opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-21 20:51:01 +08:00
Code Issues Packages Projects Releases Wiki Activity
15,594 Commits 479 Branches 387 Tags
fc24c27dfd660fa05c601b7fb571ac6b480ea0e2
Commit Graph
15594 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Michael Suchacz fc24c27dfd fix: reserve chat hook dispatch capacity for running turns (#27656) 
## Context

Follow-up fix from live UAT of the merged chat lifecycle hooks stack
(#27430). Its companion UAT fix (#27655) has merged, so this targets
`main` directly.

## Why?

UAT measured a burst of 1,500 concurrent chat creations against a
consumer with 1.2s latency. 255 were admitted and 1,245 got `502
hook_dispatch_failed (over_capacity)`, which is correct fail-closed
behavior. The collateral wasn't: the same burst failed 24 `stop`
dispatches, parking chats that had already been admitted and had already
executed tools. One 256-slot semaphore served every event, so new-work
admission could take every slot and kill turns in flight.

Callers now classify each dispatch as admission or generation, and
admission draws from a 192-slot gate held *before* the shared pool. At
least 64 shared slots stay reachable only by dispatches for work a chat
already admitted. The dispatcher is per `coderd` replica, so these
limits are per replica, not deployment-wide, and the docs say so.

**The caller classifies, not the event type.** Event type isn't a
reliable proxy in either direction: a subagent spawn dispatches
`user_prompt_submit` from inside a running turn, and the edit path
dispatches `session_start` at admission time. `CapacityClassUnset` is
rejected in `Dispatch`, so a new call site fails closed rather than
silently inheriting a share.

**Acquisition order is load-bearing.** Admission takes its own gate
first. Taking a shared slot first would let admissions queued on the
gate occupy the very capacity the reserve protects. `acquireCapacity` is
the only path that takes either pool, so the order can't be bypassed.

## What this does not guarantee

Nothing bounds how many turns generate concurrently, so the 192/64 split
is a judgement call, not a derived ceiling. This stops an *admission*
burst from consuming every slot; it does not make the remainder
sufficient. A large enough generation load can still exhaust the reserve
and error a running chat. The docs say so explicitly rather than
promising a guarantee the code doesn't deliver.

Generation can now take all 256 slots, so generation traffic starves
admission harder than before. That's the intended priority: rejecting a
new prompt is recoverable, ending a turn that already ran tools is not.

## Testing

Red-green proved both new tests. Removing the release-on-failure path
fails `RefusedSharedAcquireReleasesAdmission` deterministically;
removing the expired-deadline check fails
`ExpiredDeadlineRefusesFreeSlot` in 18/30 runs.

That deadline check fixes a real race found in review. `acquire`
previously shared one `time.Timer` across both acquires. Because
`select` picks a ready case at random, an admission dispatch could take
a slot after its capacity deadline had passed. Measured over 300 trials:
135 late acquisitions, worst overshoot 2.1ms. `acquire` now takes an
absolute deadline and refuses an expired one before selecting, which
measures 0/300.

Go: `coderd/x/agenthooks/...` and `coderd/x/chatd/...`, plus `-race
-count=3` on the dispatcher.

> Mux opened this PR on Mike's behalf.
 2026-08-03 19:04:54 +02:00
Fabien Penso 7bd9f5ec93 fix: correct authorization header spelling in api docs (#27721) 
Corrects the misspelled `Authorizaiton` Swagger header name to
`Authorization` in the source annotation and checked-in generated API
documentation.

This prevents generated API specs and SCIM examples from documenting the
wrong HTTP header name.
 2026-08-03 16:31:26 +00:00
Michael Suchacz df1c0f9710 feat: show what a chat lifecycle hook changed (#27655) 
## Stack Context

Follow-up fixes from live UAT of the merged chat lifecycle hooks stack
(#27430). Two PRs:

1. **This PR**: make hook effects visible and correctly attributed in
the transcript.
2. [`mike/chat-hooks-uat/dispatch-capacity`]: reserve dispatch capacity
so an admission burst can't fail running turns.

## Why?

UAT found three ways the transcript misrepresented what a lifecycle hook
did. All three are user-visible and share the same surface
(`chathooks/effects.go`, `codersdk.ChatMessagePart`, the conversation
timeline), so they're reviewed together.

**A prompt `input_override` silently discarded attachments.**
`ComposeUserPromptContent` replaced the entire submitted part list with
one text part, dropping `file` and `file-reference` parts along with
their `chat_file_links`. The user saw their attachments vanish with no
explanation. The override now replaces submitted *text* parts only and
preserves non-text parts in order. A consumer that wants to block
attachments uses `deny`, which is the documented mechanism for refusing
a submission.

**Every user-visible `system` row was labelled "Lifecycle hook".** The
timeline keyed the notice off `role === "system"`. That was correct only
by accident, because the hook `user_message` was the sole client-visible
system row. The backend now emits the notice as a typed `hook-notice`
part and the timeline renders on that, so a future system row can't be
mislabelled as a policy notice.

**Nothing marked a tool call the hook had rewritten.** A consumer could
replace tool input via `input_override` and the transcript showed the
rewritten input as if the model had produced it. `ChatMessagePart` gains
`hook_rewritten`, set from `preflight.Overrides` on the same path that
already carries `ToolCallCreatedAt`, and the tool row renders a
"Modified by policy" badge.

`ToolCall.PolicyProvider` renders the badge itself, at four wrap sites:
the `Tool` dispatch wrapper, the `ReadFilesTool` aggregate and its
per-file rows, and `ReadFileTimelineBlock` (grouped and single
`read_file` rows bypass `Tool`). Renderer props do not include the flag;
descendants consume it through the provider context.

The badge is emitted by the provider rather than by the shared header
because several renderer branches return early without one, including
the auth-required `execute` card, a completed `ask_user_question`, and
an empty question payload. Those branches would drop the attribution
with no type or runtime error, and the gap is not greppable: every
renderer file contains a header somewhere, only individual branches do
not. Emitting at the provider removes the possibility instead of
enumerating the cases.

A rewritten call is wrapped in a group labelled by its badge, so one
rewritten file inside a merged read is attributed on its own rather than
inheriting the group's badge. `HeaderButton` still appends the policy
wording to an explicit `ariaLabel`, since an explicit `aria-label`
replaces the name computed from descendants.

Provider-executed calls are excluded from attribution. Hooks never see
them, and duplicate tool-call ID rejection deliberately skips them, so a
reused ID would otherwise mark a provider-executed call as
policy-rewritten.

## Testing

Go: `coderd/x/chatd/...`, `coderd/x/agenthooks/...`, `codersdk/...`, and
`coderd -run 'Hook|Chat'`. Frontend: `tsc` plus every `AgentsPage`
story; the only failures are `MCP Tool Completed` and `Scroll To Bottom
Button Works With Inverse Scroll`, both of which fail on trunk.

A registry-wide story asserts every registered renderer shows the badge,
verified against three inverted toggles: removing the badge, hiding it
with `display:none`, and skipping the provider for one renderer (which
names that renderer). Storybook also covers the rewritten subagent
spawn, a completed empty question payload, a non-hook system message,
and a failed `read_file` guarding the accessible name.

> Mux opened this PR on Mike's behalf.
 2026-08-03 18:27:39 +02:00
Bobby HoandTracy Johnson 4245e4e378 feat: expose dynamic client registration in deployment settings (#27480) 
Adds the admin-controlled OAuth2 Dynamic Client Registration setting
landed by #27316 (`GET`/`PUT /api/v2/oauth2-provider/settings`) to the
OAuth2 Applications deployment settings page, since it was previously
only reachable via the API or `coder oauth2-provider dcr
enable|disable`.

The page is now tabbed, **Applications** and **Settings**, so DCR has a
home that further OAuth2 settings can share (an Initial Access Token
setting is a likely next one). The active tab is backed by a `tab`
search param, so `?tab=settings` links straight to it, and an
unpermitted deep link falls back to **Applications** rather than
selecting nothing. On the Settings tab, DCR renders as a titled section
with a description, an `Enabled` badge when active, and an
Enable/Disable button.

Enabling opens a confirmation dialog, since it lets any OAuth2 client
self-register against the deployment without prior admin approval (RFC
7591). Disabling is immediate, no confirmation.

The control is a button rather than a switch on design feedback: a
switch reads as an immediate on/off flip, which conflicts with a
confirmation dialog standing in front of it, and it left the only
explanation of the risk inside a dialog that disappears. A button
carries the confirmation step without misrepresenting what a click
costs, the always-visible description explains the setting on the page,
and the `Enabled` badge gives the active state a persistent indicator.
The layout follows Tracy's mockup on `tj/oauth2-apps-pagination`; the
apps-table pagination work that shares that branch is deliberately not
included here.

Visibility and editability are gated on the same
`ResourceDeploymentConfig` RBAC checks the endpoint itself enforces
(`viewDeploymentConfig` / `editDeploymentConfig`), not a separate
hardcoded check. The view takes the settings values as one optional
`settings` prop, absent when the viewer lacks `viewDeploymentConfig`, so
"cannot view" is the shape of the prop rather than a flag the caller
keeps consistent with the values beside it, and the tab is not rendered
at all.

Closes https://github.com/coder/coder/issues/27432

## Where this sits in the request path

```mermaid
sequenceDiagram
    autonumber
    actor Admin
    participant View as OAuth2AppsSettingsPageView<br/>(Tabs + Enable/Disable + Dialog)
    participant Page as OAuth2AppsSettingsPage<br/>(React Query)
    participant S as coderd

    Note over Page: On mount
    Page->>S: GET /api/v2/oauth2-provider/settings
    S-->>Page: { dynamic_client_registration_enabled }
    Page-->>View: settings: { dynamicClientRegistrationEnabled, canEdit, ... }

    Note over Admin,View: Admin opens the Settings tab and enables DCR
    Admin->>View: click "Enable"
    View->>View: open confirmation dialog<br/>(no request sent yet)
    Admin->>View: click Confirm
    View->>Page: settings.onDynamicClientRegistrationChange(true)
    Page->>S: PUT /api/v2/oauth2-provider/settings<br/>{dynamic_client_registration_enabled: true}
    S-->>Page: 200 OK (audited)
    Page->>S: GET /api/v2/oauth2-provider/settings (refetch)
    S-->>Page: { dynamic_client_registration_enabled: true }
    Page-->>View: section shows the "Enabled" badge and a Disable button

    Note over Admin,View: Admin disables DCR
    Admin->>View: click "Disable"
    View->>Page: onDynamicClientRegistrationChange(false)<br/>(no dialog, disable is immediate)
    Page->>S: PUT ... {dynamic_client_registration_enabled: false}
    S-->>Page: 200 OK (audited)
```

## Files changed

All 10 files are hand-written; nothing in this PR is `make gen` output.

| File | What changed |
|---|---|
| `site/src/api/api.ts` | New
`getOAuth2ProviderSettings`/`putOAuth2ProviderSettings` methods, thin
typed wrappers around the two endpoints #27316 added to `main`. |
| `site/src/api/api.test.ts` | Covers both methods against the request
they issue and the error they propagate. |
| `site/src/api/queries/oauth2.ts` | A `getSettings` query and a
`putSettings` mutation that invalidates the settings key on success.
Both the app and settings keys now derive from a shared
`oauth2ProviderKey` constant. |
| `site/src/api/queries/oauth2.test.ts` | 4 tests: the key nesting, both
delegations, and that a successful update invalidates the settings key
without touching app queries. |
| `.../OAuth2AppsSettingsPage.tsx` | Wires query and mutation into the
page and passes the settings values down as one object, or omits it
entirely without `viewDeploymentConfig`. The apps error stays its own
prop, since the view gates the applications empty state on it. |
| `.../OAuth2AppsSettingsPageView.tsx` | `Tabs` splitting Applications
from Settings. The settings tab distinguishes loading, failed, and a
value the server omitted rather than rendering nothing, and the header's
"Add application" action is scoped to the applications tab. |
| `.../OAuth2AppsSettingsPageView.stories.tsx` | 14 stories, covering
the tab wiring, both permission boundaries, the header action's scope,
and the settings tab's loading, fetch-error, update-error, and
value-omitted states. |
| `.../DynamicClientRegistrationSetting.tsx` | The section itself:
heading, description including what disabling does not undo, `Enabled`
badge, a permission explanation when the viewer cannot edit, and one
button that confirms only in the enable direction. |
| `.../DynamicClientRegistrationSetting.stories.tsx` | 11 stories,
including focus surviving an in-flight request and the dialog ignoring a
value that changes underneath it. |
| `docs/admin/integrations/oauth2-provider.md` | Adds the web UI route
to the DCR section, which previously enumerated only the CLI and the
management API. |

## Suggested review order

Follows the direction data actually flows, from the raw HTTP call up to
the rendered section.

1. **`site/src/api/api.ts`**: the two new methods. Confirms they match
the `codersdk.OAuth2ProviderSettings` shape #27316 landed and sit next
to the existing OAuth2 app methods they mirror.
2. **`site/src/api/queries/oauth2.ts`**: the query/mutation pair. The
mutation's `onSuccess` → `invalidateQueries` is the one detail worth
double-checking: it's what makes the on-screen state catch up with what
was just saved, rather than trusting the PUT payload.
3. **`OAuth2AppsSettingsPage.tsx`**: the container. Check the two
separate permission gates (`viewDeploymentConfig` on the query's
`enabled` option, `editDeploymentConfig` on the button's editability)
match the RBAC the backend enforces.
4. **`OAuth2AppsSettingsPageView.tsx`**: the tabs and the settings tab's
four states. The `settings` prop being optional is what hides the tab;
the error inside the tab is deliberately separate from the page-level
`error`, which gates the applications empty state.
5. **`DynamicClientRegistrationSetting.tsx`**: the section. Two things
worth reading closely: the enable path opens the dialog while the
disable path calls straight through, and lacking permission uses the
native `disabled` attribute while an in-flight request uses
`aria-disabled`, so a keyboard user is not blurred mid-flip.
6. **The two story files**: read last, as they exercise everything above
without a real server. The dialog stories query
`canvasElement.ownerDocument.body` rather than `canvasElement`, since
the dialog renders into a portal attached to `<body>`.

## Deliberately not in this PR

- **ENG-3116**: the applications list cannot distinguish self-registered
clients from admin-created ones. Surfacing that needs a new field on
`codersdk.OAuth2ProviderApp`, which is an API addition this PR does not
need.
- **ENG-3118**: reusing the shared `EnabledBadge` and `SettingsHeader`
primitives for this section. Both hinge on what the mockup intends, and
the badge in particular is a visible change either here or on the four
other pages that share it.

## Screenshots

Default (disabled):
<img width="1676" height="497" alt="image"
src="https://github.com/user-attachments/assets/cfa60266-8678-410e-9577-16ef474491e3"
/>



Enabling (confirmation dialog):

<img width="1661" height="558" alt="image"
src="https://github.com/user-attachments/assets/a7d54fdd-f65d-4fec-9ed9-3bfdcfdae5be"
/>



Enabled:

<img width="1666" height="559" alt="image"
src="https://github.com/user-attachments/assets/d39251c2-771c-4608-81c2-dda151b35c3d"
/>

---------

Co-authored-by: Tracy Johnson <tracy@coder.com>
 2026-08-03 08:29:35 -07:00
Jake Howell 497ab9e1a6 refactor(site): demui PortForwardButton and popover view (#27786) 
Migrate the port-forward popover off MUI and Emotion onto shadcn
Select/FormField and Tailwind.

Replaces FormControl, Select, MenuItem, TextField, Stack, and Link usage
in `PortForwardButton` / `PortForwardPopoverView`, and updates the
popover stories to match.
 2026-08-04 01:13:52 +10:00
Jake Howell 0a30dc8184 refactor(site): demui template editor dialogs and create-template inputs (#27791) 
Migrate remaining MUI usage in template create/editor flows to shared
shadcn components (`FormField`, `Input`, `Textarea`, `Checkbox`,
`RadioGroup`, `Link`).

Also drops `disablePortal` on the publish-version help popover so it is
no longer clipped by the dialog overflow.
 2026-08-04 01:13:34 +10:00
Jake Howell 20ff957c74 refactor(site): demui workspace topbar, schedule controls, and timings (#27790) 2026-08-03 15:04:23 +00:00
Ethan 4dbb3a236c test: fix tailnet connection teardown flake (#27768) 
Closes https://github.com/coder/internal/issues/1620
Closes ENG-3043

The callback cleanup added in #20687 stops new node callbacks, but it
can still race with one that's already in flight. That callback may call
`UpdatePeers` after the destination `tailnet.Conn` closes, so the test
fails with `connection closed` even though the redirect behaviour is
correct.

To fix, we'll just ignore `tailnet.ErrConnClosed` in the asynchronous
`stitch` helpers, whilst continuing to assert on every other error.
 2026-08-04 01:03:30 +10:00
Marcin TojekandNick Vigilante 07073024ee docs: update 2.35 latest release to v2.35.3 (#27511) 
Updates the release calendar in `docs/install/releases/index.md` so the
2.35 mainline row points at the latest patch release `v2.35.3` instead
of `v2.35.2`.

> [!NOTE]
> This PR was generated by Coder Agents on behalf of @mtojek.

---------

Co-authored-by: Nick Vigilante <nickvigilante@users.noreply.github.com>
 2026-08-03 14:32:12 +00:00
Jake Howell fc27714fcd refactor(site): demui workspace build data and outdated tooltip (#27787) 
Replace Emotion `css` / `useTheme` and MUI `Link` in
`WorkspaceBuildData` and `WorkspaceOutdatedTooltip` with Tailwind
semantic classes and the shared `Link` component.
 2026-08-04 00:31:14 +10:00
Nick Vigilante 0e1a9a9f05 ci: run test-go-pg mise tool install under bash on Windows (#27483) 
## What

Add `shell: bash` to the `Install Go mise tools` step in the
`test-go-pg` job so it runs under Git bash on the `windows-2022` matrix
leg.

## Why

`test-go-pg (windows-2022)` has been failing in the **Normalize File and
Directory Timestamps** step with:

```
mtimehash: command not found
##[error]Process completed with exit code 127.
```

before any tests run, which trips the aggregate `required` gate.

Root cause: the `Install Go mise tools` step had no `shell:`, so on
Windows it ran under **PowerShell**, while `./.github/scripts/retry.sh`
is a bash script (`#!/usr/bin/env bash`). The step silently no-oped on
Windows (zero output), so `mtimehash` was only present when the mise
tool cache was warm. On a cache miss it was never installed, and the
normalize step failed with exit 127. `main` stays green only because the
cache is usually warm — both green and failing runs use the same
`depot-windows-2022-16` runner, so this is **not** a fork/runner-routing
issue.

Pre-existing CI-tooling issue, unrelated to the change that surfaced it
(a Helm-only community PR, #27360).

## Fix

One line: pin the step to `shell: bash` so the install actually runs on
Windows and repairs a cache miss instead of being silently skipped.

## Verification

<details>
<summary>Local proof that the step's install target builds and
<code>mtimehash</code> runs under bash</summary>

```
$ bash ./.github/scripts/retry.sh --max-attempts 1 -- echo "retry.sh OK under bash"
retry.sh OK under bash

$ GOBIN=/tmp/demobin go install github.com/slsyy/mtimehash/cmd/mtimehash@v1.0.0
$ ls -l /tmp/demobin/mtimehash
-rwxr-xr-x 1 coder coder 6692858 /tmp/demobin/mtimehash

# the tool that was "command not found" now runs and rewrites the mtime:
$ printf 'hello' > /tmp/mt.txt                 # mtime 2026-07-24 15:32
$ find /tmp/mt.txt | /tmp/demobin/mtimehash    # exit 0
$ # mtime now 1997-11-30 (content-hash derived)
```
</details>

Final confirmation is this PR's own `test-go-pg (windows-2022)` run.
Note: if the mise cache is warm on this run the job passes regardless;
the fix specifically hardens the cache-miss path this step exercises on
Windows.

## Follow-up (not in this PR)

- Make the normalize step resilient (skip when `mtimehash` is absent /
invoke via `mise exec`) so a missing cache optimizer can't hard-fail the
job.
- Audit other Windows `run:` steps that invoke `retry.sh`/bash scripts
without `shell: bash`.

Linear: DOCS-605

> This PR was created with AI assistance (Coder Agents).
 2026-08-03 10:25:22 -04:00
Susana Ferreira ec9b0f04d1 feat(site): label AI spend as estimated (#27584) 
AI spend is estimated by multiplying token usage by a snapshot of
published model prices that ships with each Coder release, so it can
differ from provider invoices.

Label spend figures as estimated and link to the [How spend is
estimated](https://coder.com/docs/@main/ai-coder/ai-gateway/cost-controls#how-spend-is-estimated)
docs section. "Estimated spend" matches the terminology already defined
in the cost controls doc.

## Changes

- Group members tooltip: "Monthly AI spend for this user." becomes
"Estimated monthly AI spend for this user.", followed by an inline docs
link.
- Groups table tooltip: "Current AI spend compared to the group's AI
budget..." becomes "Estimated AI spend compared to...", with the same
link.
- User dropdown: "(AI spend/month)" becomes "(Estimated AI
spend/month)".
- `StatusIconTooltip` now exports `SpendEstimateDocsLink`, shared by
both tooltips.

> [!NOTE]
> Initially generated by Claude Opus 5, modified and reviewed by
@ssncferreira
 2026-08-03 14:56:36 +01:00
Susana Ferreira f4110122ec fix(site): link spend page alert to cost control migration section (#27782) 
The "Read more here" link in the spend page alert pointed at the top of
the cost controls doc, which doesn't explain the v2.36 move to AI
Governance.
Point it at the `#migrate-from-coder-agents-cost-control` section
instead:
https://coder.com/docs/@main/ai-coder/ai-gateway/cost-controls#migrate-from-coder-agents-cost-control

Related to internal slack thread:
https://codercom.slack.com/archives/C0AEHQGLW22/p1785747924721539
 2026-08-03 11:48:22 +01:00
Sas SwartandClaude Opus 4.8 8886a5749a feat: add network calls list to AI session threads API (#27425) 
The AI session threads API returned only a network call *summary*
(total/blocked counts + top domains). This adds the per-call list so the
session detail can render individual Agent Firewall network calls.

`ListAIBridgeSessionNetworkCalls` reuses the same sequence-number
windowing as the existing summary and includes all protocols. The list
is exposed as `network_call_logs` on the threads response and is capped
server-side at 100 rows. The summary (`network_calls.total`/`blocked`)
remains authoritative for whole-session totals: the list length and its
blocked count equal the summary only when a session has at most 100
calls, and are truncated beyond that.

### PR map (merge strictly bottom-up)

This change is a 4-PR stack. Each PR depends on all the ones below it,
so merge in this exact order:

1. #27417 — backend network summary
2. #27418 — frontend summary rows
3. #27425 — backend per-call list `network_call_logs`
4. #27426 — frontend network-calls panel

Refs AIGOV-464

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-08-03 11:34:27 +02:00
Jake Howell fba9f0d485 refactor(site): migrate <Markdown /> and <InlineMarkdown /> off MUI (#27724) 
Replace Emotion `css` / MUI theme tokens in `Markdown` with Tailwind
semantic classes, and swap `InlineMarkdown`'s MUI `Link` for the shared
`Link` component.

Code block colors now use theme tokens (`surface-secondary`,
`syntax-key`, `content-destructive`) instead of hardcoded zinc/teal and
`theme.palette`. Also adds a `WithLink` story for the full Markdown
component.
 2026-08-03 19:26:58 +10:00
Jake Howell 31ac9a4782 fix(site): use "Create token" wording in token settings (#27634) 
> 🤖 This PR was written by Coder Agents on behalf of Jake Howell.

The token settings page button read **"Add token"**, while everything
else uses **"Create"**:

- The page the button navigates to is titled "Create Token" with a
"Create token" submit button (`CreateTokenPage` / `CreateTokenForm`).
- CLI: `coder tokens create`
- SDK: `CreateToken`
- API: `create-token-api-key` / `CreateTokenRequest`

This aligns the button with the dominant nomenclature by changing "Add
token" → "Create token".
 2026-08-03 19:23:50 +10:00
Jake Howell c350710aeb refactor(site): remove mui components from <LicenseSettingsPage /> descendants (#27764) 
Migrate license settings views off MUI by replacing `TextField` with
`Textarea` on the add-license form and `MuiLink` with our `Link`
component in the empty licenses state.
 2026-08-03 19:19:07 +10:00
Jake Howell a76c51dfc4 fix(site): correct autostop restart prompt on the workspace schedule page (#27632) 
> 🤖 This PR was written by Coder Agents on behalf of Jake Howell.

## Problem

Enabling autostop on a running workspace never showed the "restart now
to apply?" dialog. The new TTL was saved, but a running build's deadline
is only calculated when the build starts, so autostop silently did not
take effect until a manual restart. Changing an already-enabled value
did prompt, so the behavior was inconsistent.

Separately, dismissing that dialog with **Apply later** navigated the
user away to the workspace, exactly like confirming did.

## Root cause

The dialog was gated on `getAutostop(workspace).autostopEnabled`, which
derives from `workspace.ttl_ms` — the **pre-submit** state (the
workspace is not refetched until after the mutation). That expression
means "was autostop enabled *before* this change", which maps to:

| Transition | Pre-submit enabled | Dialog | Correct? |
|---|---|---|---|
| Disabled → enabled (add) | `false` | not shown | ❌ the reported bug |
| Enabled → new value (modify) | `true` | shown | ✅ |
| Enabled → disabled (remove) | `true` | shown | ❌ (nothing to apply) |

This guard came from #16085, which intended to *skip* the prompt when
**removing** autostop (safe, because that PR also made the backend clear
a running build's deadline server-side when TTL is set to null). By
keying off the old state it actually skipped the prompt on **add** and
still showed it on **remove** — the opposite of its intent.

## Fix

- Key the prompt off the submitted form value
(`values.autostopEnabled`), with an inline comment documenting the
trigger conditions. This fixes the reported bug and restores #16085's
intent:
  - add → prompt ✅
  - modify → prompt ✅
  - remove → no prompt ✅ (deadline cleared server-side)
  - stopped / unchanged → no prompt ✅
- **Apply later** now just closes the dialog and keeps the user on the
schedule page; the saved value still applies on the next start.
**Restart** is unchanged (restarts and navigates to the workspace).

## Testing

Storybook `play`-function coverage on `WorkspaceSchedulePage` for all
cases: enable, change value, disable, enable-while-stopped,
autostart-only, and Apply-later-stays-on-page (the last also asserts
`restartWorkspace` is not called). A prior story that asserted the
pre-fix behavior (prompting on disable) was reworked. `tsc` and `biome`
clean.

<details>
<summary>Investigation notes</summary>

History of the gating condition:

- Originally `if (data.autostopChanged) { ... }` — prompted on every
autostop change (enable included).
- #16085 ("allow removing deadline for running workspace", fixes #9775)
added `&& getAutostop(workspace).autostopEnabled`. Its description
states the goal was to "not show a confirmation dialog when the change
is to remove autostop", and the same PR added backend logic in
`putWorkspaceTTL` to clear a running build's deadline when TTL is null.
- A later refactor added `&& workspace.latest_build.status ===
"running"`.

Because the backend already clears the deadline live on removal, no
restart is needed there; the frontend only needs to prompt when autostop
ends up enabled on a running workspace. The fix keys off the submitted
state so all three transitions behave correctly.

</details>
 2026-08-03 19:11:11 +10:00
Jake Howell 0028fea0e5 refactor(site): migrate VS Code button menus off MUI (#27730) 
Replace MUI `Menu`/`MenuItem` (and the Emotion `css` prop) in
`VSCodeDesktopButton` and `VSCodeDevContainerButton` with the shared
shadcn `DropdownMenu`.

The variant selector keeps the split-button layout, sizes the menu to
the button group via an `inline-flex` anchor (so width is not the full
parent), and uses `collisionPadding` so the menu stays inset from the
viewport edge.
 2026-08-03 19:09:59 +10:00
Jake Howell 5e29a878f2 refactor(site): demui <ProvisionerTagsField /> (#27763) 
Replace MUI `TextField` in `ProvisionerTagsField` with the shared
`Input` component.
 2026-08-03 19:09:13 +10:00
Jake Howell ce20ad8b2f refactor(site): demui <NotificationEvents /> into dropdown (#27732) 
> [!NOTE]
> We don't have a planned migration path for the MUI `<ToggleGroup />`.
Therefore, I've swapped these to dropdowns as an inbetween.

Migrate deployment notification event settings off MUI
`Card`/`List`/`ToggleButtonGroup` and Emotion styles.

Template groups now use the same Tailwind card layout as user
notification settings, and the delivery method control is a shared
`Select` dropdown with icon + label.

| Old | New |
| --- | --- |
| <img width="1041" height="189" alt="NOTIFICATION_EVENTS_OLD"
src="https://github.com/user-attachments/assets/2fe37dab-1ba2-43c2-9d01-3edf9883054a"
/> | <img width="1041" height="203" alt="NOTIFICATION_EVENTS_NEW"
src="https://github.com/user-attachments/assets/40afc42f-93f6-4972-8e02-dceaf95fb034"
/> |
 2026-08-03 19:09:01 +10:00
Jake Howell 26bae42c98 refactor(site): rename <404Page /> to <NotFoundPage /> (#27731) 
The component was already named `NotFoundPage`, but it lived under
`pages/404Page/404Page.tsx`. Rename the directory and file to match the
component name, and update the lazy import and organization settings
import paths.
 2026-08-03 19:08:44 +10:00
Jake Howell 0a42334f77 refactor(site): demui Form.stories.tsx stories (#27762) 
Replace MUI `TextField` in the Form Storybook stories with `FormField`,
wired through Formik and `getFormHelpers` so the examples match how real
forms use the layout components.
 2026-08-03 19:08:30 +10:00
dependabot[bot] b05a499a36 chore: bump autoprefixer from 10.5.0 to 10.5.4 in /site (#27755) 
Bumps [autoprefixer](https://github.com/postcss/autoprefixer) from
10.5.0 to 10.5.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/autoprefixer/releases">autoprefixer's
releases</a>.</em></p>
<blockquote>
<h2>10.5.4</h2>
<ul>
<li>Fixed prefixed rule duplication (by <a
href="https://github.com/xianjianlf2"><code>@​xianjianlf2</code></a>).</li>
</ul>
<h2>10.5.3</h2>
<ul>
<li>Fixed brackets and gradient parser (<a
href="https://github.com/alanturing881"><code>@​alanturing881</code></a>).</li>
</ul>
<h2>10.5.2</h2>
<ul>
<li>Moved <code>-webkit-fill-available</code> before
<code>-moz-available</code>, so Firefox
will use <code>-webkit-</code> version which is closer to
<code>stretch</code>.</li>
</ul>
<h2>10.5.1</h2>
<ul>
<li>Fixed <code>grid-area</code> span reset for overriding areas (by <a
href="https://github.com/puneetdixit200"><code>@​puneetdixit200</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/autoprefixer/blob/main/CHANGELOG.md">autoprefixer's
changelog</a>.</em></p>
<blockquote>
<h2>10.5.4</h2>
<ul>
<li>Fixed prefixed rule duplication (by <a
href="https://github.com/xianjianlf2"><code>@​xianjianlf2</code></a>).</li>
</ul>
<h2>10.5.3</h2>
<ul>
<li>Fixed brackets and gradient parser (<a
href="https://github.com/alanturing881"><code>@​alanturing881</code></a>).</li>
</ul>
<h2>10.5.2</h2>
<ul>
<li>Moved <code>-webkit-fill-available</code> before
<code>-moz-available</code>, so Firefox
will use <code>-webkit-</code> version which is closer to
<code>stretch</code>.</li>
</ul>
<h2>10.5.1</h2>
<ul>
<li>Fixed <code>grid-area</code> span reset for overriding areas (by <a
href="https://github.com/puneetdixit200"><code>@​puneetdixit200</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/postcss/autoprefixer/commit/4cad00f0e839f3d7bbcdcc00b7df6fc448fb28f3"><code>4cad00f</code></a>
Release 10.5.4 version</li>
<li><a
href="https://github.com/postcss/autoprefixer/commit/e62a4b1782f4ece51070feba79b0ff19f4305c68"><code>e62a4b1</code></a>
Update CI config</li>
<li><a
href="https://github.com/postcss/autoprefixer/commit/c8f0d0ae00f5bb28bbcc3413f70b088020007469"><code>c8f0d0a</code></a>
Update dependencies</li>
<li><a
href="https://github.com/postcss/autoprefixer/commit/cae35771dc4a4dfeda637a31dc1795ace6d9d28b"><code>cae3577</code></a>
Move back to latest pnpm 11</li>
<li><a
href="https://github.com/postcss/autoprefixer/commit/fd31eb33b56ab9663d298b5bf08ae4ff47f76878"><code>fd31eb3</code></a>
Fix duplicated prefixed selectors on reformatted CSS (<a
href="https://redirect.github.com/postcss/autoprefixer/issues/1552">#1552</a>)</li>
<li><a
href="https://github.com/postcss/autoprefixer/commit/958d390787c31c3044c1fb68ec37efc29637e26b"><code>958d390</code></a>
Release 10.5.3 version</li>
<li><a
href="https://github.com/postcss/autoprefixer/commit/21d2adb4d1fc6103c1e3cc39c991de59fdb5496e"><code>21d2adb</code></a>
Fix gradient parser</li>
<li><a
href="https://github.com/postcss/autoprefixer/commit/f7ddae99f0ebfa3961a5c14bd9ecb7d4310601a6"><code>f7ddae9</code></a>
Fix bracket parser</li>
<li><a
href="https://github.com/postcss/autoprefixer/commit/10ea5e7b8511a3e07aeb8a0f50f61496bc3faf4f"><code>10ea5e7</code></a>
Update dependencies and remove patch</li>
<li><a
href="https://github.com/postcss/autoprefixer/commit/b6e8a2a4672cafafcb3bb2c72cd0027a31b1a320"><code>b6e8a2a</code></a>
Update Dev Container</li>
<li>Additional commits viewable in <a
href="https://github.com/postcss/autoprefixer/compare/10.5.0...10.5.4">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for autoprefixer since your current version.</p>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=autoprefixer&package-manager=npm_and_yarn&previous-version=10.5.0&new-version=10.5.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-01 11:24:31 +00:00
dependabot[bot] 4fc605abe6 chore: bump motion from 12.40.0 to 12.42.2 in /site (#27748) 
Bumps [motion](https://github.com/motiondivision/motion) from 12.40.0 to
12.42.2.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/motiondivision/motion/blob/main/CHANGELOG.md">motion's
changelog</a>.</em></p>
<blockquote>
<h2>[12.42.2] 2026-07-01</h2>
<h3>Fixed</h3>
<ul>
<li><code>animateView</code>: Cropped group layers now animate
<code>border-radius</code> from the old to new radius.</li>
</ul>
<h2>[12.42.1] 2026-06-30</h2>
<h3>Fixed</h3>
<ul>
<li><code>animateView</code>: Old layer fade out now cancelled when
defining <code>.new()</code>.</li>
</ul>
<h2>[12.42.0] 2026-06-24</h2>
<h3>Changed</h3>
<ul>
<li><code>animateView</code>: Layers are automatically grouped to match
their DOM-hierarchy. New <code>.group(false)</code> method
opts-out.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li><code>animateView</code>: Auto-crop is now aspect-ratio aware,
disabling crops for matching aspect-ratios.</li>
<li><code>animateView</code>: Disabled automatic
<code>border-radius</code> animation.</li>
</ul>
<h2>[12.41.0] 2026-06-23</h2>
<h3>Added</h3>
<ul>
<li><code>animateView</code>: Moves from Motion+ Early Access and alpha
to main library.</li>
<li><code>animateView</code>: <code>.add()</code> resolves a CSS
selector or <code>Element</code> to automatically generate, apply and
remove <code>view-transition-name</code>.</li>
<li><code>animateView</code>: <code>.new()</code> and
<code>.old()</code> configures values to animate on new and old
layers.</li>
<li><code>animateView</code>: <code>.layout()</code> can set a custom
transition on the size/position animation of the currently selected
elements.</li>
<li><code>animateView</code>: Group layers now automatically crop with
children set to <code>cover</code>, with <code>border-radius</code>
animating from old radius to new. <code>.crop(false)</code> disables
this behaviour.</li>
<li><code>animateView</code>: <code>.class(name)</code> tags currently
selected elements with a <code>view-transition-class</code> as a custom
CSS hook.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li><code>AnimatePresence</code>: Prevent stuck exit animations when
children interrupt.</li>
<li><code>drag</code>: Child <code>e.stopPropagation()</code> no longer
break drag end.</li>
<li>Fixing Next.js OOM on Windows when importing via <code>motion</code>
package.</li>
<li><code>animateLayout</code>: Improve handling of parallel/interleaved
calls.</li>
</ul>
<h3>Changed</h3>
<ul>
<li><code>animateView</code>: <code>.enter()</code> and
<code>.exit()</code> now refer specifically to <code>new</code> and
<code>old</code> layers where there are no matching <code>old</code> or
<code>new</code> layers.</li>
<li><code>animateView</code>: Interrupted transition setups now return
resolved animation rather than throwing.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/motiondivision/motion/commit/40e8756c63b258c9dd07de9501cb788410eefb02"><code>40e8756</code></a>
v12.42.2</li>
<li><a
href="https://github.com/motiondivision/motion/commit/718ccc7d4e8d17dddb36e73198b730fac57267c4"><code>718ccc7</code></a>
Merge pull request <a
href="https://redirect.github.com/motiondivision/motion/issues/3768">#3768</a>
from motiondivision/view-cropped-corner-radius</li>
<li><a
href="https://github.com/motiondivision/motion/commit/19195a4bfc77389afb9cfd06bb2fb9eaeb798e8f"><code>19195a4</code></a>
Dedupe corner-radius longhands; merge crop box/radii measurements</li>
<li><a
href="https://github.com/motiondivision/motion/commit/5299aa65a2428c55728d28b68c0d3242052d8b7a"><code>5299aa6</code></a>
Resolve cropped-clip radius timing once; fix transition-option leak</li>
<li><a
href="https://github.com/motiondivision/motion/commit/937cdf396c29fa2826ba0836c1e6f1a1466e5064"><code>937cdf3</code></a>
Animate cropped view-transition group corner radius</li>
<li><a
href="https://github.com/motiondivision/motion/commit/fd2d6f66d1cffcfeb2e2e0d9e39dc54796025db2"><code>fd2d6f6</code></a>
v12.42.1</li>
<li><a
href="https://github.com/motiondivision/motion/commit/2223d873d8c78bab03301e5d9e3272c6d76907e6"><code>2223d87</code></a>
Hold the old layer when only a non-opacity .new() is set</li>
<li><a
href="https://github.com/motiondivision/motion/commit/9c841455973b280c7989befd6dc918da0246a7fa"><code>9c84145</code></a>
v12.42.0</li>
<li><a
href="https://github.com/motiondivision/motion/commit/60d7c72bc3d8052e2453424542d102467f3ed2fc"><code>60d7c72</code></a>
Add view-transition group nesting and aspect-aware cropping</li>
<li><a
href="https://github.com/motiondivision/motion/commit/6437276caa543467a3bc407514ad0a4f842c37e0"><code>6437276</code></a>
Updating</li>
<li>Additional commits viewable in <a
href="https://github.com/motiondivision/motion/compare/v12.40.0...v12.42.2">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-01 11:22:31 +00:00
dependabot[bot] 6abd926807 chore: bump express from 4.21.2 to 4.22.2 in /site (#27752) 
Bumps [express](https://github.com/expressjs/express) from 4.21.2 to
4.22.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/expressjs/express/releases">express's
releases</a>.</em></p>
<blockquote>
<h2>v4.22.2</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: restore &gt;20 array parsing for <code>req.query</code>
repeated keys (<a
href="https://github.com/expressjs/express/commit/8d09bfe6d88983da5c3e12cfdd54782c4dc675db"><code>8d09bfe6</code></a>)
<ul>
<li>This also unifies array-cap behavior across notations. Indexed
notation (<code>a[0]=...</code>) was historically capped at qs's default
<code>arrayLimit</code> of 20 even in older qs versions; after this
change it also allows up to 1000 items.</li>
</ul>
</li>
<li>deps: qs@~6.15.1</li>
<li>deps: body-parser@~1.20.5</li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/suuuuuuminnnnnn"><code>@​suuuuuuminnnnnn</code></a>
made their first contribution in <a
href="https://redirect.github.com/expressjs/express/pull/7021">expressjs/express#7021</a></li>
<li><a href="https://github.com/SAY-5"><code>@​SAY-5</code></a> made
their first contribution in <a
href="https://redirect.github.com/expressjs/express/pull/7181">expressjs/express#7181</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/expressjs/express/compare/v4.22.1...v4.22.2">https://github.com/expressjs/express/compare/v4.22.1...v4.22.2</a></p>
<h2>v4.22.1</h2>
<h2>What's Changed</h2>
<blockquote>
<p>[!IMPORTANT]<br />
The prior release (4.22.0) included an erroneous breaking change related
to the extended query parser. There is no actual security vulnerability
associated with this behavior (CVE-2024-51999 has been rejected). The
change has been fully reverted in this release.</p>
</blockquote>
<ul>
<li>Release: 4.22.1 by <a
href="https://github.com/UlisesGascon"><code>@​UlisesGascon</code></a>
in <a
href="https://redirect.github.com/expressjs/express/pull/6934">expressjs/express#6934</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/expressjs/express/compare/4.22.0...v4.22.1">https://github.com/expressjs/express/compare/4.22.0...v4.22.1</a></p>
<h2>4.22.0</h2>
<h2>Important: Security</h2>
<ul>
<li>Security fix for <a
href="https://www.cve.org/CVERecord?id=CVE-2024-51999">CVE-2024-51999</a>
(<a
href="https://github.com/expressjs/express/security/advisories/GHSA-pj86-cfqh-vqx6">GHSA-pj86-cfqh-vqx6</a>)</li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>Refactor: improve readability by <a
href="https://github.com/sazk07"><code>@​sazk07</code></a> in <a
href="https://redirect.github.com/expressjs/express/pull/6190">expressjs/express#6190</a></li>
<li>ci: add support for Node.js@23.0 by <a
href="https://github.com/UlisesGascon"><code>@​UlisesGascon</code></a>
in <a
href="https://redirect.github.com/expressjs/express/pull/6080">expressjs/express#6080</a></li>
<li>Method functions with no path should error by <a
href="https://github.com/wesleytodd"><code>@​wesleytodd</code></a> in <a
href="https://redirect.github.com/expressjs/express/pull/5957">expressjs/express#5957</a></li>
<li>ci: updated github actions ci workflow by <a
href="https://github.com/Phillip9587"><code>@​Phillip9587</code></a> in
<a
href="https://redirect.github.com/expressjs/express/pull/6323">expressjs/express#6323</a></li>
<li>ci: reorder <code>npm i</code> steps to fix ci for older node
versions by <a
href="https://github.com/Phillip9587"><code>@​Phillip9587</code></a> in
<a
href="https://redirect.github.com/expressjs/express/pull/6336">expressjs/express#6336</a></li>
<li>Backport: ci: add node.js 24 to test matrix by <a
href="https://github.com/Phillip9587"><code>@​Phillip9587</code></a> in
<a
href="https://redirect.github.com/expressjs/express/pull/6506">expressjs/express#6506</a></li>
<li>chore(4.x): wider range for query test skip by <a
href="https://github.com/jonchurch"><code>@​jonchurch</code></a> in <a
href="https://redirect.github.com/expressjs/express/pull/6513">expressjs/express#6513</a></li>
<li>use tilde notation for certain dependencies by <a
href="https://github.com/UlisesGascon"><code>@​UlisesGascon</code></a>
in <a
href="https://redirect.github.com/expressjs/express/pull/6905">expressjs/express#6905</a></li>
<li>deps: qs@6.14.0 by <a
href="https://github.com/UlisesGascon"><code>@​UlisesGascon</code></a>
in <a
href="https://redirect.github.com/expressjs/express/pull/6909">expressjs/express#6909</a></li>
<li>deps: use tilde notation for <code>qs</code> by <a
href="https://github.com/Phillip9587"><code>@​Phillip9587</code></a> in
<a
href="https://redirect.github.com/expressjs/express/pull/6919">expressjs/express#6919</a></li>
<li>Release: 4.22.0 by <a
href="https://github.com/UlisesGascon"><code>@​UlisesGascon</code></a>
in <a
href="https://redirect.github.com/expressjs/express/pull/6921">expressjs/express#6921</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/expressjs/express/compare/4.21.2...4.22.0">https://github.com/expressjs/express/compare/4.21.2...4.22.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/expressjs/express/blob/v4.22.2/History.md">express's
changelog</a>.</em></p>
<blockquote>
<h1>4.22.2 / 2026-05-011</h1>
<ul>
<li>fix: restore &gt;20 array parsing for <code>req.query</code>
repeated keys (<a
href="https://github.com/expressjs/express/commit/8d09bfe6d88983da5c3e12cfdd54782c4dc675db"><code>8d09bfe6</code></a>)
<ul>
<li>This also unifies array-cap behavior across notations. Indexed
notation (<code>a[0]=...</code>) was historically capped at qs's default
<code>arrayLimit</code> of 20 even in older qs versions; after this
change it also allows up to 1000 items.</li>
</ul>
</li>
<li>deps: qs@~6.15.1</li>
<li>deps: body-parser@~1.20.5</li>
</ul>
<h1>4.22.1 / 2025-12-01</h1>
<ul>
<li>Revert security fix for <a
href="https://www.cve.org/CVERecord?id=CVE-2024-51999">CVE-2024-51999</a>
(<a
href="https://github.com/expressjs/express/security/advisories/GHSA-pj86-cfqh-vqx6">GHSA-pj86-cfqh-vqx6</a>)
<ul>
<li>The prior release (4.22.0) included an erroneous breaking change
related to the extended query parser. There is no actual security
vulnerability associated with this behavior (CVE-2024-51999 has been
rejected). The change has been fully reverted in this release.</li>
</ul>
</li>
</ul>
<h1>4.22.0 / 2025-12-01</h1>
<ul>
<li>Security fix for <a
href="https://www.cve.org/CVERecord?id=CVE-2024-51999">CVE-2024-51999</a>
(<a
href="https://github.com/expressjs/express/security/advisories/GHSA-pj86-cfqh-vqx6">GHSA-pj86-cfqh-vqx6</a>)</li>
<li>deps: use tilde notation for dependencies</li>
<li>deps: qs@6.14.0</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/expressjs/express/commit/df0abc9333a3398b97b71f6ea7cd77d5ea3e9f97"><code>df0abc9</code></a>
4.22.2</li>
<li><a
href="https://github.com/expressjs/express/commit/836d36668ea750f78b4373b4de79bbd22634e6ec"><code>836d366</code></a>
<code>4.x</code> update qs to 6.15.1, body-parser 1.20.5 (<a
href="https://redirect.github.com/expressjs/express/issues/7224">#7224</a>)</li>
<li><a
href="https://github.com/expressjs/express/commit/8d09bfe6d88983da5c3e12cfdd54782c4dc675db"><code>8d09bfe</code></a>
fix: restore array parsing for req.query repeated keys (<a
href="https://redirect.github.com/expressjs/express/issues/7181">#7181</a>)</li>
<li><a
href="https://github.com/expressjs/express/commit/d39e8ad1778a0b8a606a5a7b17096d0cc5ec722d"><code>d39e8ad</code></a>
deps: body-parser@~1.20.4 (<a
href="https://redirect.github.com/expressjs/express/issues/7021">#7021</a>)</li>
<li><a
href="https://github.com/expressjs/express/commit/efe85d9fdc9e3a62f7a1121b4f5f484862298b48"><code>efe85d9</code></a>
deps: qs@^6.14.1 (<a
href="https://redirect.github.com/expressjs/express/issues/6972">#6972</a>)</li>
<li><a
href="https://github.com/expressjs/express/commit/f62378e1bc776259c0a471476c2dc043a02ac762"><code>f62378e</code></a>
📝 add note to history</li>
<li><a
href="https://github.com/expressjs/express/commit/12fae14531a78f19a2caaa5d4f58d9b01eaf3194"><code>12fae14</code></a>
4.22.1</li>
<li><a
href="https://github.com/expressjs/express/commit/5ddf311af32e772a77fd48b6266ce2f1ba330e1a"><code>5ddf311</code></a>
Revert &quot;sec: security patch for CVE-2024-51999&quot;</li>
<li><a
href="https://github.com/expressjs/express/commit/49744abd1120484fe64d7bde1cd3197c32523b6e"><code>49744ab</code></a>
4.22.0 (<a
href="https://redirect.github.com/expressjs/express/issues/6921">#6921</a>)</li>
<li><a
href="https://github.com/expressjs/express/commit/6e97452f600a3b01719fbc5517d833c7646b0bb7"><code>6e97452</code></a>
sec: security patch for CVE-2024-51999</li>
<li>Additional commits viewable in <a
href="https://github.com/expressjs/express/compare/4.21.2...v4.22.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=express&package-manager=npm_and_yarn&previous-version=4.21.2&new-version=4.22.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-01 11:21:29 +00:00
dependabot[bot] 025a3b253d chore: bump @lexical/utils from 0.44.0 to 0.48.0 in /site (#27751) 
Bumps
[@lexical/utils](https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils)
from 0.44.0 to 0.48.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/facebook/lexical/releases">@​lexical/utils's
releases</a>.</em></p>
<blockquote>
<p>v0.48.0 is a maintenance release focused on bug fixes across
Markdown, tables, lists, links, and selection. It's headlined by a fix
for a v0.46.0 regression that broke native text drag-and-drop (<a
href="https://redirect.github.com/facebook/lexical/pull/8842">#8842</a>)
and a couple of notable security hardening fixes. It also adds a handful
of new features, including an <code>MdastHtmlExtension</code> with
examples for authoring custom Markdown constructs (collapsibles,
<code>kbd</code>, alerts, footnotes), a customizable Yjs shared-type
root name for collaborative editing, and new table row manipulation
helpers.</p>
<h2>New APIs &amp; Features</h2>
<ul>
<li><a
href="https://lexical.dev/docs/api/modules/lexical_table"><code>@lexical/table</code></a>
— Added <code>$moveTableRow</code> for reordering table rows, plus the
previously missing <code>$unmergeCellNode</code> export (<a
href="https://redirect.github.com/facebook/lexical/pull/8833">#8833</a>)</li>
<li><a
href="https://lexical.dev/docs/api/modules/lexical_yjs"><code>@lexical/yjs</code></a>
/ <a
href="https://lexical.dev/docs/api/modules/lexical_react"><code>@lexical/react</code></a>
— The Yjs shared-type root name is now customizable, so Lexical can
share a Yjs document with other content that uses a different root key
(<a
href="https://redirect.github.com/facebook/lexical/pull/8841">#8841</a>)</li>
<li><a
href="https://lexical.dev/docs/api/modules/lexical_extension"><code>@lexical/extension</code></a>
/ <a
href="https://lexical.dev/docs/api/modules/lexical_mdast"><code>@lexical/mdast</code></a>
— Added <code>MdastHtmlExtension</code> and Markdown custom-construct
examples (collapsible sections, <code>kbd</code>, alerts, footnotes)
demonstrating how to extend the Markdown ↔ mdast pipeline. See the <a
href="https://lexical.dev/docs/serialization/markdown-mdast">Markdown
&amp; mdast serialization guide</a> (<a
href="https://redirect.github.com/facebook/lexical/pull/8826">#8826</a>)</li>
</ul>
<h2>Notable Fixes</h2>
<p><strong>Drag &amp; drop (fix for v0.46.0 regression)</strong></p>
<ul>
<li>Don't cancel <code>dragover</code> for text drags, so native drops
work again (<a
href="https://redirect.github.com/facebook/lexical/pull/8842">#8842</a>)</li>
</ul>
<p><strong>Security</strong></p>
<ul>
<li><code>LinkNode.sanitizeUrl()</code> now fails closed on unparseable
URLs, preventing a potential XSS vector (<a
href="https://redirect.github.com/facebook/lexical/pull/8846">#8846</a>)</li>
<li>Fixed a <code>serialize-javascript</code> dependency vulnerability
(<a
href="https://redirect.github.com/facebook/lexical/pull/8803">#8803</a>)</li>
</ul>
<p><strong>Markdown &amp; code</strong></p>
<ul>
<li>Roundtrip overlapping inline formats correctly through
mdast/Markdown (<a
href="https://redirect.github.com/facebook/lexical/pull/8825">#8825</a>)</li>
<li>Force re-tokenization after an async language load so highlighting
appears once the grammar is ready (<a
href="https://redirect.github.com/facebook/lexical/pull/8830">#8830</a>)</li>
</ul>
<p><strong>Tables</strong></p>
<ul>
<li>Auto-scroll while drag-selecting cells past the visible edge (<a
href="https://redirect.github.com/facebook/lexical/pull/8822">#8822</a>)</li>
<li>Enable table copy in read-only mode (<a
href="https://redirect.github.com/facebook/lexical/pull/8845">#8845</a>)</li>
</ul>
<p><strong>Lists &amp; character limit</strong></p>
<ul>
<li>Backspace at the start of a list item now outdents or converts to a
paragraph (<a
href="https://redirect.github.com/facebook/lexical/pull/8829">#8829</a>)</li>
<li>Merge adjacent <code>OverflowNode</code>s in
<code>useCharacterLimit</code> (<a
href="https://redirect.github.com/facebook/lexical/pull/8831">#8831</a>)</li>
<li>Count block separators when wrapping character-limit overflow (<a
href="https://redirect.github.com/facebook/lexical/pull/8840">#8840</a>)</li>
</ul>
<p><strong>Links &amp; selection</strong></p>
<ul>
<li>Disable link opening for disabled autolinks (<a
href="https://redirect.github.com/facebook/lexical/pull/8839">#8839</a>)</li>
<li>Skip <code>scrollIntoViewIfNeeded</code> when the selection rect is
above the editor, fixing a Safari RTL caret jump (<a
href="https://redirect.github.com/facebook/lexical/pull/8848">#8848</a>)</li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>[lexical-mdast][lexical-markdown] Bug Fix: Roundtrip overlapping
inline formats by <a
href="https://github.com/etrepum"><code>@​etrepum</code></a> in <a
href="https://redirect.github.com/facebook/lexical/pull/8825">facebook/lexical#8825</a></li>
<li>[lexical-table][lexical-playground] Bug Fix: Auto-scroll while
drag-selecting cells past the visible edge by <a
href="https://github.com/JohnJunior"><code>@​JohnJunior</code></a> in <a
href="https://redirect.github.com/facebook/lexical/pull/8822">facebook/lexical#8822</a></li>
<li>[lexical-code-shiki] Bug Fix: force re-tokenize after async language
load by <a
href="https://github.com/ochevallier"><code>@​ochevallier</code></a> in
<a
href="https://redirect.github.com/facebook/lexical/pull/8830">facebook/lexical#8830</a></li>
<li>[lexical-react] Bug Fix: Merge adjacent OverflowNodes in
useCharacterLimit by <a
href="https://github.com/mayrang"><code>@​mayrang</code></a> in <a
href="https://redirect.github.com/facebook/lexical/pull/8831">facebook/lexical#8831</a></li>
<li>Open playground links in a new tab by <a
href="https://github.com/potatowagon"><code>@​potatowagon</code></a> in
<a
href="https://redirect.github.com/facebook/lexical/pull/8837">facebook/lexical#8837</a></li>
<li>[lexical-rich-text][lexical-plain-text] Bug Fix: don't cancel
dragover for text drags so native drops work again by <a
href="https://github.com/etrepum"><code>@​etrepum</code></a> in <a
href="https://redirect.github.com/facebook/lexical/pull/8842">facebook/lexical#8842</a></li>
<li>[lexical-link] Bug Fix: disable link opening for disabled autolink
in… by <a
href="https://github.com/ochevallier"><code>@​ochevallier</code></a> in
<a
href="https://redirect.github.com/facebook/lexical/pull/8839">facebook/lexical#8839</a></li>
<li>[lexical-table] Feature: Add $moveTableRow function &amp; Add
missing export for $unmergeCellNode by <a
href="https://github.com/hamo-o"><code>@​hamo-o</code></a> in <a
href="https://redirect.github.com/facebook/lexical/pull/8833">facebook/lexical#8833</a></li>
<li>[lexical-list] Bug Fix: Backspace at start of list item outdents or
converts to paragraph by <a
href="https://github.com/mayrang"><code>@​mayrang</code></a> in <a
href="https://redirect.github.com/facebook/lexical/pull/8829">facebook/lexical#8829</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/facebook/lexical/blob/main/CHANGELOG.md">@​lexical/utils's
changelog</a>.</em></p>
<blockquote>
<h2>v0.48.0 (2026-07-16)</h2>
<ul>
<li>lexical-reactlexical-table Bug Fix Enable table copy in read-only
mode (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8845">#8845</a>)
mayrang</li>
<li>lexical-extensionlexical-mdastdev-mdast-editor-example Feature Add
MdastHtmlExtension and Markdown custom-construct examples (collapsible,
kbd, alerts, footnotes) (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8826">#8826</a>)
Bob Ippolito</li>
<li>Fix fail closed in LinkNode.sanitizeUrl() on unparseable URLs (XSS)
(<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8846">#8846</a>)
xiezhenjia-meta</li>
<li>lexical Chore Fix serialize-javascript package dependency
vulnerability (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8803">#8803</a>)
vijay ojha</li>
<li>lexical-react Bug Fix Count block separators in character limit
overflow wrapping (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8840">#8840</a>)
mayrang</li>
<li>lexical-yjslexical-react Feature Customizable Yjs shared-type root
name (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8841">#8841</a>)
mayrang</li>
<li>lexical-list Bug Fix Backspace at start of list item outdents or
converts to paragraph (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8829">#8829</a>)
mayrang</li>
<li>lexical-table Feature Add moveTableRow function Add missing export
for unmergeCellNode (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8833">#8833</a>)</li>
<li>lexical-link Bug Fix disable link opening for disabled autolink in
(<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8839">#8839</a>)
Olivier Chevallier</li>
<li>lexical-rich-textlexical-plain-text Bug Fix dont cancel dragover for
text drags so native drops work again (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8842">#8842</a>)
Bob Ippolito</li>
<li>Open playground links in a new tab (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8837">#8837</a>)
Sherry</li>
<li>lexical-react Bug Fix Merge adjacent OverflowNodes in
useCharacterLimit (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8831">#8831</a>)
mayrang</li>
<li>lexical-code-shiki Bug Fix force re-tokenize after async language
load (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8830">#8830</a>)
Olivier Chevallier</li>
<li>lexical-tablelexical-playground Bug Fix Auto-scroll while
drag-selecting cells past the visible edge (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8822">#8822</a>)
Oleksandr Trukhnii</li>
<li>lexical-mdastlexical-markdown Bug Fix Roundtrip overlapping inline
formats (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8825">#8825</a>)
Bob Ippolito</li>
<li>v0.47.0 (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8821">#8821</a>)
Bob Ippolito</li>
<li>v0.47.0 Lexical GitHub Actions Bot</li>
</ul>
<h2>v0.47.0 (2026-07-10)</h2>
<ul>
<li>lexicallexical-rich-text Bug Fix Fix formatText toggle direction and
add SETTEXTFORMATCOMMAND (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8807">#8807</a>)
mayrang</li>
<li>scripts Bug Fix Let npm prompt for OTP when publishing bootstrap
stubs (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8820">#8820</a>)
Bob Ippolito</li>
<li>lexical-playground Bug Fix Clear inline font-size when converting to
heading (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8800">#8800</a>)
mayrang</li>
<li>lexical-tablelexical-playground Feature setTableRowIsHeader and
setTableColumnIsHeader utilities (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8815">#8815</a>)
mayrang</li>
<li>lexical-website Documentation Update Rewrite testing guide (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8811">#8811</a>)
mayrang</li>
<li>lexical-mdastlexical-rich-text Feature lexicalmdast, a
micromarkmdast-based alternative to lexicalmarkdown (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8794">#8794</a>)
Bob Ippolito</li>
<li>Make dependency-check resilient to transient registry errors (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8818">#8818</a>)
Gerard Rovira</li>
<li>lexical Refactor Move event module globals into per-editor
InputState (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8809">#8809</a>)
mayrang</li>
<li>lexical Bug Fix getDocument() should fall back to the global
document when there is no active editor (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8813">#8813</a>)
Sherry</li>
<li>lexical-playground Bug Fix Keep cell background color modal open on
first click (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8806">#8806</a>)
sahir</li>
<li>lexical-playground Bug Fix Use consistent default maxWidth for
markdown-imported images (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8810">#8810</a>)
mayrang</li>
<li>lexical-devtoolslexical-playground Chore Update flow, hermes, and
babel packages to latest (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8795">#8795</a>)
Bob Ippolito</li>
<li>Add a 7-day pnpm minimumReleaseAge to match the Dependabot cooldown
(<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8808">#8808</a>)
Gerard Rovira</li>
<li>lexical Chore Fix tmp package dependency vulnerability (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8802">#8802</a>)
vijay ojha</li>
<li>lexical Chore Add missing Flow type declarations (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8799">#8799</a>)
mayrang</li>
<li>lexical-markdown Feature Add generateNodesFromMarkdownString (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8789">#8789</a>)
mayrang</li>
<li>lexicallexical-playground Chore Refactor IME composition test
infrastructure and add browser-level coverage (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8793">#8793</a>)
mayrang</li>
<li>lexical-playground Bug Fix Use viewBox dimensions for unsized
Excalidraw output (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8798">#8798</a>)
mayrang</li>
<li>lexical-table Bug Fix Export insertTableRowAtNode and
insertTableColumnAtNode (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8791">#8791</a>)</li>
<li>lexical-playgroundlexical-website Feature Add Vercel Analytics and
Speed Insights (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8796">#8796</a>)
Gerard Rovira</li>
<li>lexicallexical-eslint-plugin Feature Add getDocument() API and
Shadow DOM lint enforcement (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8788">#8788</a>)
mayrang</li>
<li>scripts Bug Fix strip misplaced pure annotations from prod builds
(<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8786">#8786</a>)
Bob Ippolito</li>
<li>lexical Bug Fix deleteCharacter overwrites X11 PRIMARY selection via
Selection.modify (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8774">#8774</a>)
Bob Ippolito</li>
<li>lexical-playground Bug Fix Support Unicode URLs in autolink matcher
(<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8787">#8787</a>)
mayrang</li>
<li>lexical-table Feature Spread pasted TSV text across table cells (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8780">#8780</a>)
mayrang</li>
<li>Breaking Changelexical Bug Fix Preserve DOM element when composing
on segmented TextNode middle (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8784">#8784</a>)
mayrang</li>
<li>Breaking Changelexical-reactlexical-devtools-core Chore Drop React
17 support, baseline is now React 18 (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8782">#8782</a>)
Bob Ippolito</li>
<li>lexical-playgroundlexical Feature Ruby annotation node with floating
editor (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8741">#8741</a>)
mayrang</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/facebook/lexical/commit/284b7491d014c412a11ecc8e4b8ea8e09e07f7e9"><code>284b749</code></a>
v0.48.0</li>
<li><a
href="https://github.com/facebook/lexical/commit/e4b7cc3f420226059c8aa30df6e89bd5fadbea90"><code>e4b7cc3</code></a>
v0.47.0 (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8821">#8821</a>)</li>
<li><a
href="https://github.com/facebook/lexical/commit/a7666ab11f5e8c674a3f5ca8a83d2e92f1b171d0"><code>a7666ab</code></a>
[*][lexical-devtools][lexical-playground] Chore: Update flow, hermes,
and bab...</li>
<li><a
href="https://github.com/facebook/lexical/commit/e649ab28b7e2dd58c1b4798c446e611f54356518"><code>e649ab2</code></a>
[lexical][lexical-eslint-plugin] Feature: Add $getDocument() API and
Shadow D...</li>
<li><a
href="https://github.com/facebook/lexical/commit/62a4b30f382b4dc60cacd1a9d753a2d1f44d9f5e"><code>62a4b30</code></a>
[lexical][*] Feature: registerEventListener / registerEventListeners DOM
help...</li>
<li><a
href="https://github.com/facebook/lexical/commit/cf25494881c9c04b090f6681d7b603ec31e157ff"><code>cf25494</code></a>
[lexical-utils] Bug Fix: positionNodeOnRange leaking orphan rect nodes
when r...</li>
<li><a
href="https://github.com/facebook/lexical/commit/1803c54f0e9cffad42a145e3bcaaf5051fe7fdee"><code>1803c54</code></a>
[lexical-selection] Bug Fix: Properly handle block end focus in backward
sele...</li>
<li><a
href="https://github.com/facebook/lexical/commit/fc162d45ae707869f47066f1aafc6fe47b1dfae1"><code>fc162d4</code></a>
[lexical-extension][lexical-playground] Chore: Some cleanups (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8732">#8732</a>)</li>
<li><a
href="https://github.com/facebook/lexical/commit/041c8642c0c0f4d0b7e791f3c499dfeac50a4a9e"><code>041c864</code></a>
v0.46.0 (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-utils/issues/8748">#8748</a>)</li>
<li><a
href="https://github.com/facebook/lexical/commit/6352a9a7f99c33d10e8b2698738d3bb6c5b6fe51"><code>6352a9a</code></a>
[lexical-utils][lexical-react] Chore: Move getScrollParent to
<code>@​lexical/utils</code> ...</li>
<li>Additional commits viewable in <a
href="https://github.com/facebook/lexical/commits/v0.48.0/packages/lexical-utils">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for <code>@​lexical/utils</code> since your current
version.</p>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@lexical/utils&package-manager=npm_and_yarn&previous-version=0.44.0&new-version=0.48.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-01 11:20:57 +00:00
dependabot[bot] e63bbc8a32 chore: bump tailwindcss from 3.4.18 to 3.4.19 in /site (#27750) 
Bumps
[tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss)
from 3.4.18 to 3.4.19.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/tailwindlabs/tailwindcss/releases">tailwindcss's
releases</a>.</em></p>
<blockquote>
<h2>v3.4.19</h2>
<h3>Fixed</h3>
<ul>
<li>Don’t break <code>sibling-*()</code> functions when used inside
<code>calc(…)</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19335">#19335</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md">tailwindcss's
changelog</a>.</em></p>
<blockquote>
<h2>[3.4.19] - 2025-12-10</h2>
<h3>Fixed</h3>
<ul>
<li>Don’t break <code>sibling-*()</code> functions when used inside
<code>calc(…)</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19335">#19335</a>)</li>
</ul>
<h2>[4.1.17] - 2025-11-06</h2>
<h3>Fixed</h3>
<ul>
<li>Substitute <code>@variant</code> inside legacy JS APIs (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19263">#19263</a>)</li>
<li>Prevent occasional crash on Windows when loaded into a worker thread
(<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19242">#19242</a>)</li>
</ul>
<h2>[4.1.16] - 2025-10-23</h2>
<h3>Fixed</h3>
<ul>
<li>Discard candidates with an empty data type (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19172">#19172</a>)</li>
<li>Fix canonicalization of arbitrary variants with attribute selectors
(<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19176">#19176</a>)</li>
<li>Fix invalid colors due to nested <code>&amp;</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19184">#19184</a>)</li>
<li>Improve canonicalization for <code>&amp; &gt; :pseudo</code> and
<code>&amp; :pseudo</code> arbitrary variants (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19178">#19178</a>)</li>
</ul>
<h2>[4.1.15] - 2025-10-20</h2>
<h3>Fixed</h3>
<ul>
<li>Fix Safari devtools rendering issue due to <code>color-mix</code>
fallback (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19069">#19069</a>)</li>
<li>Suppress Lightning CSS warnings about <code>:deep</code>,
<code>:slotted</code>, and <code>:global</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19094">#19094</a>)</li>
<li>Fix resolving theme keys when starting with the name of another
theme key in JS configs and plugins (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19097">#19097</a>)</li>
<li>Allow named groups in combination with <code>not-*</code>,
<code>has-*</code>, and <code>in-*</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19100">#19100</a>)</li>
<li>Prevent important utilities from affecting other utilities (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19110">#19110</a>)</li>
<li>Don’t index into strings with the <code>theme(…)</code> function (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19111">#19111</a>)</li>
<li>Fix parsing issue when <code>\t</code> is used in at-rules (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19130">#19130</a>)</li>
<li>Upgrade: Canonicalize utilities containing <code>0</code> values (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19095">#19095</a>)</li>
<li>Upgrade: Migrate deprecated <code>break-words</code> to
<code>wrap-break-word</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19157">#19157</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Remove the <code>postinstall</code> script from oxide (<a
href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss/issues/19149">#19149</a>)(<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19149">tailwindlabs/tailwindcss#19149</a>)</li>
</ul>
<h2>[4.1.14] - 2025-10-01</h2>
<h3>Fixed</h3>
<ul>
<li>Handle <code>'</code> syntax in ClojureScript when extracting
classes (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/18888">#18888</a>)</li>
<li>Handle <code>@variant</code> inside <code>@custom-variant</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/18885">#18885</a>)</li>
<li>Merge suggestions when using <code>@utility</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/18900">#18900</a>)</li>
<li>Ensure that file system watchers created when using the CLI are
always cleaned up (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/18905">#18905</a>)</li>
<li>Do not generate <code>grid-column</code> utilities when configuring
<code>grid-column-start</code> or <code>grid-column-end</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/18907">#18907</a>)</li>
<li>Do not generate <code>grid-row</code> utilities when configuring
<code>grid-row-start</code> or <code>grid-row-end</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/18907">#18907</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/tailwindlabs/tailwindcss/commits/v3.4.19/packages/tailwindcss">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tailwindcss&package-manager=npm_and_yarn&previous-version=3.4.18&new-version=3.4.19)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-01 11:20:05 +00:00
dependabot[bot] c3bd8bece4 chore: bump @fontsource-variable/geist from 5.2.9 to 5.3.0 in /site (#27749) 
Bumps
[@fontsource-variable/geist](https://github.com/fontsource/font-files/tree/HEAD/fonts/variable/geist)
from 5.2.9 to 5.3.0.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/fontsource/font-files/commits/HEAD/fonts/variable/geist">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@fontsource-variable/geist&package-manager=npm_and_yarn&previous-version=5.2.9&new-version=5.3.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-01 11:19:32 +00:00
dependabot[bot] 0b3212ddf2 chore: bump @fontsource/source-code-pro from 5.2.7 to 5.3.0 in /site (#27746) 
Bumps
[@fontsource/source-code-pro](https://github.com/fontsource/font-files/tree/HEAD/fonts/google/source-code-pro)
from 5.2.7 to 5.3.0.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/fontsource/font-files/commits/HEAD/fonts/google/source-code-pro">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@fontsource/source-code-pro&package-manager=npm_and_yarn&previous-version=5.2.7&new-version=5.3.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-01 11:18:15 +00:00
dependabot[bot] 2cbb6629e4 chore: bump humanize-duration from 3.33.1 to 3.34.0 in /site (#27742) 
Bumps
[humanize-duration](https://github.com/EvanHahn/HumanizeDuration.js)
from 3.33.1 to 3.34.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/EvanHahn/HumanizeDuration.js/blob/main/HISTORY.md">humanize-duration's
changelog</a>.</em></p>
<blockquote>
<h1>3.34.0 / 2026-06-29</h1>
<ul>
<li>new: Norwegian Nynorsk support (<code>nn</code>)</li>
<li>fix: Lithuanian now uses the singular form for counts such as 101
and 201 (for example &quot;101 diena&quot; instead of &quot;101
dienų&quot;)</li>
</ul>
<h1>3.33.2 / 2025-12-07</h1>
<ul>
<li>fix: Romanian now correctly uses &quot;de&quot; before nouns for
numbers &gt;= 20 such as &quot;20 de minute&quot; instead of &quot;20
minute&quot; (see <a
href="https://redirect.github.com/EvanHahn/HumanizeDuration.js/pull/235">#235</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/EvanHahn/HumanizeDuration.js/commit/49fa19c1e64833630f1f5a2b7ef5b5410933c372"><code>49fa19c</code></a>
3.34.0</li>
<li><a
href="https://github.com/EvanHahn/HumanizeDuration.js/commit/47ab9424702dd10808d5b6292fdcf8dfd340103a"><code>47ab942</code></a>
Update changelog and bower.json for 3.34.0 release</li>
<li><a
href="https://github.com/EvanHahn/HumanizeDuration.js/commit/545a37b2d8318f6b21851cc886ff2edf7a79e3cf"><code>545a37b</code></a>
Update devDependencies to latest versions</li>
<li><a
href="https://github.com/EvanHahn/HumanizeDuration.js/commit/23607f9fa017638809dad87d9f6961f7d99d7487"><code>23607f9</code></a>
Update TypeScript to latest (RC) version</li>
<li><a
href="https://github.com/EvanHahn/HumanizeDuration.js/commit/0883f5dbf59c6d81aac57279e969d621dad6e31b"><code>0883f5d</code></a>
Update changelog with Norwegian Nynorsk change</li>
<li><a
href="https://github.com/EvanHahn/HumanizeDuration.js/commit/ffcfa2a482570db1ed4a967f2ed28259eb9bb0ea"><code>ffcfa2a</code></a>
Update ESLint dependencies to latest version</li>
<li><a
href="https://github.com/EvanHahn/HumanizeDuration.js/commit/c2791af9d6818242fa9dee636004dde2980b3033"><code>c2791af</code></a>
Update Git URL</li>
<li><a
href="https://github.com/EvanHahn/HumanizeDuration.js/commit/0f69e090fa5e702aaabab1df610db2302fa97359"><code>0f69e09</code></a>
Fix Lithuanian form for counts like 101 and 201 (<a
href="https://redirect.github.com/EvanHahn/HumanizeDuration.js/issues/237">#237</a>)</li>
<li><a
href="https://github.com/EvanHahn/HumanizeDuration.js/commit/fd49da2861bfd3f76711e8b4b87977d699dee983"><code>fd49da2</code></a>
Add Norwegian Nynorsk (nn) language</li>
<li><a
href="https://github.com/EvanHahn/HumanizeDuration.js/commit/b961e8cace217f77f4481981ec5108065f0de2af"><code>b961e8c</code></a>
Mention <code>Intl.DurationFormat</code> in the readme</li>
<li>Additional commits viewable in <a
href="https://github.com/EvanHahn/HumanizeDuration.js/compare/v3.33.1...v3.34.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=humanize-duration&package-manager=npm_and_yarn&previous-version=3.33.1&new-version=3.34.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-01 11:16:43 +00:00
dependabot[bot] 4c079ef689 chore: bump axios from 1.18.0 to 1.18.1 in /site (#27741) 
Bumps [axios](https://github.com/axios/axios) from 1.18.0 to 1.18.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/axios/axios/releases">axios's
releases</a>.</em></p>
<blockquote>
<h2>v1.18.1 — June 21, 2026</h2>
<p>This release focuses on Node HTTP adapter fixes, safer AxiosError
serialisation, runtime/type correctness fixes, documentation updates,
and dependency maintenance.</p>
<h2>🐛 Bug Fixes</h2>
<ul>
<li>AxiosError Serialisation: Made AxiosError#cause non-enumerable to
prevent circular JSON serialisation failures when errors include nested
causes. (<a
href="https://redirect.github.com/axios/axios/issues/10913">#10913</a>)</li>
<li>Node HTTP Adapter: Guarded socket.setKeepAlive for proxy agent
streams, accepted path-only URLs when socketPath is configured, deferred
environment proxy handling to Node, and explicitly passed maxBodyLength
through to follow-redirects. (<a
href="https://redirect.github.com/axios/axios/issues/10917">#10917</a>,
<a
href="https://redirect.github.com/axios/axios/issues/10930">#10930</a>,
<a
href="https://redirect.github.com/axios/axios/issues/10942">#10942</a>,
<a
href="https://redirect.github.com/axios/axios/issues/10993">#10993</a>)</li>
<li>Runtime and Type Correctness: Fixed several runtime crashes, type
definition mismatches, and incorrect error handling paths. (<a
href="https://redirect.github.com/axios/axios/issues/10959">#10959</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11021">#11021</a>)</li>
<li>AxiosURLSearchParams: Switched the encoder callback to an arrow
function so <code>encoder.call(this)</code> receives the
<code>AxiosURLSearchParams</code> instance correctly. (<a
href="https://redirect.github.com/axios/axios/issues/11019">#11019</a>)</li>
</ul>
<h2>🔧 Maintenance &amp; Chores</h2>
<ul>
<li>
<p>Documentation: Documented sensitive headers and status transition
behaviour, prepared cleaned-up docs, added Deno install instructions,
and clarified that request data is request-specific (<a
href="https://redirect.github.com/axios/axios/issues/11007">#11007</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11010">#11010</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11023">#11023</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11025">#11025</a>)</p>
</li>
<li>
<p>Dependencies: Bumped vite, rollup, form-data, js-yaml, and multer
across the root project, docs, smoke tests, and module test workspaces.
(<a
href="https://redirect.github.com/axios/axios/issues/11011">#11011</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11012">#11012</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11013">#11013</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11014">#11014</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11015">#11015</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11016">#11016</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11017">#11017</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11026">#11026</a>)</p>
</li>
</ul>
<h2>🌟 New Contributors</h2>
<p>We are thrilled to welcome our new contributors. Thank you for
helping improve axios:</p>
<ul>
<li><a
href="https://github.com/webdevelopersrinu"><code>@​webdevelopersrinu</code></a>
(<a
href="https://redirect.github.com/axios/axios/issues/10913">#10913</a>)</li>
<li><a href="https://github.com/sijie-Z"><code>@​sijie-Z</code></a> (<a
href="https://redirect.github.com/axios/axios/issues/10993">#10993</a>)</li>
<li><a
href="https://github.com/bartlomieju"><code>@​bartlomieju</code></a> (<a
href="https://redirect.github.com/axios/axios/issues/11023">#11023</a>)</li>
<li><a href="https://github.com/JSap0914"><code>@​JSap0914</code></a>
(<a
href="https://redirect.github.com/axios/axios/issues/11019">#11019</a>)</li>
</ul>
<p><a
href="https://github.com/axios/axios/compare/v1.18.0...v1.18.1">Full
Changelog</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/axios/axios/blob/v1.x/CHANGELOG.md">axios's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>v1.19.0 — July 22, 2026</h2>
<p>This release raises the form-data security floor, adds configuration
and type-system capabilities, and fixes NO_PROXY matching, interceptor
errors, progress reporting, and serialization edge cases.</p>
<h2>🔒 Security Fixes</h2>
<ul>
<li>Multipart Form Data: Raised the form-data dependency floor to
^4.0.6, preventing fresh installations from resolving versions affected
by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (<a
href="https://github.com/advisories/GHSA-hmw2-7cc7-3qxx">https://github.com/advisories/GHSA-hmw2-7cc7-3qxx</a>).
(<a
href="https://redirect.github.com/axios/axios/issues/11028">#11028</a>)</li>
</ul>
<h2>🚀 New Features</h2>
<ul>
<li>Configuration Extensibility: Preserved own-enumerable symbol-keyed
fields through mergeConfig and added a generic params type across public
TypeScript declarations, responses, errors,
adapters, and serializers. (<a
href="https://redirect.github.com/axios/axios/issues/11043">#11043</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11081">#11081</a>)</li>
<li>Header Parameter Parsing: Added the opt-in
AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP
parameter parsing while preserving legacy parsing behavior. (<a
href="https://redirect.github.com/axios/axios/issues/11051">#11051</a>)</li>
<li>HTTP Status Codes: Added the missing Cloudflare 520
WebServerReturnsAnUnknownError status and matching ESM/CJS declarations.
(<a
href="https://redirect.github.com/axios/axios/issues/11067">#11067</a>)</li>
</ul>
<h2>🐛 Bug Fixes</h2>
<ul>
<li>
<p>Form Data Conversion: Limited formDataToJSON path splitting to dot
and bracket notation, preserving literal punctuation in keys, and
removed browser-facing Buffer.from usage from toFormData to avoid
unnecessary polyfills. (<a
href="https://redirect.github.com/axios/axios/issues/11006">#11006</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11018">#11018</a>)</p>
</li>
<li>
<p>Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal
forms during NO_PROXY matching and honored * entries within comma- or
space-separated bypass lists. (<a
href="https://redirect.github.com/axios/axios/issues/11029">#11029</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11053">#11053</a>)</p>
</li>
<li>
<p>Cancellation: Propagated already-aborted input signals immediately
when composing abort signals. (<a
href="https://redirect.github.com/axios/axios/issues/11035">#11035</a>)</p>
</li>
<li>
<p>Header Handling: Preserved empty first values for duplicate singleton
headers and made AxiosHeaders#getSetCookie() consistently return arrays
for present values. (<a
href="https://redirect.github.com/axios/axios/issues/11036">#11036</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11037">#11037</a>)</p>
</li>
<li>
<p>URL Handling: Included normalized, safely redacted offending URLs in
malformed-protocol errors and removed repeated trailing slashes when
combining base URLs. (<a
href="https://redirect.github.com/axios/axios/issues/11008">#11008</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11038">#11038</a>)</p>
</li>
<li>
<p>Progress Events: Clamped malformed negative progress values to zero
and ensured final Node.js download progress events are delivered before
streamed responses close. (<a
href="https://redirect.github.com/axios/axios/issues/11039">#11039</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11040">#11040</a>)</p>
</li>
<li>
<p>Error and JSON Serialization: Serialized Set values as arrays in
JSON-compatible snapshots and synthesized useful AxiosError messages
from otherwise-empty AggregateError instances. (<a
href="https://redirect.github.com/axios/axios/issues/11044">#11044</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11059">#11059</a>)</p>
</li>
<li>
<p>Content-Length Enforcement: Corrected base64 data: URL size
estimation so maxContentLength is enforced consistently by the HTTP and
Fetch adapters. (<a
href="https://redirect.github.com/axios/axios/issues/11061">#11061</a>)</p>
</li>
<li>
<p>Synchronous Interceptors: Prevented requests from being dispatched
after synchronous request interceptors fail unless their paired
rejection handler resolves successfully. (<a
href="https://redirect.github.com/axios/axios/issues/11071">#11071</a>)</p>
</li>
</ul>
<h2>🔧 Maintenance &amp; Chores</h2>
<ul>
<li>Dependencies: Updated development and test tooling, the docs
fixture's Axios version, and GitHub Actions integrations including
Checkout, Setup Node, Setup Deno, and Zizmor. (<a
href="https://redirect.github.com/axios/axios/issues/11031">#11031</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11055">#11055</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11056">#11056</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11058">#11058</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11079">#11079</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11080">#11080</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11088">#11088</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11089">#11089</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11090">#11090</a>)</li>
<li>Build Outputs: Limited sourcemap generation to published minified
bundles, removing broken map references from non-minified builds. (<a
href="https://redirect.github.com/axios/axios/issues/11054">#11054</a>)</li>
<li>Form Data Internals: Centralized FormData header handling and made
the Node.js adapter tolerate getHeaders() returning undefined under the
content-only policy. (<a
href="https://redirect.github.com/axios/axios/issues/11062">#11062</a>)</li>
<li>Developer Experience: Ignored common local AI-tooling directories
and fixed a constant-reassignment crash when the development sandbox
serves its root path. (<a
href="https://redirect.github.com/axios/axios/issues/11032">#11032</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11073">#11073</a>)</li>
<li>Documentation: Updated sponsor information, clarified that baseURL
is not a path-security boundary, scoped provenance claims to attested
releases, and corrected the configuration-defaults documentation. (<a
href="https://redirect.github.com/axios/axios/issues/11041">#11041</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11068">#11068</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11076">#11076</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11078">#11078</a>)</li>
<li>Publishing: Simplified v1 publishing to use the npm version bundled
with Node.js 26 and updated package metadata for the 1.19.0 release. (<a
href="https://redirect.github.com/axios/axios/issues/11083">#11083</a>,
<a
href="https://redirect.github.com/axios/axios/issues/11095">#11095</a>)</li>
</ul>
<h2>🌟 New Contributors</h2>
<p>We are thrilled to welcome our new contributors. Thank you for
helping improve Axios:</p>
<ul>
<li><a
href="https://github.com/afonsojramos"><code>@​afonsojramos</code></a>
(<a
href="https://redirect.github.com/axios/axios/issues/11028">#11028</a>)</li>
<li><a
href="https://github.com/MahinAnowar"><code>@​MahinAnowar</code></a> (<a
href="https://redirect.github.com/axios/axios/issues/11006">#11006</a>)</li>
<li><a
href="https://github.com/yassertawfik4"><code>@​yassertawfik4</code></a>
(<a
href="https://redirect.github.com/axios/axios/issues/11024">#11024</a>)</li>
<li><a
href="https://github.com/AnandSundar"><code>@​AnandSundar</code></a> (<a
href="https://redirect.github.com/axios/axios/issues/11029">#11029</a>)</li>
<li><a
href="https://github.com/lin-hongkuan"><code>@​lin-hongkuan</code></a>
(<a
href="https://redirect.github.com/axios/axios/issues/11035">#11035</a>)</li>
<li><a
href="https://github.com/Wali007-lab"><code>@​Wali007-lab</code></a> (<a
href="https://redirect.github.com/axios/axios/issues/11054">#11054</a>)</li>
<li><a href="https://github.com/magicdawn"><code>@​magicdawn</code></a>
(<a
href="https://redirect.github.com/axios/axios/issues/11043">#11043</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/axios/axios/commit/a209bfb1e5dcbce3cecbf4bd955339d006358887"><code>a209bfb</code></a>
chore(release): prepare release 1.18.1 (<a
href="https://redirect.github.com/axios/axios/issues/11027">#11027</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/fa6a55ef99235074d2c11d80a1064ef02850d598"><code>fa6a55e</code></a>
chore(deps-dev): bump multer from 2.1.1 to 2.2.0 (<a
href="https://redirect.github.com/axios/axios/issues/11026">#11026</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/40e7be8a78dd43caaeb2313cc4be3f8e714be91d"><code>40e7be8</code></a>
docs: clarifies that request data is request-specific in axios (<a
href="https://redirect.github.com/axios/axios/issues/11025">#11025</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/a446b39b19c8b570214a4158520c5ddd5b020366"><code>a446b39</code></a>
fix(AxiosURLSearchParams): use arrow function so encoder.call(this)
receives ...</li>
<li><a
href="https://github.com/axios/axios/commit/cf1306a42d97960b635c894c83658f2692e53585"><code>cf1306a</code></a>
docs: add Deno to install instructions (<a
href="https://redirect.github.com/axios/axios/issues/11023">#11023</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/b32880af48017457a1203ab2e63720902d3b71b3"><code>b32880a</code></a>
fix: incorrect use of error (<a
href="https://redirect.github.com/axios/axios/issues/11021">#11021</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/1792eda11aff8fe0f8c8a6e5ae6ff305740a6460"><code>1792eda</code></a>
fix: ensure maxBodyLength is explicitly passed to follow-redirects (<a
href="https://redirect.github.com/axios/axios/issues/10993">#10993</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/30499d6af0961ec38619792013a534d1933b08a9"><code>30499d6</code></a>
fix: various runtime crashes and type definition mismatches (<a
href="https://redirect.github.com/axios/axios/issues/10959">#10959</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/20ce9c412ebd88823d1a4a47000cb133a8f79440"><code>20ce9c4</code></a>
fix(http): defer env proxy handling to Node (<a
href="https://redirect.github.com/axios/axios/issues/10942">#10942</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/e64bcf9c5af231d6f37d8389b1e57ded314fff86"><code>e64bcf9</code></a>
chore(deps): merge branch 'v1.x' into tests/module/cjs (<a
href="https://redirect.github.com/axios/axios/issues/11014">#11014</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/axios/axios/compare/v1.18.0...v1.18.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=axios&package-manager=npm_and_yarn&previous-version=1.18.0&new-version=1.18.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-01 11:16:25 +00:00
dependabot[bot] f2774d4d3c chore: bump the react group across 1 directory with 3 updates (#27734) 
[//]: # (dependabot-start)
⚠️  **Dependabot is rebasing this PR** ⚠️ 

Rebasing might not happen immediately, so don't worry if this takes some
time.

Note: if you make any changes to this PR yourself, they will take
precedence over the rebase.

---

[//]: # (dependabot-end)

Bumps the react group with 3 updates in the /site directory:
[react](https://github.com/react/react/tree/HEAD/packages/react),
[@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react)
and
[react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom).

Updates `react` from 19.2.6 to 19.2.8
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/react/react/releases">react's
releases</a>.</em></p>
<blockquote>
<h2>19.2.8 (July 21st, 2026)</h2>
<h2>React Server Components</h2>
<ul>
<li>Performance improvements when decoding
(<a
href="https://redirect.github.com/facebook/react/pull/37087">#37087</a>
by <a href="https://github.com/eps1lon"><code>@​eps1lon</code></a>)</li>
</ul>
<h2>19.2.7 (June 1st, 2026)</h2>
<h2>React Server Components</h2>
<ul>
<li>Fixed missing <code>FormData</code> entries in Server Actions which
regressed in 19.2.6
(<a
href="https://redirect.github.com/facebook/react/pull/36566">#36566</a>
by <a
href="https://github.com/unstubbable"><code>@​unstubbable</code></a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/react/react/blob/main/CHANGELOG.md">react's
changelog</a>.</em></p>
<blockquote>
<h2>19.2.7 (June 1, 2026)</h2>
<h3>React Server Components</h3>
<ul>
<li>Fixed missing <code>FormData</code> entries in Server Actions which
regressed in 19.2.6 (<a
href="https://github.com/unstubbable"><code>@​unstubbable</code></a> <a
href="https://redirect.github.com/facebook/react/pull/36566">#36566</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/react/react/commit/1dd4ecbdabf826f527fc9a58c05ea70375b7d170"><code>1dd4ecb</code></a>
[FlightReply] Performance improvements when decoding (<a
href="https://github.com/react/react/tree/HEAD/packages/react/issues/37087">#37087</a>)</li>
<li><a
href="https://github.com/react/react/commit/b0d2fdb78bdfae075a7fa02ddcebbf25f90952c2"><code>b0d2fdb</code></a>
[19.2.x] Update required references to GitHub repo (<a
href="https://github.com/react/react/tree/HEAD/packages/react/issues/36753">#36753</a>)</li>
<li><a
href="https://github.com/react/react/commit/6117d7cca4906492c51fe6a03381e35adfd86e7d"><code>6117d7c</code></a>
Version 19.2.7 (<a
href="https://github.com/react/react/tree/HEAD/packages/react/issues/36591">#36591</a>)</li>
<li>See full diff in <a
href="https://github.com/react/react/commits/v19.2.8/packages/react">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for react since your current version.</p>
</details>
<br />

Updates `@types/react` from 19.2.15 to 19.2.17
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react">compare
view</a></li>
</ul>
</details>
<br />

Updates `react-dom` from 19.2.6 to 19.2.8
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/react/react/releases">react-dom's
releases</a>.</em></p>
<blockquote>
<h2>19.2.8 (July 21st, 2026)</h2>
<h2>React Server Components</h2>
<ul>
<li>Performance improvements when decoding
(<a
href="https://redirect.github.com/facebook/react/pull/37087">#37087</a>
by <a href="https://github.com/eps1lon"><code>@​eps1lon</code></a>)</li>
</ul>
<h2>19.2.7 (June 1st, 2026)</h2>
<h2>React Server Components</h2>
<ul>
<li>Fixed missing <code>FormData</code> entries in Server Actions which
regressed in 19.2.6
(<a
href="https://redirect.github.com/facebook/react/pull/36566">#36566</a>
by <a
href="https://github.com/unstubbable"><code>@​unstubbable</code></a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/react/react/blob/main/CHANGELOG.md">react-dom's
changelog</a>.</em></p>
<blockquote>
<h2>19.2.7 (June 1, 2026)</h2>
<h3>React Server Components</h3>
<ul>
<li>Fixed missing <code>FormData</code> entries in Server Actions which
regressed in 19.2.6 (<a
href="https://github.com/unstubbable"><code>@​unstubbable</code></a> <a
href="https://redirect.github.com/facebook/react/pull/36566">#36566</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/react/react/commit/1dd4ecbdabf826f527fc9a58c05ea70375b7d170"><code>1dd4ecb</code></a>
[FlightReply] Performance improvements when decoding (<a
href="https://github.com/react/react/tree/HEAD/packages/react-dom/issues/37087">#37087</a>)</li>
<li><a
href="https://github.com/react/react/commit/b0d2fdb78bdfae075a7fa02ddcebbf25f90952c2"><code>b0d2fdb</code></a>
[19.2.x] Update required references to GitHub repo (<a
href="https://github.com/react/react/tree/HEAD/packages/react-dom/issues/36753">#36753</a>)</li>
<li><a
href="https://github.com/react/react/commit/6117d7cca4906492c51fe6a03381e35adfd86e7d"><code>6117d7c</code></a>
Version 19.2.7 (<a
href="https://github.com/react/react/tree/HEAD/packages/react-dom/issues/36591">#36591</a>)</li>
<li>See full diff in <a
href="https://github.com/react/react/commits/v19.2.8/packages/react-dom">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for react-dom since your current version.</p>
</details>
<br />

Updates `@types/react` from 19.2.15 to 19.2.17
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-01 11:13:11 +00:00
dependabot[bot] 8342acee99 chore: bump @types/node from 22.20.0 to 22.20.1 in /offlinedocs (#27740) 
Bumps
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
from 22.20.0 to 22.20.1.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@types/node&package-manager=npm_and_yarn&previous-version=22.20.0&new-version=22.20.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-01 11:12:04 +00:00
dependabot[bot] 599e0ba98e chore: bump @chakra-ui/react from 2.10.9 to 2.10.10 in /offlinedocs (#27739) 
Bumps
[@chakra-ui/react](https://github.com/chakra-ui/chakra-ui/tree/HEAD/packages/react)
from 2.10.9 to 2.10.10.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/chakra-ui/chakra-ui/commits/@chakra-ui/react@2.10.10/packages/react">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@chakra-ui/react&package-manager=npm_and_yarn&previous-version=2.10.9&new-version=2.10.10)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-01 11:11:47 +00:00
dependabot[bot] b518713ab7 chore: bump sanitize-html from 2.17.5 to 2.17.6 in /offlinedocs (#27738) 
Bumps
[sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html)
from 2.17.5 to 2.17.6.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md">sanitize-html's
changelog</a>.</em></p>
<blockquote>
<h2>2.17.6 (2026-07-10)</h2>
<h3>Fixes</h3>
<ul>
<li>Allow transformTags to emit text when textFilter is set, even if the
tag is initially empty. This is consistent with the documentation.
Thanks to <a href="https://github.com/spokodev">spokodev</a> for the
fix.</li>
</ul>
<h3>Security</h3>
<ul>
<li>Fixed an XSS/allowlist bypass in which the contents of a raw-text
element (<code>textarea</code> or <code>xmp</code>) nested inside an
<code>svg</code> or <code>math</code> root were re-emitted without
HTML-escaping. <code>sanitize-html</code> treated that content as inert
raw text because <code>htmlparser2</code> 10.x classified raw-text
elements by tag name and ignored the namespace, but a real HTML5 parser
treats <code>textarea</code>/<code>xmp</code> as ordinary foreign
elements inside SVG/MathML and re-parses their contents as live markup.
As a result, markup and event-handler attributes that the allowlist
never permitted (for example <code>&lt;svg&gt;&lt;textarea&gt;&lt;img
src=x onerror=alert(1)&gt;</code>) could survive sanitization and
execute in the browser. This is now fixed on two fronts:
<code>htmlparser2</code> was upgraded to 12.x, which is namespace-aware
and parses <code>textarea</code>/<code>xmp</code> inside SVG/MathML as
ordinary elements, so their non-allowlisted children (such as the
injected <code>img</code>) are dropped by the allowlist instead of being
preserved as raw text; and any raw-text content
<code>sanitize-html</code> still emits for these tags (at HTML
integration points such as
<code>foreignObject</code>/<code>mtext</code>, or outside foreign
content) is always HTML-escaped. The default configuration is not
affected; the precondition is an <code>allowedTags</code> that includes
<code>svg</code> or <code>math</code> together with
<code>textarea</code> or <code>xmp</code>. Thanks to <a
href="https://github.com/khoadb175">khoadb175</a> for responsibly
disclosing the vulnerability.</li>
<li>Fixed a mutation-XSS / <code>allowedTags</code> bypass affecting
configurations that allow the <code>textarea</code> or <code>xmp</code>
raw-text tags. <code>htmlparser2</code> 10.x did not recognize an end
tag with a trailing solidus (e.g. <code>&lt;/textarea/&gt;</code>) as
closing the element, so it kept the following markup as raw text, but a
spec-compliant browser treats <code>&lt;/textarea/&gt;</code> as a valid
close and parses that markup as a live element. Because raw-text content
was re-emitted without escaping, a payload such as
<code>&lt;textarea&gt;&lt;/textarea/&gt;&lt;img src=x
onerror=...&gt;</code> could smuggle non-allowlisted, executable markup
through the sanitizer. The default configuration was not affected. This
is now defended at two layers: <code>htmlparser2</code> was upgraded to
12.x, whose tokenizer closes these end tags correctly, and the raw text
sanitize-html emits for these tags is always escaped so no
<code>&lt;</code> can reopen a tag when the output is re-parsed
(<code>textarea</code>, an RCDATA element whose entities
<code>htmlparser2</code> decodes, is escaped like normal text, while
<code>xmp</code>, a raw-text element, has only its angle brackets
escaped to avoid double-encoding already-encoded entities). Because
<code>htmlparser2</code> is ESM-only from version 11 onward,
<code>sanitize-html</code> now requires Node.js
<code>&gt;=22.12.0</code> (the first 22.x release in which
<code>require()</code> of an ES module is available unflagged). Thanks
to <a href="https://github.com/bibu123456">bibu123456</a> for reporting
the vulnerability and <a href="https://github.com/Kayiz-PT">Kayiz-PT</a>
for coordinating the disclosure (GHSA-jxwj-j7wr-gfrw).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/apostrophecms/apostrophe/commits/HEAD/packages/sanitize-html">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=sanitize-html&package-manager=npm_and_yarn&previous-version=2.17.5&new-version=2.17.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-01 11:11:32 +00:00
dependabot[bot] e0fc756a75 chore: bump prettier from 3.9.4 to 3.9.6 in /offlinedocs (#27737) 
Bumps [prettier](https://github.com/prettier/prettier) from 3.9.4 to
3.9.6.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/prettier/prettier/releases">prettier's
releases</a>.</em></p>
<blockquote>
<h2>3.9.6</h2>
<h2>What's Changed</h2>
<ul>
<li>Preserve quotes for methods named <code>new</code> (<a
href="https://redirect.github.com/prettier/prettier/pull/19621">prettier/prettier#19621</a>
by <a href="https://github.com/kovsu"><code>@​kovsu</code></a>)</li>
<li>Support <code>import defer</code> in <code>typescript</code> parser
(<a
href="https://redirect.github.com/prettier/prettier/pull/19624">prettier/prettier#19624</a>,
<a
href="https://redirect.github.com/prettier/prettier/pull/19675">prettier/prettier#19675</a>
by <a href="https://github.com/fisker"><code>@​fisker</code></a>)</li>
<li>Added a new official plugin <a
href="https://github.com/prettier/prettier/tree/3.9.6/packages/plugin-yuku"><code>@prettier/plugin-yuku</code>
🚀</a> (<a
href="https://redirect.github.com/prettier/prettier/pull/19628">prettier/prettier#19628</a>,
<a
href="https://redirect.github.com/prettier/prettier/pull/19629">prettier/prettier#19629</a>
by <a href="https://github.com/fisker"><code>@​fisker</code></a>)</li>
</ul>
<p>🔗 <a
href="https://github.com/prettier/prettier/blob/3.9.6/CHANGELOG.md#396">Changelog</a></p>
<h2>3.9.5</h2>
<p>🔗 <a
href="https://github.com/prettier/prettier/blob/3.9.5/CHANGELOG.md#395">Changelog</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/prettier/prettier/blob/main/CHANGELOG.md">prettier's
changelog</a>.</em></p>
<blockquote>
<h1>3.9.6</h1>
<p><a
href="https://github.com/prettier/prettier/compare/3.9.5...3.9.6">diff</a></p>
<h4>TypeScript: Preserve quotes for methods named <code>new</code> (<a
href="https://redirect.github.com/prettier/prettier/pull/19621">#19621</a>
by <a href="https://github.com/kovsu"><code>@​kovsu</code></a>)</h4>
<!-- raw HTML omitted -->
<pre lang="tsx"><code>// Input
interface Container {
  &quot;new&quot;(id: string): number;
}
<p>// Prettier 3.9.5<br />
interface Container {<br />
new(id: string): number;<br />
}</p>
<p>// Prettier 3.9.6<br />
interface Container {<br />
&quot;new&quot;(id: string): number;<br />
}<br />
</code></pre></p>
<h4>TypeScript: Support <code>import defer</code> (<a
href="https://redirect.github.com/prettier/prettier/pull/19624">#19624</a>,
<a
href="https://redirect.github.com/prettier/prettier/pull/19675">#19675</a>
by <a href="https://github.com/fisker"><code>@​fisker</code></a>)</h4>
<!-- raw HTML omitted -->
<pre lang="tsx"><code>// Input
import defer * as foo from &quot;foo&quot;;
<p>// Prettier 3.9.5<br />
import * as foo from &quot;foo&quot;;</p>
<p>// Prettier 3.9.6<br />
import defer * as foo from &quot;foo&quot;;<br />
</code></pre></p>
<h4>JavaScript: Added a new official plugin
<code>@prettier/plugin-yuku</code> (<a
href="https://redirect.github.com/prettier/prettier/pull/19628">#19628</a>,
<a
href="https://redirect.github.com/prettier/prettier/pull/19629">#19629</a>
by <a href="https://github.com/fisker"><code>@​fisker</code></a>)</h4>
<p><code>@prettier/plugin-yuku</code> is powered by <a
href="https://yuku.fyi/">Yuku</a> (A high-performance
JavaScript/TypeScript compiler toolchain written in Zig).</p>
<p>This plugin includes two new parsers: <code>yuku</code> (JavaScript
syntax) and <code>yuku-ts</code> (TypeScript syntax).</p>
<p><strong>To use this plugin:</strong></p>
<ol>
<li>
<p>Install the plugin:</p>
<pre lang="bash"><code>yarn add --dev prettier @prettier/plugin-yuku
</code></pre>
</li>
</ol>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/prettier/prettier/commit/8f0c95057cc91d5836409466cd9d9af3bb901e84"><code>8f0c950</code></a>
Release 3.9.6</li>
<li><a
href="https://github.com/prettier/prettier/commit/e9107647d0497d8ff1cacbb0f970d4543df77c1c"><code>e910764</code></a>
Update changelog</li>
<li><a
href="https://github.com/prettier/prettier/commit/ec3f1c7bd74495992bc6954323a1a7fc8368808e"><code>ec3f1c7</code></a>
Update typescript-eslint to v8.65.0 (<a
href="https://redirect.github.com/prettier/prettier/issues/19675">#19675</a>)</li>
<li><a
href="https://github.com/prettier/prettier/commit/73d2efc2c6cba6f579585c88ef171132d90834ec"><code>73d2efc</code></a>
Update Yuku parser to v0.7.0 (<a
href="https://redirect.github.com/prettier/prettier/issues/19664">#19664</a>)</li>
<li><a
href="https://github.com/prettier/prettier/commit/dd5e24eabeab1f75ad573c79781e5fd408bcfad3"><code>dd5e24e</code></a>
Preserve quotes for <code>TSMethodSignature</code> nodes named
<code>new</code> (<a
href="https://redirect.github.com/prettier/prettier/issues/19621">#19621</a>)</li>
<li><a
href="https://github.com/prettier/prettier/commit/c03ab4e71c23154d6b11537eee3c938f0d0f67d3"><code>c03ab4e</code></a>
Update dependency eslint-plugin-unicorn to v72 (<a
href="https://redirect.github.com/prettier/prettier/issues/19633">#19633</a>)</li>
<li><a
href="https://github.com/prettier/prettier/commit/b74dd53076c7208291a6b2e585c310844b41d35f"><code>b74dd53</code></a>
Update Yuku parser to v0.6.5 (<a
href="https://redirect.github.com/prettier/prettier/issues/19654">#19654</a>)</li>
<li><a
href="https://github.com/prettier/prettier/commit/f1b594ea1db1520c383d0e281d623551f671f824"><code>f1b594e</code></a>
Update dependency eslint-plugin-simple-import-sort to v14 (<a
href="https://redirect.github.com/prettier/prettier/issues/19655">#19655</a>)</li>
<li><a
href="https://github.com/prettier/prettier/commit/0d9dfb61530986373000dd107ea58ceebb79e233"><code>0d9dfb6</code></a>
Update Yuku parser to v0.6.4 (<a
href="https://redirect.github.com/prettier/prettier/issues/19650">#19650</a>)</li>
<li><a
href="https://github.com/prettier/prettier/commit/3bbb8159eb55575d4042653aa99f5f92a1416c19"><code>3bbb815</code></a>
Remove <code>typescript-only</code> directory (<a
href="https://redirect.github.com/prettier/prettier/issues/19636">#19636</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/prettier/prettier/compare/3.9.4...3.9.6">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=prettier&package-manager=npm_and_yarn&previous-version=3.9.4&new-version=3.9.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-01 11:11:07 +00:00
Jake Howell 79724ab0ba chore(site): migrate all <Dialog />s off MUI (#27506) 
> 🤖 This PR was modified by Coder Agents on behalf of Jake Howell.

Removes Material UI from every dialog, moving them onto the internal
shadcn/radix `Dialog` primitives. After this change there are **no**
`@mui/material/Dialog` usages left in `site/src`.

## Changes

- Consolidated `components/Dialogs/*` → `components/Dialog/*` and folded
the old `ConfirmDeleteDialog` into `ConfirmDialog` (`type="delete"`).
- Rewrote `ConfirmDialog`, `DeleteDialog`, `WorkspaceDeleteDialog`,
`ScheduleDialog`, and `AnnouncementBannerDialog` onto the internal
primitives (native `Input`/`Label`/`Checkbox`/`Link` instead of MUI).
- Finished the migration for the last two MUI hold-outs:
`UpdateBuildParametersDialog` and `MissingTemplateVariablesDialog`.
- Dialog prop types now compose the rendered component's props
(`ComponentProps<typeof Dialog>` / MUI `DialogProps`) instead of
hand-rolled `{ open; onOpenChange }` shapes.

## Testing

AI-Driven manual dogfood sweep in a live instance (premium license),
driven in a browser. Each dialog checked for logical rendering (layout,
variant styling, buttons, no overlap/blank/console error) and function
(open, primary action, cancel/close, guard states):

| Dialog / surface | How tested | Result |
| --- | --- | --- |
| `ConfirmDialog` (delete / info / success) | Token delete,
update-confirm, change-version | ✅ |
| `DeleteDialog` (type-to-confirm) | Delete user, group, license,
provider, OAuth2 app | ✅ |
| `WorkspaceDeleteDialog` | Workspace actions → Delete (+ orphan path
via failed workspace) | ✅ |
| `ScheduleDialog` | Template schedule → dormancy/deletion warning | ✅ |
| `AnnouncementBannerDialog` | Deployment → Appearance → New banner
(live preview + color) | ✅ |
| `ChangeWorkspaceVersionDialog` | Workspace actions → Change version |
✅ |
| `DownloadLogsDialog` | Workspace actions → Download logs | ✅ |
| Batch delete (workspaces) | Workspaces list → multi-select → Delete |
✅ |
| `TemplatePageHeader` delete | Template → Delete (cancelled) | ✅ |
| `FileDialog` (create/rename/delete) | Template editor file tree | ✅ |
| `MissingTemplateVariablesDialog` *(migrated)* | Editor → add variable
→ Build | ✅ |
| `PublishTemplateVersionDialog` | Editor → Publish | ✅ |
| `UpdateBuildParametersDialog` *(migrated)* | Classic flow + required
param → workspace Update (renders + submits) | ✅ |
| Update-confirmation (`WorkspaceUpdateDialogs`) | Workspace Update | ✅
|
| Suspend/activate confirm | Users → member row | ✅ |
| `ResetPasswordDialog` | Users → member → Reset password | ✅ |
| Token delete confirm | Settings → Tokens | ✅ |
| Create-token confirm | Token create flow | ✅ |
| SSH key regenerate confirm | Settings → SSH Keys | ✅ |
| Change-login-type confirm | Settings → Security | ✅ |
| Secret delete | Settings → Secrets | ✅ |
| Group delete | Admin → Groups | ✅ |
| Org member remove | Admin → Organization → Members | ✅ |
| License remove | Deployment → Licenses (cancelled) | ✅ |
| Announcement banner delete | Deployment → Appearance | ✅ |
| OAuth2 app delete | Deployment → OAuth2 apps | ✅ |
| `ModelFormDialogs` (form + delete) | AI → Models | ✅ |
| Provider delete | AI → Providers | ✅ |
| Gateway key create/delete | AI → Gateway keys | ✅ |
| `MCPServerFormDialogs` delete | AI → MCP servers | ✅ |
| Personal skill (create form + delete) | Agents → Personal Skills | ✅ |
| Spend user-override (add + delete) | AI → Spend | ✅ |

Human tested:

- [x] template version promote/archive
- [x] external-auth/OAuth2-provider delete 
- [x] custom-role delete
- [x] cancel-provisioner-job

Things that have a chance to bleed:

- tasks dialogs
- dormant inline confirm

Should be known that each of these renders through the already-verified
`ConfirmDialog`/`DeleteDialog`, so the underlying component is covered
even where the specific trigger wasn't reachable.

<details>
<summary>Plan &amp; decision log</summary>

**Goal:** finish the de-MUI migration everywhere and confirm every
affected modal renders logically and functions.

**Phase 1 - complete the migration**

- Confirmed only two files still rendered MUI `Dialog`
(`UpdateBuildParametersDialog`, `MissingTemplateVariablesDialog`);
ported both to the internal primitives, preserving the `{ open, onClose,
... }` public API (mapped to `onOpenChange` internally) so call sites
were unchanged. radix now wires `aria-labelledby`/`aria-describedby`,
removing a duplicated element id.

**Phase 2 - sighting sweep (live browser, premium license)**

- Batch A (workspaces/tasks): 4 PASS, rest state-gated.
- Batch B (templates): `MissingTemplateVariablesDialog`, `FileDialog`,
`PublishTemplateVersionDialog`, template delete - all PASS.
- `UpdateBuildParametersDialog`: reached by enabling classic parameter
flow + pushing a version with a required parameter - PASS (renders +
submits).
- Batch C (users/org/settings): 10 PASS.
- Batch D (deployment/AI): 10 PASS.

**Decisions**

- Kept `ConfirmDialog`-wrapper prop types explicit (composing
`DialogProps` there reintroduced a MUI smell).
- Dropped the unused `ConfirmDialogType` export (knip) and updated the
`WorkspacePage` orphan-delete test: the radix `Checkbox` puts the test
id on the `role=checkbox` button itself, so the previous
`within(...).getByRole` no longer matched.

</details>
 2026-07-31 03:23:00 +00:00
Michael Suchacz bc9c7855d9 fix: build actionlint from source to avoid the shellcheck deadlock (#27679) 2026-07-31 02:42:49 +02:00
dylanhuff-at-coder e30a7bcd0d fix(site/src/pages/UserSettingsPage/SecretsPage): prevent Add secret dialog overflow (#27649) 2026-07-30 18:14:34 -04:00
Danielle Maywood 46d01fca65 refactor(site/src/pages/AgentsPage/components/ChatElements/tools): replace label/icon switches with tables and registry invariants (#27706) 
Stacked on #27697. Do not merge before it; this diff is against that
branch, not main.

Replaces the `ToolLabel` and `ToolIcon` string switches with lookup
tables, and makes the registry/table agreement a CI failure instead of a
manual audit. No behaviour change; every label and icon renders
identically.

## Why

Three enumerations of the same tool-name set (`toolRenderers`, the label
switch, the icon switch) were kept in agreement by convention alone, and
drifted repeatedly (#27684, #27687, #27697 each deleted arms a
registered renderer had silently shadowed). Switches are unenumerable,
so the drift was invisible to both tsc and tests.

## What changed

- `genericToolLabels` (ToolLabel.tsx): the four generic-rendered labels
(`process_signal`, `process_list`, `attach_file`, `advisor`) as a
`Partial<Record<string, FC>>`. `ToolLabel` is now a table lookup plus
the MCP/raw-name fallback.
- `toolIcons` (ToolIcon.tsx): all 19 built-in icon names as a
`Partial<Record<string, LucideIcon>>`, same pattern. Unknown/MCP names
still fall to `WrenchIcon`.
- `Tool.tsx`: exports `toolRenderers` (it is the single source of truth
for dispatch; the tests read it directly).
- `toolLabelVisibility.test.ts`: fails if a registered renderer that
does not delegate to `GenericToolRenderer` shadows a `genericToolLabels`
entry, naming the arm. `process_signal` (known delegator) and `advisor`
(consumed directly by `AdvisorTool`) are allowlisted in the test. This
is the tripwire requested in review on #27697, as a CI failure rather
than a comment.
- `toolIconsCoverage.test.ts`: fails if a registered renderer has no
dedicated icon, with `read_skill_file` allowlisted for its `read_skill`
icon alias.

## Design notes

- The invariant checks live in tests, not in the type system. TypeScript
cannot assert a runtime object's key set against an independent intent
without either re-listing the names (the `satisfies Record<union, ...>`
approach, rejected as ugly repetition) or abusing conditional types. The
tables are plain objects; the tests own the invariant. A generated union
from the Go `chattool` constants is the proper long-term fix and is
deliberately out of scope.
- No `as const` / union key types: they added annotation without buying
safety the tests don't already provide, and nothing consumes `keyof
typeof` here.

## Validation

- `tsc --noEmit`, `biome check --error-on-warnings`, knip: clean.
- Unit (`--project=unit src/pages/AgentsPage`): 1502 passed, 2 skipped
(base: 1500/2; +2 are the new invariant tests).
- Storybook (`--project=storybook src/pages/AgentsPage`): 949 passed, 2
failed, identical to base: `AgentChatPageView.stories.tsx > Scroll To
Bottom Button Works With Inverse Scroll` and `Tool.stories.tsx > MCP
Tool Completed`. Both reproduce on unmodified main, so pre-existing and
unrelated. One additional flake (`AgentChatPage.stories.tsx > Slash
Compact Yields To Personal Skill`) failed once under parallel load and
passed in isolation on the final code.
- Line delta vs #27697: +148 / -98 across 5 files.

Generated by Coder Agents.
 2026-07-30 22:58:57 +01:00
Danielle Maywood 9bc681fa6e fix(site/src/pages/AgentsPage/components/ChatElements/tools): delete unreachable switch arms from ToolLabel and ToolIcon (#27697) 
Deletes unreachable switch arms from `ToolLabel` (14 arms) and
`ToolIcon` (1 arm). No behaviour change; the deleted arms could never be
reached, so the rendered output is identical.

## Reachability proof

`ToolLabel` has exactly two call sites:

1. `Tool.tsx` `GenericToolRenderer` (line 950), reached when a tool name
has no `toolRenderers` entry or when its registered renderer delegates
to `GenericToolRenderer`.
2. `AdvisorTool.tsx` (line 72), which hardcodes `name="advisor"`.

Dispatch in `Tool.tsx`: subagent names (`spawn_agent`, `wait_agent`,
`message_agent`, `interrupt_agent`, plus legacy `spawn_subagent`,
`close_agent`) route to `SubagentRenderer`; everything else hits
`toolRenderers[name] ?? GenericToolRenderer`. None of the subagent names
appear in either switch.

Every registered renderer was checked for delegation:

| ToolLabel arm | Shadowing renderer | Delegates? |
| --- | --- | --- |
| `execute` | `ExecuteRenderer` -> `ExecuteTool` | No |
| `process_output` | `ProcessOutputRenderer` -> `ProcessOutputTool` | No
|
| `read_file` | `ReadFileRenderer` -> `ReadFileTool` | No |
| `write_file` | `WriteFileRenderer` -> `WriteFileTool` | No |
| `edit_files` | `EditFilesRenderer` -> `EditFilesTool` | No |
| `create_workspace` | `CreateWorkspaceRenderer` ->
`CreateWorkspaceTool` | No |
| `start_workspace` | `StartWorkspaceRenderer` -> `StartWorkspaceTool` |
No |
| `list_templates` | `ListTemplatesRenderer` -> `ListTemplatesTool` | No
|
| `read_template` | `ReadTemplateRenderer` -> `ReadTemplateTool` | No |
| `read_skill` | `ReadSkillRenderer` -> `ReadSkillTool` | No |
| `read_skill_file` | `ReadSkillFileRenderer` -> `ReadSkillTool` | No |
| `chat_summarized` | `ChatSummarizedRenderer` -> `ChatSummarizedTool` |
No |
| `propose_plan` | `ProposePlanRenderer` -> `ProposePlanTool` | No |
| `computer` | `ComputerRenderer` -> `ComputerTool` | No |

Kept arms:

- `process_signal`: `ProcessSignalRenderer` IS a registry key but
delegates to `GenericToolRenderer`, so the arm stays reachable. Kept.
- `advisor`: hardcoded by `AdvisorTool.tsx`. Kept.
- `process_list`, `attach_file`: no registry entry, not subagent names,
so they fall through to `GenericToolRenderer`. Kept.
- `default`: covers MCP tools and any unregistered name. Kept.

`ToolIcon` is rendered by `ToolCall.LeadingIcon` / `ToolCall.Header
iconName`, and every dedicated per-tool component passes its own fixed
name (`execute`, `process_output`, `read_file`, `write_file`,
`edit_files`, `list_templates`, `read_template`, `read_skill`,
`chat_summarized`, `ask_user_question`, `propose_plan`, `computer`,
`start_workspace`, `list_agents`, `create_workspace`, `advisor`), so
those arms are reachable and kept. `thinking` is passed directly from
`StreamingOutput.tsx` and `ConversationTimeline.tsx`, and
`chat_summarized` covers `list_agents` via the shared `BotIcon` arm.
`read_skill_file` is the only arm whose renderer
(`ReadSkillFileRenderer`) renders `ReadSkillTool` with the hardcoded
`iconName="read_skill"`, so nothing ever passes `read_skill_file` to
`ToolIcon`. That arm alone is deleted.

No exports, helpers, or imports became dead (verified with knip, which
passes clean).

## Delta and tests

- Line delta: -119 (ToolLabel -118, ToolIcon -1), 0 insertions.
- Unit (`--project=unit src/pages/AgentsPage`): 1500 passed, 2 skipped
before and after.
- Storybook (`--project=storybook src/pages/AgentsPage`): 949 passed, 2
failed before and after, identical failures both runs:
`AgentChatPageView.stories.tsx > Scroll To Bottom Button Works With
Inverse Scroll` and `Tool.stories.tsx > MCP Tool Completed`. Both
reproduce on unmodified main (MCP Tool Completed also fails in isolation
on main), so they are pre-existing and unrelated.
- `tsc --noEmit`, `biome check --error-on-warnings`, and knip all pass.

Generated by Coder Agents.
 2026-07-30 22:58:57 +01:00
Jeremy Ruppel 218829d444 refactor(site): use uuid package instead of generateUUID helper (#27709) 2026-07-30 16:52:29 -04:00
McKayla はな 6cfefc0685 chore: replace isChromatic with isPixel (#26832) 
Swaps `chromatic/isChromatic` for `@coder/pixel-storybook`'s `isPixel()`
so the
snapshot-determinism gates (fixed workspace name, frozen Spinner, fixed
CLI
origin, no scroll, font loader) fire under pixel instead of Chromatic.
Drops the
now-unused `chromatic` dependency.

Stacked on #27658 (pixel-storybook 0.3); `isPixel` comes from the new
`@coder/pixel-storybook/storyapi` subpath. Verified the app and
Storybook
builds both bundle `isPixel` cleanly, and `tsc` passes with the
dependency
removed.

This is the last piece of the Chromatic removal; the story params
migrated in
#26844 and the addon came out in #27353.

<details>
<summary>Chromatic removal sequence</summary>

1. Remove the Chromatic CI job + scripts + docs reference. (#26777,
merged)
2. **This PR** — `isChromatic()` → `isPixel()`; drop the `chromatic`
dependency.
3. `data-pixel` + `pixel.exclude`; drop `delay` / `pauseAnimationAtEnd`.
(#26778,
   merged)
4. Migrate story snapshot params (`viewports` / `diffThreshold` / theme
modes →
   `pixel.matrix`); delete `testHelpers/chromatic.ts`. (#26844, merged)
5. Remove the `@chromatic-com/storybook` addon. (done on main in #27353)

</details>

---

> Generated by Coder Agents on behalf of @aslilac.
 2026-07-30 11:47:26 -06:00
McKayla はな 95275d9659 chore: upgrade to @coder/pixel-storybook 0.3 (#27658) 
includes some fixes to improve performance and reduce the number of
false positives
 2026-07-30 11:47:25 -06:00
Josh FreeandCopilot 2acfe7e829 feat(coderd/externalauth/gitprovider): use conditional requests for GitHub JSON reads (#27628) 
Fixes #27627.

## What

The chat diff-status gitsync worker polls open pull requests on a fixed
10s interval and re-downloads the full JSON body every tick, even when
nothing changed, because the GitHub client never sends `If-None-Match` /
ETag.

This adds a small, concurrency-safe, bounded in-memory ETag+body cache
(`coderd/externalauth/gitprovider/conditional.go`) and wires it into
`githubProvider.decodeJSON`. When an ETag is cached for a request, we
send `If-None-Match`; on `304 Not Modified` we decode the cached body;
on `200` we cache `{etag, body}` when an ETag is present and the body is
under a size cap.

## Why

`304` responses do not count against GitHub's primary rate limit, but
full `200`s do. Today every unchanged poll burns quota that the same
token also needs for interactive Git and API operations, so busy
instances can hit rate-limit errors and stalls elsewhere. Unchanged PRs
now revalidate for free with no behavior change; only genuine changes
transfer a body.

## Details

- Cache key = request URL + a hash of the token, so one token's response
is never served under another; raw tokens are not retained.
- Bounded by entry count (LRU eviction, default 2048) and per-body size
(1 MiB) to cap memory.
- Scope limited to the JSON reads through `decodeJSON`; the raw-diff
path (`fetchDiff`, up to `MaxDiffSize`) is intentionally left out to
avoid caching large bodies.

## Tests

`TestConditionalRequestReuse` in `github_test.go` covers:
- `NotModifiedReusesCachedBody` — a warm poll sends `If-None-Match` with
the prior ETag and reuses the cached body on `304`, yielding the same
result with exactly two upstream requests.
- `DifferentTokenDoesNotShareCache` — a different token never sends
another token's cached ETag.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 4959e1f9-f8e6-4e97-a487-f395a0123c79
 2026-07-30 17:36:39 +01:00
Paweł Banaszewski 6df24634fd fix: remove nodePort from required service fields of ai-gateway chart (#27696) 
Updates schema for ai-gateway chart. Missing piece from
https://github.com/coder/coder/pull/27682
 2026-07-30 17:53:28 +02:00
Danielle Maywood 11e03cfb3a fix(site/src/pages/AgentsPage/components/ChatElements/tools): delete dead execute auth_required flow (#27687) 
Stacked on #27684. Addresses review note CRF-2 from that PR: the kept
`auth_required` execute path is dead by the same premise that PR proved
for `wait_for_external_auth`.

The chatd execute tool's `ExecuteResult` struct
(`coderd/x/chatd/chattool/execute.go:79-88`) has no `auth_required`,
`authenticate_url`, or `provider_*` fields, so the execute tool cannot
emit the payload this path parsed. The `authenticate_url` matches
elsewhere in Go are the unrelated workspace-creation external-auth flow
(`codersdk.TemplateVersionExternalAuth`). Per `bb3a363ed4`, the
`auth_required` execute payload was written and removed on an unmerged
branch before #22290 squash merged, so no server version ever emitted
it.

Removes:
- `ExecuteAuthRequiredTool` and its `ExecuteRenderer` branch
- the `authenticateURL`/`providerLabel` chain in `getExecuteRenderData`,
and the `Boolean(data.authenticateURL)` disjunct in
`shouldRenderExecuteTool`
- the `ExecuteAuthRequired` Storybook story
- the now-dead `toProviderLabel` helper and its test block
- the `auth_required` visibility test case

The `providerLabel` identifiers elsewhere under `site/src`
(ModelSelector, ModelRow, AISettings) belong to the unrelated AI
model/provider selector and are untouched.

🤖 This pull request was created with Coder Agents.
 2026-07-30 16:20:11 +01:00
Danielle Maywood 4003f0086f fix(site/src/pages/AgentsPage/components/ChatElements/tools): delete unreachable WaitForExternalAuth tool code (#27684) 
The backend never emits a `wait_for_external_auth` tool call (no
references in any Go source, the chatd tool registry, or anywhere
outside the frontend), so the entire frontend rendering path for it was
unreachable.

Removes the `WaitForExternalAuthTool` component, its renderer and
`toolRenderers` entry, the `ToolIcon` case, and the four Storybook
stories, along with the imports that only they used (`CheckIcon`,
`LoaderIcon`, `LogInIcon`, and `toProviderLabel` in `Tool.tsx`).

Kept the separate, live `execute` auth-required flow:
`ExecuteAuthRequiredTool` and the `toProviderLabel` usage in
`toolVisibility.ts` belong to the `authenticateURL` path, not this dead
tool.

Refs #27593

🤖 This pull request was created with Coder Agents.
 2026-07-30 16:20:10 +01:00
Susana Ferreira 3f1973f45c docs: document AI Gateway cost controls (#27643) 
### Description

Adds documentation for AI Governance Cost Control, including how
administrators configure budgets, how effective groups are resolved, how
enforcement works, and where spend reporting is available.

### Changes

- Replace the placeholder cost control page with a full admin guide
- Document deployment settings, group budgets, user overrides, and
effective group resolution
- Explain estimated spend, unpriced models, notifications, enforcement,
and spend reporting
- Add migration guidance for Coder Agents Cost Control
- Add screenshots for group budgets and user overrides

Closes
[AIGOV-476](https://linear.app/codercom/issue/AIGOV-476/add-documentation-for-ai-bridge-cost-controls).

> [!NOTE]
> Initially generated by Coder Agents, modified and reviewed by
@ssncferreira
 2026-07-30 15:04:39 +00:00