p>All notable changes to this project will be documented in this file. This project adheres to <a href="http://semver.org/">Semantic Versioning</a>.</p> <h2>Unreleased</h2> <h2>1.18.0</h2> <p>This release contains a mix of bugfixes and small features. Notably:</p> <ul> <li>A breaking fix to the outbound <code>User-Agent</code> header so it conforms to RFC 9110 (see below)</li> <li>Container-aware resource limits: automatic <code>GOMAXPROCS</code> is restored and automatic <code>GOMEMLIMIT</code> is now supported</li> <li>Several <code>opa fmt</code> correctness fixes</li> <li>Improvements to <code>opa test --coverage</code> (ranges in report, inline rule head tracking, conjunction-expression coverage)</li> </ul> <h3>Breaking: Fix User-Agent according to RFC9110 (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8792">#8792</a>)</h3> <p>OPA's outbound HTTP requests (bundle, discovery, decision log, status, <code>http.send</code>, AWS KMS/ECR) previously sent <code>User-Agent: Open Policy Agent/<version> (<os>, <arch>)</code>, which is not a valid RFC 9110 <code>User-Agent</code> value because the <code>product</code> token cannot contain spaces. The header is now <code>Open-Policy-Agent/<version> (<os>, <arch>)</code>. Server-side log filters or WAF rules that exact-match the old string will need to be updated.</p> <p>Authored by <a href="https://github.com/sspaink"><code>@sspaink</code></a>, reported by <a href="https://github.com/SpecLad"><code>@SpecLad</code></a></p> <h3>Runtime, SDK, Tooling</h3> <ul> <li>bundle: fix per-module rego version lookup (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8797">#8797</a>) authored by <a href="https://github.com/sspaink"><code>@sspaink</code></a>, reported by <a href="https://github.com/xubinzheng"><code>@xubinzheng</code></a></li> <li>bundle: improve determinism of <code>file_rego_versions</code> patterns with overlap (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8733">#8733</a>) authored by <a href="https://github.com/philipaconrad"><code>@philipaconrad</code></a></li> <li>cover: Track inline rule head in post trace walk (<a href="https://redirect.github.com/open-policy-agent/opa/issues/6531">#6531</a>) authored by <a href="https://github.com/charlieegan3"><code>@charlieegan3</code></a>, reported by <a href="https://github.com/anderseknert"><code>@anderseknert</code></a></li> <li>cover: Update report to include ranges (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8748">#8748</a>) reported and authored by <a href="https://github.com/charlieegan3"><code>@charlieegan3</code></a></li> <li>cover: Add support for coverage of conjunction exprs (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8809">#8809</a>) authored by <a href="https://github.com/charlieegan3"><code>@charlieegan3</code></a></li> <li>download/oci: Set Accept headers (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8720">#8720</a>) authored by <a href="https://github.com/charlieegan3"><code>@charlieegan3</code></a></li> <li>fmt: preserve the multiline but single entry iterables (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8557">#8557</a>) authored by <a href="https://github.com/unichronic"><code>@unichronic</code></a>, reported by <a href="https://github.com/anderseknert"><code>@anderseknert</code></a></li> <li>format: Fix dropped with-clause after comment in object value (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8765">#8765</a>) authored by <a href="https://github.com/sspaink"><code>@sspaink</code></a>, reported by <a href="https://github.com/srabraham"><code>@srabraham</code></a></li> <li>format: keep lone <code>with</code> on the closing-bracket line of multi-line expressions (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8804">#8804</a>) authored by <a href="https://github.com/anneheartrecord"><code>@anneheartrecord</code></a>, reported by <a href="https://github.com/burnster"><code>@burnster</code></a></li> <li>oracle: Fix find-definition on expressions inside <code>ast.Not</code> nodes (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8731">#8731</a>) authored by <a href="https://github.com/johanfylling"><code>@johanfylling</code></a></li> <li>runtime: Restore goautomaxprocs, add automemlimit (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8784">#8784</a>) authored by <a href="https://github.com/charlieegan3"><code>@charlieegan3</code></a></li> </ul> <h3>Compiler, Topdown and Rego</h3> <ul> <li>ast: Apply location to inner <code>ast.Not</code> expressions (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8717">#8717</a>) authored by <a href="https://github.com/johanfylling"><code>@johanfylling</code></a>, reported by <a href="https://github.com/anderseknert"><code>@anderseknert</code></a></li> <li>ast: Clean up code for value comparisons (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8737">#8737</a>) authored by <a href="https://github.com/anderseknert"><code>@anderseknert</code></a></li> <li>ast: Fix PE regression for <code>future.keywords.not</code> negation inside <code>every</code> (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8781">#8781</a>) authored by <a href="https://github.com/johanfylling"><code>@johanfylling</code></a></li> <li>internal/edittree: Add recursive tree node recycling (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8693">#8693</a>) authored by <a href="https://github.com/philipaconrad"><code>@philipaconrad</code></a></li> <li>internal: compile,planner: improve determinism of <code>plan</code>/<code>wasm</code> bundle builds (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8732">#8732</a>) authored by <a href="https://github.com/philipaconrad"><code>@philipaconrad</code></a></li> <li>perf: avoid allocations in <code>object.get</code> (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8729">#8729</a>) authored by <a href="https://github.com/anderseknert"><code>@anderseknert</code></a></li> <li>topdown: Fix PE not namespacing vars in comprehensions nested inside <code>every</code> (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8816">#8816</a>) authored by <a href="https://github.com/johanfylling"><code>@johanfylling</code></a></li> <li>topdown: remove <code>dst.Compare(src)</code> shortcut (<a href="https://redirect.github.com/open-policy-agent/opa/pull/8739">#8739</a>) authored by <a href="https://github.com/srenatus"><code>@srenatus</code></a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/open-policy-agent/opa/commit/acc8bf9f88bbef57c500dbdd7231509e48ade525"><code>acc8bf9</code></a> Release v1.18.1</li> <li><a href="https://github.com/open-policy-agent/opa/commit/713dc6a42757e4b175ec8f74d58e341f89004467"><code>713dc6a</code></a> ast: fix AnnotationSet memory leak via runtime.AddCleanup cycle</li> <li><a href="https://github.com/open-policy-agent/opa/commit/cc2c5c60a4c486f15a5e8de457e96ed0fefaf5fe"><code>cc2c5c6</code></a> Prepare v1.18 release (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8820">#8820</a>)</li> <li><a href="https://github.com/open-policy-agent/opa/commit/e72a98fb10b43cfc4067568de8909c669e8a1b79"><code>e72a98f</code></a> format: keep lone <code>with</code> on the closing-bracket line of multi-line expression...</li> <li><a href="https://github.com/open-policy-agent/opa/commit/03646dde18924c2c74a13526e4cea408dcbb4481"><code>03646dd</code></a> topdown: Fix PE not namespacing vars in comprehensions nested inside <code>every</code> ...</li> <li><a href="https://github.com/open-policy-agent/opa/commit/bf2bb5261cf84958c295dd74e763837e2c021fd8"><code>bf2bb52</code></a> benchmarks: split off script, emit markdown table</li> <li><a href="https://github.com/open-policy-agent/opa/commit/02ce276093b85d101172045f0307d53f5f9cc89d"><code>02ce276</code></a> version: fix ill-formed User-Agent header (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8796">#8796</a>)</li> <li><a href="https://github.com/open-policy-agent/opa/commit/1fdbb77dd6b7aaf65dffd8c23563df72a59639a3"><code>1fdbb77</code></a> build(deps): bump the dependencies group across 2 directories with 6 updates</li> <li><a href="https://github.com/open-policy-agent/opa/commit/954196aaa43841958547b1a0ba564e591d342a67"><code>954196a</code></a> cover: Add support for coverage of conjunction exprs (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8809">#8809</a>)</li> <li><a href="https://github.com/open-policy-agent/opa/commit/dec8333b32aed9189721220f3e8101460ebb170f"><code>dec8333</code></a> deduplicate change-detection output in pr CI checks (<a href="https://redirect.github.com/open-policy-agent/opa/issues/8808">#8808</a>)</li> <li>Additional commits viewable in <a href="https://github.com/open-policy-agent/opa/compare/v1.17.0...v1.18.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/open-policy-agent/opa&package-manager=go_modules&previous-version=1.17.0&new-version=1.18.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-30 11:17:30 +00:00
dependabot[bot]	d440e71109	chore: bump golang.org/x/tools from 0.46.0 to 0.47.0 in the x group (#26857 ) Bumps the x group with 1 update: [golang.org/x/tools](https://github.com/golang/tools). Updates `golang.org/x/tools` from 0.46.0 to 0.47.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/tools/commit/fbf9f2e2c8124fbe1877f5ed2857111038d9fe12"><code>fbf9f2e</code></a> gopls/internal/cmd: add tests of 'gopls help'</li> <li><a href="https://github.com/golang/tools/commit/e891f79e03c0d60a806f959113eb8a748a3dd3fe"><code>e891f79</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/tools/commit/0602b30930e307645a5b43697b316a5599dea9a1"><code>0602b30</code></a> gopls: revert CLI usability revamp to stabilize release</li> <li><a href="https://github.com/golang/tools/commit/60c2434eca161a47c4697fdf65718dc259c1cf5b"><code>60c2434</code></a> gopls/internal/cmd: fix regression in initialization</li> <li><a href="https://github.com/golang/tools/commit/29e158310c709074e3cc2f7f1cd5ab9af11eb13b"><code>29e1583</code></a> gopls/internal/mcp: go_diagnostics: use idiomatic iterators</li> <li><a href="https://github.com/golang/tools/commit/0772d6a918b878bf9983d765a65af011d84483b4"><code>0772d6a</code></a> go/ssa: add test for fix of <a href="https://redirect.github.com/golang/go/issues/73871">golang/go#73871</a> in go/types@go1.25</li> <li><a href="https://github.com/golang/tools/commit/0fdde844aba91691351f38a7f1da04354170017e"><code>0fdde84</code></a> gopls/internal/tool: rename Application to Command and embed in SubCommand</li> <li><a href="https://github.com/golang/tools/commit/bd9e76d9f0ec7faf1dc77d440463c182ac9c348c"><code>bd9e76d</code></a> go/callgraph/vta: document ssa.InstantiateGenerics requirement</li> <li><a href="https://github.com/golang/tools/commit/d711ac7849d4f5456228745090323144c4c2d190"><code>d711ac7</code></a> go/ssa: remove incorrect hasTypeParams check</li> <li><a href="https://github.com/golang/tools/commit/439decda73f3e6449050bcb3a0241ed96d5e74e1"><code>439decd</code></a> gopls/internal/cache/xrefs: avoid materializing Inspector</li> <li>Additional commits viewable in <a href="https://github.com/golang/tools/compare/v0.46.0...v0.47.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/tools&package-manager=go_modules&previous-version=0.46.0&new-version=0.47.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-30 11:15:40 +00:00
Yevhenii Shcherbina	8bf6f43016	feat: support cross-account Bedrock AssumeRole in AI Bridge (#26527 ) # Support IAM role assumption for AWS Bedrock in AI Bridge ## Summary Implements https://linear.app/codercom/issue/AIGOV-371/support-dynamic-bedrock-assumerole-across-aws-accounts-for-ai-gateway A Bedrock provider can now be configured with an IAM role to assume. Before calling Bedrock, the gateway assumes that role via STS and signs requests with the resulting temporary credentials. Whether the role lives in the same account or another one is entirely a matter of the role's trust policy. ## Problem Many organizations prohibit long-lived AWS access keys and expect workloads to authenticate through assumed IAM roles instead. A common case is an organization that runs Bedrock across several AWS accounts, one per business unit, and needs each unit's usage billed to its own account by assuming a role there. AI Bridge previously authenticated a Bedrock provider only with static keys or the gateway's own ambient AWS identity, which is shared by every provider, with no way to assume a role. These deployments had no clean path. ## How it works When a provider is configured with a role ARN, the gateway uses its base identity to assume that role via STS and signs Bedrock requests with the temporary credentials it returns. The base identity is whatever the AWS default credential chain resolves, IRSA, EKS Pod Identity, EC2 Instance Profile, or static keys. Credentials are resolved once when the provider is set up and are then cached and rotated, so individual requests are served from the cache rather than triggering a new STS call. A deployment that needs several roles configures several providers, each pointing at its own role. ## Configuration The role ARN is part of the Bedrock provider settings and is set through the AI provider API. It is optional: a provider with no role ARN behaves exactly as before. ## Scope and trade-offs - This PR is backend only. The settings UI for the role ARN ships in a follow-up. - Configuration is not exposed through environment variables. Environment-based provider configuration is being phased out in favor of database-managed providers, so the role ARN is intentionally database and API only. Follow-up PR: https://github.com/coder/coder/pull/26578	2026-06-24 12:03:27 -04:00
Cian Johnston	2d28c1b396	feat: surface template README to agent template tools (#26334 ) Fixes CODAGT-447. Alternative implementation of https://github.com/coder/coder/pull/26212 and https://github.com/coder/coder/pull/25978 - Adds up to the first 1000 characters of `README.md` (with leading frontmatter stripped) to `chattool.list_templates` output - Adds up to 800 characters of `README.md` to `chattool.read_template`. Note: skipping `toolsdk` versions to keep scope small. > 🤖 Generated by Coder Agents	2026-06-24 12:32:46 +01:00
Sas Swart	cec1b4e886	fix: upgrade coder/boundary to v0.9.0 (#26651 ) Bumps `github.com/coder/boundary` from pseudo-version `v0.8.4-0.20260304164748-566aeea939ab` to `v0.9.0`. This picks up the fixes included in the [v0.9.0 release](https://github.com/coder/boundary/releases/tag/v0.9.0), notably: - feat: report drop counts to agent via BoundaryStatus - fix: preserve percent-encoded path when forwarding Relates to https://linear.app/codercom/issue/AIGOV-424 > Generated by Coder Agents on behalf of @SasSwart	2026-06-24 10:42:12 +02:00
dependabot[bot]	eb4bea6e94	chore: bump github.com/coreos/go-oidc/v3 from 3.18.0 to 3.19.0 (#26608 ) Bumps [github.com/coreos/go-oidc/v3](https://github.com/coreos/go-oidc) from 3.18.0 to 3.19.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/coreos/go-oidc/releases">github.com/coreos/go-oidc/v3's releases</a>.</em></p> <blockquote> <h2>v3.19.0</h2> <h2>What's Changed</h2> <ul> <li>fix: Key refresh should set <code>no-cache</code> to get most up to date keys by <a href="https://github.com/Yanni8"><code>@Yanni8</code></a> in <a href="https://redirect.github.com/coreos/go-oidc/pull/485">coreos/go-oidc#485</a></li> <li>oidc: add support for validating back-channel logout tokens by <a href="https://github.com/ericchiang"><code>@ericchiang</code></a> in <a href="https://redirect.github.com/coreos/go-oidc/pull/486">coreos/go-oidc#486</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Yanni8"><code>@Yanni8</code></a> made their first contribution in <a href="https://redirect.github.com/coreos/go-oidc/pull/485">coreos/go-oidc#485</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/coreos/go-oidc/compare/v3.18.0...v3.19.0">https://github.com/coreos/go-oidc/compare/v3.18.0...v3.19.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/coreos/go-oidc/commit/4204f0b2b0f903070de5f51a459fe5e23faca113"><code>4204f0b</code></a> oidc: add support for validating back-channel logout tokens</li> <li><a href="https://github.com/coreos/go-oidc/commit/f77e01c50994c6ad4f4c3a6ed3e2380bab1f1ff2"><code>f77e01c</code></a> fix: Key refresh should set no-cache to get most up to date keys</li> <li>See full diff in <a href="https://github.com/coreos/go-oidc/compare/v3.18.0...v3.19.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/coreos/go-oidc/v3&package-manager=go_modules&previous-version=3.18.0&new-version=3.19.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-23 11:19:00 +00:00
dependabot[bot]	e2333ebd29	chore: bump github.com/prometheus/common from 0.68.1 to 0.69.0 (#26607 ) Bumps [github.com/prometheus/common](https://github.com/prometheus/common) from 0.68.1 to 0.69.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/prometheus/common/releases">github.com/prometheus/common's releases</a>.</em></p> <blockquote> <h2>v0.69.0</h2> <h2>What's Changed</h2> <ul> <li>config: strip credentials on cross-host redirects by <a href="https://github.com/roidelapluie"><code>@roidelapluie</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/901">prometheus/common#901</a></li> <li>Modernize Go by <a href="https://github.com/SuperQ"><code>@SuperQ</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/919">prometheus/common#919</a></li> <li>config: make isCrossHostRedirect sticky across the redirect chain by <a href="https://github.com/roidelapluie"><code>@roidelapluie</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/920">prometheus/common#920</a></li> <li>config: check cross-host redirect before OAuth2 token fetch by <a href="https://github.com/roidelapluie"><code>@roidelapluie</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/921">prometheus/common#921</a></li> <li>expfmt: fix nil pointer panic when parsing empty braces "{}" by <a href="https://github.com/roidelapluie"><code>@roidelapluie</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/922">prometheus/common#922</a></li> <li>model: reduce allocations in Time.UnmarshalJSON by <a href="https://github.com/bboreham"><code>@bboreham</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/918">prometheus/common#918</a></li> <li>config: resolve LoadHTTPConfigFile paths relative to the config file by <a href="https://github.com/roidelapluie"><code>@roidelapluie</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/925">prometheus/common#925</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/prometheus/common/compare/v0.68.1...v0.69.0">https://github.com/prometheus/common/compare/v0.68.1...v0.69.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/prometheus/common/blob/main/CHANGELOG.md">github.com/prometheus/common's changelog</a>.</em></p> <blockquote> <h2>v0.69.0 / 2026-06-17</h2> <h3>Security / behavior changes</h3> <ul> <li><strong>config: credentials are no longer forwarded across cross-host redirects.</strong> When <code>FollowRedirects</code> is enabled, the HTTP client now strips <code>Authorization</code>, <code>Cookie</code>, <code>Proxy-Authorization</code> and other sensitive headers, and skips basic-auth, bearer-token and OAuth2 credentials, when a redirect points to a different host. This aligns with Go's <code>net/http</code> behavior. Callers that relied on credentials being sent to a redirect target on another host will need to target that host directly. <a href="https://redirect.github.com/prometheus/common/issues/901">#901</a> <a href="https://redirect.github.com/prometheus/common/issues/920">#920</a> <a href="https://redirect.github.com/prometheus/common/issues/921">#921</a></li> <li>config: <code>LoadHTTPConfigFile</code> now resolves relative file paths (e.g. <code>*_file</code> credentials, <code>http_headers</code> files) against the config file's own directory instead of its parent directory. Configs that worked around the old behavior by prefixing paths with the config's directory name must drop that prefix. <a href="https://redirect.github.com/prometheus/common/issues/925">#925</a></li> </ul> <h3>Bugfixes</h3> <ul> <li>expfmt: fix nil pointer panic when parsing empty braces <code>{}</code>. <a href="https://redirect.github.com/prometheus/common/issues/922">#922</a></li> <li>model: fix <code>Time.UnmarshalJSON</code> for larger negative numbers. <a href="https://redirect.github.com/prometheus/common/issues/918">#918</a></li> </ul> <h3>Performance</h3> <ul> <li>model: reduce allocations in <code>Time.UnmarshalJSON</code>. <a href="https://redirect.github.com/prometheus/common/issues/918">#918</a></li> </ul> <h3>Internal</h3> <ul> <li>Synchronize common files from prometheus/prometheus. <a href="https://redirect.github.com/prometheus/common/issues/917">#917</a></li> <li>Modernize Go. <a href="https://redirect.github.com/prometheus/common/issues/919">#919</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/prometheus/common/compare/v0.68.1...v0.69.0">https://github.com/prometheus/common/compare/v0.68.1...v0.69.0</a></p> <h2>v0.67.2 / 2025-10-28</h2> <h2>What's Changed</h2> <ul> <li>config: Fix panic in <code>tlsRoundTripper</code> when CA file is absent by <a href="https://github.com/ndk"><code>@ndk</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/792">prometheus/common#792</a></li> <li>Cleanup linting issues by <a href="https://github.com/SuperQ"><code>@SuperQ</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/860">prometheus/common#860</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/ndk"><code>@ndk</code></a> made their first contribution in <a href="https://redirect.github.com/prometheus/common/pull/792">prometheus/common#792</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/prometheus/common/compare/v0.67.1...v0.67.2">https://github.com/prometheus/common/compare/v0.67.1...v0.67.2</a></p> <h2>v0.67.1 / 2025-10-07</h2> <h2>What's Changed</h2> <ul> <li>Remove VERSION file to avoid Go conflict error in <a href="https://redirect.github.com/prometheus/common/pull/853">prometheus/common#853</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/prometheus/common/compare/v0.67.0...v0.67.1">https://github.com/prometheus/common/compare/v0.67.0...v0.67.1</a></p> <h2>v0.67.0 / 2025-10-07</h2> <h2>What's Changed</h2> <ul> <li>Create CHANGELOG.md for easier communication of library changes, especially possible breaking changes. by <a href="https://github.com/ywwg"><code>@ywwg</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/833">prometheus/common#833</a></li> <li>model: New test for validation with dots by <a href="https://github.com/m1k1o"><code>@m1k1o</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/759">prometheus/common#759</a></li> <li>expfmt: document NewTextParser as required by <a href="https://github.com/burgerdev"><code>@burgerdev</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/842">prometheus/common#842</a></li> <li>expfmt: Add support for float histograms and gauge histograms by <a href="https://github.com/beorn7"><code>@beorn7</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/843">prometheus/common#843</a></li> <li>Updated minimum Go version to 1.24.0, updated Go dependecies by <a href="https://github.com/SuperQ"><code>@SuperQ</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/849">prometheus/common#849</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/prometheus/common/commit/e3c14a039d494d866242b36ac253dfecf9c7210b"><code>e3c14a0</code></a> Merge pull request <a href="https://redirect.github.com/prometheus/common/issues/925">#925</a> from roidelapluie/roidelapluie/fix-loadhttpconfigfile...</li> <li><a href="https://github.com/prometheus/common/commit/a7b791d0a0cd8e7be164d7f3fdb33450c1868b1c"><code>a7b791d</code></a> config: resolve LoadHTTPConfigFile paths relative to the config file</li> <li><a href="https://github.com/prometheus/common/commit/f84efec4e4deb31a8afd39c4f4f7ba2b30f39df3"><code>f84efec</code></a> Merge pull request <a href="https://redirect.github.com/prometheus/common/issues/918">#918</a> from prometheus/time-split</li> <li><a href="https://github.com/prometheus/common/commit/2269d3d1af9a40c9324bb523087f7704fabe7f1d"><code>2269d3d</code></a> Merge pull request <a href="https://redirect.github.com/prometheus/common/issues/922">#922</a> from roidelapluie/roidelapluie/fix-textparse-empty-br...</li> <li><a href="https://github.com/prometheus/common/commit/a1600af967b7eaa77360339b402b447855c24915"><code>a1600af</code></a> expfmt: fix nil pointer panic when parsing empty braces "{}"</li> <li><a href="https://github.com/prometheus/common/commit/56fe3954537fa60da94055f19172fafa25347948"><code>56fe395</code></a> Merge pull request <a href="https://redirect.github.com/prometheus/common/issues/921">#921</a> from roidelapluie/roidelapluie/oauth2-cross-host-check</li> <li><a href="https://github.com/prometheus/common/commit/0fcda471410c91d285776092b7d768d8ac199bc9"><code>0fcda47</code></a> Merge pull request <a href="https://redirect.github.com/prometheus/common/issues/920">#920</a> from roidelapluie/roidelapluie/cross-host-sticky</li> <li><a href="https://github.com/prometheus/common/commit/30ba470f4f55107af9dbe7fbe9c95c0617c13f43"><code>30ba470</code></a> Merge pull request <a href="https://redirect.github.com/prometheus/common/issues/919">#919</a> from prometheus/superq/modernize</li> <li><a href="https://github.com/prometheus/common/commit/2b55b3e9e7e899f2cbcbcb7afdcb55c2db6a1754"><code>2b55b3e</code></a> config: check cross-host redirect before OAuth2 token fetch</li> <li><a href="https://github.com/prometheus/common/commit/428856f9a5d0d790dacdf03e789c2ef87b03fc40"><code>428856f</code></a> config: make isCrossHostRedirect sticky across the redirect chain</li> <li>Additional commits viewable in <a href="https://github.com/prometheus/common/compare/v0.68.1...v0.69.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/prometheus/common&package-manager=go_modules&previous-version=0.68.1&new-version=0.69.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-23 11:18:52 +00:00
dependabot[bot]	8cf394d145	chore: bump google.golang.org/api from 0.284.0 to 0.286.0 (#26606 ) Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.284.0 to 0.286.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's releases</a>.</em></p> <blockquote> <h2>v0.286.0</h2> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.285.0...v0.286.0">0.286.0</a> (2026-06-22)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3629">#3629</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/f25a08b7bd916e0719cc9e0d003454a8aaa8caf9">f25a08b</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3631">#3631</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/b3bb97ff046401ce738b4e6830642b2e6c712536">b3bb97f</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3632">#3632</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/7332dd74f142bba59a27778f115eac98cc254bfb">7332dd7</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3634">#3634</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/36081a00df42df1ca3e3228067737839aa905c9e">36081a0</a>)</li> </ul> <h2>v0.285.0</h2> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.284.0...v0.285.0">0.285.0</a> (2026-06-16)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3618">#3618</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/5c008a7963c278aff6be6c839cbf20bd0b8ae231">5c008a7</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3620">#3620</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/21a12ed9dc47cb8d9b9aa4e1f5759ac2044063a5">21a12ed</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3622">#3622</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/17394ca1afffb6d740e134a0bc148d79106c4c80">17394ca</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3623">#3623</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/087611c9a9b2c0e68f429641a012a43396afb4ce">087611c</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3624">#3624</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/72b67889b20325f1a09222d62b3184a68ad30ee2">72b6788</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3626">#3626</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/4f1d165677d35c4caecd7faf93eec27cb2fd25cd">4f1d165</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3628">#3628</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/894cccb170d1ea81f8bf49ddd072a3ef52df3d25">894cccb</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.285.0...v0.286.0">0.286.0</a> (2026-06-22)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3629">#3629</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/f25a08b7bd916e0719cc9e0d003454a8aaa8caf9">f25a08b</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3631">#3631</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/b3bb97ff046401ce738b4e6830642b2e6c712536">b3bb97f</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3632">#3632</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/7332dd74f142bba59a27778f115eac98cc254bfb">7332dd7</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3634">#3634</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/36081a00df42df1ca3e3228067737839aa905c9e">36081a0</a>)</li> </ul> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.284.0...v0.285.0">0.285.0</a> (2026-06-16)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3618">#3618</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/5c008a7963c278aff6be6c839cbf20bd0b8ae231">5c008a7</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3620">#3620</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/21a12ed9dc47cb8d9b9aa4e1f5759ac2044063a5">21a12ed</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3622">#3622</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/17394ca1afffb6d740e134a0bc148d79106c4c80">17394ca</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3623">#3623</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/087611c9a9b2c0e68f429641a012a43396afb4ce">087611c</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3624">#3624</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/72b67889b20325f1a09222d62b3184a68ad30ee2">72b6788</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3626">#3626</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/4f1d165677d35c4caecd7faf93eec27cb2fd25cd">4f1d165</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3628">#3628</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/894cccb170d1ea81f8bf49ddd072a3ef52df3d25">894cccb</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/googleapis/google-api-go-client/commit/94e4ed985051ce54267a5f938e57b8d77963c101"><code>94e4ed9</code></a> chore(main): release 0.286.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3630">#3630</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/36081a00df42df1ca3e3228067737839aa905c9e"><code>36081a0</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3634">#3634</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/7332dd74f142bba59a27778f115eac98cc254bfb"><code>7332dd7</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3632">#3632</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/b3bb97ff046401ce738b4e6830642b2e6c712536"><code>b3bb97f</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3631">#3631</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/f25a08b7bd916e0719cc9e0d003454a8aaa8caf9"><code>f25a08b</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3629">#3629</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/182ae992632d7ba19b5d3c60c71bda28fbfabca1"><code>182ae99</code></a> chore(main): release 0.285.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3619">#3619</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/894cccb170d1ea81f8bf49ddd072a3ef52df3d25"><code>894cccb</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3628">#3628</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/50adedd746e19a1fa5302c5b47dbd6f269bd8c14"><code>50adedd</code></a> chore(all): update all (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3625">#3625</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/4f1d165677d35c4caecd7faf93eec27cb2fd25cd"><code>4f1d165</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3626">#3626</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/72b67889b20325f1a09222d62b3184a68ad30ee2"><code>72b6788</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3624">#3624</a>)</li> <li>Additional commits viewable in <a href="https://github.com/googleapis/google-api-go-client/compare/v0.284.0...v0.286.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/api&package-manager=go_modules&previous-version=0.284.0&new-version=0.286.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-23 11:17:13 +00:00
dependabot[bot]	3fb402cd82	chore: bump github.com/gohugoio/hugo from 0.163.0 to 0.163.3 (#26579 ) Bumps [github.com/gohugoio/hugo](https://github.com/gohugoio/hugo) from 0.163.0 to 0.163.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/gohugoio/hugo/releases">github.com/gohugoio/hugo's releases</a>.</em></p> <blockquote> <h2>v0.163.3</h2> <h2>What's Changed</h2> <ul> <li>markup/highlight: Escape lang in default code block rendering ce1a7e0b <a href="https://github.com/bep"><code>@bep</code></a> thanks to <a href="https://github.com/k0ngj1"><code>@k0ngj1</code></a> for reporting this issue.</li> <li>parser/pageparser: Preserve non-ASCII whitespace after e.g. summary divider 70a9068a <a href="https://github.com/bep"><code>@bep</code></a></li> <li>resources: Support babel/postcss config variants 9d66d513 <a href="https://github.com/jmooring"><code>@jmooring</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/15039">#15039</a> <a href="https://redirect.github.com/gohugoio/hugo/issues/15040">#15040</a> <a href="https://redirect.github.com/gohugoio/hugo/issues/15043">#15043</a></li> <li>hugolib: Fix page/section name collision regression f0133466 <a href="https://github.com/jmooring"><code>@jmooring</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/15046">#15046</a></li> </ul> <h2>v0.163.2</h2> <h2>What's Changed</h2> <ul> <li>Continue resolving on ERR_ACCESS_DENIED in Node's resolver 134674f0 <a href="https://github.com/bep"><code>@bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/15041">#15041</a></li> <li>markup: Standardize behavior when external converters are missing 147f605f <a href="https://github.com/jmooring"><code>@jmooring</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14222">#14222</a></li> </ul> <h2>v0.163.1</h2> <p>The majority of the fixes in this release are security related (including the upstream fix in 93c8c7d3 (golang.org/x/image)). Thanks to <a href="https://github.com/vnth4nhnt"><code>@vnth4nhnt</code></a> for finding the issues fixed in a00b5c72 and cf9c8f93 (I will do the CVE work on this later). There has been a uptick in security reports lately, which doesn't mean that Hugo has gotten less secure, this is mostly the work of the new and powerful AI tools using Hugo's restrictive <a href="https://gohugo.io/about/security/">security model</a> as their baseline. Just take a look at Go's recent <a href="https://github.com/golang/go/issues?q=is%3Aissue%20label%3ASecurity">security issue list</a> to see a demonstration of this.</p> <h2>What's Changed</h2> <ul> <li>build(deps): bump golang.org/x/image from 0.41.0 to 0.42.0 93c8c7d3 <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]</li> <li>Fix multi --renderSegments merge behavior 95e5e9f4 <a href="https://github.com/bep"><code>@bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/15024">#15024</a></li> <li>security: Normalize integer IPv4 host encodings in http.urls check a00b5c72 <a href="https://github.com/bep"><code>@bep</code></a></li> <li>Drop symlinks in os.ReadDir, os.ReadFile, os.Stat and os.FileExists cf9c8f93 <a href="https://github.com/bep"><code>@bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/15019">#15019</a></li> <li>commands: Fix convert command 2602796c <a href="https://github.com/jmooring"><code>@jmooring</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/15012">#15012</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/gohugoio/hugo/commit/4d22555aebf458d5d150500c9ac4bee5b24cf0d3"><code>4d22555</code></a> releaser: Bump versions for release of 0.163.3</li> <li><a href="https://github.com/gohugoio/hugo/commit/ce1a7e0bce3713af40496ded3c2c0ceeed49231d"><code>ce1a7e0</code></a> markup/highlight: Escape lang in default code block rendering</li> <li><a href="https://github.com/gohugoio/hugo/commit/e8988c31412249897a2e6805b61c37ed5c82a10c"><code>e8988c3</code></a> Merge commit 'c86d9f4aa8a58931f52df6516f10b67c807505fb'</li> <li><a href="https://github.com/gohugoio/hugo/commit/c86d9f4aa8a58931f52df6516f10b67c807505fb"><code>c86d9f4</code></a> Squashed 'docs/' changes from 1f8ddb8a52..e17426e2b6</li> <li><a href="https://github.com/gohugoio/hugo/commit/70a9068aa67c67a9eb2ab5fe062faf5a99e6b650"><code>70a9068</code></a> parser/pageparser: Preserve non-ASCII whitespace after e.g. summary divider</li> <li><a href="https://github.com/gohugoio/hugo/commit/9d66d513cee02e77c96c78059d5c3ae6b1c5dde9"><code>9d66d51</code></a> resources: Support babel/postcss config variants</li> <li><a href="https://github.com/gohugoio/hugo/commit/f01334666790f328e222f67c278396ee77003021"><code>f013346</code></a> hugolib: Fix page/section name collision regression</li> <li><a href="https://github.com/gohugoio/hugo/commit/96e06e1ab8484327dcbb521b8445a52d0c022cf3"><code>96e06e1</code></a> releaser: Prepare repository for 0.164.0-DEV</li> <li><a href="https://github.com/gohugoio/hugo/commit/19a5cec0b9618163bb519487382e861d29edf383"><code>19a5cec</code></a> releaser: Bump versions for release of 0.163.2</li> <li><a href="https://github.com/gohugoio/hugo/commit/134674f00df2c2c0db24f0674de2263298d33eb7"><code>134674f</code></a> Continue resolving on ERR_ACCESS_DENIED in Node's resolver</li> <li>Additional commits viewable in <a href="https://github.com/gohugoio/hugo/compare/v0.163.0...v0.163.3">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/gohugoio/hugo&package-manager=go_modules&previous-version=0.163.0&new-version=0.163.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/coder/coder/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-22 18:28:02 +00:00
dependabot[bot]	2f3285ebe7	chore: bump the x group across 1 directory with 2 updates (#26521 ) Bumps the x group with 2 updates in the / directory: [golang.org/x/mod](https://github.com/golang/mod) and [golang.org/x/tools](https://github.com/golang/tools). Updates `golang.org/x/mod` from 0.36.0 to 0.37.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/mod/commit/deb1dfcdb7c7fd98fb5afddc3e95dd36d5880874"><code>deb1dfc</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/mod/commit/087f6515dd3ba3e8b06918fa425ffe7732321a7a"><code>087f651</code></a> modfile: use slices.Backward</li> <li><a href="https://github.com/golang/mod/commit/343ee60345a1f2ff0692be9dd068c0778dba985c"><code>343ee60</code></a> x/mod: allow for aggressively conslidating requires</li> <li>See full diff in <a href="https://github.com/golang/mod/compare/v0.36.0...v0.37.0">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/tools` from 0.45.0 to 0.46.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/tools/commit/3d6f8dfd4853c8b323940b931f1170c6d0df8d23"><code>3d6f8df</code></a> go/packages: propagate PATH in TestConfigEnvDoesNotInheritProcessEnv</li> <li><a href="https://github.com/golang/tools/commit/47abf61fcbb4abdcf37a986ce23e20dc140fd018"><code>47abf61</code></a> gopls: move internal/tool into gopls/internal/tool</li> <li><a href="https://github.com/golang/tools/commit/19cebc548e6c35b3bf20bd09490e7db258183507"><code>19cebc5</code></a> go/packages/gopackages: use standard flag package instead of internal/tool</li> <li><a href="https://github.com/golang/tools/commit/e965c10097987837d9805f8069f4a8278de7180f"><code>e965c10</code></a> gopls/internal/test/marker: update hover test</li> <li><a href="https://github.com/golang/tools/commit/96efd3d65c18f9f8d66bc94ec5d709db0b7e72f0"><code>96efd3d</code></a> gopls/internal/golang/stubmethods: support generic interfaces</li> <li><a href="https://github.com/golang/tools/commit/83be7b7739a3e73db55876c5d396c8d891f61a51"><code>83be7b7</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/tools/commit/bf05c11f9ba6f0ed70931bf0a302e9099897d726"><code>bf05c11</code></a> internal/typesinternal: ForEachElement: test generic methods</li> <li><a href="https://github.com/golang/tools/commit/99df0abf1ba525779b731d2f9ef358c1b8a1b633"><code>99df0ab</code></a> go/callgraph/static: support generic methods</li> <li><a href="https://github.com/golang/tools/commit/6942095782f864dadecfb2839bf2371d676bfb48"><code>6942095</code></a> go/ssa: fix instantiation of generic methods on non-generic receivers</li> <li><a href="https://github.com/golang/tools/commit/070e85daf671b972397e181b13cd7a0be55fa6b0"><code>070e85d</code></a> go/callgraph/rta: skip generic methods in fingerprinting</li> <li>Additional commits viewable in <a href="https://github.com/golang/tools/compare/v0.45.0...v0.46.0">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-18 15:13:50 +00:00
Ethan	0fcd9c2005	chore: bump fantasy to sync from upstream (#26440 ) Closes CODAGT-572 ## Overview Bumps `charm.land/fantasy` to the head of `coder_2_33` (`v0.0.0-20260617050554-2e3ddbca75dd`) and adapts `chatd` to it. The fantasy bump: - Syncs upstream `charmbracelet/fantasy` main (v0.31.0) into `coder_2_33` (coder/fantasy#42). - Mirrors the request region when prefixing cross-region inference profiles, so a legacy (un-qualified) Bedrock model ID is prefixed for the same region the request is actually signed for. Pulling in the new fantasy version propagates its required transitive dependency upgrades (aws-sdk-go-v2, OpenTelemetry, google genai, `golang.org/x/`, etc.) through MVS, which accounts for the bulk of the `go.mod`/`go.sum` churn. ## chatd changes - Thread a per-provider `Region` through `ConfiguredProvider` and `ProviderAPIKeys` (`RegionByProvider`), and merge/prune/resolve it alongside API keys and base URLs. - Source the Bedrock region from AI provider settings in `chatd` and pass `fantasybedrock.WithRegion` when a region is configured. - Migrate the runtime Bedrock title-generation model ID to a fully-qualified `global.anthropic.` ID. - Emit a `finish_reason` in the test OpenAI streaming server so streams close on a terminal event, matching fantasy's fail-closed stream handling. ## Heads-up: most of this is short-lived Almost all of the `chatd` code in this PR only executes on the direct (non-gateway) routing path — the branch taken when `AIGatewayRoutingEnabled` is `false`. That flag was a transition crutch for AI Gateway routing, and it (plus the entire direct path / `x/chatd/chatprovider` package that backs it) is slated for removal in CODAGT-598. Under AI Gateway routing — which is the path every deployment is expected to run — the Bedrock region is resolved by aibridge directly from provider settings (`cli/aibridged.go` builds `aibridge.AWSBedrockConfig{Region: settings.Bedrock.Region}`), so none of the region plumbing added here is reached. Concretely, expect the following to be deleted alongside the direct path: - The `RegionByProvider` map, the `Region()` accessor, and the region preservation in merge/resolve plus the region pruning in `PruneDisabledProviderKeys` (`chatprovider.go`). - The `fantasybedrock.WithRegion(region)` branch in `ModelFromConfig` — only reachable on the direct path; the gateway path builds a `fantasyanthropic` client with no region key. - Reading `settings.Bedrock.Region` in `aiProviderConfigFromKeys` (`chatd.go`). - The region-specific tests in `chatprovider_test.go`, and the `chattest`/`model_coverage` adjustments that support direct-path testing. What survives the cleanup (independent of routing): - The `charm.land/fantasy` bump and its `go.mod`/`go.sum` transitive churn. - The fully-qualified `global.anthropic.*` Bedrock title-generation model ID in `quickgen.go` (a runtime-valid model identifier, not direct-path-specific). We're landing the full change anyway so the direct path stays correct for the remaining transition window; just don't be surprised when CODAGT-598 reclaims most of it. ## Notes Depends on coder/fantasy `coder_2_33` already containing the upstream sync and Bedrock region fix (merged via coder/fantasy#42 and coder/fantasy#43).	2026-06-19 00:53:59 +10:00
dependabot[bot]	a6559a8b00	chore: bump github.com/prometheus-community/pro-bing from 0.8.0 to 0.9.0 (#26404 ) Bumps [github.com/prometheus-community/pro-bing](https://github.com/prometheus-community/pro-bing) from 0.8.0 to 0.9.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/prometheus-community/pro-bing/releases">github.com/prometheus-community/pro-bing's releases</a>.</em></p> <blockquote> <h2>v0.9.0</h2> <h2>What's Changed</h2> <ul> <li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@prombot</code></a> in <a href="https://redirect.github.com/prometheus-community/pro-bing/pull/185">prometheus-community/pro-bing#185</a></li> <li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@prombot</code></a> in <a href="https://redirect.github.com/prometheus-community/pro-bing/pull/186">prometheus-community/pro-bing#186</a></li> <li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@prombot</code></a> in <a href="https://redirect.github.com/prometheus-community/pro-bing/pull/190">prometheus-community/pro-bing#190</a></li> <li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@prombot</code></a> in <a href="https://redirect.github.com/prometheus-community/pro-bing/pull/191">prometheus-community/pro-bing#191</a></li> <li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@prombot</code></a> in <a href="https://redirect.github.com/prometheus-community/pro-bing/pull/193">prometheus-community/pro-bing#193</a></li> <li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@prombot</code></a> in <a href="https://redirect.github.com/prometheus-community/pro-bing/pull/197">prometheus-community/pro-bing#197</a></li> <li>Add required make step by <a href="https://github.com/ArthurSens"><code>@ArthurSens</code></a> in <a href="https://redirect.github.com/prometheus-community/pro-bing/pull/201">prometheus-community/pro-bing#201</a></li> <li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@prombot</code></a> in <a href="https://redirect.github.com/prometheus-community/pro-bing/pull/199">prometheus-community/pro-bing#199</a></li> <li>Fix ping test by <a href="https://github.com/SuperQ"><code>@SuperQ</code></a> in <a href="https://redirect.github.com/prometheus-community/pro-bing/pull/203">prometheus-community/pro-bing#203</a></li> <li>Replace CircleCI with Github Actions by <a href="https://github.com/ArthurSens"><code>@ArthurSens</code></a> in <a href="https://redirect.github.com/prometheus-community/pro-bing/pull/200">prometheus-community/pro-bing#200</a></li> <li>Migrate to PromCI by <a href="https://github.com/SuperQ"><code>@SuperQ</code></a> in <a href="https://redirect.github.com/prometheus-community/pro-bing/pull/205">prometheus-community/pro-bing#205</a></li> <li>Bump actions/checkout from 6.0.2 to 6.0.3 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus-community/pro-bing/pull/206">prometheus-community/pro-bing#206</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/ArthurSens"><code>@ArthurSens</code></a> made their first contribution in <a href="https://redirect.github.com/prometheus-community/pro-bing/pull/201">prometheus-community/pro-bing#201</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/prometheus-community/pro-bing/compare/v0.8.0...v0.9.0">https://github.com/prometheus-community/pro-bing/compare/v0.8.0...v0.9.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/prometheus-community/pro-bing/commit/945b9010a1de9b190bd7cc76fd6b667305f7604c"><code>945b901</code></a> Bump actions/checkout from 6.0.2 to 6.0.3 (<a href="https://redirect.github.com/prometheus-community/pro-bing/issues/206">#206</a>)</li> <li><a href="https://github.com/prometheus-community/pro-bing/commit/8ad48a3a4494524d283a80cf2586c922c34996e2"><code>8ad48a3</code></a> Migrate to PromCI (<a href="https://redirect.github.com/prometheus-community/pro-bing/issues/205">#205</a>)</li> <li><a href="https://github.com/prometheus-community/pro-bing/commit/1194d691ed5ef6e95d0f7c86f03280c50cecaad6"><code>1194d69</code></a> Replace CircleCI with Github Actions (<a href="https://redirect.github.com/prometheus-community/pro-bing/issues/200">#200</a>)</li> <li><a href="https://github.com/prometheus-community/pro-bing/commit/5b8ff3d3e855d8917a58ddd7f0952fd6d2995375"><code>5b8ff3d</code></a> Merge pull request <a href="https://redirect.github.com/prometheus-community/pro-bing/issues/203">#203</a> from prometheus-community/superq/localhost_ping_test</li> <li><a href="https://github.com/prometheus-community/pro-bing/commit/9e6b9559f3c8a5120fbdd70f42e99bb7ff143810"><code>9e6b955</code></a> Fix ping test</li> <li><a href="https://github.com/prometheus-community/pro-bing/commit/9e7ca651df21a1bb2af84a3b3f7f9f0aa9d2779d"><code>9e7ca65</code></a> Merge pull request <a href="https://redirect.github.com/prometheus-community/pro-bing/issues/199">#199</a> from prombot/repo_sync</li> <li><a href="https://github.com/prometheus-community/pro-bing/commit/0657089f4960412c2809c3c3c82244e5cff5b126"><code>0657089</code></a> Merge pull request <a href="https://redirect.github.com/prometheus-community/pro-bing/issues/201">#201</a> from prometheus-community/fix-golangcilint</li> <li><a href="https://github.com/prometheus-community/pro-bing/commit/b42280d67499a58ed879f827db4e28a05d12e381"><code>b42280d</code></a> Add required make step</li> <li><a href="https://github.com/prometheus-community/pro-bing/commit/f8995dd68ba40d6d7656d67d7d56b5f8ea8f487a"><code>f8995dd</code></a> Update common Prometheus files</li> <li><a href="https://github.com/prometheus-community/pro-bing/commit/f4241153b56afdc77511329e0cdffd95142d0658"><code>f424115</code></a> Merge pull request <a href="https://redirect.github.com/prometheus-community/pro-bing/issues/197">#197</a> from prometheus-community/repo_sync</li> <li>Additional commits viewable in <a href="https://github.com/prometheus-community/pro-bing/compare/v0.8.0...v0.9.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/prometheus-community/pro-bing&package-manager=go_modules&previous-version=0.8.0&new-version=0.9.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-16 11:18:26 +00:00
dependabot[bot]	1def9c693e	chore: bump google.golang.org/api from 0.283.0 to 0.284.0 (#26403 ) Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.283.0 to 0.284.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's releases</a>.</em></p> <blockquote> <h2>v0.284.0</h2> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.283.0...v0.284.0">0.284.0</a> (2026-06-09)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3613">#3613</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/5f021536107adde3063487a75aa9f46078490191">5f02153</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3616">#3616</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/25b429a5431a77dd95eb00466661c1447eab6d16">25b429a</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3617">#3617</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/1ef362535b2f2f3afbc1408adbf6d3b69e58ad26">1ef3625</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.283.0...v0.284.0">0.284.0</a> (2026-06-09)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3613">#3613</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/5f021536107adde3063487a75aa9f46078490191">5f02153</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3616">#3616</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/25b429a5431a77dd95eb00466661c1447eab6d16">25b429a</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3617">#3617</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/1ef362535b2f2f3afbc1408adbf6d3b69e58ad26">1ef3625</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/googleapis/google-api-go-client/commit/5c6a0b03b25a64955922133a4486f9632f381e88"><code>5c6a0b0</code></a> chore(main): release 0.284.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3614">#3614</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/1ef362535b2f2f3afbc1408adbf6d3b69e58ad26"><code>1ef3625</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3617">#3617</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/4dd580d53ff4585321810eaddf5c65d6d6b9d893"><code>4dd580d</code></a> chore(all): update all (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3615">#3615</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/25b429a5431a77dd95eb00466661c1447eab6d16"><code>25b429a</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3616">#3616</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/5f021536107adde3063487a75aa9f46078490191"><code>5f02153</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3613">#3613</a>)</li> <li>See full diff in <a href="https://github.com/googleapis/google-api-go-client/compare/v0.283.0...v0.284.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/api&package-manager=go_modules&previous-version=0.283.0&new-version=0.284.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-16 11:18:17 +00:00
Ethan	deb6eec68b	fix: forward attached filenames to Anthropic chat models (#26051 ) Previously, fantasy's Anthropic provider adapter accepted PDF and text FileParts but dropped the filename on the floor, so Claude (direct or via Bedrock) saw the document bytes without any handle and could not answer questions like "what's in foo.pdf". Other providers (OpenAI, Gemini, OpenRouter, Vercel) already forwarded filenames. Bumps `coder/fantasy` past [coder/fantasy#38](https://github.com/coder/fantasy/pull/38), which sanitizes `FilePart.Filename` and sets it as the Anthropic `DocumentBlockParam.Title` for both `application/pdf` and `text/*` attachments, and emits a `CallWarning` for unsupported `FilePart` media types instead of silently dropping them. On this side, plumbs the resolved filename through `partsToMessageParts` so the `FilePart` literal carries it into the provider. The existing `TestModelFromConfig_AnthropicPDFFilePartReachesProvider` regression test is extended to assert the outbound Anthropic request includes the sanitized title (`quarterly_report.v1.pdf` becomes `quarterly report v1 pdf`). Closes CODAGT-545	2026-06-10 11:37:33 +10:00
dependabot[bot]	9408b9d89b	chore: bump github.com/gohugoio/hugo from 0.162.0 to 0.163.0 (#26157 ) Bumps [github.com/gohugoio/hugo](https://github.com/gohugoio/hugo) from 0.162.0 to 0.163.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/gohugoio/hugo/releases">github.com/gohugoio/hugo's releases</a>.</em></p> <blockquote> <h2>v0.163.0</h2> <p>The main topic in this release is improvements to the AVIF image handling that we introduced in <code>v0.162.0</code>. See <a href="https://gohugo.io/configuration/imaging/#avif">the docs</a> for details, but:</p> <ul> <li>We have turned down the default <code>quality</code> for AVIF to 60. Turns out, JPEG/WebP with quality 75 is comparable to AVIF with quality 60. You can now also set quality per image format in your project config (and also per image processed if needed).</li> <li>We have added a <code>hint</code> to the AVIF with the same values as for <code>WEBP</code>. For <code>lossy</code> compression, the photo/picture hints (and the default) encodes with YUV420 chroma subsampling instead of YUV444, keeping 444 for text/icon/drawing. This greatly reduces the memory needed to encode these images.</li> </ul> <h2>Improvements</h2> <ul> <li>resources/jsconfig: Remove deprecated baseUrl setting ff2903a9 <a href="https://github.com/bep"><code>@bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14991">#14991</a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14996">#14996</a></li> <li>all: Adjust tests for deprecated link and image render hook settings ca68936d <a href="https://github.com/jmooring"><code>@jmooring</code></a></li> <li>all: Run go fix ./... 781fabf4 <a href="https://github.com/bep"><code>@bep</code></a></li> <li>pagesfromdata: Use relative path for content adapter template metrics 1d018ef8 <a href="https://github.com/anupamojha-eng"><code>@anupamojha-eng</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14999">#14999</a></li> <li>ci: Re-add macos-latest to the test matrix 121bc6ce <a href="https://github.com/bep"><code>@bep</code></a></li> <li>images: Deprecate Imaging.Compression and move it down to webp and avif configs cf18b827 <a href="https://github.com/bep"><code>@bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14998">#14998</a></li> <li>Only support the latest Go version 98ad9b3c <a href="https://github.com/bep"><code>@bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14997">#14997</a></li> <li>page: Add IsBranch and deprecate IsNode b89e7fe6 <a href="https://github.com/bep"><code>@bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/11574">#11574</a></li> <li>images: Force cache invalidation for AVIF target e8fefc83 <a href="https://github.com/bep"><code>@bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14990">#14990</a></li> <li>images: Add a per-format AVIF hint setting a043d3ec <a href="https://github.com/bep"><code>@bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14992">#14992</a></li> <li>images: Make AVIF chroma subsampling content-aware via the hint 341f575d <a href="https://github.com/bep"><code>@bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14987">#14987</a></li> <li>Cap AVIF lossy quality at 99 248241b6 <a href="https://github.com/bep"><code>@bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14981">#14981</a></li> <li>config: Deprecate the glogal imaging quality setting 4e47d95d <a href="https://github.com/bep"><code>@bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14979">#14979</a></li> <li>images: Make 60 the default quality for AVIF 03b4b542 <a href="https://github.com/bep"><code>@bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14979">#14979</a></li> <li>livereload: Disconnect from websocket server on pageswap 79be0532 <a href="https://github.com/bep"><code>@bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14983">#14983</a></li> <li>tpl/tplimpl/embedded: Prevent leading newline in sitemap template 0f440460 <a href="https://github.com/bep"><code>@bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14977">#14977</a></li> <li>images: Recover from memory alloc errors in WASM image processors 4e17421e <a href="https://github.com/bep"><code>@bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14985">#14985</a></li> <li>images: Add quality setting per image format b01ecd4c <a href="https://github.com/bep"><code>@bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14957">#14957</a></li> <li>misc: Remove duplicate words in comments 45c00b7c <a href="https://github.com/jmooring"><code>@jmooring</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14936">#14936</a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14950">#14950</a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14965">#14965</a></li> <li>Add some PNG to AVIF golden test cases 28d882ab <a href="https://github.com/bep"><code>@bep</code></a></li> </ul> <h2>Dependency Updates</h2> <ul> <li>build(deps): bump github.com/bits-and-blooms/bitset 0d29fc81 <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]</li> <li>build(deps): bump github.com/tetratelabs/wazero bb57404f <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]</li> <li>build(deps): bump github.com/rogpeppe/go-internal from 1.14.1 to 1.15.0 7d1b1fb3 <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]</li> <li>build(deps): bump github.com/getkin/kin-openapi from 0.138.0 to 0.139.0 77a11470 <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]</li> </ul> <h2>v0.162.1</h2> <h2>What's Changed</h2> <ul> <li>modules/npm: Fix false stale warning after npm pack 59f35cd9 <a href="https://github.com/jmooring"><code>@jmooring</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14959">#14959</a></li> <li>Revert "tpl/collections: Make dict return nil when no values are provided" c2709750 <a href="https://github.com/bep"><code>@bep</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14958">#14958</a></li> <li>tpl/time: Fix locale-specific month abbreviations ea8b48af <a href="https://github.com/jmooring"><code>@jmooring</code></a> <a href="https://redirect.github.com/gohugoio/hugo/issues/14948">#14948</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/gohugoio/hugo/commit/4a9485336a3ff2cea07ab88e2a17ec34d5baaa6e"><code>4a94853</code></a> releaser: Bump versions for release of 0.163.0</li> <li><a href="https://github.com/gohugoio/hugo/commit/1d018ef8573e1cbeca6c05b6df0792cb5f672541"><code>1d018ef</code></a> pagesfromdata: Use relative path for content adapter template metrics</li> <li><a href="https://github.com/gohugoio/hugo/commit/121bc6ceb232effd98a85a5fec357181be8ff01e"><code>121bc6c</code></a> ci: Re-add macos-latest to the test matrix</li> <li><a href="https://github.com/gohugoio/hugo/commit/0d29fc81bb559750644bc163ec67f21f3c36ed1b"><code>0d29fc8</code></a> build(deps): bump github.com/bits-and-blooms/bitset</li> <li><a href="https://github.com/gohugoio/hugo/commit/bb57404f3d93cd588e98f34c742b8b7c2741a4c7"><code>bb57404</code></a> build(deps): bump github.com/tetratelabs/wazero</li> <li><a href="https://github.com/gohugoio/hugo/commit/781fabf4e406aae6b888d4f9f68331e7f13e89aa"><code>781fabf</code></a> all: Run go fix ./...</li> <li><a href="https://github.com/gohugoio/hugo/commit/cf18b827e2bebe95f87b36bff9937218348a55ca"><code>cf18b82</code></a> images: Deprecate Imaging.Compression and move it down to webp and avif configs</li> <li><a href="https://github.com/gohugoio/hugo/commit/98ad9b3c03278d0af3ebd13f8ec9fc1a71d46745"><code>98ad9b3</code></a> Only support the latest Go version</li> <li><a href="https://github.com/gohugoio/hugo/commit/ff2903a9317ba45a65f9963f837c66cc6bce3c0e"><code>ff2903a</code></a> resources/jsconfig: Remove deprecated baseUrl setting</li> <li><a href="https://github.com/gohugoio/hugo/commit/7d1b1fb33dd7bdbb0d16dde9509ce15d93f7d894"><code>7d1b1fb</code></a> build(deps): bump github.com/rogpeppe/go-internal from 1.14.1 to 1.15.0</li> <li>Additional commits viewable in <a href="https://github.com/gohugoio/hugo/compare/v0.162.0...v0.163.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/gohugoio/hugo&package-manager=go_modules&previous-version=0.162.0&new-version=0.163.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-09 11:14:22 +00:00
dependabot[bot]	5d8cd2ea7c	chore: bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.68.0 to 0.69.0 (#26042 ) Bumps [go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp](https://github.com/open-telemetry/opentelemetry-go-contrib) from 0.68.0 to 0.69.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-go-contrib/releases">go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp's releases</a>.</em></p> <blockquote> <h2>v1.44.0/v2.5.1/v0.69.0/v0.37.1/v0.24.0/v0.19.0/v0.16.1/v0.16.0</h2> <h3>Added</h3> <ul> <li>Add <code>error.type</code> attribute to <code>http.client.request.duration</code> for transport failures in <code>otelhttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8801">#8801</a>)</li> <li>Add examples for prometheus compatibility document. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8716">#8716</a>)</li> <li>Add support for <code>cardinality_limits</code> in <code>PeriodicMetricReader</code> in <code>otelconf</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8885">#8885</a>)</li> <li>Add <code>Resource</code> method to <code>SDK</code> in <code>go.opentelemetry.io/contrib/otelconf/x</code> to expose the resolved SDK resource from declarative configuration. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8913">#8913</a>)</li> <li>Add <code>go.opentelemetry.io/contrib/detectors/hetzner</code>, a new resource detector for Hetzner Cloud servers, ported from <code>github.com/open-telemetry/opentelemetry-collector-contrib/processor/resourcedetectionprocessor/internal/hetzner</code>. Detects <code>cloud.provider</code>, <code>cloud.platform</code>, <code>cloud.region</code>, <code>cloud.availability_zone</code>, <code>host.id</code>, and <code>host.name</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8979">#8979</a>)</li> </ul> <h3>Changed</h3> <ul> <li>Set error field as <code>record.SetErr</code> instead of a plain attribute in <code>go.opentelemetry.io/contrib/bridges/otellogrus</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8776">#8776</a>)</li> <li>Set the "error" field (e.g. created via <code>zap.Error</code>) as <code>record.SetErr</code> instead of a plain attribute in <code>go.opentelemetry.io/contrib/bridges/otelzap</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8719">#8719</a>)</li> <li>Set fields implementing <code>error</code> interface from <code>slog</code> records as <code>record.SetErr</code> instead of plain attributes in <code>go.opentelemetry.io/contrib/bridges/otelslog</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8774">#8774</a>)</li> <li>Set emitted errors in <code>go.opentelemetry.io/contrib/bridges/otellogr</code> as record errors (<code>Record.SetErr</code>) instead of <code>exception.message</code> attributes. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8775">#8775</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Fix header attributes lost when using sub-spans in <code>go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8797">#8797</a>)</li> <li>Validate <code>encoding</code> configuration for OTLP HTTP exporters in <code>go.opentelemetry.io/contrib/otelconf</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8772">#8772</a>)</li> <li>Remove the custom body wrapper from the request's body after the request is processed to allow body type comparisons with the original type in <code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code> and <code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/6914">#6914</a>)</li> <li>Unknown or empty HTTP methods now report "_OTHER" instead of "GET" across all HTTP instrumentations to align with OpenTelemetry semantic conventions. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8868">#8868</a>)</li> <li>The default span name formatter in <code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code> now conforms to the OpenTelemetry HTTP semantic conventions for server span names. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8871">#8871</a>) <ul> <li>The default span name is now <code>{method} {route}</code> (e.g. <code>GET /foo/{id}</code>) when a route pattern is available, or <code>{method}</code> (e.g. <code>GET</code>) otherwise.</li> </ul> </li> </ul> <h3>Removed</h3> <ul> <li>Remove the deprecated <code>WithSpanOptions</code> option in <code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8991">#8991</a>)</li> </ul> <h2>What's Changed</h2> <ul> <li>otelconf: validate encoding configuration for OTLP HTTP exporters by <a href="https://github.com/sonalgaud12"><code>@sonalgaud12</code></a> in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8772">open-telemetry/opentelemetry-go-contrib#8772</a></li> <li>fix(deps): update module github.com/aws/aws-sdk-go-v2/service/s3 to v1.99.0 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8780">open-telemetry/opentelemetry-go-contrib#8780</a></li> <li>chore(deps): update prom/prometheus docker tag to v3.11.1 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8779">open-telemetry/opentelemetry-go-contrib#8779</a></li> <li>otellogrus: Set error field as <code>record.SetErr</code> by <a href="https://github.com/sonalgaud12"><code>@sonalgaud12</code></a> in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8778">open-telemetry/opentelemetry-go-contrib#8778</a></li> <li>chore(deps): update module golang.org/x/sys to v0.43.0 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8783">open-telemetry/opentelemetry-go-contrib#8783</a></li> <li>chore(deps): update golang.org/x/telemetry digest to 93c7c8a by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8786">open-telemetry/opentelemetry-go-contrib#8786</a></li> <li>chore(deps): update module github.com/mattn/go-isatty to v0.0.21 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8787">open-telemetry/opentelemetry-go-contrib#8787</a></li> <li>chore(deps): update module github.com/mattn/go-runewidth to v0.0.23 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8788">open-telemetry/opentelemetry-go-contrib#8788</a></li> <li>chore(deps): update golang.org/x by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8791">open-telemetry/opentelemetry-go-contrib#8791</a></li> <li>chore(deps): update actions/github-script action to v9 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8795">open-telemetry/opentelemetry-go-contrib#8795</a></li> <li>fix(deps): update golang.org/x by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8794">open-telemetry/opentelemetry-go-contrib#8794</a></li> <li>otelzap: set error field as record.SetErr by <a href="https://github.com/iblancasa"><code>@iblancasa</code></a> in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8719">open-telemetry/opentelemetry-go-contrib#8719</a></li> <li>fix(deps): update golang.org/x to 746e56f by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8796">open-telemetry/opentelemetry-go-contrib#8796</a></li> <li>chore(deps): update module golang.org/x/arch to v0.26.0 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8798">open-telemetry/opentelemetry-go-contrib#8798</a></li> <li>Check if otelgrpc metrics are enabled by <a href="https://github.com/dashpole"><code>@dashpole</code></a> in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8792">open-telemetry/opentelemetry-go-contrib#8792</a></li> <li>chore(deps): update actions/upload-artifact action to v7.0.1 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8800">open-telemetry/opentelemetry-go-contrib#8800</a></li> <li>Check instrument enabled in deprecatedruntime by <a href="https://github.com/dashpole"><code>@dashpole</code></a> in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8793">open-telemetry/opentelemetry-go-contrib#8793</a></li> <li>chore(deps): update module github.com/ashanbrown/forbidigo/v2 to v2.3.1 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8804">open-telemetry/opentelemetry-go-contrib#8804</a></li> <li>chore(deps): update module github.com/ashanbrown/makezero/v2 to v2.2.1 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8802">open-telemetry/opentelemetry-go-contrib#8802</a></li> <li>chore(deps): update module github.com/manuelarte/funcorder to v0.6.0 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8803">open-telemetry/opentelemetry-go-contrib#8803</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md">go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp's changelog</a>.</em></p> <blockquote> <h2>[1.44.0/2.5.1/0.69.0/0.37.1/0.24.0/0.19.0/0.16.1/0.16.0] - 2026-05-28</h2> <h3>Added</h3> <ul> <li>Add <code>error.type</code> attribute to <code>http.client.request.duration</code> for transport failures in <code>otelhttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8801">#8801</a>)</li> <li>Add examples for prometheus compatibility document. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8716">#8716</a>)</li> <li>Add support for <code>cardinality_limits</code> in <code>PeriodicMetricReader</code> in <code>otelconf</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8885">#8885</a>)</li> <li>Add <code>Resource</code> method to <code>SDK</code> in <code>go.opentelemetry.io/contrib/otelconf/x</code> to expose the resolved SDK resource from declarative configuration. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8913">#8913</a>)</li> <li>Add <code>go.opentelemetry.io/contrib/detectors/hetzner</code>, a new resource detector for Hetzner Cloud servers, ported from <code>github.com/open-telemetry/opentelemetry-collector-contrib/processor/resourcedetectionprocessor/internal/hetzner</code>. Detects <code>cloud.provider</code>, <code>cloud.platform</code>, <code>cloud.region</code>, <code>cloud.availability_zone</code>, <code>host.id</code>, and <code>host.name</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8979">#8979</a>)</li> </ul> <h3>Changed</h3> <ul> <li>Set error field as <code>record.SetErr</code> instead of a plain attribute in <code>go.opentelemetry.io/contrib/bridges/otellogrus</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8776">#8776</a>)</li> <li>Set the "error" field (e.g. created via <code>zap.Error</code>) as <code>record.SetErr</code> instead of a plain attribute in <code>go.opentelemetry.io/contrib/bridges/otelzap</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8719">#8719</a>)</li> <li>Set fields implementing <code>error</code> interface from <code>slog</code> records as <code>record.SetErr</code> instead of plain attributes in <code>go.opentelemetry.io/contrib/bridges/otelslog</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8774">#8774</a>)</li> <li>Set emitted errors in <code>go.opentelemetry.io/contrib/bridges/otellogr</code> as record errors (<code>Record.SetErr</code>) instead of <code>exception.message</code> attributes. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8775">#8775</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Fix header attributes lost when using sub-spans in <code>go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8797">#8797</a>)</li> <li>Validate <code>encoding</code> configuration for OTLP HTTP exporters in <code>go.opentelemetry.io/contrib/otelconf</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8772">#8772</a>)</li> <li>Remove the custom body wrapper from the request's body after the request is processed to allow body type comparisons with the original type in <code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code> and <code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/6914">#6914</a>)</li> <li>Unknown or empty HTTP methods now report "_OTHER" instead of "GET" across all HTTP instrumentations to align with OpenTelemetry semantic conventions. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8868">#8868</a>)</li> <li>The default span name formatter in <code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code> now conforms to the OpenTelemetry HTTP semantic conventions for server span names. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8871">#8871</a>) <ul> <li>The default span name is now <code>{method} {route}</code> (e.g. <code>GET /foo/{id}</code>) when a route pattern is available, or <code>{method}</code> (e.g. <code>GET</code>) otherwise.</li> </ul> </li> </ul> <h3>Removed</h3> <ul> <li>Remove the deprecated <code>WithSpanOptions</code> option in <code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8991">#8991</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/03b2bcdb54b3dde73c9ff91ae216aec262f6c8f5"><code>03b2bcd</code></a> Release v1.44.0/v2.5.1/v0.69.0/v0.37.1/v0.24.0/v0.19.0/v0.16.1/v0.16.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9033">#9033</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/80c46d4037d5991ce324216a52cf7e8d7f2d81fa"><code>80c46d4</code></a> chore(deps): update module github.com/alecthomas/chroma/v2 to v2.26.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9034">#9034</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/51f292197d33b84a21b3c70ae21cb185a2570d5e"><code>51f2921</code></a> fix(deps): update module github.com/hetznercloud/hcloud-go/v2 to v2.41.2 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9026">#9026</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/db82162f1b642bb6dca7fa5be48045315bb466d6"><code>db82162</code></a> fix(deps): update aws-sdk-go-v2 monorepo (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9031">#9031</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/5a3e533d8cd4045128e61a966f6dad58964a78ea"><code>5a3e533</code></a> fix(deps): update module github.com/aws/smithy-go to v1.26.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9032">#9032</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/c67843c753a924faef17bc4aa63c138aa9472477"><code>c67843c</code></a> otelhttp: Remove custom wrapper after handling request (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/6914">#6914</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/c0a41352283151ab6655e88120e4ff4f0a917a2e"><code>c0a4135</code></a> docs(otelhttptrace): add performance guidance for WithoutSubSpans (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8785">#8785</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/a51a86790e1f4df231a70bb5fecc72b95d3c1bf0"><code>a51a867</code></a> otelconf: implement cardinality_limits support in PeriodicMetricReader (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8885">#8885</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/dead6e50fc0b5b3dc4aea288df207953dae5afe7"><code>dead6e5</code></a> chore(deps): update module go.yaml.in/yaml/v2 to v2.4.4 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8994">#8994</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/979ce1857524394d0884fd7c491722c5bcb43d50"><code>979ce18</code></a> chore(deps): update module github.com/jgautheron/goconst to v1.10.2 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9030">#9030</a>)</li> <li>Additional commits viewable in <a href="https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.68.0...zpages/v0.69.0">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-05 12:37:40 +00:00
dependabot[bot]	7e3ac4a85e	chore: bump google.golang.org/api from 0.280.0 to 0.283.0 (#26045 ) Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.280.0 to 0.283.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's releases</a>.</em></p> <blockquote> <h2>v0.283.0</h2> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.282.0...v0.283.0">0.283.0</a> (2026-06-01)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3609">#3609</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/ed84bb800c56d3f7fee4c11f96673114e94a8cc2">ed84bb8</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3611">#3611</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/3855346eda7f4ba6c844d86de5de493d3e395f00">3855346</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3612">#3612</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/32624d32240ec8e5997810fb9cb54f8000b6c7f8">32624d3</a>)</li> </ul> <h2>v0.282.0</h2> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.281.0...v0.282.0">0.282.0</a> (2026-05-27)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3607">#3607</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/3c139a07f71096667d5a623591ddb37dacd38d55">3c139a0</a>)</li> </ul> <h2>v0.281.0</h2> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.280.0...v0.281.0">0.281.0</a> (2026-05-26)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3600">#3600</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/bcaee85f93824a21f5441c2ccd3b4d4811d97de7">bcaee85</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3602">#3602</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/f0071d379f4443ffdae9994fe141b1b5e0c18a62">f0071d3</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3603">#3603</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/b1aa9dea8c3c0e539c8d9687c99c55ec3679c996">b1aa9de</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3604">#3604</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/711e008d9caf16e6fb68c860f83a28fd0a8c0f98">711e008</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3606">#3606</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/3ad8e8e2ab4ae50862c0fc5b17efa2d3cda33d9a">3ad8e8e</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.282.0...v0.283.0">0.283.0</a> (2026-06-01)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3609">#3609</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/ed84bb800c56d3f7fee4c11f96673114e94a8cc2">ed84bb8</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3611">#3611</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/3855346eda7f4ba6c844d86de5de493d3e395f00">3855346</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3612">#3612</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/32624d32240ec8e5997810fb9cb54f8000b6c7f8">32624d3</a>)</li> </ul> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.281.0...v0.282.0">0.282.0</a> (2026-05-27)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3607">#3607</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/3c139a07f71096667d5a623591ddb37dacd38d55">3c139a0</a>)</li> </ul> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.280.0...v0.281.0">0.281.0</a> (2026-05-26)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3600">#3600</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/bcaee85f93824a21f5441c2ccd3b4d4811d97de7">bcaee85</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3602">#3602</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/f0071d379f4443ffdae9994fe141b1b5e0c18a62">f0071d3</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3603">#3603</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/b1aa9dea8c3c0e539c8d9687c99c55ec3679c996">b1aa9de</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3604">#3604</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/711e008d9caf16e6fb68c860f83a28fd0a8c0f98">711e008</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3606">#3606</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/3ad8e8e2ab4ae50862c0fc5b17efa2d3cda33d9a">3ad8e8e</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/googleapis/google-api-go-client/commit/f6726366ff2f0b8fc82cec6f063dc9beb3ab1377"><code>f672636</code></a> chore(main): release 0.283.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3610">#3610</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/32624d32240ec8e5997810fb9cb54f8000b6c7f8"><code>32624d3</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3612">#3612</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/3855346eda7f4ba6c844d86de5de493d3e395f00"><code>3855346</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3611">#3611</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/ed84bb800c56d3f7fee4c11f96673114e94a8cc2"><code>ed84bb8</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3609">#3609</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/60aebbd7406af09eb63866ff79f0dbd40cccecbb"><code>60aebbd</code></a> chore(main): release 0.282.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3608">#3608</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/3c139a07f71096667d5a623591ddb37dacd38d55"><code>3c139a0</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3607">#3607</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/8f434ff91fe8dc299942ecd7c87ebab151ff38e5"><code>8f434ff</code></a> chore(main): release 0.281.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3601">#3601</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/57f4b28d8c80b464f7f0b486a555de528fb89c4e"><code>57f4b28</code></a> chore(all): update all (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3605">#3605</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/3ad8e8e2ab4ae50862c0fc5b17efa2d3cda33d9a"><code>3ad8e8e</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3606">#3606</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/711e008d9caf16e6fb68c860f83a28fd0a8c0f98"><code>711e008</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3604">#3604</a>)</li> <li>Additional commits viewable in <a href="https://github.com/googleapis/google-api-go-client/compare/v0.280.0...v0.283.0">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-05 12:37:19 +00:00
Ehab Younes	38ae92b6b7	chore: upgrade slog to 3.1.0 (#26096 ) Changes from https://github.com/coder/slog/releases/tag/v3.1.0 This also carries the transitive dependency versions required by `cdr.dev/slog/v3@v3.1.0`, including OpenTelemetry `v1.44.0`, Cloud Logging `v1.18.0`, and the updated `google.golang.org/genproto` modules.	2026-06-05 15:23:04 +03:00
Michael Suchacz	c4792cf104	fix: show Anthropic Opus 4.7+ thinking (#26026 ) ## Summary - Updates Coder's pinned `github.com/coder/fantasy` fork to include coder/fantasy#39. - Exposes Anthropic `thinking_display` as a typed chat model provider option with `summarized` and `omitted` values. - Validates configured `thinking_display` values and maps them to `fantasyanthropic.ProviderOptions.ThinkingDisplay`. - Regenerates the API/UI option schemas so the admin model config form gets a generated select field. ## Tests - `go mod tidy` - `make gen` - `go test ./codersdk ./coderd/x/chatd/chatprovider ./coderd -run 'TestChatModelProviderOptions\|TestAnthropicThinkingDisplayFromChat\|TestProviderOptionsFromChatModelConfig_AnthropicThinkingDisplay\|TestMergeMissingProviderOptions_AnthropicThinkingDisplay\|TestValidateChatModelProviderOptions_AnthropicThinkingDisplay'` - `go test ./coderd/x/chatd/... ./codersdk` - `go test ./coderd -run 'TestValidateChatModelProviderOptions_AnthropicThinkingDisplay'` - `pnpm --dir site exec -- biome lint --error-on-warnings src/api/chatModelOptionsGenerated.json src/api/typesGenerated.ts` - pre-commit hook, including fmt, lint, and slim build > Mux working on behalf of Mike.	2026-06-05 08:37:54 +02:00
Seth Shelnutt	61a35185cf	fix: upgrade Go toolchain from 1.26.2 to 1.26.4 (#26066 ) Upgrades the Go toolchain from 1.26.2 to 1.26.4 to address two stdlib CVEs: - CVE-2026-27145 (Low): `crypto/x509` `VerifyHostname` has quadratic cost with large DNS SAN lists, enabling DoS with untrusted certificates. - CVE-2026-42507 (Low): `net/textproto` includes attacker-controlled input in errors without escaping, enabling log injection. ### Changes - `go.mod`: Bump `go` directive from 1.26.2 to 1.26.4 - `mise.toml`: Bump `go` tool version from 1.26.2 to 1.26.4 - `mise.lock`: Regenerated with updated Go checksums Resolves ENT-104 > Generated by Coder Agents on behalf of @Shelnutt2	2026-06-04 11:22:28 -04:00

1 2 3 4 5 ...