mirror of
https://github.com/coder/coder.git
synced 2026-09-21 12:44:32 +08:00
ff6f5893df1209191bdc5574f92c2c8d52e94328
13712
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Yevhenii Shcherbina
|
ff6f5893df |
docs: byok docs (#24032)
## Summary Adds BYOK (Personal API Key) documentation for OpenCode. ## BYOK support | Client | Personal API Key | ChatGPT Subscription | Claude Subscription | |--------------|------------------|----------------------|---------------------| | Codex CLI | ✅ | ✅ | - | | Claude Code | ✅ | - | ✅ | | Mux | ? | ? | ? | | OpenCode | ✅ | ❌ | ❌ | | Factory | ✅ | ❌ | ❌ | | Cline | ✅ Only OpenAI API | ❌ | ❌ | | KiloCode | ❌ (client-side bug) | ❌ | ❌ | | RooCode | ✅ Only OpenAI API | ❌ | ❌ | | VSCode | ❌ | ❌ | ❌ | | JetBrains | ❌ | ❌ | ❌ | | Zed | ❌ | ❌ | ❌ | | Copilot CLI | ? | ? | ? | <details> <summary>Why OpenCode doesn't support subscriptions through AI Bridge</summary> **ChatGPT subscription**: OpenCode's codex plugin [hardcodes the upstream URL](https://github.com/anomalyco/opencode/blob/3a0e00dd7f9192730f6d0eeee37ae0a5fb023927/packages/opencode/src/plugin/codex.ts#L458-L460) to `https://chatgpt.com/backend-api/codex/responses` inside a custom `fetch`, bypassing any configured `baseURL`. **Claude subscription**: Anthropic [no longer supports](https://www.reddit.com/r/ClaudeAI/comments/1r9hqdk/claude_subscriptions_will_no_longer_be_usable_in/) using subscriptions in third-party clients. </details> ## Notes - Anthropic forbids Claude subscription in all 3rd-party clients - OpenCode supports ChatGPT subscription, but there is no way to customize BaseURL - Does it make sense to investigate Mux? - Factory doesn't support ChatGPT subscription - Cline supports ChatGPT subscription, but there is no way to customize BaseURL - KiloCode supports CustomHeaders, but I wasn't able to make it work neither for centralized key nor for BYOK. Seems support for custom providers has bugs. I got different errors for different models, this one is common: `Unsupported parameter: 'max_tokens' is not supported with this model. Use 'max_completion_tokens' instead.` Seems should be fixed on KiloCode side. - RooCode and Cline support only OpenAI. They have special OpenAI-Compatible provider which allows adding custom headers. - VSCode (NativeChat) uses github copilot under the hood. I wasn't able to make it work, neither in VSCode nor in VSCode-Insiders on my MacOS. I used VSCode-Insiders Version: 1.116.0-insider (Universal). I got different errors. When I used Github Copilot Chat (stable release - it ignored my AI Gateway configuration), when I tried to install Github Copilot Chat pre-release it failed with `~/.vscode-insiders/extensions/github.copilot-chat-0.43.2026040705` - JetBrains (embedded AI assistant). OpenAI Compatible provider doesn't support custom headers. Also I got some errors even for centralized key setup. - Zed doesn't support custom headers - Copilot CLI is special, because it's only supported via gateway proxy. But it also means that we don't need support of custom headers, because `X-AI-Gov-Token` is set by proxy itself. So if BYOK is supported in CopilotCLI - it should be supported for CopilotCLI via Bridge and BridgeProxy. ## Questions - Do we want to explicitly state that Claude Max/Pro or ChatGPT Plus/Pro subscriptions aren’t supported by OpenCode via AIBridge? I initially avoided mentioning it since this could change over time, and keeping that information up to date across clients might be difficult. |
||
|
Thomas Kosiewski
|
8382e96a81 | feat: add types, context, and model normalization (#23914) | ||
|
Kyle Carberry
|
a414d37165 |
feat(site/src/pages/AgentsPage): add full-width chat layout toggle (#24307)
Adds a user preference to remove the `max-w-3xl` constraint on agent chat messages, letting the content fill the available viewport width. The toggle lives in **Agents > Settings > Behavior** under "Chat Layout" and persists via `localStorage` (`agents.chat-full-width`). A `useSyncExternalStore` hook (`useChatFullWidth`) provides same-tab reactivity so flipping the toggle updates all mounted consumers immediately — the chat timeline, chat input, the Suspense skeleton, and the in-page loading view. This was requested by a customer and is an individual user setting, so it seems fine to add. |
||
|
Jake Howell
|
e0902e3c27 |
feat: demui the <LinearProgress /> dependency (#24275)
Adds a small LinearProgress (determinate + MUI-style dual-bar indeterminate) and uses it on workspace build progress; drops MUI and adds Tailwind keyframes + Storybook stories. - New component under `site/src/components/LinearProgress/` - `WorkspaceBuildProgress` switched off `@mui/material/LinearProgress` - Added `bar-indeterminate` / `bar-indeterminate-2` animation keyframes <img width="563" height="115" alt="image" src="https://github.com/user-attachments/assets/bdcd8584-fa2d-487c-96f6-084891a9b084" /> |
||
|
Cian Johnston
|
11fe4972b6 |
fix(site): use readonly Organization[] and explicit is_default lookups (#24288)
`OrganizationAutocomplete` declared `options: Organization[]` (mutable), but `useDashboard().organizations` returns `readonly Organization[]`. Callers forced to spread to satisfy the type even though the component never mutates the array. While fixing this, found two more issues with how organization context is resolved: - `AgentCreateForm`, `ChatPageContent`, and `OrganizationRedirect` used `organizations[0]` assuming the default org is first — nothing guarantees that ordering. - `ChatPageInput` was guessing the org from `useDashboard()` for file uploads on existing chats, even though the chat already has `organization_id`. In multi-org deployments, uploads could land in the wrong org. Changes: - Widen `OrganizationAutocomplete` `options` to `readonly Organization[]` - Remove unnecessary `[...organizations]` spread in `AgentCreateForm` - Replace all `organizations[0]` with `.find(o => o.is_default) ?? organizations[0]` for users not in the default org - Eliminate `[...organizations].sort()` allocation in `OrganizationRedirect` with direct `.find()` lookups (equivalent priority: editable default → any editable → viewable default → any viewable) - Thread `chat.organization_id` from `AgentChatPage` → `AgentChatPageView` → `ChatPageInput` so file uploads use the chat's actual org instead of guessing Closes #24285 > 🤖 PR initially created by Claude Opus 4.6 |
||
|
Kyle Carberry
|
69917b4516 |
fix: resolve flaky TestWatchChats/DiffStatusChangeIncludesDiffStatus (#24298)
## Problem `TestWatchChats/DiffStatusChangeIncludesDiffStatus` flakes with: ``` failed to read JSON message: failed to get reader: context deadline exceeded ``` Tracker: https://github.com/coder/internal/issues/1467 ## Root Cause The test published a pubsub event **once**, immediately after `client.Dial()` returned. However, `Dial` completes as soon as the HTTP upgrade finishes — before the server-side `watchChats` handler has called `SubscribeWithErr` on the pubsub channel. When the publish races ahead of the subscription, the message is silently dropped and the `wsjson.Read` loop blocks until the context deadline. ## Fix Publish the event on a short ticker (`testutil.IntervalFast` = 25ms) in a background goroutine instead of publishing once. This guarantees that at least one publish lands **after** the subscription is active, regardless of goroutine scheduling. The goroutine is cleanly stopped via a `publishDone` channel once the expected event is received. ## Verification - `go test -race -count=50 -run TestWatchChats/DiffStatusChangeIncludesDiffStatus` → **50/50 PASS, 0 races** - `go test -race -count=5 -run TestWatchChats` → **all 5 subtests pass 5/5 times** |
||
|
Garrett DelfosseandJakub Domeracki
|
079dc48ba0 |
ci: use GitHub App for community label org membership check (#24149)
Supersedes #23343. ## Problem `author_association` on `pull_request_target` events is unreliable: - Returns `CONTRIBUTOR` instead of `MEMBER` when both apply ([actions/github-script#643](https://github.com/actions/github-script/issues/643)). - Returns `NONE` for members with private org visibility ([community#18690](https://github.com/orgs/community/discussions/18690)). This causes org members to incorrectly receive the `community` label. ## Approach Replace the `author_association` check with an explicit `orgs.checkMembershipForUser()` API call, which reliably detects both public and private org members. Uses a dedicated **GitHub App** via `actions/create-github-app-token` instead of a PAT. The App only needs **Organization > Members: Read** permission. Installation tokens are short-lived (1 hour) and auto-rotated — no long-lived secrets to worry about. ### Setup required A repo/org admin needs to: 1. Create a GitHub App with only **Organization > Members: Read** permission. 2. Install it on the `coder` org. 3. Store the App ID as a repository variable: `ORG_MEMBERSHIP_APP_ID`. 4. Store the App's private key as a repository secret: `ORG_MEMBERSHIP_APP_PRIVATE_KEY`. > [!NOTE] > Generated by Coder Agents --------- Co-authored-by: Jakub Domeracki <jakub@coder.com> |
||
|
Yevhenii Shcherbina
|
b78eba9f9d |
feat: make sure creds are always masked (#24241)
## Summary Adds a `sanitizeCredentialHint` safety check in the db-to-SDK conversion layer to ensure credential hints are always masked before being exposed in the API. Also adds `credential_kind` and `credential_hint` assertions to the session threads API test. |
||
|
Zach
|
4854f33678 |
feat: add secret value and file path validation (#24269)
Add secret value validation to reject null bytes and values exceeding 32KB. The 32KB limit applies uniformly to both env var and file secrets because the value field is shared and the destination can change after creation. Add file path validation to also reject null bytes and paths exceeding 4096 bytes. Wire up secret value validation into both POST and PATCH handlers. |
||
|
Thomas Kosiewski
|
6ab30123bf | feat: add chat debug log tables, queries, and SDK types (#23913) | ||
|
Jake Howell
|
58c6855c59 |
feat: de-mui <Skeleton /> component (#24278)
Replaces remaining MUI `<Skeleton />` usages with our shared `Skeleton` component to keep loading states consistent and reduce MUI/Emotion coupling. Also cleans up a few adjacent touched styles while preserving existing behavior. - Replace `@mui/material/Skeleton` with `#/components/Skeleton/Skeleton` - Remove a few MUI-specific skeleton patterns at callsites - De-mui adjacent Emotion styles - Simplify filter layout handling with class-based responsive wrapping |
||
|
Danielle Maywood
|
39ceb8cfe3 | fix(site): show "Preparing" in workspace pill during agent startup scripts (#24286) | ||
|
Cian JohnstonandMathias Fredriksson
|
22062ec52e |
feat: add organization scoping to chats (#23827)
Fixes https://github.com/coder/internal/issues/1436 * Adds organization_id to chats with backfill (workspace org → user org membership → default org) * No support yet for ACLs (follow-up issue) - Cross-org workspace binding rejected (both in `CreateChatRequest` and in `create_workspace` tool - Adds `OrganizationAutocomplete` to `AgentCreateForm` - Docs updated with `organization_id` in chats-api.md > 🤖 Written by a Coder Agent. Reviewed by many humans and many agents. --------- Co-authored-by: Mathias Fredriksson <mafredri@gmail.com> |
||
|
Danielle Maywood
|
cb0b84a2d3 | feat: show build logs in chat for start_workspace and create_workspace tools (#24194) | ||
|
Jake Howell
|
982739f3bf |
feat: add a debounce to menu filtering (#24048)
This pull-request implements a small debounce to ensure we aren't constantly pinging the backend on each keystroke of an input. <img width="962" height="317" alt="image" src="https://github.com/user-attachments/assets/4f187c18-0dd8-4456-bcc1-59ad7ce9c7dd" /> https://github.com/user-attachments/assets/5787310a-2c1e-448a-a4b7-123eb9d50124 |
||
|
Jake Howell
|
7b02a51841 |
feat: refactor <AgentLogs /> error state (#24233)
This pull-request addresses a few design things within the `<AgentRow />` element. This is a follow-on from the previous work done with implementing tabs. - Workspace border can no longer be red, will always be orange (this was done in a previous PR but not stated). - Warnings have been moved to inside the Agent Logs collapsible. - Warning badge has been added to the Agent Logs collapsible trigger. - Collapsible is now open by default when there is an error inside of the agent. - Agent disconnected is no longer prominent by default. |
||
|
david-fraley
|
bd467ce443 | chore: update EA text and docs link in Coder Agents UI (#24255) | ||
|
Kayla はな
|
c67c93982b | chore: fix typescript skill table (#24217) | ||
|
Zach
|
2f52de7cfc |
feat(agent/proto): add user secrets to agent manifest (#24252)
Add workspace secrets as a field in the agent manifest protobuf schema. This allows the control plane to pass user secrets to agents for runtime injection into workspace sessions. Message fields: - env_name: environment variable name (empty for file-only secrets) - file_path: file path (empty for env-only secrets) - value: the decrypted secret value as bytes |
||
|
dependabot[bot]
|
0552b927b2 |
chore: bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.67.0 to 0.68.0 (#24078)
Bumps [go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp](https://github.com/open-telemetry/opentelemetry-go-contrib) from 0.67.0 to 0.68.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-go-contrib/releases">go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp's releases</a>.</em></p> <blockquote> <h2>Release v1.43.0/v2.5.0/v0.68.0/v0.37.0/v0.23.0/v0.18.0/v0.16.0/v0.15.0</h2> <h2>Added</h2> <ul> <li>Add <code>Resource</code> method to <code>SDK</code> in <code>go.opentelemetry.io/contrib/otelconf/v0.3.0</code> to expose the resolved SDK resource from declarative configuration. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8660">#8660</a>)</li> <li>Add support to set the configuration file via <code>OTEL_CONFIG_FILE</code> in <code>go.opentelemetry.io/contrib/otelconf</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8639">#8639</a>)</li> <li>Add support for <code>service</code> resource detector in <code>go.opentelemetry.io/contrib/otelconf</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8674">#8674</a>)</li> <li>Add support for <code>attribute_count_limit</code> and <code>attribute_value_length_limit</code> in tracer provider configuration in <code>go.opentelemetry.io/contrib/otelconf</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8687">#8687</a>)</li> <li>Add support for <code>attribute_count_limit</code> and <code>attribute_value_length_limit</code> in logger provider configuration in <code>go.opentelemetry.io/contrib/otelconf</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8686">#8686</a>)</li> <li>Add support for <code>server.address</code> and <code>server.port</code> attributes in <code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8723">#8723</a>)</li> <li>Add support for <code>OTEL_SEMCONV_STABILITY_OPT_IN</code> in <code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>. Supported values are <code>rpc</code> (default), <code>rpc/dup</code> and <code>rpc/old</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8726">#8726</a>)</li> <li>Add the <code>http.route</code> metric attribute to <code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8632">#8632</a>)</li> </ul> <h2>Changed</h2> <ul> <li>Prepend <code>_</code> to the normalized environment variable name when the key starts with a digit in <code>go.opentelemetry.io/contrib/propagators/envcar</code>, ensuring POSIX compliance. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8678">#8678</a>)</li> <li>Move experimental types from <code>go.opentelemetry.io/contrib/otelconf</code> to <code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8529">#8529</a>)</li> <li>Normalize cached environment variable names in <code>go.opentelemetry.io/contrib/propagators/envcar</code>, aligning <code>Carrier.Keys</code> output with the carrier's normalized key format. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8761">#8761</a>)</li> </ul> <h2>Fixed</h2> <ul> <li>Fix <code>go.opentelemetry.io/contrib/otelconf</code> Prometheus reader converting OTel dot-style label names (e.g. <code>service.name</code>) to underscore-style (<code>service_name</code>) in <code>target_info</code> when both <code>without_type_suffix</code> and <code>without_units</code> are set. Use <code>NoTranslation</code> instead of <code>UnderscoreEscapingWithoutSuffixes</code> to preserve dot-style label names while still suppressing metric name suffixes. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8763">#8763</a>)</li> <li>Limit the request body size at 1MB in <code>go.opentelemetry.io/contrib/zpages</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8656">#8656</a>)</li> <li>Fix server spans using the client's address and port for <code>server.address</code> and <code>server.port</code> attributes in <code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8723">#8723</a>)</li> </ul> <h2>Removed</h2> <ul> <li>Host ID resource detector has been removed when configuring the <code>host</code> resource detector in <code>go.opentelemetry.io/contrib/otelconf</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8581">#8581</a>)</li> </ul> <h2>Deprecated</h2> <ul> <li>Deprecate <code>OTEL_EXPERIMENTAL_CONFIG_FILE</code> in favour of <code>OTEL_CONFIG_FILE</code> in <code>go.opentelemetry.io/contrib/otelconf</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8639">#8639</a>)</li> </ul> <h2>What's Changed</h2> <ul> <li>chore(deps): update module github.com/jgautheron/goconst to v1.9.0 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8651">open-telemetry/opentelemetry-go-contrib#8651</a></li> <li>chore(deps): update module go.yaml.in/yaml/v2 to v2.4.4 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8652">open-telemetry/opentelemetry-go-contrib#8652</a></li> <li>chore(deps): update golang.org/x/telemetry digest to e526e8a by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8647">open-telemetry/opentelemetry-go-contrib#8647</a></li> <li>chore(deps): update module k8s.io/klog/v2 to v2.140.0 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8650">open-telemetry/opentelemetry-go-contrib#8650</a></li> <li>chore(deps): update module github.com/mgechev/revive to v1.14.0 by <a href="https://github.com/mmorel-35"><code>@mmorel-35</code></a> in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8646">open-telemetry/opentelemetry-go-contrib#8646</a></li> <li>chore(deps): update module github.com/mgechev/revive to v1.15.0 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8539">open-telemetry/opentelemetry-go-contrib#8539</a></li> <li>chore: fix noctx issues by <a href="https://github.com/mmorel-35"><code>@mmorel-35</code></a> in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8645">open-telemetry/opentelemetry-go-contrib#8645</a></li> <li>chore(deps): update golang.org/x by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8655">open-telemetry/opentelemetry-go-contrib#8655</a></li> <li>chore(deps): update module codeberg.org/chavacava/garif to v0.2.1 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8654">open-telemetry/opentelemetry-go-contrib#8654</a></li> <li>chore(deps): update module github.com/mattn/go-runewidth to v0.0.21 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8653">open-telemetry/opentelemetry-go-contrib#8653</a></li> <li>fix(deps): update module go.opentelemetry.io/proto/otlp to v1.10.0 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8657">open-telemetry/opentelemetry-go-contrib#8657</a></li> <li>Limit the number of bytes read from the zpages body by <a href="https://github.com/dmathieu"><code>@dmathieu</code></a> in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8656">open-telemetry/opentelemetry-go-contrib#8656</a></li> <li>fix(deps): update module github.com/golangci/golangci-lint/v2 to v2.11.2 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8648">open-telemetry/opentelemetry-go-contrib#8648</a></li> <li>fix(deps): update module github.com/golangci/golangci-lint/v2 to v2.11.3 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8661">open-telemetry/opentelemetry-go-contrib#8661</a></li> <li>chore(deps): update github.com/securego/gosec/v2 digest to 8895462 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8663">open-telemetry/opentelemetry-go-contrib#8663</a></li> <li>otelconf: support OTEL_CONFIG_FILE as it is no longer experimental by <a href="https://github.com/codeboten"><code>@codeboten</code></a> in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8639">open-telemetry/opentelemetry-go-contrib#8639</a></li> <li>chore(deps): update module github.com/sonatard/noctx to v0.5.1 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/pull/8664">open-telemetry/opentelemetry-go-contrib#8664</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md">go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp's changelog</a>.</em></p> <blockquote> <h2>[1.43.0/2.5.0/0.68.0/0.37.0/0.23.0/0.18.0/0.16.0/0.15.0] - 2026-04-03</h2> <h3>Added</h3> <ul> <li>Add <code>Resource</code> method to <code>SDK</code> in <code>go.opentelemetry.io/contrib/otelconf/v0.3.0</code> to expose the resolved SDK resource from declarative configuration. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8660">#8660</a>)</li> <li>Add support to set the configuration file via <code>OTEL_CONFIG_FILE</code> in <code>go.opentelemetry.io/contrib/otelconf</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8639">#8639</a>)</li> <li>Add support for <code>service</code> resource detector in <code>go.opentelemetry.io/contrib/otelconf</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8674">#8674</a>)</li> <li>Add support for <code>attribute_count_limit</code> and <code>attribute_value_length_limit</code> in tracer provider configuration in <code>go.opentelemetry.io/contrib/otelconf</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8687">#8687</a>)</li> <li>Add support for <code>attribute_count_limit</code> and <code>attribute_value_length_limit</code> in logger provider configuration in <code>go.opentelemetry.io/contrib/otelconf</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8686">#8686</a>)</li> <li>Add support for <code>server.address</code> and <code>server.port</code> attributes in <code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8723">#8723</a>)</li> <li>Add support for <code>OTEL_SEMCONV_STABILITY_OPT_IN</code> in <code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>. Supported values are <code>rpc</code> (default), <code>rpc/dup</code> and <code>rpc/old</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8726">#8726</a>)</li> <li>Add the <code>http.route</code> metric attribute to <code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8632">#8632</a>)</li> </ul> <h3>Changed</h3> <ul> <li>Prepend <code>_</code> to the normalized environment variable name when the key starts with a digit in <code>go.opentelemetry.io/contrib/propagators/envcar</code>, ensuring POSIX compliance. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8678">#8678</a>)</li> <li>Move experimental types from <code>go.opentelemetry.io/contrib/otelconf</code> to <code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8529">#8529</a>)</li> <li>Normalize cached environment variable names in <code>go.opentelemetry.io/contrib/propagators/envcar</code>, aligning <code>Carrier.Keys</code> output with the carrier's normalized key format. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8761">#8761</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Fix <code>go.opentelemetry.io/contrib/otelconf</code> Prometheus reader converting OTel dot-style label names (e.g. <code>service.name</code>) to underscore-style (<code>service_name</code>) in <code>target_info</code> when both <code>without_type_suffix</code> and <code>without_units</code> are set. Use <code>NoTranslation</code> instead of <code>UnderscoreEscapingWithoutSuffixes</code> to preserve dot-style label names while still suppressing metric name suffixes. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8763">#8763</a>)</li> <li>Limit the request body size at 1MB in <code>go.opentelemetry.io/contrib/zpages</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8656">#8656</a>)</li> <li>Fix server spans using the client's address and port for <code>server.address</code> and <code>server.port</code> attributes in <code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8723">#8723</a>)</li> </ul> <h3>Removed</h3> <ul> <li>Host ID resource detector has been removed when configuring the <code>host</code> resource detector in <code>go.opentelemetry.io/contrib/otelconf</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8581">#8581</a>)</li> </ul> <h3>Deprecated</h3> <ul> <li>Deprecate <code>OTEL_EXPERIMENTAL_CONFIG_FILE</code> in favour of <code>OTEL_CONFIG_FILE</code> in <code>go.opentelemetry.io/contrib/otelconf</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8639">#8639</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/45977a4b9cf4a60effd1ee07367043f7e9bcae66"><code>45977a4</code></a> Release v1.43.0/v2.5.0/v0.68.0/v0.37.0/v0.23.0/v0.18.0/v0.16.0/v0.15.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8769">#8769</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/0fcc1524d1a740b3632db418f73236d29536f119"><code>0fcc152</code></a> fix(deps): update module github.com/googlecloudplatform/opentelemetry-operati...</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/eaba3cdaa1559cc7425644e21a389f227e30dc86"><code>eaba3cd</code></a> chore(deps): update googleapis to 6f92a3b (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8776">#8776</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/6df430c48045ad1221f203c01f6656367dd46fd1"><code>6df430c</code></a> chore(deps): update module github.com/jgautheron/goconst to v1.10.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8771">#8771</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/ae90e3237e8d8f14bc3f181e1f82feb1686604f0"><code>ae90e32</code></a> Fix otelconf prometheus label escaping (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8763">#8763</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/f202c3f8000fe3e681621808b5e316fe4749850a"><code>f202c3f</code></a> otelconf: move experimental types to otelconf/x (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8529">#8529</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/8ddaecee1cc531ae753d4812842745bdfb805208"><code>8ddaece</code></a> fix(deps): update aws-sdk-go-v2 monorepo (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8764">#8764</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/c7c03a47d4cf7252728b11efd78e2159b437dbd2"><code>c7c03a4</code></a> chore(deps): update module github.com/mattn/go-runewidth to v0.0.22 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8766">#8766</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/717a85a20313ac21712dd055ba2ede71205889e8"><code>717a85a</code></a> envcar: normalize cached environment variable names (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8761">#8761</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go-contrib/commit/ad990b6d55811953d06ec88720fa373931fa1a27"><code>ad990b6</code></a> fix(deps): update module github.com/aws/smithy-go to v1.24.3 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8765">#8765</a>)</li> <li>Additional commits viewable in <a href="https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.67.0...zpages/v0.68.0">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
16b1b6865d |
chore: bump google.golang.org/api from 0.274.0 to 0.275.0 (#24260)
Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.274.0 to 0.275.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's releases</a>.</em></p> <blockquote> <h2>v0.275.0</h2> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.274.0...v0.275.0">0.275.0</a> (2026-04-07)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3557">#3557</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/2b2ef99cb9f245743690a4d26e4fdc65287253e0">2b2ef99</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3560">#3560</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/9437d4d741a6ae9e1c20a6f727b9c8f64e1bc19e">9437d4d</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/googleapis/google-api-go-client/compare/v0.274.0...v0.275.0">0.275.0</a> (2026-04-07)</h2> <h3>Features</h3> <ul> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3557">#3557</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/2b2ef99cb9f245743690a4d26e4fdc65287253e0">2b2ef99</a>)</li> <li><strong>all:</strong> Auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3560">#3560</a>) (<a href="https://github.com/googleapis/google-api-go-client/commit/9437d4d741a6ae9e1c20a6f727b9c8f64e1bc19e">9437d4d</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/googleapis/google-api-go-client/commit/d43aa15bdf02279f1beaa366b551587391355265"><code>d43aa15</code></a> chore(main): release 0.275.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3558">#3558</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/9437d4d741a6ae9e1c20a6f727b9c8f64e1bc19e"><code>9437d4d</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3560">#3560</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/0a62c64ae95b23c6ecb9fc71db89f09c479b0442"><code>0a62c64</code></a> chore(all): update cloud.google.com/go/auth to v0.20.0 (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3559">#3559</a>)</li> <li><a href="https://github.com/googleapis/google-api-go-client/commit/2b2ef99cb9f245743690a4d26e4fdc65287253e0"><code>2b2ef99</code></a> feat(all): auto-regenerate discovery clients (<a href="https://redirect.github.com/googleapis/google-api-go-client/issues/3557">#3557</a>)</li> <li>See full diff in <a href="https://github.com/googleapis/google-api-go-client/compare/v0.274.0...v0.275.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
897533f08d |
chore: bump github.com/coreos/go-oidc/v3 from 3.17.0 to 3.18.0 (#24261)
Bumps [github.com/coreos/go-oidc/v3](https://github.com/coreos/go-oidc) from 3.17.0 to 3.18.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/coreos/go-oidc/releases">github.com/coreos/go-oidc/v3's releases</a>.</em></p> <blockquote> <h2>v3.18.0</h2> <h2>What's Changed</h2> <ul> <li>.github: configure dependabot by <a href="https://github.com/ericchiang"><code>@ericchiang</code></a> in <a href="https://redirect.github.com/coreos/go-oidc/pull/477">coreos/go-oidc#477</a></li> <li>.github: update go versions in CI by <a href="https://github.com/ericchiang"><code>@ericchiang</code></a> in <a href="https://redirect.github.com/coreos/go-oidc/pull/480">coreos/go-oidc#480</a></li> <li>build(deps): bump golang.org/x/oauth2 from 0.28.0 to 0.36.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/coreos/go-oidc/pull/478">coreos/go-oidc#478</a></li> <li>build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/coreos/go-oidc/pull/479">coreos/go-oidc#479</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/coreos/go-oidc/compare/v3.17.0...v3.18.0">https://github.com/coreos/go-oidc/compare/v3.17.0...v3.18.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/coreos/go-oidc/commit/da6b3bfca8af72414ee0e6e8746585ff5d206003"><code>da6b3bf</code></a> build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4</li> <li><a href="https://github.com/coreos/go-oidc/commit/7f80694215d5eb5b28f851f35845439b1e1e9e5d"><code>7f80694</code></a> build(deps): bump golang.org/x/oauth2 from 0.28.0 to 0.36.0</li> <li><a href="https://github.com/coreos/go-oidc/commit/7271de57587bb756318f9819796ba846b1ba875a"><code>7271de5</code></a> .github: update go versions in CI</li> <li><a href="https://github.com/coreos/go-oidc/commit/3ccf20fdc4afab7c64881a108d6f4c17a4ecc24d"><code>3ccf20f</code></a> .github: configure dependabot</li> <li>See full diff in <a href="https://github.com/coreos/go-oidc/compare/v3.17.0...v3.18.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
3e25cc9238 |
chore: bump the coder-modules group across 2 directories with 2 updates (#24258)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
bb64cab8a5 |
chore: bump rust from a08d20a to cf09adf in /dogfood/coder (#24257)
Bumps rust from `a08d20a` to `cf09adf`. [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Kayla はな
|
b149433138 | chore: complete jest to vitest migration (#24216) | ||
|
Kyle Carberry
|
8dff1cbc57 |
fix: resolve idle timeout recording test flake on macOS (#24240)
Fixes https://github.com/coder/internal/issues/1461 Two synchronization issues caused `TestPortableDesktop_IdleTimeout_StopsRecordings` (and the `MultipleRecordings` variant) to flake on macOS CI: 1. **`clk.Advance(idleTimeout)` was not awaited.** In `MultipleRecordings`, both idle timers fire simultaneously but their `fire()` goroutines race to remove themselves from the mock clock's event list. Without `MustWait`, the second timer may still be in `m.all` when the next `Advance` is called, causing `"cannot advance ... beyond next timer/ticker event in 0s"`. 2. **The test depended on SIGINT being handled promptly.** After the `stop_timeout` timer was released, the test relied entirely on the shell process handling SIGINT (via `rec.done`). On macOS, `/bin/sh` may not interrupt `wait` reliably, leaving `lockedStopRecordingProcess` blocked in its `select` while holding `p.mu` — deadlocking the `require.Eventually` callback. ### Fix Wait for each `Advance` to complete and advance past the 15s stop timeout so the process is forcibly killed via the timer path, independent of signal handling. Verified with 1000 iterations (500 per test) with zero failures. > Generated with [Coder Agents](https://coder.com/agents) |
||
|
Mathias Fredriksson
|
a62ead8588 |
fix(coderd): sort pinned chats first in GetChats pagination (#24222)
The GetChats SQL query ordered by (updated_at, id) DESC with no pin_order awareness. A pinned chat with an old updated_at could land on page 2+ and be invisible in the sidebar's Pinned section. Add a 4-column ORDER BY: pinned-first flag DESC, negated pin_order DESC, updated_at DESC, id DESC. The negation trick keeps all sort columns DESC so the cursor tuple < comparison still works. Update the after_id cursor clause to match the expanded sort key. Fix the false handler comment claiming PinChatByID bumps updated_at. |
||
|
dependabot[bot]
|
b68c14dd04 |
chore: bump github.com/hashicorp/go-getter from 1.8.4 to 1.8.6 (#24247)
Bumps [github.com/hashicorp/go-getter](https://github.com/hashicorp/go-getter) from 1.8.4 to 1.8.6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/hashicorp/go-getter/releases">github.com/hashicorp/go-getter's releases</a>.</em></p> <blockquote> <h2>v1.8.6</h2> <p>No release notes provided.</p> <h2>v1.8.5</h2> <h2>What's Changed</h2> <ul> <li>[chore] : Bump the go group with 2 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/hashicorp/go-getter/pull/576">hashicorp/go-getter#576</a></li> <li>use %w to wrap error by <a href="https://github.com/Ericwww"><code>@Ericwww</code></a> in <a href="https://redirect.github.com/hashicorp/go-getter/pull/475">hashicorp/go-getter#475</a></li> <li>fix: <a href="https://redirect.github.com/hashicorp/go-getter/issues/538">#538</a> http file download skipped if headResp.ContentLength is 0 by <a href="https://github.com/martijnvdp"><code>@martijnvdp</code></a> in <a href="https://redirect.github.com/hashicorp/go-getter/pull/539">hashicorp/go-getter#539</a></li> <li>chore: fix error message capitalization in checksum function by <a href="https://github.com/ssagarverma"><code>@ssagarverma</code></a> in <a href="https://redirect.github.com/hashicorp/go-getter/pull/578">hashicorp/go-getter#578</a></li> <li>[chore] : Bump the go group with 8 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/hashicorp/go-getter/pull/577">hashicorp/go-getter#577</a></li> <li>Fix git url with ambiguous ref by <a href="https://github.com/nimasamii"><code>@nimasamii</code></a> in <a href="https://redirect.github.com/hashicorp/go-getter/pull/382">hashicorp/go-getter#382</a></li> <li>fix: resolve compilation errors in get_git_test.go by <a href="https://github.com/CreatorHead"><code>@CreatorHead</code></a> in <a href="https://redirect.github.com/hashicorp/go-getter/pull/579">hashicorp/go-getter#579</a></li> <li>[chore] : Bump the actions group with 2 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/hashicorp/go-getter/pull/582">hashicorp/go-getter#582</a></li> <li>[chore] : Bump the go group with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/hashicorp/go-getter/pull/583">hashicorp/go-getter#583</a></li> <li>test that arbitrary files cannot be checksummed by <a href="https://github.com/schmichael"><code>@schmichael</code></a> in <a href="https://redirect.github.com/hashicorp/go-getter/pull/250">hashicorp/go-getter#250</a></li> <li>[chore] : Bump google.golang.org/api from 0.260.0 to 0.262.0 in the go group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/hashicorp/go-getter/pull/585">hashicorp/go-getter#585</a></li> <li>[chore] : Bump actions/checkout from 6.0.1 to 6.0.2 in the actions group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/hashicorp/go-getter/pull/586">hashicorp/go-getter#586</a></li> <li>[chore] : Bump the go group with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/hashicorp/go-getter/pull/588">hashicorp/go-getter#588</a></li> <li>[chore] : Bump actions/cache from 5.0.2 to 5.0.3 in the actions group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/hashicorp/go-getter/pull/589">hashicorp/go-getter#589</a></li> <li>[chore] : Bump aws-actions/configure-aws-credentials from 5.1.1 to 6.0.0 in the actions group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/hashicorp/go-getter/pull/592">hashicorp/go-getter#592</a></li> <li>[chore] : Bump google.golang.org/api from 0.264.0 to 0.265.0 in the go group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/hashicorp/go-getter/pull/591">hashicorp/go-getter#591</a></li> <li>[chore] : Bump the go group with 5 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/hashicorp/go-getter/pull/593">hashicorp/go-getter#593</a></li> <li>IND-6310 - CRT Onboarding by <a href="https://github.com/nasareeny"><code>@nasareeny</code></a> in <a href="https://redirect.github.com/hashicorp/go-getter/pull/584">hashicorp/go-getter#584</a></li> <li>Fix crt build path by <a href="https://github.com/ssagarverma"><code>@ssagarverma</code></a> in <a href="https://redirect.github.com/hashicorp/go-getter/pull/594">hashicorp/go-getter#594</a></li> <li>[chore] : Bump the go group with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/hashicorp/go-getter/pull/596">hashicorp/go-getter#596</a></li> <li>fix: remove checkout action from set-product-version job by <a href="https://github.com/ssagarverma"><code>@ssagarverma</code></a> in <a href="https://redirect.github.com/hashicorp/go-getter/pull/598">hashicorp/go-getter#598</a></li> <li>[chore] : Bump the actions group with 4 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/hashicorp/go-getter/pull/595">hashicorp/go-getter#595</a></li> <li>fix(deps): upgrade go.opentelemetry.io/otel/sdk to v1.40.0 (GO-2026-4394) by <a href="https://github.com/ssagarverma"><code>@ssagarverma</code></a> in <a href="https://redirect.github.com/hashicorp/go-getter/pull/599">hashicorp/go-getter#599</a></li> <li>Prepare go-getter for v1.8.5 release by <a href="https://github.com/nasareeny"><code>@nasareeny</code></a> in <a href="https://redirect.github.com/hashicorp/go-getter/pull/597">hashicorp/go-getter#597</a></li> <li>[chore] : Bump the actions group with 2 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/hashicorp/go-getter/pull/600">hashicorp/go-getter#600</a></li> <li>sec: bump go and xrepos + redact aws tokens in url by <a href="https://github.com/dduzgun-security"><code>@dduzgun-security</code></a> in <a href="https://redirect.github.com/hashicorp/go-getter/pull/604">hashicorp/go-getter#604</a></li> </ul> <p><strong>NOTES:</strong></p> <p>Binary Distribution Update: To streamline our release process and align with other HashiCorp tools, all release binaries will now be published exclusively to the official HashiCorp <a href="https://releases.hashicorp.com/go-getter/">release</a> site. We will no longer attach release assets to GitHub Releases.</p> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Ericwww"><code>@Ericwww</code></a> made their first contribution in <a href="https://redirect.github.com/hashicorp/go-getter/pull/475">hashicorp/go-getter#475</a></li> <li><a href="https://github.com/martijnvdp"><code>@martijnvdp</code></a> made their first contribution in <a href="https://redirect.github.com/hashicorp/go-getter/pull/539">hashicorp/go-getter#539</a></li> <li><a href="https://github.com/nimasamii"><code>@nimasamii</code></a> made their first contribution in <a href="https://redirect.github.com/hashicorp/go-getter/pull/382">hashicorp/go-getter#382</a></li> <li><a href="https://github.com/nasareeny"><code>@nasareeny</code></a> made their first contribution in <a href="https://redirect.github.com/hashicorp/go-getter/pull/584">hashicorp/go-getter#584</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/hashicorp/go-getter/compare/v1.8.4...v1.8.5">https://github.com/hashicorp/go-getter/compare/v1.8.4...v1.8.5</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/hashicorp/go-getter/commit/d23bff48fb87c956bb507a03d35a63ee45470e34"><code>d23bff4</code></a> Merge pull request <a href="https://redirect.github.com/hashicorp/go-getter/issues/608">#608</a> from hashicorp/dependabot/go_modules/go-security-9c51...</li> <li><a href="https://github.com/hashicorp/go-getter/commit/2c4aba8e5286c18bc66358236454a3e3b0aa7421"><code>2c4aba8</code></a> Merge pull request <a href="https://redirect.github.com/hashicorp/go-getter/issues/613">#613</a> from hashicorp/pull/v1.8.6</li> <li><a href="https://github.com/hashicorp/go-getter/commit/fe61ed9454b818721d81328d7e880fc2ed2c8d15"><code>fe61ed9</code></a> Merge pull request <a href="https://redirect.github.com/hashicorp/go-getter/issues/611">#611</a> from hashicorp/SECVULN-41053</li> <li><a href="https://github.com/hashicorp/go-getter/commit/d53365612c5250f7df8d586ba3be70fbd42e613b"><code>d533656</code></a> Merge pull request <a href="https://redirect.github.com/hashicorp/go-getter/issues/606">#606</a> from hashicorp/pull/CRT</li> <li><a href="https://github.com/hashicorp/go-getter/commit/388f23d7d40f1f1e1a9f5b40ee5590c08154cd6d"><code>388f23d</code></a> Additional test for local branch and head</li> <li><a href="https://github.com/hashicorp/go-getter/commit/b7ceaa59b11a203c14cf58e5fcaa8f169c0ced6e"><code>b7ceaa5</code></a> harden checkout ref handling and added regression tests</li> <li><a href="https://github.com/hashicorp/go-getter/commit/769cc14fdb0df5ac548f4ead1193b5c40460f11e"><code>769cc14</code></a> Release version bump up</li> <li><a href="https://github.com/hashicorp/go-getter/commit/6086a6a1f6347f735401c26429d9a0e14ad29444"><code>6086a6a</code></a> Review Comments Addressed</li> <li><a href="https://github.com/hashicorp/go-getter/commit/e02063cd28e97bb8a23a63e72e2a4a4ab6e982cf"><code>e02063c</code></a> Revert "SECVULN Fix for git checkout argument injection enables arbitrary fil...</li> <li><a href="https://github.com/hashicorp/go-getter/commit/c93084dc4306b2c49c54fe6fbfbe79c98956e5f8"><code>c93084d</code></a> [chore] : Bump google.golang.org/grpc</li> <li>Additional commits viewable in <a href="https://github.com/hashicorp/go-getter/compare/v1.8.4...v1.8.6">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/coder/coder/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Zach
|
508114d484 |
feat: user secret database encryption (#24218)
Add dbcrypt support for user secret values. When database encryption is enabled, secret values are transparently encrypted on write and decrypted on read through the existing dbcrypt store wrapper. - Wrap `CreateUserSecret`, `GetUserSecretByUserIDAndName`, `ListUserSecretsWithValues`, and `UpdateUserSecretByUserIDAndName` in enterprise/dbcrypt/dbcrypt.go. - Add rotate and decrypt support for user secrets in enterprise/dbcrypt/cliutil.go (`server dbcrypt rotate` and `server dbcrypt decrypt`). - Add internal tests covering encrypt-on-create, decrypt-on-read, re-encrypt-on-update, and plaintext passthrough when no cipher is configured. |
||
|
Garrett Delfosse
|
e0fbb0e4ec |
feat: comment on original PR after cherry-pick PR is created (#24243)
After the cherry-pick workflow creates a backport PR, it now comments on the original PR to notify the author with a link to the new PR. If the cherry-pick had conflicts, the comment includes a warning. ## Changes - Capture the URL output of `gh pr create` into `NEW_PR_URL` - Add `gh pr comment` on the original PR with the link - Append a conflict warning to the comment when applicable > Generated by Coder Agents |
||
|
J. Scott Miller
|
7bde763b66 |
feat: add workspace build transition to provisioner job list (#24131)
Closes #16332 Previously `coder provisioner jobs list` showed no indication of what a workspace build job was doing (i.e., start, stop, or delete). This adds `workspace_build_transition` to the provisioner job metadata, exposed in both the REST API and CLI. Template and workspace name columns were also added, both available via `-c`. ``` $ coder provisioner jobs list -c id,type,status,"workspace build transition" ID TYPE STATUS WORKSPACE BUILD TRANSITION 95f35545-a59f-4900-813d-80b8c8fd7a33 template_version_import succeeded 0a903bbe-cef5-4e72-9e62-f7e7b4dfbb7a workspace_build succeeded start ``` |
||
|
Matt Vollmer
|
36141fafad |
feat: stack insights tables vertically and paginate Pull requests table (#24198)
The "By model" and "Pull requests" tables on the PR Insights page (`/agents/settings/insights`) were side-by-side at `lg` breakpoints, and the Pull requests table was hard-capped at 20 rows by the backend. - Replaced `lg:grid-cols-2` with a single-column stacked layout so both tables span the full content width. - Removed the `LIMIT 20` from the `GetPRInsightsRecentPRs` SQL query so all PRs in the selected time range are returned. - Can add this back if we need it. If we do, we should add a little subheader above this table to indicate that we're not showing all PRs within the selected timeframe. - Added client-side pagination to the Pull requests table using `PaginationWidgetBase` (page size 10), matching the existing pattern in `ChatCostSummaryView`. - Renamed the section heading from "Recent" to "Pull requests" since it now shows the full set for the time range. <img width="1481" height="1817" alt="image" src="https://github.com/user-attachments/assets/0066c42f-4d7b-4cee-b64b-6680848edc68" /> > 🤖 PR generated with Coder Agents |
||
|
Garrett Delfosse
|
3462c31f43 |
fix: update directory for terraform-managed subagents (#24220)
When a devcontainer subagent is terraform-managed, the provisioner sets its directory to the host-side `workspace_folder` path at build time. At runtime, the agent injection code determines the correct container-internal path from `devcontainer read-configuration` and sends it via `CreateSubAgent`. However, the `CreateSubAgent` handler only updated `display_apps` for pre-existing agents, ignoring the `Directory` field. This caused SSH/terminal sessions to land in `~` instead of the workspace folder (e.g. `/workspaces/foo`). Add `UpdateWorkspaceAgentDirectoryByID` query and call it in the terraform-managed subagent update path to also persist the directory. Fixes PLAT-118 <details><summary>Root cause analysis</summary> Two code paths set the subagent `Directory` field: 1. **Provisioner (build time):** `insertDevcontainerSubagent` in `provisionerdserver.go` stores `dc.GetWorkspaceFolder()` — the **host-side** path from the `coder_devcontainer` Terraform resource (e.g. `/home/coder/project`). 2. **Agent injection (runtime):** `maybeInjectSubAgentIntoContainerLocked` in `api.go` reads the devcontainer config and gets the correct **container-internal** path (e.g. `/workspaces/project`), then calls `client.Create(ctx, subAgentConfig)`. For terraform-managed subagents (those with `req.Id != nil`), `CreateSubAgent` in `coderd/agentapi/subagent.go` recognized the pre-existing agent and entered the update path — but only called `UpdateWorkspaceAgentDisplayAppsByID`, discarding the `Directory` field from the request. The agent kept the stale host-side path, which doesn't exist inside the container, causing `expandPathToAbs` to fall back to `~`. </details> > [!NOTE] > Generated by Coder Agents |
||
|
Ethan
|
a0ea71b74c |
perf(site/src): optimistically edit chat messages (#23976)
Previously, editing a past user message in Agents chat waited for the PATCH round-trip and cache reconciliation before the conversation visibly settled. The edited bubble and truncated tail could briefly fall back to older fetched state, and a failed edit did not restore the full local editing context cleanly. Keep history editing optimistic end-to-end: update the edited user bubble and truncate the tail immediately, preserve that visible conversation until the authoritative replacement message and cache catch up, and restore the draft/editor/attachment state on failure. The route already scopes each `agentId` to a keyed `AgentChatPage` instance with its own store/cache-writing closures, so navigating between chats does not need an extra post-await active-chat guard to keep one chat's edit response out of another chat. |
||
|
Cian Johnston
|
0a14bb529e |
refactor(site): convert OrganizationAutocomplete to fully controlled component (#24211)
Fixes https://github.com/coder/internal/issues/1440 - Convert `OrganizationAutocomplete` to a purely presentational, fully controlled component - Accept `value`, `onChange`, `options` from parent; remove internal state, data fetching, and permission filtering - Update `CreateTemplateForm` and `CreateUserForm` to own org fetching, permission checks, auto-select, and invalid-value clearing inline - Memoize `orgOptions` in callers for stable `useEffect` deps - Rewrite Storybook stories for the new controlled API > 🤖 Written by a Coder Agent. Reviewed by a human. |
||
|
Danielle Maywood
|
2c32d84f12 | fix: remove double bottom border on build logs table (#24000) | ||
|
Jaayden Halko
|
76d89f59af |
fix(site): add bottom spacing for sources-only assistant messages (#24202)
Closes CODAGT-123 Assistant messages containing only source parts (no markdown or reasoning) were missing the bottom spacer that normally fills the gap left by the hidden action bar, causing them to sit flush against the next user bubble. The existing fallback spacer guarded on `Boolean(parsed.reasoning)`, so it only fired for thinking-only replies. Replace that guard with the broader `hasRenderableContent` flag (which covers blocks, tools, and sources) and extract a named `needsAssistantBottomSpacer` boolean so future content types inherit consistent spacing without re-reading compound conditions. Adds a `SourcesOnlyAssistantSpacing` Storybook story mirroring the existing `ThinkingOnlyAssistantSpacing` pattern for regression coverage. |
||
|
Jaayden Halko
|
1a3a92bd1b |
fix: fix 4px layout shift on streaming commit in chat (#24203)
Closes CODAGT-124 When a streaming assistant response finishes and moves from the live stream tail into the conversation timeline, the message jumps 4px upward. This happens because the outer layout wrapper and live-stream section both used `gap-3` (12px), while the committed-message list used `gap-2` (8px). Unify all three containers to `gap-2` so the gap between messages stays at 8px regardless of whether they're streaming or committed, eliminating the layout shift. A Storybook story with play-function assertions locks the invariant: it renders both committed messages and an active stream, then verifies both the outer and inner containers report `rowGap === "8px"`. |
||
|
Jake Howell
|
4018320614 |
fix: resolve <WorkspaceTimings /> size (#24235)
|
||
|
Susana Ferreira
|
d9700baa8d |
docs(docs/ai-coder): document AI Gateway Proxy private IP restrictions (#24209)
Documents the private/reserved IP range restrictions added to AI Gateway Proxy: - **Restricting proxy access**: Updated to reflect that private/reserved IP ranges are now blocked by default, with atomic IP validation to prevent DNS rebinding. Documents the Coder access URL exemption and the `CODER_AIBRIDGE_PROXY_ALLOWED_PRIVATE_CIDRS` option. - **Upstream proxy**: Added a note on the DNS rebinding limitation when an upstream proxy is configured, and that upstream proxies should enforce their own restrictions. > [!NOTE] > Initially generated by Coder Agents, modified and reviewed by @ssncferreira Follow-up: #23109 |
||
|
Jake Howell
|
82456ff62e |
feat: resolve useTime() thunk() error (#24234)
Fixes a regression introduced in #24060 that could crash the frontend. `thunk` is created by `useEffectEvent()`, and React 19.2 enforces that effect-event functions are not invoked during render. The previous code called `thunk()` inside a `setState` updater function, and React executes updater functions during render, so this became an illegal render-phase call. The fix computes `next` in the interval callback (`const next = thunk()`) and then stores it via `setComputedValue(() => next)`. This keeps the `useEffectEvent` call outside render and also preserves correct behavior when `func` returns a function value, because React stores `next` instead of treating it as a functional updater. |
||
|
Faur Ioan-Aurel
|
83fd4cf5c2 |
fix: OAuth2 cancel button in the authorization page not working (#24058)
Go's html/template has a built-in security filter (urlFilter) that only allows http, https, and mailto URL schemes. Any other scheme gets replaced with #ZgotmplZ. The OAuth2 app's callback URL uses custom URI scheme which the filter considers unsafe. For example the Coder JetBrains plugin exposes a callback URI with the scheme jetbrains:// - which was effectively changed by the template engine into #ZgotmplZ. Of course this is not an actual callback. When users clicked the cancel button nothing happened. The fix was simple - we now wrap the apps registered callback URI into htmltemplate.URL. Usually this needs some validation otherwise the linter will complain about it. The callback URI used by the Cancel logic is actually validated by our backend when the client app programmatically registered via the dynamic OAuth2 registration endpoints, so we refactored the validation around that code and re-used some of it in the Cancel handling to make sure we don't allow URIs like `javascript` and `data`, even though in theory these URIs were already validated. In addition, while testing this PR with https://github.com/coder/coder-jetbrains-toolbox/pull/209 I discovered that we are also not compliant with https://www.rfc-editor.org/rfc/rfc6749#section-4.1.2.1 which requires the server to attach the local state if it was provided by the client in the original request. Also it is optional but generally a good practice to include `error_description` in the error responses. In fact we follow this pattern for the other types of error responses. So this is not a one off. - resolves #20323 <img width="1485" height="771" alt="Cancel_page_with_invalid_uri" src="https://github.com/user-attachments/assets/5539d234-9ce3-4dda-b421-d023fc9aa99e" /> <img width="486" height="746" alt="Coder Toolbox handling the Cancel button" src="https://github.com/user-attachments/assets/acab71a6-d29c-4fa9-80ba-3c0095bbdc8f" /> <!-- If you have used AI to produce some or all of this PR, please ensure you have read our [AI Contribution guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING) before submitting. --> |
||
|
Danielle Maywood
|
38d4da82b9 | refactor: send raw typed payloads over chat WebSockets (#24148) | ||
|
Jaayden Halko
|
19e0e0e8e6 |
perf(site): split InlineMarkdown out of Markdown to avoid loading PrismJS in initial bundle (#24192)
\`InlineMarkdown\` and \`MemoizedInlineMarkdown\` lived in
\`Markdown.tsx\`
alongside a static \`import { Prism as SyntaxHighlighter } from
"react-syntax-highlighter"\` — the full PrismJS build with ~300 language
grammars. Because \`DashboardLayout\` eagerly imports
\`AnnouncementBannerView → InlineMarkdown\`, every authenticated page
loaded and evaluated the entire Prism/refractor bundle on startup even
though syntax highlighting is only used in secondary views.
This PR moves \`InlineMarkdown\` and \`MemoizedInlineMarkdown\` into
their
own \`InlineMarkdown.tsx\` file that depends only on \`react-markdown\`
and
updates all six consumers to import from the new module.
\`Markdown.tsx\`
keeps the PrismJS import for the full \`Markdown\` component, which is
only reached through lazy-loaded routes.
> 🤖 Generated by Coder Agents
|
||
|
Ehab Younes
|
1d0653cdab |
fix(cli): retry dial timeouts in SSH connection setup (#24199)
Reorder error checks in isRetryableError so IsConnectionError is evaluated before context.DeadlineExceeded. Dial timeouts (*net.OpError wrapping DeadlineExceeded) were incorrectly treated as non-retryable, causing Coder Connect to fail immediately on broken tunnels with valid DNS despite existing retry logic. Fixes #24201 |
||
|
Zach
|
95cff8c5fb |
feat: add REST API handlers and client methods for user secrets (#24107)
Add the five REST endpoints for managing user secrets, SDK client
methods, and handler tests.
Endpoints:
- `POST /api/v2/users/{user}/secrets`
- `GET /api/v2/users/{user}/secrets`
- `GET /api/v2/users/{user}/secrets/{name}`
- `PATCH /api/v2/users/{user}/secrets/{name}`
- `DELETE /api/v2/users/{user}/secrets/{name}`
Routes are registered under the existing `/{user}` group with
`ExtractUserParam`. The delete query was changed from `:exec` to
`:execrows` so the handler can distinguish "not found" from success
(DELETE with `:exec` silently returns nil for zero affected rows).
|
||
|
Ethan
|
ad2415ede7 |
fix: bump coder/tailscale to pick up RTM_MISS fix (#24187)
## What Bumps `coder/tailscale` to [`e956a95`](https://github.com/coder/tailscale/commit/e956a950740bd737c55451f56e77038f7430a919) ([PR #113](https://github.com/coder/tailscale/pull/113)) to pick up the `RTM_MISS` fix for the Darwin network monitor. Already released on `release/2.31` as v2.31.8. (#24185) to unblock a customer. This PR is to update `main`. ## Why On Darwin, `RTM_MISS` route-socket messages (fired on every failed route lookup) were not filtered by `netmon`, causing each one to be treated as a `LinkChange`. When netcheck sends STUN probes to an IPv6 address with no route, this creates a self-sustaining feedback loop: `RTM_MISS` → `LinkChange` → `ReSTUN` → netcheck → v6 STUN probe → `RTM_MISS` → … The loop drives DERP home-region flapping at ~70× baseline, which at fleet scale saturates PostgreSQL's `NOTIFY` lock and causes coordinator health-check timeouts. The upstream fix adds a single `if msg.Type == unix.RTM_MISS { return true }` check to `skipRouteMessage`. This is safe because `RTM_MISS` is a lookup-path signal, not a table-mutation signal — route withdrawals always emit `RTM_DELETE` before any subsequent lookup can miss. Of note is that this issue has only been reported recently, since users updated to macOS 26.4. Relates to ENG-2394 |
||
|
Cian Johnston
|
1e40cea199 |
feat: warn in CLI when server runs dev or RC builds (#24158)
Adds warning on stderr when the server version contains `-devel` or
`-rc.N`
> 🤖 Written by a Coder Agent. Will be reviewed by a human.
|
||
|
Kayla はな
|
9d6557d173 | refactor(site): migrate some components from emotion to tailwind (#24182) | ||
|
Kayla はな
|
224db483d7 | refactor(site): remove mui from a few components (#24125) |