opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-22 05:05:20 +08:00
Code Issues Packages Projects Releases Wiki Activity
15,434 Commits 479 Branches 387 Tags
d5a3963167cc31396ebcbf7ddc8e894371a9cf44
Commit Graph
15434 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
dylanhuff-at-coder d5a3963167 feat: add bulk user secret import endpoint and SDK client (PLAT-240) (#26724) 
Adds `POST /api/v2/users/{user}/secrets/batch` and
`codersdk.Client.ImportUserSecrets` to import env, JSON, or YAML secrets
atomically. The endpoint validates each entry, rolls back the full batch
on conflicts or limits, omits secret values from responses and audit
logs, and imports keys that cannot be injected as environment variables
with an empty `env_name`.

Part of the [PLAT-240 bulk secret import
stack](https://linear.app/codercom/issue/PLAT-240). Reviewed and updated
by Coder Agents on behalf of @dylanhuff-at-coder.
 2026-07-23 14:55:34 -07:00
Nick Vigilante 73af2ca632 docs: audit and fix manifest.json page descriptions for SEO (#27267) 
## What

Audit and fix the page `description` fields in `docs/manifest.json` so
each one is accurate, unique, and follows meta-description SEO best
practices, targeting 70-155 characters.

Tracking: DOCS-576

## Why

Many manifest descriptions were terse (243 of 272 hand-maintained
descriptions were under 70 characters), a few reused another page's
description (copy/paste errors), and one just repeated its own title.
These feed the per-page `<meta name="description">` on coder.com/docs,
so they matter for search snippets and click-through.

## What changed

The manifest diff is +244 / -244 lines, touching only `description`
string values (0 structural lines changed). A second commit regenerates
one downstream file (see Generated file below).

- **Fixed 5 copy/paste errors** where a page reused another page's
description:
  - `admin/monitoring/index.md` (had Security's text)
  - `admin/monitoring/metrics.md` (had Logs' text)
- `admin/templates/template-permissions.md` (had "Creating Templates"
text)
  - `admin/networking/stun.md` (had Port Forwarding's text)
- `admin/provisioners/manage-provisioner-jobs.md` (had the provisioners
index text)
- **Fixed `reference/index.md`**, whose description merely repeated the
title "Reference".
- **Corrected wording**: "Coderd API" to Coder REST API; "VSCode" to VS
Code; dropped the `&` shorthand on the AI Gateway index per the docs
style guide.
- **Corrected accuracy**: the AI landing page listed outdated example
agents (GPT-Code, OpenDevin, SWE-Agent); it now references agents used
elsewhere in the docs (Claude Code, Aider).
- **Expanded terse descriptions** into the 70-155 range with
active-voice, front-loaded phrasing.

## Generated file

`docs/install/releases/feature-stages.md` is generated by
`scripts/release/docs_update_feature_stages.sh`, which copies the beta
pages' manifest descriptions verbatim into the beta-features table.
Three rows (MCP Server, JetBrains Toolbox, Coder Agents) update to match
the new descriptions; User secrets is unchanged. Regenerated with `make
gen` so the generated-files check stays clean.

## Scope / exclusions

Auto-generated reference subtrees are intentionally left untouched,
since `make gen` rebuilds them from source and would revert hand edits
(and fail the generated-files check):

- `Reference > Command Line` children, from `scripts/clidocgen` (each
command's `Short` help)
- `Reference > REST API` children, from `scripts/apidocgen`
- `Reference > Agent API` children

The section index nodes themselves (Reference, REST API, Command Line,
Agent API) are hand-maintained and are in scope.

## Validation

- `docs/manifest.json` is valid JSON; diff touches only `description`
values.
- All 272 in-scope descriptions are now 70-155 characters, with 0
duplicates across distinct pages.
- No double quotes, backslashes, em/en dashes, or `&` / `<` / `>` in
descriptions.
- Biome 2.4.10 (`scripts/biome_format.sh`) is a no-op on the result.
- `scripts/check_emdash.sh` passes.

> This PR was created with AI assistance (Coder Agents).
 2026-07-23 16:24:06 -05:00
Nick Vigilante 5bafbace8e docs: add What's next? carve-out to the Learn more style rule (#27163) 
## What

Adds a **What's next?** carve-out to the **Learn more, not Next steps**
rule in the docs style guide (`docs/.style/style-guide/word-choice.md`).

The existing `## Learn more, not Next steps` heading, its two
rationales, and the ban on **Next steps** are unchanged, so the
`#learn-more-not-next-steps` anchor is preserved. A new `### Sequenced
tutorials: What's next?` subsection lets a tutorial in an ordered series
point to the single next tutorial, and the enforcement note now
clarifies that the planned `Coder.LearnMore` rule flags **Next steps**,
not **What's next?**.

## Why

**What's next?** and **Learn more** do different jobs:

- **What's next?** carries the reader along a defined sequence: the
single next tutorial.
- **Learn more** stays optional related reading, such as feature or
reference pages.

The **What's next?** phrasing also avoids the "steps" mobility metaphor,
so the inclusive-language reason for banning **Next steps** still holds.

The merged Quickstart "Customize your template" series (#26712) already
uses **What's next?** sections, so this codifies the pattern those pages
adopted.

## Implementation plan and decision log

- Keep `## Learn more, not Next steps` (preserves the anchor and the
core ban).
- Add `### Sequenced tutorials: What's next?` after the Learn more
Do/Don't examples: a tutorial in an ordered series may add a **What's
next?** section pointing to the single next tutorial, placed above
**Learn more**, written as a short sentence with the link.
- Add a **Do** example showing **What's next?** above **Learn more**.
- Update the closing note to: *Enforced by `Coder.LearnMore` (planned).
The planned rule flags Next steps, not What's next?.*

Decisions:

- Subsection, not a new top-level rule, keeps the shared rationale and
the `#learn-more-not-next-steps` anchor intact.
- The planned Vale rule must flag **Next steps** but allow **What's
next?**, so the note calls that out explicitly to prevent a future false
positive.
- Diff scope: only the Learn more section changes (21 insertions, 1
deletion); no other rules are touched.

---
Generated by Coder Agents on behalf of @nickvigilante.
 2026-07-23 16:21:40 -05:00
Nick Vigilante 66a55e1ebd feat(docs/.style): enable Coder.GerundHeading (#25502) 
## Summary

Adds `Coder.GerundHeading`, a `warning`-level Vale rule that flags
headings and titles whose first word ends in `-ing` (a gerund or present
participle used as a verb form, like `Installing` or `Configuring`).

Task headings read better in the imperative (`Install Coder`); concept
headings read better as nouns (`Installation`). The choice is
context-dependent, so the rule is a `warning`: it annotates without
blocking CI.

The style-guide section this rule enforces already lives on `main` at
[`capitalization-and-punctuation.md#no-gerund-leading-headings`](https://github.com/coder/coder/blob/main/docs/.style/style-guide/capitalization-and-punctuation.md#no-gerund-leading-headings).
This PR adds the matching rule and nothing else: the net diff is a
single file.

## What's in this PR

- `docs/.style/styles/Coder/GerundHeading.yml` (new). Heading-scoped
`existence` rule, anchored regex `^[A-Z][a-z]+ing\b`, `level: warning`.
- `exceptions:` mirror the style guide's **Exceptions** section: `-ing`
words that name a feature, category, or attribute (`Logging`,
`Monitoring`, `Networking`, `Tracing`, `Troubleshooting`, `Pricing`,
`Billing`, ...) plus words that only look like gerunds (`Bring`,
`String`, ...).

This branch was rebuilt onto `main`'s restructured `docs/.style/` (the
single `style-guide.md` became a `style-guide/` directory and Vale moved
into `ci.yaml`), which is why the diff is now just the rule.

## Scope: rule only

The rule ships as a `warning`, so it surfaces the existing `-ing` task
headings (~200) as advisory annotations rather than failing CI.
De-gerunding those headings (imperative rewrites plus internal anchor
fixes) is a corpus-wide content change and lands in a dedicated
follow-up PR, tracked separately. Splitting keeps this PR to the rule
and keeps the content churn reviewable on its own.

<details>
<summary>Decision log</summary>

**`existence` + `scope: heading`, not `sequence` + `tag: VBG`.** Vale's
POS-tagging sequence rules are hardcoded to sentence scope and never
reach heading text, so a `VBG` sequence rule fires on paragraphs and
stays silent on H1-H6. Google's and Microsoft's heading rules all use
the existence+regex pattern; this rule follows it.

**Exceptions align to the committed style guide, not the original branch
design.** The first draft of this rule intentionally left concept-noun
gerunds (`Logging`, `Monitoring`, ...) in the flagged set. Since then,
`main`'s style guide declared exactly those as non-violations. The rule
now excepts them so the rule and the guide agree. An excepted first word
is allowed everywhere, which is a deliberate precision trade-off for a
first-word regex: `Monitoring Coder` (a task) is not flagged, but the
standalone concept heading `Monitoring` stays clean.

**Severity = warning.** The imperative-vs-noun choice is judgment-bound,
which is the case the `warning` tier exists for: strong guidance,
legitimate human-judgment exceptions, no CI block.

**Verification.** `make lint/prose` loads the rule cleanly; the excepted
words (`Troubleshooting`, `Monitoring`, `Networking`, `Logging`,
`Contributing`, `Styling`, `Scaling`, `Routing`, `Pricing`, `Billing`,
`Tracing`) each produce zero findings.

</details>

---

*Opened via Coder Agents on @nickvigilante's behalf.*
 2026-07-23 20:38:42 +00:00
earapo13 8654b1cec3 docs: add clarification of install methods in Get Started guide (#27466) 
I was confused by the difference between the Quickstart page and the
Install page.

Fixes DOCS 602

<!--

If you have used AI to produce some or all of this PR, please ensure you
have read our [AI Contribution
guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING)
before submitting.

-->
 2026-07-23 20:03:01 +00:00
Nick Vigilante 9e09fa86d8 chore: add @coder/docs as a CODEOWNER for docs content and tooling (#27240) 
Linked Linear issue:
[DOCS-571](https://linear.app/codercom/issue/DOCS-571/add-coderdocs-as-a-codeowner-for-docs-content-and-tooling-in)

## What

Adds `@coder/docs` as a CODEOWNER for documentation content and
docs-specific tooling, so the docs team is automatically requested for
review (and notified) whenever these paths change.

## Paths added

- `/docs/` — documentation content
- `/offlinedocs/` — offline docs app
- `/.vale.ini`, `/.markdownlint.jsonc`, `/.markdownlint-cli2.jsonc` —
prose/Markdown lint config
- `scripts/clidocgen/`, `scripts/apidocgen/`, `scripts/auditdocgen/`,
`scripts/metricsdocgen/`, `scripts/docgenenv/` — reference-docs
generators + shared helper
- Docs CI workflows, **co-owned with `@jdomeracki-coder`**:
`.github/workflows/doc-check.yaml`, `docs-preview.yaml`,
`deploy-docs.yaml`, `weekly-docs.yaml`

Patterns are root-anchored and appended after the existing entries. The
workflow lines co-own with `@jdomeracki-coder` (who owns `.github/`), so
no existing ownership is removed.

## Out of scope

- `.swaggo` (API swagger-gen config) — intentionally left with its
current default ownership.

## Notes

- Intended as **notify-only**: auto-requests `@coder/docs` for review on
these paths. `main` does not enforce required code-owner review, so this
does not gate merges.
- Takes effect once merged to `main`, and only if `@coder/docs` has
write access to this repo.

_Opened as a draft._
 2026-07-23 15:00:04 -05:00
McKayla はな 2f879910af fix(coderd): harden oauth2 redirect validation (#27274) 
Closes DEVEX-604

Hardens `redirect` URL handling in the OAuth2/OIDC/external-auth
callback flows so redirects are always reduced to a safe, relative path
local to the application. Previously a redirect value with an opaque
scheme (e.g. `javascript:...`) or a path with multiple leading slashes
(e.g. `///evil.com`) could survive sanitization mostly intact.

Also de-duplicates the previously copy-pasted `uriFromURL` helper (now
exported `httpmw.URIFromURL`) so there's a single implementation shared
by `coderd/userauth.go`, `coderd/externalauth.go`, and
`coderd/httpmw/oauth2.go`.

<details>
<summary>Context</summary>

Addresses a low-severity finding reported via a pentest disclosure: the
redirect sanitizer used `url.Parse(...).RequestURI()`, which doesn't
reject non-hierarchical (opaque) URLs and doesn't collapse extra leading
slashes, so crafted `redirect` values could partially survive
sanitization.

</details>

This PR was authored by a Coder Agent on behalf of @aslilac.
 2026-07-23 11:56:07 -06:00
Ehab Younes 10624122c5 feat(site/src): show spend for unlimited and zero AI budgets (#27458) 
The group members table hid a member's spend behind a bare "Unlimited"
label when their budget resolves to a group with no limit, and rendered
a $0 budget as a special "None" label. Spend now always shows: as
"$X / Unlimited USD" for unlimited budgets, and as a normal limit row
("Group limit $0", exceeded color once spend is above zero) for $0
budgets.

The Everyone badge drops "(not allocated)" when the Everyone group's
own budget or a user override applies, showing "Everyone" or
"Everyone (individual)" instead. The not-attributed tooltip now states
that the amount is the user's spend in the viewed group and that their
AI budget is managed by another group, replacing the misleading
"Not attributed to this group" wording.
 2026-07-23 17:38:05 +00:00
Jaayden HalkoandCursor 3c7a1d33e3 feat: add persisted whole-chat summary with background generation (#26657) 
Adds a persisted whole-chat summary that backs the chat summary popover.
A new nullable `chats.summary` column is populated in the background
after a successful root-chat turn and pushed to clients via a new
`chat_summary_change` watch event (distinct from `summary_change`, which
is bound to `last_turn_summary`), so the popover reads `chat.summary`
straight off the loaded `Chat` with no extra query.

This is the data source for the popover and per-chat cost UI built in
#26649; the popover can consume `chat.summary` once this lands (the
field is nullable, so merge order does not matter).

## How it works

- **Generation** runs in the existing successful-turn finalize hook,
detached from the request so the user's turn is never blocked. A cadence
gate generates the first summary after one completed turn, then
regenerates every three turns, using the `chats.summary_generated_at`
freshness marker. Generation reads compaction-aware history, renders it
to a bounded plain-text transcript (short transcripts are skipped), and
asks for a 1-3 sentence summary via structured output. Failures never
clear an existing summary.
- **Staleness** is guarded by `history_version` (mirroring
`last_turn_summary`), so a background write racing a newer turn loses
while worker lifecycle transitions cannot reject a fresh write.
- **Model selection** uses the chat's configured model.

## Deferred to follow-ups

- **Cost accounting**: the `chat_messages.cost_source` discriminator and
summary/title usage recording were removed from this PR so summary
persistence is not blocked by hidden accounting rows advancing
`history_version`. Title usage recording stays on main's
`InsertChatMessages` path.
- **Model override**: deployment-wide summary generation model selection
is split into #26803; the base feature always uses the chat model.

## Notes

- Migration `000540` adds `chats.summary` and
`chats.summary_generated_at`, and recreates `chats_expanded` to expose
the new columns.
- Root chats only; shared viewers pick up the summary on their next
refetch (live watch events are owner-only).

Refs #26649

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-07-23 16:36:23 +01:00
Danielle Maywood 9ce366414e fix(site): remember reasoning effort per model on new chat (#27457) 2026-07-23 13:37:50 +01:00
Danielle Maywood 591edcb050 chore: add DanielleMaywood as CODEOWNER of AgentsPage (#27456) 2026-07-23 10:21:45 +00:00
Paweł Banaszewski 468b1a27a3 fix: remove standalone AI Gateway http listener dependency on loading providers (#27303) 
Fixes an issue where the standalone AI Gateway waited for the initial
provider load before starting its HTTP server.

HTTP serving now starts independently of provider synchronization.
`/healthz` becomes available when the HTTP server starts, while
`/readyz` requires an active DRPC connection and completed initial
provider load.

Enables the Helm chart's startup and liveness probes by default because
liveness no longer depends on provider loading.
 2026-07-23 11:55:42 +02:00
Susana Ferreira b9fad66214 refactor: authorize AI budget reads against the user resource directly (#27443) 
Replaces the `GetUserByID` read used as an authz check in the AI budget-resolution queries with a targeted `authorizeContext` against the user resource. Same RBAC decision, one fewer db query per resolution step.

Follow-up to https://github.com/coder/coder/pull/27364#discussion_r3632577802.

> [!NOTE]
> Initially generated by Claude Opus 4.7, modified and reviewed by @ssncferreira
 2026-07-23 10:46:58 +01:00
Marcin Tojek 10bbe3b140 fix(codersdk/agentsdk): isolate http transport in reinit test (#27442) 
Fixes: https://github.com/coder/internal/issues/1451

## Problem

Flaky test
`TestStreamAgentReinitEvents/doesn't_transmit_events_if_the_transmitter_context_is_canceled`
(coder/internal#1451):

```
agentsdk_test.go:84:
    Error: Received unexpected error:
    Get "http://127.0.0.1:XXXXX": net/http: HTTP/1.x transport connection broken: http: CloseIdleConnections called
```

## Root cause

The subtests used `client := &http.Client{}`. A client with a nil
`Transport` uses the process-global `http.DefaultTransport`, which is
shared by every parallel test in the test binary.

`httptest.Server.Close()` calls
`http.DefaultTransport.CloseIdleConnections()`. When any other parallel
test closes its `httptest.Server` while this test's request is in
flight, the shared transport tears the connection down and
`client.Do(req)` fails with `http: CloseIdleConnections called`. This is
the same class of flake already documented/fixed in `testutil/oauth2.go`
and the `mcphttpclient` helpers, and related to coder/internal#1020.

## Fix

Give each client a dedicated `*http.Transport` (`&http.Client{Transport:
&http.Transport{}}`) so cross-test `CloseIdleConnections` calls cannot
break its requests. The construction is extracted into a small
`newReinitTestClient()` helper used by all three subtests, with a
comment documenting the reason.

## Verification

`go test ./codersdk/agentsdk -run TestStreamAgentReinitEvents -count=20`
passes.

The flake was reproduced against the exact failing subtest logic (real
`NewSSEAgentReinitTransmitter` with a pre-canceled transmit context,
same client pattern) under a `CloseIdleConnections` stress loop:

- Fix reverted to `&http.Client{}`: reliably FAILs (e.g. 15 broken
requests in 10s).
- Fix present: 0 broken requests across repeated runs.

<details>
<summary>Optional stress harness to reproduce/verify locally (not
committed)</summary>

Drop this into `codersdk/agentsdk/` as a throwaway `*_test.go` file. It
runs the verbatim body of the failing subtest in a loop while parallel
goroutines call `CloseIdleConnections` (exactly what
`httptest.Server.Close()` does). With the fix present it reports
`closeIdleErrs=0`; revert `newReinitTestClient` to `&http.Client{}` to
reproduce.

```go
package agentsdk_test

import (
	"context"
	"net/http"
	"net/http/httptest"
	"strings"
	"sync"
	"sync/atomic"
	"testing"
	"time"

	"github.com/google/uuid"

	"cdr.dev/slog/v3/sloggers/slogtest"
	"github.com/coder/coder/v2/codersdk/agentsdk"
)

func TestFlakeReproRealSubtest(t *testing.T) {
	t.Parallel()

	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
	defer cancel()

	var wg sync.WaitGroup
	var closeIdleErrs int64
	var sample atomic.Value

	defaultTransport := http.DefaultTransport.(*http.Transport)
	for range 8 {
		wg.Add(1)
		go func() {
			defer wg.Done()
			for ctx.Err() == nil {
				defaultTransport.CloseIdleConnections()
			}
		}()
	}

	for range 32 {
		wg.Add(1)
		go func() {
			defer wg.Done()
			for ctx.Err() == nil {
				// Verbatim body of the failing subtest.
				eventToSend := agentsdk.ReinitializationEvent{
					WorkspaceID: uuid.New(),
					Reason:      agentsdk.ReinitializeReasonPrebuildClaimed,
				}
				events := make(chan agentsdk.ReinitializationEvent, 1)
				events <- eventToSend

				transmitCtx, cancelTransmit := context.WithCancel(context.Background())
				cancelTransmit()
				transmitErrCh := make(chan error, 1)
				srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
					transmitter := agentsdk.NewSSEAgentReinitTransmitter(slogtest.Make(t, nil), w, r)
					transmitErrCh <- transmitter.Transmit(transmitCtx, events)
				}))

				req, err := http.NewRequestWithContext(ctx, "GET", srv.URL, nil)
				if err != nil {
					srv.Close()
					continue
				}
				client := newReinitTestClient() // revert to &http.Client{} to reproduce
				resp, err := client.Do(req)
				if err != nil {
					if strings.Contains(err.Error(), "CloseIdleConnections called") {
						atomic.AddInt64(&closeIdleErrs, 1)
						sample.CompareAndSwap(nil, err.Error())
					}
					srv.Close()
					continue
				}
				resp.Body.Close()
				srv.Close()
			}
		}()
	}
	wg.Wait()

	t.Logf("closeIdleErrs=%d", atomic.LoadInt64(&closeIdleErrs))
	if n := atomic.LoadInt64(&closeIdleErrs); n > 0 {
		t.Fatalf("reproduced coder/internal#1451 on the real subtest: %d requests broken (e.g. %v)", n, sample.Load())
	}
}
```

Example output with the fix reverted to `&http.Client{}`:

```
    flakerepro_test.go:88: closeIdleErrs=15
    flakerepro_test.go:90: reproduced coder/internal#1451 on the real subtest: 15 requests broken (e.g. Get "http://127.0.0.1:43755": net/http: HTTP/1.x transport connection broken: http: CloseIdleConnections called)
--- FAIL: TestFlakeReproRealSubtest (10.14s)
```

With the fix present: `closeIdleErrs=0` and PASS.

</details>

---

Generated by Coder Agents on behalf of @mtojek.
 2026-07-23 11:37:30 +02:00
Cian Johnston 73d89499e9 chore: add test-timings target to find long-running tests (#27301) 
Adds a `test-timings` Makefile target to create a report of the time
taken to run each test.

e.g.

```
$ make test-timings; head < test-timings.tsv
package test    status  elapsed_ms
github.com/coder/coder/v2/enterprise/coderd     TestWorkspaceTagsTerraform      pass    77590
github.com/coder/coder/v2/coderd        TestProvisionerJobs     pass    74210
github.com/coder/coder/v2/coderd        TestInboxNotification_Watch     pass    68600
github.com/coder/coder/v2/coderd        TestInboxNotifications_List     pass    68540
github.com/coder/coder/v2/coderd        TestTasks       pass    63830
github.com/coder/coder/v2/cli   TestServer      pass    46980
github.com/coder/coder/v2/cli   TestAutoUpdate  pass    46700
github.com/coder/coder/v2/enterprise/coderd     TestTemplates   pass    46160
github.com/coder/coder/v2/enterprise/coderd     TestUserOIDC    pass    43800
```

> Generated by Coder Agents with prodding by this human.
 2026-07-23 09:51:10 +01:00
Susana Ferreira c23f2c0223 feat: fall back to the Everyone group for AI spend attribution (#27364) 
## Description

Previously, a user with no per-user override and no membership in a budgeted group had no effective group, so their AI spend was attributed nowhere and was, therefore, untracked. This change falls back to the organization's Everyone group when no override or group budget applies.

Since every user in an organization is implicitly a member of that org's Everyone group, spend is now attributed and tracked for any user with organization membership. A user with no organization membership resolves to no group, so their daily spend is not incremented and a warning is logged.

The fallback is unlimited, so enforcement is unaffected: only override and group budgets can block requests. For users in multiple organizations, an existing budget on any Everyone group is still chosen by the "highest" policy; when none is budgeted, the fallback prefers the default org, then orders by organization name.

## Changes

- Add `ResolveUserEffectiveGroup` and the `GetUserEveryoneFallbackGroup` query: resolve override → group budget → Everyone group fallback.
- Attribute token-usage spend and the user AI spend endpoint via the fallback, so unbudgeted users resolve to their Everyone group instead of null.
- Update `GetGroupMembersAISpend` to surface the Everyone fallback as the effective group.
- Update `GetHighestGroupAIBudgetByUser` to break ties by organization name then group name, keeping multi-org resolution deterministic and consistent with the fallback.
- For multi-org users with no budget anywhere, the fallback picks the Everyone group deterministically: prefer the default org, then order by organization name.

Closes https://linear.app/codercom/issue/AIGOV-509/fall-back-to-the-everyone-group-for-spend-attribution

> [!NOTE]
> Initially generated by Claude Opus 4.7, modified and reviewed by @ssncferreira
 2026-07-23 09:26:25 +01:00
Atif Ali 671173b498 ci: harden GitHub workflow permissions to least privilege (#27414) 
## Summary

Hardens GitHub Actions workflow token permissions to address OpenSSF
Scorecard findings.

## Changes

- Default affected workflows to no token permissions (`permissions:
{}`).
- Move required write permissions directly to the jobs that consume
them.
- Document the least-privilege permissions rule in `AGENTS.md`: never
grant write permissions at the workflow top level; scope grants to
`jobs.<id>.permissions`.

## Validation

- `make lint-light` passed locally via pre-commit hooks.

> 🤖 This PR was created with the help of Coder Agents, and needs a human
review. 🧑💻
 2026-07-23 13:03:40 +05:00
Michael Suchacz 52a687902f docs: add frontend-review skill for pre-PR FE rule audits (#27408) 
## What

Adds `.claude/skills/frontend-review`, a diff-scoped self-review skill
that audits changes under `site/src/` against the FE1 to FE10 rule
contract before a PR is created or updated. Each rule has a concrete
"what to look for in a diff" checklist, and the output format is a terse
per-rule PASS/FAIL table with `file:line` findings.

Wiring:

- `site/AGENTS.md` Pre-PR Checklist gains step 6: run the audit when the
diff touches `site/src/`.
- `.claude/skills/code-review` now cites FE rule IDs for frontend
findings.
- The deep-review `frontend-reviewer` role audits against the same
contract.

## Why

Most frontend review findings are semantic (missing interaction
coverage, clobbered form state, near-duplicate components) and cannot be
linted. Today they are caught post-hoc by reviewers and the review bot,
which is exactly the "PRs get complaints" experience. Running the same
rubric before the PR exists converts review rounds into pre-push fixes.

Stacked on #27407 (the rule contract). The deterministic-checks
follow-up (#27409) was closed; that subset will be enforced through
proper linting instead.

> This PR was written by Mux, an AI coding agent, on behalf of Mike.
 2026-07-23 07:22:10 +02:00
Michael Suchacz 5565fcd03b docs: add frontend pattern rule contract (FE1-FE10) (#27407) 
## What

Adds `.claude/docs/FRONTEND_PATTERNS.md`, a canonical frontend rule
contract for `site/src/` with ten stable rule IDs (FE1 to FE10), each
with short incorrect/correct examples using real repo idioms. Adds a
compact non-negotiables index at the top of `site/AGENTS.md` and links
the contract from the root `AGENTS.md` frontend routing line.

## Why

Frontend PRs keep drawing the same review findings. Mining the last 18
months of `site/` PR review data (330 closed/merged PRs, 1,105 inline
comments, 358 actionable pattern findings across 57 PRs) shows the
recurring themes, in order of frequency: missing Storybook interaction
coverage, loose TypeScript, component duplication and PR scope,
redundant comments, unhandled UI states, accessibility, react-query
misuse, and effect misuse. The guidance largely existed in
`site/AGENTS.md` already, but as unprioritized prose with no shared
vocabulary.

Stable rule IDs give reviewers, agents, and tooling one shared language
("FE7: re-typed query key"), and the rules are ordered by how often
reviewers actually flagged them.

This is the first PR of a stack of two:

1. This PR: the rule contract.
2. A `frontend-review` skill that audits diffs against these rules
pre-PR (#27408).

A third PR with a deterministic ratchet script (#27409) was closed; the
machine-checkable subset will be enforced through proper linting
instead.

## Notes for reviewers

The rule content is derived from your own review comments (for example,
the re-typed query key example in FE7 mirrors feedback on #27385). If a
rule does not match how you want the frontend built, the contract file
is the place to change it.

> This PR was written by Mux, an AI coding agent, on behalf of Mike.
 2026-07-23 07:21:27 +02:00
dependabot[bot] 80f8e4f624 chore: bump next from 15.5.18 to 15.5.21 in /offlinedocs (#27441) 
Bumps [next](https://github.com/vercel/next.js) from 15.5.18 to 15.5.21.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/next.js/releases">next's
releases</a>.</em></p>
<blockquote>
<h2>v15.5.21</h2>
<p>This release contains security fixes for the following
advisories:</p>
<p>High:</p>
<ul>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial
of Service in App Router using Server Actions</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware
/ Proxy bypass in App Router applications using Turbopack and single
locale</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side
Request Forgery in rewrites via attacker-controlled destination
hostname</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side
Request Forgery in Server Actions on custom servers</a></li>
</ul>
<p>Moderate:</p>
<ul>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache
confusion of response bodies for requests with bodies</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache
confusion of response bodies for requests with bodies containing invalid
UTF-8 byte sequences</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial
of Service in the Image Optimization API using SVGs</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated
disclosure of internal Server Function endpoints</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded
Server Action payload in Edge runtime</a></li>
</ul>
<h2>v15.5.20</h2>
<p>Contains no changes except publishing <code>@next/swc-wasm-web</code>
which was accidentally not published since 15.5.15.</p>
<h2>15.5.19</h2>
<blockquote>
<p>[!NOTE]
This release is backporting bug fixes. It does <strong>not</strong>
include all pending features/changes on canary.</p>
</blockquote>
<h3>Core Changes</h3>
<ul>
<li>[15.5.x] Don't drop <code>FormData</code> entries (<a
href="https://redirect.github.com/vercel/next.js/issues/94244">#94244</a>)</li>
</ul>
<h3>Other</h3>
<ul>
<li>[15.5.x] Fix CI (<a
href="https://redirect.github.com/vercel/next.js/issues/94281">#94281</a>)</li>
</ul>
<h3>Credits</h3>
<p>Huge thanks to <a
href="https://github.com/eps1lon"><code>@​eps1lon</code></a> for
helping!</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/next.js/commit/e26f6ffaa710fc62ca0c8640db0e43b6663edf32"><code>e26f6ff</code></a>
v15.5.21</li>
<li><a
href="https://github.com/vercel/next.js/commit/7f5deeb6c594b7515edecb879b0547beba1b8a82"><code>7f5deeb</code></a>
[15.x] Improve performance of checking valid MPA form submissions</li>
<li><a
href="https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4"><code>57c31f7</code></a>
[15.x] Enforce <code>serverActions.bodySizeLimit</code> for Server
Actions in Edge runtime</li>
<li><a
href="https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498"><code>e3e5666</code></a>
[15.x] Set correct origin for internal redirects in custom server</li>
<li><a
href="https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9"><code>35f5013</code></a>
[15.x] Ensure exotic rewrite param values are properly encoded</li>
<li><a
href="https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c"><code>062f667</code></a>
[15.x] fix(fetch-cache): key fetch(Request, init) by the effective
request</li>
<li><a
href="https://github.com/vercel/next.js/commit/577c9dc0a08ac806e35f591fec528d5fb7407ad4"><code>577c9dc</code></a>
[15.x] fix(incremental-cache): byte-exact fetch cache key for binary
bodies</li>
<li><a
href="https://github.com/vercel/next.js/commit/530d4fa31e010a05f28ea6e26a5f51f80f61e0c6"><code>530d4fa</code></a>
[15.x] fix(next/image): improve performance of detectContentType()</li>
<li><a
href="https://github.com/vercel/next.js/commit/8fabaf3225be100d62dfb0f44d85ab43c2a14a20"><code>8fabaf3</code></a>
[15.x] Performance improvements when decoding React Server function
payloads</li>
<li><a
href="https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b"><code>ff12a61</code></a>
[15.x] Validate server reference IDs during manifest lookup</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/next.js/compare/v15.5.18...v15.5.21">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=next&package-manager=npm_and_yarn&previous-version=15.5.18&new-version=15.5.21)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/coder/coder/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-23 02:20:39 +00:00
McKayla はな 630a68c173 chore: enable pixel auto review (#27439) 2026-07-22 19:56:39 -06:00
McKayla はな 1c2bb07b81 chore(site): upgrade to pixel 0.2 (#27353) 2026-07-22 22:27:05 +00:00
Jeremy Ruppel 6b22383823 fix(site/src/pages/TemplateBuilder): show all step content without inner scroll (#27437) 
## Summary

The Template Builder steps clipped their content to an inner scrollbar
via
`max-h-[calc(...)]` + `overflow-y-auto`, so the base picker showed fewer
than
three rows before requiring scroll. This removes those wrappers from all
four
steps so every base/module renders and the page scrolls naturally.

Resolves DEVEX-585.

## Changes

- `BaseInfraSelectStep.tsx` — base picker grid (3-col grid retained)
- `ModuleSelectStep.tsx` — module picker grid
- `ModuleSettingsStep.tsx` — module variables list
- `BaseTemplateParametersStep.tsx` — base config; unwrapped the
now-styleless
  wrapper `div` into the fragment

The sticky sidebar summary (`SelectionSummary.tsx`) is intentionally
left as-is;
it is not a wizard step.

### Tradeoff

With the inner scroll removed, the Back/Continue controls sit below the
full
grid, so reaching them requires page scroll when a list is long. This
matches
the requested "just show all of em" behavior.


https://github.com/user-attachments/assets/7e371850-7b97-42c7-b92c-5ac00a3e7979

<details>
<summary>Implementation plan</summary>

# DEVEX-585: Show more base templates before requiring scroll

## Problem
The base template picker on the Template Builder feels too narrow: it
clips to
fewer than three rows before an inner scrollbar appears.

## Root cause
The step grids were wrapped in `max-h-[calc(100vh-420px)]
overflow-y-auto`
(and `340px` variants), constraining height so only a couple of rows
showed
before an inner scrollbar clipped the rest.

## Approach (chosen: remove inner scroll)
Show all content and let the page scroll naturally by removing the
height/scroll utilities (and stale comments) from each step's container.
Applied to the base picker, base parameters, module picker, and module
settings steps.

## Testing / verification
- Biome check passes on all edited files; LSP reports no diagnostics.
- Visual: each step renders all content with no inner scrollbar; the
page
  scrolls if the list is long.

## Out of scope
- The sidebar summary scroll (`SelectionSummary.tsx`) is not a wizard
step.
- Auto-filling customization fields (separate work, PR #27272).

</details>

---

This PR was generated by Coder Agents on behalf of @jeremyruppel.
 2026-07-22 16:05:29 -05:00
Jeremy Ruppel 877c13de2b fix(.mcp.json): use pnpm dlx for typescript-language-server (#27294) 
## Problem

The `typescript-language-server` MCP server in `.mcp.json` launched the
language server via `pnpx`, but `pnpx` is not installed in the workspace
(only `pnpm` is available). As a result the server failed to start and
appeared inactive/broken.

## Fix

Swap `pnpx` for the pnpm equivalent, `pnpm dlx`, so the language server
is fetched and run correctly:

```diff
 "-lsp",
-"pnpx",
+"pnpm",
 "--",
+"dlx",
 "typescript-language-server",
 "--stdio"
```

## Verification

- `pnpm dlx typescript-language-server@latest --version` returns
`5.3.0`.
- Ran the full chain `go run
github.com/isaacphi/mcp-language-server@latest -workspace ./site/ -lsp
pnpm -- dlx typescript-language-server --stdio`. It logged `Successfully
registered all MCP tools` and stayed up cleanly until terminated.

---

_This PR was generated by Coder Agents on behalf of @jeremyruppel._
 2026-07-22 15:52:50 -05:00
Jeremy Ruppel c309f4d5ff feat(site/src/pages/TemplateBuilder): auto-fill customization fields from base template (#27272) 
Closes
[DEVEX-586](https://linear.app/codercom/issue/DEVEX-586/auto-fill-customization-fields-from-selected-base-template).

The Template Builder wizard's final **Customizations** step rendered
empty inputs for ID, Display name, Description, and Icon. This seeds
those fields with sensible defaults derived from the selected base
template, while keeping every field editable.

## Changes

All frontend, in `site/src/pages/TemplateBuilder/wizardState.ts`:

- `SelectedBaseMeta` now carries `description`, mapped in
`toSelectedBaseMeta`.
- New pure helper `baseCustomizationDefaults(base)` maps the base to `{
name: base.id, displayName: base.name, description, icon }`.
- `SET_BASE` seeds the four customization fields when the base changes
(still clearing base variable values). Re-selecting the same base
preserves user edits.
- `initWizardState` seeds the same defaults for the `?base=` deeplink
entry path.
- `RESET_CUSTOMIZATIONS` (fired on back-navigation) now resets only
organization/provisioner state, so auto-filled values survive stepping
back and forth.

No change was needed in `TemplateCustomizationsStep.tsx`; it already
binds to these state fields, so seeded values render and stay editable.
Existing placeholders remain as the fallback when a base value is empty
(e.g. `scratch`).

### Default mapping

| Form field   | State key     | Source             |
| ------------ | ------------- | ------------------ |
| ID           | `name`        | `base.id`          |
| Display name | `displayName` | `base.name`        |
| Description  | `description` | `base.description` |
| Icon         | `icon`        | `base.icon`        |

`base.id` is used for the ID field because base ids are already valid
template slugs (`docker`, `aws-linux`, ...). Icon values are already
served asset paths (`/icon/*`, `/emojis/*`), so no lookup map is needed.

## Testing

- `wizardState.test.ts`: 27 passing, including new coverage for seeding,
base-change re-seed, same-base edit preservation,
`RESET_CUSTOMIZATIONS`, `initWizardState`, `toSelectedBaseMeta`, and
`baseCustomizationDefaults`.
- `biome check` clean; `tsc --noEmit` clean.

<img width="1043" height="593" alt="Screenshot 2026-07-15 at 2 17 19 PM"
src="https://github.com/user-attachments/assets/25620df4-b020-4430-b5f3-9ce8b7b9f379"
/>

<details>
<summary>Implementation plan</summary>

# DEVEX-586: Auto-fill customization fields from selected base template

## Goal

In the Template Builder wizard, the final **Customizations** step
currently renders empty inputs for Display name, Description, ID, and
Icon. Pre-populate these with sensible defaults derived from the
selected base template, while keeping every field editable. Organization
is already auto-selected when a single org is available, so it is out of
scope beyond leaving it untouched.

Source: Linear DEVEX-586 (Ben Potter): "Would love if all these options
... were auto-filled and generated and can be edited versus the user
manually filling it out." Fields called out: display name, description,
ID, and icon.

## Current behavior (findings)

Frontend lives in `site/src/pages/TemplateBuilder/`.

- `TemplateCustomizationsStep.tsx` renders the four fields bound to
`state.displayName`, `state.description`, `state.name` (the "ID" field),
and `state.icon`. All start empty (`initialWizardState`).
- `wizardState.ts` holds the state, the `wizardReducer`, and the
`SelectedBaseMeta` UI type.
  - `SelectedBaseMeta` did not carry `description`.
- `toSelectedBaseMeta(base)` maps the API `TemplateBuilderBase` into
`SelectedBaseMeta`.
- `SET_BASE` set the base and cleared `baseVariableValues` only when the
base id changed; customization fields were left empty.
- `RESET_CUSTOMIZATIONS` (dispatched by `handleBack`) blanked
org/provisioner plus `name`, `displayName`, `description`, `icon`.
- `initWizardState(preselectedBase)` seeded `baseTemplateId` and
`selectedBase` for deeplinks but left customization fields empty.
- API type `TemplateBuilderBase` exposes `id`, `name`, `description`,
`icon`, `os`, `variables`, `prerequisites`.
- Backend (`coderd/templatebuilder_handler.go`) builds each base from
the built-in `TemplateExample`: `id = ex.ID`, `name = ex.Name`,
`description = ex.Description`, `icon = ex.Icon`.
- Base IDs are valid template names (lowercase, hyphen-separated):
`docker`, `kubernetes`, `aws-linux`, `aws-windows`, `gcp-linux`,
`gcp-windows`, `azure-linux`, `digitalocean-linux`, `scratch`.

## Default mapping

| Form field | State key | Default source |
| --- | --- | --- |
| ID (required) | `name` | `base.id` |
| Display name | `displayName` | `base.name` |
| Description | `description` | `base.description` |
| Icon | `icon` | `base.iconUrl` (`base.icon`) |
| Organization | `organizationId` | unchanged (already auto-selected) |

Rationale for `name = base.id`: base ids are guaranteed valid template
slugs, whereas slugifying the human display name is lossy and can
collide. The field stays editable.

## Icon default: confirmed, no map needed

The API already returns normalized, served asset paths in `base.icon`
(e.g. `/icon/docker.png`, `/icon/aws.svg`, `/emojis/1f4e6.png` for
`scratch`), the same values `CreateTemplatePage` assigns when creating
from a built-in example. `IconField` accepts any URL/path, so every base
renders correctly. A base-id-to-icon map is unnecessary.

## Implementation

Frontend-only, in `wizardState.ts`:

1. Add `description?: string` to `SelectedBaseMeta`; map it in
`toSelectedBaseMeta`.
2. Add pure helper `baseCustomizationDefaults(base)` returning `{ name,
displayName, description, icon }`.
3. `SET_BASE`: on base change, spread the defaults alongside the
`baseVariableValues: {}` reset; on same-base re-selection, preserve
existing values.
4. `initWizardState(preselectedBase)`: spread defaults into the returned
state.
5. Narrow `RESET_CUSTOMIZATIONS` to reset only `organizationId` and
`hasProvisioners`.
6. `toCreateTemplateRequest` already sends the fields, so no payload
change.

## Tests

Reducer unit tests in `wizardState.test.ts` for seeding, base-change
re-seed, same-base edit preservation, `RESET_CUSTOMIZATIONS`,
`initWizardState`, `toSelectedBaseMeta` (description carried), and
`baseCustomizationDefaults`.

## Scope / non-goals

- No backend changes; the API already returns all needed fields.
- Organization auto-selection is unchanged.
- No slug transformation of display names (base id is used directly).
- No base-id-to-icon map.

</details>

---
*Opened by Coder Agents on behalf of @jeremyruppel.*
 2026-07-22 15:09:37 -05:00
dependabot[bot] 923667013e chore: bump google.golang.org/grpc from 1.82.0 to 1.82.1 (#27431) 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from
1.82.0 to 1.82.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/grpc/grpc-go/releases">google.golang.org/grpc's
releases</a>.</em></p>
<blockquote>
<h2>Release 1.82.1</h2>
<h1>Security</h1>
<ul>
<li>server: Stop reading from the connection when flooded by HTTP/2
frames. The default value for this limit is 100 frames, excluding DATA
and HEADERS, and may be changed by setting environment variable
<code>GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT</code>.</li>
<li>xds/rbac: Support <code>Metadata</code> and
<code>RequestedServerName</code> permissions matcher fields. If present
in a DENY rule, previously these would be ignored and fail-open.</li>
<li>xds/rbac: Fix panic when parsing unsupported fields in
<code>NotRule</code>/<code>NotId</code> permissions.</li>
<li>xds/rbac: Support the deprecated <code>source_ip</code> principal
identifier by treating it as equivalent to
<code>direct_remote_ip</code>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/grpc/grpc-go/commit/ebd8f06a09426fbece97157c95c3917abff28f4e"><code>ebd8f06</code></a>
Change version to 1.82.1 (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9238">#9238</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/4ea465d4ab98013f72a142fe0fc89c19770b2935"><code>4ea465d</code></a>
Cherry-pick commits (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9236">#9236</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/9494a2cf32a0ec9d35420af401445ef3c9f66f05"><code>9494a2c</code></a>
Change version to 1.82.1-dev (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9171">#9171</a>)</li>
<li>See full diff in <a
href="https://github.com/grpc/grpc-go/compare/v1.82.0...v1.82.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/grpc&package-manager=go_modules&previous-version=1.82.0&new-version=1.82.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/coder/coder/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-22 18:39:27 +00:00
Michael Suchacz 02fd1cc691 feat: allow spawn_agent model and reasoning effort override (#27385) 2026-07-22 18:43:22 +02:00
Paweł Banaszewski 8a3fb04510 feat: add Helm chart for standalone AI Gateway (#27256) 
Adds the `coder-ai-gateway` Helm chart for deploying the Coder AI
Gateway as a standalone Kubernetes workload.

Adds the coder-ai-gateway Helm chart for deploying the Coder AI Gateway as a standalone Kubernetes workload.

The chart supports AI Gateway keys from an existing Secret or environment configuration, Coder connectivity through CODER_URL, listener and Coder-facing TLS, and optional Service, Ingress, and Gateway API HTTPRoute resources.

Integrates the chart with existing Helm build, lint, golden generation, release artifact, Helm repository, and OCI publishing workflows.
 2026-07-22 17:42:42 +02:00
dylanhuff-at-coder 99e740bdb7 feat: add user secrets file parser and shared validator (PLAT-240) (#26723) 
Part of the **PLAT-240** bulk secret import stack: this PR adds the
`codersdk` parser and shared create-secret validator used by the
follow-up batch endpoint and UI PRs.

`ParseSecretsFile` parses `.env`, `.json`, and `.yaml` files into
`CreateUserSecretRequest` entries in source order, with size, count,
duplicate-key, structure, and malformed-input checks.
`ValidateCreateUserSecretRequest` now backs the single-create handler
too, so create validation has one SDK-level implementation.

Part of https://linear.app/codercom/issue/PLAT-240

> This PR was generated by Coder Agents on behalf of
@dylanhuff-at-coder.
 2026-07-22 06:23:38 -07:00
Danielle Maywood ff71bb3850 fix(site): align AI Settings model provider dropdowns (#27391) 2026-07-22 14:13:31 +01:00
Sas SwartandClaude Opus 4.8 f17d488479 feat: add network call badges to AI sessions table (#27341) 
Surface the total and blocked Agent Firewall network calls on the AI
sessions list. Sessions that did not pass through Agent Firewall show as
"Disabled".

<img width="2842" height="1366" alt="image"
src="https://github.com/user-attachments/assets/2a68b4a9-4d93-454d-a06e-5f0d0b734a33"
/>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-22 14:16:31 +02:00
Danielle Maywood 507ce504f8 refactor(site): align AgentsPage layout naming with codebase conventions (#27378) 2026-07-22 13:16:14 +01:00
Ehab Younes 6ec45f75c6 chore(site): replace handrolled AI spend types with generated types (#27342) 
The groups and group members pages consumed AI spend through local ai_cost_control wrapper types with TODOs to adopt the generated contract. Both spend endpoints are now live, so this switches to the generated types and hardens the fetch path.

- Use OrganizationGroupsAISpend and GroupMembersAISpend from typesGenerated for the org groups and group members spend endpoints
- Fetch identity and spend separately, joining by group_id/user_id at the container so each row gets one enriched object
- Batch spend requests at the backend cap of 100 IDs in the API client and merge the responses, with table-driven tests covering both endpoints
- Treat a null effective_group_id as a budget managed by a group in another org: render an em-dash with an info tooltip and skip the group name lookup instead of firing an empty-ID request

Closes AIGOV-509
 2026-07-22 12:17:22 +03:00
Nick Vigilante d485786dfe ci(.github/workflows): list all changed doc pages with review checkboxes (#27166) 
## Problem

The `docs-preview` comment bot links to exactly one changed page under
`docs/`. See
https://github.com/coder/coder/pull/27161#issuecomment-4937078346, where
the PR touched a few dozen pages but the comment only surfaced one
preview link, with no way to track which of the other pages had actually
been reviewed.

## Changes

Scope: this PR only touches `.github/workflows/**`.

- List a preview link for **every** added/modified Markdown file under
`docs/` in the PR, not just the first.
- Filter that list to files that resolve to a route in
`docs/manifest.json` (fetched as a raw blob at the PR head sha).
Anything else (`docs/.style/**` contributor tooling, or a page not wired
into navigation) is dropped so the comment never links to a 404.
- Render each page as a Markdown checklist item a reviewer can check off
in the GitHub UI as they review the rendered coder.com preview.
(GitHub's native per-file "Viewed" state tracks the raw diff and can't
deep-link to the preview, which is why the workflow keeps its own
state.)
- Round-trip checked state across pushes: a page's checkbox stays
checked as long as its blob sha hasn't changed since the comment was
last updated, and resets to unchecked the moment new content lands on
that page (a checked box means "I've reviewed the current revision," not
some earlier one). State is stored as a hidden base64 `path -> sha`
marker and recovered defensively (a malformed or non-object marker
resets safely to unchecked).
- Keep the comment under GitHub's 65,536-character limit by building and
measuring the exact posted body, then binary-searching the largest
leading prefix of pages that fits; omitted pages are summarized with a
link to the PR Files tab.
- Extended `test-docs-preview-mapper.sh` with regression tests for the
manifest-path normalization, checkbox-line parsing, checked-state
carryover, base64 state round-trip, and comment-size capping.

Linear:
[DOCS-541](https://linear.app/codercom/issue/DOCS-541/docs-preview-pr-comment-list-all-changed-pages-with-per-page-viewed)

<details>
<summary>How this was tested</summary>

GitHub Actions can't easily be run locally, so I extracted the `run:`
script logic and exercised it against a fake `gh` CLI backed by JSON
fixtures, covering:

1. First run: several changed pages, one under `docs/.style/`, one not
in the manifest, one image, one removed file. Only the
manifest-resolvable pages show up, all unchecked.
2. Second run: a page with an unchanged sha stays checked; a page whose
sha changed resets to unchecked even though it was previously checked; a
brand-new page starts unchecked.
3. No eligible Markdown files on a push, and Markdown files present but
none resolving to a manifest route: the stale comment gets deleted.
4. State round-trip: a valid base64 `path -> sha` marker is recovered;
an undecodable marker and a valid-but-non-object marker both reset
safely to `{}`; an emitted marker survives a full round-trip.
5. Comment-size cap: a repo-scale case of 400 long paths with a long
branch keeps the largest prefix that fits under budget (176/400 at ~64.8
KB) and confirms one more page would exceed the 65 KB budget.

`shfmt`, `shellcheck`, `actionlint`, and `bash
.github/workflows/test-docs-preview-mapper.sh` all pass.

</details>

## What this looks like

<img width="900" height="380" alt="docs-preview-demo"
src="https://github.com/user-attachments/assets/daf71781-1a88-4d90-a063-8f1ebcc84b42"
/>

---

*This PR description and the underlying changes were prepared with Coder
Agents assistance.*
 2026-07-21 15:16:29 -05:00
Nick Vigilante f5e0c1a860 fix: correct invalid inline HTML in hand-written docs (#27298) 
## What

Fixes three classes of invalid inline HTML in hand-written docs, all of
which
render incorrectly (or only render by accident) today. Found via a
systematic,
markdown-aware audit of every `.md` under `docs/` (ignores code blocks,
inline
code, comments, and autolinks), so this is a complete sweep of the
hand-written
surface, not a spot fix.

## Changes

1. **`<kdb>` → `<kbd>` (72 tags).** The keyboard element is `<kbd>`;
`<kdb>` is
a typo that is not a real element, so renderers drop/mangle it and the
   keystrokes lose their styling. Corrected across the IDE access guides
(`cursor.md`, `windsurf.md`, `antigravity.md`). The correct `<kbd>` is
   already used in the JetBrains Gateway guide.
2. **Unclosed `<div class="tabs">` in `docs/admin/users/idp-sync.md`.**
The
"Provider-Specific Guides" section opened a `.tabs` container (rendered
as
the `DocsTabs` component) that was never closed, so the wrapper leaked
over
the rest of the page. Added the missing `</div>` before `## Next Steps`,
   matching the three other tab sections in the same file.
3. **`<Image>` → `<img>` (6 tags).** `<Image>` is not a registered docs
component — it renders only because the HTML5 parser rewrites the legacy
`<image>` tag to `<img>`. Converted to lowercase `<img>` for correctness
and
   clarity; rendering is unchanged. (`organizations.md`, `idp-sync.md`,
   `add-envbuilder.md`.)

## Scope / what is intentionally not here

- **Generated reference docs.** The audit also found swallowed
placeholders in
  generated pages (`<server>` in `reference/api/{chats,schemas}.md`;
`<glob>`/`<host>` in `agent-firewall`; `<region>` in `server`). Those
are
fixed at the generator source (codersdk comments / CLI flag help) and
tracked
  in DOCS-551.
- **`<b>Resource<b>`** in the generated audit-logs table was fixed
separately in
  #27293 (merged) and is not duplicated here.
- **`<children></children>`** is an intentional, renderer-implemented
docs
component (child-page card grid) with no HTML equivalent, so it is left
as-is.
It is well-formed; a follow-up CI checker will still verify its
open/close
  balance.

A follow-up adds CI enforcement so invalid inline HTML can't regress.

<details>
<summary>Verification</summary>

Run against the changed files:

- `markdownlint-cli2` — 0 errors
- `markdown-table-formatter --check` — no changes needed
- `typos --config .github/workflows/typos.toml` — clean
- Re-running the audit scanner: hand-written `unclosed`, `<kdb>`, and
  capitalized-component findings all drop to 0 (only the generated-doc
  placeholders tracked in DOCS-551 remain).

</details>

## Linear

DOCS-581:
https://linear.app/codercom/issue/DOCS-581/audit-and-fix-all-invalid-html-across-the-docs

> This PR was created with AI assistance (Coder Agents).
 2026-07-21 19:59:59 +00:00
Steven Masley d77aa3bca3 test(coderd): make TestTemplateVersionDryRun/ImportNotFinished deterministic (#27386) 
Closes PLAT-334 /
[coder/internal#1221](https://github.com/coder/internal/issues/1221).

The subtest asserts HTTP 425 while the import job is unfinished, but it
ran a real provisioner daemon. Any failure in an early import phase
(init, parse, update job) sets `CompletedAt`, which is all
`postTemplateVersionDryRun` checks, so the endpoint could return 201 and
flake.

Run the subtest without a provisioner daemon: the job is never acquired,
stays pending, and the 425 is deterministic.

> Generated by Coder Agents on behalf of @Emyrk.
 2026-07-21 13:16:26 -05:00
Michael Suchacz 608c2ee46f fix(site/src/pages/AgentsPage/components/ChatMessageInput): scroll skills menu selection into view (#27345) 
When navigating the slash skills menu with arrow keys, moving the
highlight past the visible area did not scroll the list, so the selected
skill went out of view.

The menu drives cmdk in controlled mode while arrow keys are consumed by
the Lexical trigger plugin, so cmdk's internal scroll-into-view never
runs for keyboard navigation. This adds a layout effect in
`SkillsTriggerMenu` that scrolls the highlighted item (and its group
heading when it is the first item in a group) into view on
keyboard-driven index changes, while skipping pointer-driven highlights
to avoid hover/scroll loops, matching cmdk's own behavior.

Covered by two new interaction stories that fail without the fix:
`ScrollsSelectionIntoView` (menu in isolation) and
`ArrowKeysScrollMenuList` (end-to-end arrow-key wrap in
`ChatMessageInput`).

> Opened by Mux, an AI coding agent, on Mike's behalf.
 2026-07-21 19:23:42 +02:00
Nick Vigilante f55be09bfc docs(docs/ai-coder/ai-gateway): fix bmcp_ described as suffix instead of prefix (#27392) 
The Tool Injection section of the AI Gateway MCP doc called `bmcp_` a
suffix, directly contradicting the correct description one section
earlier on the same page and the `aibridge` implementation, where
`injectedToolPrefix` is prepended to every bridged MCP tool name
(`aibridge/mcp/tool.go`).

Reported by a customer who read the suffix wording and assumed `bmcp` in
a tool name like `bmcp_github_list_gists` was a typo.

---
🤖 Built with AI assistance.
 2026-07-21 11:59:30 -05:00
Michael Suchacz dcf3cce51c fix(site/src/pages/AgentsPage): clarify empty context usage popover state (#27389) 
## Summary

The context usage badge popover showed "Context usage unavailable"
before any assistant message reported token usage, which read like an
error. This changes the empty-state copy to "Context usage will appear
after sending a message." and fixes a spacing bug that state exposed:
the pinned context list's top margin was conditional on a usage
percentage being present, so without usage data the list sat flush
against the message.

## Changes

- `ContextUsageIndicator`: new empty-state copy; unconditional `mt-2` on
the context list.
- Stories: `NoUsage` (message only) and `NoUsageWithContext` (message
plus pinned resource list), both asserting the new copy via hover
interactions.

## Testing

- Storybook interaction stories cover both empty states.
- `biome check` and `tsc --noEmit` pass; verified visually in Storybook.

> This PR was authored by Mux, an AI coding agent, acting on Mike's
behalf.
 2026-07-21 16:24:35 +00:00
Atif Ali 2b2a5c963a Revert "fix(coderd): explain default GitHub app org visibility on login rejection" (#27388) 2026-07-21 16:17:27 +00:00
Atif Ali 48e9bb3391 fix(coderd): explain default GitHub app org visibility on login rejection (#27374) 
## Problem

On a fresh deployment with no custom GitHub OAuth app, Coder falls back
to the default Coder-managed GitHub app. That app can only see
organization memberships in organizations where it has been installed.
If `CODER_OAUTH2_GITHUB_ALLOWED_ORGS` is set but the app isn't installed
in the allowed organizations, the membership list comes back empty and
every login, including the first admin login, is rejected with a bare
"You aren't a member of the authorized Github organizations!" with no
hint about the actual cause. This leaves fresh deployments in an
apparently broken state.

## Fix

* Append a remediation hint to the login rejection when the default
provider is configured, pointing at the [app installation
page](<https://github.com/apps/coder/installations/select_target>) and
at configuring a custom GitHub OAuth app.
* Log a startup warning when the default provider is combined with
`CODER_OAUTH2_GITHUB_ALLOWED_ORGS`, listing the allowed orgs and the
install URL.
* Document the installation requirement next to the
`CODER_OAUTH2_GITHUB_ALLOWED_ORGS` step in the GitHub auth docs.

Access-control behavior is unchanged; the org check still rejects logins
as before, it just explains why and how to fix it.

## Testing

* New `TestUserOAuth2Github/NotInAllowedOrganizationDefaultProvider`
asserts the hint appears when `DefaultProviderConfigured` is set; the
existing `NotInAllowedOrganization` subtest asserts it does not leak
into the custom-app path.

Fixes coder/coder#17752
 2026-07-21 20:43:10 +05:00
Sas SwartandClaude Opus 4.8 a9a1dcc65d feat: add network calls column to AI sessions table (#27269) 
Add a "Total/blocked network calls" column to the AIBridge sessions
table.

Update `ListAIBridgeSessions` query to calculate network called made and
blocked per session. See query plan
[here](https://explain.dalibo.com/plan/54355c90b165ggb4).

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
 2026-07-21 14:34:23 +02:00
Cian Johnston bce9ba3356 chore: update CODEOWNERS for both aibridged and chatd (#27376) 2026-07-21 13:22:24 +01:00
Thomas Kosiewski aa89801ee5 fix(coderd/x/chatd/chatadvisor): textualize advisor prompt tool exchanges (#27059) 
Closes CODAGT-592.

## Problem

The advisor tool sometimes fails with the opaque error `advisor produced
no text output`. Live reproduction against `claude-sonnet-4-6` showed
the cause: `BuildAdvisorMessages` forwards the parent conversation's raw
`tool_use`/`tool_result` blocks into the nested advisor call, which
defines no tools. The nested model imitates the forwarded pattern and
spends its turn committing to a tool call it cannot make (captured
reasoning from a failing run: "The user wants me to make another tool
call to the advisor about writing a poem about cucumbers."), so the step
ends with reasoning-only or empty content and no advice. Because each
chat step currently rebuilds the advisor runtime and snapshot
(CODAGT-593), the second advisor call in a run reliably sees the first
call's exchange, which is why the first call succeeds and later ones
fail.

## Fix

- `BuildAdvisorMessages` rewrites tool activity as plain-text notes:
assistant tool-call parts are removed and folded, together with their
matching result, into a single user-role note of the form `[The parent
agent ran the X tool with input {...}. Result: ...]`. No raw tool blocks
and no bare call lines reach the tool-less nested request. This also
removes the provider requirement that `tool_result` blocks pair with a
`tool_use`, so results orphaned by window truncation are kept as notes
instead of dropped.
- The `advisor produced no text output` error now appends the finish
reason and content-part kinds, e.g. `advisor produced no text output
(finish_reason=stop; parts: reasoning=1)`, so field reports distinguish
tool-call mimicry, reasoning-only turns, and truncation.

Validated live by driving the production `RunAdvisor` path against
`claude-sonnet-4-6` through the dev.coder.com AI gateway: the failing
scenario went from 3/3 errors to 6/6 genuine advice (with and without
extended thinking), with the control scenario unaffected.

Related: CODAGT-593 (per-step advisor runtime recreation, addressed
separately) and CODAGT-742 (advisor tool call design).

<details>
<summary>Investigation and validation details</summary>

### Reproduction

A CLI prototype constructed the exact conversation snapshot the
generation preparer hands the advisor tool and called the real
`chatadvisor.NewRuntime` / `Runtime.RunAdvisor` / `BuildAdvisorMessages`
/ `chatloop.GenerateAssistant` chain against live `claude-sonnet-4-6`,
with a stream-teeing model wrapper capturing what `runner.go` discards
(finish reason, part kinds, reasoning text).

| Scenario (snapshot contents) | Thinking | Before fix | After fix |
|---|---|---|---|
| control: call #1 state, no prior advisor exchange | on | 3/3 advice |
2/2 advice |
| repro: call #2 state, prior advisor `tool_use`/`tool_result` pair
forwarded | on | 3/3 `advisor produced no text output` | 3/3 genuine
advice |
| repro | off | 2/3 same error, 1/3 degenerate advice ("I'll ask the
advisor...") | 3/3 genuine advice |

Every failing response was a tiny thinking block, zero text, zero
tool-call stream parts, finish reason `stop`; the model's own reasoning
text showed it deciding to "make the second tool call" in a request with
`tools=0`. The refunded `remaining_uses: 1200` in the failing
tool-result JSON matches the original issue screenshot.

### Decision log

- Tool exchanges are folded into a single user-role note per call/result
pair. A first attempt rendered assistant-authored `[tool call:
name(input)]` text lines plus separate result messages; live runs then
returned the literal `[tool call: advisor(...)]` line as the advice 6/6
times. The bare assistant call line is itself an imitable pattern, so no
assistant-authored tool artifact may survive the handoff. The folded
user-role note produced 6/6 genuine advice.
- An assistant message that carried only tool calls is dropped entirely;
the folded notes preserve the information.
- `dropOrphanToolMessages` was removed: without raw tool blocks there is
no provider pairing constraint, and an orphaned result note retains
context value.
- A reasoning-budget-starvation hypothesis (thinking budget consuming
`MaxOutputTokens`) did not reproduce on `claude-sonnet-4-6`; the model
adapts thinking length to the cap. The enriched error would identify
such cases on other models via `finish_reason=length`.
- CODAGT-593 (persisting the advisor runtime across steps) is
intentionally not addressed here; it shrinks the priming window but the
handoff fix is what removes the failure mode.

</details>

---

*This PR was generated by Coder Agents on behalf of @ThomasK33 (Linear
agent session for CODAGT-592).*
 2026-07-21 13:38:20 +02:00
Danielle Maywood 6014a44c85 fix(site): keep mobile model picker effort row and last model visible (#27336) 2026-07-21 12:37:55 +01:00
dependabot[bot] 850c6a712d ci: bump the github-actions group with 6 updates (#27373) 
Bumps the github-actions group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/setup-java](https://github.com/actions/setup-java) | `5.5.0`
| `5.6.0` |
| [fluxcd/flux2/action](https://github.com/fluxcd/flux2) | `2.9.1` |
`2.9.2` |
|
[github/codeql-action/upload-sarif](https://github.com/github/codeql-action)
| `4.36.3` | `4.37.0` |
| [github/codeql-action/init](https://github.com/github/codeql-action) |
`4.36.3` | `4.37.0` |
|
[github/codeql-action/analyze](https://github.com/github/codeql-action)
| `4.36.3` | `4.37.0` |
| [actions/stale](https://github.com/actions/stale) | `10.3.0` |
`10.4.0` |

Updates `actions/setup-java` from 5.5.0 to 5.6.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/setup-java/releases">actions/setup-java's
releases</a>.</em></p>
<blockquote>
<h2>v5.6.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Backport to v5: Add Maven compiler problem matcher for javac
diagnostics by <a
href="https://github.com/brunoborges"><code>@​brunoborges</code></a> in
<a
href="https://redirect.github.com/actions/setup-java/pull/1087">actions/setup-java#1087</a></li>
<li>feat: expose cache-primary-key output (<a
href="https://redirect.github.com/actions/setup-java/issues/597">#597</a>)
[v5 backport] by <a
href="https://github.com/brunoborges"><code>@​brunoborges</code></a> in
<a
href="https://redirect.github.com/actions/setup-java/pull/1089">actions/setup-java#1089</a></li>
<li>dist: Cover Tencent Kona JDK 25 (<a
href="https://redirect.github.com/actions/setup-java/issues/1108">#1108</a>)
[v5 backport] by <a
href="https://github.com/brunoborges"><code>@​brunoborges</code></a> in
<a
href="https://redirect.github.com/actions/setup-java/pull/1110">actions/setup-java#1110</a></li>
<li>Backport <a
href="https://redirect.github.com/actions/setup-java/issues/1111">#1111</a>:
Preserve Maven toolchains across repeated setup-java runs (<a
href="https://redirect.github.com/actions/setup-java/issues/1099">#1099</a>)
by <a
href="https://github.com/brunoborges"><code>@​brunoborges</code></a> in
<a
href="https://redirect.github.com/actions/setup-java/pull/1113">actions/setup-java#1113</a></li>
<li>Backport <a
href="https://redirect.github.com/actions/setup-java/issues/1097">#1097</a>/<a
href="https://redirect.github.com/actions/setup-java/issues/1098">#1098</a>
to v5: cache Maven and Gradle wrapper distributions separately by <a
href="https://github.com/brunoborges"><code>@​brunoborges</code></a> in
<a
href="https://redirect.github.com/actions/setup-java/pull/1122">actions/setup-java#1122</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-java/compare/v5...v5.6.0">https://github.com/actions/setup-java/compare/v5...v5.6.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/setup-java/commit/03ad4de0992f5dab5e18fcb136590ce7c4a0ac95"><code>03ad4de</code></a>
Backport <a
href="https://redirect.github.com/actions/setup-java/issues/1097">#1097</a>/<a
href="https://redirect.github.com/actions/setup-java/issues/1098">#1098</a>:
cache Maven and Gradle wrapper distributions separately...</li>
<li><a
href="https://github.com/actions/setup-java/commit/d229d2e858d9137cc0b3f118fa5184b9f0a44ac4"><code>d229d2e</code></a>
Backport <a
href="https://redirect.github.com/actions/setup-java/issues/1111">#1111</a>:
Preserve Maven toolchains across repeated setup-java runs (<a
href="https://redirect.github.com/actions/setup-java/issues/1">#1</a>...</li>
<li><a
href="https://github.com/actions/setup-java/commit/bbf0f6967066506f72571a96d5d6c67ca42ab460"><code>bbf0f69</code></a>
dist: Cover Tencent Kona JDK 25 (<a
href="https://redirect.github.com/actions/setup-java/issues/1110">#1110</a>)</li>
<li><a
href="https://github.com/actions/setup-java/commit/513edc4f8710565e4ad696f3b7d8e3bda584a46c"><code>513edc4</code></a>
feat: expose cache-primary-key output (<a
href="https://redirect.github.com/actions/setup-java/issues/597">#597</a>)
[v5 backport] (<a
href="https://redirect.github.com/actions/setup-java/issues/1089">#1089</a>)</li>
<li><a
href="https://github.com/actions/setup-java/commit/62df799a9c6e3022bb466697c66c36e9a2dbf347"><code>62df799</code></a>
Add Maven compiler problem matcher for javac diagnostics (<a
href="https://redirect.github.com/actions/setup-java/issues/1087">#1087</a>)</li>
<li><a
href="https://github.com/actions/setup-java/commit/176156a187714aaf460b0a3c8f21e8b4f784b978"><code>176156a</code></a>
chore: bump version to 5.6.0 for v5 release line</li>
<li><a
href="https://github.com/actions/setup-java/commit/bf7b8deac240b9cee05eb15ccdb1d2f424a54b9f"><code>bf7b8de</code></a>
build: rebuild dist for backported changes (<a
href="https://redirect.github.com/actions/setup-java/issues/1079">#1079</a>,
<a
href="https://redirect.github.com/actions/setup-java/issues/1083">#1083</a>,
<a
href="https://redirect.github.com/actions/setup-java/issues/1084">#1084</a>)</li>
<li><a
href="https://github.com/actions/setup-java/commit/0173e6dd1b6e53ac3f6d68d220fa24cce79ae77c"><code>0173e6d</code></a>
Infer distribution from asdf .tool-versions vendor prefix (<a
href="https://redirect.github.com/actions/setup-java/issues/1084">#1084</a>)</li>
<li><a
href="https://github.com/actions/setup-java/commit/f45cd82b67042e9e5c24cef950ea0c61736241c6"><code>f45cd82</code></a>
Rename jdkFile input to jdk-file with deprecated alias (<a
href="https://redirect.github.com/actions/setup-java/issues/1083">#1083</a>)</li>
<li><a
href="https://github.com/actions/setup-java/commit/e2863ad49937c063e5a23922d1971a105f4f0140"><code>e2863ad</code></a>
Map Zulu x86 architecture to i686 for Azul Metadata API (<a
href="https://redirect.github.com/actions/setup-java/issues/1079">#1079</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/setup-java/compare/0f481fcb613427c0f801b606911222b5b6f3083a...03ad4de0992f5dab5e18fcb136590ce7c4a0ac95">compare
view</a></li>
</ul>
</details>
<br />

Updates `fluxcd/flux2/action` from 2.9.1 to 2.9.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/fluxcd/flux2/releases">fluxcd/flux2/action's
releases</a>.</em></p>
<blockquote>
<h2>v2.9.2</h2>
<h2>Highlights</h2>
<p>Flux v2.9.2 is a patch release. The main fix addresses a regression
introduced in
v2.9.1 where a Kustomization with <code>openapi.path</code> pointing to
a URL failed to
reconcile with <code>failed to read OpenAPI schema</code>. This release
also corrects several
CRD field descriptions that contained inaccurate or leaked content.
Users are
encouraged to upgrade for the best experience.</p>
<p>ℹ️ Please follow the <a
href="https://github.com/fluxcd/flux2/discussions/5572">Upgrade
Procedure for Flux v2.7+</a> for a smooth upgrade from Flux v2.6 to the
latest version.</p>
<p>Fixes:</p>
<ul>
<li>Fix a regression where a Kustomization with
<code>openapi.path</code> pointing to a URL failed to reconcile with
<code>failed to read OpenAPI schema</code> (kustomize-controller)</li>
<li>Fix the <code>HelmChart</code> CRD description for
<code>.status.url</code>, which pointed users at
<code>BucketStatus.Artifact</code> instead of
<code>HelmChartStatus.Artifact</code> (source-controller)</li>
<li>Fix the <code>ImageRepository</code> CRD description for
<code>.status.observedExclusionList</code>, which referred to
<code>spec.lastScanResult</code> instead of
<code>status.lastScanResult</code> (image-reflector-controller)</li>
<li>Fix the <code>ImageUpdateAutomation</code> CRD description for
<code>.status.observedSourceRevision</code>, which had a stray Go struct
declaration leaking into it (image-automation-controller)</li>
</ul>
<p>Improvements:</p>
<ul>
<li>Update fluxcd/pkg dependencies</li>
</ul>
<h2>Components changelog</h2>
<ul>
<li>source-controller <a
href="https://github.com/fluxcd/source-controller/blob/v1.9.3/CHANGELOG.md">v1.9.3</a></li>
<li>kustomize-controller <a
href="https://github.com/fluxcd/kustomize-controller/blob/v1.9.3/CHANGELOG.md">v1.9.3</a></li>
<li>helm-controller <a
href="https://github.com/fluxcd/helm-controller/blob/v1.6.2/CHANGELOG.md">v1.6.2</a></li>
<li>notification-controller <a
href="https://github.com/fluxcd/notification-controller/blob/v1.9.2/CHANGELOG.md">v1.9.2</a></li>
<li>image-reflector-controller <a
href="https://github.com/fluxcd/image-reflector-controller/blob/v1.2.3/CHANGELOG.md">v1.2.3</a></li>
<li>image-automation-controller <a
href="https://github.com/fluxcd/image-automation-controller/blob/v1.2.3/CHANGELOG.md">v1.2.3</a></li>
<li>source-watcher <a
href="https://github.com/fluxcd/source-watcher/blob/v2.2.2/CHANGELOG.md">v2.2.2</a></li>
</ul>
<h2>CLI changelog</h2>
<ul>
<li>Update fluxcd/pkg dependencies by <a
href="https://github.com/fluxcdbot"><code>@​fluxcdbot</code></a> in <a
href="https://redirect.github.com/fluxcd/flux2/pull/5984">fluxcd/flux2#5984</a></li>
<li>Update fluxcd/pkg dependencies by <a
href="https://github.com/fluxcdbot"><code>@​fluxcdbot</code></a> in <a
href="https://redirect.github.com/fluxcd/flux2/pull/5990">fluxcd/flux2#5990</a></li>
<li>Update toolkit components by <a
href="https://github.com/fluxcdbot"><code>@​fluxcdbot</code></a> in <a
href="https://redirect.github.com/fluxcd/flux2/pull/5994">fluxcd/flux2#5994</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/fluxcd/flux2/compare/v2.9.1...v2.9.2">https://github.com/fluxcd/flux2/compare/v2.9.1...v2.9.2</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/fluxcd/flux2/commit/6a650dba1b4ae9945185c4bb3cc3f386aaf71b3d"><code>6a650db</code></a>
Merge pull request <a
href="https://redirect.github.com/fluxcd/flux2/issues/5994">#5994</a>
from fluxcd/update-components-release/v2.9.x</li>
<li><a
href="https://github.com/fluxcd/flux2/commit/00b96327ed5c15ba20196e0005627eb837051986"><code>00b9632</code></a>
Update toolkit components</li>
<li><a
href="https://github.com/fluxcd/flux2/commit/dc8430cb71860755d1b90dab23a784fc36eea9ad"><code>dc8430c</code></a>
Merge pull request <a
href="https://redirect.github.com/fluxcd/flux2/issues/5990">#5990</a>
from fluxcd/update-pkg-deps/release/v2.9.x</li>
<li><a
href="https://github.com/fluxcd/flux2/commit/c21de821a91ceea8df417bdb7075e9e2476ca854"><code>c21de82</code></a>
Update fluxcd/pkg dependencies</li>
<li><a
href="https://github.com/fluxcd/flux2/commit/fa3c7b8a0702424a0ccf4ef8f1f7c95b4b1efd2e"><code>fa3c7b8</code></a>
Merge pull request <a
href="https://redirect.github.com/fluxcd/flux2/issues/5984">#5984</a>
from fluxcd/update-pkg-deps/release/v2.9.x</li>
<li><a
href="https://github.com/fluxcd/flux2/commit/de86a518c2b29e47418492f3b3075f8191b6cb20"><code>de86a51</code></a>
Update fluxcd/pkg dependencies</li>
<li>See full diff in <a
href="https://github.com/fluxcd/flux2/compare/f05a280b876a3a1d35a76a91f701e605777853aa...6a650dba1b4ae9945185c4bb3cc3f386aaf71b3d">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action/upload-sarif` from 4.36.3 to 4.37.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/upload-sarif's
releases</a>.</em></p>
<blockquote>
<h2>v4.37.0</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li>
<li>In addition to the existing input format, the
<code>config-file</code> input for the <code>codeql-action/init</code>
step will soon support a new <code>[owner/]repo[@ref][:path]</code>
format. All components except the repository name are optional. If
omitted, <code>owner</code> defaults to the same owner as the repository
the analysis is running for, <code>ref</code> to <code>main</code>, and
<code>path</code> to <code>.github/codeql-action.yaml</code>. Support
for this format ships in this version of the CodeQL Action, but will
only be enabled over the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/upload-sarif's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.37.1 - 16 Jul 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.20.6 and earlier. These versions of
CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise
Server 3.16, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li>
</ul>
<h2>4.37.0 - 08 Jul 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li>
<li>In addition to the existing input format, the
<code>config-file</code> input for the <code>codeql-action/init</code>
step will soon support a new <code>[owner/]repo[@ref][:path]</code>
format. All components except the repository name are optional. If
omitted, <code>owner</code> defaults to the same owner as the repository
the analysis is running for, <code>ref</code> to <code>main</code>, and
<code>path</code> to <code>.github/codeql-action.yaml</code>. Support
for this format ships in this version of the CodeQL Action, but will
only be enabled over the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li>
</ul>
<h2>4.36.3 - 01 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.36.2 - 04 Jun 2026</h2>
<ul>
<li>Cache CodeQL CLI version information across Actions steps. <a
href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li>
<li>Reduce requests while waiting for analysis processing by using
exponential backoff when polling SARIF processing status. <a
href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li>
</ul>
<h2>4.36.1 - 02 Jun 2026</h2>
<p>No user facing changes.</p>
<h2>4.36.0 - 22 May 2026</h2>
<ul>
<li><em>Breaking change</em>: Bump the minimum required CodeQL bundle
version to 2.19.4. <a
href="https://redirect.github.com/github/codeql-action/pull/3894">#3894</a></li>
<li>Add support for SHA-256 Git object IDs. <a
href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5">2.25.5</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3926">#3926</a></li>
</ul>
<h2>4.35.5 - 15 May 2026</h2>
<ul>
<li>We have improved how the JavaScript bundles for the CodeQL Action
are generated to avoid duplication across bundles and reduce the size of
the repository by around 70%. This should have no effect on the runtime
behaviour of the CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3899">#3899</a></li>
<li>For performance and accuracy reasons, <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> will now only be enabled on a pull request when
diff-informed analysis is also enabled for that run. If diff-informed
analysis is unavailable (for example, because the PR diff ranges could
not be computed), the action will fall back to a full analysis. <a
href="https://redirect.github.com/github/codeql-action/pull/3791">#3791</a></li>
<li>If multiple inputs are provided for the GitHub-internal
<code>analysis-kinds</code> input, only <code>code-scanning</code> will
be enabled. The <code>analysis-kinds</code> input is experimental, for
GitHub-internal use only, and may change without notice at any time. <a
href="https://redirect.github.com/github/codeql-action/pull/3892">#3892</a></li>
<li>Added an experimental change which, when running a Code Scanning
analysis for a PR with <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> enabled, prefers CodeQL CLI versions that have
a cached overlay-base database for the configured languages. This speeds
up analysis for a repository when there is not yet a cached overlay-base
database for the latest CLI version. We expect to roll this change out
to everyone in May. <a
href="https://redirect.github.com/github/codeql-action/pull/3880">#3880</a></li>
</ul>
<h2>4.35.4 - 07 May 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4">2.25.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3881">#3881</a></li>
</ul>
<h2>4.35.3 - 01 May 2026</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/99df26d4f13ea111d4ec1a7dddef6063f76b97e9"><code>99df26d</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3996">#3996</a>
from github/update-v4.37.0-c7c896d71</li>
<li><a
href="https://github.com/github/codeql-action/commit/31c27074fda95256cda077009907f8a6022dd7c0"><code>31c2707</code></a>
Add changenote for <a
href="https://redirect.github.com/github/codeql-action/issues/3973">#3973</a></li>
<li><a
href="https://github.com/github/codeql-action/commit/72df2181aac054d1f4b44264399d2aac12cf11c6"><code>72df218</code></a>
Update changelog for v4.37.0</li>
<li><a
href="https://github.com/github/codeql-action/commit/c7c896d71b3055d36f2aff93b16bcc6c69923b91"><code>c7c896d</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3995">#3995</a>
from github/update-bundle/codeql-bundle-v2.26.0</li>
<li><a
href="https://github.com/github/codeql-action/commit/3f34ff0ea3f5153c96071437b7cbf71ea3757146"><code>3f34ff0</code></a>
Add changelog note</li>
<li><a
href="https://github.com/github/codeql-action/commit/43bec09f1dc368b430cab4b5d69799bc904079d1"><code>43bec09</code></a>
Update default bundle to codeql-bundle-v2.26.0</li>
<li><a
href="https://github.com/github/codeql-action/commit/f58f0d11ebf5dedd870fab2f999275f7602cfa46"><code>f58f0d1</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3973">#3973</a>
from github/mbg/repo-props/config-file-shorthands</li>
<li><a
href="https://github.com/github/codeql-action/commit/7dc37cbb5b3e37f0e1cd1f18b61e0ea849898fb8"><code>7dc37cb</code></a>
Merge remote-tracking branch 'origin/main' into
mbg/repo-props/config-file-sh...</li>
<li><a
href="https://github.com/github/codeql-action/commit/8e22350a7e28c34c82a5a499fc241923301c2c4f"><code>8e22350</code></a>
Thread <code>ActionState</code> to <code>initConfig</code></li>
<li><a
href="https://github.com/github/codeql-action/commit/69c9e8c7d918cf2fee13b8b72fdde15883ff155b"><code>69c9e8c</code></a>
Mark some <code>status-report</code> imports as <code>type</code>-only
to avoid circular dependencies</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...99df26d4f13ea111d4ec1a7dddef6063f76b97e9">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action/init` from 4.36.3 to 4.37.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/init's
releases</a>.</em></p>
<blockquote>
<h2>v4.37.0</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li>
<li>In addition to the existing input format, the
<code>config-file</code> input for the <code>codeql-action/init</code>
step will soon support a new <code>[owner/]repo[@ref][:path]</code>
format. All components except the repository name are optional. If
omitted, <code>owner</code> defaults to the same owner as the repository
the analysis is running for, <code>ref</code> to <code>main</code>, and
<code>path</code> to <code>.github/codeql-action.yaml</code>. Support
for this format ships in this version of the CodeQL Action, but will
only be enabled over the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/init's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.37.1 - 16 Jul 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.20.6 and earlier. These versions of
CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise
Server 3.16, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li>
</ul>
<h2>4.37.0 - 08 Jul 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li>
<li>In addition to the existing input format, the
<code>config-file</code> input for the <code>codeql-action/init</code>
step will soon support a new <code>[owner/]repo[@ref][:path]</code>
format. All components except the repository name are optional. If
omitted, <code>owner</code> defaults to the same owner as the repository
the analysis is running for, <code>ref</code> to <code>main</code>, and
<code>path</code> to <code>.github/codeql-action.yaml</code>. Support
for this format ships in this version of the CodeQL Action, but will
only be enabled over the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li>
</ul>
<h2>4.36.3 - 01 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.36.2 - 04 Jun 2026</h2>
<ul>
<li>Cache CodeQL CLI version information across Actions steps. <a
href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li>
<li>Reduce requests while waiting for analysis processing by using
exponential backoff when polling SARIF processing status. <a
href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li>
</ul>
<h2>4.36.1 - 02 Jun 2026</h2>
<p>No user facing changes.</p>
<h2>4.36.0 - 22 May 2026</h2>
<ul>
<li><em>Breaking change</em>: Bump the minimum required CodeQL bundle
version to 2.19.4. <a
href="https://redirect.github.com/github/codeql-action/pull/3894">#3894</a></li>
<li>Add support for SHA-256 Git object IDs. <a
href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5">2.25.5</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3926">#3926</a></li>
</ul>
<h2>4.35.5 - 15 May 2026</h2>
<ul>
<li>We have improved how the JavaScript bundles for the CodeQL Action
are generated to avoid duplication across bundles and reduce the size of
the repository by around 70%. This should have no effect on the runtime
behaviour of the CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3899">#3899</a></li>
<li>For performance and accuracy reasons, <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> will now only be enabled on a pull request when
diff-informed analysis is also enabled for that run. If diff-informed
analysis is unavailable (for example, because the PR diff ranges could
not be computed), the action will fall back to a full analysis. <a
href="https://redirect.github.com/github/codeql-action/pull/3791">#3791</a></li>
<li>If multiple inputs are provided for the GitHub-internal
<code>analysis-kinds</code> input, only <code>code-scanning</code> will
be enabled. The <code>analysis-kinds</code> input is experimental, for
GitHub-internal use only, and may change without notice at any time. <a
href="https://redirect.github.com/github/codeql-action/pull/3892">#3892</a></li>
<li>Added an experimental change which, when running a Code Scanning
analysis for a PR with <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> enabled, prefers CodeQL CLI versions that have
a cached overlay-base database for the configured languages. This speeds
up analysis for a repository when there is not yet a cached overlay-base
database for the latest CLI version. We expect to roll this change out
to everyone in May. <a
href="https://redirect.github.com/github/codeql-action/pull/3880">#3880</a></li>
</ul>
<h2>4.35.4 - 07 May 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4">2.25.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3881">#3881</a></li>
</ul>
<h2>4.35.3 - 01 May 2026</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/99df26d4f13ea111d4ec1a7dddef6063f76b97e9"><code>99df26d</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3996">#3996</a>
from github/update-v4.37.0-c7c896d71</li>
<li><a
href="https://github.com/github/codeql-action/commit/31c27074fda95256cda077009907f8a6022dd7c0"><code>31c2707</code></a>
Add changenote for <a
href="https://redirect.github.com/github/codeql-action/issues/3973">#3973</a></li>
<li><a
href="https://github.com/github/codeql-action/commit/72df2181aac054d1f4b44264399d2aac12cf11c6"><code>72df218</code></a>
Update changelog for v4.37.0</li>
<li><a
href="https://github.com/github/codeql-action/commit/c7c896d71b3055d36f2aff93b16bcc6c69923b91"><code>c7c896d</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3995">#3995</a>
from github/update-bundle/codeql-bundle-v2.26.0</li>
<li><a
href="https://github.com/github/codeql-action/commit/3f34ff0ea3f5153c96071437b7cbf71ea3757146"><code>3f34ff0</code></a>
Add changelog note</li>
<li><a
href="https://github.com/github/codeql-action/commit/43bec09f1dc368b430cab4b5d69799bc904079d1"><code>43bec09</code></a>
Update default bundle to codeql-bundle-v2.26.0</li>
<li><a
href="https://github.com/github/codeql-action/commit/f58f0d11ebf5dedd870fab2f999275f7602cfa46"><code>f58f0d1</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3973">#3973</a>
from github/mbg/repo-props/config-file-shorthands</li>
<li><a
href="https://github.com/github/codeql-action/commit/7dc37cbb5b3e37f0e1cd1f18b61e0ea849898fb8"><code>7dc37cb</code></a>
Merge remote-tracking branch 'origin/main' into
mbg/repo-props/config-file-sh...</li>
<li><a
href="https://github.com/github/codeql-action/commit/8e22350a7e28c34c82a5a499fc241923301c2c4f"><code>8e22350</code></a>
Thread <code>ActionState</code> to <code>initConfig</code></li>
<li><a
href="https://github.com/github/codeql-action/commit/69c9e8c7d918cf2fee13b8b72fdde15883ff155b"><code>69c9e8c</code></a>
Mark some <code>status-report</code> imports as <code>type</code>-only
to avoid circular dependencies</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...99df26d4f13ea111d4ec1a7dddef6063f76b97e9">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action/analyze` from 4.36.3 to 4.37.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/analyze's
releases</a>.</em></p>
<blockquote>
<h2>v4.37.0</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li>
<li>In addition to the existing input format, the
<code>config-file</code> input for the <code>codeql-action/init</code>
step will soon support a new <code>[owner/]repo[@ref][:path]</code>
format. All components except the repository name are optional. If
omitted, <code>owner</code> defaults to the same owner as the repository
the analysis is running for, <code>ref</code> to <code>main</code>, and
<code>path</code> to <code>.github/codeql-action.yaml</code>. Support
for this format ships in this version of the CodeQL Action, but will
only be enabled over the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/analyze's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.37.1 - 16 Jul 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.20.6 and earlier. These versions of
CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise
Server 3.16, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li>
</ul>
<h2>4.37.0 - 08 Jul 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li>
<li>In addition to the existing input format, the
<code>config-file</code> input for the <code>codeql-action/init</code>
step will soon support a new <code>[owner/]repo[@ref][:path]</code>
format. All components except the repository name are optional. If
omitted, <code>owner</code> defaults to the same owner as the repository
the analysis is running for, <code>ref</code> to <code>main</code>, and
<code>path</code> to <code>.github/codeql-action.yaml</code>. Support
for this format ships in this version of the CodeQL Action, but will
only be enabled over the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li>
</ul>
<h2>4.36.3 - 01 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.36.2 - 04 Jun 2026</h2>
<ul>
<li>Cache CodeQL CLI version information across Actions steps. <a
href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li>
<li>Reduce requests while waiting for analysis processing by using
exponential backoff when polling SARIF processing status. <a
href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li>
</ul>
<h2>4.36.1 - 02 Jun 2026</h2>
<p>No user facing changes.</p>
<h2>4.36.0 - 22 May 2026</h2>
<ul>
<li><em>Breaking change</em>: Bump the minimum required CodeQL bundle
version to 2.19.4. <a
href="https://redirect.github.com/github/codeql-action/pull/3894">#3894</a></li>
<li>Add support for SHA-256 Git object IDs. <a
href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5">2.25.5</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3926">#3926</a></li>
</ul>
<h2>4.35.5 - 15 May 2026</h2>
<ul>
<li>We have improved how the JavaScript bundles for the CodeQL Action
are generated to avoid duplication across bundles and reduce the size of
the repository by around 70%. This should have no effect on the runtime
behaviour of the CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3899">#3899</a></li>
<li>For performance and accuracy reasons, <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> will now only be enabled on a pull request when
diff-informed analysis is also enabled for that run. If diff-informed
analysis is unavailable (for example, because the PR diff ranges could
not be computed), the action will fall back to a full analysis. <a
href="https://redirect.github.com/github/codeql-action/pull/3791">#3791</a></li>
<li>If multiple inputs are provided for the GitHub-internal
<code>analysis-kinds</code> input, only <code>code-scanning</code> will
be enabled. The <code>analysis-kinds</code> input is experimental, for
GitHub-internal use only, and may change without notice at any time. <a
href="https://redirect.github.com/github/codeql-action/pull/3892">#3892</a></li>
<li>Added an experimental change which, when running a Code Scanning
analysis for a PR with <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> enabled, prefers CodeQL CLI versions that have
a cached overlay-base database for the configured languages. This speeds
up analysis for a repository when there is not yet a cached overlay-base
database for the latest CLI version. We expect to roll this change out
to everyone in May. <a
href="https://redirect.github.com/github/codeql-action/pull/3880">#3880</a></li>
</ul>
<h2>4.35.4 - 07 May 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4">2.25.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3881">#3881</a></li>
</ul>
<h2>4.35.3 - 01 May 2026</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/99df26d4f13ea111d4ec1a7dddef6063f76b97e9"><code>99df26d</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3996">#3996</a>
from github/update-v4.37.0-c7c896d71</li>
<li><a
href="https://github.com/github/codeql-action/commit/31c27074fda95256cda077009907f8a6022dd7c0"><code>31c2707</code></a>
Add changenote for <a
href="https://redirect.github.com/github/codeql-action/issues/3973">#3973</a></li>
<li><a
href="https://github.com/github/codeql-action/commit/72df2181aac054d1f4b44264399d2aac12cf11c6"><code>72df218</code></a>
Update changelog for v4.37.0</li>
<li><a
href="https://github.com/github/codeql-action/commit/c7c896d71b3055d36f2aff93b16bcc6c69923b91"><code>c7c896d</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3995">#3995</a>
from github/update-bundle/codeql-bundle-v2.26.0</li>
<li><a
href="https://github.com/github/codeql-action/commit/3f34ff0ea3f5153c96071437b7cbf71ea3757146"><code>3f34ff0</code></a>
Add changelog note</li>
<li><a
href="https://github.com/github/codeql-action/commit/43bec09f1dc368b430cab4b5d69799bc904079d1"><code>43bec09</code></a>
Update default bundle to codeql-bundle-v2.26.0</li>
<li><a
href="https://github.com/github/codeql-action/commit/f58f0d11ebf5dedd870fab2f999275f7602cfa46"><code>f58f0d1</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3973">#3973</a>
from github/mbg/repo-props/config-file-shorthands</li>
<li><a
href="https://github.com/github/codeql-action/commit/7dc37cbb5b3e37f0e1cd1f18b61e0ea849898fb8"><code>7dc37cb</code></a>
Merge remote-tracking branch 'origin/main' into
mbg/repo-props/config-file-sh...</li>
<li><a
href="https://github.com/github/codeql-action/commit/8e22350a7e28c34c82a5a499fc241923301c2c4f"><code>8e22350</code></a>
Thread <code>ActionState</code> to <code>initConfig</code></li>
<li><a
href="https://github.com/github/codeql-action/commit/69c9e8c7d918cf2fee13b8b72fdde15883ff155b"><code>69c9e8c</code></a>
Mark some <code>status-report</code> imports as <code>type</code>-only
to avoid circular dependencies</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...99df26d4f13ea111d4ec1a7dddef6063f76b97e9">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/stale` from 10.3.0 to 10.4.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/stale/releases">actions/stale's
releases</a>.</em></p>
<blockquote>
<h2>v10.4.0</h2>
<h2>What's Changed</h2>
<h3>Bug Fix</h3>
<ul>
<li>Fixed <code>only-issue-types</code> validation by <a
href="https://github.com/trueberryless"><code>@​trueberryless</code></a>
in <a
href="https://redirect.github.com/actions/stale/pull/1338">actions/stale#1338</a></li>
</ul>
<h3>Dependency Updates</h3>
<ul>
<li>Bump undici to 6.27.0 via override, clean up stale license files,
and version to 10.4.0. by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/stale/pull/1342">actions/stale#1342</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/trueberryless"><code>@​trueberryless</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/stale/pull/1338">actions/stale#1338</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/stale/compare/v10.3.0...v10.4.0">https://github.com/actions/stale/compare/v10.3.0...v10.4.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/stale/commit/1e223db275d687790206a7acac4d1a11bd6fe629"><code>1e223db</code></a>
Bump undici to 6.27.0 via override, clean up stale license files, and
version...</li>
<li><a
href="https://github.com/actions/stale/commit/9461cb10066d1553762bac6a02599ab8c26b14dd"><code>9461cb1</code></a>
fix: <code>only-issue-types</code> does not affect PRs (<a
href="https://redirect.github.com/actions/stale/issues/1338">#1338</a>)</li>
<li>See full diff in <a
href="https://github.com/actions/stale/compare/eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899...1e223db275d687790206a7acac4d1a11bd6fe629">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-21 11:26:17 +00:00
dependabot[bot] acd0d7f841 chore: bump google.golang.org/api from 0.288.0 to 0.289.0 (#27365) 
Bumps
[google.golang.org/api](https://github.com/googleapis/google-api-go-client)
from 0.288.0 to 0.289.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's
releases</a>.</em></p>
<blockquote>
<h2>v0.289.0</h2>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.288.0...v0.289.0">0.289.0</a>
(2026-07-16)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3649">#3649</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/6e259cbb923dd10f071e2f724be23914f8ccd78b">6e259cb</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3652">#3652</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/5116a48938fa4674df57289ca63e75d209c06e10">5116a48</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3653">#3653</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/6c876b4102b2db7dabc6a0f69eb0e854d298f48d">6c876b4</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3655">#3655</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/69af635fafd38d3623f52c173715883d93d7ead5">69af635</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3656">#3656</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/1fc8f4539d0bf40f8272c1eb36f1e84cfa0ecea7">1fc8f45</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3657">#3657</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/aa8d256cb84dcc38ee3888c983515cae283d7436">aa8d256</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3659">#3659</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/af8d03336daad8d37f8de7e4692a8b67a7d35b7e">af8d033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.288.0...v0.289.0">0.289.0</a>
(2026-07-16)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3649">#3649</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/6e259cbb923dd10f071e2f724be23914f8ccd78b">6e259cb</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3652">#3652</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/5116a48938fa4674df57289ca63e75d209c06e10">5116a48</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3653">#3653</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/6c876b4102b2db7dabc6a0f69eb0e854d298f48d">6c876b4</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3655">#3655</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/69af635fafd38d3623f52c173715883d93d7ead5">69af635</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3656">#3656</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/1fc8f4539d0bf40f8272c1eb36f1e84cfa0ecea7">1fc8f45</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3657">#3657</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/aa8d256cb84dcc38ee3888c983515cae283d7436">aa8d256</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3659">#3659</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/af8d03336daad8d37f8de7e4692a8b67a7d35b7e">af8d033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/783bf4bedcc95794980288f1e9928582e9a231b9"><code>783bf4b</code></a>
chore(main): release 0.289.0 (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3650">#3650</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/af8d03336daad8d37f8de7e4692a8b67a7d35b7e"><code>af8d033</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3659">#3659</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/080002a0ba10410dcd7c018483bfbdf27c2160ff"><code>080002a</code></a>
chore: constrain go version updates in renovate (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3658">#3658</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/aa8d256cb84dcc38ee3888c983515cae283d7436"><code>aa8d256</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3657">#3657</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/1fc8f4539d0bf40f8272c1eb36f1e84cfa0ecea7"><code>1fc8f45</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3656">#3656</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/7ac76e4d28ec9dd11c07746b48262426805a0084"><code>7ac76e4</code></a>
chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 in
/internal/koko...</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/8a47d2a5ae242a70b49a82a25eb72754dcc9acfc"><code>8a47d2a</code></a>
chore(all): update all (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3654">#3654</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/69af635fafd38d3623f52c173715883d93d7ead5"><code>69af635</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3655">#3655</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/6c876b4102b2db7dabc6a0f69eb0e854d298f48d"><code>6c876b4</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3653">#3653</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/5116a48938fa4674df57289ca63e75d209c06e10"><code>5116a48</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3652">#3652</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/googleapis/google-api-go-client/compare/v0.288.0...v0.289.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/api&package-manager=go_modules&previous-version=0.288.0&new-version=0.289.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-21 11:19:05 +00:00
dependabot[bot] 0344e06d4c chore: bump github.com/prometheus/client_golang from 1.23.2 to 1.24.0 (#27366) 
Bumps
[github.com/prometheus/client_golang](https://github.com/prometheus/client_golang)
from 1.23.2 to 1.24.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/prometheus/client_golang/releases">github.com/prometheus/client_golang's
releases</a>.</em></p>
<blockquote>
<h2>v1.24.0 - 2026-07-20</h2>
<h3>Changes</h3>
<ul>
<li>[CHANGE] Minimum required Go version is now 1.25, only the two
latest Go versions (1.25 and 1.26) are supported from now on. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1862">#1862</a></li>
<li>[CHANGE] prometheus: Name validation now always uses the UTF-8
scheme instead of the deprecated <code>model.NameValidationScheme</code>
global. Default behavior is unchanged; code that set
<code>NameValidationScheme = LegacyValidation</code> no longer gets
legacy enforcement at metric, label, and push-grouping construction. <a
href="https://redirect.github.com/prometheus/client_golang/issues/2051">#2051</a></li>
<li>[CHANGE] api/prometheus/v1: Support matchers (<code>matches[]</code>
parameter) in <code>Rules</code> method (<code>Rules(ctx
context.Context, matches []string) (RulesResult, error)</code>). <a
href="https://redirect.github.com/prometheus/client_golang/issues/1843">#1843</a></li>
<li>[CHANGE] api/prometheus/v1: Refactor <code>LabelNames</code> method
to return <code>model.LabelNames</code> instead of <code>[]string</code>
for consistency across the API. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1850">#1850</a></li>
<li>[CHANGE] exp/api/remote: Simplify <code>Store</code> interface,
rename <code>Handler</code> to <code>WriteHandler</code>, and
encapsulate write response handling. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1855">#1855</a></li>
<li>[FEATURE] prometheus: Add new Go 1.26 runtime metrics
(<code>/sched/goroutines-created:goroutines</code>,
<code>/sched/goroutines/not-in-go:goroutines</code>,
<code>/sched/goroutines/runnable:goroutines</code>,
<code>/sched/goroutines/running:goroutines</code>,
<code>/sched/goroutines/waiting:goroutines</code>,
<code>/sched/threads/total:threads</code>). <a
href="https://redirect.github.com/prometheus/client_golang/issues/1942">#1942</a></li>
<li>[FEATURE] prometheus: Add <code>WithUnit(unit string)</code> option
and explicit OpenMetrics unit support in <code>CounterOpts</code>,
<code>GaugeOpts</code>, <code>SummaryOpts</code>, and
<code>HistogramOpts</code>. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1392">#1392</a></li>
<li>[FEATURE] prometheus: Expose descriptor construction error through
public <code>Err()</code> method on <code>Desc</code>. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1902">#1902</a></li>
<li>[FEATURE] promhttp: Add opt-in
<code>HandlerOpts.CoalesceGather</code> to deduplicate concurrent
<code>Gather</code> calls so overlapping scrapes share one collection
cycle, preventing goroutine pile-up when the scrape rate outpaces
collection time. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1969">#1969</a></li>
<li>[FEATURE] promhttp: HTTP handlers created by <code>promhttp</code>
package now support metrics filtering by providing one or more
<code>name[]</code> query parameters. The default behavior when none are
provided remains the same, returning all metrics. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1925">#1925</a></li>
<li>[FEATURE] api/prometheus/v1: Add query formatting endpoint support
(<code>/format_query</code>) and <code>FormatQuery(ctx context.Context,
query string) (string, error)</code> method. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1846">#1846</a>,
<a
href="https://redirect.github.com/prometheus/client_golang/issues/1856">#1856</a></li>
<li>[FEATURE] api/prometheus/v1: Add support for
<code>/status/tsdb/blocks</code> endpoint via <code>TSDBBlocks(ctx
context.Context) ([]TSDBBlock, error)</code> method. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1896">#1896</a></li>
<li>[FEATURE] exp/api/remote: Export <code>BackoffConfig</code> to allow
customization when using <code>WithAPIBackoff</code>. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1895">#1895</a></li>
<li>[FEATURE] exp/api/remote: Add <code>RetryCallBack</code> to allow
custom logging or handling on retry attempts in the remote write client.
<a
href="https://redirect.github.com/prometheus/client_golang/issues/1888">#1888</a>,
<a
href="https://redirect.github.com/prometheus/client_golang/issues/1890">#1890</a></li>
<li>[ENHANCEMENT] prometheus/collectors/version: Allow specifying custom
labels when registering the version collector. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1860">#1860</a></li>
<li>[ENHANCEMENT] api: Use cloned <code>http.DefaultTransport</code>
when constructing default HTTP clients to prevent accidental mutations
of shared global transport state. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1885">#1885</a></li>
<li>[BUGFIX] prometheus: Recover from collector panics during
<code>Gather()</code> and return an error instead of crashing the
process. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1961">#1961</a></li>
<li>[BUGFIX] prometheus: Fix <code>cpu-seconds</code> unit suffix
handling for metric
<code>go_cpu_classes_gc_mark_assist_cpu_seconds</code>. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1991">#1991</a></li>
<li>[BUGFIX] promhttp: <code>InstrumentHandlerDuration</code> and
<code>InstrumentHandlerCounter</code> no longer panic when given an
observer/counter that does not implement
<code>ExemplarObserver</code>/<code>ExemplarAdder</code> (e.g. a
<code>SummaryVec</code>). The exemplar is dropped and the value is
recorded via the plain <code>Observe</code>/<code>Add</code> path,
matching the safe-cast already used by
<code>Timer.ObserveDurationWithExemplar</code>. <a
href="https://redirect.github.com/prometheus/client_golang/issues/2005">#2005</a></li>
<li>[BUGFIX] api/prometheus/v1: Fall back to <code>GET</code> requests
when <code>POST</code> requests return <code>403 Forbidden</code> or
method not allowed. <a
href="https://redirect.github.com/prometheus/client_golang/issues/2030">#2030</a></li>
<li>[BUGFIX] api: Respect context cancellation inside
<code>httpClient.Do</code>. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1971">#1971</a></li>
<li>[BUGFIX] exp/api/remote: Fix compression buffer pooling where
compressed buffers were released prematurely, causing corrupted
remote-write payloads. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1889">#1889</a></li>
<li>[BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring
huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM
from oversized remote-write requests. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1917">#1917</a></li>
<li>[BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be
returned on v1 requests. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1927">#1927</a></li>
</ul>
<!-- raw HTML omitted -->
<ul>
<li>build(deps): bump github.com/prometheus/procfs from 0.16.1 to 0.17.0
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1839">prometheus/client_golang#1839</a></li>
<li>build(deps): bump golang.org/x/sys from 0.33.0 to 0.34.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1838">prometheus/client_golang#1838</a></li>
<li>prometheus/collectors: use godoc link for runtime/metrics supported
metrics by <a
href="https://github.com/xieyuschen"><code>@​xieyuschen</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1844">prometheus/client_golang#1844</a></li>
<li>Fix doc typo by <a
href="https://github.com/torrca"><code>@​torrca</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1849">prometheus/client_golang#1849</a></li>
<li>Merge release-1.23 into main by <a
href="https://github.com/vesari"><code>@​vesari</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1851">prometheus/client_golang#1851</a></li>
<li>build(deps): bump github/codeql-action from 3.29.2 to 3.29.5 in the
github-actions group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1852">prometheus/client_golang#1852</a></li>
<li>Refactor LabelNames to return model.LabelNames type for consistency
by <a href="https://github.com/yshngg"><code>@​yshngg</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1850">prometheus/client_golang#1850</a></li>
<li>remote: simplified Store interface; renamed Handler to WriteHandler
by <a href="https://github.com/bwplotka"><code>@​bwplotka</code></a> in
<a
href="https://redirect.github.com/prometheus/client_golang/pull/1855">prometheus/client_golang#1855</a></li>
<li>feat(api/prometheus): add format_query endpoint for query formatting
by <a href="https://github.com/yshngg"><code>@​yshngg</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1846">prometheus/client_golang#1846</a></li>
<li>feat(api): add FormatQuery method to Prometheus v1 API by <a
href="https://github.com/yshngg"><code>@​yshngg</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1856">prometheus/client_golang#1856</a></li>
<li>Support matchers in rules API by <a
href="https://github.com/jotak"><code>@​jotak</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1843">prometheus/client_golang#1843</a></li>
<li>Use prometheus/common.expfmt.NewTextParser by <a
href="https://github.com/aknuds1"><code>@​aknuds1</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1859">prometheus/client_golang#1859</a></li>
<li>Merge release-1.23 into main by <a
href="https://github.com/aknuds1"><code>@​aknuds1</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1861">prometheus/client_golang#1861</a></li>
<li>chore: Drop support for &lt;go1.22 by <a
href="https://github.com/mrueg"><code>@​mrueg</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1862">prometheus/client_golang#1862</a></li>
<li>collectors/version: Allow custom additional labels by <a
href="https://github.com/mrueg"><code>@​mrueg</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1860">prometheus/client_golang#1860</a></li>
<li>build(deps): bump github.com/prometheus/common from 0.65.0 to 0.66.0
by <a href="https://github.com/ywwg"><code>@​ywwg</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1865">prometheus/client_golang#1865</a></li>
<li>Sync release-1.23 into main by <a
href="https://github.com/aknuds1"><code>@​aknuds1</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1868">prometheus/client_golang#1868</a></li>
<li>Sync main with release-1.23 by <a
href="https://github.com/aknuds1"><code>@​aknuds1</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1871">prometheus/client_golang#1871</a></li>
<li>chore: clean up golangci-lint configuration by <a
href="https://github.com/mmorel-35"><code>@​mmorel-35</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1802">prometheus/client_golang#1802</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/prometheus/client_golang/blob/v1.24.0/CHANGELOG.md">github.com/prometheus/client_golang's
changelog</a>.</em></p>
<blockquote>
<h2>1.24.0 / 2026-07-20</h2>
<ul>
<li>[CHANGE] Minimum required Go version is now 1.25, only the two
latest Go versions (1.25 and 1.26) are supported from now on. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1862">#1862</a></li>
<li>[CHANGE] prometheus: Name validation now always uses the UTF-8
scheme instead of the deprecated <code>model.NameValidationScheme</code>
global. Default behavior is unchanged; code that set
<code>NameValidationScheme = LegacyValidation</code> no longer gets
legacy enforcement at metric, label, and push-grouping construction. <a
href="https://redirect.github.com/prometheus/client_golang/issues/2051">#2051</a></li>
<li>[CHANGE] api/prometheus/v1: Support matchers (<code>matches[]</code>
parameter) in <code>Rules</code> method (<code>Rules(ctx
context.Context, matches []string) (RulesResult, error)</code>). <a
href="https://redirect.github.com/prometheus/client_golang/issues/1843">#1843</a></li>
<li>[CHANGE] api/prometheus/v1: Refactor <code>LabelNames</code> method
to return <code>model.LabelNames</code> instead of <code>[]string</code>
for consistency across the API. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1850">#1850</a></li>
<li>[CHANGE] exp/api/remote: Simplify <code>Store</code> interface,
rename <code>Handler</code> to <code>WriteHandler</code>, and
encapsulate write response handling. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1855">#1855</a></li>
<li>[FEATURE] prometheus: Add new Go 1.26 runtime metrics
(<code>/sched/goroutines-created:goroutines</code>,
<code>/sched/goroutines/not-in-go:goroutines</code>,
<code>/sched/goroutines/runnable:goroutines</code>,
<code>/sched/goroutines/running:goroutines</code>,
<code>/sched/goroutines/waiting:goroutines</code>,
<code>/sched/threads/total:threads</code>). <a
href="https://redirect.github.com/prometheus/client_golang/issues/1942">#1942</a></li>
<li>[FEATURE] prometheus: Add <code>WithUnit(unit string)</code> option
and explicit OpenMetrics unit support in <code>CounterOpts</code>,
<code>GaugeOpts</code>, <code>SummaryOpts</code>, and
<code>HistogramOpts</code>. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1392">#1392</a></li>
<li>[FEATURE] prometheus: Expose descriptor construction error through
public <code>Err()</code> method on <code>Desc</code>. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1902">#1902</a></li>
<li>[FEATURE] promhttp: Add opt-in
<code>HandlerOpts.CoalesceGather</code> to deduplicate concurrent
<code>Gather</code> calls so overlapping scrapes share one collection
cycle, preventing goroutine pile-up when the scrape rate outpaces
collection time. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1969">#1969</a></li>
<li>[FEATURE] promhttp: HTTP handlers created by <code>promhttp</code>
package now support metrics filtering by providing one or more
<code>name[]</code> query parameters. The default behavior when none are
provided remains the same, returning all metrics. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1925">#1925</a></li>
<li>[FEATURE] api/prometheus/v1: Add query formatting endpoint support
(<code>/format_query</code>) and <code>FormatQuery(ctx context.Context,
query string) (string, error)</code> method. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1846">#1846</a>,
<a
href="https://redirect.github.com/prometheus/client_golang/issues/1856">#1856</a></li>
<li>[FEATURE] api/prometheus/v1: Add support for
<code>/status/tsdb/blocks</code> endpoint via <code>TSDBBlocks(ctx
context.Context) ([]TSDBBlock, error)</code> method. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1896">#1896</a></li>
<li>[FEATURE] exp/api/remote: Export <code>BackoffConfig</code> to allow
customization when using <code>WithAPIBackoff</code>. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1895">#1895</a></li>
<li>[FEATURE] exp/api/remote: Add <code>RetryCallBack</code> to allow
custom logging or handling on retry attempts in the remote write client.
<a
href="https://redirect.github.com/prometheus/client_golang/issues/1888">#1888</a>,
<a
href="https://redirect.github.com/prometheus/client_golang/issues/1890">#1890</a></li>
<li>[ENHANCEMENT] prometheus/collectors/version: Allow specifying custom
labels when registering the version collector. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1860">#1860</a></li>
<li>[ENHANCEMENT] api: Use cloned <code>http.DefaultTransport</code>
when constructing default HTTP clients to prevent accidental mutations
of shared global transport state. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1885">#1885</a></li>
<li>[BUGFIX] prometheus: Recover from collector panics during
<code>Gather()</code> and return an error instead of crashing the
process. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1961">#1961</a></li>
<li>[BUGFIX] prometheus: Fix <code>cpu-seconds</code> unit suffix
handling for metric
<code>go_cpu_classes_gc_mark_assist_cpu_seconds</code>. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1991">#1991</a></li>
<li>[BUGFIX] promhttp: <code>InstrumentHandlerDuration</code> and
<code>InstrumentHandlerCounter</code> no longer panic when given an
observer/counter that does not implement
<code>ExemplarObserver</code>/<code>ExemplarAdder</code> (e.g. a
<code>SummaryVec</code>). The exemplar is dropped and the value is
recorded via the plain <code>Observe</code>/<code>Add</code> path,
matching the safe-cast already used by
<code>Timer.ObserveDurationWithExemplar</code>. <a
href="https://redirect.github.com/prometheus/client_golang/issues/2005">#2005</a></li>
<li>[BUGFIX] api/prometheus/v1: Fall back to <code>GET</code> requests
when <code>POST</code> requests return <code>403 Forbidden</code> or
method not allowed. <a
href="https://redirect.github.com/prometheus/client_golang/issues/2030">#2030</a></li>
<li>[BUGFIX] api: Respect context cancellation inside
<code>httpClient.Do</code>. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1971">#1971</a></li>
<li>[BUGFIX] exp/api/remote: Fix compression buffer pooling where
compressed buffers were released prematurely, causing corrupted
remote-write payloads. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1889">#1889</a></li>
<li>[BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring
huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM
from oversized remote-write requests. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1917">#1917</a></li>
<li>[BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be
returned on v1 requests. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1927">#1927</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/prometheus/client_golang/commit/48dd383f94cc36bb0179724166383effd9f64847"><code>48dd383</code></a>
Cut v1.24.0 (<a
href="https://redirect.github.com/prometheus/client_golang/issues/2061">#2061</a>)</li>
<li><a
href="https://github.com/prometheus/client_golang/commit/a7253054383fd6702034c16194117d37727cd5fc"><code>a725305</code></a>
Cut v1.24.0-rc.0 (<a
href="https://redirect.github.com/prometheus/client_golang/issues/2058">#2058</a>)</li>
<li><a
href="https://github.com/prometheus/client_golang/commit/77c584f2501bf3726bb39b83a89b70c0e6f9ab0c"><code>77c584f</code></a>
build(deps): update all Go dependencies in all go.mod files (<a
href="https://redirect.github.com/prometheus/client_golang/issues/2059">#2059</a>)</li>
<li><a
href="https://github.com/prometheus/client_golang/commit/78262a77b89922f94a19ecd25eaeb849fb58f2cc"><code>78262a7</code></a>
feat(promhttp): add CoalesceGather option to deduplicate concurrent
Gather ca...</li>
<li><a
href="https://github.com/prometheus/client_golang/commit/34e9a7fe186a7a3ff47694f127d44d5641ff388f"><code>34e9a7f</code></a>
Merge pull request <a
href="https://redirect.github.com/prometheus/client_golang/issues/2055">#2055</a>
from prombot/repo_sync</li>
<li><a
href="https://github.com/prometheus/client_golang/commit/43749bc83131a4af24527351aabb47dc58590c85"><code>43749bc</code></a>
Update common Prometheus files</li>
<li><a
href="https://github.com/prometheus/client_golang/commit/de192175ccd6f6d4894cd9ceb804712c982e4958"><code>de19217</code></a>
examples: improve simple main.go example (<a
href="https://redirect.github.com/prometheus/client_golang/issues/1999">#1999</a>)</li>
<li><a
href="https://github.com/prometheus/client_golang/commit/20355eb4487c108a6ed54d9ebc6893bd649c10d0"><code>20355eb</code></a>
fix: correct typos in comments and test error messages (<a
href="https://redirect.github.com/prometheus/client_golang/issues/2049">#2049</a>)</li>
<li><a
href="https://github.com/prometheus/client_golang/commit/4cd2d3a57eccc893f00e23eb765f62e970e61f33"><code>4cd2d3a</code></a>
test: fix two flaky tests (darwin start_time regex, memstats
HeapReleased dri...</li>
<li><a
href="https://github.com/prometheus/client_golang/commit/b0d896bb08469911db07752f2c92c4d3986c629b"><code>b0d896b</code></a>
Replace deprecated model.NameValidationScheme with explicit
UTF8Validation (#...</li>
<li>Additional commits viewable in <a
href="https://github.com/prometheus/client_golang/compare/v1.23.2...v1.24.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/prometheus/client_golang&package-manager=go_modules&previous-version=1.23.2&new-version=1.24.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-21 11:16:43 +00:00
dependabot[bot] 0aa74b0e5e chore: bump github.com/scim2/filter-parser/v2 from 2.2.0 to 2.3.1 (#27368) 
Bumps
[github.com/scim2/filter-parser/v2](https://github.com/scim2/filter-parser)
from 2.2.0 to 2.3.1.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/scim2/filter-parser/commit/65b9da65508fb179de8e6841f81a4661a5d13ca1"><code>65b9da6</code></a>
chore: lower go directive to 1.18 (actual minimum)</li>
<li><a
href="https://github.com/scim2/filter-parser/commit/fb6a9f86f8dffff137ca8f65faf65660480ea0d9"><code>fb6a9f8</code></a>
chore: migrate parser dependency to github.com/q-uint/parser</li>
<li><a
href="https://github.com/scim2/filter-parser/commit/a551bba7d74bbd9fce7e56f4844351c77c338d9f"><code>a551bba</code></a>
fix: allow hyphens in URI segments (<a
href="https://redirect.github.com/scim2/filter-parser/issues/29">#29</a>)</li>
<li><a
href="https://github.com/scim2/filter-parser/commit/5c111b10bf6b419428e400380472a51512f3be00"><code>5c111b1</code></a>
fix: preserve operator precedence in LogicalExpression.String() (<a
href="https://redirect.github.com/scim2/filter-parser/issues/28">#28</a>)</li>
<li>See full diff in <a
href="https://github.com/scim2/filter-parser/compare/v2.2.0...v2.3.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/scim2/filter-parser/v2&package-manager=go_modules&previous-version=2.2.0&new-version=2.3.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-21 11:13:28 +00:00
Spike Curtis 9bd4cf2a2a test: use NATS in coderdtest by default (#27343) 
Closes GRU-70

Enables NATS as the pubsub for `coderdtest` unless specifically overwritten by the test case.
 2026-07-21 11:19:23 +02:00