mirror of
https://github.com/coder/coder.git
synced 2026-09-24 15:04:27 +08:00
d5bb35a49a1caaa7b9325b0eeb79b143f420b048
15800
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Michael Suchacz
|
d5bb35a49a |
fix(coderd): deflake TestChatMessageWithFiles/FileCapExceeded (#28091)
Fixes the flake tracked in [CODAGT-926](https://linear.app/codercom/issue/CODAGT-926/flake-testchatmessagewithfilesfilecapexceeded). ## Problem `TestChatMessageWithFiles/FileCapExceeded` asserted the rollback of a rejected over-cap send by comparing message counts taken before and after the send. `CreateChat` starts assistant generation asynchronously, so the assistant reply can be persisted between the two reads, making the count check fail even though the rejected message was correctly rolled back ("should have 1 item(s), but has 2"). ## Fix Replace the count comparison with a semantic assertion that the rejected `one too many` message was not persisted, hardened through Codex review rounds: - Scan message history for the rejected marker instead of comparing counts. - Also scan `QueuedMessages`: a busy chat queues the send before file-link validation, so a rollback regression could leave the rejected message queued rather than in history. - Close the queue-promotion race: `getChatMessages` reads history and the queue in two separate database reads, so the assertion first waits for the queue to observe empty; a promoted message must then appear in a fresh history read. ## Verification - Deterministic repro of the exact CI failure signature: waiting for the async assistant reply before the old count assertion reproduced `should have 1 item(s), but has 2` every run. - The new assertion passes under that same forced condition. - Assertion liveness (all temporary red checks reverted): persisting the marker in history fails the history scan; queuing the marker fails the queued scan; queuing the marker and letting it promote fails the post-drain history scan 3/3. - `go test ./coderd -run 'TestChatMessageWithFiles/FileCapExceeded' -count=100` and the full `TestChatMessageWithFiles` parent both pass. > Mux acted on Mike's behalf to create this PR. |
||
|
Michael Suchacz
|
48e1e28638 |
fix(coderd/x/chatd/chattool): make edit_files schema and errors actionable for models (#28121)
## Problem Chat `45b87e40-ffe7-49e5-8932-5fd0bdb9e542` on dev.coder.com failed 57 of 75 `edit_files` tool calls. Every failure was the same: the model omitted `files[].path` (it batched edits per file but only filled in `edits`), and the error relayed back to the model was: ``` POST http://[fd7a:115c:...]:4/api/v0/edit-files: unexpected status code 400: "path" is required ``` The model retried the identical malformed call dozens of times. Two gaps made this sticky: 1. The `edit_files` input schema had no field descriptions, so `path` was only a bare required property. 2. The agent API error reached the model wrapped in HTTP transport noise (method, internal tailnet URL, status code) with no indication of which `files` entry was broken. ## Changes - Add `description` tags to every `edit_files` schema field and state the path requirement in the tool description. - Validate `files` entries in the tool before plan-turn checks and the workspace connection lookup, returning entry-indexed errors such as `files[1].path is required; provide the absolute path of the file to edit; no files in this batch were applied`. - Relay agent API failures with `Message`, `Helper`, `Detail`, and `Validations` from `codersdk.Error` instead of the raw transport-prefixed string. ## Validation - `go test ./coderd/x/chatd/chattool` passes; new tests cover the schema description, entry-indexed validation errors, and transport-noise stripping (each verified red-green by toggling the fix off). - `go build ./...`, `go vet`, and pre-commit (fmt + lint) pass. > Mux created this PR on Mike's behalf. |
||
|
McKayla はな
|
e1fa247e59 | feat: redirect to the template builder after first time setup (#27670) | ||
|
Bobby HoandClaude Opus 5
|
990d24dc42 |
feat: add oauth2 scope columns and single-use delete queries (#28007)
OAuth2 tokens issued by Coder ignore scope entirely. The authorize endpoint parses the `scope` parameter and then discards it, and both grant paths mint API keys with full API access regardless of what the client requested or what the app's allowlist permits. There is also nowhere to put a negotiated scope: nothing carries one from the authorize step to the token it produces. Schema and query groundwork for that pipeline. No behavior change on its own. - Migration `000569` adds a `scope` column to `oauth2_provider_app_codes` and `oauth2_provider_app_tokens`, so a negotiated scope can travel from a code to the token it is exchanged for, and from a token to its refreshed successor. - Existing rows are backfilled to `coder:all`, then both columns become NOT NULL with a non-empty CHECK. Every OAuth2 key is unrestricted in fact today, so the backfill only writes that down, and a caller that omits the column now fails instead of silently issuing full access. - Adds `DeleteOAuth2ProviderAppCodeByIDReturningRow` and `DeleteAPIKeyByIDReturningRow`, which return `sql.ErrNoRows` when the row is already gone. Postgres serializes concurrent deletes on the row lock, so exactly one caller gets a row back, which is what will let the grant paths enforce single use of a code or refresh token without a read-then-write race. - No callers yet. The existing blind deletes and all of their call sites are untouched, and codes and tokens record `coder:all` until a later phase negotiates a real value. Phase 1 of [PLAT-470](https://linear.app/codercom/issue/PLAT-470), tracked as [PLAT-478](https://linear.app/codercom/issue/PLAT-478/phase-1-schema-and-queries). Scope validation at authorize, applying the negotiated scope in the code grant, and refresh narrowing follow as separate PRs. Verified locally: `make gen` and `make lint` clean, the migrations suite passes both up and down, and dbauthz's `TestMethodTestSuite` passes. <details> <summary>End-to-end scope enforcement flow (green marks what this PR touches)</summary> ```mermaid flowchart TD subgraph authorize["/oauth2/authorize"] AZ1["ShowAuthorizePage (GET)<br/>renders consent page"] AZ2["ProcessAuthorize (POST)<br/>scope parsed, then discarded"] Q1["InsertOAuth2ProviderAppCode<br/>gains a Scope param"] AZ1 --> AZ2 --> Q1 end Q1 --> CODES[("oauth2_provider_app_codes<br/>new column: scope text NOT NULL")] subgraph codegrant["POST /oauth2/token, grant_type=authorization_code"] G1["authorizationCodeGrant"] Q2["GetOAuth2ProviderAppCodeByPrefix<br/>now returns Scope"] Q4["DeleteOAuth2ProviderAppCodeByIDReturningRow<br/>added, no caller yet"] G2["apikey.Generate + UserRBACSubject<br/>hardcoded to full access"] G1 --> Q2 --> G2 G1 -.-> Q4 end CODES --> G1 G2 --> Q3 Q3["InsertOAuth2ProviderAppToken<br/>gains a Scope param"] Q3 --> TOKENS[("oauth2_provider_app_tokens<br/>new column: scope text NOT NULL")] subgraph refresh["POST /oauth2/token, grant_type=refresh_token"] G3["refreshTokenGrant"] Q5["GetOAuth2ProviderAppTokenByPrefix<br/>now returns Scope"] Q6["DeleteAPIKeyByIDReturningRow<br/>added, no caller yet"] G3 --> Q5 G3 -.-> Q6 end TOKENS --> G3 Q5 --> Q3 subgraph enforce["Every authenticated API request"] E1["httpmw ExtractAPIKey"] --> E2["APIKey.ScopeSet()"] --> E3["UserRBACSubject"] --> E4["dbauthz authorize"] end TOKENS --> E1 classDef changed fill:#c8e6c9,stroke:#2e7d32,stroke-width:2px,color:#1b3c1e classDef dormant fill:#c8e6c9,stroke:#2e7d32,stroke-width:2px,stroke-dasharray:5 3,color:#1b3c1e class Q1,Q2,Q3,Q5,CODES,TOKENS changed class Q4,Q6 dormant ``` Solid green is added or changed here. Dashed green exists but has no caller yet. Everything else is unchanged, including the enforcement engine at the bottom, which already reads a key's scopes correctly and only needs real data fed into it. </details> <details> <summary>Suggested reading order</summary> Most of the diff is generated. `dump.sql`, `models.go`, `querier.go`, `queries.sql.go`, `check_constraint.go`, and the dbmock and dbmetrics packages all come from `make gen`. 1. `migrations/000569_oauth2_scope_columns.{up,down}.sql`: additive column, backfill, NOT NULL, CHECK, and a `COMMENT ON COLUMN` on each. 2. `queries/oauth2.sql` and `queries/apikeys.sql`: `scope` added to both insert column lists, plus the two new returning-row deletes alongside the untouched originals. The `Get...ByPrefix` selects needed no edit, since they are `SELECT *`. 3. `dbauthz/dbauthz.go`: hand-written wrappers for the two new queries, each fetching by ID, authorizing delete against the fetched object, then delegating. The generic `deleteQ` helper does not fit, since it requires the delete to return only `error`. 4. `oauth2provider/authorize.go` and `oauth2provider/tokens.go`: the only production changes, all behavior-neutral. 5. `dbgen/dbgen.go` and `dbauthz/dbauthz_test.go`: seed threading, plus a case per new query. `MethodTestSuite` fails with "Method never called" for anything untested. Neither type needs to become auditable, which `make lint` confirms by not erroring on `enterprise/audit/table.go`. </details> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|
Michael Suchacz
|
8d4d0b35dd |
feat: add Coder Agents chat tools to the MCP toolsdk (#28025)
Exposes the experimental Coder Agents chats API through the MCP tool registry, so MCP clients (the hosted `/api/experimental/mcp/http` server and `coder exp mcp server`) can start and drive server-side coding agents. New tools in `codersdk/toolsdk`, all thin wrappers over existing `codersdk.ExperimentalClient` methods: | Tool | Wraps | |---|---| | `coder_create_chat` | `CreateChat` (prompt, optional org, model config, labels) | | `coder_get_chat` | `GetChat` (status, last error, last turn summary, workspace, files) | | `coder_get_chat_messages` | `GetChatMessages` (user-facing parts, chronological, cursor pagination, queued prompts) | | `coder_send_chat_message` | `CreateChatMessage` (queue or interrupt busy behavior) | | `coder_interrupt_chat` | `InterruptChat` | | `coder_archive_chat` | `UpdateChat` with `archived: true` | | `coder_list_chat_model_configs` | `ListChatModelConfigs` (enabled configs with default flag) | Both MCP servers register tools from `toolsdk.All`, so no additional wiring is needed. Responses are trimmed to what an MCP caller needs (IDs as strings, user-facing transcripts) rather than full SDK payloads. No new endpoints and no database changes. Also adds MCP [prompts](https://modelcontextprotocol.io/specification/2026-07-28/server/prompts) for the chat workflows, defined once in `codersdk/toolsdk` and registered by both servers: | Prompt | Purpose | |---|---| | `coder_agents_delegate` | delegate a task to a Coder Agents chat and monitor it to completion | | `coder_agents_check` | check the status and recent activity of an existing chat | Each prompt declares the tools its workflow needs; the stdio server skips prompts whose tools are excluded by `--allowed-tools`. Tests run the tools against a chat-enabled coderdtest instance (fake OpenAI-compatible provider plus in-process AI bridge), covering the full lifecycle, an interrupt against a blocked turn, pagination cursors, permission-dependent model config filtering, and argument validation. Prompt coverage spans SDK rendering, the hosted `prompts/list`/`prompts/get` round trip, and the stdio server including allowlist gating. > Mux created this PR on Mike's behalf. |
||
|
Michael Suchacz
|
bca5d72c1c |
fix(site): prefer permitted organization for chat creation (#28078)
Fixes first-send 403s for multi-org users who lack `chat:create` in the deployment default organization (CODAGT-892). Two frontend defects combined to send chat creation to the wrong organization: 1. The Agents create form initialized its organization selection permission-blind to the default org and only corrected it when the `permittedOrganizations` authcheck result *transitioned*, so a fast first send raced the check, and on warm-query-cache remounts the correction never ran at all: the wrong org stayed selected permanently while the org picker was hidden. 2. The permitted-organizations authcheck itself sent no `owner_id`, so roles that grant `chat:create` at member (owner) scope, such as `agents-access` (Coder Agents User, the exact role in the customer report), were denied in every organization and the form always fell back to the default org. This part was split out and already landed on main via #28076; after rebasing, this PR relies on that fix and keeps its stricter regression stories around it. ## Changes - Derive the effective organization at render time: keep the user's explicit pick only while it is still permitted, otherwise fall back to the permitted default org, then the first permitted org, then the dashboard default. Replaces the transition-based reconciliation, which could not fire when the query cache was already warm on mount. - Keep user-driven org cleanup (workspace selection, attachments) in the picker/dialog event handlers; permission-driven changes are handled by render-time state adjustments and the attachment hook's post-commit adoption effect. - Disable Send until the permitted-organizations check settles and the attachment hook has adopted the effective org; hide the org picker and disable the workspace picker until the check settles (their pre-settlement options come from the unfiltered dashboard fallback, so a pick could persist a foreign-org workspace). - Scope persisted attachments to their organization in `useFileAttachments`: restoration defers until a permitted org is known, permission-driven org changes replace attachment state post-commit, in-flight uploads are invalidated by an adoption epoch (including A-to-B-to-A round trips), and no render exposes another org's file IDs, including when authorization resolves to no org at all. - Revalidate org-scoped state on permission refetches: a revoked explicit selection clears instead of lying latent, a settled effective-org change drops the stored workspace, and the org-change confirmation dialog closes (and re-checks on confirm) when its pending org is revoked. - Rebase reconciliation with #28076: the stories use its `permittedOrganizationsKey` helper and retain its `MemberScopedPermissionsShowOrgPicker` regression story alongside this PR's stricter member-scope stories. The backend RBAC rejection was correct; this is frontend-only. ## Testing - Red-green: every guard above was verified by reverting it and confirming exactly its guarding story or unit test fails (whole-file runs). - `pnpm -C site check`, `pnpm -C site lint`, `pnpm -C site lint:types`, full `AgentCreateForm.stories.tsx` (42 pass), `useFileAttachments.test.tsx` (8 pass), re-run after the rebase onto main. - Dogfood UAT on a licensed multi-org dev deployment at this branch: a restricted user with `agents-access` only in a non-default org sends first and warm-remount messages successfully (201, payload carries the permitted org, no 403); admin picker, workspace filtering, and attachment org-change dialog verified. Round 2 of UAT caught the missing `owner_id` (now landed via #28076); round 3 re-verified end to end. > Mux created this PR on Mike's behalf. |
||
|
Steven Masley
|
0d0f5b4392 |
test: skip racey tasks test (#28033)
tasks is being removed, so fixing tests is not worth it Closes: https://github.com/coder/internal/issues/1635 |
||
|
Susana FerreiraandNick Vigilante
|
3426f83a27 |
docs: use approximate spend and add Everyone group tip for AI Gateway cost controls (#28012)
## Summary Updates the AI Governance Cost Control docs in two ways: - **Terminology:** aligns the docs with the UI, which now labels spend as **approximate** rather than **estimated**. Renames the `Estimated spend` term, the "How spend is calculated" section (and its anchor and references), and updates the surrounding prose. - **Everyone group tip:** adds a note that, because the organization's `Everyone` group includes every member, its **Members** tab is a quick way for an admin to look up any user's effective group. This complements the existing Get user AI spend API endpoint, since there is no dedicated cost control page today. Related: https://github.com/coder/coder/pull/27977 --- _This PR was created by Coder Agents on behalf of @ssncferreira._ --------- Co-authored-by: Nick Vigilante <nickvigilante@users.noreply.github.com> |
||
|
TJ
|
49cbd7dde3 |
fix(site): keep standard avatar border for normal AI spend state (#28037)
The navbar avatar received a grey `border-content-secondary` override whenever AI spend data was present, so the default (normal spend) state looked different from a standard avatar. It also relied entirely on border color to communicate state, which is easy to miss and inaccessible to colorblind users. ## Changes - **Avatar border**: always standard — the severity border override is removed for all states. - **Warning / exceeded states** get a notification-style corner badge (like the inbox unread badge): - Warning: triangle-alert icon on the orange alert surface (`surface-orange` / `highlight-orange`). - Exceeded: octagon-alert icon on the red alert surface (`surface-red` / `highlight-red`). - Distinct icon shapes per state make the change perceivable without relying on color; surface/highlight token pairs keep the icon light on dark mode and dark on light mode. - **Accessibility**: the trigger now has a descriptive accessible name — `User menu`, `User menu. AI spend is nearing its limit`, or `User menu. AI spend limit exceeded`. Storybook: `AvatarBorderNormal/Warning/Exceeded` stories assert the trigger's accessible name per state, and Chromatic snapshots cover the visual states. <img width="604" height="542" alt="image" src="https://github.com/user-attachments/assets/3dab5700-c35b-44a6-abc5-7413254adeee" /> --- *This PR was generated by Coder Agents on behalf of @tracyjohnsonux.* |
||
|
Susana Ferreira
|
2d9b6eda8f |
feat: add experimental CLI to price unpriced AI models (#27926)
## Description AI Gateway computes the cost of an interception from `ai_model_prices`, which is seeded on every server start from a price book embedded in the binary. A model the price book does not cover records a NULL cost, so its spend is invisible to cost reporting and is not enforced against budgets. The only fix was to wait for a Coder release that added the model. This adds an experimental CLI, backed by an experimental HTTP endpoint, for pricing those models. Models the price book already covers are rejected, because the seeder re-applies the book on every start and would overwrite an operator price. Support for custom pricing will be handled in https://linear.app/codercom/issue/AIGOV-589/extend-experimental-cli-command-to-set-custom-ai-model-prices. ## Commands ``` coder exp ai-model-prices list [--provider] [--model] coder exp ai-model-prices update [file|-] [--provider] [--model] [--input-price] [--output-price] [--cache-read-price] [--cache-write-price] [--yes] ``` ## Changes - Add `GET` and `POST /api/experimental/ai/model-prices`, gated behind the AI Bridge entitlement and the existing `ai_model_price` RBAC resource. - Add a `GetAIModelPrices` query with optional `provider` and `model` filters applied in SQL. - Validate the whole request before writing anything, so one bad entry cannot leave the table half updated, and report every problem at once. - Reject prices for models the embedded price book already covers, through a new `prices.IsDefaultPriced`. - Add the `coder exp ai-model-prices` command with `list` and `update`. `update` accepts a JSON document or the single-model flags and prints a plan, asking to confirm unless the document is piped in or `--yes` is passed. - Consolidate the supported provider list into `coderd/aibridge/prices/providers` so the price generator and the server share one definition. - Add `codersdk` types and client methods for both endpoints, and bound the request body at 1 MiB. - Document the command in the AI Gateway cost controls page. Closes https://linear.app/codercom/issue/AIGOV-567/experimental-cli-command-to-set-prices-for-unpriced-ai-models > [!NOTE] > Initially generated by Claude Opus 5, modified and reviewed by @ssncferreira |
||
|
Danielle Maywood
|
abe9c79605 | feat(site/src/pages/AgentsPage): render list_subagent_models tool results (#28116) | ||
|
Hugo Dutka
|
bfa937a36a |
chore: update chatd ARCHITECTURE.md guidance in AGENTS.md (#28103)
Update the guidance related to chatd's `ARCHITECTURE.md` to avoid AI-slop in the document. |
||
|
dependabot[bot]
|
b2c70590db |
chore: bump the vite group across 1 directory with 2 updates (#28108)
Bumps the vite group with 2 updates in the /site directory: [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Updates `@vitejs/plugin-react` from 6.0.4 to 6.0.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite-plugin-react/releases">@vitejs/plugin-react's releases</a>.</em></p> <blockquote> <h2>plugin-react@6.0.5</h2> <h3>Fixed the react compiler preset filter to be linear (<a href="https://redirect.github.com/vitejs/vite-plugin-react/pull/1353">#1353</a>)</h3> <p>The improved filter in v6.0.3 was non-linear and caused a performance regression (<a href="https://redirect.github.com/vitejs/vite-plugin-react/issues/1349">#1349</a>). The filter was changed to be linear to avoid that.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md">@vitejs/plugin-react's changelog</a>.</em></p> <blockquote> <h2>6.0.5 (2026-07-30)</h2> <h3>Fixed the react compiler preset filter to be linear (<a href="https://redirect.github.com/vitejs/vite-plugin-react/pull/1353">#1353</a>)</h3> <p>The improved filter in v6.0.3 was non-linear and caused a performance regression (<a href="https://redirect.github.com/vitejs/vite-plugin-react/issues/1349">#1349</a>). The filter was changed to be linear to avoid that.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitejs/vite-plugin-react/commit/68c0cb8796ce18bd049c3d05c5210eaf0617eac0"><code>68c0cb8</code></a> release: plugin-react@6.0.5 (<a href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1362">#1362</a>)</li> <li><a href="https://github.com/vitejs/vite-plugin-react/commit/555cdbc126506317b05404481374406771a41e70"><code>555cdbc</code></a> fix(react): make the react compiler preset filter linear (<a href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1353">#1353</a>)</li> <li><a href="https://github.com/vitejs/vite-plugin-react/commit/a00a9f8240d5a7bb4062ee2a5bac68ea4f0defa6"><code>a00a9f8</code></a> fix(deps): update all non-major dependencies (<a href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1327">#1327</a>)</li> <li>See full diff in <a href="https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.0.5/packages/plugin-react">compare view</a></li> </ul> </details> <br /> Updates `vite` from 8.1.5 to 8.2.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/releases">vite's releases</a>.</em></p> <blockquote> <h2>create-vite@8.2.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/create-vite@8.2.0/packages/create-vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>plugin-legacy@8.2.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/plugin-legacy@8.2.0/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.2.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.2.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.2.0-beta.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.2.0-beta.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md">vite's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/vitejs/vite/compare/v8.2.0-beta.0...v8.2.0">8.2.0</a> (2026-07-30)</h2> <h3>Features</h3> <ul> <li>add <code>input</code> to <code>server.fs.allow</code> (<a href="https://redirect.github.com/vitejs/vite/issues/23035">#23035</a>) (<a href="https://github.com/vitejs/vite/commit/95a3cdab83e1125b03d2e8dd942fb6b64209e5fa">95a3cda</a>)</li> <li><strong>bundled-dev:</strong> reload once after rebuild instead of via the fallback page (<a href="https://redirect.github.com/vitejs/vite/issues/23106">#23106</a>) (<a href="https://github.com/vitejs/vite/commit/b24381d741941b9ce2b1c07db62cc5f4d7bad981">b24381d</a>)</li> <li><strong>bundled-dev:</strong> support worker file update accepted by HMR (<a href="https://redirect.github.com/vitejs/vite/issues/23068">#23068</a>) (<a href="https://github.com/vitejs/vite/commit/0d04351fdc12258c75b9f1cda5780fdb836ed0ef">0d04351</a>)</li> <li><strong>config:</strong> include column in config incompatibility location (<a href="https://redirect.github.com/vitejs/vite/issues/23064">#23064</a>) (<a href="https://github.com/vitejs/vite/commit/8a245726944ed29225920d49be77c33c6e03afc8">8a24572</a>)</li> <li><strong>dev:</strong> resolve interface name for explicit host in network URLs (<a href="https://redirect.github.com/vitejs/vite/issues/22965">#22965</a>) (<a href="https://github.com/vitejs/vite/commit/3ac77d9dd742968961af38a5a91ed6b061ceda7d">3ac77d9</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li><strong>bundledDev:</strong> print build errors to the terminal when an HMR update fails (<a href="https://redirect.github.com/vitejs/vite/issues/23024">#23024</a>) (<a href="https://github.com/vitejs/vite/commit/41c465896e8b11b1eb9c5fbdafbdcc528e189a2c">41c4658</a>)</li> <li><strong>deps:</strong> update all non-major dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/23069">#23069</a>) (<a href="https://github.com/vitejs/vite/commit/4c07b74416f859d7e8bdace13409ef2d080edf76">4c07b74</a>)</li> <li><strong>hmr:</strong> preserve environment snapshot during server restart (<a href="https://redirect.github.com/vitejs/vite/issues/22992">#22992</a>) (<a href="https://github.com/vitejs/vite/commit/b1186c36d06bb94941c58e8272fc4acb8512c93b">b1186c3</a>)</li> <li><strong>importAnalysis:</strong> interop imports injected into optimized dep files by plugins (<a href="https://redirect.github.com/vitejs/vite/issues/23029">#23029</a>) (<a href="https://github.com/vitejs/vite/commit/8c2a87d41fb24536e59643351758084cde4d0dd7">8c2a87d</a>)</li> <li><strong>module-runner:</strong> keep stack trace interception working when <code>Object.prototype</code> is frozen (<a href="https://redirect.github.com/vitejs/vite/issues/23073">#23073</a>) (<a href="https://github.com/vitejs/vite/commit/599c5b02a8b6879b05ede988020f1331e877aaea">599c5b0</a>)</li> <li><strong>server:</strong> strip base in indexHtml module graph lookup (<a href="https://redirect.github.com/vitejs/vite/issues/22932">#22932</a>) (<a href="https://github.com/vitejs/vite/commit/fa005d19af5d847931c6dbefc63841c137383e6c">fa005d1</a>)</li> <li>support resolving top-level input option with plugins (<a href="https://redirect.github.com/vitejs/vite/issues/23101">#23101</a>) (<a href="https://github.com/vitejs/vite/commit/41df81a6a4c3eef08f7a9a8ac9530cd136c0eafa">41df81a</a>)</li> </ul> <h3>Documentation</h3> <ul> <li><strong>config:</strong> correct cacheDir default fallback description (<a href="https://redirect.github.com/vitejs/vite/issues/23060">#23060</a>) (<a href="https://github.com/vitejs/vite/commit/aafa103af5d71fb59d7c3dd617d0cbef3b222f1f">aafa103</a>)</li> </ul> <h3>Tests</h3> <ul> <li>config CJS module vars in ESM case (<a href="https://redirect.github.com/vitejs/vite/issues/23010">#23010</a>) (<a href="https://github.com/vitejs/vite/commit/d8cd38830251b95fd7dddcd0eee0ce94cc61c2f4">d8cd388</a>)</li> </ul> <h2><a href="https://github.com/vitejs/vite/compare/v8.1.5...v8.2.0-beta.0">8.2.0-beta.0</a> (2026-07-22)</h2> <h3>Features</h3> <ul> <li>add <code>input</code> option (<a href="https://redirect.github.com/vitejs/vite/issues/22642">#22642</a>) (<a href="https://github.com/vitejs/vite/commit/9beae37d7221b25463a011feb40b0303ca328d87">9beae37</a>)</li> <li><strong>config:</strong> warn features incompatible with native loader in bundle loader (<a href="https://redirect.github.com/vitejs/vite/issues/22850">#22850</a>) (<a href="https://github.com/vitejs/vite/commit/05302b07267f6b4f9dbeac5b1d73fcc3dc06d730">05302b0</a>)</li> <li><strong>css:</strong> export PostCSS config type for type-safe configs (<a href="https://redirect.github.com/vitejs/vite/issues/22792">#22792</a>) (<a href="https://github.com/vitejs/vite/commit/302c755a8125b9a26214e3b413922b5513e41981">302c755</a>)</li> <li><strong>dev:</strong> label network URLs with their interface name (<a href="https://redirect.github.com/vitejs/vite/issues/22830">#22830</a>) (<a href="https://github.com/vitejs/vite/commit/78accc42a5b8887d9df624f7d4a934d3ead677d1">78accc4</a>)</li> <li><strong>optimizer:</strong> support aube lockfile (<a href="https://redirect.github.com/vitejs/vite/issues/22813">#22813</a>) (<a href="https://github.com/vitejs/vite/commit/6319827116c5be2a19c1b91c84ba3d38ad26a41c">6319827</a>)</li> <li><strong>optimizer:</strong> support nub lockfile (<a href="https://redirect.github.com/vitejs/vite/issues/22891">#22891</a>) (<a href="https://github.com/vitejs/vite/commit/65d3604f6fdbfcf6e86244d7fe3c1ca86acae701">65d3604</a>)</li> <li>update rolldown-related dependencies and use client-side HMR in bundled-dev (<a href="https://redirect.github.com/vitejs/vite/issues/22961">#22961</a>) (<a href="https://github.com/vitejs/vite/commit/960e9efbc1372000caac46cc2f123cef4824e2bb">960e9ef</a>)</li> <li><strong>wasm:</strong> expand test suite, unwrap WebAssembly.Global and enable js-string builtins (<a href="https://redirect.github.com/vitejs/vite/issues/22674">#22674</a>) (<a href="https://github.com/vitejs/vite/commit/9e79b51579457a9af4fa623b68a0bfabbf38010b">9e79b51</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li><strong>build:</strong> map CSS chunks in chunk import maps (fix <a href="https://redirect.github.com/vitejs/vite/issues/22946">#22946</a>) (<a href="https://redirect.github.com/vitejs/vite/issues/22947">#22947</a>) (<a href="https://github.com/vitejs/vite/commit/e16ff3a1199293ac9cdfa6132c08fdea162215f3">e16ff3a</a>)</li> <li><strong>config:</strong> exclude virtual modules from native config compat check (<a href="https://redirect.github.com/vitejs/vite/issues/22979">#22979</a>) (<a href="https://github.com/vitejs/vite/commit/2ced1fe4e4e480ed78cb7aa5c78319e57bfa7783">2ced1fe</a>)</li> <li><strong>css:</strong> rewrite urls in OnceExit-injected content (<a href="https://redirect.github.com/vitejs/vite/issues/22983">#22983</a>) (<a href="https://github.com/vitejs/vite/commit/abb793e18c92592c21fbb8e1f3fc450b5839f04f">abb793e</a>)</li> <li><strong>deps:</strong> update all non-major dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/22985">#22985</a>) (<a href="https://github.com/vitejs/vite/commit/04f345b37064cd0bba6447eb5c32be5c22162f3d">04f345b</a>)</li> <li><strong>deps:</strong> update dependency magic-string to v1 (<a href="https://redirect.github.com/vitejs/vite/issues/22998">#22998</a>) (<a href="https://github.com/vitejs/vite/commit/c60b4d7cdb85b7d4f78671cdcfb863e5f8b66bb7">c60b4d7</a>)</li> <li><strong>hmr:</strong> remove hot data after prune (<a href="https://redirect.github.com/vitejs/vite/issues/23002">#23002</a>) (<a href="https://github.com/vitejs/vite/commit/be9631658f5191ee5c5665e780239d42a330280a">be96316</a>)</li> <li>resolve root to real path (<a href="https://redirect.github.com/vitejs/vite/issues/22832">#22832</a>) (<a href="https://github.com/vitejs/vite/commit/55bba7bbd9de40d031360e4408fe91bff5b29ec9">55bba7b</a>)</li> </ul> <h3>Performance Improvements</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitejs/vite/commit/24a611f1c83a976d32262628d42f683609746635"><code>24a611f</code></a> release: v7.2.4</li> <li><a href="https://github.com/vitejs/vite/commit/2d66b7b14aa6dfd62f3d6a59ee8382ed5ca6fd32"><code>2d66b7b</code></a> fix: revert "perf(deps): replace debug with obug (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21107">#21107</a>)"</li> <li><a href="https://github.com/vitejs/vite/commit/a668014dba377c2b82a32d8124f1761e9ea74f82"><code>a668014</code></a> release: v7.2.3</li> <li><a href="https://github.com/vitejs/vite/commit/acfe939e1f7c303c34b0b39b883cc302da767fa2"><code>acfe939</code></a> perf(deps): replace debug with obug (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21107">#21107</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/4f8171eb3046bd70c83964689897dab4c6b58bc0"><code>4f8171e</code></a> fix(deps): update all non-major dependencies (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21128">#21128</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/50297208452241061cb44d09a4bbdf77a11ac01e"><code>5029720</code></a> chore(deps): update rolldown-related dependencies (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21127">#21127</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/5909efd8fbfd1bf1eab65427aea0613124b2797a"><code>5909efd</code></a> fix: allow multiple <code>bindCLIShortcuts</code> calls with shortcut merging (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21103">#21103</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/39a0a15fd24ed37257c48b795097a3794e54d255"><code>39a0a15</code></a> chore(deps): update rolldown-related dependencies (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21095">#21095</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/6a34ac3422686e7cf7cc9a25d299cb8e5a8d92a0"><code>6a34ac3</code></a> fix(deps): update all non-major dependencies (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21096">#21096</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/02ceaec45e17bef19159188a28d9196fed1761be"><code>02ceaec</code></a> chore(deps): update dependency <code>@rollup/plugin-commonjs</code> to v29 (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21099">#21099</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vitejs/vite/commits/create-vite@8.2.0/packages/vite">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
f09cb20b1e |
ci: bump dorny/paths-filter from 4.0.2 to 4.0.3 in the github-actions group (#28119)
Bumps the github-actions group with 1 update: [dorny/paths-filter](https://github.com/dorny/paths-filter). Updates `dorny/paths-filter` from 4.0.2 to 4.0.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/dorny/paths-filter/releases">dorny/paths-filter's releases</a>.</em></p> <blockquote> <h2>v4.0.3</h2> <h2>What's Changed</h2> <ul> <li>Update Outputs in readme to account for the 'every' predicate-quantifier by <a href="https://github.com/hintron"><code>@hintron</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/247">dorny/paths-filter#247</a></li> <li>fix: scope base-ignored warning to API path by <a href="https://github.com/saschabratton"><code>@saschabratton</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/319">dorny/paths-filter#319</a></li> <li>docs: add contents permission to PR example by <a href="https://github.com/134130"><code>@134130</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/248">dorny/paths-filter#248</a></li> <li>feat: add 'some-with-excludes' predicate quantifier by <a href="https://github.com/arxeiss"><code>@arxeiss</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/322">dorny/paths-filter#322</a></li> <li>Document safe handling of file list outputs in workflows by <a href="https://github.com/dorny"><code>@dorny</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/326">dorny/paths-filter#326</a></li> </ul> <h2>Security</h2> <ul> <li>Escape multi-line filenames in list-files shell and csv output] by <a href="https://github.com/ken-matsui"><code>@ken-matsui</code></a> and <a href="https://github.com/tjswlsgg"><code>@tjswlsgg</code></a> in <a href="https://github.com/advisories/GHSA-7hc6-8hq5-9q2m">https://github.com/advisories/GHSA-7hc6-8hq5-9q2m</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/hintron"><code>@hintron</code></a> made their first contribution in <a href="https://redirect.github.com/dorny/paths-filter/pull/247">dorny/paths-filter#247</a></li> <li><a href="https://github.com/134130"><code>@134130</code></a> made their first contribution in <a href="https://redirect.github.com/dorny/paths-filter/pull/248">dorny/paths-filter#248</a></li> <li><a href="https://github.com/arxeiss"><code>@arxeiss</code></a> made their first contribution in <a href="https://redirect.github.com/dorny/paths-filter/pull/322">dorny/paths-filter#322</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/dorny/paths-filter/compare/v4...v4.0.3">https://github.com/dorny/paths-filter/compare/v4...v4.0.3</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md">dorny/paths-filter's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v4.0.3</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/326">Document safe handling of file list outputs in workflows</a></li> <li><a href="https://github.com/advisories/GHSA-7hc6-8hq5-9q2m">Escape multi-line filenames in list-files shell and csv output</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/322">Add 'some-with-excludes' predicate quantifier</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/248">Add contents permission to PR example</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/319">Scope base-ignored warning to API path</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/247">Update outputs in readme to account for the 'every' predicate-quantifier</a></li> </ul> <h2>v4.0.2</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/317">Work around git dubious ownership errors in container jobs</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/303">Use rev-parse instead of branch --show-current for older git compat</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/282">Fix warning message</a></li> </ul> <h2>v4.0.1</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/255">Support merge queue</a></li> </ul> <h2>v4.0.0</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/294">Update action runtime to node24</a></li> </ul> <h2>v3.0.4</h2> <ul> <li><a href="https://github.com/advisories/GHSA-7hc6-8hq5-9q2m">Escape multi-line filenames in list-files shell and csv output</a></li> </ul> <h2>v3.0.3</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/279">Add missing predicate-quantifier</a></li> </ul> <h2>v3.0.2</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/224">Add config parameter for predicate quantifier</a></li> </ul> <h2>v3.0.1</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/133">Compare base and ref when token is empty</a></li> </ul> <h2>v3.0.0</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/210">Update to Node.js 20</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/215">Update all dependencies</a></li> </ul> <h2>v2.11.1</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/167">Update @actions/core to v1.10.0 - Fixes warning about deprecated set-output</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/168">Document need for pull-requests: read permission</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/164">Updating to actions/checkout@v3</a></li> </ul> <h2>v2.11.0</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/157">Set list-files input parameter as not required</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/161">Update Node.js</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/162">Fix incorrect handling of Unicode characters in exec()</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/163">Use Octokit pagination</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/160">Updates real world links</a></li> </ul> <h2>v2.10.2</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/dorny/paths-filter/commit/ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d"><code>ceb8a2b</code></a> Update CHANGELOG.md for v4.0.3 and v3.0.4 (<a href="https://redirect.github.com/dorny/paths-filter/issues/327">#327</a>)</li> <li><a href="https://github.com/dorny/paths-filter/commit/ef09b88f3eacdbec6ce135a7c9a193a6849545c1"><code>ef09b88</code></a> Document safe handling of file list outputs in workflows (<a href="https://redirect.github.com/dorny/paths-filter/issues/326">#326</a>)</li> <li><a href="https://github.com/dorny/paths-filter/commit/44adc5b06dc135dba334efce9bf3cf0624512d2d"><code>44adc5b</code></a> Merge commit from fork</li> <li><a href="https://github.com/dorny/paths-filter/commit/4711b7a31b4aa89103d8c6ffab2e3b8e7b6381c7"><code>4711b7a</code></a> feat: add 'some-with-excludes' predicate quantifier (<a href="https://redirect.github.com/dorny/paths-filter/issues/322">#322</a>)</li> <li><a href="https://github.com/dorny/paths-filter/commit/93c889f9e58fca66f35a0c83d8673ac7e88bb70a"><code>93c889f</code></a> fix: escape multi-line filenames in list-files shell and csv output</li> <li><a href="https://github.com/dorny/paths-filter/commit/b41dfa943b1939b9b646f67753bfe35cf6e4de03"><code>b41dfa9</code></a> docs: add contents permission to PR example (<a href="https://redirect.github.com/dorny/paths-filter/issues/248">#248</a>)</li> <li><a href="https://github.com/dorny/paths-filter/commit/9af6e5a9d010d1ae8ec570390b3d793e2b70a402"><code>9af6e5a</code></a> fix: scope base-ignored warning to API path (<a href="https://redirect.github.com/dorny/paths-filter/issues/319">#319</a>)</li> <li><a href="https://github.com/dorny/paths-filter/commit/cae9006b65a1a53044b518c68e13e835c54948a7"><code>cae9006</code></a> docs: update outputs in readme to account for the 'every' predicate-quantifie...</li> <li>See full diff in <a href="https://github.com/dorny/paths-filter/compare/7b450fff21473bca461d4b92ce414b9d0420d706...ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
314897631d |
chore: bump @types/lodash from 4.17.24 to 4.17.25 in /site (#28114)
Bumps [@types/lodash](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/lodash) from 4.17.24 to 4.17.25. <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/lodash">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
f792ba45fd |
chore: bump postcss from 8.5.18 to 8.5.26 in /site (#28113)
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.18 to 8.5.26. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/postcss/postcss/releases">postcss's releases</a>.</em></p> <blockquote> <h2>8.5.26</h2> <ul> <li>Fixed <code>list.split()</code> regression (by <a href="https://github.com/lazerg"><code>@lazerg</code></a>).</li> <li>Track symlinks in path protection in source map loading (by <a href="https://github.com/drengir1"><code>@drengir1</code></a>).</li> </ul> <h2>8.5.25</h2> <ul> <li>Fixed 8.5.17 visitor regression.</li> <li>Fixed <code>list.split()</code> for non-string values (by <a href="https://github.com/amir-rezaei"><code>@amir-rezaei</code></a>).</li> </ul> <h2>8.5.24</h2> <ul> <li>Preserve the BOM after the processing (by <a href="https://github.com/hdimer"><code>@hdimer</code></a>).</li> </ul> <h2>8.5.23</h2> <ul> <li>Do not load source map without <code>opts.from</code> for security reasons.</li> </ul> <h2>8.5.22</h2> <ul> <li>Fixed custom property losing semicolon before a comment (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> </ul> <h2>8.5.21</h2> <ul> <li>Fixed childless at-rule losing semicolon before comment (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> <li>Fixed docs (by <a href="https://github.com/isker"><code>@isker</code></a>).</li> </ul> <h2>8.5.20</h2> <ul> <li>Fixed missing space if <code>AtRule#params</code> is set after (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> <li>Fixed mixing AST error on warnings (by <a href="https://github.com/MahinAnowar"><code>@MahinAnowar</code></a>).</li> </ul> <h2>8.5.19</h2> <ul> <li>Fixed cleaning <code>before</code> for new nodes inserted to <code>Root</code> (by <a href="https://github.com/MahinAnowar"><code>@MahinAnowar</code></a>).</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/postcss/postcss/blob/main/CHANGELOG.md">postcss's changelog</a>.</em></p> <blockquote> <h2>8.5.26</h2> <ul> <li>Fixed <code>list.split()</code> regression (by <a href="https://github.com/lazerg"><code>@lazerg</code></a>).</li> <li>Track symlinks in path protection in source map loading (by <a href="https://github.com/drengir1"><code>@drengir1</code></a>).</li> </ul> <h2>8.5.25</h2> <ul> <li>Fixed 8.5.17 visitor regression.</li> <li>Fixed <code>list.split()</code> for non-string values (by <a href="https://github.com/amir-rezaei"><code>@amir-rezaei</code></a>).</li> </ul> <h2>8.5.24</h2> <ul> <li>Preserve the BOM after the processing (by <a href="https://github.com/hdimer"><code>@hdimer</code></a>).</li> </ul> <h2>8.5.23</h2> <ul> <li>Do not load source map without <code>opts.from</code> for security reasons.</li> </ul> <h2>8.5.22</h2> <ul> <li>Fixed custom property losing semicolon before a comment (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> </ul> <h2>8.5.21</h2> <ul> <li>Fixed childless at-rule losing semicolon before comment (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> <li>Fixed docs (by <a href="https://github.com/isker"><code>@isker</code></a>).</li> </ul> <h2>8.5.20</h2> <ul> <li>Fixed missing space if <code>AtRule#params</code> is set after (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> <li>Fixed mixing AST error on warnings (by <a href="https://github.com/MahinAnowar"><code>@MahinAnowar</code></a>).</li> </ul> <h2>8.5.19</h2> <ul> <li>Fixed cleaning <code>before</code> for new nodes inserted to <code>Root</code> (by <a href="https://github.com/MahinAnowar"><code>@MahinAnowar</code></a>).</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/postcss/postcss/commit/07b25773f38f77919f2af02ae3e8896b0deb5988"><code>07b2577</code></a> Release 8.5.26 version</li> <li><a href="https://github.com/postcss/postcss/commit/47de6b9d7c55674cb326c5de7a734a740916defc"><code>47de6b9</code></a> Update CI</li> <li><a href="https://github.com/postcss/postcss/commit/1493a83db7830912316512f55ab6064e7b7dd68e"><code>1493a83</code></a> Fix Rule#selectors losing the empty selector (<a href="https://redirect.github.com/postcss/postcss/issues/2129">#2129</a>)</li> <li><a href="https://github.com/postcss/postcss/commit/180db166e250d20e6761b224ae8d8134c9ba3e40"><code>180db16</code></a> Typo</li> <li><a href="https://github.com/postcss/postcss/commit/29e9e00f132c96e46e1de295b816fe88a05354e7"><code>29e9e00</code></a> Resolve symlinks before the previous-source-map containment check (<a href="https://redirect.github.com/postcss/postcss/issues/2125">#2125</a>)</li> <li><a href="https://github.com/postcss/postcss/commit/3ba8f84703a884329b58abea579c3615684e0b7e"><code>3ba8f84</code></a> Update dependencies</li> <li><a href="https://github.com/postcss/postcss/commit/87e72f671fd0d401c52822b5226c656632d92ec0"><code>87e72f6</code></a> Update lock file</li> <li><a href="https://github.com/postcss/postcss/commit/caaeeb907e4a816c44a23b00b151882bd02325a1"><code>caaeeb9</code></a> Upgrade nanoid to fix infinite loop on zero size (<a href="https://redirect.github.com/postcss/postcss/issues/2124">#2124</a>)</li> <li><a href="https://github.com/postcss/postcss/commit/3609b6f4296952d0b5b9ddae42c8d73ee460c041"><code>3609b6f</code></a> Explain how to type plugin options</li> <li><a href="https://github.com/postcss/postcss/commit/fbad419cbd01cd7a9a1a46413447f2cd9b3fce4a"><code>fbad419</code></a> docs: show ESM and TypeScript plugin declaration (<a href="https://redirect.github.com/postcss/postcss/issues/2118">#2118</a>)</li> <li>Additional commits viewable in <a href="https://github.com/postcss/postcss/compare/8.5.18...8.5.26">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
a742b53b26 |
chore: bump motion from 12.42.2 to 12.43.0 in /site (#28111)
Bumps [motion](https://github.com/motiondivision/motion) from 12.42.2 to 12.43.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/motiondivision/motion/blob/main/CHANGELOG.md">motion's changelog</a>.</em></p> <blockquote> <h2>[12.43.0] 2026-07-27</h2> <h3>Added</h3> <ul> <li>Hardware acceleration for <code>backgroundColor</code> in supported browsers.</li> <li>Hardware acceleration for SVG elements.</li> </ul> <h3>Fixed</h3> <ul> <li><code>AnimatePresence</code>: Exiting children no longer interleave with entering children, which could reorder and remount children present in both renders.</li> <li><code>motion</code>: Throw error when passing a custom <code>motion</code> component an incorrect <code>ref</code> type.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/motiondivision/motion/commit/a4ef40a5dd378205a41dbb19e7fad04e3280607f"><code>a4ef40a</code></a> v12.43.0</li> <li><a href="https://github.com/motiondivision/motion/commit/14f2d286d1b0805ca8a34b41f9c4122a36e215eb"><code>14f2d28</code></a> adding svg acceleration</li> <li><a href="https://github.com/motiondivision/motion/commit/1f5a27b828d42574ff3dfffa29f77da613d84eb2"><code>1f5a27b</code></a> Fixing merge</li> <li><a href="https://github.com/motiondivision/motion/commit/79f03532429c6abee2de5161e3ca1594aa2d61f0"><code>79f0353</code></a> Updating changelog</li> <li><a href="https://github.com/motiondivision/motion/commit/57f179b1beaec64da990ca914c18697f87265b4f"><code>57f179b</code></a> Updating changelog</li> <li><a href="https://github.com/motiondivision/motion/commit/695cb3954d4df55ca0794bc95f084b377e4f5f4f"><code>695cb39</code></a> Merge pull request <a href="https://redirect.github.com/motiondivision/motion/issues/3755">#3755</a> from motiondivision/fix-issue-2777</li> <li><a href="https://github.com/motiondivision/motion/commit/33a1820f6c35e9b206eca277e059415b07ddafde"><code>33a1820</code></a> Drop the production fallback for non-DOM refs</li> <li><a href="https://github.com/motiondivision/motion/commit/ebe35f223ddda0806af8d8335e7f053115d67d4b"><code>ebe35f2</code></a> Throw an actionable invariant for non-DOM custom component refs</li> <li><a href="https://github.com/motiondivision/motion/commit/a6ed0946a338256f660560500861b09c2b8a20d2"><code>a6ed094</code></a> Merge pull request <a href="https://redirect.github.com/motiondivision/motion/issues/3754">#3754</a> from motiondivision/fix-3745-popchild-ref-warning</li> <li><a href="https://github.com/motiondivision/motion/commit/9f251f3377766a6bf97a93c1634c4e51a7408ccf"><code>9f251f3</code></a> Merge pull request <a href="https://redirect.github.com/motiondivision/motion/issues/3763">#3763</a> from motiondivision/advisor/003-color-waapi</li> <li>Additional commits viewable in <a href="https://github.com/motiondivision/motion/compare/v12.42.2...v12.43.0">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
089c08e10c |
chore: bump react-router from 7.18.0 to 7.18.2 in /site (#28115)
Bumps [react-router](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router) from 7.18.0 to 7.18.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/remix-run/react-router/releases">react-router's releases</a>.</em></p> <blockquote> <h2>v7.18.2</h2> <p>See the changelog for release notes: <a href="https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7182">https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7182</a></p> <h2>v7.18.1</h2> <p>See the changelog for release notes: <a href="https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7181">https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7181</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/remix-run/react-router/blob/react-router@7.18.2/packages/react-router/CHANGELOG.md">react-router's changelog</a>.</em></p> <blockquote> <h2>v7.18.2</h2> <h3>Patch Changes</h3> <ul> <li>Harden RSC CSRF codepaths. (<a href="https://redirect.github.com/remix-run/react-router/pull/15353">#15353</a>)</li> </ul> <h2>v7.18.1</h2> <h3>Patch Changes</h3> <ul> <li><em>No changes</em></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/remix-run/react-router/commit/69a653ee6ab1ac95b13c917ec56c5f3dc17ca9c1"><code>69a653e</code></a> Release v7.18.2 (<a href="https://github.com/remix-run/react-router/tree/HEAD/packages/react-router/issues/15354">#15354</a>)</li> <li><a href="https://github.com/remix-run/react-router/commit/8ebd5df9932854547963e3255c8454e62430e05d"><code>8ebd5df</code></a> Harden RSC CSRF codepaths (backport of <a href="https://github.com/remix-run/react-router/tree/HEAD/packages/react-router/issues/15311">#15311</a>) (<a href="https://github.com/remix-run/react-router/tree/HEAD/packages/react-router/issues/15353">#15353</a>)</li> <li><a href="https://github.com/remix-run/react-router/commit/afdf85d3c15448a41017514caca2aca038d3e9ca"><code>afdf85d</code></a> Release v7.18.1 (<a href="https://github.com/remix-run/react-router/tree/HEAD/packages/react-router/issues/15253">#15253</a>)</li> <li>See full diff in <a href="https://github.com/remix-run/react-router/commits/react-router@7.18.2/packages/react-router">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
15ee136921 |
chore: bump react-infinite-scroll-component from 7.1.0 to 7.2.1 in /site (#28112)
Bumps [react-infinite-scroll-component](https://github.com/ankeetmaini/react-infinite-scroll-component) from 7.1.0 to 7.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/ankeetmaini/react-infinite-scroll-component/releases">react-infinite-scroll-component's releases</a>.</em></p> <blockquote> <h2>v7.2.1 - Accessibility props</h2> <h2>What's new</h2> <h3>Accessibility props</h3> <p>You can now pass <code>role</code>, <code>aria-label</code>, <code>aria-labelledby</code>, <code>tabIndex</code>, <code>id</code>, and any <code>aria-*</code> attribute directly to the scroll container:</p> <pre lang="tsx"><code><InfiniteScroll role="list" aria-label="Search results" dataLength={items.length} next={fetchMore} hasMore={hasMore} loader={<p>Loading...</p>} > {items.map(item => ( <div role="listitem" key={item.id}>{item.name}</div> ))} </InfiniteScroll> </code></pre> <p>Closes <a href="https://redirect.github.com/ankeetmaini/react-infinite-scroll-component/issues/411">#411</a>. Thanks to <a href="https://github.com/sayedrisat"><code>@sayedrisat</code></a> for the contribution!</p> <h2>Commits</h2> <ul> <li>feat: add accessibility props to scroll container (<a href="https://redirect.github.com/ankeetmaini/react-infinite-scroll-component/issues/432">#432</a>)</li> <li>docs: expand accessibility props table and add usage examples (<a href="https://redirect.github.com/ankeetmaini/react-infinite-scroll-component/issues/433">#433</a>)</li> </ul> <h2>v7.2.0 - useInfiniteScroll hook</h2> <h2>What's new</h2> <h3><code>useInfiniteScroll</code> hook</h3> <p>A new named export for building fully custom infinite scroll UIs. The hook manages the <code>IntersectionObserver</code> lifecycle and exposes <code>sentinelRef</code> and <code>isLoading</code> — your markup, your styles, your loader.</p> <pre lang="tsx"><code>import { useInfiniteScroll } from 'react-infinite-scroll-component'; <p>const { sentinelRef, isLoading } = useInfiniteScroll({<br /> next: fetchMore,<br /> hasMore,<br /> dataLength: items.length,<br /> });<br /> </code></pre></p> <p>Attach <code>sentinelRef</code> to any element at the end of your list. <code>isLoading</code> is <code>true</code> from when <code>next()</code> fires until <code>dataLength</code> changes.</p> <p>Accepts the same <code>hasMore</code>, <code>dataLength</code>, <code>next</code>, <code>scrollThreshold</code>, <code>scrollableTarget</code>, and <code>inverse</code> props as the <code>InfiniteScroll</code> component.</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ankeetmaini/react-infinite-scroll-component/commit/8f5ee8c782e9542009c53d3cf09a4e548c4660d5"><code>8f5ee8c</code></a> chore: bump version to 7.2.1</li> <li><a href="https://github.com/ankeetmaini/react-infinite-scroll-component/commit/4b957d00b451d6cbd4a99300b8da240a4d1e8d3e"><code>4b957d0</code></a> docs: add sayedrisat to contributors list</li> <li><a href="https://github.com/ankeetmaini/react-infinite-scroll-component/commit/b7a3600aed44d039b8e2a407cd1441e807dbb879"><code>b7a3600</code></a> docs: add accessibility props to table and usage examples</li> <li><a href="https://github.com/ankeetmaini/react-infinite-scroll-component/commit/dc9f7f4da80629ee8f4efd0e5fc27001a0ce0349"><code>dc9f7f4</code></a> Scope container props to accessibility attributes</li> <li><a href="https://github.com/ankeetmaini/react-infinite-scroll-component/commit/0feacda0e92e90bd898373127af289e73addb936"><code>0feacda</code></a> Add accessibility props to scroll container</li> <li><a href="https://github.com/ankeetmaini/react-infinite-scroll-component/commit/92b3249f361e97323dc9c0ffde603fb91823196c"><code>92b3249</code></a> chore: bump version to 7.2.0</li> <li><a href="https://github.com/ankeetmaini/react-infinite-scroll-component/commit/d896cc9f166e6c2b57effcfd86d2d32d0d67a383"><code>d896cc9</code></a> fix: update stories.tsx import to renamed ScrollableTop</li> <li><a href="https://github.com/ankeetmaini/react-infinite-scroll-component/commit/a3102a644304ab1927bbee2044417cb875a8f038"><code>a3102a6</code></a> docs: fill empty defaults with dash, expand all prop descriptions</li> <li><a href="https://github.com/ankeetmaini/react-infinite-scroll-component/commit/d93280928ef51481c5d1ee6bdac75cb64f38fbe7"><code>d932809</code></a> docs: overhaul README and improve package.json metadata</li> <li><a href="https://github.com/ankeetmaini/react-infinite-scroll-component/commit/b53588b1cadfeaef6aec9a70266421d83d0d2ae9"><code>b53588b</code></a> feat: add AGENTS.md and llms.txt for AI discoverability</li> <li>Additional commits viewable in <a href="https://github.com/ankeetmaini/react-infinite-scroll-component/compare/v7.1.0...v7.2.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
96553f8105 |
chore: bump the react group across 1 directory with 2 updates (#28107)
[//]: # (dependabot-start) ⚠️ **Dependabot is rebasing this PR** ⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Bumps the react group with 2 updates in the /site directory: [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) and [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom). Updates `@types/react` from 19.2.17 to 19.2.18 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react">compare view</a></li> </ul> </details> <br /> Updates `@types/react-dom` from 19.2.3 to 19.2.4 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
0e267475a7 |
chore: bump next from 15.5.21 to 15.5.22 in /offlinedocs (#28110)
Bumps [next](https://github.com/vercel/next.js) from 15.5.21 to 15.5.22. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">next's releases</a>.</em></p> <blockquote> <h2>v15.5.22</h2> <h2>What's Changed</h2> <ul> <li>[15.5] Reject TypeScript >= 7.0 with an actionable error by <a href="https://github.com/lukesandberg"><code>@lukesandberg</code></a> in <a href="https://redirect.github.com/vercel/next.js/pull/96110">vercel/next.js#96110</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/vercel/next.js/compare/v15.5.21...v15.5.22">https://github.com/vercel/next.js/compare/v15.5.21...v15.5.22</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/6ad9e56bbb6b1ebc17a3d35fa820800ac6419775"><code>6ad9e56</code></a> v15.5.22</li> <li><a href="https://github.com/vercel/next.js/commit/fcc0424b7616e73a5f38d2e4f8ec8315355dacf3"><code>fcc0424</code></a> [15.5] Reject TypeScript >= 7.0 with an actionable error (<a href="https://redirect.github.com/vercel/next.js/issues/96110">#96110</a>)</li> <li>See full diff in <a href="https://github.com/vercel/next.js/compare/v15.5.21...v15.5.22">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
a450104247 |
chore: bump @types/lodash from 4.17.24 to 4.17.25 in /offlinedocs (#28109)
Bumps [@types/lodash](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/lodash) from 4.17.24 to 4.17.25. <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/lodash">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
625681aa82 |
chore: bump the coder-modules group across 2 directories with 1 update (#28106)
Bumps the coder-modules group with 1 update in the /dogfood/coder directory: coder/claude-code/coder. Bumps the coder-modules group with 1 update in the /dogfood/vscode-coder directory: coder/claude-code/coder. Updates `coder/claude-code/coder` from 5.2.0 to 5.4.0 Updates `coder/claude-code/coder` from 5.2.0 to 5.4.0 Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Michael Suchacz
|
e92fd8e96f |
chore: retire mark3labs/mcp-go dependency (#28061)
## Stack Context PR 6 of 6 in a stack that migrates every Coder MCP surface from the archived `github.com/mark3labs/mcp-go` library to the official `github.com/modelcontextprotocol/go-sdk` v1.7.0. Stack: #28056 -> #28057 -> #28058 -> #28059 -> #28060 -> #28061 ## Why With every production surface migrated, this PR removes the mark3labs dependency entirely and converts the remaining test fixtures. - Migrates the remaining mark3labs test fixtures (coderd MCP e2e tests, chatd fixtures, mcpclient fixtures, and the Force On MCP policy tests) to official stateless SDK servers. - Removes `github.com/mark3labs/mcp-go` from `go.mod` and drops the corresponding dependabot ignore entry. Zero references remain repo-wide. - Updates the MCP docs for the 2026-07-28 protocol: stateless Streamable HTTP behavior, the supported 2024-11-05 through 2026-07-28 protocol range, and explicit non-features (resources, prompts, structured output, elicitation, MCP Tasks). - The e2e ping assertion is removed because MCP 2026-07-28 removed the ping method. > Mux created this PR on Mike's behalf. |
||
|
Michael Suchacz
|
c8e8b21a88 |
feat: migrate aibridge injected-MCP proxy to official MCP Go SDK (#28060)
## Stack Context PR 5 of 6 in a stack that migrates every Coder MCP surface from the archived `github.com/mark3labs/mcp-go` library to the official `github.com/modelcontextprotocol/go-sdk` v1.7.0. Stack: #28056 -> #28057 -> #28058 -> #28059 -> #28060 -> #28061 ## Why The aibridge injected-MCP proxy now owns an official `*mcp.Client`, `*mcp.StreamableClientTransport`, and `*mcp.ClientSession`. - The proxy constructor accepts an optional `*http.Client` instead of mark3labs options; the header-injecting wrapper shallow-copies a supplied client so its Timeout, Jar, and redirect policy survive. - Manual protocol version negotiation and the mark3labs five-second close workaround are removed; the SDK negotiates during `Connect` and fails when no mutually supported version exists. - Repeated `Init` closes the previous session, and a failed tool fetch closes the just-created session so transports do not leak. - Tool and intercept types use the official pointer content types; embedded resource blobs are re-encoded to base64 for model-facing text because the SDK decodes them into raw bytes. - `aibridge/mcpmock` is regenerated, and its stale `go:generate` source path is corrected. > Mux created this PR on Mike's behalf. |
||
|
Michael Suchacz
|
7720e283f5 |
feat(agent/x/agentmcp): migrate workspace agent MCP client to official Go SDK (#28059)
## Stack Context PR 4 of 6 in a stack that migrates every Coder MCP surface from the archived `github.com/mark3labs/mcp-go` library to the official `github.com/modelcontextprotocol/go-sdk` v1.7.0. Stack: #28056 -> #28057 -> #28058 -> #28059 -> #28060 -> #28061 ## Why The workspace agent MCP manager now stores `*mcp.ClientSession` per configured server. - stdio servers use `mcp.CommandTransport` with an `exec.Cmd` built from Coder's `agentexec.Execer`, preserving environment enrichment; the command uses the manager's parent context so a stdio subprocess outlives the connect handshake and stops when the session closes. - HTTP and SSE servers use header-injecting HTTP clients. - Binary tool content is re-encoded to base64 for the agent API because the official SDK decodes it into raw bytes. - The reload test now triggers config diffs via an environment variable because the official SDK drops connections on non-protocol stdout output (flags like `-test.v` made the fake server chatty). > Mux created this PR on Mike's behalf. |
||
|
Michael Suchacz
|
1e546ea8a3 |
feat(coderd/x/chatd/mcpclient): migrate external MCP client to official Go SDK (#28058)
## Stack Context PR 3 of 6 in a stack that migrates every Coder MCP surface from the archived `github.com/mark3labs/mcp-go` library to the official `github.com/modelcontextprotocol/go-sdk` v1.7.0. Stack: #28056 -> #28057 -> #28058 -> #28059 -> #28060 -> #28061 ## Why The chatd external MCP client (admin-configured MCP servers used by Agent chat) now holds `*mcp.ClientSession` connections created via `mcp.NewClient` and `Client.Connect`, with `StreamableClientTransport` or `SSEClientTransport` per server config. - Auth and identity headers are injected through a custom `http.RoundTripper` because the official SDK has no per-header transport options. - Tool input schemas are extracted from the SDK's `map[string]any` decoding. - Content conversion handles the official pointer content types; the SDK decodes blob resources into raw bytes, so binary content is handled without an extra base64 round trip. - Test fixtures are official stateless Streamable HTTP servers. > Mux created this PR on Mike's behalf. |
||
|
Michael Suchacz
|
26fe3f3185 |
feat(cli): migrate exp mcp stdio server to official MCP Go SDK (#28057)
## Stack Context PR 2 of 6 in a stack that migrates every Coder MCP surface from the archived `github.com/mark3labs/mcp-go` library to the official `github.com/modelcontextprotocol/go-sdk` v1.7.0. Stack: #28056 -> #28057 -> #28058 -> #28059 -> #28060 -> #28061 ## Why `coder exp mcp server` (stdio) now uses the official SDK server with `mcp.IOTransport` over the invocation's stdin/stdout, and reuses the shared `coderd/mcp.RegisterSDKTool` helper from PR #28056 so both servers register tools identically. - A `nopWriteCloser` prevents the SDK from closing the invocation's stdout. - Tests send spec-compliant initialize params and `notifications/initialized` before `tools/list` because the official SDK enforces the protocol lifecycle. > Mux created this PR on Mike's behalf. |
||
|
Michael Suchacz
|
08a1525f78 |
feat: migrate coderd MCP server to official MCP Go SDK (#28056)
## Stack Context PR 1 of 6 in a stack that migrates every Coder MCP surface from the archived `github.com/mark3labs/mcp-go` library to the official `github.com/modelcontextprotocol/go-sdk` v1.7.0, adding MCP 2026-07-28 support while keeping compatibility with clients speaking 2024-11-05 through 2025-06-18. Stack: #28056 -> #28057 -> #28058 -> #28059 -> #28060 -> #28061 ## Why The coderd Streamable HTTP MCP server (`/api/experimental/mcp/http`) is the foundation layer: it introduces the official SDK dependency and the shared `RegisterSDKTool` helper the CLI server reuses. - The server runs the SDK handler in stateless mode with `JSONResponse: true`, preserving the previous `application/json` POST wire format. GET and DELETE return 405, and no `Mcp-Session-Id` is issued, both permitted by the Streamable HTTP spec. - `DisableLocalhostProtection` is set because coderd commonly listens on loopback behind a reverse proxy with a public Host header; the endpoint's bearer authentication is the relevant access control. - Tool registration builds raw JSON object schemas and omits empty `required`, keeping `tools/list` output byte-identical to the previous server (verified with a golden comparison). - SDK logs are adapted to `cdr.dev/slog/v3`; only warnings and errors are forwarded because the SDK logs several INFO lines per stateless request. - Tests cover the modern 2026-07-28 flow, legacy 2025-06-18 initialize, unsupported protocol version rejection (`-32022`), and non-POST method behavior. ## Known behavior deltas vs the old endpoint Both deltas come from the SDK enforcing the Streamable HTTP spec where mark3labs was lenient, on an experimental endpoint: - POST requests whose `Accept` header lists `application/json` without `text/event-stream` are now rejected with 400 (the spec requires clients to list both; a missing `Accept` header is still tolerated). mark3labs did not validate `Accept` at all. - The old server generated an unvalidated `Mcp-Session-Id` response header; the stateless SDK handler issues none. Clients that merely echo the header back are unaffected. ## Validation Beyond unit/integration tests, a remote dogfood UAT ran protocol conformance against a live dev server built from the stack tip: version negotiation matrix (2024-11-05 through bogus/omitted values), auth, session/method semantics, tool schema sanity, tools/call happy and error paths (unknown tool, schema-violating args, malformed JSON, jsonrpc "1.0"), and a concurrency smoke test. No 500s or connection drops; error shapes are clean JSON-RPC/HTTP errors. > Mux created this PR on Mike's behalf. |
||
|
Michael Suchacz
|
d509e1e6a0 |
fix(site): include owner context in Agents org picker permission check (#28076)
Fixes the Agents org picker and workspace attach menu for users whose only chat grant comes from the member-scoped "Coder Agents User" (`agents-access`) org role (PRODUCT-552). ## Problem The per-org authcheck behind the org picker checked `chat:create` with only `organization_id`. The `agents-access` role grants chat permissions at org-member scope, which requires the checked object to be owned by the caller (`policy.rego` `org_member` requires a non-empty owner matching the subject). With no `owner_id`, every org check returned `false`, so: - the org picker never rendered (`permittedOrgs.length > 1` gate), - the form stayed pinned to the default org, - the workspace attach menu, filtered to that org, showed "No workspaces found" even though the user had workspaces in another org. The page-level `createChat` check already includes `owner_id: "me"`, which is why the same user could load the page and create chats via the API. ## Fix Pass `owner_id: "me"` in the `permittedOrganizations` seed check in `AgentCreateForm`, matching the page-level check's semantics. The `permittedOrganizations` helper spreads the check object through, so each per-org check now carries owner context and the backend substitutes the caller's user ID. The other `permittedOrganizations` callsites (`organization_member:create`, `template:create`) check org-scoped admin permissions and correctly omit `owner_id`. Adds a regression story whose `checkAuthorization` mock only allows checks carrying `owner_id: "me"` (mirroring the RBAC member-scope behavior); it fails without the fix and passes with it (red-green verified). ## Validation - Red-green verified regression story: fails without the fix (picker not found), passes with it; all 31 stories in the file pass. - `pnpm -C site check` and `pnpm -C site lint:types` clean. - Remote dogfood UAT (dev.coder.com chat [97be7f39](https://dev.coder.com/agents/97be7f39-4688-45ee-be3d-24bc4f6f8046)): PASS on all acceptance criteria at this exact commit. Reproduced the bug scenario end to end (two orgs, non-admin user with only the "Coder Agents User" role in both, workspace only in the second org): the org picker renders, the second org's workspaces appear in the attach menu, and chat creation succeeds with a real model. Single-org and admin behaviors unchanged. Authcheck probe documents the backend semantics: `chat:create` with `owner_id: "me"` returns true, without it returns false. > Mux acted on Mike's behalf for this PR. |
||
|
Cian JohnstonandCopilot Autofix powered by AI
|
3f9e8cca2a |
chore: add test coverage for chatd compaction (#28053)
## Summary Adds test coverage for the three compaction-decision functions in chatd that had zero tests: `latestPromptUsage`, `shouldCompactPromptUsage`, and `contextTokensFromUsage`. AIGOV-585 hypothesized that chatd's token counting logic was incorrect — that it compared a cumulative sum of prompt tokens across all agentic-loop steps against the context window. The tests disprove this: `latestPromptUsage` returns the last persisted assistant message's usage, not a sum. The actual bug was in the aibridge streaming interceptor, which summed usage across SSE chunks and persisted inflated values (fixed in `ad100452d4`). ## What's tested - `TestLatestPromptUsage` — pins that the compaction path reads the last step's usage (5,400), not a cumulative sum across steps (15,600). If someone wires `TotalUsage` into the compaction path as the issue suggested, this fails. - `TestShouldCompactPromptUsage` — covers the threshold decision with the inflated value from the issue (417,012 → compacts), the correct value (6,000 → doesn't compact), cache token counting, and both disable guards (threshold=100, contextLimit=0). <details> <summary>Plan / investigation notes</summary> - Traced the full flow: `chatloop.go:993` sets `result.usage = part.Usage` from the per-step `StreamPartTypeFinish` event, not the accumulated `TotalUsage` from `agent.go:544`. chatd never calls fantasy's `Agent` interface. - The `TotalUsage` accumulation in `agent.go:544` is only used for cost attribution, not context occupancy. - Commit `ad100452d4` fixed the real bug in `aibridge/intercept/chatcompletions/streaming.go` (cross-chunk usage summation for vLLM-style backends). - Tests reuse existing `dbMessage` and `withUsage` helpers from `message_conversion_test.go` (same package). </details> Generated by [Coder Agents](https://coder.com) --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> |
||
|
Steven Masley
|
f0c17291b3 |
feat: unhide --oidc-redirect-url server option (#28072)
Unhides the `--oidc-redirect-url` / `CODER_OIDC_REDIRECT_URL` server option so it appears in `coder server --help` and the deployment configuration docs. - Removed `Hidden: true` from the option in `codersdk/deployment.go` - Regenerated CLI golden files and docs via `make gen` --- > Generated with Coder Agents on behalf of @Emyrk |
||
|
Bobby Ho
|
209d1ca498 |
fix: reject PKCE code_verifier below RFC 7636 length floor (#28003)
The token endpoint accepted any non-empty `code_verifier`, so a one-character verifier was enough to authenticate. RFC 7636 §4.1 requires 43 to 128 characters from the unreserved set. That fix plus the related gaps review surfaced in the same path: - Enforce the length and charset floor on the verifier before the S256 comparison runs. - Validate the challenge at the authorize endpoint too. It was only checked for non-emptiness, so a malformed challenge was stored and then failed late at token exchange, blaming the wrong parameter. - A malformed verifier now returns `invalid_request` (RFC 6749 §5.2); a well-formed but wrong one still returns `invalid_grant` (RFC 7636 §4.6). Both looked identical before, so a client had no way to tell a syntax error from a hash mismatch and would retry the same bad verifier forever. - Revoke the authorization code when a PKCE check fails. Without that, a leaked code could be replayed with unlimited verifier guesses for its remaining lifetime, and RFC 6749 §10.5 requires codes to be single use. - Fix verifier generation in `scripts/oauth2/*.sh` and the docs example. They deleted reserved base64 characters instead of translating them to the URL-safe alphabet, so most runs produced verifiers under the new floor. Also carries #28041, which merged into this branch: public clients may register bare custom schemes such as `vscode://` again, with `mailto`, `tel`, and `sms` rejected. Split out of #27873 (public OAuth2 client support). PKCE is already mandatory for every client, so this stands on its own. <details> <summary>Manual verification</summary> Ran against a local dev server on this branch, using a session token and a throwaway app from `scripts/oauth2/setup-test-app.sh`. 1. Happy path unchanged: HTTP 200, verifier length 43. 2. `code_verifier=short`, and a 43-character verifier ending in `!`: both HTTP 400 `invalid_request`, so charset is enforced and not just length. 3. `code_challenge=tooshort` at authorize: HTTP 400 `invalid_request`, no code issued. An empty challenge still hits the older "required and cannot be empty" message. 4. Well-formed but wrong verifier: HTTP 400 `invalid_grant`, distinct from the cases above. 5. Retrying that same code with the correct verifier: HTTP 400, code already revoked by the failed check. 6. `generate-pkce.sh` produces a 43-character verifier (20 out of 20 runs); the docs example produces 128. 7. `scripts/oauth2/test-mcp-oauth2.sh` passes end to end. The two bearer-token failures in its output are a pre-existing script bug (`09c50559f3`, July 2025) that reuses a resource-scoped token against the real API, not a regression here. </details> |
||
|
Michael Suchacz
|
0acd9785fa | fix(coderd/x/agenthooks/dispatch): deflake TestDispatcherTimeoutNoRetry (#28050) | ||
|
Michael Suchacz
|
1458d27d78 |
fix: allow manual chat compaction from the error state (#28022)
A chat that fails generation with a context overflow (for example `Input
length 262625 exceeds the maximum allowed input length of 262112
tokens`) is stuck in a catch-22: `POST /chats/{id}/compact` returns 409
because the `RequestCompaction` transition is only allowed from the
waiting state, and the only other way out of the error state is sending
or editing a message, which re-runs generation with the same oversized
prompt and fails again. Compaction is exactly the recovery a
context-overflowed chat needs, and it is unreachable exactly when it is
needed.
Three semantic changes:
- Allow `RequestCompaction` from the error states: `E0 -> R0` and `E1 ->
R1` (queued messages are preserved and processed after the compaction
turn).
- Clear `last_error` in `Tx.RequestCompaction`, matching the
architecture rule that transitions leaving `E0`/`E1` clear the stored
error. Without this a successful compaction would land in waiting with a
stale persisted error.
- Grant the compaction turn a fresh history epoch: a
`grant_history_epoch` flag on `UpdateChatExecutionState` sets
`history_version = snapshot_version`, resets `generation_attempt`, and
clears `retry_state` in the same atomic update that clears `last_error`
(mirroring the `chat_messages` trigger postcondition). The transition
inserts no history, so without this the turn inherits the failed turn's
spent retry budget, and resetting the counter alone could collide with
message part episode keys still retained on the erroring replica.
No frontend change is required: the chat input is already enabled in the
error state and `/compact` submission already handles both the success
and 409 paths. Also updates ARCHITECTURE.md (transition matrix,
endpoint, and manual compaction sections), the endpoint's swagger
description, and SDK comments.
> Mux created this PR on Mike's behalf.
<!-- mux-attribution: model=claude-sonnet-4-6 thinking=high -->
|
||
|
TJ
|
b145142404 |
fix(site): add aria-label to icon-only Back navigation links (#26222)
## Summary Two icon-only "Back" navigation links in the topbars have no accessible name. The visible tooltip text is wired via Radix's `aria-describedby`, which provides a *description*, not an accessible **name**, so screen readers announce them as just "link" with no purpose. This adds an `aria-label` to each link matching the visible tooltip text, following the existing `aria-label` convention already used in these same files (e.g. `aria-label="Create File"`, `aria-label="Daily usage"`). ## WCAG 2.1 criteria addressed - **SC 4.1.2 Name, Role, Value** (Level A) - **SC 2.4.4 Link Purpose (In Context)** (Level A) ## Changes | File | Element | Added | |---|---|---| | `site/src/pages/WorkspacePage/WorkspaceTopbar.tsx` | Back-to-workspaces chevron link | `aria-label="Back to workspaces"` | | `site/src/pages/TemplateVersionEditorPage/TemplateVersionEditor.tsx` | Back-to-template chevron link | `aria-label="Back to the template"` | No visual change. No behavior change for sighted users. `aria-label` is safe here because the elements have no visible text content (only an icon), so it is not overriding a visible name. <details> <summary>Why not rely on the existing Tooltip?</summary> Radix UI's `Tooltip` wires `aria-describedby` from the trigger to the tooltip content. `aria-describedby` provides an *accessible description*, not an *accessible name*. WCAG 4.1.2 requires interactive controls to have a programmatically determinable name, and screen readers do not consistently announce descriptions, especially when no name is present. Adding `aria-label` gives the link a stable, programmatic name that exactly matches the visible tooltip text. </details> --- _Created by Coder Agents on behalf of @tracyjohnsonux._ |
||
|
Matt Vollmer
|
52bd05adb4 |
docs: remove AI Governance Add-On references (#28073)
## Summary Replaces all remaining "AI Governance Add-On" references with language consistent with AI Governance being included with a Premium license. **`docs/ai-coder/ai-gateway/standalone.md`** - Admonition: "AI Gateway requires the AI Governance Add-On... deployments without the add-on will not be able to access" → "AI Gateway requires a Premium license. Community deployments cannot access AI Gateway." - Requirements list: "A Coder license with the AI Governance Add-On" → "A Premium license with AI Governance" **`docs/install/airgap.md`** - Table row: "deployments with the AI Governance Add On" → "deployments with AI Governance" **`docs/reference/glossary.md`** - Agent Firewall, AI Gateway, AI Gateway Proxy entries: "This feature requires the AI Governance Add-On" → "This feature requires a Premium license" - Agent Workspace Build entry: "the AI Governance Add-On expands the allowance" → "a Premium license expands the allowance" - Heading: "### AI Governance Add-On" → "### AI Governance" - Definition: "A separate per-user license for Premium customers, purchased on top of a Premium subscription..." → "Included with a Premium license, AI Governance unlocks..." **`docs/ai-coder/ai-governance.md`** - Removed the "Identifying AI seat consumers" section (heading through end of file), which described an "AI add-on column" in the UI ## Note References to Agent Workspace Builds will be eliminated in a separate PR that removes Coder Tasks from the docs. --- PR generated with Coder Agents. |
||
|
blockgroot
|
7a545b35ed |
fix(aibridge): record token usage without an MCP proxier (#27886)
_Disclosure: investigated and drafted with Claude Opus 5. I reviewed the
change and ran the tests locally._
Streaming Responses interceptions recorded no token usage when the
bridge was built with a nil `mcp.ServerProxier`, because
`recordTokenUsage` was called from inside the `i.mcpProxy != nil` branch
in `aibridge/intercept/responses/streaming.go`. Requests completed
normally and returned `200`, so traffic was served but metered as zero,
with no error surfaced. Upstream reports usage on the
`response.completed` event independently of tool injection, so the
proxier is not a valid precondition for recording it.
That state is reachable in production:
`coderd/aibridged/pool.go:255-265` treats proxier construction failure
as non-fatal ("MCP server injection can gracefully degrade") and caches
the resulting bridge via `SetWithTTL`, so one transient config-retrieval
error suppressed usage recording for every streaming Responses request
served by that bridge until its TTL expired.
This records usage for every completed response, guarded only on
`completedResponse`, matching `responses/blocking.go` and both
`chatcompletions` implementations. Per-iteration semantics are preserved
for the inner agentic loop.
The integration harness substituted a non-nil noop manager whenever no
proxier was supplied (`setupbridge.go:153-155`), so the nil path was
never exercised. `withoutMCP()` covers it.
Verification, with the fix reverted:
```
--- FAIL: TestResponsesStreamingRecordsTokenUsageWithoutMCP/without_mcp_proxy
Error: "[]" should have 1 item(s), but has 0
--- PASS: TestResponsesStreamingRecordsTokenUsageWithoutMCP/with_noop_mcp_proxy
```
and with it applied:
```
--- PASS: TestResponsesStreamingRecordsTokenUsageWithoutMCP/without_mcp_proxy
--- PASS: TestResponsesStreamingRecordsTokenUsageWithoutMCP/with_noop_mcp_proxy
--- PASS: TestResponsesStreamingRecordsTokenUsagePerAgenticIteration
```
The per-iteration case asserts exactly two records for the injected-tool
fixture, so decoupling the call from the proxier does not double-count
when the agentic loop iterates. `go test -race ./aibridge/...` passes
across all 15 packages.
Fixes #27885
One caveat on verification: I was unable to run `make gen` / `make
pre-commit` locally, as I do not have the full mise toolchain installed.
The change touches no codegen inputs (no SQL, protos, mocks, or
TypeScript), so I do not expect generated-file drift, but flagging it
rather than leaving it implied.
|
||
|
Michael Suchacz
|
b3607f51b2 |
fix: keep chat token usage for streams ending with usage-less chunks (#28068)
Bumps the coder/fantasy fork pin to pick up coder/fantasy#52.
## Problem
Chats on `poolside/laguna-xs-2.1` showed no context usage: every
assistant message persisted NULL token columns, and automatic compaction
never triggered, so chats ran to context overflow. AIBridge recorded
correct usage for the same requests, so the loss was client-side in
fantasy.
When tools are declared, laguna-xs reports cumulative usage on every
delta chunk and ends the stream with a `finish_reason` chunk whose
`usage` is null, with no trailing usage-only chunk. Fantasy's
chat-completions stream loops reassigned usage from every chunk, and the
default stream usage hook returns zero usage for usage-less chunks, so
the trailing finish chunk wiped the real usage one chunk earlier. The
Finish part then reported `Usage{0,0,0}`, which chatd persists as NULL
(`nullInt64IfNonZero`).
## Fix
coder/fantasy#52 adopts the stream usage hook's result only when the
chunk actually carries usage, in both the chat-completions stream loop
and the JSON-mode object stream loop. This mirrors the aibridge fix in
#27967, which is why the gateway recorded usage correctly while fantasy
lost it. Spec-compliant backends that emit usage once on the final chunk
are unaffected.
This PR pins the fork at the merged commit and documents the fork-only
patch in the go.mod comment block.
## Validation
- coder/fantasy#52: new regression tests for both stream loops, proven
red against the unguarded code; full module tests, vet, gofmt, and
golangci-lint green; fork CI green before merge.
- Here: `go build ./...`, `go vet ./coderd/x/chatd/...`, and `go test
./coderd/x/chatd/...` (including the chatdebug field-coverage guard) all
pass with the bumped pin.
> Mux acted on Mike's behalf to create this PR.
|
||
|
Danielle Maywood
|
5a33b669b4 | feat: redesign the advisor tool row (#28069) | ||
|
Cian Johnston
|
e02d9adc11 |
chore: add NewUnstartedHTTPServer helper to disable keep-alives on test servers (#28052)
Tests that proxy or pool connections to a bare `httptest.Server` intermittently fail on Windows with a bare EOF when a stale pooled connection is reused. net/http will not retry a non-replayable request (e.g. a POST) on a closed pooled connection, so forcing a fresh connection per request eliminates the failure class. This is the same mechanism fixed in #28016 (AIGOV-430 / internal#1564), now expressed as a reusable, behavior-preserving helper. This PR adds `testutil.NewTestHTTPServer`, a known-good wrapper around `httptest.NewServer` that applies some defaults. Currently the only default is disabling keep-alives by default. - `testutil/http_server.go`: `NewHTTPServer(t, handler, opts)` started, with documented defaults, starts automatically, and handles `t.Cleanup`. - `testutil/http_server_test.go`: unit test for defaults and overriding defaults. - `enterprise/aibridgeproxyd/reload_test.go`: refactor the harness's hand-rolled server to the helper. ## Future Work - Functional options are exposed but not explicitly defined. This can be done later as required. - No lint rule or broader migration. A forcing-function analyzer covering more packages, plus wider adoption, belongs in a separate follow-up. ## Verification - `testutil` and `enterprise/aibridgeproxyd` suites pass under `-race`. - `TestProxy_HotReloadRouting` and `TestProxy_StaleTunnel` pass 10x under `-race`. - New helper unit test passes under `-race`. > Generated by a Coder agent. |
||
|
Danielle Maywood
|
c424a76a12 | feat: wire chat search box to full-text search (#27973) | ||
|
Seth Shelnutt
|
6765731ea9 |
feat(site/src/pages/AgentsPage): add download and export for personal skills (#28032)
## Summary
Adds a way to get personal skills back out of Coder Agents as files, so
sharing a skill no longer means pasting `SKILL.md` by hand.
- **Per-skill Download**: a `Download` action on each row of the
*Personal
skills* settings page saves that skill's `SKILL.md` as `<name>.md`.
- **Export all**: a header button zips every personal skill (each as
`<name>/SKILL.md`) and downloads `personal-skills.zip`.
Scope is **personal skills only** (workspace/filesystem skills are
read-only
in chat and out of scope). No backend changes: the single-skill content
endpoint (`GET /api/experimental/users/{user}/skills/{skillName}`)
already
returns full content, so the view fetches on demand and downloads with
`file-saver`, zipping with `jszip` (both existing deps, matching
`DownloadLogsDialog`).
## Changes
- `AgentSettingsPersonalSkillsPageView.tsx`: `Download` per-row button
(with
per-row spinner) and an `Export all` header button (disabled when empty
or
loading).
- `AgentSettingsPersonalSkillsPage.tsx`: container handlers that fetch
content via `queryClient.fetchQuery(userSkill(name))` and trigger the
download/zip, with `toast` error handling. Download logic is extracted
to
module-level helpers to stay React Compiler friendly.
- `AgentSettingsPersonalSkillsPageView.stories.tsx`: interaction stories
asserting `onDownload`/`onExportAll` fire, plus loading-state stories.
## Testing
- `pnpm check` (biome), `pnpm lint:types` (tsc), React Compiler check,
and
Storybook interaction tests (22 passed) all pass locally.
- `make pre-commit` passed.
Closes
[CODAGT-918](https://linear.app/codercom/issue/CODAGT-918/add-ability-to-download-and-export-skills-from-coder-agents).
<details>
<summary>Implementation plan</summary>
### Problem
Users can create, edit, and delete personal skills in Agent settings,
but
there is no way to get a skill back out as a file. The only workaround
was to
paste the `SKILL.md` content by hand.
### Decisions (confirmed with requester)
1. Surface: download in the settings UI (Personal skills page).
2. Build both single-skill download and export-all (zip).
3. Personal skills only (workspace/filesystem skills out of scope).
### Approach (frontend-only, additive)
No backend changes: the single-skill content endpoint already exists.
The
view stays presentational and exposes new callbacks; the container
fetches
content and performs the download, mirroring how Edit/Delete already
split
between view and container.
- Per-row Download button, placed before Edit in the actions cell; shows
a
spinner while its own row is downloading.
- Export all button in the section header, disabled when there are no
skills
or while loading.
- Container: single download fetches content and `saveAs(<name>.md)`;
export
all fetches every skill, adds each as `<name>/SKILL.md` to a `JSZip`,
generates a blob, and `saveAs(personal-skills.zip)`. Failures surface
via
`toast.error`.
- Stories cover the interactions and loading states (stories are the FE
test
surface).
### Out of scope
- Workspace skills download (filesystem source): different data path,
read-only in chat, not user-owned data.
- In-chat download button on the `read_skill` tool output: possible
follow-up, different surface and interaction model.
</details>
---
_Opened by Coder Agents on behalf of @Shelnutt2._
|
||
|
Michael Suchacz
|
88e113554a | fix: report per-request Anthropic usage in chat token accounting (#27966) | ||
|
Michael Suchacz
|
ac11ae52d1 |
fix(site/src/pages/AgentsPage): stop attachment downloads from trapping iOS PWAs (#27853)
On iOS, tapping an attachment download link inside the installed (standalone) PWA hands the file to QuickLook, which renders on top of the app with no reliable way back. Users had to force-quit the PWA to recover. ## Approach In iOS standalone mode, when the device supports file sharing, the download click is intercepted and the fetched attachment is handed to the native share sheet (`navigator.share` with a `File`), where the user can pick Save to Files or any other target. This is the platform-intended path for saving files from a PWA; no library covers it (FileSaver.js is broken in iOS PWAs, and browser-fs-access falls back to the same broken anchor path). Everything else keeps native behavior: - Non-iOS platforms and regular iOS Safari tabs keep the plain `<a download>` anchor. - iOS standalone devices without file sharing keep the anchor too. - Inline `data:` attachments are decoded locally because the production CSP (`connect-src 'self'`) blocks fetching them. ## Error model Deliberately small: a share-sheet dismissal (`AbortError`) is silent, an expired click gesture (`NotAllowedError`, which happens when the fetch outlasts transient activation) shows a toast whose Save action retries with a fresh gesture, and any other failure shows a plain error toast. An earlier revision carried pending-state tracking, abort-signal threading through unmount, and a blob-URL tab fallback; those guards were removed on purpose to keep the change proportionate to the defect. Also hardens chat file uploads slightly: filenames are sanitized before upload and the file-picker `accept` attribute mirrors the server's attachment allowlist. ## Testing - Storybook interaction tests cover the share happy path and native-anchor behavior; unit tests cover the intercept gate (including iPadOS detection), failure toasts, retry action, and inline-data decode. - Validated on an iPhone against a dev deployment: share sheet opens, Save to Files works, and the app remains usable afterwards. > Mux implemented this on Mike's behalf. <!-- mux-attribution: model=claude-sonnet-4-5 thinking=high --> |
||
|
Jake Howell
|
726e86cef7 |
refactor(site): add <Drawer /> and migrate build logs drawer (#28009)
> 🤖 This PR was written by Coder Agents on behalf of Jake Howell. Follow-up to #27798. That PR introduced a shared `Drawer` primitive by adding [`vaul`](https://github.com/emilkowalski/vaul) as a dependency. As raised in review, `vaul` is currently unmaintained, and this drawer is the only place in the UI using that concept. This PR takes the [suggested](https://github.com/coder/coder/pull/27798#pullrequestreview-4901095865) route: a dead-simple, self-owned drawer that covers this one case well, built directly on Radix UI's `Dialog` (already a dependency via `radix-ui`) instead of `vaul`. It keeps the same shadcn-style API (`Drawer`, `DrawerTrigger`, `DrawerContent`, `DrawerHeader`, `DrawerFooter`, `DrawerTitle`, `DrawerDescription`, `DrawerClose`) so usage stays familiar, and migrates `CreateTemplatePage`'s `BuildLogsDrawer` off MUI onto it. ### What changed - Add `site/src/components/Drawer/Drawer.tsx`: a reusable drawer/sheet built on `radix-ui` `Dialog`. Supports a `direction` prop (`top`/`bottom`/`left`/`right`, default `right`) with slide animations via `tailwindcss-animate`. No new dependencies. - Migrate `BuildLogsDrawer` from `@mui/material/Drawer` to the new component. Desktop panel stays at 800px via `min(800px, 100%)` so it stays within the viewport on mobile. - Storybook coverage with `play()` functions for both the generic `Drawer` (open/close, direction) and `BuildLogsDrawer` (close via the X button and via Escape assert `onClose`), addressing the earlier P1 review note about covering the controlled close path. ### Why Radix instead of vaul - `radix-ui` `Dialog` is already a dependency and provides accessibility, focus management, and open/close state. - No dependency on an unmaintained package for a single-use concept. - `vaul`'s drag-to-dismiss gesture is not needed for this build-logs use case. |
||
|
Michael Suchacz
|
bde38e9d10 |
fix(coderd/x/chatd): synchronize aibridgeTestFactory recorded fields (#28031)
Fixes the data race in the chatd test helper `aibridgeTestFactory` reported in CODAGT-917 (`test-go-race-pg` flake in `TestAwaitSubagentCompletion/Timeout`). `TransportFor` recorded `providerName` and `source` with plain field writes. Tests that start the chat worker share one factory between concurrently running chat runners (parent chat and spawned subagent), so two runners resolving models at the same time raced on those writes. The fix guards the recorded fields with a mutex and reads them through a locked `recorded()` accessor at the three asserting call sites. Verified with a red-green repro: concurrent `TransportFor` calls on one factory failed `go test -race` with the exact CI signature (lines 37-38) before the fix and pass after it. Also ran `go test -race ./coderd/x/chatd -run TestAwaitSubagentCompletion -count=10` and the full `go test -race ./coderd/x/chatd` package, both clean. Audited every other `aibridge.TransportFactory` implementation and `aibridgeTestFactory` use site for the same defect: `chattest.MockAIBridgeTransport` is already mutex-guarded, `stubTransportFactory` (coderd/aibridge_test.go) records via a channel, `providerRoutedTransportFactory` (chatd_test.go) is a stateless lookup, and the production factories keep no recorded state. No other occurrence exists. Closes CODAGT-917. > Mux acted on Mike's behalf to create this PR. |
||
|
TJ
|
5fab238ed1 |
fix(site/src/pages/AgentsPage): improve git panel color contrast (#28038)
## Summary Follow-up to #27012 addressing color contrast in the git panel: - The orange (`text-content-warning`) **Working** label failed color contrast. The label in the view switcher trigger and dropdown now uses `text-content-secondary`. The `CircleDotIcon` keeps its original `text-content-warning` color as a state indicator. - The **Commit** and **View PR** buttons now use `text-content-primary` for their text and icons instead of `text-content-secondary`. The now-redundant `hover:text-content-primary` was dropped. No behavior changes; class-only updates in `GitPanel.tsx` and `RemoteDiffPanel.tsx`. ## Testing - `biome check` and `tsc --noEmit` pass on the touched files. - Verified visually via Storybook screenshots of the GitPanel stories. --- > Generated by Coder Agents on behalf of @tracyjohnsonux. |
||
|
TJ
|
f7f840ac69 |
feat(site/src/pages/AgentsPage): consolidate git panel tab strip into a view switcher dropdown (#27012)
## What Replaces the git panel's tab strip (`[PR #4847] [Working coder] [Working other]`) with a single dropdown "view switcher" that lists the PR (when present) and each dirty working repo as items. Also: - Moves the PR title to a dedicated row below the switcher, truncated with a hover tooltip for the full title. The row only appears while the PR view is active. - Removes the redundant PR-state badge from the RemoteDiffPanel sub-header (state is now shown as the colored pill on the switcher trigger). ## Why The common multi-view states are `PR only`, `Working only`, or `PR + one Working repo`. The tab strip was fine for one view but crowded the toolbar the moment two showed up. Collapsing to a single trigger + optional dropdown keeps the toolbar quiet in the 80% case and the switcher stays intuitive when there is more than one thing to look at. ## Screens Storybook coverage: - `PullRequestAndWorkingChanges` — collapsed switcher shows the PR state + `PR #<n>`, PR title below. - `ViewSwitcherOpen` (new) — dropdown open with PR and both working repos, then clicks a working entry to verify the view swaps. - `DraftPullRequest`, `MergedPullRequest`, `ClosedPullRequest` — trigger's colored pill reflects state (play assertions added). - `WorkingChangesOnly`, `BranchOnly`, `MultipleRepos`, `EmptyState`, `GitNotActive`, `GitStatusLoading` — all pass. - `EverDirtyRepoGoneClean`, `CleanRepoFromStart` — regression coverage updated to target the new switcher rather than the old `Working` tab buttons. <details> <summary>Decisions and scoping notes</summary> ### Why a switcher and not a PR-only dropdown Original design showed multiple PRs in the dropdown, but the server model only tracks **one PR per chat** (`ChatDiffStatus.pr_number` is a single field). Multi-PR would need a DB / watcher / SDK change out of scope for a UI polish PR. After reviewing frequency of the actual multi-view states (`PR only` and `Working only` dominate; `PR + Working` shows up during review iteration; 3+ views is rare), we scaled back to make the dropdown a **view switcher** that spans the existing tab strip's data: PR + working repos. Ships today, no backend work. ### Behavior notes - With a single item the trigger renders as a static pill (no chevron, no dropdown behavior); it becomes an interactive dropdown once there is more than one item. - The colored state pill on the trigger uses `text-git-*-bright` / `text-content-warning` / `text-content-secondary` (text color only; no background token). - Dropdown items render as `[icon] primary secondary` where primary/secondary is `PR #<n> / title` for the remote entry and `Working / repo` for local entries. - Local (Working) entries are visually nested under the remote/PR entry when one is present; otherwise they render flush-left. - When the head branch is known but no PR is opened, the trigger reads `Branch | <head-branch>`. </details> --- _Coder Agent generated on behalf of @tracyjohnsonux._ |
||
|
Jeremy Ruppel
|
e9ee83af69 | fix(site/src): gate TemplateExampleCard Use template link on builder state (#28035) |