opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity
15,594 Commits 479 Branches 388 Tags
fc24c27dfd660fa05c601b7fb571ac6b480ea0e2
Commit Graph
15594 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Atif Ali 48e9bb3391 fix(coderd): explain default GitHub app org visibility on login rejection (#27374) 
## Problem

On a fresh deployment with no custom GitHub OAuth app, Coder falls back
to the default Coder-managed GitHub app. That app can only see
organization memberships in organizations where it has been installed.
If `CODER_OAUTH2_GITHUB_ALLOWED_ORGS` is set but the app isn't installed
in the allowed organizations, the membership list comes back empty and
every login, including the first admin login, is rejected with a bare
"You aren't a member of the authorized Github organizations!" with no
hint about the actual cause. This leaves fresh deployments in an
apparently broken state.

## Fix

* Append a remediation hint to the login rejection when the default
provider is configured, pointing at the [app installation
page](<https://github.com/apps/coder/installations/select_target>) and
at configuring a custom GitHub OAuth app.
* Log a startup warning when the default provider is combined with
`CODER_OAUTH2_GITHUB_ALLOWED_ORGS`, listing the allowed orgs and the
install URL.
* Document the installation requirement next to the
`CODER_OAUTH2_GITHUB_ALLOWED_ORGS` step in the GitHub auth docs.

Access-control behavior is unchanged; the org check still rejects logins
as before, it just explains why and how to fix it.

## Testing

* New `TestUserOAuth2Github/NotInAllowedOrganizationDefaultProvider`
asserts the hint appears when `DefaultProviderConfigured` is set; the
existing `NotInAllowedOrganization` subtest asserts it does not leak
into the custom-app path.

Fixes coder/coder#17752
 2026-07-21 20:43:10 +05:00
Sas SwartandClaude Opus 4.8 a9a1dcc65d feat: add network calls column to AI sessions table (#27269) 
Add a "Total/blocked network calls" column to the AIBridge sessions
table.

Update `ListAIBridgeSessions` query to calculate network called made and
blocked per session. See query plan
[here](https://explain.dalibo.com/plan/54355c90b165ggb4).

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
 2026-07-21 14:34:23 +02:00
Cian Johnston bce9ba3356 chore: update CODEOWNERS for both aibridged and chatd (#27376) 2026-07-21 13:22:24 +01:00
Thomas Kosiewski aa89801ee5 fix(coderd/x/chatd/chatadvisor): textualize advisor prompt tool exchanges (#27059) 
Closes CODAGT-592.

## Problem

The advisor tool sometimes fails with the opaque error `advisor produced
no text output`. Live reproduction against `claude-sonnet-4-6` showed
the cause: `BuildAdvisorMessages` forwards the parent conversation's raw
`tool_use`/`tool_result` blocks into the nested advisor call, which
defines no tools. The nested model imitates the forwarded pattern and
spends its turn committing to a tool call it cannot make (captured
reasoning from a failing run: "The user wants me to make another tool
call to the advisor about writing a poem about cucumbers."), so the step
ends with reasoning-only or empty content and no advice. Because each
chat step currently rebuilds the advisor runtime and snapshot
(CODAGT-593), the second advisor call in a run reliably sees the first
call's exchange, which is why the first call succeeds and later ones
fail.

## Fix

- `BuildAdvisorMessages` rewrites tool activity as plain-text notes:
assistant tool-call parts are removed and folded, together with their
matching result, into a single user-role note of the form `[The parent
agent ran the X tool with input {...}. Result: ...]`. No raw tool blocks
and no bare call lines reach the tool-less nested request. This also
removes the provider requirement that `tool_result` blocks pair with a
`tool_use`, so results orphaned by window truncation are kept as notes
instead of dropped.
- The `advisor produced no text output` error now appends the finish
reason and content-part kinds, e.g. `advisor produced no text output
(finish_reason=stop; parts: reasoning=1)`, so field reports distinguish
tool-call mimicry, reasoning-only turns, and truncation.

Validated live by driving the production `RunAdvisor` path against
`claude-sonnet-4-6` through the dev.coder.com AI gateway: the failing
scenario went from 3/3 errors to 6/6 genuine advice (with and without
extended thinking), with the control scenario unaffected.

Related: CODAGT-593 (per-step advisor runtime recreation, addressed
separately) and CODAGT-742 (advisor tool call design).

<details>
<summary>Investigation and validation details</summary>

### Reproduction

A CLI prototype constructed the exact conversation snapshot the
generation preparer hands the advisor tool and called the real
`chatadvisor.NewRuntime` / `Runtime.RunAdvisor` / `BuildAdvisorMessages`
/ `chatloop.GenerateAssistant` chain against live `claude-sonnet-4-6`,
with a stream-teeing model wrapper capturing what `runner.go` discards
(finish reason, part kinds, reasoning text).

| Scenario (snapshot contents) | Thinking | Before fix | After fix |
|---|---|---|---|
| control: call #1 state, no prior advisor exchange | on | 3/3 advice |
2/2 advice |
| repro: call #2 state, prior advisor `tool_use`/`tool_result` pair
forwarded | on | 3/3 `advisor produced no text output` | 3/3 genuine
advice |
| repro | off | 2/3 same error, 1/3 degenerate advice ("I'll ask the
advisor...") | 3/3 genuine advice |

Every failing response was a tiny thinking block, zero text, zero
tool-call stream parts, finish reason `stop`; the model's own reasoning
text showed it deciding to "make the second tool call" in a request with
`tools=0`. The refunded `remaining_uses: 1200` in the failing
tool-result JSON matches the original issue screenshot.

### Decision log

- Tool exchanges are folded into a single user-role note per call/result
pair. A first attempt rendered assistant-authored `[tool call:
name(input)]` text lines plus separate result messages; live runs then
returned the literal `[tool call: advisor(...)]` line as the advice 6/6
times. The bare assistant call line is itself an imitable pattern, so no
assistant-authored tool artifact may survive the handoff. The folded
user-role note produced 6/6 genuine advice.
- An assistant message that carried only tool calls is dropped entirely;
the folded notes preserve the information.
- `dropOrphanToolMessages` was removed: without raw tool blocks there is
no provider pairing constraint, and an orphaned result note retains
context value.
- A reasoning-budget-starvation hypothesis (thinking budget consuming
`MaxOutputTokens`) did not reproduce on `claude-sonnet-4-6`; the model
adapts thinking length to the cap. The enriched error would identify
such cases on other models via `finish_reason=length`.
- CODAGT-593 (persisting the advisor runtime across steps) is
intentionally not addressed here; it shrinks the priming window but the
handoff fix is what removes the failure mode.

</details>

---

*This PR was generated by Coder Agents on behalf of @ThomasK33 (Linear
agent session for CODAGT-592).*
 2026-07-21 13:38:20 +02:00
Danielle Maywood 6014a44c85 fix(site): keep mobile model picker effort row and last model visible (#27336) 2026-07-21 12:37:55 +01:00
dependabot[bot] 850c6a712d ci: bump the github-actions group with 6 updates (#27373) 
Bumps the github-actions group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/setup-java](https://github.com/actions/setup-java) | `5.5.0`
| `5.6.0` |
| [fluxcd/flux2/action](https://github.com/fluxcd/flux2) | `2.9.1` |
`2.9.2` |
|
[github/codeql-action/upload-sarif](https://github.com/github/codeql-action)
| `4.36.3` | `4.37.0` |
| [github/codeql-action/init](https://github.com/github/codeql-action) |
`4.36.3` | `4.37.0` |
|
[github/codeql-action/analyze](https://github.com/github/codeql-action)
| `4.36.3` | `4.37.0` |
| [actions/stale](https://github.com/actions/stale) | `10.3.0` |
`10.4.0` |

Updates `actions/setup-java` from 5.5.0 to 5.6.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/setup-java/releases">actions/setup-java's
releases</a>.</em></p>
<blockquote>
<h2>v5.6.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Backport to v5: Add Maven compiler problem matcher for javac
diagnostics by <a
href="https://github.com/brunoborges"><code>@​brunoborges</code></a> in
<a
href="https://redirect.github.com/actions/setup-java/pull/1087">actions/setup-java#1087</a></li>
<li>feat: expose cache-primary-key output (<a
href="https://redirect.github.com/actions/setup-java/issues/597">#597</a>)
[v5 backport] by <a
href="https://github.com/brunoborges"><code>@​brunoborges</code></a> in
<a
href="https://redirect.github.com/actions/setup-java/pull/1089">actions/setup-java#1089</a></li>
<li>dist: Cover Tencent Kona JDK 25 (<a
href="https://redirect.github.com/actions/setup-java/issues/1108">#1108</a>)
[v5 backport] by <a
href="https://github.com/brunoborges"><code>@​brunoborges</code></a> in
<a
href="https://redirect.github.com/actions/setup-java/pull/1110">actions/setup-java#1110</a></li>
<li>Backport <a
href="https://redirect.github.com/actions/setup-java/issues/1111">#1111</a>:
Preserve Maven toolchains across repeated setup-java runs (<a
href="https://redirect.github.com/actions/setup-java/issues/1099">#1099</a>)
by <a
href="https://github.com/brunoborges"><code>@​brunoborges</code></a> in
<a
href="https://redirect.github.com/actions/setup-java/pull/1113">actions/setup-java#1113</a></li>
<li>Backport <a
href="https://redirect.github.com/actions/setup-java/issues/1097">#1097</a>/<a
href="https://redirect.github.com/actions/setup-java/issues/1098">#1098</a>
to v5: cache Maven and Gradle wrapper distributions separately by <a
href="https://github.com/brunoborges"><code>@​brunoborges</code></a> in
<a
href="https://redirect.github.com/actions/setup-java/pull/1122">actions/setup-java#1122</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-java/compare/v5...v5.6.0">https://github.com/actions/setup-java/compare/v5...v5.6.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/setup-java/commit/03ad4de0992f5dab5e18fcb136590ce7c4a0ac95"><code>03ad4de</code></a>
Backport <a
href="https://redirect.github.com/actions/setup-java/issues/1097">#1097</a>/<a
href="https://redirect.github.com/actions/setup-java/issues/1098">#1098</a>:
cache Maven and Gradle wrapper distributions separately...</li>
<li><a
href="https://github.com/actions/setup-java/commit/d229d2e858d9137cc0b3f118fa5184b9f0a44ac4"><code>d229d2e</code></a>
Backport <a
href="https://redirect.github.com/actions/setup-java/issues/1111">#1111</a>:
Preserve Maven toolchains across repeated setup-java runs (<a
href="https://redirect.github.com/actions/setup-java/issues/1">#1</a>...</li>
<li><a
href="https://github.com/actions/setup-java/commit/bbf0f6967066506f72571a96d5d6c67ca42ab460"><code>bbf0f69</code></a>
dist: Cover Tencent Kona JDK 25 (<a
href="https://redirect.github.com/actions/setup-java/issues/1110">#1110</a>)</li>
<li><a
href="https://github.com/actions/setup-java/commit/513edc4f8710565e4ad696f3b7d8e3bda584a46c"><code>513edc4</code></a>
feat: expose cache-primary-key output (<a
href="https://redirect.github.com/actions/setup-java/issues/597">#597</a>)
[v5 backport] (<a
href="https://redirect.github.com/actions/setup-java/issues/1089">#1089</a>)</li>
<li><a
href="https://github.com/actions/setup-java/commit/62df799a9c6e3022bb466697c66c36e9a2dbf347"><code>62df799</code></a>
Add Maven compiler problem matcher for javac diagnostics (<a
href="https://redirect.github.com/actions/setup-java/issues/1087">#1087</a>)</li>
<li><a
href="https://github.com/actions/setup-java/commit/176156a187714aaf460b0a3c8f21e8b4f784b978"><code>176156a</code></a>
chore: bump version to 5.6.0 for v5 release line</li>
<li><a
href="https://github.com/actions/setup-java/commit/bf7b8deac240b9cee05eb15ccdb1d2f424a54b9f"><code>bf7b8de</code></a>
build: rebuild dist for backported changes (<a
href="https://redirect.github.com/actions/setup-java/issues/1079">#1079</a>,
<a
href="https://redirect.github.com/actions/setup-java/issues/1083">#1083</a>,
<a
href="https://redirect.github.com/actions/setup-java/issues/1084">#1084</a>)</li>
<li><a
href="https://github.com/actions/setup-java/commit/0173e6dd1b6e53ac3f6d68d220fa24cce79ae77c"><code>0173e6d</code></a>
Infer distribution from asdf .tool-versions vendor prefix (<a
href="https://redirect.github.com/actions/setup-java/issues/1084">#1084</a>)</li>
<li><a
href="https://github.com/actions/setup-java/commit/f45cd82b67042e9e5c24cef950ea0c61736241c6"><code>f45cd82</code></a>
Rename jdkFile input to jdk-file with deprecated alias (<a
href="https://redirect.github.com/actions/setup-java/issues/1083">#1083</a>)</li>
<li><a
href="https://github.com/actions/setup-java/commit/e2863ad49937c063e5a23922d1971a105f4f0140"><code>e2863ad</code></a>
Map Zulu x86 architecture to i686 for Azul Metadata API (<a
href="https://redirect.github.com/actions/setup-java/issues/1079">#1079</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/setup-java/compare/0f481fcb613427c0f801b606911222b5b6f3083a...03ad4de0992f5dab5e18fcb136590ce7c4a0ac95">compare
view</a></li>
</ul>
</details>
<br />

Updates `fluxcd/flux2/action` from 2.9.1 to 2.9.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/fluxcd/flux2/releases">fluxcd/flux2/action's
releases</a>.</em></p>
<blockquote>
<h2>v2.9.2</h2>
<h2>Highlights</h2>
<p>Flux v2.9.2 is a patch release. The main fix addresses a regression
introduced in
v2.9.1 where a Kustomization with <code>openapi.path</code> pointing to
a URL failed to
reconcile with <code>failed to read OpenAPI schema</code>. This release
also corrects several
CRD field descriptions that contained inaccurate or leaked content.
Users are
encouraged to upgrade for the best experience.</p>
<p>ℹ️ Please follow the <a
href="https://github.com/fluxcd/flux2/discussions/5572">Upgrade
Procedure for Flux v2.7+</a> for a smooth upgrade from Flux v2.6 to the
latest version.</p>
<p>Fixes:</p>
<ul>
<li>Fix a regression where a Kustomization with
<code>openapi.path</code> pointing to a URL failed to reconcile with
<code>failed to read OpenAPI schema</code> (kustomize-controller)</li>
<li>Fix the <code>HelmChart</code> CRD description for
<code>.status.url</code>, which pointed users at
<code>BucketStatus.Artifact</code> instead of
<code>HelmChartStatus.Artifact</code> (source-controller)</li>
<li>Fix the <code>ImageRepository</code> CRD description for
<code>.status.observedExclusionList</code>, which referred to
<code>spec.lastScanResult</code> instead of
<code>status.lastScanResult</code> (image-reflector-controller)</li>
<li>Fix the <code>ImageUpdateAutomation</code> CRD description for
<code>.status.observedSourceRevision</code>, which had a stray Go struct
declaration leaking into it (image-automation-controller)</li>
</ul>
<p>Improvements:</p>
<ul>
<li>Update fluxcd/pkg dependencies</li>
</ul>
<h2>Components changelog</h2>
<ul>
<li>source-controller <a
href="https://github.com/fluxcd/source-controller/blob/v1.9.3/CHANGELOG.md">v1.9.3</a></li>
<li>kustomize-controller <a
href="https://github.com/fluxcd/kustomize-controller/blob/v1.9.3/CHANGELOG.md">v1.9.3</a></li>
<li>helm-controller <a
href="https://github.com/fluxcd/helm-controller/blob/v1.6.2/CHANGELOG.md">v1.6.2</a></li>
<li>notification-controller <a
href="https://github.com/fluxcd/notification-controller/blob/v1.9.2/CHANGELOG.md">v1.9.2</a></li>
<li>image-reflector-controller <a
href="https://github.com/fluxcd/image-reflector-controller/blob/v1.2.3/CHANGELOG.md">v1.2.3</a></li>
<li>image-automation-controller <a
href="https://github.com/fluxcd/image-automation-controller/blob/v1.2.3/CHANGELOG.md">v1.2.3</a></li>
<li>source-watcher <a
href="https://github.com/fluxcd/source-watcher/blob/v2.2.2/CHANGELOG.md">v2.2.2</a></li>
</ul>
<h2>CLI changelog</h2>
<ul>
<li>Update fluxcd/pkg dependencies by <a
href="https://github.com/fluxcdbot"><code>@​fluxcdbot</code></a> in <a
href="https://redirect.github.com/fluxcd/flux2/pull/5984">fluxcd/flux2#5984</a></li>
<li>Update fluxcd/pkg dependencies by <a
href="https://github.com/fluxcdbot"><code>@​fluxcdbot</code></a> in <a
href="https://redirect.github.com/fluxcd/flux2/pull/5990">fluxcd/flux2#5990</a></li>
<li>Update toolkit components by <a
href="https://github.com/fluxcdbot"><code>@​fluxcdbot</code></a> in <a
href="https://redirect.github.com/fluxcd/flux2/pull/5994">fluxcd/flux2#5994</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/fluxcd/flux2/compare/v2.9.1...v2.9.2">https://github.com/fluxcd/flux2/compare/v2.9.1...v2.9.2</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/fluxcd/flux2/commit/6a650dba1b4ae9945185c4bb3cc3f386aaf71b3d"><code>6a650db</code></a>
Merge pull request <a
href="https://redirect.github.com/fluxcd/flux2/issues/5994">#5994</a>
from fluxcd/update-components-release/v2.9.x</li>
<li><a
href="https://github.com/fluxcd/flux2/commit/00b96327ed5c15ba20196e0005627eb837051986"><code>00b9632</code></a>
Update toolkit components</li>
<li><a
href="https://github.com/fluxcd/flux2/commit/dc8430cb71860755d1b90dab23a784fc36eea9ad"><code>dc8430c</code></a>
Merge pull request <a
href="https://redirect.github.com/fluxcd/flux2/issues/5990">#5990</a>
from fluxcd/update-pkg-deps/release/v2.9.x</li>
<li><a
href="https://github.com/fluxcd/flux2/commit/c21de821a91ceea8df417bdb7075e9e2476ca854"><code>c21de82</code></a>
Update fluxcd/pkg dependencies</li>
<li><a
href="https://github.com/fluxcd/flux2/commit/fa3c7b8a0702424a0ccf4ef8f1f7c95b4b1efd2e"><code>fa3c7b8</code></a>
Merge pull request <a
href="https://redirect.github.com/fluxcd/flux2/issues/5984">#5984</a>
from fluxcd/update-pkg-deps/release/v2.9.x</li>
<li><a
href="https://github.com/fluxcd/flux2/commit/de86a518c2b29e47418492f3b3075f8191b6cb20"><code>de86a51</code></a>
Update fluxcd/pkg dependencies</li>
<li>See full diff in <a
href="https://github.com/fluxcd/flux2/compare/f05a280b876a3a1d35a76a91f701e605777853aa...6a650dba1b4ae9945185c4bb3cc3f386aaf71b3d">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action/upload-sarif` from 4.36.3 to 4.37.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/upload-sarif's
releases</a>.</em></p>
<blockquote>
<h2>v4.37.0</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li>
<li>In addition to the existing input format, the
<code>config-file</code> input for the <code>codeql-action/init</code>
step will soon support a new <code>[owner/]repo[@ref][:path]</code>
format. All components except the repository name are optional. If
omitted, <code>owner</code> defaults to the same owner as the repository
the analysis is running for, <code>ref</code> to <code>main</code>, and
<code>path</code> to <code>.github/codeql-action.yaml</code>. Support
for this format ships in this version of the CodeQL Action, but will
only be enabled over the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/upload-sarif's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.37.1 - 16 Jul 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.20.6 and earlier. These versions of
CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise
Server 3.16, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li>
</ul>
<h2>4.37.0 - 08 Jul 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li>
<li>In addition to the existing input format, the
<code>config-file</code> input for the <code>codeql-action/init</code>
step will soon support a new <code>[owner/]repo[@ref][:path]</code>
format. All components except the repository name are optional. If
omitted, <code>owner</code> defaults to the same owner as the repository
the analysis is running for, <code>ref</code> to <code>main</code>, and
<code>path</code> to <code>.github/codeql-action.yaml</code>. Support
for this format ships in this version of the CodeQL Action, but will
only be enabled over the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li>
</ul>
<h2>4.36.3 - 01 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.36.2 - 04 Jun 2026</h2>
<ul>
<li>Cache CodeQL CLI version information across Actions steps. <a
href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li>
<li>Reduce requests while waiting for analysis processing by using
exponential backoff when polling SARIF processing status. <a
href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li>
</ul>
<h2>4.36.1 - 02 Jun 2026</h2>
<p>No user facing changes.</p>
<h2>4.36.0 - 22 May 2026</h2>
<ul>
<li><em>Breaking change</em>: Bump the minimum required CodeQL bundle
version to 2.19.4. <a
href="https://redirect.github.com/github/codeql-action/pull/3894">#3894</a></li>
<li>Add support for SHA-256 Git object IDs. <a
href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5">2.25.5</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3926">#3926</a></li>
</ul>
<h2>4.35.5 - 15 May 2026</h2>
<ul>
<li>We have improved how the JavaScript bundles for the CodeQL Action
are generated to avoid duplication across bundles and reduce the size of
the repository by around 70%. This should have no effect on the runtime
behaviour of the CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3899">#3899</a></li>
<li>For performance and accuracy reasons, <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> will now only be enabled on a pull request when
diff-informed analysis is also enabled for that run. If diff-informed
analysis is unavailable (for example, because the PR diff ranges could
not be computed), the action will fall back to a full analysis. <a
href="https://redirect.github.com/github/codeql-action/pull/3791">#3791</a></li>
<li>If multiple inputs are provided for the GitHub-internal
<code>analysis-kinds</code> input, only <code>code-scanning</code> will
be enabled. The <code>analysis-kinds</code> input is experimental, for
GitHub-internal use only, and may change without notice at any time. <a
href="https://redirect.github.com/github/codeql-action/pull/3892">#3892</a></li>
<li>Added an experimental change which, when running a Code Scanning
analysis for a PR with <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> enabled, prefers CodeQL CLI versions that have
a cached overlay-base database for the configured languages. This speeds
up analysis for a repository when there is not yet a cached overlay-base
database for the latest CLI version. We expect to roll this change out
to everyone in May. <a
href="https://redirect.github.com/github/codeql-action/pull/3880">#3880</a></li>
</ul>
<h2>4.35.4 - 07 May 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4">2.25.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3881">#3881</a></li>
</ul>
<h2>4.35.3 - 01 May 2026</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/99df26d4f13ea111d4ec1a7dddef6063f76b97e9"><code>99df26d</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3996">#3996</a>
from github/update-v4.37.0-c7c896d71</li>
<li><a
href="https://github.com/github/codeql-action/commit/31c27074fda95256cda077009907f8a6022dd7c0"><code>31c2707</code></a>
Add changenote for <a
href="https://redirect.github.com/github/codeql-action/issues/3973">#3973</a></li>
<li><a
href="https://github.com/github/codeql-action/commit/72df2181aac054d1f4b44264399d2aac12cf11c6"><code>72df218</code></a>
Update changelog for v4.37.0</li>
<li><a
href="https://github.com/github/codeql-action/commit/c7c896d71b3055d36f2aff93b16bcc6c69923b91"><code>c7c896d</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3995">#3995</a>
from github/update-bundle/codeql-bundle-v2.26.0</li>
<li><a
href="https://github.com/github/codeql-action/commit/3f34ff0ea3f5153c96071437b7cbf71ea3757146"><code>3f34ff0</code></a>
Add changelog note</li>
<li><a
href="https://github.com/github/codeql-action/commit/43bec09f1dc368b430cab4b5d69799bc904079d1"><code>43bec09</code></a>
Update default bundle to codeql-bundle-v2.26.0</li>
<li><a
href="https://github.com/github/codeql-action/commit/f58f0d11ebf5dedd870fab2f999275f7602cfa46"><code>f58f0d1</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3973">#3973</a>
from github/mbg/repo-props/config-file-shorthands</li>
<li><a
href="https://github.com/github/codeql-action/commit/7dc37cbb5b3e37f0e1cd1f18b61e0ea849898fb8"><code>7dc37cb</code></a>
Merge remote-tracking branch 'origin/main' into
mbg/repo-props/config-file-sh...</li>
<li><a
href="https://github.com/github/codeql-action/commit/8e22350a7e28c34c82a5a499fc241923301c2c4f"><code>8e22350</code></a>
Thread <code>ActionState</code> to <code>initConfig</code></li>
<li><a
href="https://github.com/github/codeql-action/commit/69c9e8c7d918cf2fee13b8b72fdde15883ff155b"><code>69c9e8c</code></a>
Mark some <code>status-report</code> imports as <code>type</code>-only
to avoid circular dependencies</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...99df26d4f13ea111d4ec1a7dddef6063f76b97e9">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action/init` from 4.36.3 to 4.37.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/init's
releases</a>.</em></p>
<blockquote>
<h2>v4.37.0</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li>
<li>In addition to the existing input format, the
<code>config-file</code> input for the <code>codeql-action/init</code>
step will soon support a new <code>[owner/]repo[@ref][:path]</code>
format. All components except the repository name are optional. If
omitted, <code>owner</code> defaults to the same owner as the repository
the analysis is running for, <code>ref</code> to <code>main</code>, and
<code>path</code> to <code>.github/codeql-action.yaml</code>. Support
for this format ships in this version of the CodeQL Action, but will
only be enabled over the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/init's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.37.1 - 16 Jul 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.20.6 and earlier. These versions of
CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise
Server 3.16, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li>
</ul>
<h2>4.37.0 - 08 Jul 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li>
<li>In addition to the existing input format, the
<code>config-file</code> input for the <code>codeql-action/init</code>
step will soon support a new <code>[owner/]repo[@ref][:path]</code>
format. All components except the repository name are optional. If
omitted, <code>owner</code> defaults to the same owner as the repository
the analysis is running for, <code>ref</code> to <code>main</code>, and
<code>path</code> to <code>.github/codeql-action.yaml</code>. Support
for this format ships in this version of the CodeQL Action, but will
only be enabled over the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li>
</ul>
<h2>4.36.3 - 01 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.36.2 - 04 Jun 2026</h2>
<ul>
<li>Cache CodeQL CLI version information across Actions steps. <a
href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li>
<li>Reduce requests while waiting for analysis processing by using
exponential backoff when polling SARIF processing status. <a
href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li>
</ul>
<h2>4.36.1 - 02 Jun 2026</h2>
<p>No user facing changes.</p>
<h2>4.36.0 - 22 May 2026</h2>
<ul>
<li><em>Breaking change</em>: Bump the minimum required CodeQL bundle
version to 2.19.4. <a
href="https://redirect.github.com/github/codeql-action/pull/3894">#3894</a></li>
<li>Add support for SHA-256 Git object IDs. <a
href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5">2.25.5</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3926">#3926</a></li>
</ul>
<h2>4.35.5 - 15 May 2026</h2>
<ul>
<li>We have improved how the JavaScript bundles for the CodeQL Action
are generated to avoid duplication across bundles and reduce the size of
the repository by around 70%. This should have no effect on the runtime
behaviour of the CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3899">#3899</a></li>
<li>For performance and accuracy reasons, <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> will now only be enabled on a pull request when
diff-informed analysis is also enabled for that run. If diff-informed
analysis is unavailable (for example, because the PR diff ranges could
not be computed), the action will fall back to a full analysis. <a
href="https://redirect.github.com/github/codeql-action/pull/3791">#3791</a></li>
<li>If multiple inputs are provided for the GitHub-internal
<code>analysis-kinds</code> input, only <code>code-scanning</code> will
be enabled. The <code>analysis-kinds</code> input is experimental, for
GitHub-internal use only, and may change without notice at any time. <a
href="https://redirect.github.com/github/codeql-action/pull/3892">#3892</a></li>
<li>Added an experimental change which, when running a Code Scanning
analysis for a PR with <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> enabled, prefers CodeQL CLI versions that have
a cached overlay-base database for the configured languages. This speeds
up analysis for a repository when there is not yet a cached overlay-base
database for the latest CLI version. We expect to roll this change out
to everyone in May. <a
href="https://redirect.github.com/github/codeql-action/pull/3880">#3880</a></li>
</ul>
<h2>4.35.4 - 07 May 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4">2.25.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3881">#3881</a></li>
</ul>
<h2>4.35.3 - 01 May 2026</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/99df26d4f13ea111d4ec1a7dddef6063f76b97e9"><code>99df26d</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3996">#3996</a>
from github/update-v4.37.0-c7c896d71</li>
<li><a
href="https://github.com/github/codeql-action/commit/31c27074fda95256cda077009907f8a6022dd7c0"><code>31c2707</code></a>
Add changenote for <a
href="https://redirect.github.com/github/codeql-action/issues/3973">#3973</a></li>
<li><a
href="https://github.com/github/codeql-action/commit/72df2181aac054d1f4b44264399d2aac12cf11c6"><code>72df218</code></a>
Update changelog for v4.37.0</li>
<li><a
href="https://github.com/github/codeql-action/commit/c7c896d71b3055d36f2aff93b16bcc6c69923b91"><code>c7c896d</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3995">#3995</a>
from github/update-bundle/codeql-bundle-v2.26.0</li>
<li><a
href="https://github.com/github/codeql-action/commit/3f34ff0ea3f5153c96071437b7cbf71ea3757146"><code>3f34ff0</code></a>
Add changelog note</li>
<li><a
href="https://github.com/github/codeql-action/commit/43bec09f1dc368b430cab4b5d69799bc904079d1"><code>43bec09</code></a>
Update default bundle to codeql-bundle-v2.26.0</li>
<li><a
href="https://github.com/github/codeql-action/commit/f58f0d11ebf5dedd870fab2f999275f7602cfa46"><code>f58f0d1</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3973">#3973</a>
from github/mbg/repo-props/config-file-shorthands</li>
<li><a
href="https://github.com/github/codeql-action/commit/7dc37cbb5b3e37f0e1cd1f18b61e0ea849898fb8"><code>7dc37cb</code></a>
Merge remote-tracking branch 'origin/main' into
mbg/repo-props/config-file-sh...</li>
<li><a
href="https://github.com/github/codeql-action/commit/8e22350a7e28c34c82a5a499fc241923301c2c4f"><code>8e22350</code></a>
Thread <code>ActionState</code> to <code>initConfig</code></li>
<li><a
href="https://github.com/github/codeql-action/commit/69c9e8c7d918cf2fee13b8b72fdde15883ff155b"><code>69c9e8c</code></a>
Mark some <code>status-report</code> imports as <code>type</code>-only
to avoid circular dependencies</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...99df26d4f13ea111d4ec1a7dddef6063f76b97e9">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action/analyze` from 4.36.3 to 4.37.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/analyze's
releases</a>.</em></p>
<blockquote>
<h2>v4.37.0</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li>
<li>In addition to the existing input format, the
<code>config-file</code> input for the <code>codeql-action/init</code>
step will soon support a new <code>[owner/]repo[@ref][:path]</code>
format. All components except the repository name are optional. If
omitted, <code>owner</code> defaults to the same owner as the repository
the analysis is running for, <code>ref</code> to <code>main</code>, and
<code>path</code> to <code>.github/codeql-action.yaml</code>. Support
for this format ships in this version of the CodeQL Action, but will
only be enabled over the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/analyze's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.37.1 - 16 Jul 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.20.6 and earlier. These versions of
CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise
Server 3.16, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li>
</ul>
<h2>4.37.0 - 08 Jul 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li>
<li>In addition to the existing input format, the
<code>config-file</code> input for the <code>codeql-action/init</code>
step will soon support a new <code>[owner/]repo[@ref][:path]</code>
format. All components except the repository name are optional. If
omitted, <code>owner</code> defaults to the same owner as the repository
the analysis is running for, <code>ref</code> to <code>main</code>, and
<code>path</code> to <code>.github/codeql-action.yaml</code>. Support
for this format ships in this version of the CodeQL Action, but will
only be enabled over the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li>
</ul>
<h2>4.36.3 - 01 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.36.2 - 04 Jun 2026</h2>
<ul>
<li>Cache CodeQL CLI version information across Actions steps. <a
href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li>
<li>Reduce requests while waiting for analysis processing by using
exponential backoff when polling SARIF processing status. <a
href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li>
</ul>
<h2>4.36.1 - 02 Jun 2026</h2>
<p>No user facing changes.</p>
<h2>4.36.0 - 22 May 2026</h2>
<ul>
<li><em>Breaking change</em>: Bump the minimum required CodeQL bundle
version to 2.19.4. <a
href="https://redirect.github.com/github/codeql-action/pull/3894">#3894</a></li>
<li>Add support for SHA-256 Git object IDs. <a
href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5">2.25.5</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3926">#3926</a></li>
</ul>
<h2>4.35.5 - 15 May 2026</h2>
<ul>
<li>We have improved how the JavaScript bundles for the CodeQL Action
are generated to avoid duplication across bundles and reduce the size of
the repository by around 70%. This should have no effect on the runtime
behaviour of the CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3899">#3899</a></li>
<li>For performance and accuracy reasons, <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> will now only be enabled on a pull request when
diff-informed analysis is also enabled for that run. If diff-informed
analysis is unavailable (for example, because the PR diff ranges could
not be computed), the action will fall back to a full analysis. <a
href="https://redirect.github.com/github/codeql-action/pull/3791">#3791</a></li>
<li>If multiple inputs are provided for the GitHub-internal
<code>analysis-kinds</code> input, only <code>code-scanning</code> will
be enabled. The <code>analysis-kinds</code> input is experimental, for
GitHub-internal use only, and may change without notice at any time. <a
href="https://redirect.github.com/github/codeql-action/pull/3892">#3892</a></li>
<li>Added an experimental change which, when running a Code Scanning
analysis for a PR with <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> enabled, prefers CodeQL CLI versions that have
a cached overlay-base database for the configured languages. This speeds
up analysis for a repository when there is not yet a cached overlay-base
database for the latest CLI version. We expect to roll this change out
to everyone in May. <a
href="https://redirect.github.com/github/codeql-action/pull/3880">#3880</a></li>
</ul>
<h2>4.35.4 - 07 May 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4">2.25.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3881">#3881</a></li>
</ul>
<h2>4.35.3 - 01 May 2026</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/99df26d4f13ea111d4ec1a7dddef6063f76b97e9"><code>99df26d</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3996">#3996</a>
from github/update-v4.37.0-c7c896d71</li>
<li><a
href="https://github.com/github/codeql-action/commit/31c27074fda95256cda077009907f8a6022dd7c0"><code>31c2707</code></a>
Add changenote for <a
href="https://redirect.github.com/github/codeql-action/issues/3973">#3973</a></li>
<li><a
href="https://github.com/github/codeql-action/commit/72df2181aac054d1f4b44264399d2aac12cf11c6"><code>72df218</code></a>
Update changelog for v4.37.0</li>
<li><a
href="https://github.com/github/codeql-action/commit/c7c896d71b3055d36f2aff93b16bcc6c69923b91"><code>c7c896d</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3995">#3995</a>
from github/update-bundle/codeql-bundle-v2.26.0</li>
<li><a
href="https://github.com/github/codeql-action/commit/3f34ff0ea3f5153c96071437b7cbf71ea3757146"><code>3f34ff0</code></a>
Add changelog note</li>
<li><a
href="https://github.com/github/codeql-action/commit/43bec09f1dc368b430cab4b5d69799bc904079d1"><code>43bec09</code></a>
Update default bundle to codeql-bundle-v2.26.0</li>
<li><a
href="https://github.com/github/codeql-action/commit/f58f0d11ebf5dedd870fab2f999275f7602cfa46"><code>f58f0d1</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3973">#3973</a>
from github/mbg/repo-props/config-file-shorthands</li>
<li><a
href="https://github.com/github/codeql-action/commit/7dc37cbb5b3e37f0e1cd1f18b61e0ea849898fb8"><code>7dc37cb</code></a>
Merge remote-tracking branch 'origin/main' into
mbg/repo-props/config-file-sh...</li>
<li><a
href="https://github.com/github/codeql-action/commit/8e22350a7e28c34c82a5a499fc241923301c2c4f"><code>8e22350</code></a>
Thread <code>ActionState</code> to <code>initConfig</code></li>
<li><a
href="https://github.com/github/codeql-action/commit/69c9e8c7d918cf2fee13b8b72fdde15883ff155b"><code>69c9e8c</code></a>
Mark some <code>status-report</code> imports as <code>type</code>-only
to avoid circular dependencies</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...99df26d4f13ea111d4ec1a7dddef6063f76b97e9">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/stale` from 10.3.0 to 10.4.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/stale/releases">actions/stale's
releases</a>.</em></p>
<blockquote>
<h2>v10.4.0</h2>
<h2>What's Changed</h2>
<h3>Bug Fix</h3>
<ul>
<li>Fixed <code>only-issue-types</code> validation by <a
href="https://github.com/trueberryless"><code>@​trueberryless</code></a>
in <a
href="https://redirect.github.com/actions/stale/pull/1338">actions/stale#1338</a></li>
</ul>
<h3>Dependency Updates</h3>
<ul>
<li>Bump undici to 6.27.0 via override, clean up stale license files,
and version to 10.4.0. by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/stale/pull/1342">actions/stale#1342</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/trueberryless"><code>@​trueberryless</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/stale/pull/1338">actions/stale#1338</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/stale/compare/v10.3.0...v10.4.0">https://github.com/actions/stale/compare/v10.3.0...v10.4.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/stale/commit/1e223db275d687790206a7acac4d1a11bd6fe629"><code>1e223db</code></a>
Bump undici to 6.27.0 via override, clean up stale license files, and
version...</li>
<li><a
href="https://github.com/actions/stale/commit/9461cb10066d1553762bac6a02599ab8c26b14dd"><code>9461cb1</code></a>
fix: <code>only-issue-types</code> does not affect PRs (<a
href="https://redirect.github.com/actions/stale/issues/1338">#1338</a>)</li>
<li>See full diff in <a
href="https://github.com/actions/stale/compare/eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899...1e223db275d687790206a7acac4d1a11bd6fe629">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-21 11:26:17 +00:00
dependabot[bot] acd0d7f841 chore: bump google.golang.org/api from 0.288.0 to 0.289.0 (#27365) 
Bumps
[google.golang.org/api](https://github.com/googleapis/google-api-go-client)
from 0.288.0 to 0.289.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's
releases</a>.</em></p>
<blockquote>
<h2>v0.289.0</h2>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.288.0...v0.289.0">0.289.0</a>
(2026-07-16)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3649">#3649</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/6e259cbb923dd10f071e2f724be23914f8ccd78b">6e259cb</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3652">#3652</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/5116a48938fa4674df57289ca63e75d209c06e10">5116a48</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3653">#3653</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/6c876b4102b2db7dabc6a0f69eb0e854d298f48d">6c876b4</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3655">#3655</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/69af635fafd38d3623f52c173715883d93d7ead5">69af635</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3656">#3656</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/1fc8f4539d0bf40f8272c1eb36f1e84cfa0ecea7">1fc8f45</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3657">#3657</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/aa8d256cb84dcc38ee3888c983515cae283d7436">aa8d256</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3659">#3659</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/af8d03336daad8d37f8de7e4692a8b67a7d35b7e">af8d033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.288.0...v0.289.0">0.289.0</a>
(2026-07-16)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3649">#3649</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/6e259cbb923dd10f071e2f724be23914f8ccd78b">6e259cb</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3652">#3652</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/5116a48938fa4674df57289ca63e75d209c06e10">5116a48</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3653">#3653</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/6c876b4102b2db7dabc6a0f69eb0e854d298f48d">6c876b4</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3655">#3655</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/69af635fafd38d3623f52c173715883d93d7ead5">69af635</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3656">#3656</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/1fc8f4539d0bf40f8272c1eb36f1e84cfa0ecea7">1fc8f45</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3657">#3657</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/aa8d256cb84dcc38ee3888c983515cae283d7436">aa8d256</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3659">#3659</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/af8d03336daad8d37f8de7e4692a8b67a7d35b7e">af8d033</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/783bf4bedcc95794980288f1e9928582e9a231b9"><code>783bf4b</code></a>
chore(main): release 0.289.0 (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3650">#3650</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/af8d03336daad8d37f8de7e4692a8b67a7d35b7e"><code>af8d033</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3659">#3659</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/080002a0ba10410dcd7c018483bfbdf27c2160ff"><code>080002a</code></a>
chore: constrain go version updates in renovate (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3658">#3658</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/aa8d256cb84dcc38ee3888c983515cae283d7436"><code>aa8d256</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3657">#3657</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/1fc8f4539d0bf40f8272c1eb36f1e84cfa0ecea7"><code>1fc8f45</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3656">#3656</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/7ac76e4d28ec9dd11c07746b48262426805a0084"><code>7ac76e4</code></a>
chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 in
/internal/koko...</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/8a47d2a5ae242a70b49a82a25eb72754dcc9acfc"><code>8a47d2a</code></a>
chore(all): update all (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3654">#3654</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/69af635fafd38d3623f52c173715883d93d7ead5"><code>69af635</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3655">#3655</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/6c876b4102b2db7dabc6a0f69eb0e854d298f48d"><code>6c876b4</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3653">#3653</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/5116a48938fa4674df57289ca63e75d209c06e10"><code>5116a48</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3652">#3652</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/googleapis/google-api-go-client/compare/v0.288.0...v0.289.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/api&package-manager=go_modules&previous-version=0.288.0&new-version=0.289.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-21 11:19:05 +00:00
dependabot[bot] 0344e06d4c chore: bump github.com/prometheus/client_golang from 1.23.2 to 1.24.0 (#27366) 
Bumps
[github.com/prometheus/client_golang](https://github.com/prometheus/client_golang)
from 1.23.2 to 1.24.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/prometheus/client_golang/releases">github.com/prometheus/client_golang's
releases</a>.</em></p>
<blockquote>
<h2>v1.24.0 - 2026-07-20</h2>
<h3>Changes</h3>
<ul>
<li>[CHANGE] Minimum required Go version is now 1.25, only the two
latest Go versions (1.25 and 1.26) are supported from now on. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1862">#1862</a></li>
<li>[CHANGE] prometheus: Name validation now always uses the UTF-8
scheme instead of the deprecated <code>model.NameValidationScheme</code>
global. Default behavior is unchanged; code that set
<code>NameValidationScheme = LegacyValidation</code> no longer gets
legacy enforcement at metric, label, and push-grouping construction. <a
href="https://redirect.github.com/prometheus/client_golang/issues/2051">#2051</a></li>
<li>[CHANGE] api/prometheus/v1: Support matchers (<code>matches[]</code>
parameter) in <code>Rules</code> method (<code>Rules(ctx
context.Context, matches []string) (RulesResult, error)</code>). <a
href="https://redirect.github.com/prometheus/client_golang/issues/1843">#1843</a></li>
<li>[CHANGE] api/prometheus/v1: Refactor <code>LabelNames</code> method
to return <code>model.LabelNames</code> instead of <code>[]string</code>
for consistency across the API. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1850">#1850</a></li>
<li>[CHANGE] exp/api/remote: Simplify <code>Store</code> interface,
rename <code>Handler</code> to <code>WriteHandler</code>, and
encapsulate write response handling. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1855">#1855</a></li>
<li>[FEATURE] prometheus: Add new Go 1.26 runtime metrics
(<code>/sched/goroutines-created:goroutines</code>,
<code>/sched/goroutines/not-in-go:goroutines</code>,
<code>/sched/goroutines/runnable:goroutines</code>,
<code>/sched/goroutines/running:goroutines</code>,
<code>/sched/goroutines/waiting:goroutines</code>,
<code>/sched/threads/total:threads</code>). <a
href="https://redirect.github.com/prometheus/client_golang/issues/1942">#1942</a></li>
<li>[FEATURE] prometheus: Add <code>WithUnit(unit string)</code> option
and explicit OpenMetrics unit support in <code>CounterOpts</code>,
<code>GaugeOpts</code>, <code>SummaryOpts</code>, and
<code>HistogramOpts</code>. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1392">#1392</a></li>
<li>[FEATURE] prometheus: Expose descriptor construction error through
public <code>Err()</code> method on <code>Desc</code>. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1902">#1902</a></li>
<li>[FEATURE] promhttp: Add opt-in
<code>HandlerOpts.CoalesceGather</code> to deduplicate concurrent
<code>Gather</code> calls so overlapping scrapes share one collection
cycle, preventing goroutine pile-up when the scrape rate outpaces
collection time. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1969">#1969</a></li>
<li>[FEATURE] promhttp: HTTP handlers created by <code>promhttp</code>
package now support metrics filtering by providing one or more
<code>name[]</code> query parameters. The default behavior when none are
provided remains the same, returning all metrics. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1925">#1925</a></li>
<li>[FEATURE] api/prometheus/v1: Add query formatting endpoint support
(<code>/format_query</code>) and <code>FormatQuery(ctx context.Context,
query string) (string, error)</code> method. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1846">#1846</a>,
<a
href="https://redirect.github.com/prometheus/client_golang/issues/1856">#1856</a></li>
<li>[FEATURE] api/prometheus/v1: Add support for
<code>/status/tsdb/blocks</code> endpoint via <code>TSDBBlocks(ctx
context.Context) ([]TSDBBlock, error)</code> method. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1896">#1896</a></li>
<li>[FEATURE] exp/api/remote: Export <code>BackoffConfig</code> to allow
customization when using <code>WithAPIBackoff</code>. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1895">#1895</a></li>
<li>[FEATURE] exp/api/remote: Add <code>RetryCallBack</code> to allow
custom logging or handling on retry attempts in the remote write client.
<a
href="https://redirect.github.com/prometheus/client_golang/issues/1888">#1888</a>,
<a
href="https://redirect.github.com/prometheus/client_golang/issues/1890">#1890</a></li>
<li>[ENHANCEMENT] prometheus/collectors/version: Allow specifying custom
labels when registering the version collector. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1860">#1860</a></li>
<li>[ENHANCEMENT] api: Use cloned <code>http.DefaultTransport</code>
when constructing default HTTP clients to prevent accidental mutations
of shared global transport state. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1885">#1885</a></li>
<li>[BUGFIX] prometheus: Recover from collector panics during
<code>Gather()</code> and return an error instead of crashing the
process. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1961">#1961</a></li>
<li>[BUGFIX] prometheus: Fix <code>cpu-seconds</code> unit suffix
handling for metric
<code>go_cpu_classes_gc_mark_assist_cpu_seconds</code>. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1991">#1991</a></li>
<li>[BUGFIX] promhttp: <code>InstrumentHandlerDuration</code> and
<code>InstrumentHandlerCounter</code> no longer panic when given an
observer/counter that does not implement
<code>ExemplarObserver</code>/<code>ExemplarAdder</code> (e.g. a
<code>SummaryVec</code>). The exemplar is dropped and the value is
recorded via the plain <code>Observe</code>/<code>Add</code> path,
matching the safe-cast already used by
<code>Timer.ObserveDurationWithExemplar</code>. <a
href="https://redirect.github.com/prometheus/client_golang/issues/2005">#2005</a></li>
<li>[BUGFIX] api/prometheus/v1: Fall back to <code>GET</code> requests
when <code>POST</code> requests return <code>403 Forbidden</code> or
method not allowed. <a
href="https://redirect.github.com/prometheus/client_golang/issues/2030">#2030</a></li>
<li>[BUGFIX] api: Respect context cancellation inside
<code>httpClient.Do</code>. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1971">#1971</a></li>
<li>[BUGFIX] exp/api/remote: Fix compression buffer pooling where
compressed buffers were released prematurely, causing corrupted
remote-write payloads. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1889">#1889</a></li>
<li>[BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring
huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM
from oversized remote-write requests. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1917">#1917</a></li>
<li>[BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be
returned on v1 requests. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1927">#1927</a></li>
</ul>
<!-- raw HTML omitted -->
<ul>
<li>build(deps): bump github.com/prometheus/procfs from 0.16.1 to 0.17.0
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1839">prometheus/client_golang#1839</a></li>
<li>build(deps): bump golang.org/x/sys from 0.33.0 to 0.34.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1838">prometheus/client_golang#1838</a></li>
<li>prometheus/collectors: use godoc link for runtime/metrics supported
metrics by <a
href="https://github.com/xieyuschen"><code>@​xieyuschen</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1844">prometheus/client_golang#1844</a></li>
<li>Fix doc typo by <a
href="https://github.com/torrca"><code>@​torrca</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1849">prometheus/client_golang#1849</a></li>
<li>Merge release-1.23 into main by <a
href="https://github.com/vesari"><code>@​vesari</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1851">prometheus/client_golang#1851</a></li>
<li>build(deps): bump github/codeql-action from 3.29.2 to 3.29.5 in the
github-actions group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1852">prometheus/client_golang#1852</a></li>
<li>Refactor LabelNames to return model.LabelNames type for consistency
by <a href="https://github.com/yshngg"><code>@​yshngg</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1850">prometheus/client_golang#1850</a></li>
<li>remote: simplified Store interface; renamed Handler to WriteHandler
by <a href="https://github.com/bwplotka"><code>@​bwplotka</code></a> in
<a
href="https://redirect.github.com/prometheus/client_golang/pull/1855">prometheus/client_golang#1855</a></li>
<li>feat(api/prometheus): add format_query endpoint for query formatting
by <a href="https://github.com/yshngg"><code>@​yshngg</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1846">prometheus/client_golang#1846</a></li>
<li>feat(api): add FormatQuery method to Prometheus v1 API by <a
href="https://github.com/yshngg"><code>@​yshngg</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1856">prometheus/client_golang#1856</a></li>
<li>Support matchers in rules API by <a
href="https://github.com/jotak"><code>@​jotak</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1843">prometheus/client_golang#1843</a></li>
<li>Use prometheus/common.expfmt.NewTextParser by <a
href="https://github.com/aknuds1"><code>@​aknuds1</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1859">prometheus/client_golang#1859</a></li>
<li>Merge release-1.23 into main by <a
href="https://github.com/aknuds1"><code>@​aknuds1</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1861">prometheus/client_golang#1861</a></li>
<li>chore: Drop support for &lt;go1.22 by <a
href="https://github.com/mrueg"><code>@​mrueg</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1862">prometheus/client_golang#1862</a></li>
<li>collectors/version: Allow custom additional labels by <a
href="https://github.com/mrueg"><code>@​mrueg</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1860">prometheus/client_golang#1860</a></li>
<li>build(deps): bump github.com/prometheus/common from 0.65.0 to 0.66.0
by <a href="https://github.com/ywwg"><code>@​ywwg</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1865">prometheus/client_golang#1865</a></li>
<li>Sync release-1.23 into main by <a
href="https://github.com/aknuds1"><code>@​aknuds1</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1868">prometheus/client_golang#1868</a></li>
<li>Sync main with release-1.23 by <a
href="https://github.com/aknuds1"><code>@​aknuds1</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1871">prometheus/client_golang#1871</a></li>
<li>chore: clean up golangci-lint configuration by <a
href="https://github.com/mmorel-35"><code>@​mmorel-35</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1802">prometheus/client_golang#1802</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/prometheus/client_golang/blob/v1.24.0/CHANGELOG.md">github.com/prometheus/client_golang's
changelog</a>.</em></p>
<blockquote>
<h2>1.24.0 / 2026-07-20</h2>
<ul>
<li>[CHANGE] Minimum required Go version is now 1.25, only the two
latest Go versions (1.25 and 1.26) are supported from now on. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1862">#1862</a></li>
<li>[CHANGE] prometheus: Name validation now always uses the UTF-8
scheme instead of the deprecated <code>model.NameValidationScheme</code>
global. Default behavior is unchanged; code that set
<code>NameValidationScheme = LegacyValidation</code> no longer gets
legacy enforcement at metric, label, and push-grouping construction. <a
href="https://redirect.github.com/prometheus/client_golang/issues/2051">#2051</a></li>
<li>[CHANGE] api/prometheus/v1: Support matchers (<code>matches[]</code>
parameter) in <code>Rules</code> method (<code>Rules(ctx
context.Context, matches []string) (RulesResult, error)</code>). <a
href="https://redirect.github.com/prometheus/client_golang/issues/1843">#1843</a></li>
<li>[CHANGE] api/prometheus/v1: Refactor <code>LabelNames</code> method
to return <code>model.LabelNames</code> instead of <code>[]string</code>
for consistency across the API. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1850">#1850</a></li>
<li>[CHANGE] exp/api/remote: Simplify <code>Store</code> interface,
rename <code>Handler</code> to <code>WriteHandler</code>, and
encapsulate write response handling. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1855">#1855</a></li>
<li>[FEATURE] prometheus: Add new Go 1.26 runtime metrics
(<code>/sched/goroutines-created:goroutines</code>,
<code>/sched/goroutines/not-in-go:goroutines</code>,
<code>/sched/goroutines/runnable:goroutines</code>,
<code>/sched/goroutines/running:goroutines</code>,
<code>/sched/goroutines/waiting:goroutines</code>,
<code>/sched/threads/total:threads</code>). <a
href="https://redirect.github.com/prometheus/client_golang/issues/1942">#1942</a></li>
<li>[FEATURE] prometheus: Add <code>WithUnit(unit string)</code> option
and explicit OpenMetrics unit support in <code>CounterOpts</code>,
<code>GaugeOpts</code>, <code>SummaryOpts</code>, and
<code>HistogramOpts</code>. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1392">#1392</a></li>
<li>[FEATURE] prometheus: Expose descriptor construction error through
public <code>Err()</code> method on <code>Desc</code>. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1902">#1902</a></li>
<li>[FEATURE] promhttp: Add opt-in
<code>HandlerOpts.CoalesceGather</code> to deduplicate concurrent
<code>Gather</code> calls so overlapping scrapes share one collection
cycle, preventing goroutine pile-up when the scrape rate outpaces
collection time. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1969">#1969</a></li>
<li>[FEATURE] promhttp: HTTP handlers created by <code>promhttp</code>
package now support metrics filtering by providing one or more
<code>name[]</code> query parameters. The default behavior when none are
provided remains the same, returning all metrics. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1925">#1925</a></li>
<li>[FEATURE] api/prometheus/v1: Add query formatting endpoint support
(<code>/format_query</code>) and <code>FormatQuery(ctx context.Context,
query string) (string, error)</code> method. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1846">#1846</a>,
<a
href="https://redirect.github.com/prometheus/client_golang/issues/1856">#1856</a></li>
<li>[FEATURE] api/prometheus/v1: Add support for
<code>/status/tsdb/blocks</code> endpoint via <code>TSDBBlocks(ctx
context.Context) ([]TSDBBlock, error)</code> method. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1896">#1896</a></li>
<li>[FEATURE] exp/api/remote: Export <code>BackoffConfig</code> to allow
customization when using <code>WithAPIBackoff</code>. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1895">#1895</a></li>
<li>[FEATURE] exp/api/remote: Add <code>RetryCallBack</code> to allow
custom logging or handling on retry attempts in the remote write client.
<a
href="https://redirect.github.com/prometheus/client_golang/issues/1888">#1888</a>,
<a
href="https://redirect.github.com/prometheus/client_golang/issues/1890">#1890</a></li>
<li>[ENHANCEMENT] prometheus/collectors/version: Allow specifying custom
labels when registering the version collector. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1860">#1860</a></li>
<li>[ENHANCEMENT] api: Use cloned <code>http.DefaultTransport</code>
when constructing default HTTP clients to prevent accidental mutations
of shared global transport state. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1885">#1885</a></li>
<li>[BUGFIX] prometheus: Recover from collector panics during
<code>Gather()</code> and return an error instead of crashing the
process. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1961">#1961</a></li>
<li>[BUGFIX] prometheus: Fix <code>cpu-seconds</code> unit suffix
handling for metric
<code>go_cpu_classes_gc_mark_assist_cpu_seconds</code>. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1991">#1991</a></li>
<li>[BUGFIX] promhttp: <code>InstrumentHandlerDuration</code> and
<code>InstrumentHandlerCounter</code> no longer panic when given an
observer/counter that does not implement
<code>ExemplarObserver</code>/<code>ExemplarAdder</code> (e.g. a
<code>SummaryVec</code>). The exemplar is dropped and the value is
recorded via the plain <code>Observe</code>/<code>Add</code> path,
matching the safe-cast already used by
<code>Timer.ObserveDurationWithExemplar</code>. <a
href="https://redirect.github.com/prometheus/client_golang/issues/2005">#2005</a></li>
<li>[BUGFIX] api/prometheus/v1: Fall back to <code>GET</code> requests
when <code>POST</code> requests return <code>403 Forbidden</code> or
method not allowed. <a
href="https://redirect.github.com/prometheus/client_golang/issues/2030">#2030</a></li>
<li>[BUGFIX] api: Respect context cancellation inside
<code>httpClient.Do</code>. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1971">#1971</a></li>
<li>[BUGFIX] exp/api/remote: Fix compression buffer pooling where
compressed buffers were released prematurely, causing corrupted
remote-write payloads. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1889">#1889</a></li>
<li>[BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring
huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM
from oversized remote-write requests. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1917">#1917</a></li>
<li>[BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be
returned on v1 requests. <a
href="https://redirect.github.com/prometheus/client_golang/issues/1927">#1927</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/prometheus/client_golang/commit/48dd383f94cc36bb0179724166383effd9f64847"><code>48dd383</code></a>
Cut v1.24.0 (<a
href="https://redirect.github.com/prometheus/client_golang/issues/2061">#2061</a>)</li>
<li><a
href="https://github.com/prometheus/client_golang/commit/a7253054383fd6702034c16194117d37727cd5fc"><code>a725305</code></a>
Cut v1.24.0-rc.0 (<a
href="https://redirect.github.com/prometheus/client_golang/issues/2058">#2058</a>)</li>
<li><a
href="https://github.com/prometheus/client_golang/commit/77c584f2501bf3726bb39b83a89b70c0e6f9ab0c"><code>77c584f</code></a>
build(deps): update all Go dependencies in all go.mod files (<a
href="https://redirect.github.com/prometheus/client_golang/issues/2059">#2059</a>)</li>
<li><a
href="https://github.com/prometheus/client_golang/commit/78262a77b89922f94a19ecd25eaeb849fb58f2cc"><code>78262a7</code></a>
feat(promhttp): add CoalesceGather option to deduplicate concurrent
Gather ca...</li>
<li><a
href="https://github.com/prometheus/client_golang/commit/34e9a7fe186a7a3ff47694f127d44d5641ff388f"><code>34e9a7f</code></a>
Merge pull request <a
href="https://redirect.github.com/prometheus/client_golang/issues/2055">#2055</a>
from prombot/repo_sync</li>
<li><a
href="https://github.com/prometheus/client_golang/commit/43749bc83131a4af24527351aabb47dc58590c85"><code>43749bc</code></a>
Update common Prometheus files</li>
<li><a
href="https://github.com/prometheus/client_golang/commit/de192175ccd6f6d4894cd9ceb804712c982e4958"><code>de19217</code></a>
examples: improve simple main.go example (<a
href="https://redirect.github.com/prometheus/client_golang/issues/1999">#1999</a>)</li>
<li><a
href="https://github.com/prometheus/client_golang/commit/20355eb4487c108a6ed54d9ebc6893bd649c10d0"><code>20355eb</code></a>
fix: correct typos in comments and test error messages (<a
href="https://redirect.github.com/prometheus/client_golang/issues/2049">#2049</a>)</li>
<li><a
href="https://github.com/prometheus/client_golang/commit/4cd2d3a57eccc893f00e23eb765f62e970e61f33"><code>4cd2d3a</code></a>
test: fix two flaky tests (darwin start_time regex, memstats
HeapReleased dri...</li>
<li><a
href="https://github.com/prometheus/client_golang/commit/b0d896bb08469911db07752f2c92c4d3986c629b"><code>b0d896b</code></a>
Replace deprecated model.NameValidationScheme with explicit
UTF8Validation (#...</li>
<li>Additional commits viewable in <a
href="https://github.com/prometheus/client_golang/compare/v1.23.2...v1.24.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/prometheus/client_golang&package-manager=go_modules&previous-version=1.23.2&new-version=1.24.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-21 11:16:43 +00:00
dependabot[bot] 0aa74b0e5e chore: bump github.com/scim2/filter-parser/v2 from 2.2.0 to 2.3.1 (#27368) 
Bumps
[github.com/scim2/filter-parser/v2](https://github.com/scim2/filter-parser)
from 2.2.0 to 2.3.1.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/scim2/filter-parser/commit/65b9da65508fb179de8e6841f81a4661a5d13ca1"><code>65b9da6</code></a>
chore: lower go directive to 1.18 (actual minimum)</li>
<li><a
href="https://github.com/scim2/filter-parser/commit/fb6a9f86f8dffff137ca8f65faf65660480ea0d9"><code>fb6a9f8</code></a>
chore: migrate parser dependency to github.com/q-uint/parser</li>
<li><a
href="https://github.com/scim2/filter-parser/commit/a551bba7d74bbd9fce7e56f4844351c77c338d9f"><code>a551bba</code></a>
fix: allow hyphens in URI segments (<a
href="https://redirect.github.com/scim2/filter-parser/issues/29">#29</a>)</li>
<li><a
href="https://github.com/scim2/filter-parser/commit/5c111b10bf6b419428e400380472a51512f3be00"><code>5c111b1</code></a>
fix: preserve operator precedence in LogicalExpression.String() (<a
href="https://redirect.github.com/scim2/filter-parser/issues/28">#28</a>)</li>
<li>See full diff in <a
href="https://github.com/scim2/filter-parser/compare/v2.2.0...v2.3.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/scim2/filter-parser/v2&package-manager=go_modules&previous-version=2.2.0&new-version=2.3.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-21 11:13:28 +00:00
Spike Curtis 9bd4cf2a2a test: use NATS in coderdtest by default (#27343) 
Closes GRU-70

Enables NATS as the pubsub for `coderdtest` unless specifically overwritten by the test case.
 2026-07-21 11:19:23 +02:00
Michael Suchacz 3227cac217 feat: add manual chat compaction via /compact (#27081) 
Adds a user-triggered `/compact` action for Coder Agents chats: typing
`/compact` in the composer (or picking it from the `/` trigger menu)
summarizes the conversation so far to free up context window space.

## How it works

- New `POST /api/experimental/chats/{chat}/compact` endpoint
(owner-only, RBAC `ActionUpdate`, excluded from the public API reference
via `x-apidocgen skip`). It marks the chat with a durable one-shot
`chats.compaction_requested_at` signal and moves it `waiting -> running`
via a new `RequestCompaction` state transition; no message row is
inserted. AI Gateway attribution needs no per-request key: generation
preparation resolves the owner's synthetic API key (#27170) like any
other turn.
- `RequestCompaction` hands off chat ownership (clears
`worker_id`/`runner_id`) so a worker acquisition hint is published;
since the transition changes no history, the previous runner could
otherwise miss the request under reordered pubsub delivery.
- The background chat worker picks the chat up like any other turn. A
pending manual request takes precedence over turn completion in the
generation decision, and forces compaction even below the automatic
threshold (and when compaction is disabled via threshold=100). The
commit step consumes the request marker in the same transaction; any
transition that ends the turn clears stale markers.
- The summary triplet reuses the automatic-compaction path, now tagged
with a `source` (`automatic` | `manual`) that is plumbed through
streamed progress parts, persisted tool JSON, and the UI label
("Summarized (manual)").
- Validation order: busy chats reject with 409 (state-machine conflict),
empty/already-compacted chats with 409 "nothing to compact", archived
chats with 400; the owner usage-limit check runs last so no-op requests
surface the specific conflict instead of a limit error.
- Web UI: the `/` trigger menu now has a built-in "Commands" group
listing `/compact`; submit intercepts exactly `/compact` and calls the
endpoint instead of sending a message. A personal or workspace skill
named `compact` takes precedence over the built-in command; while skill
collisions are still resolving, an exact `/compact` submission is
blocked with a retryable hint instead of leaking as message text.
History and queued-message edits are never intercepted. After
compaction, the context usage indicator resets to its unknown state
until the next assistant response reports fresh usage, instead of
showing the stale pre-compaction number.
- codersdk: `ExperimentalClient.CompactChat`.

Worker-path execution (rather than compacting synchronously in the
handler) reuses the existing lock fencing, live "Summarizing..."
streaming, retry accounting, restart resilience, and debug-run
observability. Rationale documented in `coderd/x/chatd/ARCHITECTURE.md`.

## Testing

- State machine: transition-matrix coverage for `RequestCompaction`,
marker lifecycle tests (carried by lease renewals/queue appends, cleared
by terminal transitions, consumed by commit), ownership handoff +
acquisition hint assertions.
- Worker: decision-ordering and forced-compaction unit tests;
active-server end-to-end test (manual compact below threshold produces a
`source=manual` summary, returns to `waiting`, no assistant follow-up;
busy chat rejected).
- API: success, archived, non-owner, RBAC-denied, empty-chat, no-daemon
cases; usage-limit ordering (at-limit owners still get
state/nothing-to-compact conflicts for no-op requests, with marker
rollback).
- Frontend: Storybook play tests for the Commands menu group, submit
intercept, skill-name collision, queued-edit passthrough, and
manual/automatic tool rendering; unit tests for command availability
resolution and the post-compaction context usage reset.

> This PR was created by Mux, an AI coding agent, working on Mike's
behalf.
 2026-07-21 10:58:08 +02:00
dependabot[bot] ed64eb3515 chore: bump the coder-modules group across 3 directories with 3 updates (#27358) 
Bumps the coder-modules group with 3 updates in the /dogfood/coder
directory: coder/code-server/coder, coder/mux/coder and
coder/vscode-web/coder.
Bumps the coder-modules group with 1 update in the
/dogfood/coder-envbuilder directory: coder/code-server/coder.
Bumps the coder-modules group with 2 updates in the
/dogfood/vscode-coder directory: coder/code-server/coder and
coder/vscode-web/coder.

Updates `coder/code-server/coder` from 1.5.1 to 1.5.2

Updates `coder/mux/coder` from 1.4.3 to 1.5.0

Updates `coder/vscode-web/coder` from 1.6.0 to 1.6.1

Updates `coder/code-server/coder` from 1.5.1 to 1.5.2

Updates `coder/code-server/coder` from 1.5.1 to 1.5.2

Updates `coder/vscode-web/coder` from 1.6.0 to 1.6.1


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-21 00:26:49 +00:00
Nick Vigilante 68344a0973 ci(.github/workflows/deploy-docs.yaml): surface bounded error code on failure, not raw body (#26917) 
## What

On failure, the `deploy-docs` jobs (`algolia-and-isr` and
`vercel-rebuild`) print the HTTP status and a **bounded error code**
extracted from the response (`(.error | objects | .code)`), never the
raw response body. Comments that wrongly described the run log as
"restricted to repo collaborators" are corrected, including a
pre-existing one.

## Why

This repository is public, so GitHub Actions run logs are
world-readable. The existing design deliberately keeps free-form
upstream strings out of the public step summary via a jq allowlist.
Printing the raw response body to the run log has the same public
visibility, so it would defeat that intent. Surfacing only the bounded
error code (for example `bad_request`) is safe and enough to diagnose
failures like the deploy hook's recent HTTP 400.

## Scope and risk

- One file, `+15/-5`, success path untouched.
- Editing this workflow does not trigger it (its `push` trigger is
scoped to `docs/**`), so merging is safe.
- `actionlint` clean. The jq extraction was verified to emit only the
bounded `code`, never `message` or free-form string errors.

<details>
<summary>Context / decision log</summary>

- This started from a `vercel-rebuild` failure (HTTP 400 on every
full-rebuild trigger since 2026-06-18) whose reason was never surfaced
in CI.
- Root cause was operational: the docs site's production branch moved
from `master` to `main`, which invalidated the old deploy hook. It was
fixed separately by repointing the hook, and the workflow is green
again.
- The first revision of this PR logged the raw response body to the run
log. `coder-agents-review` (CRF-1, P2) correctly flagged that
public-repo run logs are world-readable, so that would leak the
free-form strings the allowlist exists to suppress. Revised to surface
only the bounded error code, and to correct the false "restricted to
repo collaborators" comments (CRF-2 nit: comment blocks shortened).

</details>

---
Generated by Coder Agents on behalf of @nickvigilante.
 2026-07-20 21:34:36 +00:00
Danny Kopping d0be387194 feat(dogfood/coder): add opt-in /dev/kvm device mapping (#27352) 
## Summary

Adds an opt-in **"Expose /dev/kvm to the workspace"** bool parameter
(default `false`) to the dogfood template. When enabled, the host's
`/dev/kvm` device is mapped into the workspace container so it can run
hardware-accelerated VMs (e.g. nested microVM runtimes).

## Details

- New `coder_parameter` `enable_kvm` (bool, default off, mutable).
- A `dynamic "devices"` block on `docker_container.workspace` that maps
`/dev/kvm` only when the parameter is enabled.

It is gated behind a parameter on purpose: dogfood runs on GKE, where
most nodes do not expose `/dev/kvm`, and mapping a missing device fails
container creation. Keeping it off by default means existing workspaces
are unaffected; only users on a KVM-capable host opt in.

## Verifying KVM passthrough on a host

```bash
docker run --rm --runtime=sysbox-runc --device=/dev/kvm alpine sh -c \
  '[ -c /dev/kvm ] && [ -r /dev/kvm ] && [ -w /dev/kvm ] && echo OK || echo FAIL'
```

## Notes

- No effect unless the host actually provides `/dev/kvm` and the
workspace user has access to it.
- Draft: still validating end-to-end on a KVM-capable host.
 2026-07-20 20:58:00 +00:00
dependabot[bot] 69a045f944 chore: bump axios from 1.16.1 to 1.18.0 in /site (#27350) 
Bumps [axios](https://github.com/axios/axios) from 1.16.1 to 1.18.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/axios/axios/releases">axios's
releases</a>.</em></p>
<blockquote>
<h2>v1.18.0 — June 13, 2026</h2>
<p>This release hardens redirect and URL handling, improves the
validateStatus configuration semantics, and includes updates to
documentation, dependencies, and release metadata.</p>
<h2>🔒 Security Fixes</h2>
<ul>
<li>
<p><strong>Redirect Header Safety:</strong> Added Node HTTP adapter
support for stripping caller-specified sensitive headers on cross-origin
redirects, helping prevent custom auth headers such as API keys from
leaking to another origin. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10892">#10892</a></strong>)</p>
</li>
<li>
<p><strong>URL And Request Hardening:</strong> Rejects malformed
<code>http:</code> and <code>https:</code> URLs that omit
<code>//</code> with <code>ERR_INVALID_URL</code>, while tightening
prototype-pollution-safe config reads, stream size limits, FormData
depth handling, data URL sizing, and local <code>NO_PROXY</code>
matching. (<strong><a
href="https://redirect.github.com/axios/axios/issues/11000">#11000</a></strong>)</p>
</li>
</ul>
<h2>🐛 Bug Fixes</h2>
<ul>
<li><strong>Status Validation:</strong> Added
<code>transitional.validateStatusUndefinedResolves</code> so
applications can opt in to treating <code>validateStatus:
undefined</code> like the option was omitted, while
<code>validateStatus: null</code> remains the explicit way to accept
every status. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10899">#10899</a></strong>)</li>
</ul>
<h2>🔧 Maintenance &amp; Chores</h2>
<ul>
<li>
<p><strong>Documentation:</strong> Published the v1.17.0 release notes,
fixed a changelog typo, clarified the package update PR policy, and
marked the <code>proxy</code> request config as Node.js-only in the
advanced docs. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10984">#10984</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10988">#10988</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10992">#10992</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10995">#10995</a></strong>)</p>
</li>
<li>
<p><strong>Dependencies:</strong> Bumped <code>@babel/core</code>,
<code>@babel/preset-env</code>, <code>@commitlint/cli</code>,
<code>@commitlint/config-conventional</code>,
<code>@rollup/plugin-babel</code>, <code>@rollup/plugin-commonjs</code>,
<code>@vitest/browser</code>, <code>@vitest/browser-playwright</code>,
<code>eslint</code>, <code>lint-staged</code>, <code>rollup</code>,
<code>vitest</code>, and <code>actions/checkout</code>. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10989">#10989</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10996">#10996</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10997">#10997</a></strong>)</p>
</li>
<li>
<p><strong>Release Metadata:</strong> Prepared the 1.18.0 release by
updating package metadata and the runtime <code>VERSION</code> value.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/11003">#11003</a></strong>)</p>
</li>
</ul>
<h2>🌟 New Contributors</h2>
<p>We are thrilled to welcome our new contributors. Thank you for
helping improve axios:</p>
<ul>
<li><strong><a
href="https://github.com/drori12"><code>@​drori12</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10984">#10984</a></strong>)</li>
<li><strong><a
href="https://github.com/eyupcanakman"><code>@​eyupcanakman</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10899">#10899</a></strong>)</li>
<li><strong><a
href="https://github.com/Adi-Beker"><code>@​Adi-Beker</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10995">#10995</a></strong>)</li>
</ul>
<p><a
href="https://github.com/axios/axios/compare/v1.17.0...v1.18.0">Full
Changelog</a></p>
<h2>v1.17.0 — June 1, 2026</h2>
<p>This release adds Node HTTP zstd decompression, hardens config and
release workflows, and fixes authentication, header, proxy, and
type-handling regressions.</p>
<h2>🔒 Security Fixes</h2>
<ul>
<li><strong>Config Hardening:</strong> Guarded <code>socketPath</code>,
<code>params</code>, and <code>paramsSerializer</code> reads with
own-property checks to prevent inherited prototype values from affecting
request behavior, including SSRF-sensitive paths. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10901">#10901</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10922">#10922</a></strong>)</li>
<li><strong>Release Publishing:</strong> Switched the publish workflow
to npm staged publishing for safer, auditable package releases with
provenance. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10926">#10926</a></strong>)</li>
</ul>
<h2>🚀 New Features</h2>
<ul>
<li><strong>HTTP Compression:</strong> Added Node HTTP adapter support
for zstd response decompression, with
<code>transitional.advertiseZstdAcceptEncoding</code> controlling
whether <code>zstd</code> is advertised in <code>Accept-Encoding</code>.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/6792">#6792</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10920">#10920</a></strong>)</li>
</ul>
<h2>🐛 Bug Fixes</h2>
<ul>
<li><strong>Authentication Handling:</strong> Restored Basic auth on
same-origin Node redirects while continuing to strip credentials
cross-origin, and aligned the fetch adapter with HTTP adapter behavior
for URL-embedded Basic auth. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10929">#10929</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10896">#10896</a></strong>)</li>
<li><strong>Proxy TLS:</strong> Preserved user <code>httpsAgent</code>
TLS options when tunneling HTTPS requests through HTTP CONNECT proxies.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10957">#10957</a></strong>)</li>
<li><strong>React Native FormData:</strong> Cleared default
<code>Content-Type</code> for React Native <code>FormData</code> so
multipart boundaries can be generated correctly. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10898">#10898</a></strong>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/axios/axios/blob/v1.x/CHANGELOG.md">axios's
changelog</a>.</em></p>
<blockquote>
<h2>v1.18.0 — June 13, 2026</h2>
<p>This release hardens redirect and URL handling, improves the
validateStatus configuration semantics, and includes updates to
documentation, dependencies, and release metadata.</p>
<h2>🔒 Security Fixes</h2>
<ul>
<li>
<p><strong>Redirect Header Safety:</strong> Added Node HTTP adapter
support for stripping caller-specified sensitive headers on cross-origin
redirects, helping prevent custom auth headers such as API keys from
leaking to another origin. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10892">#10892</a></strong>)</p>
</li>
<li>
<p><strong>URL And Request Hardening:</strong> Rejects malformed
<code>http:</code> and <code>https:</code> URLs that omit
<code>//</code> with <code>ERR_INVALID_URL</code>, while tightening
prototype-pollution-safe config reads, stream size limits, FormData
depth handling, data URL sizing, and local <code>NO_PROXY</code>
matching. (<strong><a
href="https://redirect.github.com/axios/axios/issues/11000">#11000</a></strong>)</p>
</li>
</ul>
<h2>🐛 Bug Fixes</h2>
<ul>
<li><strong>Status Validation:</strong> Added
<code>transitional.validateStatusUndefinedResolves</code> so
applications can opt in to treating <code>validateStatus:
undefined</code> like the option was omitted, while
<code>validateStatus: null</code> remains the explicit way to accept
every status. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10899">#10899</a></strong>)</li>
</ul>
<h2>🔧 Maintenance &amp; Chores</h2>
<ul>
<li>
<p><strong>Documentation:</strong> Published the v1.17.0 release notes,
fixed a changelog typo, clarified the package update PR policy, and
marked the <code>proxy</code> request config as Node.js-only in the
advanced docs. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10984">#10984</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10988">#10988</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10992">#10992</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10995">#10995</a></strong>)</p>
</li>
<li>
<p><strong>Dependencies:</strong> Bumped <code>@babel/core</code>,
<code>@babel/preset-env</code>, <code>@commitlint/cli</code>,
<code>@commitlint/config-conventional</code>,
<code>@rollup/plugin-babel</code>, <code>@rollup/plugin-commonjs</code>,
<code>@vitest/browser</code>, <code>@vitest/browser-playwright</code>,
<code>eslint</code>, <code>lint-staged</code>, <code>rollup</code>,
<code>vitest</code>, and <code>actions/checkout</code>. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10989">#10989</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10996">#10996</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10997">#10997</a></strong>)</p>
</li>
<li>
<p><strong>Release Metadata:</strong> Prepared the 1.18.0 release by
updating package metadata and the runtime <code>VERSION</code> value.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/11003">#11003</a></strong>)</p>
</li>
</ul>
<h2>🌟 New Contributors</h2>
<p>We are thrilled to welcome our new contributors. Thank you for
helping improve axios:</p>
<ul>
<li><strong><a
href="https://github.com/drori12"><code>@​drori12</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10984">#10984</a></strong>)</li>
<li><strong><a
href="https://github.com/eyupcanakman"><code>@​eyupcanakman</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10899">#10899</a></strong>)</li>
<li><strong><a
href="https://github.com/Adi-Beker"><code>@​Adi-Beker</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10995">#10995</a></strong>)</li>
</ul>
<p><a
href="https://github.com/axios/axios/compare/v1.17.0...v1.18.0">Full
Changelog</a></p>
<h2>v1.17.0 — June 1, 2026</h2>
<p>This release adds Node HTTP zstd decompression, hardens config and
release workflows, and fixes authentication, header, proxy, and
type-handling regressions.</p>
<h2>🔒 Security Fixes</h2>
<ul>
<li><strong>Config Hardening:</strong> Guarded <code>socketPath</code>,
<code>params</code>, and <code>paramsSerializer</code> reads with
own-property checks to prevent inherited prototype values from affecting
request behavior, including SSRF-sensitive paths. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10901">#10901</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10922">#10922</a></strong>)</li>
<li><strong>Release Publishing:</strong> Switched the publish workflow
to npm staged publishing for safer, auditable package releases with
provenance. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10926">#10926</a></strong>)</li>
</ul>
<h2>🚀 New Features</h2>
<ul>
<li><strong>HTTP Compression:</strong> Added Node HTTP adapter support
for zstd response decompression, with
<code>transitional.advertiseZstdAcceptEncoding</code> controlling
whether <code>zstd</code> is advertised in <code>Accept-Encoding</code>.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/6792">#6792</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10920">#10920</a></strong>)</li>
</ul>
<h2>🐛 Bug Fixes</h2>
<ul>
<li><strong>Authentication Handling:</strong> Restored Basic auth on
same-origin Node redirects while continuing to strip credentials
cross-origin, and aligned the fetch adapter with HTTP adapter behavior
for URL-embedded Basic auth. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10929">#10929</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10896">#10896</a></strong>)</li>
<li><strong>Proxy TLS:</strong> Preserved user <code>httpsAgent</code>
TLS options when tunneling HTTPS requests through HTTP CONNECT proxies.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10957">#10957</a></strong>)</li>
<li><strong>React Native FormData:</strong> Cleared default
<code>Content-Type</code> for React Native <code>FormData</code> so
multipart boundaries can be generated correctly. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10898">#10898</a></strong>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/axios/axios/commit/2d06f96e8602c2db13b65a26340ee4a1bbc0b61f"><code>2d06f96</code></a>
chore(release): prepare release 1.18.0 (<a
href="https://redirect.github.com/axios/axios/issues/11003">#11003</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2"><code>32fc489</code></a>
fix: malformed http urls (<a
href="https://redirect.github.com/axios/axios/issues/11000">#11000</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/b40ce498abfa10d90b873b4fd08f520afa5d2545"><code>b40ce49</code></a>
chore(deps-dev): bump the development_dependencies group with 10 updates
(<a
href="https://redirect.github.com/axios/axios/issues/10">#10</a>...</li>
<li><a
href="https://github.com/axios/axios/commit/fe964f960ecb52c3e1155b0daf7be77541956b01"><code>fe964f9</code></a>
docs: mark proxy config as Node.js only (<a
href="https://redirect.github.com/axios/axios/issues/10995">#10995</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/5f229d2d1f018d1db3dab6bbe034dbf3f9041b99"><code>5f229d2</code></a>
chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the
github-actions ...</li>
<li><a
href="https://github.com/axios/axios/commit/fae9d4e7db6a858c407c75e607a071c533c5c4f6"><code>fae9d4e</code></a>
docs: clarify package update PR policy (<a
href="https://redirect.github.com/axios/axios/issues/10992">#10992</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/28ab2ced820e55192806c53472ab3eb0cbb68dc2"><code>28ab2ce</code></a>
chore(deps-dev): bump the development_dependencies group with 2 updates
(<a
href="https://redirect.github.com/axios/axios/issues/10989">#10989</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/a8e4f13aeecc45a3b8fab3ecfd9ddb5d70fb772b"><code>a8e4f13</code></a>
fix(core): keep default validateStatus when request passes undefined (<a
href="https://redirect.github.com/axios/axios/issues/10899">#10899</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/614f4552a17de757d4171ad7c3bd38c9c1025fd8"><code>614f455</code></a>
docs: publish v1.17.0 release notes (<a
href="https://redirect.github.com/axios/axios/issues/10988">#10988</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/6bb12c191f5380fad321322fb90216ae0dc36985"><code>6bb12c1</code></a>
fix: custom auth headers not stripped on cross-origin redirects (<a
href="https://redirect.github.com/axios/axios/issues/10892">#10892</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/axios/axios/compare/v1.16.1...v1.18.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=axios&package-manager=npm_and_yarn&previous-version=1.16.1&new-version=1.18.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/coder/coder/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-20 19:06:59 +00:00
Michael Suchacz 4ed6fcced7 refactor(coderd): stop storing chat gateway key IDs and drop the columns (#27171) 
> Mux is working on behalf of Mike.

## Summary

Stop reading and writing the legacy `api_key_id` columns on chat
messages and queued messages, and drop the columns in the same PR.
Runtime AI Gateway attribution continues to use the per-user synthetic
key introduced by #27170.

With the columns gone, `sqlc` generates `database.ChatMessage` and
`database.ChatQueuedMessage` without `api_key_id`, so no transitional
query scaffolding is needed.

Migration `000548` drops the `api_key_id` columns. #27170 already
removed their foreign keys, so the down migration re-adds nullable text
columns without constraints. Previous column values cannot be restored.

Also moves the model config validation in `CreateChat` above the
message-building work so a disabled or invalid model fails fast. On main
this mattered more: the old ordering minted a synthetic API key before
rejecting the request.

Deploy note: replicas still running the previous release write
`api_key_id` on insert, so chat message inserts on old replicas fail
during the rolling window after the column drop. This was previously
split across two PRs to avoid that window; per review feedback the split
added more churn than it was worth for an experimental surface.

Depends on #27170 (merged).
 2026-07-20 19:49:19 +02:00
Michael Suchacz f18c664be2 fix(site): stack settings layouts on mobile (#27334) 
## Problem

On mobile viewports every settings shell renders a fixed 240px sidebar
next to the content in a non-responsive flex row, leaving the content
almost no width. The MCP Servers page is worst: its fixed-layout table
cannot shrink, so the whole page collapses into a single cramped column.

## Changes

- `Sidebar` component: full width below the `lg` breakpoint, `w-60` at
`lg`+.
- Six settings layouts (AI, Deployment, Organization, User, Workspace,
Template) stack the nav above the content below `lg` and keep the
previous side-by-side spacing at `lg`+. Content wrappers get `min-w-0`
so flex children cannot force overflow, and horizontal padding tightens
on small screens.
- MCP servers table gets `min-w-[640px]` so the existing `overflow-auto`
wrapper provides horizontal scrolling instead of colliding column
headers.

Tailwind class changes only; no component or behavior changes.

## Testing

- `pnpm check` and `pnpm run lint:types` pass.
- Dogfood UAT on a dev deployment: at 390x844 the MCP Servers,
Deployment, Account, and Template settings pages stack nav-above-content
with no horizontal body overflow and a scrollable MCP table; boundary
verified stacked at 1023px and side-by-side at 1024px; at 1440x900 the
layouts are pixel-identical to before (240px sidebar, 112px gap, 40px
padding).

Closes CODAGT-828.

> Created by Mux, an AI agent, on Mike's behalf.
 2026-07-20 19:35:23 +02:00
Sas Swart 66e6f40b8b chore: rename agent firewall flags (#27231) 
* Alias --boundary-log-proxy-socket-path to
--agent-firewall-log-proxy-socket-path
* Also alias CODER_AGENT_BOUNDARY_LOG_PROXY_SOCKET_PATH to
CODER_AGENT_FIREWALL_LOG_PROXY_SOCKET_PATH
* Also Rename related variables and symbols to reflect the new name.

<!--

If you have used AI to produce some or all of this PR, please ensure you
have read our [AI Contribution
guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING)
before submitting.

-->
 2026-07-20 15:39:21 +02:00
Susana Ferreira a9fdf87a2f feat: add GET /groups/{group}/members/ai/spend (#27130) 
## Description

Adds `GET /api/v2/groups/{group}/members/ai/spend?user_ids=...` (also available org-scoped at `/api/v2/organizations/{org}/groups/{groupName}/members/ai/spend`) to return per-member AI spend attributed to a group, along with each member's effective budget group and the applied spend limit when the queried group is their effective budget source.

In the UI, this endpoint is used alongside the existing `/api/v2/groups/{group}/members` endpoint. AI spend data is kept separate from that endpoint so that:

- Different concepts stay on different endpoints: identity (group members) vs. cost control (spend). Cost control is an additional feature layered on top of groups/orgs.
- Callers that don't need spend information don't pay for its computation.

UI flow:

1. Request `/api/v2/groups/{group}/members` → returns the group's members.
2. Request `/api/v2/groups/{group}/members/ai/spend?user_ids=...` with the IDs from step 1.

**Note:** Only current members of the queried group are returned. `spend_limit_micros` and `limit_source` are populated only when the queried group is the member's effective budget source (its own limit or a user override). `effective_group_id` is null when the member's budget resolves to a group in another organization, since an organization is treated as a tenant boundary.

<img width="2880" height="1904" alt="image" src="https://github.com/user-attachments/assets/33ed395d-d1a3-4b46-bb04-c8d3f41c8886" />

## Changes

- Add `codersdk.GroupMembersAISpend` and `GroupMemberAISpend` types, reusing the shared `AISpendPeriodWindow`.
- Add `GetGroupMembersAISpend` SQL query with a dbauthz per-row filter that mirrors `GET /api/v2/groups/{group}/members`.
- Add handler and routes under `/groups/{group}/members/ai/spend` (and the org-scoped alias) with a required `user_ids` query param (cap 100). Callers with more than 100 members are expected to batch across multiple requests.
- Add codersdk client method.
- Tests: dbauthz, raw SQL, endpoint, and role-access.

Closes https://linear.app/codercom/issue/AIGOV-471/backend-group-members-endpoint-with-members-spend

> [!NOTE]
> Initially generated by Claude Opus 4.7, modified and reviewed by @ssncferreira
 2026-07-20 13:04:37 +01:00
Susana Ferreira 2adc8f5272 feat: add GET /organizations/{org}/groups/ai/spend (#27123) 
## Description

Adds `GET /api/v2/organizations/{org}/groups/ai/spend?group_ids=...` to return per-group AI spend and configured limits for a set of groups in an organization.

In the UI, this endpoint is used alongside the existing `/api/v2/organizations/{org}/groups` endpoint. AI spend data is kept separate from that endpoint so that:

- Different concepts stay on different endpoints: identity (groups) vs. cost control (spend). Cost control is an additional feature layered on top of groups/orgs.
- Callers that don't need spend information don't pay for its computation.

UI flow:

1. Request `/api/v2/organizations/{org}/groups` → returns the organization's groups.
2. Request `/api/v2/organizations/{org}/groups/ai/spend?group_ids=...` with the IDs from step 1.

The groups endpoint from 1) is currently not paginated, but if pagination is added later, this design keeps the two responses in sync. This spend endpoint intentionally takes `group_ids` rather than paginating on its own, since it depends on the group set from step 1. Pagination could be added in the future, especially for Cost Control-focused pages.

<img width="2880" height="1460" alt="image" src="https://github.com/user-attachments/assets/ea83b74d-6a4f-45a6-af2f-1024e019da07" />

## Changes

- Add `codersdk.OrganizationGroupsAISpend` and `OrganizationGroupAISpend` types, plus a shared `AISpendPeriodWindow` embedded in the spend response.
- Add `GetOrganizationGroupsAISpend` SQL query with a dbauthz per-row filter that mirrors `GET /organizations/{org}/groups`.
- Add handler and route under `/organizations/{organization}/groups/ai/spend` with a required `group_ids` query param (cap 100). Callers with more than 100 groups are expected to batch across multiple requests.
- Add codersdk client method.
- Tests: dbauthz, raw SQL, endpoint, and role-access.

Closes https://linear.app/codercom/issue/AIGOV-466/backend-organization-groups-endpoint-with-groups-spend

> [!NOTE]
> Initially generated by Claude Opus 4.7, modified and reviewed by @ssncferreira
 2026-07-20 12:54:52 +01:00
Mathias Fredriksson b511a68ab0 fix(coderd/x/chatd): clarify wait agent timeout (#27335) 
The model-visible timeout schema did not state its five-minute default.
Clarify that waits return on completion and that a timeout leaves the
agent running.
 2026-07-20 13:47:25 +03:00
Cian Johnston 54fa4a087e chore: wire quartz.Clock into Acquirer (#27291) 
- Wires quartz.Clock into provisionerdserver.Acquirer
- Allows overriding Acquirer in coderd.Options
- Updates existing tests to use an Acquirer driven by a quartz.Mock 

Before this change `enterprise/coderd/prebuilds` package tests would
take ~60-70s to run.
After this change, it's down to ~10s.

> Generated by Coder agents, massaged by this human.
 2026-07-20 10:30:02 +01:00
Michael Suchacz 9f4ddea571 feat: revoke MCP server OAuth grants at the provider on disconnect (#27300) 
Closes
[CODAGT-805](https://linear.app/codercom/issue/CODAGT-805/revoke-oauth-grants-at-the-source-for-mcp-servers).

The experimental MCP server OAuth2 disconnect endpoint previously
deleted only the stored token row, leaving the grant active at the OAuth
provider. This PR adds provider-side token revocation while keeping
local disconnect independent of provider availability.

## Changes

- Add `mcp_server_configs.oauth2_revocation_url` in migration `000547`.
The value can be configured manually, discovered from RFC 8414 metadata,
and managed through the MCP server settings UI. Non-admin responses
redact it with the other OAuth2 fields.
- Revoke the refresh token first through the RFC 7009 endpoint, then
fall back to the access token only for `unsupported_token_type`. Public
clients send `client_id`; confidential clients use
`client_secret_basic`.
- Delete the local token transactionally before best-effort provider
revocation. Callers without a token receive the same response for hidden
and nonexistent config IDs, and provider failures return a generic
warning without exposing provider response bodies.
- Require HTTPS revocation endpoints except for HTTP loopback URLs.
Redirects must preserve the POST and remain on the configured origin.
Redirect errors omit provider-controlled paths and query strings so
reflected token material cannot enter logs.
- Treat `200 OK` and `204 No Content` as completed revocations. `202
Accepted` remains a failure because it does not confirm completion.
- Prevent an in-flight refresh from recreating a token deleted by
disconnect. Refresh persistence now uses an optimistic update keyed by
token ID and `updated_at`; only the OAuth callback can create a token
row. Refresh conflicts reload the current row or clear in-memory auth
when disconnect deleted it.
- Return `{token_revoked, token_revocation_error}` from disconnect,
while retaining SDK compatibility with the legacy `204` response. The UI
surfaces provider revocation failures as warning toasts.
- Document revocation endpoint discovery, HTTPS requirements, and
best-effort disconnect behavior.

No token or no configured revocation URL returns `token_revoked: false`
without an error, so disconnect remains idempotent.

> Updated by Mux, an AI coding agent, on Mike's behalf.
 2026-07-20 00:14:03 +02:00
Michael Suchacz 33fcc9de68 fix(coderd/x/chatd): drop stale APIKeyID from CreateOptions test literal (#27331) 
> Mux is working on behalf of Mike.

Closes coder/internal#1622 (ENG-3061).

## Problem

`main` is broken: the chatd test package fails to compile, taking down
`lint`, `test-go-pg`, `test-go-pg-17`, and `test-go-race-pg`.

This was a semantic merge conflict between two individually green PRs:

- #27170 removed `APIKeyID` from `chatd.CreateOptions` (chatd now mints
a synthetic gateway key from the chat owner).
- #27070 branched before that merge and added the
`CreateChatProviderDisabledRejected` test, which sets `APIKeyID` in a
`CreateOptions` literal. Its CI ran against the old base and passed.

Merged together: `unknown field APIKeyID in struct literal of type
CreateOptions`.

## Fix

Two lines in the test:

- Drop the stale `APIKeyID` field from the `CreateOptions` literal.
- Create the chat owner with `dbgen.User` instead of a random
`uuid.New()`. On current `main`, `CreateChat` resolves the owner's
synthetic API key before the model-config recheck, so a nonexistent
owner fails with `sql: no rows` instead of reaching the
`ErrInvalidModelConfigID` assertion.

## Validation

- `go build ./...`
- `go test ./coderd/x/chatd/...` (full package, passes)
- pre-commit hooks (lint/go, lint/ts)
 2026-07-19 10:20:26 +00:00
Michael Suchacz 9b3af629cd fix: hide and reject chat models from disabled AI providers (#27070) 2026-07-19 08:33:40 +02:00
Michael Suchacz 34ed124478 fix(site): align React Compiler check scope with vite.config.mts (#27216) 
## Stack Context

First PR of a 6-PR stack that thins the agent instruction corpus (~4,800
lines down to ~2,800) by removing startup bloat, assigning each
procedure one canonical owner, and fixing rules that drifted from
reality. Split from #27203 for reviewability.

## Why?

`site/vite.config.mts` compiles `src/pages/AIBridgePage/` with the React
Compiler, but `site/scripts/check-compiler.mjs` did not include that
directory. Compiler regressions in AIBridgePage were invisible to CI:
code could silently bail out of compilation with no signal. The two
lists had already drifted once, which is exactly how this class of bug
recurs.

## What?

- Add `src/pages/AIBridgePage/` to the check-compiler scope. Verified
all 381 functions in scope compile cleanly.
- Cross-reference the two lists with comments so the next person who
edits one finds the other.

This is the only behavioral (non-docs) change in the stack, which is why
it sits at the bottom.

> This PR was prepared by Mux (AI agent) on Mike's behalf.
 2026-07-19 07:29:53 +02:00
Michael Suchacz 5f5efa49da fix: stop sending adaptive thinking to pre-4.6 Anthropic models (#27314) 
## Problem

A chat model config with `reasoning_effort` set on a pre-4.6 Anthropic
model (for example `claude-haiku-4-5`) fails every generation with HTTP
400 `adaptive thinking is not supported on this model`, surfaced in chat
as "Anthropic returned an unexpected error." The fantasy Anthropic
provider always serialized effort as `thinking: {type: "adaptive"}` plus
`output_config.effort`, a shape only Claude 4.6+ accepts.

## Changes

- Bump the coder/fantasy pin to include coder/fantasy#47: the provider
now converts effort into `{type: "enabled", budget_tokens}` on models
older than Claude 4.6, with the budget derived from the call's
`max_tokens` (aibridge-mirroring ratios, 1024-token API floor; below the
floor thinking is omitted, which keeps small-budget calls like title
generation working). Adaptive-capable models keep the current shape, and
Opus 4.5 keeps `output_config.effort` alongside the derived budget since
it supports effort without adaptive thinking. Models older than Claude
3.7 predate extended thinking, so effort sends no thinking at all there.
`minimal` is normalized to `low`, `xhigh` falls back to `max` on
adaptive models that predate the xhigh tier (Claude 4.7+); effort `none`
disables thinking, including an explicit `thinking: {type: "disabled"}`
on Claude 5+ models that otherwise run adaptive thinking by default. The
Bedrock provider wraps the Anthropic one, so both are covered, and
Vertex-style `@date` model IDs parse correctly.
- `TestActiveServer_CompactionModelOverride` previously codified the
buggy shape (asserting `output_config.effort` sent to
`claude-3-5-haiku-latest`). The summary-routing subtest is now a
three-case table: pre-thinking override models (Claude 3.5) expect no
thinking, legacy budget-thinking ones (Haiku 4.5) expect enabled
thinking with the derived budget, adaptive-capable ones still expect
`output_config.effort`.
- New regression test `TestActiveServer_AnthropicModelReasoningEffort`:
a `claude-haiku-4-5` config with `reasoning_effort` produces enabled
thinking with the derived budget and no `output_config` on the wire, and
a `claude-sonnet-5` config with effort `none` sends an explicit thinking
disable.
- `chattest.AnthropicRequest` gains a `Thinking` field so tests can
assert the thinking config.
- One-sentence note in the chatd ARCHITECTURE reasoning-effort section.

No chatd production code changes: `ApplyReasoningEffort` keeps setting
`Effort`, which is now valid for every Anthropic model.

## Validation

- `go test ./coderd/x/chatd/...` passes (19 packages).
- Fork PR validated separately: full fantasy test suite plus new
provider unit tests (version gating incl. Vertex/Bedrock IDs, budget
derivation, floor behavior, normalization, effort `none` incl. Claude 5+
disable, Opus 4.5 effort preservation, sampling-param stripping),
golangci-lint clean.

Closes
[CODAGT-812](https://linear.app/codercom/issue/CODAGT-812/reasoning-effort-on-pre-46-anthropic-models-fails-generations-with).

> This PR was authored by Mux, an AI coding agent, acting on Mike's
behalf.
 2026-07-18 22:47:02 +02:00
Michael Suchacz 1ea61b976b fix(site): prevent slash menu from flashing at top-left corner when closed (#27326) 
Typing `/` in the agent chat input opens the skills slash menu. Pressing
Backspace to erase the `/` made the menu flash at the top-left corner of
the app for a split second before disappearing.

Radix keeps the popover content mounted through its exit animation, but
the caret-positioned `PopoverAnchor` was unmounted in the same render
that closed the menu. Without an anchor, the popper repositioned the
still-visible closing content to the viewport origin. The anchor now
stays rendered at the last known caret rect, so the menu holds its
position while it animates out.

Verified with a frame-by-frame position recorder in the browser: before
the fix the closing menu jumped from the caret position to `(0, 4)`;
after the fix it stays in place until unmount. Added a
`BackspaceClosesMenuWithoutRepositioning` story that fails without the
fix.

> This PR was created by Mux, an AI coding agent, on Mike's behalf.
 2026-07-18 22:43:34 +02:00
Michael Suchacz 46d1823c0a feat: add workspace skills to agent chat slash menu (#25600) 
> This Pull Request was updated by Mux working on behalf of Mike.

Adds workspace skills to the agent chat slash menu, sourced entirely
from the chat's pinned context resources (the single-chat GET response
the page already fetches), the same inventory `read_skill` resolves
from. No new API endpoint is introduced.

Personal entries insert `/name`, or `/personal/name` when the name
collides with a workspace skill or the chat's pinned context has not
resolved yet; workspace entries insert `/workspace/name`. Qualified
aliases stay searchable even when the displayed trigger is bare. Before
a chat binds a workspace (new chat form, or a selected but unbound
workspace), the menu lists personal skills only.

Sending a message invalidates the chat detail query, and chatd
broadcasts a context watch event when a first-turn bind pins the chat,
so the menu picks up newly pinned context without a reload.

Makes `UpdateChatWorkspaceBinding` a no-op when the requested
workspace/build/agent binding is unchanged, preserving `updated_at` so
chat list ordering and watch events stay stable.

Includes regression coverage for the no-op binding guard, pinned-context
skill mapping, collision qualification, and skills menu behavior.

Refs
[CODAGT-474](https://linear.app/codercom/issue/CODAGT-474/ux-improvements-for-coder-agents)
(skills autocompleting in the editor).
 2026-07-18 21:52:02 +02:00
Michael Suchacz 997b5d0843 feat: add synthetic gateway keys (#27170) 
> Mux is working on behalf of Mike.

## Summary

Add a per-user synthetic API key for chatd AI Gateway attribution. Chatd
resolves the key from the chat owner, extends it before expiry, and
discards the generated bearer token so the key is never a usable
credential.

There is no mapping table. The key is resolved from `api_keys` by a
deterministic token name (`chatd_<owner_id>_session_token`), mirroring
the provisionerd session token model, with three deltas that chatd
needs:

- **Login type guard**: token names are unvalidated user input, so a
user can create a bearer token with the colliding name. The lookup
excludes `login_type = 'token'` rows, so chatd never picks up (or
extends) a real user token. Synthetic keys are minted with the owner's
login type, which is never `token`.
- **In-place expiry extension instead of delete-and-reinsert**: chat
generations have no stop boundary, and an in-flight generation may have
already delegated the current key ID to aibridged. Extending
`expires_at` keeps the key ID stable forever.
- **Advisory-lock mint**: the unique index on token names is partial
(`WHERE login_type = 'token'`), so nothing DB-enforces uniqueness for
synthetic keys. A per-user advisory lock serializes concurrent mints.

Keys carry a minimal scope (`api_key:read`) as defense in depth; the
delegated gateway path never evaluates scopes and the secret is
discarded at mint.

Migration 000544 removes the foreign keys from the legacy message and
queue `api_key_id` columns while chatd continues stamping them for
rolling compatibility. Stale IDs are tolerated because routing uses
`chats.owner_id`. Individual key deletion, delete-all, and password
reset remove the key without changing chat history or queue versions,
and the next lookup remints it. Suspension does not delete the key;
delegated gateway authorization rejects inactive users at request time.

This is the first PR in a three-PR rollout and must be fully deployed
before #27171.

Refs
https://linear.app/codercom/issue/CODAGT-561/maintain-synthetic-api-key-per-user-per-chat
 2026-07-18 20:45:13 +02:00
Nick Vigilante 4d4d2575e4 fix: exempt docs/.style/ prose from Vale's own Coder rules (#27192) 
## Problem

The repo-root `.vale.ini` lints all of `docs/**/*.md`, including the
style guide under `docs/.style/style-guide/`. The guide deliberately
contains the constructs the Coder rules ban:

- Don't examples in blockquotes and in the Don't column of Do/Don't
tables.
- Banned terms named in prose and headings (a rule about "Next steps"
must write "Next steps").

`Coder.BrandNames` already fired on the Brand names table's Don't column
(`Hashicorp`, `HASHICORP`), and each future `Coder.*` rule would fire on
its matching section's examples. Vale runs advisory, so these surface as
non-blocking annotations, exactly the standing backlog the README warns
against, and they break the documented "zero baseline findings"
doctrine.

## Change

Option B, narrowed after review to the style-guide subtree:

- `.vale.ini`: clear `BasedOnStyles` for `docs/.style/style-guide/**`
(the guide subpages only). The annotation demo and the rest of
`docs/.style/` stay linted; the demo keeps firing its `Coder.Demo*`
rules by inheriting `Coder` from `[*.md]`, with no re-include. Also
corrects the `error`-tier doctrine line to reflect advisory-only Vale.
- `docs/.style/README.md`: "What still runs" / "What does not run"
describe the narrowed exemption, and record that it holds only for paths
that resolve to `docs/.style/style-guide/...` (repo-root-relative), not
absolute or subdirectory-relative invocations.
- `docs/.style/style-guide/README.md`: exemption note scoped to
`docs/.style/style-guide/**`.
- `docs/.style/styles/Coder/BrandNames.yml`,
`docs/.style/styles/Coder/README.md`: fix the remaining dead
`style-guide.md` links (the `BrandNames.yml` one was a live 404 surfaced
in Vale annotations).

## Validation

- `make lint/prose` reports only the 3 intended `Coder.Demo*` findings
across the corpus; the guide's `BrandNames` findings are gone.
- `content-guidelines.md`, the landing `README.md`, and
`styles/Coder/README.md` are now linted and clean (0). Injecting a
miscased `Hashicorp` into `content-guidelines.md` fires
`Coder.BrandNames`; reverted.
- The guide subpages stay exempt (0); the annotation demo still fires
its 3 findings via `[*.md]`.
- Invocation-path behavior verified against
`docs/.style/style-guide/word-choice.md`: repo-root-relative `docs/...`
is exempt (0), while `docs/`-relative and absolute-path invocations
still fire 2 `Coder.BrandNames` errors.
- `markdownlint-cli2` clean on the changed READMEs.

## Decision log

Considered three options from the issue:

- **A. Surgical in-file suppression** (`vale off`/`vale on` comment
blocks, backticking banned terms). Rejected as primary: noisy in source,
repeated per example, bare-term headings still fire, and every new rule
can re-break the guide. It is path-independent, so it would have covered
the editor case noted in Option B's limitation.
- **B. Config-level subtree exemption** (chosen; narrowed to the guide
subtree after round-2 review). One place, zero source noise,
future-proof for the guide subpages.
- **Scope.** The clear applies to `docs/.style/style-guide/**` only.
Round-2 review (three reviewers converged, verified end-to-end) showed
the original directory-wide clear over-reached: `content-guidelines.md`
and the landing `README.md` are ordinary contributor prose that lints
clean today (`content-guidelines.md` uses `HashiCorp` correctly), so
they should stay linted. Narrowing to the guide subtree preserves the
exact 3-finding baseline, relints those two pages, removes the
last-match-wins ordering hazard, and drops the whole-package demo
re-include. The demo sits at the `.style/` root and keeps firing via
`[*.md]`.
- **Tradeoff.** The guide's own prose under `style-guide/` is no longer
auto-linted by Vale. Acceptable because the guide must contain banned
terms by design, one-sentence-per-line is enforced by markdownlint, and
human review covers the rest.
- **Limitation.** The exemption holds only for invocations whose path
resolves to `docs/.style/style-guide/...` (repo-root-relative
`docs/...`, what `make lint/prose` and CI pass). Absolute paths
(editors/LSP) and subdirectory-relative paths still flag the guide.
Recorded in `docs/.style/README.md`.
- **C. Restructure examples into fenced code blocks.** Rejected: changes
the guide's rendered format and doesn't cover Do/Don't tables or
headings.

## Notes

- `.vale.ini` is outside `docs/`, so this PR modifies repo-wide lint
config; the clear is scoped to `docs/.style/style-guide/` only.
- Linear: DOCS-543.

---
Opened via Coder Agents on behalf of @nickvigilante.
 2026-07-18 13:41:27 -04:00
Michael Suchacz 36e36e2048 fix(site): wrap workspace topbar controls on narrow viewports (#27313) 
On mobile-width viewports the workspace page grew to ~1080px wide (390px
viewport), pushing the schedule controls, status indicator, and action
buttons off-screen. Users had to zoom out or scroll horizontally to
reach Stop/Restart/Favorite/Share.

The topbar header and the right-side controls group used non-wrapping
flex rows, and every child is a `whitespace-nowrap` button, so the row's
minimum width (~725px for the controls alone) forced the document wider
than the viewport.

## Changes

- `WorkspaceTopbar`: allow the topbar header and the right controls
group to wrap; right controls stay right-aligned when they wrap onto
their own row.
- `WorkspaceActions`: allow the button row to wrap.
- `TopbarData`: merge a caller-provided `className` (no existing caller
passed one); the workspace breadcrumbs use it to wrap on very narrow
screens.

## Verification

Compared before/after with agent-browser on Storybook stories
(`Workspace: Running`, `WorkspaceTopbar: Outdated / WithQuotaWithOrgs /
Dormant / ConnectedWithMaxDeadline`):

| Viewport | Before `scrollWidth` | After `scrollWidth` |
|---|---|---|
| 320 | 1080 (overflow) | 305 (fits) |
| 390 | 1080 (overflow) | 375 (fits) |
| 768 | 1080 (overflow) | 753 (fits) |
| 1024 | 1080 (overflow) | 1009 (fits) |
| 1440 | 1425 (fits) | 1425, pixel-identical (0% diff) |

At widths >= 1280 the layout is unchanged (0% pixel diff at 1440 across
the stories above). Between ~1080-1230px the controls now wrap onto a
second right-aligned row instead of squeezing label text onto two lines
inside a single row.

Validation: `biome check`, `tsc --noEmit`, and `pnpm test:storybook` for
`Workspace.stories.tsx` + `WorkspaceTopbar.stories.tsx` (36 passed).

> This PR was prepared by Mux, an AI coding agent, on Mike's behalf.
 2026-07-17 18:12:25 +02:00
Michael Suchacz 1ac106255b feat: add Anthropic 1M context window toggle for Agents model configs (#27257) 2026-07-17 13:04:13 +02:00
Asher 2ac2295b1e fix: do not send or use stale init dynamic parameter state (#27283) 
In summary, we use the init message if we have no autofill params. If we
do, then we ignore the init message, send another message with the
autofilled values, and then when we get *that* response, finally we
render the form since we know we have good state. This eliminates the
possibility of temporarily rendering with stale state.

This is the same fix that was applied to the edit page, but on the
create page this time. The only difference is that the create page does
not need to wait on a build parameters query, instead it has to wait on
the first message from the socket (to get defaults).

This also makes one change where we would send the defaults in the init
message. The server already knows the defaults so there is no need to
send them. The advantage here is that we no longer need to wait for the
first message, and it also fixes an issue where fields with blank values
were getting validation errors because they were not filled out, before
the user had a chance to actually fill them out.
 2026-07-16 12:55:43 -08:00
Yevhenii Shcherbina 1453b4b1fc docs: document Bedrock mantle protocol (#27296) 
Implements:
https://linear.app/codercom/issue/AIGOV-518/add-docs-for-bedrock-mantle
Follow-up to: https://github.com/coder/coder/pull/26745
 2026-07-16 14:58:09 -04:00
Michael Suchacz 3dd9265fa6 feat: add UI option to disconnect OAuth2 MCP credentials (#27299) 
Closes
[CODAGT-804](https://linear.app/codercom/issue/CODAGT-804/add-ui-option-to-revoke-oauth-mcp-credentials).

Users could authenticate with an OAuth2 MCP server from the chat input,
but there was no UI to disconnect those per-user credentials. The
backend endpoint (`DELETE
/api/experimental/mcp/servers/{id}/oauth2/disconnect`) already existed.

## Changes

- Connected OAuth2 MCP rows in the chat input plus menu now show a
disconnect icon button next to the enable switch. It opens a
confirmation dialog; confirming calls the disconnect endpoint, shows a
toast, and refetches MCP configs so the row reverts to the `Auth` button
without a reload.
- New `disconnectMCPServerOAuth2` API client method and react-query
mutation that invalidates `mcp-server-configs`.
- Storybook interaction tests: control visibility per auth state, cancel
makes no API call, confirm calls the endpoint once, failed disconnect
keeps the dialog open.
- Hardened `TestMCPServerConfigsOAuth2Disconnect`: seeded tokens flip
`auth_connected`, disconnect only removes the calling user's token, and
repeat disconnect stays idempotent.

The endpoint removes the token stored in Coder; it does not revoke the
upstream OAuth grant, so the UI copy says "disconnect" rather than
"revoke".

Validated with the targeted Go test, Storybook tests (51 passed), tsc,
biome, the react-compiler check, and a manual dogfood run (seeded token,
disconnect/cancel/reconnect flows verified in the UI).

> This PR was authored by Mux, an AI coding agent, on Mike's behalf.
 2026-07-16 18:26:35 +02:00
Susana Ferreira 101aee8ee0 refactor: use Options struct in aibridgedserver.NewServer (#27200) 
Refactor `aibridgedserver.NewServer` to take an `Options` struct instead
of a long list of positional arguments. Follow-up to review feedback in
https://github.com/coder/coder/pull/27117#discussion_r3571535760
 2026-07-16 16:09:25 +01:00
Nick Vigilante 77582be805 fix: close <b> tag in generated audit log table header (#27293) 
## What

The audit log resource table header in
`docs/admin/security/audit-logs.md` was
emitted as `<b>Resource<b>`: a second opening `<b>` instead of a closing
`</b>`.
Because the bold element never closes, Markdown/HTML renderers can bold
content
well beyond the header cell.

The page is generated (`<!-- Code generated by 'make
docs/admin/security/audit-logs.md'. DO NOT EDIT -->`),
so the fix belongs in the generator, `scripts/auditdocgen/main.go`, with
the
doc regenerated from it.

## Changes

- `scripts/auditdocgen/main.go`: emit a closing `</b>` instead of a
second `<b>` in the table header row.
- `docs/admin/security/audit-logs.md`: regenerated with `make
docs/admin/security/audit-logs.md`; only the header cell changes.

## Verification

<details>
<summary>Regenerated doc and local checks</summary>

Header cell before (unclosed tag):

```text
| <b>Resource<b>                                   | ...
```

Header cell after (balanced tag):

```text
| <b>Resource</b>                                  | ...
```

- `make docs/admin/security/audit-logs.md` regenerates the page from the
fixed generator and changes only the header cell (single line; the table
stays aligned).
- Local `make pre-commit` passed with `GEN_SKIP_GOLDEN=1` (this
workspace has no Docker daemon for the golden-file gen step, which this
change does not touch): `gen`, `fmt`, `lint/go`, `lint/ts`,
`lint/markdown`, `lint/typos`, `lint/emdash`, and the slim binary build
all green.

</details>

## Linear

DOCS-580:
https://linear.app/codercom/issue/DOCS-580/fix-unclosed-b-tag-in-generated-audit-logs-table-header

---

This PR was created using AI (Coder Agents) on behalf of @nickvigilante,
who is accountable for its contents. See the [AI Contribution
guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING).
 2026-07-16 14:56:55 +00:00
Cian Johnston f7481c5d08 feat: Add full text search over chat messages (#27126) 
Closes CODAGT-721
Closes CODAGT-722
Closes CODAGT-723
Closes CODAGT-724
Closes CODAGT-725

This PR adds the database and API pieces necessary to support full-text
chat message search.

- Adds required chat schema for full-text search
- Adds dbpurge job to populate search_tsv in the background
- Adds `search` parameter to GetChats query
- Adds `search` filter to `searchquery.Chats`
- Wires chat search filter into chats API

> Implemented by Coder Agents, reviewed and tested by a human.
 2026-07-16 15:21:57 +01:00
Yevhenii ShcherbinaandJake Howell 9862f10484 feat(site): add Bedrock mantle protocol selector to provider form (#27156) 
Implements:
https://linear.app/codercom/issue/AIGOV-517/add-ui-for-bedrock-mantle

Follow-up to https://github.com/coder/coder/pull/26745, which added AWS
Bedrock **mantle** support to the backend and modeled it as a `protocol`
field on the Bedrock provider settings.
## What changed

- Adds a **Protocol** selector to the Bedrock provider form: InvokeModel
(default) or Mantle.
- The form is now protocol-aware:
- **Model** / **Small-fast model** fields are shown only for
InvokeModel. Mantle is a passthrough (the client sends the model at
request time), so the fields are hidden and omitted from the saved
settings.
- **Endpoint** validation, placeholder, and hint switch per protocol.
Mantle requires a `https://bedrock-mantle.{region}.api.aws/anthropic`
URL; InvokeModel keeps the
`https://bedrock-runtime.{region}.amazonaws.com` shape. The `/anthropic`
suffix is required for mantle because the SDK appends `/v1/messages` to
the base URL.

## Manual Testing

Tested the following scenarios:

1. Creating a new Mantle provider — works.
2. Creating a new InvokeModel provider — works.
3. Verifying that an existing InvokeModel provider continues to work.
4. Upgrading an existing InvokeModel provider to Mantle — works.

## Screenshots

### InvokeModel

<img width="1085" height="474" alt="image"
src="https://github.com/user-attachments/assets/4c36b9b0-0eb8-4b17-80b7-e2112325f8d1"
/>


### Mantle

<img width="1082" height="357" alt="image"
src="https://github.com/user-attachments/assets/e8caef26-83d1-4b7e-8f96-79079949e8f1"
/>

---------

Co-authored-by: Jake Howell <jake@hwll.me>
 2026-07-16 09:37:48 -04:00
Jeremy Ruppel b3ff4baeb9 fix: smooth compose loader to files page transition (#27277) 
## Summary

During the template builder compose flow, the transition into the
template
files page briefly flashed the wizard form again before the files page
settled.

Root cause: the loader was gated on `createMutation.isPending`. When the
compose
POST resolved, `isPending` flipped to `false` in the same commit that
`onSuccess` navigated to the files page, so `TemplateBuilderPageView`
repainted
the wizard form for a frame before the route change committed and
unmounted it.

Fix: keep the loader mounted while the mutation is pending **or**
succeeded
(`createMutation.isPending || createMutation.isSuccess`). Since
`onSuccess`
always navigates away, the loader stays until the component unmounts, so
the
form never reflashes. The error path is unaffected (`isSuccess` stays
false).

Resolves DEVEX-561.


https://github.com/user-attachments/assets/6d5ec04e-9f97-4864-bd18-e1e75055f079

## Scope

Targets the wizard form reflash only. Two adjacent items were identified
during
investigation and intentionally left out:

- The destination files page briefly shows its own `<Loader />` while it
fetches
template files. Smoothing that requires prefetching before navigation
and is a
  larger change.
- The `justCreated` "Awesome, you just created a template!" alert is
cleared by a
mount effect, so it renders one frame then disappears. Arguably its own
bug.

Happy to follow up on either if wanted.

## Testing

- Biome clean on the changed file.
- Manual: build a template through the wizard and confirm the loader
holds
  straight through to the files page with no form flash.

## Stack

Stacked on top of #27276 (DEVEX-593).

---

Generated by Coder Agents.
 2026-07-16 09:15:11 -04:00
Jeremy Ruppel 3ddf7d3baa fix: stop the template builder build progress bar from looping (#27276) 
## Summary

The template builder's "Building your template" loader had a progress
bar that
animated 0→100% every 5s with an infinite repeat, so it visibly
restarted over
and over while a template built. It looked broken and was frustrating to
watch.

This replaces the looping fill with a single ease-out fill that
decelerates
toward 90% and holds until the request resolves and the loader unmounts.

Since the loader is intentionally indeterminate and no progress is
streamed to
the browser, this also removes the now-dead `onUpdate` callback plumbing
from
the backend `waitForProvisionerJob` (its only caller passed `nil`).

Resolves DEVEX-593.


https://github.com/user-attachments/assets/6d5ec04e-9f97-4864-bd18-e1e75055f079

## Commits

- `refactor(coderd): drop unused onUpdate callback from
waitForProvisionerJob`
- `fix(site/src/pages/TemplateBuilder): stop build progress bar from
looping`

## Testing

- `go build ./coderd/` passes with the reduced `waitForProvisionerJob`
signature.
- Biome clean on the changed frontend file.
- Storybook: `pages/TemplateBuilder/BuildingTemplateLoader` shows the
bar fill
  once and hold, with no restart.

<details>
<summary>Implementation plan</summary>

# DEVEX-593: Stop the build progress bar from looping repeatedly

## Problem

While the template builder composes and imports a template, the FE shows
`BuildingTemplateLoader`. Its progress bar animates from 0% to 100% over
5s
with `repeat: Number.POSITIVE_INFINITY`, so it visibly restarts over and
over.
Users report this looks broken and is frustrating to watch while
waiting.

## Decision (scope)

Minimal fix only: **stop the loop**, plus remove the now-dead `onUpdate`
plumbing from the backend. Since the UI is intentionally indeterminate
and no
progress signal is streamed, the callback serves no purpose and should
be
deleted rather than left as dead code.

### Why not "real sync" now

- `POST /api/v2/templatebuilder/compose/template` is a single blocking
request.
  It composes, bundles, inserts the provisioner job, then calls
`waitForProvisionerJob(jobCtx, provisionerJob.ID, nil)` and only
responds once
  the job completes.
- The `onUpdate` callback runs server-side only. Nothing is streamed to
the
  browser during the wait, so the FE has no progress signal to bind to.
- A provisioner job exposes no numeric percentage. Only status
transitions
  (`pending -> running -> succeeded`) and coarse log stages
(`init/plan/graph/apply`) exist. Real sync would require converting the
endpoint to a streaming protocol (SSE/WebSocket) plus FE rework, which
is
  disproportionate for this 1-point ticket.

### Keep polling (do not switch to pubsub-block)

The wait could technically block instead of poll: on completion
`CompleteJob`
publishes `ProvisionerJobLogsNotifyMessage{EndOfLogs: true}` on the job
logs
notify channel, so we could subscribe and wait for that message with the
context timeout as a fallback. We deliberately do not do that here:
correctness
would require subscribe-before-completion plus an initial DB completion
check to
avoid a race, and Postgres LISTEN/NOTIFY is at-most-once (can drop under
load),
so a poll fallback would still be needed. The existing backoff poll
(100ms -> 200ms -> 500ms -> 1s) is simple and robust for a short-lived
synchronous request.

## Approach

Replace the looping fill with a single, non-repeating ease-out fill that
decelerates and approaches (but never reaches) ~90%, holding there until
the
request resolves and the loader unmounts. This reads as continuous
forward
progress for an unknown-duration operation and never restarts. The
floating-icon
animation is intentional ambient motion and is not in scope.

## Out of scope

- Any behavioral change to how the endpoint waits (it still blocks on
the job).
- Streaming real job progress to the browser.
- Changes to the floating-icon animation.

</details>

---

Generated by Coder Agents.
 2026-07-16 09:14:07 -04:00
TJandCoder Agents 529b2ead78 feat(site/src/pages/AgentsPage): show "Archived chats" sidebar heading when viewing archived chats (#26926) 
In the agents sidebar, show "Archived chats" instead of "Chats" when the
archive filter is set to `archived`. The heading reads the existing
`sidebarFilters.archiveStatus` state, the same condition already used
for the archived empty-state message.

---

_This PR was opened by [Coder Agents](https://coder.com/) on behalf of
@tracyjohnsonux._

---------

Co-authored-by: Coder Agents <noreply@coder.com>
 2026-07-16 06:04:52 -07:00
Michael Suchacz e489092154 feat: handle revoked OAuth grants for MCP servers gracefully (#27264) 
Closes
[CODAGT-792](https://linear.app/codercom/issue/CODAGT-792/handle-revoked-oauth-grants-for-mcp-servers-gracefully).

When a user revokes an upstream OAuth grant for an MCP server used by
Coder Agents, Coder kept treating the cached token as valid:
`invalid_grant` refresh failures were logged and swallowed, the dead
bearer token kept being attached, the list endpoints re-attempted the
refresh on every call, and the UI kept showing the server as
authenticated.

## Changes

Backend, mirroring the `external_auth_links` prior art:

- New migration adds
`mcp_server_user_tokens.oauth_refresh_failure_reason`.
`UpsertMCPServerUserToken` clears it, so completing the OAuth flow again
recovers the row.
- New `MarkMCPServerUserTokenRefreshFailure` query records the failure
and clears all token material, guarded by an `updated_at` optimistic
lock so a stale failure never clobbers a concurrently refreshed token
(on a lock miss the winner's row is used).
- `mcpclient.IsPermanentRefreshError` classifies `*oauth2.RetrieveError`
codes: only `invalid_grant` and `bad_refresh_token` are permanent.
Client/config errors (`invalid_client`, `unauthorized_client`, ...) stay
transient for the user row since reconnecting cannot fix them.
- chatd token refresh and the MCP list/get endpoints persist permanent
failures, return cleared tokens for the in-flight request, and skip
provider calls for already-failed rows.
- `buildAuthHeaders` no longer attaches an Authorization header for
failed tokens, so chat degrades by omitting that server's tools instead
of sending a dead bearer.

API and UI:

- No new API surface. A permanently failed token simply reports
`auth_connected: false`, so the existing "Auth" button and "Not
authenticated" tooltip appear and the user re-runs the same OAuth flow
to recover. An earlier revision added an `auth_status` enum (`connected`
/ `not_connected` / `reconnect_required`) with a dedicated "Reconnect"
button; it was collapsed to keep the API minimal since both states lead
to the identical re-auth action.

Out of scope (follow-up): typed 401-on-connect detection and forced
refresh. mcp-go exposes no stable typed 401 signal in the static-header
path, so a revocation while the access token still looks valid locally
stays undetected until expiry triggers a refresh.

## Testing

- Unit and integration tests: classifier, chatd refresh paths
(permanent/transient/race/persist-failure), API endpoints (revoked,
transient, no-retry caching, re-auth recovery, stale-lock), dbauthz,
dbcrypt, migrations.
- Dogfood UAT against a dev instance with a mock IdP returning
`invalid_grant`: revoked grant detected on refresh and persisted once
(no repeated IdP calls), chat with the revoked server selected completes
with the server's tools omitted, and re-auth restores the connected
state.

> This PR was authored by Mux, working on Mike's behalf.
 2026-07-16 11:43:05 +00:00
Danielle Maywood 213f5ce606 fix(site): redesign provider tri-state controls (#27288) 2026-07-16 12:12:38 +01:00
Danielle Maywood 457fa5afa3 fix(site): move thinking settings to provider configuration (#27287) 2026-07-16 12:12:24 +01:00
Danielle Maywood 9d1e881093 refactor(site/src/pages/AgentsPage): use model selector for personal overrides (#27229) 2026-07-16 11:22:48 +01:00
Ehab Younes 35ade9e3d2 feat: collect workspace logs in support bundles (#26694) 
Add workspace-side file collection to `coder support bundle` via
repeatable --workspace-file flags. The agent resolves the requested
paths or globs inside the remote workspace and streams back a tar with
a manifest and the collected files; nothing is read from the machine
running the command.

- Add POST /api/v0/bundle-files to the agent's agentfiles package.
- Expand env vars in the agent's environment; paths must then be
  absolute or start with ~/ (the agent user's home directory).
- Support ** globs and tail oversized files.
- Record requested patterns, per-path errors, truncation, and the
  applied limits in a manifest.
- Unpack the archive into the bundle under agent/workspace_files/,
  recording dropped entries in collection_errors.txt.
- Write a manifest-only archive marking collection as unsupported for
  agents that predate the endpoint.
- Bound collection: 64 KB request body, 10000 files, 10 MiB per file,
  100 MiB total including archive overhead, 110 MiB client-side read
  cap, 5 minute timeout.

Closes #26020
 2026-07-16 13:00:32 +03:00
Mathias Fredriksson f997afa220 feat(coderd/x/chatd/chatloop): retain user constraints in compaction summaries (#27230) 
Compaction summaries drop or soften user-stated constraints,
corrections, and prohibitions, so post-compaction assistants repeat
behavior the user already corrected. Add a summary prompt bullet that
instructs the summarizer to quote them, treat them as standing until
revoked, and attribute rules to their true source instead of
defaulting to the user.

Validated offline on unseen human chats: holdout P1 delta +0.175
(arbitrated), 13/18 cases improve. This improves per-compaction
retention only; it does not address deep-chain correction loss.
 2026-07-16 09:18:43 +00:00
Spike Curtis fa4c7c5700 chore: fix replicasync to function for NATS even if no DERP relay address is set (#27235) 
<!--

If you have used AI to produce some or all of this PR, please ensure you have read our [AI Contribution guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING) before submitting.

-->

Fixes `replicasync` so that it keeps peers even if they don't set a RelayAddress. This allows NATS to function even if you are not running a DERP relay on the primay Coderd instances.

Also renames some replicasync functions to make it clear they are for DERP.
 2026-07-16 09:42:23 +02:00