We recently made a change to the `wsbuilder` to handle task related
logic. Our test coverage for the lifecycle executor didn't handle this
scenario and so we missed that it had insufficient permissions.
This PR adds `Update` and `Read` permissions for `Task`s in the
lifecycle executor, as well as an autostart/autostop test tailored to
task workspaces to verify the change.
---
Anthropic's Claude Sonnet 4.5 Thinking was involved in writing the tests
## Description
The membership reconciliation ensures the prebuilds system user is a
member of all organizations with prebuilds configured. To support
prebuilds quota management, each organization must have a prebuilds
group that the system user belongs to.
## Problem
Previously, membership reconciliation iterated over all presets to check
and update membership status. This meant database queries
`GetGroupByOrgAndName` and `InsertGroupMember` were executed for each
preset. Since presets are unique combinations of `(organization,
template, template version, preset)`, this resulted in several redundant
checks for the same organization.
In dogfood, `InsertGroupMember` was called thousands of times per day,
even though memberships were already configured ([internal Grafana
dashboard link](https://grafana.dev.coder.com/goto/46MZ1UgDg?orgId=1))
<img width="5382" height="1788" alt="Screenshot 2025-10-28 at 16 01 36"
src="https://github.com/user-attachments/assets/757b7253-106f-4f72-8586-8e2ede9f18db"
/>
## Solution
This PR introduces `GetOrganizationsWithPrebuildStatus`, a single query
that returns:
* All unique organizations with prebuilds configured
* Whether the prebuilds user is a member of each organization
* Whether the prebuilds group exists in each organization
* Whether the prebuilds user is in the prebuilds group
The membership reconciliation logic now:
* Fetches status for all organizations in one query
* Only performs inserts for organizations missing required memberships
or groups
* Safely handles concurrent operations via unique constraint violations
* This reduces database load from `O(presets)` to `O(organizations)` per
reconciliation loop, with a single read query when everything is
configured.
## Changes
* Add `GetOrganizationsWithPrebuildStatus` SQL query
* Update `membership.ReconcileAll` to use organization-based
reconciliation instead of preset-based
* Update tests to reflect new behavior
Related to internal thread:
https://codercom.slack.com/archives/C07GRNNRW03/p1760535570381369
## Description
PR https://github.com/coder/coder/pull/20387 introduced canceling
pending prebuild jobs from inactive template versions to avoid
provisioning obsolete workspaces. However, the associated prebuilds
remained in the database with "Canceled" status, visible in the UI.
This PR now orphan-deletes these canceled prebuilt workspaces. Since the
canceled jobs were never processed by a provisioner, no Terraform
resources were created, making orphan deletion safe.
Orphan deletion always creates a provisioner job, but behaves
differently based on provisioner availability:
- If no provisioner daemon is available, the job is immediately marked
as completed and the workspace is marked as deleted without any
provisioner processing
- If a provisioner daemon is available, it processes the delete job with
empty Terraform state (no actual resources to destroy)
The job cancellation and workspace deletion occur atomically in the same
transaction. We don't split this into two separate reconciliation runs
because there's no way to distinguish between system-canceled prebuilds
and user-canceled workspaces. If we deleted canceled workspaces in a
later run, we'd delete user-canceled workspaces that users may want to
keep for troubleshooting.
Note: This only applies to system-generated prebuilds from inactive
template versions.
## Changes
* Update `UpdatePrebuildProvisionerJobWithCancel` query to return job
ID, workspace ID, template ID, and template version preset ID
* Add `DeprovisionMode` enum to support orphan deletion in the provision
flow
* Update `ActionTypeCancelPending` handler to cancel jobs and
orphan-delete associated workspaces atomically
I have been experimenting (via blink) and these seem to have made the
LLM behave more intelligently and consistently when it comes to creating
workspaces and manipulating files.
Partially addresses https://github.com/coder/internal/issues/1047
This uses the `terraform init -json` logs to add more visibility into
the `init` phase of `plan`. The `init` logs omit `ms` precision, so we
have to use `time.Now()` 😢
Open TF PR: https://github.com/hashicorp/terraform/pull/37818
This should resolve https://github.com/coder/internal/issues/728 by
refactoring the ResourceMonitorAPI struct to only require querying the
resource monitor once for memory and once for volumes, then using the
stored monitors on the API struct from that point on. This should
eliminate the vast majority of calls to `GetWorkspaceByAgentID` and
`FetchVolumesResourceMonitorsUpdatedAfter`/`FetchMemoryResourceMonitorsUpdatedAfter`
(millions of calls per week).
Tests passed, and I ran an instance of coder via a workspace with a
template that added resource monitoring every 10s. Note that this is the
default docker container, so there are other sources of
`GetWorkspaceByAgentID` db queries. Note that this workspace was running
for ~15 minutes at the time I gathered this data.
Over 30s for the `ResourceMonitor` calls:
```
coder@callum-coder-2:~/coder$ curl localhost:19090/metrics | grep ResourceMonitor | grep count
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0coderd_db_query_latencies_seconds_count{query="FetchMemoryResourceMonitorsByAgentID"} 2
coderd_db_query_latencies_seconds_count{query="FetchMemoryResourceMonitorsUpdatedAfter"} 2
100 288k 0 288k 0 0 58.3M 0 --:--:-- --:--:-- --:--:-- 70.4M
coderd_db_query_latencies_seconds_count{query="FetchVolumesResourceMonitorsByAgentID"} 2
coderd_db_query_latencies_seconds_count{query="FetchVolumesResourceMonitorsUpdatedAfter"} 2
coderd_db_query_latencies_seconds_count{query="UpdateMemoryResourceMonitor"} 155
coderd_db_query_latencies_seconds_count{query="UpdateVolumeResourceMonitor"} 155
coder@callum-coder-2:~/coder$ curl localhost:19090/metrics | grep ResourceMonitor | grep count
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0coderd_db_query_latencies_seconds_count{query="FetchMemoryResourceMonitorsByAgentID"} 2
coderd_db_query_latencies_seconds_count{query="FetchMemoryResourceMonitorsUpdatedAfter"} 2
100 288k 0 288k 0 0 34.7M 0 --:--:-- --:--:-- --:--:-- 40.2M
coderd_db_query_latencies_seconds_count{query="FetchVolumesResourceMonitorsByAgentID"} 2
coderd_db_query_latencies_seconds_count{query="FetchVolumesResourceMonitorsUpdatedAfter"} 2
coderd_db_query_latencies_seconds_count{query="UpdateMemoryResourceMonitor"} 158
coderd_db_query_latencies_seconds_count{query="UpdateVolumeResourceMonitor"} 158
```
And over 1m for the `GetWorkspaceAgentByID` calls, the majority are from
the workspace metadata stats updates:
```
coder@callum-coder-2:~/coder$ curl localhost:19090/metrics | grep GetWorkspaceByAgentID | grep count
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 284k 0 284k 0 0 42.4M 0 --:--:-- --:--:-- --:--:-- 46.3M
coderd_db_query_latencies_seconds_count{query="GetWorkspaceByAgentID"} 876
coder@callum-coder-2:~/coder$ curl localhost:19090/metrics | grep GetWorkspaceByAgentID | grep count
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 284k 0 284k 0 0 75.4M 0 --:--:-- --:--:-- --:--:-- 92.7M
coderd_db_query_latencies_seconds_count{query="GetWorkspaceByAgentID"} 918
```
---------
Signed-off-by: Callum Styan <callumstyan@gmail.com>
Relates to https://github.com/coder/internal/issues/1098
Currently task notifications are incredibly noisy. We should disable
them by default for the upcoming release whilst we iron them out.
Relates to
https://github.com/coder/coder/pull/20431/files#diff-9cfc826a6ce7e77d977b2025482474dd263d12965b2a94479a74c7f1d872b782
If the workspace relating to a task was deleted, most of the
workspace-related fields in `taskFromDBTaskAndWorkspace` will be
zero-valued. However, we can still get information relating to the owner
so that "created by" shows up correctly in the UI.
Updates the `tasks_with_status` view with a join on `visible_users` to
get owner-related info.
Closes https://github.com/coder/internal/issues/769
According to the `time.NewTicker` documentation [^1] (which is used
under the hood by https://github.com/coder/quartz) it will automatically
adjust the time interval to make up for slow receivers. This means we
should be safe to drop the default branch.
> NewTicker returns a new Ticker containing a channel that will send the
current time on the channel after each tick. The period of the ticks is
specified by the duration argument. The ticker will adjust the time
interval or drop ticks to make up for slow receivers. The duration d
must be greater than zero; if not, NewTicker will panic.
[^1]: https://pkg.go.dev/time#Ticker
## Add Dynamic Parameters test procedure to 10k users validated architecture
This PR adds a new test procedure for Dynamic Parameters to the 10k users validated architecture documentation. No changes to the recommended hardware specs as this test case succeeded with no issues.
While investigating a flake I noticed that the dbfake workspace builder
executes all database inserts without a transaction. Since our real
wsbuilder implementation utilizes one it makes sense to do here as well.
For example, our normal workspace <-> build relationship is such that a
workspace cannot exist with at least one build. However, our
GetWorkspaces query left joins workspace builds but has types that are
non-nullable, leading to flakes like coder/internal#1103.
- Adds a new table to keep track of which payloads have already been
reported since we only report for the last clock hour
- Adds a query to gather and aggregate all the data by
provider/model/client
Relates to https://github.com/coder/coder-telemetry-server/issues/27
<!--
If you have used AI to produce some or all of this PR, please ensure you have read our [AI Contribution guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING) before submitting.
-->
Add support for scoped API tokens in CLI
This PR adds CLI support for creating and viewing API tokens with scopes and allow lists. It includes:
- New `--scope` and `--allow` flags for the `tokens create` command
- A new `tokens view` command to display detailed information about a token
- Updated table columns in `tokens list` to show scopes and allow list entries
- Updated help text and examples
These changes enable users to create tokens with limited permissions through the CLI, similar to the existing functionality in the web UI.
Fixes issue where clicking Build in the template editor would always
redirect to main.tf instead of keeping the currently open file.
Closes#14130
<!--
If you have used AI to produce some or all of this PR, please ensure you
have read our [AI Contribution
guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING)
before submitting.
-->
I initially created `API.getWorkspaceParameters` to group two related
requests, but after revisiting the implementation, I realized this
abstraction doesn’t add much value. It also prevents us from taking full
advantage of React Query’s built-in caching and invalidation.
So instead of grouping them, I removed the helper and replaced it with
separate queries — this simplifies the flow and lets React Query handle
caching more efficiently.
Related to
https://github.com/coder/coder/pull/20431#discussion_r2457010137
Bumps the github-actions group with 7 updates:
| Package | From | To |
| --- | --- | --- |
| [actions/upload-artifact](https://github.com/actions/upload-artifact)
| `4.6.2` | `5.0.0` |
| [chromaui/action](https://github.com/chromaui/action) | `13.3.0` |
`13.3.2` |
|
[actions/download-artifact](https://github.com/actions/download-artifact)
| `5.0.0` | `6.0.0` |
|
[tj-actions/changed-files](https://github.com/tj-actions/changed-files)
| `d03a93c0dbfac6d6dd6a0d8a5e7daff992b07449` |
`dbf178ceecb9304128c8e0648591d71208c6e2c9` |
|
[nixbuild/nix-quick-install-action](https://github.com/nixbuild/nix-quick-install-action)
| `33` | `34` |
| [github/codeql-action](https://github.com/github/codeql-action) |
`4.30.9` | `4.31.0` |
|
[Mattraks/delete-workflow-runs](https://github.com/mattraks/delete-workflow-runs)
| `2.0.6` | `2.1.0` |
Updates `actions/upload-artifact` from 4.6.2 to 5.0.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/upload-artifact/releases">actions/upload-artifact's
releases</a>.</em></p>
<blockquote>
<h2>v5.0.0</h2>
<h2>What's Changed</h2>
<p><strong>BREAKING CHANGE:</strong> this update supports Node
<code>v24.x</code>. This is not a breaking change per-se but we're
treating it as such.</p>
<ul>
<li>Update README.md by <a
href="https://github.com/GhadimiR"><code>@GhadimiR</code></a> in <a
href="https://redirect.github.com/actions/upload-artifact/pull/681">actions/upload-artifact#681</a></li>
<li>Update README.md by <a
href="https://github.com/nebuk89"><code>@nebuk89</code></a> in <a
href="https://redirect.github.com/actions/upload-artifact/pull/712">actions/upload-artifact#712</a></li>
<li>Readme: spell out the first use of GHES by <a
href="https://github.com/danwkennedy"><code>@danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/upload-artifact/pull/727">actions/upload-artifact#727</a></li>
<li>Update GHES guidance to include reference to Node 20 version by <a
href="https://github.com/patrikpolyak"><code>@patrikpolyak</code></a>
in <a
href="https://redirect.github.com/actions/upload-artifact/pull/725">actions/upload-artifact#725</a></li>
<li>Bump <code>@actions/artifact</code> to <code>v4.0.0</code></li>
<li>Prepare <code>v5.0.0</code> by <a
href="https://github.com/danwkennedy"><code>@danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/upload-artifact/pull/734">actions/upload-artifact#734</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/GhadimiR"><code>@GhadimiR</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/upload-artifact/pull/681">actions/upload-artifact#681</a></li>
<li><a href="https://github.com/nebuk89"><code>@nebuk89</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/upload-artifact/pull/712">actions/upload-artifact#712</a></li>
<li><a
href="https://github.com/danwkennedy"><code>@danwkennedy</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/upload-artifact/pull/727">actions/upload-artifact#727</a></li>
<li><a
href="https://github.com/patrikpolyak"><code>@patrikpolyak</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/upload-artifact/pull/725">actions/upload-artifact#725</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/upload-artifact/compare/v4...v5.0.0">https://github.com/actions/upload-artifact/compare/v4...v5.0.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="330a01c490"><code>330a01c</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/upload-artifact/issues/734">#734</a>
from actions/danwkennedy/prepare-5.0.0</li>
<li><a
href="03f2824452"><code>03f2824</code></a>
Update <code>github.dep.yml</code></li>
<li><a
href="905a1ecb59"><code>905a1ec</code></a>
Prepare <code>v5.0.0</code></li>
<li><a
href="2d9f9cdfa9"><code>2d9f9cd</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/upload-artifact/issues/725">#725</a>
from patrikpolyak/patch-1</li>
<li><a
href="9687587dec"><code>9687587</code></a>
Merge branch 'main' into patch-1</li>
<li><a
href="2848b2cda0"><code>2848b2c</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/upload-artifact/issues/727">#727</a>
from danwkennedy/patch-1</li>
<li><a
href="9b511775fd"><code>9b51177</code></a>
Spell out the first use of GHES</li>
<li><a
href="cd231ca1ed"><code>cd231ca</code></a>
Update GHES guidance to include reference to Node 20 version</li>
<li><a
href="de65e23aa2"><code>de65e23</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/upload-artifact/issues/712">#712</a>
from actions/nebuk89-patch-1</li>
<li><a
href="8747d8cd76"><code>8747d8c</code></a>
Update README.md</li>
<li>Additional commits viewable in <a
href="ea165f8d65...330a01c490">compare
view</a></li>
</ul>
</details>
<br />
Updates `chromaui/action` from 13.3.0 to 13.3.2
<details>
<summary>Commits</summary>
<ul>
<li><a
href="bc2d84ad2b"><code>bc2d84a</code></a>
v13.3.2</li>
<li><a
href="1c807fb41f"><code>1c807fb</code></a>
v13.3.1</li>
<li>See full diff in <a
href="4ffe736a2a...bc2d84ad2b">compare
view</a></li>
</ul>
</details>
<br />
Updates `actions/download-artifact` from 5.0.0 to 6.0.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/download-artifact/releases">actions/download-artifact's
releases</a>.</em></p>
<blockquote>
<h2>v6.0.0</h2>
<h2>What's Changed</h2>
<p><strong>BREAKING CHANGE:</strong> this update supports Node
<code>v24.x</code>. This is not a breaking change per-se but we're
treating it as such.</p>
<ul>
<li>Update README for download-artifact v5 changes by <a
href="https://github.com/yacaovsnc"><code>@yacaovsnc</code></a> in <a
href="https://redirect.github.com/actions/download-artifact/pull/417">actions/download-artifact#417</a></li>
<li>Update README with artifact extraction details by <a
href="https://github.com/yacaovsnc"><code>@yacaovsnc</code></a> in <a
href="https://redirect.github.com/actions/download-artifact/pull/424">actions/download-artifact#424</a></li>
<li>Readme: spell out the first use of GHES by <a
href="https://github.com/danwkennedy"><code>@danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/download-artifact/pull/431">actions/download-artifact#431</a></li>
<li>Bump <code>@actions/artifact</code> to <code>v4.0.0</code></li>
<li>Prepare <code>v6.0.0</code> by <a
href="https://github.com/danwkennedy"><code>@danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/download-artifact/pull/438">actions/download-artifact#438</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/danwkennedy"><code>@danwkennedy</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/download-artifact/pull/431">actions/download-artifact#431</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/download-artifact/compare/v5...v6.0.0">https://github.com/actions/download-artifact/compare/v5...v6.0.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="018cc2cf5b"><code>018cc2c</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/download-artifact/issues/438">#438</a>
from actions/danwkennedy/prepare-6.0.0</li>
<li><a
href="815651c680"><code>815651c</code></a>
Revert "Remove <code>github.dep.yml</code>"</li>
<li><a
href="bb3a066a8b"><code>bb3a066</code></a>
Remove <code>github.dep.yml</code></li>
<li><a
href="fa1ce46bbd"><code>fa1ce46</code></a>
Prepare <code>v6.0.0</code></li>
<li><a
href="4a24838f3d"><code>4a24838</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/download-artifact/issues/431">#431</a>
from danwkennedy/patch-1</li>
<li><a
href="5e3251c4ff"><code>5e3251c</code></a>
Readme: spell out the first use of GHES</li>
<li><a
href="abefc31eaf"><code>abefc31</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/download-artifact/issues/424">#424</a>
from actions/yacaovsnc/update_readme</li>
<li><a
href="ac43a6070a"><code>ac43a60</code></a>
Update README with artifact extraction details</li>
<li><a
href="de96f4613b"><code>de96f46</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/download-artifact/issues/417">#417</a>
from actions/yacaovsnc/update_readme</li>
<li><a
href="7993cb44e9"><code>7993cb4</code></a>
Remove migration guide for artifact download changes</li>
<li>Additional commits viewable in <a
href="634f93cb29...018cc2cf5b">compare
view</a></li>
</ul>
</details>
<br />
Updates `tj-actions/changed-files` from
d03a93c0dbfac6d6dd6a0d8a5e7daff992b07449 to
dbf178ceecb9304128c8e0648591d71208c6e2c9
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/tj-actions/changed-files/blob/main/HISTORY.md">tj-actions/changed-files's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h1><a
href="https://github.com/tj-actions/changed-files/compare/v46.0.5...v47.0.0">47.0.0</a>
- (2025-09-13)</h1>
<h2><!-- raw HTML omitted -->🚀 Features</h2>
<ul>
<li>Add any_added to outputs (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2567">#2567</a>)
(<a
href="c260d49a82">c260d49</a>)
- (Jellyfrog)</li>
</ul>
<h2><!-- raw HTML omitted -->➖ Remove</h2>
<ul>
<li>Commit and push step from build job (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2538">#2538</a>)
(<a
href="be393a9038">be393a9</a>)
- (Tonye Jack)</li>
</ul>
<h2><!-- raw HTML omitted -->🔄 Update</h2>
<ul>
<li>Updated README.md (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2592">#2592</a>)</li>
</ul>
<p>Co-authored-by: github-actions[bot]
<41898282+github-actions[bot]<a
href="https://github.com/users"><code>@users</code></a>.noreply.github.com>
(<a
href="3dbc1e1812">3dbc1e1</a>)
- (github-actions[bot])</p>
<ul>
<li>Updated README.md (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2591">#2591</a>)</li>
</ul>
<p>Co-authored-by: github-actions[bot]
<41898282+github-actions[bot]<a
href="https://github.com/users"><code>@users</code></a>.noreply.github.com>
(<a
href="b1ccff8c08">b1ccff8</a>)
- (github-actions[bot])</p>
<ul>
<li>Updated README.md (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2574">#2574</a>)</li>
</ul>
<p>Co-authored-by: github-actions[bot]
<41898282+github-actions[bot]<a
href="https://github.com/users"><code>@users</code></a>.noreply.github.com>
(<a
href="050a3d3360">050a3d3</a>)
- (github-actions[bot])</p>
<h2><!-- raw HTML omitted -->📚 Documentation</h2>
<ul>
<li>Update link to glob patterns (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2590">#2590</a>)
(<a
href="a892f50f7a">a892f50</a>)
- (Tonye Jack)</li>
<li>Add Jellyfrog as a contributor for code, and doc (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2573">#2573</a>)
(<a
href="f000a9b97f">f000a9b</a>)
- (allcontributors[bot])</li>
</ul>
<h2><!-- raw HTML omitted -->🧪 Testing</h2>
<ul>
<li>Manual triggered workflows (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2637">#2637</a>)
(<a
href="c2ca249319">c2ca249</a>)
- (Tonye Jack)</li>
</ul>
<h2><!-- raw HTML omitted -->⚙️ Miscellaneous Tasks</h2>
<ul>
<li><strong>deps-dev:</strong> Bump jest from 30.0.5 to 30.1.3 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2655">#2655</a>)
(<a
href="9a6755550a">9a67555</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump tj-actions/git-cliff from 2.1.0 to 2.2.0
(<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2660">#2660</a>)
(<a
href="b67e30df88">b67e30d</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump github/codeql-action from 3.30.2 to
3.30.3 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2661">#2661</a>)
(<a
href="62aef422ff">62aef42</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump github/codeql-action from 3.29.11 to
3.30.2 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2659">#2659</a>)
(<a
href="e874f3cddd">e874f3c</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump actions/setup-node from 4.4.0 to 5.0.0
(<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2656">#2656</a>)
(<a
href="8c14441336">8c14441</a>)
- (dependabot[bot])</li>
<li><strong>deps-dev:</strong> Bump <code>@types/node</code> from
24.3.0 to 24.3.1 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2657">#2657</a>)
(<a
href="e995ac4be5">e995ac4</a>)
- (dependabot[bot])</li>
<li><strong>deps-dev:</strong> Bump <code>@types/node</code> from
24.2.1 to 24.3.0 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2649">#2649</a>)
(<a
href="3b04099b21">3b04099</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump github/codeql-action from 3.29.9 to
3.29.11 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2651">#2651</a>)
(<a
href="e7b6c977e5">e7b6c97</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump tj-actions/git-cliff from 2.0.2 to 2.1.0
(<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2648">#2648</a>)
(<a
href="765d62bc04">765d62b</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump github/codeql-action from 3.29.8 to
3.29.9 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2647">#2647</a>)
(<a
href="2036da178f">2036da1</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump github/codeql-action from 3.29.7 to
3.29.8 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2644">#2644</a>)
(<a
href="239aef84a5">239aef8</a>)
- (dependabot[bot])</li>
<li><strong>deps-dev:</strong> Bump <code>@types/node</code> from
24.2.0 to 24.2.1 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2645">#2645</a>)
(<a
href="a7d5f5f491">a7d5f5f</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump actions/checkout from 4.2.2 to 5.0.0 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2646">#2646</a>)
(<a
href="5107f3abcc">5107f3a</a>)
- (dependabot[bot])</li>
<li><strong>deps-dev:</strong> Bump <code>@types/node</code> from
24.1.0 to 24.2.0 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2640">#2640</a>)
(<a
href="f963b3f356">f963b3f</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump actions/download-artifact from 4.3.0 to
5.0.0 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2641">#2641</a>)
(<a
href="f956744105">f956744</a>)
- (dependabot[bot])</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="dbf178ceec"><code>dbf178c</code></a>
chore(deps): bump actions/setup-node from 5.0.0 to 6.0.0 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2690">#2690</a>)</li>
<li><a
href="1900262303"><code>1900262</code></a>
chore(deps): bump github/codeql-action from 3.30.6 to 4.30.9 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2693">#2693</a>)</li>
<li><a
href="27e5d78f9b"><code>27e5d78</code></a>
chore(deps-dev): bump <code>@types/node</code> from 24.6.2 to 24.9.1
(<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2695">#2695</a>)</li>
<li>See full diff in <a
href="d03a93c0db...dbf178ceec">compare
view</a></li>
</ul>
</details>
<br />
Updates `nixbuild/nix-quick-install-action` from 33 to 34
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/nixbuild/nix-quick-install-action/releases">nixbuild/nix-quick-install-action's
releases</a>.</em></p>
<blockquote>
<h2>nixbuild/nix-quick-install-action@v34</h2>
<h2>Changes</h2>
<ul>
<li>
<p>Update Nix versions: 2.31.0 -> 2.31.2, 2.30.0 -> 2.30.3, 2.29.1
-> 2.29.2, 2.28.4 -> 2.28.5.</p>
</li>
<li>
<p>Bump default Nix version: 2.29.1 -> 2.29.2</p>
</li>
</ul>
<h2>Supported Nix Versions on x86_64-linux runners</h2>
<ul>
<li>2.31.2</li>
<li>2.30.3</li>
<li>2.29.2</li>
<li>2.28.5</li>
<li>2.26.4</li>
<li>2.24.15</li>
<li>2.3.18</li>
</ul>
<h2>Supported Nix Versions on aarch64-linux runners</h2>
<ul>
<li>2.31.2</li>
<li>2.30.3</li>
<li>2.29.2</li>
<li>2.28.5</li>
<li>2.26.4</li>
<li>2.24.15</li>
</ul>
<h2>Supported Nix Versions on x86_64-darwin runners</h2>
<ul>
<li>2.31.2</li>
<li>2.30.3</li>
<li>2.29.2</li>
<li>2.28.5</li>
<li>2.26.4</li>
<li>2.24.15</li>
<li>2.3.18</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/nixbuild/nix-quick-install-action/blob/master/RELEASE">nixbuild/nix-quick-install-action's
changelog</a>.</em></p>
<blockquote>
<p>v34</p>
<h2>Changes</h2>
<ul>
<li>
<p>Update Nix versions: 2.31.0 -> 2.31.2, 2.30.0 -> 2.30.3, 2.29.1
-> 2.29.2, 2.28.4 -> 2.28.5.</p>
</li>
<li>
<p>Bump default Nix version: 2.29.1 -> 2.29.2</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="2c9db80fb9"><code>2c9db80</code></a>
Release v34</li>
<li><a
href="6dd8039259"><code>6dd8039</code></a>
ci: Fix versions</li>
<li><a
href="a7214c23df"><code>a7214c2</code></a>
Fix default version</li>
<li><a
href="efda085bca"><code>efda085</code></a>
Bump Nix versions</li>
<li><a
href="b644e5e09d"><code>b644e5e</code></a>
Update README and workflows for v33</li>
<li>See full diff in <a
href="1f095fee85...2c9db80fb9">compare
view</a></li>
</ul>
</details>
<br />
Updates `github/codeql-action` from 4.30.9 to 4.31.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.31.0</h2>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>4.31.0 - 24 Oct 2025</h2>
<ul>
<li>Bump minimum CodeQL bundle version to 2.17.6. <a
href="https://redirect.github.com/github/codeql-action/pull/3223">#3223</a></li>
<li>When SARIF files are uploaded by the <code>analyze</code> or
<code>upload-sarif</code> actions, the CodeQL Action automatically
performs post-processing steps to prepare the data for the upload.
Previously, these post-processing steps were only performed before an
upload took place. We are now changing this so that the post-processing
steps will always be performed, even when the SARIF files are not
uploaded. This does not change anything for the
<code>upload-sarif</code> action. For <code>analyze</code>, this may
affect Advanced Setup for CodeQL users who specify a value other than
<code>always</code> for the <code>upload</code> input. <a
href="https://redirect.github.com/github/codeql-action/pull/3222">#3222</a></li>
</ul>
<p>See the full <a
href="https://github.com/github/codeql-action/blob/v4.31.0/CHANGELOG.md">CHANGELOG.md</a>
for more information.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.31.0 - 24 Oct 2025</h2>
<ul>
<li>Bump minimum CodeQL bundle version to 2.17.6. <a
href="https://redirect.github.com/github/codeql-action/pull/3223">#3223</a></li>
<li>When SARIF files are uploaded by the <code>analyze</code> or
<code>upload-sarif</code> actions, the CodeQL Action automatically
performs post-processing steps to prepare the data for the upload.
Previously, these post-processing steps were only performed before an
upload took place. We are now changing this so that the post-processing
steps will always be performed, even when the SARIF files are not
uploaded. This does not change anything for the
<code>upload-sarif</code> action. For <code>analyze</code>, this may
affect Advanced Setup for CodeQL users who specify a value other than
<code>always</code> for the <code>upload</code> input. <a
href="https://redirect.github.com/github/codeql-action/pull/3222">#3222</a></li>
</ul>
<h2>4.30.9 - 17 Oct 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.23.3. <a
href="https://redirect.github.com/github/codeql-action/pull/3205">#3205</a></li>
<li>Experimental: A new <code>setup-codeql</code> action has been added
which is similar to <code>init</code>, except it only installs the
CodeQL CLI and does not initialize a database. Do not use this in
production as it is part of an internal experiment and subject to change
at any time. <a
href="https://redirect.github.com/github/codeql-action/pull/3204">#3204</a></li>
</ul>
<h2>4.30.8 - 10 Oct 2025</h2>
<p>No user facing changes.</p>
<h2>4.30.7 - 06 Oct 2025</h2>
<ul>
<li>[v4+ only] The CodeQL Action now runs on Node.js v24. <a
href="https://redirect.github.com/github/codeql-action/pull/3169">#3169</a></li>
</ul>
<h2>3.30.6 - 02 Oct 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.23.2. <a
href="https://redirect.github.com/github/codeql-action/pull/3168">#3168</a></li>
</ul>
<h2>3.30.5 - 26 Sep 2025</h2>
<ul>
<li>We fixed a bug that was introduced in <code>3.30.4</code> with
<code>upload-sarif</code> which resulted in files without a
<code>.sarif</code> extension not getting uploaded. <a
href="https://redirect.github.com/github/codeql-action/pull/3160">#3160</a></li>
</ul>
<h2>3.30.4 - 25 Sep 2025</h2>
<ul>
<li>We have improved the CodeQL Action's ability to validate that the
workflow it is used in does not use different versions of the CodeQL
Action for different workflow steps. Mixing different versions of the
CodeQL Action in the same workflow is unsupported and can lead to
unpredictable results. A warning will now be emitted from the
<code>codeql-action/init</code> step if different versions of the CodeQL
Action are detected in the workflow file. Additionally, an error will
now be thrown by the other CodeQL Action steps if they load a
configuration file that was generated by a different version of the
<code>codeql-action/init</code> step. <a
href="https://redirect.github.com/github/codeql-action/pull/3099">#3099</a>
and <a
href="https://redirect.github.com/github/codeql-action/pull/3100">#3100</a></li>
<li>We added support for reducing the size of dependency caches for Java
analyses, which will reduce cache usage and speed up workflows. This
will be enabled automatically at a later time. <a
href="https://redirect.github.com/github/codeql-action/pull/3107">#3107</a></li>
<li>You can now run the latest CodeQL nightly bundle by passing
<code>tools: nightly</code> to the <code>init</code> action. In general,
the nightly bundle is unstable and we only recommend running it when
directed by GitHub staff. <a
href="https://redirect.github.com/github/codeql-action/pull/3130">#3130</a></li>
<li>Update default CodeQL bundle version to 2.23.1. <a
href="https://redirect.github.com/github/codeql-action/pull/3118">#3118</a></li>
</ul>
<h2>3.30.3 - 10 Sep 2025</h2>
<p>No user facing changes.</p>
<h2>3.30.2 - 09 Sep 2025</h2>
<ul>
<li>Fixed a bug which could cause language autodetection to fail. <a
href="https://redirect.github.com/github/codeql-action/pull/3084">#3084</a></li>
<li>Experimental: The <code>quality-queries</code> input that was added
in <code>3.29.2</code> as part of an internal experiment is now
deprecated and will be removed in an upcoming version of the CodeQL
Action. It has been superseded by a new <code>analysis-kinds</code>
input, which is part of the same internal experiment. Do not use this in
production as it is subject to change at any time. <a
href="https://redirect.github.com/github/codeql-action/pull/3064">#3064</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="4e94bd11f7"><code>4e94bd1</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3235">#3235</a>
from github/update-v4.31.0-1d36546c1</li>
<li><a
href="8f11182164"><code>8f11182</code></a>
Update changelog for v4.31.0</li>
<li><a
href="1d36546c14"><code>1d36546</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3234">#3234</a>
from github/mbg/changelog/post-processing</li>
<li><a
href="08ada26e6a"><code>08ada26</code></a>
Add changelog entry for post-processing change</li>
<li><a
href="b843cbeed0"><code>b843cbe</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3233">#3233</a>
from github/mbg/getOptionalEnvVar</li>
<li><a
href="1ecd563919"><code>1ecd563</code></a>
Use <code>getOptionalEnvVar</code> in
<code>writePostProcessedFiles</code></li>
<li><a
href="e576807920"><code>e576807</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3223">#3223</a>
from github/henrymercer/bump-minimum</li>
<li><a
href="ad35676669"><code>ad35676</code></a>
Add <code>getOptionalEnvVar</code> function</li>
<li><a
href="d75645b13f"><code>d75645b</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3222">#3222</a>
from github/mbg/upload-lib/post-process</li>
<li><a
href="710606cc35"><code>710606c</code></a>
Check that <code>outputPath</code> is non-empty</li>
<li>Additional commits viewable in <a
href="16140ae1a1...4e94bd11f7">compare
view</a></li>
</ul>
</details>
<br />
Updates `Mattraks/delete-workflow-runs` from 2.0.6 to 2.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/mattraks/delete-workflow-runs/releases">Mattraks/delete-workflow-runs's
releases</a>.</em></p>
<blockquote>
<h2>v2.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update README.md with contents: read permission by <a
href="https://github.com/jonaslindstr"><code>@jonaslindstr</code></a>
in <a
href="https://redirect.github.com/Mattraks/delete-workflow-runs/pull/19">Mattraks/delete-workflow-runs#19</a></li>
<li>Deletes workflow runs that do not have an existing workflow by <a
href="https://github.com/watercable76"><code>@watercable76</code></a>
in <a
href="https://redirect.github.com/Mattraks/delete-workflow-runs/pull/20">Mattraks/delete-workflow-runs#20</a></li>
<li>Quick note about GHE <code>baseUrl</code> config by <a
href="https://github.com/kquinsland"><code>@kquinsland</code></a> in <a
href="https://redirect.github.com/Mattraks/delete-workflow-runs/pull/32">Mattraks/delete-workflow-runs#32</a></li>
<li>Added try/catch blocks to catch each error individually by <a
href="https://github.com/marcelovani"><code>@marcelovani</code></a> in
<a
href="https://redirect.github.com/Mattraks/delete-workflow-runs/pull/35">Mattraks/delete-workflow-runs#35</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/jonaslindstr"><code>@jonaslindstr</code></a>
made their first contribution in <a
href="https://redirect.github.com/Mattraks/delete-workflow-runs/pull/19">Mattraks/delete-workflow-runs#19</a></li>
<li><a
href="https://github.com/watercable76"><code>@watercable76</code></a>
made their first contribution in <a
href="https://redirect.github.com/Mattraks/delete-workflow-runs/pull/20">Mattraks/delete-workflow-runs#20</a></li>
<li><a
href="https://github.com/kquinsland"><code>@kquinsland</code></a> made
their first contribution in <a
href="https://redirect.github.com/Mattraks/delete-workflow-runs/pull/32">Mattraks/delete-workflow-runs#32</a></li>
<li><a
href="https://github.com/marcelovani"><code>@marcelovani</code></a>
made their first contribution in <a
href="https://redirect.github.com/Mattraks/delete-workflow-runs/pull/35">Mattraks/delete-workflow-runs#35</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Mattraks/delete-workflow-runs/compare/v2.0.6...v2.1.0">https://github.com/Mattraks/delete-workflow-runs/compare/v2.0.6...v2.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="ab482449ba"><code>ab48244</code></a>
version v2.1.0</li>
<li><a
href="feeb82053e"><code>feeb820</code></a>
Undo previous changes.</li>
<li><a
href="c61e04ec70"><code>c61e04e</code></a>
Added another try/catch block</li>
<li><a
href="f93a693640"><code>f93a693</code></a>
Added another try/catch block</li>
<li><a
href="f40e9cd010"><code>f40e9cd</code></a>
Removed condition that is limiting deletion</li>
<li><a
href="0a28a6b9d4"><code>0a28a6b</code></a>
Display debug messages</li>
<li><a
href="cb572387c4"><code>cb57238</code></a>
Display all workflows</li>
<li><a
href="8859caa936"><code>8859caa</code></a>
Quick note about GHE <code>baseUrl</code> config</li>
<li><a
href="4c9f24749b"><code>4c9f247</code></a>
Added better check to verify runs to be deleted, and some logging</li>
<li><a
href="2068295672"><code>2068295</code></a>
Deletes workflow runs that do not have an existing workflow</li>
<li>Additional commits viewable in <a
href="39f0bbed25...ab482449ba">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [github.com/gohugoio/hugo](https://github.com/gohugoio/hugo) from
0.151.2 to 0.152.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/gohugoio/hugo/releases">github.com/gohugoio/hugo's
releases</a>.</em></p>
<blockquote>
<h2>v0.152.2</h2>
<p>In <code>v0.152.0</code> we tightened the source validation for <a
href="https://gohugo.io/configuration/module/#mounts">file mounts</a>.
We always said that <em>project mounts can mount with absolute
file/directorynames, modules/themes are restricted to relative</em>. In
<code>v0.152.0</code> we narrowed module/themes mounts to be local,
which made the setup in the bug report listed below fail:</p>
<pre lang="toml"><code>[[module.mounts]]
source = '../../node_modules/bootstrap'
target = 'assets/vendor/bootstrap'
</code></pre>
<p>One part of this is security. But the construct above is
<em>usually</em> very odd (the project uses files in a theme/module, not
the other way around) and not very portable. But the example above
demonstrates a valid exception, that we now have added support for in a
portable way. The above example now works as it did before
<code>v0.152.0</code>, but going forward you can also write:</p>
<pre lang="toml"><code>[[module.mounts]]
source = 'node_modules/bootstrap'
target = 'assets/vendor/bootstrap'
</code></pre>
<p>We now have the <code>node_modules</code> as a special case: For
themes/modules we first check if the mounted source exists locally, if
not we try relative to the project root.</p>
<h2>What's Changed</h2>
<ul>
<li>deps: Update github.com/tdewolff/minify v2.24.4 => v2.24.5
1c8c21e45 <a
href="https://github.com/jmooring"><code>@jmooring</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14086">#14086</a></li>
<li>hugofs: Make node_modules a "special case" mount 809ebe01f
<a href="https://github.com/bep"><code>@bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14089">#14089</a></li>
<li>github: Fix typo in stale PR message 08a0679a8 <a
href="https://github.com/jordelver"><code>@jordelver</code></a></li>
</ul>
<h2>v0.152.1</h2>
<p>These fixes are are all related to the YAML library upgrade in <a
href="https://github.com/gohugoio/hugo/releases/tag/v0.152.0">v0.152.0</a>.</p>
<ul>
<li>Expand the numeric conversions to template funcs/methods e08278d16
<a href="https://github.com/bep"><code>@bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14079">#14079</a></li>
<li>Fix where with uint64 df4f80d54 <a
href="https://github.com/bep"><code>@bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14081">#14081</a></li>
<li>Fix it so YAML integer types can be used where Go int types are
expected d4c78885a <a
href="https://github.com/bep"><code>@bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14079">#14079</a></li>
<li>tpl/compare: Fix compare/sort of uint64s 29e2c2fa9 <a
href="https://github.com/bep"><code>@bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14078">#14078</a></li>
<li>Fix "assignment to entry in nil map" on empty YAML config
files 0579afc3c <a href="https://github.com/bep"><code>@bep</code></a>
<a
href="https://redirect.github.com/gohugoio/hugo/issues/14074">#14074</a></li>
</ul>
<h2>v0.152.0</h2>
<p>The big new thing and the motivation behind this release is the
upgrade to a more modern YAML library in <a
href="https://github.com/goccy"><code>@goccy</code></a> 's <a
href="https://github.com/goccy/go-yaml">github.com/goccy/go-yaml</a>.
It's been a surprisingly long and winding road to get here. <strong>Note
that this upgrade comes with some minor breaking changes, most notably
that the old YAML 1.1 spec listed a set of strings that, when unquoted,
were treated as boolean <code>true</code> or
<code>false</code>.</strong> So if you're using any of the values in the
table below as booleans, you need to adjust your YAML, but I suspect
that fixing this very surprising behavior will fix more issues than it
introduces. A big new thing with this new YAML library is the support
for <a
href="https://www.linode.com/docs/guides/yaml-anchors-aliases-overrides-extensions/">YAML
anchors and aliases</a> which helps to reduce duplication in e.g. your
configuration. There are some examples in Hugo's <a
href="https://github.com/gohugoio/hugo/blob/master/hugoreleaser.yaml">release
build configuration</a> and in the <a
href="https://github.com/gohugoio/hugo/blob/master/.circleci/config.yml">Hugo's
CI release setup</a>.</p>
<table>
<thead>
<tr>
<th align="left">Values</th>
<th align="left">Old meaning</th>
<th align="left">New meaning</th>
</tr>
</thead>
<tbody>
<tr>
<td align="left"><code>yes</code>, <code>Yes</code>, <code>YES</code>,
<code>y</code>, <code>Y</code>, <code>on</code>, <code>On</code>,
<code>ON</code></td>
<td align="left"><code>true</code> (bool)</td>
<td align="left"><code>yes</code>, <code>Yes</code>, <code>YES</code>,
<code>y</code>, <code>Y</code>, <code>on</code>, <code>On</code>,
<code>ON</code> (string)</td>
</tr>
<tr>
<td align="left"><code>no</code>, <code>No</code>, <code>NO</code>,
<code>n</code>, <code>N</code>, <code>off</code>, <code>Off</code>,
<code>OFF</code></td>
<td align="left"><code>false</code> (bool)</td>
<td align="left"><code>no</code>, <code>No</code>, <code>NO</code>,
<code>n</code>, <code>N</code>, <code>off</code>, <code>Off</code>,
<code>OFF</code> (string)</td>
</tr>
</tbody>
</table>
<h2>Note</h2>
<ul>
<li>Replace to gopkg.in/yaml with github.com/goccy/go-yaml (note)
a3d954846 <a href="https://github.com/bep"><code>@bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/8822">#8822</a>
<a
href="https://redirect.github.com/gohugoio/hugo/issues/13043">#13043</a>
<a
href="https://redirect.github.com/gohugoio/hugo/issues/14053">#14053</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="6abdacad3f"><code>6abdaca</code></a>
releaser: Bump versions for release of 0.152.2</li>
<li><a
href="1c8c21e45e"><code>1c8c21e</code></a>
deps: Update github.com/tdewolff/minify v2.24.4 => v2.24.5</li>
<li><a
href="809ebe01fa"><code>809ebe0</code></a>
hugofs: Make node_modules a "special case" mount</li>
<li><a
href="08a0679a89"><code>08a0679</code></a>
github: Fix typo in stale PR message</li>
<li><a
href="524b98665b"><code>524b986</code></a>
releaser: Prepare repository for 0.153.0-DEV</li>
<li><a
href="5869cbddd8"><code>5869cbd</code></a>
releaser: Bump versions for release of 0.152.1</li>
<li><a
href="e08278d165"><code>e08278d</code></a>
Expand the numeric conversions to template funcs/methods</li>
<li><a
href="df4f80d54f"><code>df4f80d</code></a>
Fix where with uint64</li>
<li><a
href="d4c78885ae"><code>d4c7888</code></a>
Fix it so YAML integer types can be used where Go int types are
expected</li>
<li><a
href="29e2c2fa92"><code>29e2c2f</code></a>
tpl/compare: Fix compare/sort of uint64s</li>
<li>Additional commits viewable in <a
href="https://github.com/gohugoio/hugo/compare/v0.151.2...v0.152.2">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Adds columns to track package and test name to test_databases table, and populates them as databases are created using the Broker.
In order to seamlessly work with existing `coder_database` databases with the old schema, the SQL that creates the table and columns is additive and idempotent, so we run it every time we initialize the Broker (once per test binary execution).
We include a transaction level advisorly lock to prevent deadlocks before attempting to alter the schema. I was seeing deadlocks without this.
If you were to somehow get a 401, or some other unexpected HTTP status code when following a workspace's build logs, `coder ssh` would swallow the error, and give you a different error that didn't make sense.
In this case I was getting a 401 on `/templateversions/{templateversion}/dry-run/{jobID}/logs` , but the CLI error would say the workspace had no agents.
I ran into the 401 when running a scaletest, and then whilst attempting to reproduce the issue locally, I ran `coder ssh` from one build of Coder that used `coder_session_token` as the session token cookie name, whilst the other build used `dev_coder_session_token` (as set by `develop.sh`). For reference, the CLI uses cookies when following the build logs.
The list of community templates contained a template called
vscode-server-template which links to a hijacked accounts repository.
https://github.com/KozmikNano/vscode-server-template
I removed it from the list
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Adds CompletionHandler to the ssh command that dynamically suggests
workspace and agent targets based on the user's running workspaces.
Features:
- Suggests workspace name for single-agent workspaces
- Suggests agent.workspace format for all agents in multi-agent
workspaces
- Only shows running workspaces (matches immediate availability)
- Alphabetically sorted completions for better UX
Tests cover single-agent, multi-agent, and network error scenarios.
Amp-Thread-ID:
https://ampcode.com/threads/T-d137d343-53f3-4ece-be5a-584249bbd9e8
<!--
If you have used AI to produce some or all of this PR, please ensure you
have read our [AI Contribution
guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING)
before submitting.
-->
closes#20158
Demo:
https://github.com/user-attachments/assets/e1000463-ded6-4bc9-b013-61780453f019
---------
Co-authored-by: Ethan Dickson <ethan@coder.com>
Resolved an invalid parameter error (-2147024809) during PTY creation on
Windows 11 22H2 (but not only) when connecting via JetBrains Toolbox
which spawns the native SSH client with `-tt` forcing PTY allocation
even though there is no "terminal" on the client side to query its size.
CreatePseudoConsole doesn't accept a 0x0 (zero width and zero height)
console size and unfortunately, there is NO explicit documentation in
the official Microsoft documentation that states the minimum valid
values or explicitly prohibits 0x0.
Looking at real-world implementations in the search results, all
examples use reasonable non-zero values.
I tested this with a local Windows VM registered to dev.coder.com i.e.
externally managed workspace.
Fixes: #20468
## Description
This PR introduces an optimization to automatically cancel pending
prebuild-related jobs from non-active template versions in the
reconciliation loop.
## Problem
Currently, when a template is configured with more prebuild instances
than available provisioners, the provisioner queue can become flooded
with pending prebuild jobs. This issue is worsened when
provisioning/deprovisioning operations take a long time.
When the prebuild reconciliation loop generates jobs faster than
provisioners can process them, pending jobs accumulate in the queue.
Since prebuilt workspaces should always run the latest active template
version, pending prebuild jobs from non-active versions become obsolete
once a new version is promoted.
## Solution
The reconciliation loop cancels pending prebuild-related jobs from
non-active template versions that match the following criteria:
* Build number: 1 (initial build created by the reconciliation loop)
* Job status: `pending`
* Not yet picked up by a provisioner (`worker_id` is `NULL`)
* Owned by the prebuilds system user
* Workspace transition: `start`
This prevents the queue from being cluttered with stale prebuild jobs
that would provision workspaces on an outdated template version that
would consequently need to be deprovisioned.
## Changes
* Added new SQL query `CountPendingNonActivePrebuilds` to identify
presets with pending jobs from non-active versions
* Added new SQL query `UpdatePrebuildProvisionerJobWithCancel` to cancel
jobs for a specific preset
* New reconciliation action type `ActionTypeCancelPending` handles the
cancellation logic
* Cancellation is non-blocking: failures to cancel prebuild jobs are
logged as errors and don't prevent other reconciliation actions
## Follow-up PR
Canceling pending prebuild jobs leaves workspaces in a Canceled state.
While no Terraform resources need to be destroyed (since jobs were
canceled before provisioning started), these database records should
still be cleaned up. This will be addressed in a follow-up PR.
Closes: https://github.com/coder/coder/issues/20242
Relates to https://github.com/coder/internal/issues/1093
This is the first of N pull requests to allow coder script ordering.
It introduces what is for now dead code, but paves the way for various
interfaces that allow coder scripts and other processes to depend on one
another via CLI commands and terraform configurations.
The next step is to add reactivity to the graph, such that changes in
the status of one vertex will propagate and allow other vertices to
change their own statuses.
Concurrency and stress testing yield the following:
CPU Profile:
<img width="1512" height="862" alt="Screenshot 2025-10-17 at 10 38 52"
src="https://github.com/user-attachments/assets/f46cf1a2-a0b2-4c02-81a0-069798108ee5"
/>
Mem Profile:
<img width="1512" height="862" alt="Screenshot 2025-10-17 at 10 38 01"
src="https://github.com/user-attachments/assets/45be1235-fff6-45ba-a50d-db9880377bd0"
/>
Predictably, lock contention and memory allocation are the largest
components of this system under stress. Nothing seems untoward.
Updates the UI to use the new API endpoints for tasks and use its new
data model.
Disclaimer: Since the base data model for tasks changed, we had to do a
quite large refactor and I'm sorry for that 🙏, but you'll notice most of
the changes are to adjust the types.
Closescoder/internal#976
---------
Co-authored-by: Bruno Quaresma <bruno_nonato_quaresma@hotmail.com>
Add API key allow list to the SDK
This PR adds an allow list to API keys in the SDK. The allow list is a list of targets that the API key is allowed to access. If the allow list is empty, a default allow list with a single entry that allows access to all resources is created.
The changes include:
- Adding a default allow list when generating an API key if none is provided
- Adding allow list to the API key response in the SDK
- Converting database allow list entries to SDK format in the API response
- Adding tests to verify the default allow list behavior
Fixes#19854
As we're moving away from the SidebarAppID nomenclature, this PR
introduces a new `TaskAppID` field to `codersdk.WorkspaceBuild` and
deprecates the `AITaskSidebarAppID` field. They both contain the same
value.
Pipes through the Task's ID and prompt into the provisioner. This is
required to support the new `coder_ai_task.prompt` field and modified
`coder_ai_task.id` field.
Second flake for this test today 😮💨.
Flake seen here, though I couldn't replicate this locally, some CI
exclusive networking issue.
https://github.com/coder/coder/actions/runs/18770305895/job/53553517887?pr=20448
```
agent_test.go:3619:
Error Trace: /home/runner/work/coder/coder/agent/agent_test.go:3619
Error: Received unexpected error:
expected 1, got 0.000000:
github.com/coder/coder/v2/agent_test.TestAgent_Metrics_SSH.func7
/home/runner/work/coder/coder/agent/agent_test.go:3557
Test: TestAgent_Metrics_SSH
Messages: check fn for coderd_agentstats_currently_reachable_peers failed
```
This value is incremented by a successful ping to the peer from the
agent, which is dependent on all the networking code, which I think is
definitely out of scope of this test for agent metrics. So, we'll just
assert that the metrics exist with the correct labels (`derp`, `p2p`)
Closes https://github.com/coder/internal/issues/921
The flake in the linked issue was caused by the startup script taking longer than 1 second in CI. The existing conditional, that the startup script duration was under a second, was incorrect; the correct conditional is that the metric exists with the `success` label set to `true`.
This PR uses the same sha256 hashing technique as we use for APIKeys. So
now all randomly generated secrets will be hashed with sha256 for
consistency.
This is a breaking change for the oauth tokens. Since oauth is only
allowed for dev builds and experimental, this is ok.
Since `coder exp scaletest dynamic-parameters` ends up creating template versions, provisioner tags may be required to create the template versions.
On our own scaletest clusters, we tag every provisioner, so an untagged template version won't build and won't get imported.
Thanks to the great work in #20393, we’ve successfully introduced
offset-based pagination for this endpoint. However, the frontend expects
a `count` field in the response rather than `total`. This PR updates the
response payload to rename the returned key to `count` for consistency
with frontend expectations and existing API patterns.
This is necessary to unblock the work in #20331
Allows running a vendored version of Coder in our `compose.yaml` as
follows:
```
CODER_REPO=my.repo.tld/mycoder/coder CODER_VERSION=my-tag docker compose up
```
Also allows running the current "dogfood" version of Coder as follows:
```
CODER_REPO=ghcr.io/coder/coder-preview CODER_VERSION=dogfood docker compose up
```
This PR extends the scaletest notification runner with SMTP support.
If the `--smtp-api-url` flag is provided, the runner will also watch for SMTP notifications using the specified URL.
#### Changes
- Added a new watcher to retrieve emails sent to the runner user
- Tracked WebSocket and SMTP latencies separately
- Updated metrics to include `notification_id` and `notification_type` labels
#### CLI Flags
- `--smtp-api-url`: Address of the SMTP mock HTTP API used to retrieve email notifications
#### Metrics
- `notification_delivery_latency_seconds` now includes:
- `notification_id`
- `notification_type` (`websocket` or `smtp`)
This PR adds a fake SMTP server for scale testing. It collects emails sent during tests, which you can then check using the HTTP API.
#### Changes
- Added mock SMTP server
- Added `coder scaletest smtp` CLI command
- Implemented HTTP API endpoints to retrieve messages by email
- Added auto-purge to prevent memory issues
#### HTTP API Endpoints
- `GET /messages?email=<email>` – Get messages sent to an email address
- `POST /purge` – Clear all messages from memory
The HTTP API parses raw email messages to extract the **date**, **subject**, and **notification ID**.
Notification IDs are sent in emails like this:
```html
<p>
<a href="http://127.0.0.1:3000/settings/notifications?disabled=4e19c0ac-94e1-4532-9515-d1801aa283b2"
style="color: #2563eb; text-decoration: none;">
Stop receiving emails like this
</a>
</p>
```
#### CLI
```bash
coder scaletest smtp --host localhost --port 33199 --api-port 8080 --purge-at-count 1000
```
**Flags:**
- `--host`: Host for the mock SMTP and API server (default: localhost)
- `--port`: Port for the mock SMTP server (random if not specified)
- `--api-port`: Port for the HTTP API server (random if not specified)
- `--purge-at-count`: Max number of messages before auto-purging (default: 100000)
This change allows us to stop adding the following for every invokation:
```
//nolint:gocritic // This is in a test package and does not end up in the build
```
- Adds FK from `aibridge_interceptions.initiator_id` to `users.id`
- This is enforced by deleting any rows that don't have any users. Since
this is an experimental feature AND coder never deletes user rows I
think this is acceptable.
- Adds `name` as a property on `codersdk.MinimalUser`
- This matches the `visible_users` view in the database. I'm unsure why
`name` wasn't already included given that `username` is.
- Adds a new `initiator` field to `codersdk.AIBridgeInterception` which
contains `codersdk.MinimalUser` (ID, username, name, avatar URL)
- Removes `initiator_id` from `codersdk.AIBridgeInterception`
- Should be fine since we're still in early access
The tenv linter is deprecated in favor of usetesting which offers a
superset of lint checks. This message is seen when running `make lint`
```
[nix-shell:~/src/coder]$ make lint
<snip>
WARN The linter 'tenv' is deprecated (since v1.64.0) due to: Duplicate feature in another linter. Replaced by usetesting.
<snip>
```
This change swaps out the deprecated tenv linter for the usetesting linter,
and configures it for linting parity.
https://github.com/coder/coder/issues/20398
Sometimes tests would fail because the port embedded postgres tries to
use is already in use. This is because there's no way to tell postgres
to use an ephemeral port in tests. This change adds retries to starting
embedded postgres when the port is not explicitly defined (e.g. tests) which
should rid of, or at least significantly reduce, these flakes.
https://github.com/coder/internal/issues/658
The authz recorder is causing a lot of memory to be allocated, and is a
memory leak for websocket connections.
This change makes it opt-in on a per request basis (ontop of `isDev`).
To get the authz headers, use `Copy as cURL` on chrome and append the
header `x-authz-checks=true`.
Bumps [github.com/gohugoio/hugo](https://github.com/gohugoio/hugo) from
0.150.0 to 0.151.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/gohugoio/hugo/releases">github.com/gohugoio/hugo's
releases</a>.</em></p>
<blockquote>
<h2>v0.151.2</h2>
<h2>What's Changed</h2>
<ul>
<li>parser/pageparser: Add a testcase for nested shortcodes of the same
name 989454a52 <a href="https://github.com/bep"><code>@bep</code></a>
<a
href="https://redirect.github.com/gohugoio/hugo/issues/14054">#14054</a></li>
<li>parser/pageparser: Fix shortcode nesting regression 1e91e4652 <a
href="https://github.com/bep"><code>@bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14054">#14054</a></li>
</ul>
<h2>v0.151.1</h2>
<p>This release is mostly motivated by some upstream security fixes:</p>
<ul>
<li>Upgrade from Go 1.25.1 to Go 1.25.3 which comes with <a
href="https://github.com/golang/go/issues?q=milestone%3AGo1.25.2%20label%3ASecurity">10
security fixes</a>.</li>
<li>Go's <code>net/html</code> package also has one <a
href="59706cdaa8">security
patch</a></li>
</ul>
<p>I, <a href="https://github.com/bep"><code>@bep</code></a>, have
inspected the above issues, and none of them seem to be relevant for
Hugo, but we understand that many want to have a clean security
report.</p>
<h2>Bug fixes</h2>
<ul>
<li>tpl: Fix strings/truncate CJK handling 88aea5668 <a
href="https://github.com/oishikazuo"><code>@oishikazuo</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14039">#14039</a></li>
<li>parser/pagerparser: Fix closing shortcode error handling when
repeated a133393ed <a
href="https://github.com/bep"><code>@bep</code></a></li>
</ul>
<h2>Improvements</h2>
<ul>
<li>Upgrade Go to 1.25.3 e2fb0b0e8 <a
href="https://github.com/bep"><code>@bep</code></a></li>
<li>create/skeletons: Wrap section and home lists with section tags
29cf87444 <a
href="https://github.com/imomaliev"><code>@imomaliev</code></a></li>
<li>markup/goldmark: Align blockquote default output with Goldmark
1b4dd436d <a
href="https://github.com/jmooring"><code>@jmooring</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14046">#14046</a></li>
<li>parser/pageparser: Store shortcode names as unique.Handle[string] to
save memory allocations 4414ef73f <a
href="https://github.com/bep"><code>@bep</code></a></li>
<li>testscripts: Make test assertion less specific 9197debbf <a
href="https://github.com/bep"><code>@bep</code></a></li>
</ul>
<h2>Dependency Updates</h2>
<ul>
<li>build(deps): bump github.com/gohugoio/hashstructure from 0.5.0 to
0.6.0 f4c11571b <a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]</li>
<li>build(deps): bump golang.org/x/image from 0.30.0 to 0.32.0 54075acc2
<a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]</li>
<li>build(deps): bump github.com/evanw/esbuild from 0.25.10 to 0.25.11
8b52303e3 <a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]</li>
<li>build(deps): bump golang.org/x/tools from 0.37.0 to 0.38.0 3d45d30a4
<a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]</li>
<li>build(deps): bump golang.org/x/mod from 0.28.0 to 0.29.0 095157cd6
<a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]</li>
</ul>
<h2>v0.151.0</h2>
<p>Some notable new features in Hugo v0.151.0 are:</p>
<ul>
<li>New <a
href="https://gohugo.io/functions/transform/htmltomarkdown/">transform.HTMLToMarkdown</a>
template function. One possible use case would be to provide <a
href="https://llmstxt.org/">LLM friendly content</a>.</li>
<li>Hugo now reports OSC 9;4 progress when building; progress
bars/indicators are supported by terminals such as <a
href="https://ghostty.org/docs/install/release-notes/1-2-0#graphical-progress-bars">Ghostty</a>
on Macos and Linux, Windows terminal.</li>
<li>Several new <a
href="https://gohugo.io/configuration/markup/#footnote">config
options</a> for Markdown foot notes.</li>
</ul>
<h2>Note</h2>
<ul>
<li>transform/livereloadinject: Skip livereload.js injection if no tags
found (note) 7fd6762c1 <a
href="https://github.com/AndrewChubatiuk"><code>@AndrewChubatiuk</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="a3574f6f70"><code>a3574f6</code></a>
releaser: Bump versions for release of 0.151.2</li>
<li><a
href="989454a52d"><code>989454a</code></a>
parser/pageparser: Add a testcase for nested shortcodes of the same
name</li>
<li><a
href="1e91e46520"><code>1e91e46</code></a>
parser/pageparser: Fix shortcode nesting regression</li>
<li><a
href="8a57d0f15f"><code>8a57d0f</code></a>
testscripts: Add and improve commands tests for static mounts</li>
<li><a
href="b76c50ac18"><code>b76c50a</code></a>
releaser: Prepare repository for 0.152.0-DEV</li>
<li><a
href="1cdd17882c"><code>1cdd178</code></a>
releaser: Bump versions for release of 0.151.1</li>
<li><a
href="e2fb0b0e80"><code>e2fb0b0</code></a>
Upgrade Go to 1.25.3</li>
<li><a
href="88aea56683"><code>88aea56</code></a>
tpl: Fix strings/truncate CJK handling</li>
<li><a
href="f4c11571bb"><code>f4c1157</code></a>
build(deps): bump github.com/gohugoio/hashstructure from 0.5.0 to
0.6.0</li>
<li><a
href="54075acc29"><code>54075ac</code></a>
build(deps): bump golang.org/x/image from 0.30.0 to 0.32.0</li>
<li>Additional commits viewable in <a
href="https://github.com/gohugoio/hugo/compare/v0.150.0...v0.151.2">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the x group with 4 updates in the / directory:
[golang.org/x/crypto](https://github.com/golang/crypto),
[golang.org/x/net](https://github.com/golang/net),
[golang.org/x/oauth2](https://github.com/golang/oauth2) and
[golang.org/x/tools](https://github.com/golang/tools).
Updates `golang.org/x/crypto` from 0.42.0 to 0.43.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="627cb894b6"><code>627cb89</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="dca4914afe"><code>dca4914</code></a>
acme: fix autocert TestHTTPHandlerDefaultFallback</li>
<li><a
href="1336e21bd6"><code>1336e21</code></a>
x509roots/fallback: update bundle</li>
<li><a
href="2beaa59a3c"><code>2beaa59</code></a>
ssh: add VerifiedPublicKeyCallback</li>
<li><a
href="66c3d8ce71"><code>66c3d8c</code></a>
ssh: add support for FIPS mode</li>
<li><a
href="ddb4e80c6a"><code>ddb4e80</code></a>
ssh: remove custom contains, use slices.Contains</li>
<li><a
href="f4d47b0db5"><code>f4d47b0</code></a>
ssh: return clearer error when signature algorithm is used as key
format</li>
<li><a
href="96dc232fbd"><code>96dc232</code></a>
x509roots/fallback/bundle: add bundle package to export root certs</li>
<li><a
href="8c9ba31836"><code>8c9ba31</code></a>
all: freeze and deprecate more packages</li>
<li><a
href="559e062ce8"><code>559e062</code></a>
ssh/agent: return an error for unexpected message types</li>
<li>See full diff in <a
href="https://github.com/golang/crypto/compare/v0.42.0...v0.43.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `golang.org/x/net` from 0.45.0 to 0.46.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="2002a064a4"><code>2002a06</code></a>
go.mod: update golang.org/x dependencies</li>
<li>See full diff in <a
href="https://github.com/golang/net/compare/v0.45.0...v0.46.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `golang.org/x/oauth2` from 0.31.0 to 0.32.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="792c877635"><code>792c877</code></a>
oauth2: use strings.Builder instead of bytes.Buffer</li>
<li>See full diff in <a
href="https://github.com/golang/oauth2/compare/v0.31.0...v0.32.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `golang.org/x/term` from 0.35.0 to 0.36.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="3a0828a666"><code>3a0828a</code></a>
go.mod: update golang.org/x dependencies</li>
<li>See full diff in <a
href="https://github.com/golang/term/compare/v0.35.0...v0.36.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `golang.org/x/text` from 0.29.0 to 0.30.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="c6abd0305e"><code>c6abd03</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="42f038dad6"><code>42f038d</code></a>
x/text: fix nil dereference in gotext extract</li>
<li><a
href="a42f0e2da6"><code>a42f0e2</code></a>
all: use built-in max/min to simplify the code</li>
<li>See full diff in <a
href="https://github.com/golang/text/compare/v0.29.0...v0.30.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `golang.org/x/tools` from 0.37.0 to 0.38.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="a22b5e8a9b"><code>a22b5e8</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="4bbcc9fd12"><code>4bbcc9f</code></a>
all: use reflect.TypeFor instead of reflect.TypeOf when we have known
the type</li>
<li><a
href="122c93afe1"><code>122c93a</code></a>
internal/refactor: AddImport: remove unnecessary result</li>
<li><a
href="76aace8abc"><code>76aace8</code></a>
internal/analysisinternal: rationalize</li>
<li><a
href="8cf2d63f23"><code>8cf2d63</code></a>
gopls/internal/golang: add condition for enabling package move</li>
<li><a
href="1f054fd59c"><code>1f054fd</code></a>
x/tools: downgrade token.FileSet parameters to token.File</li>
<li><a
href="44e71e5c40"><code>44e71e5</code></a>
go/analysis/passes/printf: check anonymous functions too</li>
<li><a
href="9095e9b831"><code>9095e9b</code></a>
internal/analysisinternal: extract DeleteVar</li>
<li><a
href="62a1b26b1a"><code>62a1b26</code></a>
internal/analysisinternal: IsChildOf(Cursor, edge.Kind) bool</li>
<li><a
href="d32fb5053d"><code>d32fb50</code></a>
internal/analysisinternal: export EnclosingFile</li>
<li>Additional commits viewable in <a
href="https://github.com/golang/tools/compare/v0.37.0...v0.38.0">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Necessary for the frontend to be able to paginate easily. Cursor
pagination is good for fetching all events, but doesn't play very well
when a pagination component gets involved.
Adds support for `?offset=x` to the existing endpoint. The cursor-based
pagination (`?after_id=x`) is still supported. The two pagination modes
are mutually exclusive, and are documented as such. If both are
supplied, the request will be rejected.
Also adds a `total` property to the response that contains the full
count of items matching the filter. We already have indices in place so
I don't think this will impact performance (or we can revisit it before
GA).
Adds a new document for our ongoing efforts achieving 10k user scale. The content is caveated as work in progress, but represents what we have tested so far.
closes: https://github.com/coder/internal/issues/1025
Adds the following debug routes for people with the `debug_info:read`
permission:
- `/api/v2/debug/pprof` for `net/http/pprof`
- `/`
- `/cmdline`
- `/profile`
- `/symbol`
- `/trace`
- `/*`
- `/api/v2/debug/metrics` for Prometheus metrics
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## Description
Add missing provisionerd metrics to Prometheus documentation:
* `coderd_provisionerd_num_daemons`: The number of provisioner daemons.
* `coderd_provisionerd_workspace_build_timings_seconds`: The time taken
for a workspace to build.
Related to internal thread:
https://codercom.slack.com/archives/C07GRNNRW03/p1760642020583019
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
aid in differentiation between sources of calls to `GetWorkspaces` but introducing new queries for metrics specific use cases
---------
Signed-off-by: Callum Styan <callumstyan@gmail.com>
Set the terraform provider version to `2.12.0-pre0` so we can dogfood it
before releasing. This provider version contains an update to the
`coder_ai_task` resource in preparation for the upcoming 2.28 Coder
release.
Some comments are likely still omitted as guts does not cover all cases
right now. And some cases are omitted because the output format is
ambiguous on how best to format it.
Fixes https://github.com/coder/internal/issues/1067
- Adds `WorkspaceAgentWaiter.WithContext()`
- Updates usage of `WorkspaceAgentWaiter` in `aitasks_test.go` with
context bumped to `testutil.WaitMedium`
Authored by Claude with manual review and updates.
Adds some coderd integration tests for `coder exp tasks (send|logs)`.
The actual agentapi interaction is faked out. I figure we don't want to
actually start a real agentapi instance here.
Authored by Claude with some manual cleanup.
## Summary
In this pull request we're adding a simple backoff to the workspace
agent polling. This backoff is being added to address seemingly random
cases of elevated number of calls that we've seen to the
`api/v2/workspaceagent/{agent_id}` endpoint.
For more information on the investigation, see:
https://github.com/coder/internal/issues/725
### Changes
- Updated the polling to use predefined progressive intervals for
polling instead of continuously polling every 500ms
### Testing
- Added a test for the function used to calculate the progressive
polling interval
Co-authored-by: Spike Curtis <spike@coder.com>
## Overview
Links in announcement banners are now underlined to make them visually
distinguishable without requiring users to hover over them.
Context:
[Slack](https://codercom.slack.com/archives/C0989BZU23T/p1759503061267819)
## Changes
- Added `text-decoration: underline` to links in the announcement banner
component
---------
Co-authored-by: blink-so[bot] <211532188+blink-so[bot]@users.noreply.github.com>
Co-authored-by: blink-so[bot] <157993532+blink-so[bot]@users.noreply.github.com>
Co-authored-by: Michael Smith <michaelsmith@coder.com>
Previously we unpinned the containerd.io package since the dogfood
template image build was failing due to docker-ce requiring a newer
version of containerd.io. The build was fixed, but some dogfood machines
experienced docker-in-docker problems again because their OS version
didn't have the fixed containerd.io packages available.
This PR first reverts the unpinning of the containerd.io package, and
pins the docker-ce major version for compatibility with the
containerd.io package version we have pinned. Newer versions of
docker-ce have a higher min version of containerd.io. While the
underlying issue that caused us to pin containerd.io is fixed in newer
versions, we can't yet remove the pin because some machines running
dogfood are not yet updated to a version of Linux that have a version of
the fixed package (e.g. ubuntu 20.04).
## Description
Follow-up from: https://github.com/coder/coder/pull/20305 to include a
note about `coder_workspace_tags` being cumulative and a new step to
validate the status of the prebuild provisioners.
Fix steps formatting.
## Description
Add a `coder_workspace_tags` data block to the Write Coder on Coder
template that conditionally includes the tag `is_prebuild=true` when the
provisioner job is a prebuild (workspace_build) job.
Related internal [PR](https://github.com/coder/dogfood/pull/201) updated
the dogfood deployment with a dedicated pool of provisioner daemons
configured with this tag.
As a result, prebuild-related jobs are now routed exclusively to this
pool, preventing them from competing with user-initiated workspace jobs.
This has been successfully tested internally in dogfood with template
`ssncf-prebuilds-coder`
Add reconciliation and rollout for coder-provisioner-tagged-prebuilds
deployment
<!--
If you have used AI to produce some or all of this PR, please ensure you
have read our [AI Contribution
guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING)
before submitting.
-->
- Attempts pings twice per replicasync callback in wsproxy
- Reworks the test setup code to be more lenient and retry proxy
registration on failure
Closescoder/internal#957
Previously the dogfood action was failing because the image for the
dogfood template pulls a version of docker-ce that depended on a version
of containerd.io greater than the pinned version. The pinned version was
a workaround for an old sysbox issue (see #15723).
Example action I kicked off main recently that failed:
https://github.com/coder/coder/actions/runs/18507966953
```
4.879 The following packages have unmet dependencies:
4.955 docker-ce : Depends: containerd.io (>= 1.7.27) but 1.7.23-1 is to be installed
4.963 E: Unable to correct problems, you have held broken packages.
```
Disclaimer: Claude did all of this, reviewed and committed by me.
I find the "task is working" notification straight after creation to be
unnecessary.
Added logic to skip the notification if the first app status is
"working".
- Ignore errors when reporting a connection from the server, just log
them instead
- Translate connection log IP `localhost` to `127.0.0.1` on both the
server and the agent
Note that the temporary fix for converting invalid IPs to localhost is
not required in main since the database no longer forbids NULL for the
IP column since https://github.com/coder/coder/pull/19788
Relates to #20194
## Description
Update the Prebuilds troubleshooting page to include a new section,
“Preventing prebuild queue contention (recommended)”, outlining a
best-practice configuration to prevent prebuild jobs from overwhelming
the provisioner queue.
This setup introduces a dedicated prebuild provisioner pool and has been
successfully tested internally in dogfood:
https://github.com/coder/dogfood/pull/201
Closes: https://github.com/coder/coder/issues/20241
fixes https://github.com/coder/internal/issues/1045
Fixes a race condition in our PG Coordinator when a peer disconnects. We issue database queries to find the peer mappings (node structures for each peer connected via a tunnel), and then send these to the "mapper" that generates diffs and eventually writes the update to the websocket.
Before this change we erroneously used the querier's context for this update, which has the same lifetime as the coordinator itself. If the peer has disconnected, the mapper might not be reading from its channel, and this causes a deadlock in a querier worker. This also prevents us from doing any more work on the peer.
I also added some more debug logging that would have been helpful when tracking this down.
## Summary
Migrate the `TermsOfServiceLink` component from MUI to shadcn/ui
## Changes
- **Replaced** `@mui/material/Link` with the custom `Link` component
from `components/Link/Link` (shadcn/ui)
- **Migrated** Emotion `css` prop to Tailwind utility classes
- **Preserved** external link icon functionality (automatically provided
by shadcn Link component)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude <noreply@anthropic.com>
This PR adds troubleshooting steps to guide Coder operators when they
suspect that prebuilds might have overwhelmed their deployments.
Closes https://github.com/coder/coder/issues/19490
---------
Co-authored-by: Susana Ferreira <susana@coder.com>
Upgrades coder/clistat to v1.1.0. This version contains a significant
refactor to the cgroupv2 implementation that improves how we calculate
memory and cpu limits.
Bumps alpine from 3.22.1 to 3.22.2.
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [github.com/gofrs/flock](https://github.com/gofrs/flock) from
0.12.1 to 0.13.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/gofrs/flock/releases">github.com/gofrs/flock's
releases</a>.</em></p>
<blockquote>
<h2>v0.13.0</h2>
<h2>What's Changed</h2>
<p>Minimum Go version 1.24</p>
<ul>
<li>feat: add Stat method by <a
href="https://github.com/ferhatelmas"><code>@ferhatelmas</code></a> in
<a
href="https://redirect.github.com/gofrs/flock/pull/127">gofrs/flock#127</a></li>
<li>chore(deps): bump golang.org/x/sys from 0.22.0 to 0.37.0</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/gofrs/flock/compare/v0.12.1...v0.13.0">https://github.com/gofrs/flock/compare/v0.12.1...v0.13.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="bfec60bb02"><code>bfec60b</code></a>
chore(deps): bump golang.org/x/sys from 0.36.0 to 0.37.0 in the gomod
group (...</li>
<li><a
href="7094284415"><code>7094284</code></a>
chore: update linter</li>
<li><a
href="8111aec69c"><code>8111aec</code></a>
feat: add Stat method (<a
href="https://redirect.github.com/gofrs/flock/issues/127">#127</a>)</li>
<li><a
href="6f0f0ed4e1"><code>6f0f0ed</code></a>
chore(deps): bump the github-actions group with 4 updates (<a
href="https://redirect.github.com/gofrs/flock/issues/126">#126</a>)</li>
<li><a
href="fe44231e56"><code>fe44231</code></a>
chore(deps): bump golang.org/x/sys from 0.35.0 to 0.36.0 in the gomod
group (...</li>
<li><a
href="f74f0fb033"><code>f74f0fb</code></a>
chore(deps): bump github.com/stretchr/testify from 1.10.0 to 1.11.1 in
the go...</li>
<li><a
href="c1f6d161c8"><code>c1f6d16</code></a>
chore(deps): bump golang.org/x/sys from 0.34.0 to 0.35.0 in the gomod
group (...</li>
<li><a
href="c542c57ff5"><code>c542c57</code></a>
chore(deps): bump github/codeql-action from 3.29.2 to 3.29.5 in the
github-ac...</li>
<li><a
href="425570ba9b"><code>425570b</code></a>
chore(deps): bump golang.org/x/sys from 0.33.0 to 0.34.0 in the gomod
group (...</li>
<li><a
href="12753ea298"><code>12753ea</code></a>
chore(deps): bump github/codeql-action from 3.28.18 to 3.29.2 in the
github-a...</li>
<li>Additional commits viewable in <a
href="https://github.com/gofrs/flock/compare/v0.12.1...v0.13.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[github.com/brianvoe/gofakeit/v7](https://github.com/brianvoe/gofakeit)
from 7.7.1 to 7.8.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="6af983166a"><code>6af9831</code></a>
emoji - cleanup, organization and new function additions</li>
<li><a
href="1399ba0ab2"><code>1399ba0</code></a>
generate - improve generate performance</li>
<li><a
href="3840eaf8c6"><code>3840eaf</code></a>
internet - added url safe slug</li>
<li><a
href="1332b94147"><code>1332b94</code></a>
airline - added airline functions</li>
<li><a
href="ae44694fb1"><code>ae44694</code></a>
readme - updated to reflect text updates</li>
<li><a
href="e5a4d526a4"><code>e5a4d52</code></a>
lorem ipsum - simplified usage and directly use sentence gen</li>
<li><a
href="3890a67dc9"><code>3890a67</code></a>
sentence - updated usage across repo</li>
<li><a
href="ab13d69433"><code>ab13d69</code></a>
hipster - updated to uppercase first character</li>
<li><a
href="7b7ddf7db3"><code>7b7ddf7</code></a>
hipster - updated to uppercase first character</li>
<li><a
href="5e08f26140"><code>5e08f26</code></a>
template - update test usage</li>
<li>Additional commits viewable in <a
href="https://github.com/brianvoe/gofakeit/compare/v7.7.1...v7.8.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps rust from `1219c0b` to `e4ae8ab`.
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This change ensures task names are unique per user the same way we do
for workspaces. This ensures we don't create tasks that are impossible
to start due to another task being named the same creating a workspace
name conflict.
Updates coder/internal#948
Supersedes coder/coder#20212
This change updates the `task_workspace_apps` table structure for
improved linking to workspace builds and adds queries to manage tasks
and a view to expose task status.
Updates coder/internal#948
Supersedes coder/coder#20212
Supersedes coder/coder#19773
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
fixes https://github.com/coder/internal/issues/1026
Thru a (perhaps too-) clever hack of `init()` functions, I've managed to remove the need to separately compile the cleaner binary. This should fix the flakes we are seeing were the binary compilation takes 10s of seconds on macOS. The cleaner is encorporated directly into the test binary and we self-exec as the subprocess.
In preparation for adding the "member" permission level, which will also
be grouped by org ID, do a bit of a refactor to make room for it and the
existing "org" level to live in the same `map`
I tried to break this work into smaller pieces, but since there are a
lot of dependent components, I decided to handle it in one larger chunk
and rely on Storybook to catch any bugs.
That said, let me know if you’d prefer a different approach!
# Add API key allow_list for resource-scoped tokens
This PR adds support for API key allow lists, enabling tokens to be scoped to specific resources. The implementation:
1. Adds a new `allow_list` field to the `CreateTokenRequest` struct, allowing clients to specify resource-specific scopes when creating API tokens
2. Implements `APIAllowListTarget` type to represent resource targets in the format `<type>:<id>` with support for wildcards
3. Adds validation and normalization logic for allow lists to handle wildcards and deduplication
4. Integrates with RBAC by creating an `APIKeyEffectiveScope` that merges API key scopes with allow list restrictions
5. Updates API documentation and TypeScript types to reflect the new functionality
This feature enables creating tokens that are limited to specific resources (like workspaces or templates) by ID, making it possible to create more granular API tokens with limited access.
Closes https://github.com/coder/internal/issues/978
- Introduce `CODER_TASK_ID` and `CODER_TASK_PROMPT` to the provisioner
environment
- Make use of new `app_id` field in provider, with a fallback to
`sidebar_app.id` for backwards compatibility
**For now** I've left the `taskPrompt` and `taskID` as a TODO as we do
not yet create these values.
When we added support for connection tracking in the Workspace agent, we modified the ReconnectingPTY tests to add an initial connection that we immediately hang up and check that connections are logged.
In the case of `screen`-based pty handling, hanging up the initial connection can race with the initial attachment to the `screen` process, and cause that process to exit early. This leaves subsequent connections to the same session ID to fail.
In this PR we just use different pty session IDs so that the initial connections we do to verify logging don't interfere with the rest of the test.
_Arguably_ it's a bug in our Reconnecting PTY code that hanging up immediately can leave the system in a weird state, but we do eventually recover and error out, so I don't think it's worth trying to fix.
relates to: https://github.com/coder/internal/issues/1026
On POSIX systems (macOS and Linux) we compile the dbcleaner binary into a temp directory. This allows us to explicitly separate the compilation step and report the time it takes. We suspect this might be a contributing factor in the above linked flakes we see on macOS.
This doesn't work on Windows because Go tests clean up the temp directory at the end of the test and the dbcleaner binary will still be executing. On Windows you cannot delete a file being executed nor the directory. However, we are not seeing any flakes on Windows so the old behavior seems to be OK.
fixes https://github.com/coder/internal/issues/1050
Extends the timeout on the affected test. It uses a postgres database, and so 15s timeout isn't enough to not flake with our test infra these days.
The prebuilds user never initiates a workspace claim autonomously. A
claim can only happen when a user attempts to create a workspace. When
listing prebuild provisioner jobs, it would not make sense to see jobs
related to users who are creating workspaces and have gotten a prebuilt
workspace. When cleaning up an overwhelmed provisioner queue, we should
not delete claims as they have humans waiting for them and are not part
of the thundering herd.
Therefore, this PR ensures that provisioner jobs that claim workspaces
are considered to be initiated by the user, not the prebuilds system.
part of https://github.com/coder/internal/issues/912
Adds CLI command `coder exp scaletest dynamic-parameters`
I've left out the configuration of tracing and timeouts for now. I think I want to do some refactoring of the scaletest CLI to make handling those flags take up less boiler plate.
I will add tracing and timeout flags in a follow up PR.
Relates to https://github.com/coder/internal/issues/910
This PR adds a scaletest runner that simulates users receiving notifications through WebSocket connections.
An instance of this notification runner does the following:
1. Creates a user (optionally with specific roles like owner).
2. Connects to /api/v2/notifications/inbox/watch via WebSocket to receive notifications in real-time.
3. Waits for all other concurrently executing runners (per the DialBarrier WaitGroup) to also connect their websockets.
4. For receiving users: Watches the WebSocket for expected notifications and records delivery latency for each notification type.
5. For regular users: Maintains WebSocket connections to simulate concurrent load while receiving users wait for notifications.
6. Waits on the ReceivingWatchBarrier to coordinate between receiving and regular users.
7. Cleans up the created user after the test completes.
Exposes three prometheus metrics:
1. notification_delivery_latency_seconds - HistogramVec. Labels = {username, notification_type}
2. notification_delivery_errors_total - CounterVec. Labels = {username, action}
3. notification_delivery_missed_total - CounterVec. Labels = {username}
The runner measures end-to-end notification latency from when a notification-triggering event occurs (e.g., user creation/deletion) to when the notification is received by a WebSocket client.
## Changes made
- Updated `useClipboard` API to require passing the text in via the
`copyToClipboard` function, rather than requiring that the text gets
specified in render logic
- Ensured that the `copyToClipboard` function always stays stable across
all React lifecycles
- Updated all existing uses to use the new function signatures
- Updated all tests and added new cases
Reverts coder/coder#20181
I realized we don’t need this in the task response. When loading a task,
we already need much more workspace information, so it makes more sense
to fetch the workspace data separately instead of trying to embed all
its details into the response.
I think we can keep the task response clean and focused on the essential
information needed to list tasks. For more specific details, we can
fetch the related resources as needed. So, I’m reverting this PR.
Fixes a Biome lint error when running `make lint`.
```
> biome check --error-on-warnings --fix .
biome.jsonc:6:13 deserialize ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
ℹ The configuration schema version does not match the CLI version 2.2.4
4 │ "includes": ["!e2e/**/*Generated.ts"]
5 │ },
> 6 │ "$schema": "https://biomejs.dev/schemas/2.2.0/schema.json"
│ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
7 │ }
8 │
ℹ Expected: 2.2.4
Found: 2.2.0
ℹ Run the command biome migrate to migrate the configuration file.
Checked 1165 files in 796ms. No fixes applied.
```
Allows users with `updateTemplates` permission to select a specific
template version when creating a task.
One of the biggest changes was moving `TaskPrompt` into `modules/task`
and adding a Storybook entry for it. I also moved some stories from
`TasksPage` to simplify its story.
<img width="1208" height="197" alt="Screenshot 2025-10-02 at 12 09 06"
src="https://github.com/user-attachments/assets/b85d2723-bb52-442b-b8eb-36721944a653"
/>
Closes https://github.com/coder/coder/issues/19986
Bumps [github.com/coreos/go-oidc/v3](https://github.com/coreos/go-oidc)
from 3.15.0 to 3.16.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/coreos/go-oidc/releases">github.com/coreos/go-oidc/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.16.0</h2>
<h2>What's Changed</h2>
<ul>
<li>refactor: Remove unused time injection from RemoteKeySet by <a
href="https://github.com/ponimas"><code>@ponimas</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/466">coreos/go-oidc#466</a></li>
<li>bump go to 1.24, remove 1.23 support, bump go-jose dependency,
remove x/net dependency by <a
href="https://github.com/wardviaene"><code>@wardviaene</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/467">coreos/go-oidc#467</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/wardviaene"><code>@wardviaene</code></a> made
their first contribution in <a
href="https://redirect.github.com/coreos/go-oidc/pull/467">coreos/go-oidc#467</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/coreos/go-oidc/compare/v3.15.0...v3.16.0">https://github.com/coreos/go-oidc/compare/v3.15.0...v3.16.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="e9584733f8"><code>e958473</code></a>
bump go to 1.24, remove 1.23 support, bump go-jose dependency, remove
x/net d...</li>
<li><a
href="69b167061f"><code>69b1670</code></a>
refactor: Remove unused time injection from RemoteKeySet</li>
<li>See full diff in <a
href="https://github.com/coreos/go-oidc/compare/v3.15.0...v3.16.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [github.com/moby/moby](https://github.com/moby/moby) from
28.4.0+incompatible to 28.5.0+incompatible.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/moby/moby/releases">github.com/moby/moby's
releases</a>.</em></p>
<blockquote>
<h2>v28.5.0</h2>
<h1>28.5.0</h1>
<p>For a full list of pull requests and changes in this release, refer
to the relevant GitHub milestones:</p>
<ul>
<li><a
href="https://github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.5.0">docker/cli,
28.5.0 milestone</a></li>
<li><a
href="https://github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.5.0">moby/moby,
28.5.0 milestone</a></li>
<li>Deprecated and removed features, see <a
href="https://github.com/docker/cli/blob/v28.5.0/docs/deprecated.md">Deprecated
Features</a>.</li>
<li>Changes to the Engine API, see <a
href="https://github.com/moby/moby/blob/v28.5.0/docs/api/version-history.md">API
version history</a>.</li>
</ul>
<h3>Bug fixes and enhancements</h3>
<ul>
<li>Don't print warnings in <code>docker info</code> for broken symlinks
in CLI-plugin directories. <a
href="https://redirect.github.com/docker/cli/pull/6476">docker/cli#6476</a></li>
<li>Fix a panic during <code>stats</code> on empty event
<code>Actor.ID</code>. <a
href="https://redirect.github.com/docker/cli/pull/6471">docker/cli#6471</a></li>
</ul>
<h3>Packaging updates</h3>
<ul>
<li>Remove support for legacy CBC cipher suites. <a
href="https://redirect.github.com/docker/cli/pull/6474">docker/cli#6474</a></li>
<li>Update Buildkit to <a
href="https://github.com/moby/buildkit/releases/tag/v0.25.0">v0.25.0</a>.
<a
href="https://redirect.github.com/moby/moby/pull/51075">moby/moby#51075</a></li>
<li>Update Dockerfile syntax to <a
href="https://github.com/moby/buildkit/releases/tag/dockerfile%2F1.19.0">v1.19.0</a>.
<a
href="https://redirect.github.com/moby/moby/pull/51075">moby/moby#51075</a></li>
</ul>
<h3>Networking</h3>
<ul>
<li>Eliminated harmless warning about deletion of
<code>endpoint_count</code> from the data store. <a
href="https://redirect.github.com/moby/moby/pull/51064">moby/moby#51064</a></li>
<li>Fix a bug causing IPAM plugins to not be loaded on Windows. <a
href="https://redirect.github.com/moby/moby/pull/51035">moby/moby#51035</a></li>
</ul>
<h3>API</h3>
<ul>
<li>Deprecate support for kernel memory TCP accounting
(<code>KernelMemoryTCP</code>). <a
href="https://redirect.github.com/moby/moby/pull/51067">moby/moby#51067</a></li>
<li>Fix <code>GET containers/{name}/checkpoints</code> returning
<code>null</code> instead of empty JSON array when there are no
checkpoints. <a
href="https://redirect.github.com/moby/moby/pull/51052">moby/moby#51052</a></li>
</ul>
<h3>Go SDK</h3>
<ul>
<li>cli-plugins/plugin: Run: allow customizing the CLI. <a
href="https://redirect.github.com/docker/cli/pull/6481">docker/cli#6481</a></li>
<li>cli/command: add <code>WithUserAgent</code> option. <a
href="https://redirect.github.com/docker/cli/pull/6477">docker/cli#6477</a></li>
</ul>
<h3>Deprecations</h3>
<ul>
<li>Go-SDK: cli/command: deprecate <code>DockerCli.Apply</code>. This
method is no longer used and will be removed in the next release if
there are no remaining uses. <a
href="https://redirect.github.com/docker/cli/pull/6497">docker/cli#6497</a></li>
<li>Go-SDK: cli/command: deprecate
<code>DockerCli.ContentTrustEnabled</code>. This method is no longer
used and will be removed in the next release. <a
href="https://redirect.github.com/docker/cli/pull/6495">docker/cli#6495</a></li>
<li>Go-SDK: cli/command: deprecate
<code>DockerCli.DefaultVersion</code>. This method is no longer used and
will be removed in the next release. <a
href="https://redirect.github.com/docker/cli/pull/6491">docker/cli#6491</a></li>
<li>Go-SDK: cli/command: deprecate <code>ResolveDefaultContext</code>
utility. <a
href="https://redirect.github.com/docker/cli/pull/6529">docker/cli#6529</a></li>
<li>Go-SDK: cli/command: deprecate <code>WithContentTrustFromEnv</code>,
<code>WithContentTrust</code> options. These options were used
internally, and will be removed in the next release.. <a
href="https://redirect.github.com/docker/cli/pull/6489">docker/cli#6489</a></li>
<li>Go-SDK: cli/manifest/store: deprecate <code>IsNotFound()</code>. <a
href="https://redirect.github.com/docker/cli/pull/6514">docker/cli#6514</a></li>
<li>Go-SDK: templates: deprecate NewParse() function. <a
href="https://redirect.github.com/docker/cli/pull/6469">docker/cli#6469</a></li>
</ul>
<h2>v28.5.0-rc.1</h2>
<h2>28.5.0-rc.1</h2>
<p>For a full list of pull requests and changes in this release, refer
to the relevant GitHub milestones:</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="cd048300a4"><code>cd04830</code></a>
Merge pull request <a
href="https://redirect.github.com/moby/moby/issues/51075">#51075</a>
from vvoland/51074-28.x</li>
<li><a
href="e29d6be7a5"><code>e29d6be</code></a>
vendor: github.com/moby/buildkit v0.25.0</li>
<li><a
href="9b4369035b"><code>9b43690</code></a>
Merge pull request <a
href="https://redirect.github.com/moby/moby/issues/51069">#51069</a>
from thaJeztah/28.x_backport_docs_rm_deprecated_vir...</li>
<li><a
href="4f3572596b"><code>4f35725</code></a>
api: swagger: remove VirtualSize fields for API > v1.43</li>
<li><a
href="79f310d4bc"><code>79f310d</code></a>
Merge pull request <a
href="https://redirect.github.com/moby/moby/issues/51067">#51067</a>
from austinvazquez/cherry-pick-deprecate-kernel-mem...</li>
<li><a
href="deb4bbbfe0"><code>deb4bbb</code></a>
api: deprecate <code>KernelMemoryTCP</code> support</li>
<li><a
href="423a7fd6af"><code>423a7fd</code></a>
Merge pull request <a
href="https://redirect.github.com/moby/moby/issues/51064">#51064</a>
from thaJeztah/28.x_backport_fix_epcnt_warning</li>
<li><a
href="fbf2fe8b7d"><code>fbf2fe8</code></a>
Eliminate warning about endpoint count store delete</li>
<li><a
href="252a1ebe7e"><code>252a1eb</code></a>
Merge pull request <a
href="https://redirect.github.com/moby/moby/issues/51061">#51061</a>
from thaJeztah/28.x_backport_rm_email_example</li>
<li><a
href="2c15eb6617"><code>2c15eb6</code></a>
api/docs: remove email field from example auth</li>
<li>Additional commits viewable in <a
href="https://github.com/moby/moby/compare/v28.4.0...v28.5.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
In https://github.com/coder/coder/pull/20137, we added a new flag to
`coder provisioner jobs list`, namely `--initiator`.
To make some follow-up worth it, I need to rename an API param used in
the process before it becomes part of our released and tagged API.
Instead of only accepting UUIDs, we accept an arbitrary string.
We still validate it as a UUID now, but we will expand its validation to
allow any string and then resolve that string the same way that we
resolve the user parameter elsewhere in the API.
# Add API Key Scope Wildcards
This PR adds wildcard API key scopes (`resource:*`) for all RBAC resources to ensure every resource has a matching wildcard value. It also adds all individual `resource:action` scopes to the API documentation and TypeScript definitions.
The changes include:
- Adding a new database migration (000377) that adds wildcard API key scopes
- Updating the API documentation to include all available scopes
- Enhancing the scope generation scripts to include all resource wildcards
- Updating the TypeScript definitions to match the expanded scope list
These changes make creating API keys with comprehensive permissions for specific resource types easier.
Relates to https://github.com/coder/internal/issues/934
This PR provides a mechanism to filter provisioner jobs according to who
initiated the job.
This will be used to find pending prebuild jobs when prebuilds have
overwhelmed the provisioner job queue. They can then be canceled.
If prebuilds are overwhelming provisioners, the following steps will be
taken:
```bash
# pause prebuild reconciliation to limit provisioner queue pollution:
coder prebuilds pause
# cancel pending provisioner jobs to clear the queue
coder provisioner jobs list --initiator="prebuilds" --status="pending" | jq ... | xargs -n1 -I{} coder provisioner jobs cancel {}
# push a fixed template and wait for the import to complete
coder templates push ... # push a fixed template
# resume prebuild reconciliation
coder prebuilds resume
```
This interface differs somewhat from what was specified in the issue,
but still provides a mechanism that addresses the issue. The original
proposal was made by myself and this simpler implementation makes sense.
I might add a `--search` parameter in a follow-up if there is appetite
for it.
Potential follow ups:
* Support for this usage: `coder provisioner jobs list --search
"initiator:prebuilds status:pending"`
* Adding the same parameters to `coder provisioner jobs cancel` as a
convenience feature so that operators don't have to pipe through `jq`
and `xargs`
## Summary
In this pull request we're adding support in the CLI for prompting the
user for any missing required template variables in the `coder templates
push` command and automatically retrying the template build once a user
has provided any missing variable values.
Closes: https://github.com/coder/coder/issues/19782
### Demo
In the following recording I created a simple template terraform file
that used different variable types (string, number, boolean, and
sensitive) and prompted the user to enter a value for each variable.
<details>
<summary>See example template terraform file</summary>
```tf
...
# Required variables for testing interactive prompting
variable "docker_image" {
description = "Docker image to use for the workspace"
type = string
}
variable "workspace_name" {
description = "Name of the workspace"
type = string
}
variable "cpu_limit" {
description = "CPU limit for the container (number of cores)"
type = number
}
variable "enable_gpu" {
description = "Enable GPU access for the container"
type = bool
}
variable "api_key" {
description = "API key for external services (sensitive)"
type = string
sensitive = true
}
# Optional variable with default
variable "docker_socket" {
default = "/var/run/docker.sock"
description = "Docker socket path"
type = string
}
...
```
</details>
Once the user entered a valid value for each variable, the template
build would be retried.
https://github.com/user-attachments/assets/770cf954-3cbc-4464-925e-2be4e32a97de
<details>
<summary>See output from recording</summary>
```shell
$ ./scripts/coder-dev.sh templates push test-required-params -d examples/templates/test-required-params/
INFO : Overriding codersdk.SessionTokenCookie as we are developing inside a Coder workspace.
/home/coder/coder/build/coder-slim_2.26.0-devel+a68122ca3_linux_amd64
Provisioner tags: <none>
WARN: No .terraform.lock.hcl file found
| When provisioning, Coder will be unable to cache providers without a lockfile and must download them from the internet each time.
| Create one by running terraform init in your template directory.
> Upload "examples/templates/test-required-params"? (yes/no) yes
=== ✔ Queued [0ms]
==> ⧗ Running
==> ⧗ Running
=== ✔ Running [4ms]
==> ⧗ Setting up
=== ✔ Setting up [0ms]
==> ⧗ Parsing template parameters
=== ✔ Parsing template parameters [8ms]
==> ⧗ Cleaning Up
=== ✘ Cleaning Up [4ms]
=== ✘ Cleaning Up [8ms]
Found 5 missing required variables:
- docker_image (string): Docker image to use for the workspace
- workspace_name (string): Name of the workspace
- cpu_limit (number): CPU limit for the container (number of cores)
- enable_gpu (bool): Enable GPU access for the container
- api_key (string): API key for external services (sensitive)
The template requires values for the following variables:
var.docker_image (required)
Description: Docker image to use for the workspace
Type: string
Current value: <empty>
> Enter value: image-name
var.workspace_name (required)
Description: Name of the workspace
Type: string
Current value: <empty>
> Enter value: workspace-name
var.cpu_limit (required)
Description: CPU limit for the container (number of cores)
Type: number
Current value: <empty>
> Enter value: 1
var.enable_gpu (required)
Description: Enable GPU access for the container
Type: bool
Current value: <empty>
? Select value: false
var.api_key (required), sensitive
Description: API key for external services (sensitive)
Type: string
Current value: <empty>
> Enter value: (*redacted*) ******
Retrying template build with provided variables...
=== ✔ Queued [0ms]
==> ⧗ Running
==> ⧗ Running
=== ✔ Running [2ms]
==> ⧗ Setting up
=== ✔ Setting up [0ms]
==> ⧗ Parsing template parameters
=== ✔ Parsing template parameters [7ms]
==> ⧗ Detecting persistent resources
2025-09-25 22:34:14.731Z Terraform 1.13.0
2025-09-25 22:34:15.140Z data.coder_provisioner.me: Refreshing...
2025-09-25 22:34:15.140Z data.coder_workspace.me: Refreshing...
2025-09-25 22:34:15.140Z data.coder_workspace_owner.me: Refreshing...
2025-09-25 22:34:15.141Z data.coder_provisioner.me: Refresh complete after 0s [id=2bd73098-d127-4362-b3a5-628e5bce6998]
2025-09-25 22:34:15.141Z data.coder_workspace_owner.me: Refresh complete after 0s [id=c2006933-4f3e-4c45-9e04-79612c3a5eca]
2025-09-25 22:34:15.141Z data.coder_workspace.me: Refresh complete after 0s [id=36f2dc6f-0bf2-43bd-bc4d-b29768334e02]
2025-09-25 22:34:15.186Z coder_agent.main: Plan to create
2025-09-25 22:34:15.186Z module.code-server[0].coder_app.code-server: Plan to create
2025-09-25 22:34:15.186Z docker_volume.home_volume: Plan to create
2025-09-25 22:34:15.186Z module.code-server[0].coder_script.code-server: Plan to create
2025-09-25 22:34:15.187Z docker_container.workspace[0]: Plan to create
2025-09-25 22:34:15.187Z Plan: 5 to add, 0 to change, 0 to destroy.
=== ✔ Detecting persistent resources [3104ms]
==> ⧗ Detecting ephemeral resources
2025-09-25 22:34:16.033Z Terraform 1.13.0
2025-09-25 22:34:16.428Z data.coder_workspace.me: Refreshing...
2025-09-25 22:34:16.428Z data.coder_provisioner.me: Refreshing...
2025-09-25 22:34:16.429Z data.coder_workspace_owner.me: Refreshing...
2025-09-25 22:34:16.429Z data.coder_provisioner.me: Refresh complete after 0s [id=2d2f7083-88e6-425c-9df3-856a3bf4cc73]
2025-09-25 22:34:16.429Z data.coder_workspace.me: Refresh complete after 0s [id=c723575e-c7d3-43d7-bf54-0e34d0959dc3]
2025-09-25 22:34:16.431Z data.coder_workspace_owner.me: Refresh complete after 0s [id=d43470c2-236e-4ae9-a977-6b53688c2cb1]
2025-09-25 22:34:16.453Z coder_agent.main: Plan to create
2025-09-25 22:34:16.453Z docker_volume.home_volume: Plan to create
2025-09-25 22:34:16.454Z Plan: 2 to add, 0 to change, 0 to destroy.
=== ✔ Detecting ephemeral resources [1278ms]
==> ⧗ Cleaning Up
=== ✔ Cleaning Up [6ms]
┌──────────────────────────────────┐
│ Template Preview │
├──────────────────────────────────┤
│ RESOURCE │
├──────────────────────────────────┤
│ docker_container.workspace │
│ └─ main (linux, amd64) │
├──────────────────────────────────┤
│ docker_volume.home_volume │
└──────────────────────────────────┘
The test-required-params template has been created at Sep 25
22:34:16! Developers can provision a workspace with this template using:
Updated version at Sep 25 22:34:16!
```
</details>
### Changes
- Added a new function to check if the provisioner failed due to a
template missing required variables
- Added a handler function that is called when a provisioner fails due
to the "missing required variables" error. The handler function will:
- Check for provided template variables and identify any missing
variables
- Prompt the user for any missing variables (prompt is adapted based on
the variable type)
- Validate user input for missing variables
- Retry the template build when all variables have been provided by the
user
### Testing
Added tests for the following scenarios:
- Ensure validation based on variable type
- Ensure users are not prompted for variables with a default value
- Ensure variables provided via a variables files (`--variables-file`)
or a variable flag (`--variable`) take precedence over a template
Incorrect error variable is used during reporting of the issue during
unmarshall operations and this makes it hard to understand the
underlying reason for OIDC failure: use `unmarshalError` instead of
`err`.
This PR makes the initial steps at removing usage of the global Go HTTP
client, which was seen to have impacts on test flakiness in
https://github.com/coder/internal/issues/1020. The first commit removes
uses from tests, with the exception of one test that is tightly coupled
to the default client. The second commit makes easy/low-risk removals
from application code. This should have some impact to reduce test flakiness.
## Summary
In this pull request we're adding a heartbeat to the
`handleParameterWebsocket` function to ensure that the connection stays
open until the 30 min timeout has been reached.
Closes: https://github.com/coder/coder/issues/19805
### Testing
- Reproduced the problem mentioned in the issue (websocket connection
closes after ~10 minutes of inactivity on the create workspace page)
<img width="1870" height="357" alt="Screenshot 2025-09-26 at 15 58 51"
src="https://github.com/user-attachments/assets/a9e2e89e-87c5-4afa-9644-afe246a15f79"
/>
- Confirmed that adding the heartbeat kept the connection open until the
30 min timeout was reached
<img width="1636" height="387" alt="Screenshot 2025-09-29 at 15 51 43"
src="https://github.com/user-attachments/assets/0a8c5cda-29a6-493d-a6c0-4a2629da8838"
/>
Audit Log entries can be deleted safely (with appropriate caveats), but
we don't specifically call this out in the docs.
---------
Signed-off-by: Danny Kopping <danny@coder.com>
Relates to https://github.com/coder/dogfood/pull/189
Closes https://github.com/coder/internal/issues/1021
- Adds new script `scripts/should_deploy.sh` which implements the
algorithm in the linked issue
- Changes the `ci.yaml` workflow to run on release branches
- Moves the deployment steps out of `ci.yaml` into a new workflow
`deploy.yaml` for concurrency limiting purposes
- Changes the behavior of image tag pushing slightly:
- Versioned tags will no longer have a `main-` prefix
- `main` branch will still push the `main` and `latest` tags
- `release/x.y` branches will now push `release-x.y` tags
- The deploy job will exit early if `should_deploy.sh` returns false
- The deploy job will now retag whatever image it's about to deploy as
`dogfood`
Earlier today, a dependabot PR was merged despite CI not having been run. https://github.com/coder/coder/pull/20068
This was because the `changes` job failed due to a github ratelimit, which caused all the tests to be skipped, which caused `required` to pass as it passes if tests are skipped.
<img width="725" height="872" alt="image" src="https://github.com/user-attachments/assets/3a13d19b-819a-48df-ad8c-e9ff903a0496" />
This PR makes `changes` required so this can't happen again (assuming we keep around the dependabot automerge around, it might).
Relates to https://github.com/coder/internal/issues/911
This PR adds a scaletest runner that simulates a user with a workspace configured to autostart at a specific time.
An instance of this autostart runner does the following:
1. Creates a user.
2. Creates a workspace.
3. Listens on `/api/v2/workspaces/<ws-id>/watch` to wait for build completions throughout the run.
4. Stops the workspace, waits for the build to finish.
4. Waits for all other concurrently executing runners (per the `SetupBarrier` `WaitGroup`) to also have a stopped workspace.
5. Sets the workspace autostart time to `time.Now().Add(cfg.AutoStartDelay)`
6. Waits for the autostart workspace build to begin, enter the `pending` status, and then `running`.
7. Waits for the autostart workspace build to end.
Exposes four prometheus metrics:
- `autostart_job_creation_latency_seconds` - HistogramVec. Labels = {username, workspace_name}
- `autostart_job_acquired_latency_seconds` - HistogramVec. Labels = {username, workspace_name}
- `autostart_total_latency_seconds` - `HistogramVec`. Labels = `{username, workspace_name}`.
- `autostart_errors_total` - `CounterVec`. Labels = `{username, action}`.
Bumps
[react-virtualized-auto-sizer](https://github.com/bvaughn/react-virtualized-auto-sizer)
and
[@types/react-virtualized-auto-sizer](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-virtualized-auto-sizer).
These dependencies needed to be updated together.
Updates `react-virtualized-auto-sizer` from 1.0.24 to 1.0.26
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/bvaughn/react-virtualized-auto-sizer/releases">react-virtualized-auto-sizer's
releases</a>.</em></p>
<blockquote>
<h2>1.0.26</h2>
<ul>
<li>Changed <code>width</code> and <code>height</code> values to be
based om <code>getBoundingClientRect</code> rather than
<code>offsetWidth</code> and <code>offsetHeight</code> (<a
href="https://developer.mozilla.org/en-US/docs/Web/API/HTMLElement/offsetWidth#value">which
are integers</a> and can cause rounding/flickering problems in some
cases).</li>
</ul>
<h2>1.0.25</h2>
<ul>
<li>Dependencies updated to include React 19</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/bvaughn/react-virtualized-auto-sizer/blob/master/CHANGELOG.md">react-virtualized-auto-sizer's
changelog</a>.</em></p>
<blockquote>
<h2>1.0.26</h2>
<ul>
<li>Changed <code>width</code> and <code>height</code> values to be
based om <code>getBoundingClientRect</code> rather than
<code>offsetWidth</code> and <code>offsetHeight</code> (<a
href="https://developer.mozilla.org/en-US/docs/Web/API/HTMLElement/offsetWidth#value">which
are integers</a> and can cause rounding/flickering problems in some
cases).</li>
</ul>
<h2>1.0.25</h2>
<ul>
<li>Dependencies updated to include React 19</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="45b1270b63"><code>45b1270</code></a>
Add deprecation warning for scaledWidth/scaledHeight accessors</li>
<li><a
href="e9c8ef003f"><code>e9c8ef0</code></a>
Merge pull request <a
href="https://redirect.github.com/bvaughn/react-virtualized-auto-sizer/issues/97">#97</a>
from bvaughn/issues/96</li>
<li><a
href="fdf25d4075"><code>fdf25d4</code></a>
Change width and height to come from getBoundingClientRect rather than
offset...</li>
<li><a
href="1898b073c1"><code>1898b07</code></a>
Tweaked README format</li>
<li><a
href="2dc8808e26"><code>2dc8808</code></a>
1.0.24 -> 1.0.25</li>
<li><a
href="801cc5239d"><code>801cc52</code></a>
Merge pull request <a
href="https://redirect.github.com/bvaughn/react-virtualized-auto-sizer/issues/93">#93</a>
from olafbuitelaar/patch-1</li>
<li><a
href="0b8b1811ff"><code>0b8b181</code></a>
updated deps to react 19</li>
<li><a
href="9f970c99fd"><code>9f970c9</code></a>
Update README</li>
<li>See full diff in <a
href="https://github.com/bvaughn/react-virtualized-auto-sizer/compare/1.0.24...1.0.26">compare
view</a></li>
</ul>
</details>
<br />
Updates `@types/react-virtualized-auto-sizer` from 1.0.4 to 1.0.8
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-virtualized-auto-sizer">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [react-confetti](https://github.com/alampros/react-confetti) from
6.2.2 to 6.4.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/alampros/react-confetti/releases">react-confetti's
releases</a>.</em></p>
<blockquote>
<h2>v6.4.0</h2>
<h1><a
href="https://github.com/alampros/react-confetti/compare/v6.3.0...v6.4.0">6.4.0</a>
(2025-03-04)</h1>
<h3>Bug Fixes</h3>
<ul>
<li>clamp tweenProgress between 0 and tweenDuration (<a
href="f988305151">f988305</a>)</li>
</ul>
<h3>Features</h3>
<ul>
<li>adding tweenFrom property to allow smooth transition when parameters
change (<a
href="dde31e0e28">dde31e0</a>)</li>
</ul>
<h2>v6.3.0</h2>
<h1><a
href="https://github.com/alampros/react-confetti/compare/v6.2.3...v6.3.0">6.3.0</a>
(2025-03-01)</h1>
<h3>Bug Fixes</h3>
<ul>
<li>prevent particle flicker on removal (<a
href="5cb5bd8703">5cb5bd8</a>)</li>
</ul>
<h3>Features</h3>
<ul>
<li>using elapsed time in physics updates (<a
href="d1626dcd16">d1626dc</a>)</li>
</ul>
<h2>v6.2.3</h2>
<h2><a
href="https://github.com/alampros/react-confetti/compare/v6.2.2...v6.2.3">6.2.3</a>
(2025-02-22)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>export IConfettiOptions (<a
href="73dffe8f87">73dffe8</a>),
closes <a
href="https://redirect.github.com/alampros/react-confetti/issues/165">#165</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/alampros/react-confetti/blob/develop/CHANGELOG.md">react-confetti's
changelog</a>.</em></p>
<blockquote>
<h1><a
href="https://github.com/alampros/react-confetti/compare/v6.3.0...v6.4.0">6.4.0</a>
(2025-03-04)</h1>
<h3>Bug Fixes</h3>
<ul>
<li>clamp tweenProgress between 0 and tweenDuration (<a
href="f988305151">f988305</a>)</li>
</ul>
<h3>Features</h3>
<ul>
<li>adding tweenFrom property to allow smooth transition when parameters
change (<a
href="dde31e0e28">dde31e0</a>)</li>
</ul>
<h1><a
href="https://github.com/alampros/react-confetti/compare/v6.2.3...v6.3.0">6.3.0</a>
(2025-03-01)</h1>
<h3>Bug Fixes</h3>
<ul>
<li>prevent particle flicker on removal (<a
href="5cb5bd8703">5cb5bd8</a>)</li>
</ul>
<h3>Features</h3>
<ul>
<li>using elapsed time in physics updates (<a
href="d1626dcd16">d1626dc</a>)</li>
</ul>
<h2><a
href="https://github.com/alampros/react-confetti/compare/v6.2.2...v6.2.3">6.2.3</a>
(2025-02-22)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>export IConfettiOptions (<a
href="73dffe8f87">73dffe8</a>),
closes <a
href="https://redirect.github.com/alampros/react-confetti/issues/165">#165</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="0d535377bc"><code>0d53537</code></a>
chore(release): 6.4.0 [skip ci]</li>
<li><a
href="641b351900"><code>641b351</code></a>
Merge branch 'develop'</li>
<li><a
href="6ac61ed2d3"><code>6ac61ed</code></a>
lint fix</li>
<li><a
href="90f5a59488"><code>90f5a59</code></a>
Merge pull request <a
href="https://redirect.github.com/alampros/react-confetti/issues/172">#172</a>
from AlexJDG/bugfix/fix-tweening</li>
<li><a
href="f988305151"><code>f988305</code></a>
fix: clamp tweenProgress between 0 and tweenDuration</li>
<li><a
href="dde31e0e28"><code>dde31e0</code></a>
feat: adding tweenFrom property to allow smooth transition when
parameters ch...</li>
<li><a
href="5dd9f7b4ea"><code>5dd9f7b</code></a>
chore: renaming property for clarity</li>
<li><a
href="31eb46d24b"><code>31eb46d</code></a>
chore(release): 6.3.0 [skip ci]</li>
<li><a
href="e44738908b"><code>e447389</code></a>
Merge branch 'develop'</li>
<li><a
href="b1779918cf"><code>b177991</code></a>
fix lint action name</li>
<li>Additional commits viewable in <a
href="https://github.com/alampros/react-confetti/compare/v6.2.2...v6.4.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.1 to 8.5.6.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/releases">postcss's
releases</a>.</em></p>
<blockquote>
<h2>8.5.6</h2>
<ul>
<li>Fixed <code>ContainerWithChildren</code> type discriminating (by <a
href="https://github.com/Goodwine"><code>@Goodwine</code></a>).</li>
</ul>
<h2>8.5.5</h2>
<ul>
<li>Fixed <code>package.json</code>→<code>exports</code> compatibility
with some tools (by <a
href="https://github.com/JounQin"><code>@JounQin</code></a>).</li>
</ul>
<h2>8.5.4</h2>
<ul>
<li>Fixed Parcel compatibility issue (by <a
href="https://github.com/git-sumitchaudhary"><code>@git-sumitchaudhary</code></a>).</li>
</ul>
<h2>8.5.3</h2>
<ul>
<li>Added more details to <code>Unknown word</code> error (by <a
href="https://github.com/hiepxanh"><code>@hiepxanh</code></a>).</li>
<li>Fixed types (by <a
href="https://github.com/romainmenke"><code>@romainmenke</code></a>).</li>
<li>Fixed docs (by <a
href="https://github.com/catnipan"><code>@catnipan</code></a>).</li>
</ul>
<h2>8.5.2</h2>
<ul>
<li>Fixed end position of rules with semicolon (by <a
href="https://github.com/romainmenke"><code>@romainmenke</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/blob/main/CHANGELOG.md">postcss's
changelog</a>.</em></p>
<blockquote>
<h2>8.5.6</h2>
<ul>
<li>Fixed <code>ContainerWithChildren</code> type discriminating (by <a
href="https://github.com/Goodwine"><code>@Goodwine</code></a>).</li>
</ul>
<h2>8.5.5</h2>
<ul>
<li>Fixed <code>package.json</code>→<code>exports</code> compatibility
with some tools (by <a
href="https://github.com/JounQin"><code>@JounQin</code></a>).</li>
</ul>
<h2>8.5.4</h2>
<ul>
<li>Fixed Parcel compatibility issue (by <a
href="https://github.com/git-sumitchaudhary"><code>@git-sumitchaudhary</code></a>).</li>
</ul>
<h2>8.5.3</h2>
<ul>
<li>Added more details to <code>Unknown word</code> error (by <a
href="https://github.com/hiepxanh"><code>@hiepxanh</code></a>).</li>
<li>Fixed types (by <a
href="https://github.com/romainmenke"><code>@romainmenke</code></a>).</li>
<li>Fixed docs (by <a
href="https://github.com/catnipan"><code>@catnipan</code></a>).</li>
</ul>
<h2>8.5.2</h2>
<ul>
<li>Fixed end position of rules with semicolon (by <a
href="https://github.com/romainmenke"><code>@romainmenke</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="91d6eb5c3d"><code>91d6eb5</code></a>
Release 8.5.6 version</li>
<li><a
href="65ffc55117"><code>65ffc55</code></a>
Update dependencies</li>
<li><a
href="ecd20eb7f9"><code>ecd20eb</code></a>
Fix ContainerWithChildren to allow discriminating the node type by
comparing ...</li>
<li><a
href="c18159719e"><code>c181597</code></a>
Release 8.5.5 version</li>
<li><a
href="c5523fbec5"><code>c5523fb</code></a>
Update dependencies</li>
<li><a
href="2e3450c55f"><code>2e3450c</code></a>
refactor: <code>import</code> should be listed before
<code>require</code> (<a
href="https://redirect.github.com/postcss/postcss/issues/2052">#2052</a>)</li>
<li><a
href="4d720bd01a"><code>4d720bd</code></a>
Update EM text</li>
<li><a
href="6cb4a6673f"><code>6cb4a66</code></a>
Release 8.5.4 version</li>
<li><a
href="ec5c1e0310"><code>ec5c1e0</code></a>
Update dependencies</li>
<li><a
href="e85e9385c8"><code>e85e938</code></a>
Fix code format</li>
<li>Additional commits viewable in <a
href="https://github.com/postcss/postcss/compare/8.5.1...8.5.6">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[@fontsource/ibm-plex-mono](https://github.com/fontsource/font-files/tree/HEAD/fonts/google/ibm-plex-mono)
from 5.1.1 to 5.2.7.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/fontsource/font-files/commits/HEAD/fonts/google/ibm-plex-mono">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [autoprefixer](https://github.com/postcss/autoprefixer) from
10.4.20 to 10.4.21.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/autoprefixer/releases">autoprefixer's
releases</a>.</em></p>
<blockquote>
<h2>10.4.21</h2>
<ul>
<li>Fixed old <code>-moz-</code> prefix for
<code>:placeholder-shown</code> (by <a
href="https://github.com/Marukome0743"><code>@Marukome0743</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/autoprefixer/blob/main/CHANGELOG.md">autoprefixer's
changelog</a>.</em></p>
<blockquote>
<h2>10.4.21</h2>
<ul>
<li>Fixed old <code>-moz-</code> prefix for
<code>:placeholder-shown</code> (by <a
href="https://github.com/Marukome0743"><code>@Marukome0743</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="541295c0e6"><code>541295c</code></a>
Release 10.4.21 version</li>
<li><a
href="8d555f7e5e"><code>8d555f7</code></a>
Update dependencies and sort imports</li>
<li><a
href="5c2421e82a"><code>5c2421e</code></a>
Update Node.js and pnpm on CI</li>
<li><a
href="af9cb5f365"><code>af9cb5f</code></a>
fix: replace <code>:-moz-placeholder-shown</code> with
<code>:-moz-placeholder</code> (<a
href="https://redirect.github.com/postcss/autoprefixer/issues/1532">#1532</a>)</li>
<li>See full diff in <a
href="https://github.com/postcss/autoprefixer/compare/10.4.20...10.4.21">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[@types/lodash](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/lodash)
from 4.17.15 to 4.17.20.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/lodash">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
[//]: # (dependabot-start)
⚠️ **Dependabot is rebasing this PR** ⚠️
Rebasing might not happen immediately, so don't worry if this takes some
time.
Note: if you make any changes to this PR yourself, they will take
precedence over the rebase.
---
[//]: # (dependabot-end)
Bumps
[tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss)
from 3.4.17 to 3.4.18.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/tailwindlabs/tailwindcss/releases">tailwindcss's
releases</a>.</em></p>
<blockquote>
<h2>v3.4.18</h2>
<h3>Fixed</h3>
<ul>
<li>Improve support for raw <code>supports-[…]</code> queries in
arbitrary values (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/13605">#13605</a>)</li>
<li>Fix <code>require.cache</code> error when loaded through a
TypeScript file in Node 22.18+ (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/18665">#18665</a>)</li>
<li>Support <code>import.meta.resolve(…)</code> in configs for new
enough Node.js versions (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/18938">#18938</a>)</li>
<li>Allow using newer versions of <code>postcss-load-config</code> for
better ESM and TypeScript PostCSS config support with the CLI (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/18938">#18938</a>)</li>
<li>Remove irrelevant utility rules when matching important classes (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19030">#19030</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md">tailwindcss's
changelog</a>.</em></p>
<blockquote>
<h2>[3.4.18] - 2024-10-01</h2>
<h3>Fixed</h3>
<ul>
<li>Improve support for raw <code>supports-[…]</code> queries in
arbitrary values (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/13605">#13605</a>)</li>
<li>Fix <code>require.cache</code> error when loaded through a
TypeScript file in Node 22.18+ (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/18665">#18665</a>)</li>
<li>Support <code>import.meta.resolve(…)</code> in configs for new
enough Node.js versions (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/18938">#18938</a>)</li>
<li>Allow using newer versions of <code>postcss-load-config</code> for
better ESM and TypeScript PostCSS config support with the CLI (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/18938">#18938</a>)</li>
<li>Remove irrelevant utility rules when matching important classes (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19030">#19030</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/tailwindlabs/tailwindcss/commits/v3.4.18/packages/tailwindcss">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [ua-parser-js](https://github.com/faisalman/ua-parser-js) from
1.0.40 to 1.0.41.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/faisalman/ua-parser-js/releases">ua-parser-js's
releases</a>.</em></p>
<blockquote>
<h2>v1.0.41</h2>
<h2>Version 0.7.41 / 1.0.41</h2>
<ul>
<li>Add new browser: Daum, Ladybird</li>
<li>Add new device vendor: HMD</li>
<li>Add new engine: LibWeb</li>
<li>Add new os: Windows IoT, Ubuntu Touch</li>
<li>Improve cpu detection: ARM, x86</li>
<li>Improve device vendor detection: Apple, Archos, Generic, Google,
Honor, Huawei, Infinix, Nvidia, Lenovo, Nokia, OnePlus, Xiaomi</li>
<li>Improve device type detection: smarttv, wearables</li>
<li>Improve os detection: Linux, Symbian</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/faisalman/ua-parser-js/compare/1.0.40...1.0.41">https://github.com/faisalman/ua-parser-js/compare/1.0.40...1.0.41</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/faisalman/ua-parser-js/blob/master/CHANGELOG.md">ua-parser-js's
changelog</a>.</em></p>
<blockquote>
<h2>Version 0.7.41 / 1.0.41</h2>
<ul>
<li>Add new browser: Daum, Ladybird</li>
<li>Add new device vendor: HMD</li>
<li>Add new engine: LibWeb</li>
<li>Add new os: Windows IoT, Ubuntu Touch</li>
<li>Improve cpu detection: ARM, x86</li>
<li>Improve device vendor detection: Apple, Archos, Generic, Google,
Honor, Huawei, Infinix, Nvidia, Lenovo, Nokia, OnePlus, Xiaomi</li>
<li>Improve device type detection: smarttv, wearables</li>
<li>Improve os detection: Linux, Symbian</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="90017c98d3"><code>90017c9</code></a>
Bump version <code>1.0.41</code> (mirror of <code>0.7.41</code>)</li>
<li><a
href="af825ff557"><code>af825ff</code></a>
Bump version <code>0.7.41</code></li>
<li><a
href="5925954451"><code>5925954</code></a>
Backport - Improve detection for Nokia device & Symbian OS</li>
<li><a
href="fc668ef0c0"><code>fc668ef</code></a>
Backport - Improve device detection for Generic device: capture its
device mo...</li>
<li><a
href="0543fb2e95"><code>0543fb2</code></a>
Backport - Improve CPU detection: ARM</li>
<li><a
href="98f1c00fd3"><code>98f1c00</code></a>
Backport - Improve device detection for unidentified SmartTV
vendors</li>
<li><a
href="d66c971090"><code>d66c971</code></a>
Backport - Improve detection for Nvidia devices</li>
<li><a
href="cbe60388ea"><code>cbe6038</code></a>
Backport - Add Daum app user agent (<a
href="https://redirect.github.com/faisalman/ua-parser-js/issues/773">#773</a>)</li>
<li><a
href="e665bd56be"><code>e665bd5</code></a>
Backport - Add new OS: <code>Ubuntu Touch</code></li>
<li><a
href="20c3040720"><code>20c3040</code></a>
Backport - Add new device: Apple HomePod</li>
<li>Additional commits viewable in <a
href="https://github.com/faisalman/ua-parser-js/compare/1.0.40...1.0.41">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [jest-fixed-jsdom](https://github.com/mswjs/jest-fixed-jsdom) from
0.0.9 to 0.0.10.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/mswjs/jest-fixed-jsdom/releases">jest-fixed-jsdom's
releases</a>.</em></p>
<blockquote>
<h2>v0.0.10 (2025-08-30)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>using node's global AbortController and AbortSignal (<a
href="https://redirect.github.com/mswjs/jest-fixed-jsdom/issues/35">#35</a>)
(1e63cde866d5575f42ec5fc4520ebb9c487101e2) <a
href="https://github.com/stevematney"><code>@stevematney</code></a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="d31545fc0c"><code>d31545f</code></a>
chore(release): v0.0.10</li>
<li><a
href="1e63cde866"><code>1e63cde</code></a>
fix: using node's global AbortController and AbortSignal (<a
href="https://redirect.github.com/mswjs/jest-fixed-jsdom/issues/35">#35</a>)</li>
<li>See full diff in <a
href="https://github.com/mswjs/jest-fixed-jsdom/compare/v0.0.9...v0.0.10">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[github.com/anthropics/anthropic-sdk-go](https://github.com/anthropics/anthropic-sdk-go)
from 1.12.0 to 1.13.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-go/releases">github.com/anthropics/anthropic-sdk-go's
releases</a>.</em></p>
<blockquote>
<h2>v1.13.0</h2>
<h2>1.13.0 (2025-09-29)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-go/compare/v1.12.0...v1.13.0">v1.12.0...v1.13.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> adds support for Claude Sonnet 4.5 and context
management features (<a
href="3d5d51ad6e">3d5d51a</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>bugfix for setting JSON keys with special characters (<a
href="c868b92119">c868b92</a>)</li>
<li><strong>internal:</strong> unmarshal correctly when there are
multiple discriminators (<a
href="ecc3ce31a9">ecc3ce3</a>)</li>
<li>use slices.Concat instead of sometimes modifying r.Options (<a
href="88e7186cad">88e7186</a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li>bump minimum go version to 1.22 (<a
href="87af8f397a">87af8f3</a>)</li>
<li>do not install brew dependencies in ./scripts/bootstrap by default
(<a
href="c689348cc4">c689348</a>)</li>
<li><strong>internal:</strong> fix tests (<a
href="bfc6eafeff">bfc6eaf</a>)</li>
<li>update more docs for 1.22 (<a
href="d67c50d490">d67c50d</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-go/blob/main/CHANGELOG.md">github.com/anthropics/anthropic-sdk-go's
changelog</a>.</em></p>
<blockquote>
<h2>1.13.0 (2025-09-29)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-go/compare/v1.12.0...v1.13.0">v1.12.0...v1.13.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> adds support for Claude Sonnet 4.5 and context
management features (<a
href="3d5d51ad6e">3d5d51a</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>bugfix for setting JSON keys with special characters (<a
href="c868b92119">c868b92</a>)</li>
<li><strong>internal:</strong> unmarshal correctly when there are
multiple discriminators (<a
href="ecc3ce31a9">ecc3ce3</a>)</li>
<li>use slices.Concat instead of sometimes modifying r.Options (<a
href="88e7186cad">88e7186</a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li>bump minimum go version to 1.22 (<a
href="87af8f397a">87af8f3</a>)</li>
<li>do not install brew dependencies in ./scripts/bootstrap by default
(<a
href="c689348cc4">c689348</a>)</li>
<li><strong>internal:</strong> fix tests (<a
href="bfc6eafeff">bfc6eaf</a>)</li>
<li>update more docs for 1.22 (<a
href="d67c50d490">d67c50d</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="e8befdc7fd"><code>e8befdc</code></a>
release: 1.13.0</li>
<li><a
href="1de6d4717b"><code>1de6d47</code></a>
feat(api): adds support for Claude Sonnet 4.5 and context management
features</li>
<li><a
href="a9aab31ae6"><code>a9aab31</code></a>
fix: bugfix for setting JSON keys with special characters</li>
<li><a
href="41a745429c"><code>41a7454</code></a>
codegen metadata</li>
<li><a
href="31633bdc1a"><code>31633bd</code></a>
chore: do not install brew dependencies in ./scripts/bootstrap by
default</li>
<li><a
href="2deaed6d70"><code>2deaed6</code></a>
fix: use slices.Concat instead of sometimes modifying r.Options</li>
<li><a
href="9f35b68669"><code>9f35b68</code></a>
chore: update more docs for 1.22</li>
<li><a
href="287a399aa1"><code>287a399</code></a>
chore: bump minimum go version to 1.22</li>
<li><a
href="aa4540a9c3"><code>aa4540a</code></a>
chore(internal): fix tests</li>
<li><a
href="73e5532c81"><code>73e5532</code></a>
codegen metadata</li>
<li>Additional commits viewable in <a
href="https://github.com/anthropics/anthropic-sdk-go/compare/v1.12.0...v1.13.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps alpine from 3.21.3 to 3.22.1.
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps rust from `3f391b0` to `1219c0b`.
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps ubuntu from `0e5e4a5` to `4e0171b`.
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
When not triggering via `workflow_dispatch`, it looks like the default
values are simply empty.
This PR creates an intermediate step to conditionally set defaults based
on `github.event_name`.
I'm also adding a commented-out step for installing `gh` that's required
for local testing via `nektos/act`. It's not required in a 'real'
runner.
Bumps the react group with 2 updates in the /site directory:
[@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react)
and
[@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom).
Updates `@types/react` from 19.1.13 to 19.1.17
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react">compare
view</a></li>
</ul>
</details>
<br />
Updates `@types/react-dom` from 19.1.9 to 19.1.11
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
The upgrade caused the following error:
```
node: ../deps/uv/src/unix/stream.c:456: uv__stream_destroy: Assertion `!uv__io_active(&stream->io_watcher, POLLIN | POLLOUT)' failed.
```
After downgrading `msw`, a new error appeared only in
`WorkspacesPage.test.tsx`:
```
<--- Last few GCs --->
[2799:0x292c2000] 16790 ms: Scavenge 336.1 (443.3) -> 322.8 (443.3) MB, pooled: 32 MB, 6.45 / 0.00 ms (average mu = 0.997, current mu = 0.996) allocation failure;
[2799:0x292c2000] 16883 ms: Scavenge 336.7 (443.3) -> 326.8 (443.3) MB, pooled: 32 MB, 8.29 / 0.00 ms (average mu = 0.997, current mu = 0.996) allocation failure;
[2799:0x292c2000] 16989 ms: Scavenge 339.6 (443.3) -> 329.1 (443.3) MB, pooled: 32 MB, 9.87 / 0.00 ms (average mu = 0.997, current mu = 0.996) allocation failure;
```
After some debugging, I traced it to `@radix-ui/dialog`. I didn’t find
any open issues about memory leaks there, so my guess is it’s just using
more memory than our default allocation. Jest has an option to increase
the memory limit, but we should be fine for now.
Related issue:
[https://github.com/mswjs/msw/issues/2537](https://github.com/mswjs/msw/issues/2537)
Bumps [@radix-ui/react-dialog](https://github.com/radix-ui/primitives)
from 1.1.4 to 1.1.15.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/radix-ui/primitives/commits">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [@radix-ui/react-select](https://github.com/radix-ui/primitives)
from 2.1.4 to 2.2.6.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/radix-ui/primitives/commits">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [msw](https://github.com/mswjs/msw) from 2.4.8 to 2.11.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/mswjs/msw/releases">msw's
releases</a>.</em></p>
<blockquote>
<h2>v2.11.3 (2025-09-20)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>migrate to <code>until-async</code> (<a
href="https://redirect.github.com/mswjs/msw/issues/2590">#2590</a>)
(7087b1e29eb7ca0a414eff36ed3c98d03147044b) <a
href="https://github.com/kettanaito"><code>@kettanaito</code></a></li>
</ul>
<h2>v2.11.2 (2025-09-10)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>setupWorker:</strong> handle in-flight requests after
calling <code>worker.stop()</code> (<a
href="https://redirect.github.com/mswjs/msw/issues/2578">#2578</a>)
(97cf4c744d9b1a17f42ca65ac8ef93b2632b935b) <a
href="https://github.com/kettanaito"><code>@kettanaito</code></a></li>
</ul>
<h2>v2.11.1 (2025-08-31)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>use <code>tough-cookie@6</code> directly (<a
href="https://redirect.github.com/mswjs/msw/issues/2453">#2453</a>)
(6ce3b9511821e997a8e21f1d7578bbf824a3deb6) <a
href="https://github.com/sampsonjoliver"><code>@sampsonjoliver</code></a>
<a href="https://github.com/SamMousa"><code>@SamMousa</code></a> <a
href="https://github.com/kettanaito"><code>@kettanaito</code></a></li>
<li><strong>HttpResponse:</strong> infer provided body type for
<code>HttpResponse.arrayBuffer</code> (<a
href="https://redirect.github.com/mswjs/msw/issues/2575">#2575</a>)
(ad3d7c1c130a38bf9f5e5886782b725d2aa53745) <a
href="https://github.com/kettanaito"><code>@kettanaito</code></a></li>
</ul>
<h2>v2.11.0 (2025-08-30)</h2>
<h3>Features</h3>
<ul>
<li>custom request predicate function (<a
href="https://redirect.github.com/mswjs/msw/issues/2541">#2541</a>)
(a05405bd5ba7c82ad3e80990c176cbf6cb94dee7) <a
href="https://github.com/ytoshiki"><code>@ytoshiki</code></a> <a
href="https://github.com/kettanaito"><code>@kettanaito</code></a></li>
</ul>
<h2>v2.10.5 (2025-08-13)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>export the <code>GraphQLResponseBody</code> type (<a
href="https://redirect.github.com/mswjs/msw/issues/2565">#2565</a>)
(642523d3258bd1996df986ea0c9270be150bec3d) <a
href="https://github.com/breadadams"><code>@breadadams</code></a></li>
</ul>
<h2>v2.10.4 (2025-07-12)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>HttpHandler:</strong> use correct query parameters docs link
(<a href="https://redirect.github.com/mswjs/msw/issues/2547">#2547</a>)
(6cdce81de5576e5049899a729ab3a1424550c003) <a
href="https://github.com/kettanaito"><code>@kettanaito</code></a></li>
</ul>
<h2>v2.10.3 (2025-07-04)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>ws:</strong> support <code>resolutionContext</code> on
<code>parse</code> and <code>run</code> (<a
href="https://redirect.github.com/mswjs/msw/issues/2544">#2544</a>)
(024568571990b6068601a0ba9f03e143ccbbfffb) <a
href="https://github.com/kettanaito"><code>@kettanaito</code></a></li>
<li><strong>getResponse:</strong> support <code>resolutionContext</code>
argument (<a
href="https://redirect.github.com/mswjs/msw/issues/2543">#2543</a>)
(ce3ab1fdd3b353d6a1d8db3c69532bde44483a8a) <a
href="https://github.com/kettanaito"><code>@kettanaito</code></a></li>
</ul>
<h2>v2.10.2 (2025-06-09)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>TypeScript:</strong> support <code>Response.error()</code>
and <code>HttpResponse.error()</code> as mocked responses (<a
href="https://redirect.github.com/mswjs/msw/issues/2132">#2132</a>)
(72cc8ddac8f030f747b674148b03e5a025e412d2) <a
href="https://github.com/jacquesg"><code>@jacquesg</code></a> <a
href="https://github.com/kettanaito"><code>@kettanaito</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="3f7641a52a"><code>3f7641a</code></a>
chore(release): v2.11.3</li>
<li><a
href="9e6712e7c3"><code>9e6712e</code></a>
test: fix <code>body-stream</code> test rough performance equal</li>
<li><a
href="7087b1e29e"><code>7087b1e</code></a>
fix: migrate to <code>until-async</code> (<a
href="https://redirect.github.com/mswjs/msw/issues/2590">#2590</a>)</li>
<li><a
href="df869f4b00"><code>df869f4</code></a>
chore(release): v2.11.2</li>
<li><a
href="97cf4c744d"><code>97cf4c7</code></a>
fix(setupWorker): handle in-flight requests after calling
<code>worker.stop()</code> (<a
href="https://redirect.github.com/mswjs/msw/issues/2">#2</a>...</li>
<li><a
href="44e1521023"><code>44e1521</code></a>
chore: migrate eslint to flat config (<a
href="https://redirect.github.com/mswjs/msw/issues/2212">#2212</a>)</li>
<li><a
href="25d2c8f54f"><code>25d2c8f</code></a>
test(graphql): add <code>TypedDocumentNode</code> inference tests (<a
href="https://redirect.github.com/mswjs/msw/issues/2018">#2018</a>)</li>
<li><a
href="5c676b8a22"><code>5c676b8</code></a>
chore(release): v2.11.1</li>
<li><a
href="6ce3b95118"><code>6ce3b95</code></a>
fix: use <code>tough-cookie@6</code> directly (<a
href="https://redirect.github.com/mswjs/msw/issues/2453">#2453</a>)</li>
<li><a
href="3173e66751"><code>3173e66</code></a>
refactor: remove unused import & imported multiple times (<a
href="https://redirect.github.com/mswjs/msw/issues/2576">#2576</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/mswjs/msw/compare/v2.4.8...v2.11.3">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [ssh2](https://github.com/mscdex/ssh2) and
[@types/ssh2](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/ssh2).
These dependencies needed to be updated together.
Updates `ssh2` from 1.16.0 to 1.17.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="844f1edfc4"><code>844f1ed</code></a>
package: bump version to v1.17.0</li>
<li><a
href="f7cbb0cff0"><code>f7cbb0c</code></a>
package: bump nan to v2.23.0</li>
<li><a
href="83ec32070a"><code>83ec320</code></a>
ci: add node 24.x</li>
<li><a
href="b33c065d86"><code>b33c065</code></a>
ci: bump windows image version</li>
<li><a
href="c19a821454"><code>c19a821</code></a>
client: add support for environment variables when starting SFTP</li>
<li><a
href="dd5510c088"><code>dd5510c</code></a>
lib: fix workers thread-safety issues</li>
<li><a
href="0fe2643cb2"><code>0fe2643</code></a>
ci: unset OPENSSL_CONF</li>
<li><a
href="42491a6053"><code>42491a6</code></a>
ci: fix issues related to old node-gyp + new Python</li>
<li>See full diff in <a
href="https://github.com/mscdex/ssh2/compare/v1.16.0...v1.17.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `@types/ssh2` from 1.15.1 to 1.15.5
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/ssh2">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## Description
This PR updates the dogfood "Write Coder on Coder" template by modifying
the Claude system prompt so that it does not report task status changes
related to the system prompt itself.
Currently, when a user adds the initial prompt, the Claude code
workspace app (configured via Terraform) reports four status changes:
`Working → Idle → Working → Idle`
The first pair (`Working → Idle`) is caused by the status reporting of
the system prompt, which is unnecessary noise.
These redundant transitions also triggered notification reports, leading
to extra, misleading updates.
With this update, the system prompt will no longer trigger status
transitions or notifications, ensuring that only user-driven prompts
cause meaningful status and notification updates.
Bumps the emotion group with 1 update in the /offlinedocs directory:
[@emotion/styled](https://github.com/emotion-js/emotion).
Bumps the emotion group with 1 update in the /site directory:
[@emotion/styled](https://github.com/emotion-js/emotion).
Updates `@emotion/styled` from 11.14.0 to 11.14.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/emotion-js/emotion/releases"><code>@emotion/styled</code>'s
releases</a>.</em></p>
<blockquote>
<h2><code>@emotion/styled</code><a
href="https://github.com/11"><code>@11</code></a>.14.1</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/emotion-js/emotion/pull/3334">#3334</a>
<a
href="0facbe47bd"><code>0facbe4</code></a>
Thanks <a
href="https://github.com/ZachRiegel"><code>@ZachRiegel</code></a>! -
Renamed default-exported variable in <code>@emotion/styled</code> to aid
inferred import names in auto-import completions in IDEs</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="4922955396"><code>4922955</code></a>
Version Packages (<a
href="https://redirect.github.com/emotion-js/emotion/issues/3335">#3335</a>)</li>
<li><a
href="0facbe47bd"><code>0facbe4</code></a>
Renamed default-exported variable in <code>@emotion/styled</code> to aid
inferred import...</li>
<li><a
href="cce67ec6b2"><code>cce67ec</code></a>
Bump parcel (<a
href="https://redirect.github.com/emotion-js/emotion/issues/3258">#3258</a>)</li>
<li>See full diff in <a
href="https://github.com/emotion-js/emotion/compare/@emotion/styled@11.14.0...@emotion/styled@11.14.1">compare
view</a></li>
</ul>
</details>
<br />
Updates `@emotion/styled` from 11.14.0 to 11.14.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/emotion-js/emotion/releases"><code>@emotion/styled</code>'s
releases</a>.</em></p>
<blockquote>
<h2><code>@emotion/styled</code><a
href="https://github.com/11"><code>@11</code></a>.14.1</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/emotion-js/emotion/pull/3334">#3334</a>
<a
href="0facbe47bd"><code>0facbe4</code></a>
Thanks <a
href="https://github.com/ZachRiegel"><code>@ZachRiegel</code></a>! -
Renamed default-exported variable in <code>@emotion/styled</code> to aid
inferred import names in auto-import completions in IDEs</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="4922955396"><code>4922955</code></a>
Version Packages (<a
href="https://redirect.github.com/emotion-js/emotion/issues/3335">#3335</a>)</li>
<li><a
href="0facbe47bd"><code>0facbe4</code></a>
Renamed default-exported variable in <code>@emotion/styled</code> to aid
inferred import...</li>
<li><a
href="cce67ec6b2"><code>cce67ec</code></a>
Bump parcel (<a
href="https://redirect.github.com/emotion-js/emotion/issues/3258">#3258</a>)</li>
<li>See full diff in <a
href="https://github.com/emotion-js/emotion/compare/@emotion/styled@11.14.0...@emotion/styled@11.14.1">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [undici](https://github.com/nodejs/undici) from 6.21.2 to 6.21.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/nodejs/undici/releases">undici's
releases</a>.</em></p>
<blockquote>
<h2>v6.21.3</h2>
<h2>What's Changed</h2>
<ul>
<li>[Backport v6.x] append crlf to formdata body by <a
href="https://github.com/github-actions"><code>@github-actions</code></a>
in <a
href="https://redirect.github.com/nodejs/undici/pull/4210">nodejs/undici#4210</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/nodejs/undici/compare/v6.21.2...v6.21.3">https://github.com/nodejs/undici/compare/v6.21.2...v6.21.3</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="da0e823ac0"><code>da0e823</code></a>
Bumped v6.21.4</li>
<li><a
href="dbbe0a2d50"><code>dbbe0a2</code></a>
append crlf to formdata body (<a
href="https://redirect.github.com/nodejs/undici/issues/3625">#3625</a>)
(<a
href="https://redirect.github.com/nodejs/undici/issues/4210">#4210</a>)</li>
<li>See full diff in <a
href="https://github.com/nodejs/undici/compare/v6.21.2...v6.21.3">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [react-markdown](https://github.com/remarkjs/react-markdown) from
9.0.3 to 9.1.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/remarkjs/react-markdown/releases">react-markdown's
releases</a>.</em></p>
<blockquote>
<h2>9.1.0</h2>
<ul>
<li>6ce120e Add support for async plugins
by <a href="https://github.com/wooorm"><code>@wooorm</code></a> in <a
href="https://redirect.github.com/remarkjs/react-markdown/pull/890">remarkjs/react-markdown#890</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/remarkjs/react-markdown/compare/9.0.3...9.1.0">https://github.com/remarkjs/react-markdown/compare/9.0.3...9.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/remarkjs/react-markdown/blob/main/changelog.md">react-markdown's
changelog</a>.</em></p>
<blockquote>
<h2>9.1.0 - 2025-02-20</h2>
<ul>
<li><a
href="https://github.com/remarkjs/react-markdown/commit/6ce120e"><code>6ce120e</code></a>
Add support for async plugins</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="747e505c9a"><code>747e505</code></a>
9.1.0</li>
<li><a
href="6ce120e706"><code>6ce120e</code></a>
Add support for async plugins</li>
<li><a
href="78d08de906"><code>78d08de</code></a>
Refactor to remove warning in tests</li>
<li><a
href="bcdc5b3b4f"><code>bcdc5b3</code></a>
Refactor <code>package.json</code></li>
<li><a
href="c44e246bbb"><code>c44e246</code></a>
Update dev-dependencies</li>
<li>See full diff in <a
href="https://github.com/remarkjs/react-markdown/compare/9.0.3...9.1.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
[//]: # (dependabot-start)
⚠️ **Dependabot is rebasing this PR** ⚠️
Rebasing might not happen immediately, so don't worry if this takes some
time.
Note: if you make any changes to this PR yourself, they will take
precedence over the rebase.
---
[//]: # (dependabot-end)
Bumps [react-markdown](https://github.com/remarkjs/react-markdown) from
9.0.3 to 9.1.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/remarkjs/react-markdown/releases">react-markdown's
releases</a>.</em></p>
<blockquote>
<h2>9.1.0</h2>
<ul>
<li>6ce120e Add support for async plugins
by <a href="https://github.com/wooorm"><code>@wooorm</code></a> in <a
href="https://redirect.github.com/remarkjs/react-markdown/pull/890">remarkjs/react-markdown#890</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/remarkjs/react-markdown/compare/9.0.3...9.1.0">https://github.com/remarkjs/react-markdown/compare/9.0.3...9.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/remarkjs/react-markdown/blob/main/changelog.md">react-markdown's
changelog</a>.</em></p>
<blockquote>
<h2>9.1.0 - 2025-02-20</h2>
<ul>
<li><a
href="https://github.com/remarkjs/react-markdown/commit/6ce120e"><code>6ce120e</code></a>
Add support for async plugins</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="747e505c9a"><code>747e505</code></a>
9.1.0</li>
<li><a
href="6ce120e706"><code>6ce120e</code></a>
Add support for async plugins</li>
<li><a
href="78d08de906"><code>78d08de</code></a>
Refactor to remove warning in tests</li>
<li><a
href="bcdc5b3b4f"><code>bcdc5b3</code></a>
Refactor <code>package.json</code></li>
<li><a
href="c44e246bbb"><code>c44e246</code></a>
Update dev-dependencies</li>
<li>See full diff in <a
href="https://github.com/remarkjs/react-markdown/compare/9.0.3...9.1.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
[//]: # (dependabot-start)
⚠️ **Dependabot is rebasing this PR** ⚠️
Rebasing might not happen immediately, so don't worry if this takes some
time.
Note: if you make any changes to this PR yourself, they will take
precedence over the rebase.
---
[//]: # (dependabot-end)
Bumps [remark-gfm](https://github.com/remarkjs/remark-gfm) from 4.0.0 to
4.0.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/remarkjs/remark-gfm/releases">remark-gfm's
releases</a>.</em></p>
<blockquote>
<h2>4.0.1</h2>
<h4>Types</h4>
<ul>
<li>4af823a Refactor to use <code>interface</code> for exposed
types</li>
<li>3a57a5b Add declaration maps</li>
<li>76559f9 Refactor to use <code>@import</code>s</li>
</ul>
<h4>Docs</h4>
<ul>
<li>173394d Add docs on footnote option</li>
<li>21cae6a Fix typo
by <a href="https://github.com/leafac"><code>@leafac</code></a> in <a
href="https://redirect.github.com/remarkjs/remark-gfm/pull/73">remarkjs/remark-gfm#73</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/remarkjs/remark-gfm/compare/4.0.0...4.0.1">https://github.com/remarkjs/remark-gfm/compare/4.0.0...4.0.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="109972e8a7"><code>109972e</code></a>
4.0.1</li>
<li><a
href="173394d373"><code>173394d</code></a>
Add docs on footnote option</li>
<li><a
href="030dd8d534"><code>030dd8d</code></a>
Update dev-dependencies</li>
<li><a
href="21cae6ac8b"><code>21cae6a</code></a>
Fix typo</li>
<li><a
href="4af823a56b"><code>4af823a</code></a>
Refactor to use <code>interface</code> for exposed types</li>
<li><a
href="3a57a5bc3c"><code>3a57a5b</code></a>
Add declaration maps</li>
<li><a
href="76559f9e05"><code>76559f9</code></a>
Refactor to use <code>@import</code>s</li>
<li><a
href="da382350cc"><code>da38235</code></a>
Refactor <code>package.json</code></li>
<li><a
href="a5e8993994"><code>a5e8993</code></a>
Remove license year</li>
<li><a
href="4e1d55f320"><code>4e1d55f</code></a>
Refactor <code>.editorconfig</code></li>
<li>Additional commits viewable in <a
href="https://github.com/remarkjs/remark-gfm/compare/4.0.0...4.0.1">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip)
from 5.51.0 to 5.64.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/webpro-nl/knip/releases">knip's
releases</a>.</em></p>
<blockquote>
<h2>Release 5.64.1</h2>
<ul>
<li>Edit docs (634b59d07353bc09db762ee1b672df06da66da59)</li>
<li>Edit docs (d3433f00840736e11cc5c845babffe415ecad1fe)</li>
<li>Add "How to keep package.json under control" article
(570f40b15007c075d7f1e4d77bd2970034eec8ec)</li>
<li>We're incompatible with typescript v7
(f4f9166a0fca265e6f0dc939528836ce7003938f)</li>
<li>Migrate from bun → pnpm
(f18428c53d5bff7bad5259bf053e1d8c2b78881f)</li>
<li>Migrate from biome v1 → v2
(7ae5d72dadba0d8084842765ba3c045ac9199aa5)</li>
<li>Update dependencies (3174456e0c0f3086cc52d41cbea647b5a50cc057)</li>
<li>Re-gen plugins list (2da7ba49e8930c68b3cf8d1421a88cf975af9800)</li>
<li>Migrate from zod v3 → v4
(a71c1030be3ee6b7312fdb952504a3f1dbe5a694)</li>
</ul>
<h2>Release 5.64.0</h2>
<ul>
<li>Fix formatting (900068149a5612cb6d084d46a3ff31b94c49b284)</li>
<li>Add <code>env-cmd</code> Support (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1254">#1254</a>)
(21d6b5183ad10b3296cdb9c8f21a8f2d01bb36e9) - thanks <a
href="https://github.com/joealden"><code>@joealden</code></a>!</li>
<li>Re-gen sponsorships chart
(185c6389226216548c5691acbac38dda3bf07dfd)</li>
<li>fix: handle only string modules in dependency resolution (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1263">#1263</a>)
(a54021b6e5904fe6a6e87614728b841fe6931858) - thanks <a
href="https://github.com/wattanx"><code>@wattanx</code></a>!</li>
<li>fix: bun ci (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1267">#1267</a>)
(3d1c3c5b91f440ade9f1069dd41f402e50645c6c) - thanks <a
href="https://github.com/Zamiell"><code>@Zamiell</code></a>!</li>
<li>Filter out invalid binaries (resolves <a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1264">#1264</a>)
(6f306111e4571418546da2aaf40d9b533940dd28)</li>
<li>Work types for good ol' ts 5.0.4
(9913ee755014285036a12ceed65371eb47a321eb)</li>
<li>Add <a
href="https://github.com/Datadog-OSS"><code>@Datadog-OSS</code></a>
sponsor (a61d9fef9b3ea9c163c6408b1b38495417aeb1da)</li>
<li>feat: GitHub actions reporter (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1231">#1231</a>)
(0a234504fd626f9f0a59aa377301fa46639539c1) - thanks <a
href="https://github.com/cylewaitforit"><code>@cylewaitforit</code></a>!</li>
<li>Add pos to unlisted deps issue type
(5b54dae614d1b0719046405241d80e390ab9f4ba)</li>
<li>Improve import specifier sanitizer (resolves <a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1257">#1257</a>)
(087a98e028994d3e19bfcfd88b7b6231855de781)</li>
<li>Cover more cases for symbol refs finder (resolves <a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1273">#1273</a>)
(3d76e51e59eceeb528ef6e20ca5e3a1bfff2a841)</li>
<li>Fix package name of rslib enabler (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1272">#1272</a>)
(432bdccb9aa3c8c7d8c0114f6614a651d959e56d) - thanks <a
href="https://github.com/nyarthan"><code>@nyarthan</code></a>!</li>
<li>Pass parsed CLI args to config-as-a-function
(b0814c9d454ccd060aeda693398d1707ef678fc4)</li>
<li>Ignore !-suffixed deps/bins only in production mode (resolves <a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1253">#1253</a>)
(06d4df84e7fe2735fce8bc1b1b12e78016e38ebb)</li>
<li>Update docs (0d8fd135b46855f6d606783e6c256cceeccf9acf)</li>
<li>Auto-format (f54a7bd2cd74354f51fb46ae978b3e5db8759fd7)</li>
<li>Find accessed identifiers for dynamic imports (resolves <a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1155">#1155</a>,
resolves <a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1230">#1230</a>)
(ec0be7e3b222da5b6ddb34baad9d2591f0f479cb)</li>
<li>Update oxc-resolver and a few more (dev) deps
(96c822a40855c21152f81a1599458850b4f6c2dc)</li>
<li>Optimize <code>getAccessedIdentifiers</code>
(8fb95019030533909c970bdb204b4779c19eaf5d)</li>
<li>fix: enable pnpm plugin on root config & lockfile (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1275">#1275</a>)
(6e339cadc079b0e144c2036134154c696e8b31c0) - thanks <a
href="https://github.com/nyarthan"><code>@nyarthan</code></a>!</li>
<li>Remove ancient past sponsors
(e9e6e911d87cf550df87647f5a9b949d32faa27f)</li>
<li>Remove default <code>binaries</code> values in plugins
(aac28c491ead836231e7487a8ebea056d0cf16cc)</li>
<li>Remove default <code>containingFilePath</code> value in angular
plugin (92089275df7752a830c171d8d1d4cb39b0a83565)</li>
<li>Add <code>isRootOnly</code> to pnpm plugin
(fe99f594ac79c2bb3590091651300062b690a12b)</li>
<li>Move/extend docs to write plugin
(497bddb5479a53d59baaa078225343a621eaa317)</li>
<li>feat: add <code>time</code> & <code>unzip</code> to ignored
binaries (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1276">#1276</a>)
(4f8d9df599ffaba171e2535ffe61153f4ce1089a) - thanks <a
href="https://github.com/nyarthan"><code>@nyarthan</code></a>!</li>
<li>Add <code>Rstest</code> Plugin (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1277">#1277</a>)
(5b7d92f101153294708a3d1afe8d2c4d61595116) - thanks <a
href="https://github.com/nyarthan"><code>@nyarthan</code></a>!</li>
<li>Edit docs (847ccf168776f2cb6c9b5108a208ea8eae12799f)</li>
<li>feat: add plugin for <code>bumpp</code> (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1278">#1278</a>)
(136a14bc4ff4138389a831afc62f5406f66223a5) - thanks <a
href="https://github.com/nyarthan"><code>@nyarthan</code></a>!</li>
<li>Support input resolver from args in plugins (resolve <a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1274">#1274</a>)
(19dd367764fa078fb9c93bb0a715492ff0581098)</li>
<li>Edit docs (77d683e2b75b44c7fd5fc47b59621398b86028ea)</li>
</ul>
<h2>Release 5.63.1</h2>
<ul>
<li>Fix <code>rsbuild</code> Plugin (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1227">#1227</a>)
(e91eea3382059ad4067ace6079e856b2268d9f94) - thanks <a
href="https://github.com/joealden"><code>@joealden</code></a>!</li>
<li>Binaries don't contain colons (closes <a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1234">#1234</a>)
(1d060ac1043ccf211380682962c4c668758740ed)</li>
<li>Refactor options all over the place
(982d3272e46609f06ca858605d802a75726500d1)</li>
<li>feat: detect nuxt modules as dependencies (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1241">#1241</a>)
(f2072e6aecd81a2082dc60f440d1e48ab583e480) - thanks <a
href="https://github.com/danielamaia"><code>@danielamaia</code></a>!</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="e0ff0b5d74"><code>e0ff0b5</code></a>
Release 5.64.1</li>
<li><a
href="a71c1030be"><code>a71c103</code></a>
Migrate from zod v3 → v4</li>
<li><a
href="3174456e0c"><code>3174456</code></a>
Update dependencies</li>
<li><a
href="7ae5d72dad"><code>7ae5d72</code></a>
Migrate from biome v1 → v2</li>
<li><a
href="f18428c53d"><code>f18428c</code></a>
Migrate from bun → pnpm</li>
<li><a
href="f4f9166a0f"><code>f4f9166</code></a>
We're incompatible with typescript v7</li>
<li><a
href="f0aeb5bc66"><code>f0aeb5b</code></a>
Release 5.64.0</li>
<li><a
href="77d683e2b7"><code>77d683e</code></a>
Edit docs</li>
<li><a
href="19dd367764"><code>19dd367</code></a>
Support input resolver from args in plugins (resolve <a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1274">#1274</a>)</li>
<li><a
href="136a14bc4f"><code>136a14b</code></a>
feat: add plugin for <code>bumpp</code> (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1278">#1278</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/webpro-nl/knip/commits/5.64.1/packages/knip">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [@radix-ui/react-slot](https://github.com/radix-ui/primitives)
from 1.1.1 to 1.2.3.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/radix-ui/primitives/commits">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
[//]: # (dependabot-start)
⚠️ **Dependabot is rebasing this PR** ⚠️
Rebasing might not happen immediately, so don't worry if this takes some
time.
Note: if you make any changes to this PR yourself, they will take
precedence over the rebase.
---
[//]: # (dependabot-end)
Bumps
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
from 20.17.16 to 20.19.19.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [@playwright/test](https://github.com/microsoft/playwright) from
1.50.1 to 1.55.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/microsoft/playwright/releases"><code>@playwright/test</code>'s
releases</a>.</em></p>
<blockquote>
<h2>v1.55.1</h2>
<h3>Highlights</h3>
<p><a
href="https://redirect.github.com/microsoft/playwright/issues/37479">microsoft/playwright#37479</a>
- [Bug]: Upgrade Chromium to 140.0.7339.186.
<a
href="https://redirect.github.com/microsoft/playwright/issues/37147">microsoft/playwright#37147</a>
- [Regression]: Internal error: step id not found.
<a
href="https://redirect.github.com/microsoft/playwright/issues/37146">microsoft/playwright#37146</a>
- [Regression]: HTML reporter displays a broken chip link when there are
no projects.
<a
href="https://redirect.github.com/microsoft/playwright/pull/37137">microsoft/playwright#37137</a>
- Revert "fix(a11y): track inert elements as hidden".</p>
<h2>Browser Versions</h2>
<ul>
<li>Chromium 140.0.7339.186</li>
<li>Mozilla Firefox 141.0</li>
<li>WebKit 26.0</li>
</ul>
<p>This version was also tested against the following stable
channels:</p>
<ul>
<li>Google Chrome 139</li>
<li>Microsoft Edge 139</li>
</ul>
<h2>v1.55.0</h2>
<h2>New APIs</h2>
<ul>
<li>New Property <a
href="https://playwright.dev/docs/api/class-teststepinfo#test-step-info-title-path">testStepInfo.titlePath</a>
Returns the full title path starting from the test file, including test
and step titles.</li>
</ul>
<h2>Codegen</h2>
<ul>
<li>Automatic <code>toBeVisible()</code> assertions: Codegen can now
generate automatic <code>toBeVisible()</code> assertions for common UI
interactions. This feature can be enabled in the Codegen settings
UI.</li>
</ul>
<h2>Breaking Changes</h2>
<ul>
<li>⚠️ Dropped support for Chromium extension manifest v2.</li>
</ul>
<h2>Miscellaneous</h2>
<ul>
<li>Added support for Debian 13 "Trixie".</li>
</ul>
<h2>Browser Versions</h2>
<ul>
<li>Chromium 140.0.7339.16</li>
<li>Mozilla Firefox 141.0</li>
<li>WebKit 26.0</li>
</ul>
<p>This version was also tested against the following stable
channels:</p>
<ul>
<li>Google Chrome 139</li>
<li>Microsoft Edge 139</li>
</ul>
<h2>v1.54.2</h2>
<h3>Highlights</h3>
<p><a
href="https://redirect.github.com/microsoft/playwright/issues/36714">microsoft/playwright#36714</a>
- [Regression]: Codegen is not able to launch in Administrator Terminal
on Windows (ProtocolError: Protocol error)
<a
href="https://redirect.github.com/microsoft/playwright/issues/36828">microsoft/playwright#36828</a>
- [Regression]: Playwright Codegen keeps spamming with selected option
<a
href="https://redirect.github.com/microsoft/playwright/issues/36810">microsoft/playwright#36810</a>
- [Regression]: Starting Codegen with target language doesn't work
anymore</p>
<h2>Browser Versions</h2>
<ul>
<li>Chromium 139.0.7258.5</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="ae51df7a35"><code>ae51df7</code></a>
chore: mark v1.55.1 (<a
href="https://redirect.github.com/microsoft/playwright/issues/37530">#37530</a>)</li>
<li><a
href="86dde294ce"><code>86dde29</code></a>
feat(chromium): roll to r1193 (<a
href="https://redirect.github.com/microsoft/playwright/issues/37529">#37529</a>)</li>
<li><a
href="86328bc9f4"><code>86328bc</code></a>
chore: do not use -k option (<a
href="https://redirect.github.com/microsoft/playwright/issues/37532">#37532</a>)</li>
<li><a
href="63799ba683"><code>63799ba</code></a>
cherry-pick(<a
href="https://redirect.github.com/microsoft/playwright/issues/37214">#37214</a>):
docs: fix method names in release notes</li>
<li><a
href="21e29a42ab"><code>21e29a4</code></a>
cherry-pick(<a
href="https://redirect.github.com/microsoft/playwright/issues/37153">#37153</a>):
fix(html): don't display a chip with empty content with ...</li>
<li><a
href="ba62e6ab0d"><code>ba62e6a</code></a>
cherry-pick(<a
href="https://redirect.github.com/microsoft/playwright/issues/37149">#37149</a>):
fix(test): attaching in boxed fixture</li>
<li><a
href="25bb073f26"><code>25bb073</code></a>
cherry-pick(<a
href="https://redirect.github.com/microsoft/playwright/issues/37137">#37137</a>):
Revert "fix(a11y): track inert elements as hidden (<a
href="https://redirect.github.com/microsoft/playwright/issues/36947">#36947</a>)"</li>
<li><a
href="f992162f04"><code>f992162</code></a>
chore: mark v1.55.0 (<a
href="https://redirect.github.com/microsoft/playwright/issues/37121">#37121</a>)</li>
<li><a
href="4a92ea0025"><code>4a92ea0</code></a>
cherry-pick(<a
href="https://redirect.github.com/microsoft/playwright/issues/37113">#37113</a>):
docs: add release-notes for v1.55</li>
<li><a
href="aa05507bba"><code>aa05507</code></a>
cherry-pick(<a
href="https://redirect.github.com/microsoft/playwright/issues/37114">#37114</a>):
test: move browser._launchServer in child process</li>
<li>Additional commits viewable in <a
href="https://github.com/microsoft/playwright/compare/v1.50.1...v1.55.1">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~playwright-bot">playwright-bot</a>, a new
releaser for <code>@playwright/test</code> since your current
version.</p>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[@fontsource/fira-code](https://github.com/fontsource/font-files/tree/HEAD/fonts/google/fira-code)
from 5.2.5 to 5.2.7.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/fontsource/font-files/commits/HEAD/fonts/google/fira-code">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [chromatic](https://github.com/chromaui/chromatic-cli) from
11.25.2 to 11.29.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/chromaui/chromatic-cli/releases">chromatic's
releases</a>.</em></p>
<blockquote>
<h2>v11.29.0</h2>
<h4>🚀 Enhancement</h4>
<ul>
<li>Export <code>createLogger</code> and make all arguments optional <a
href="https://redirect.github.com/chromaui/chromatic-cli/pull/1182">#1182</a>
(<a
href="https://github.com/ghengeveld"><code>@ghengeveld</code></a>)</li>
</ul>
<h4>Authors: 1</h4>
<ul>
<li>Gert Hengeveld (<a
href="https://github.com/ghengeveld"><code>@ghengeveld</code></a>)</li>
</ul>
<h2>v11.28.4</h2>
<h4>🐛 Bug Fix</h4>
<ul>
<li>Revert "Add git command logging and pass
<code>--no-relative</code> to <code>git diff</code>." <a
href="https://redirect.github.com/chromaui/chromatic-cli/pull/1183">#1183</a>
(<a
href="https://github.com/ghengeveld"><code>@ghengeveld</code></a>)</li>
</ul>
<h4>Authors: 1</h4>
<ul>
<li>Gert Hengeveld (<a
href="https://github.com/ghengeveld"><code>@ghengeveld</code></a>)</li>
</ul>
<h2>v11.28.3</h2>
<h4>🐛 Bug Fix</h4>
<ul>
<li>Add git command logging and pass <code>--no-relative</code> to
<code>git diff</code>. <a
href="https://redirect.github.com/chromaui/chromatic-cli/pull/1181">#1181</a>
(<a href="https://github.com/tmeasday"><code>@tmeasday</code></a>)</li>
</ul>
<h4>Authors: 1</h4>
<ul>
<li>Tom Coleman (<a
href="https://github.com/tmeasday"><code>@tmeasday</code></a>)</li>
</ul>
<h2>v11.28.2</h2>
<h4>🐛 Bug Fix</h4>
<ul>
<li>Use pagination to get all tests in the build <a
href="https://redirect.github.com/chromaui/chromatic-cli/pull/1175">#1175</a>
(<a href="https://github.com/codykaup"><code>@codykaup</code></a>)</li>
</ul>
<h4>Authors: 1</h4>
<ul>
<li>Cody Kaup (<a
href="https://github.com/codykaup"><code>@codykaup</code></a>)</li>
</ul>
<h2>v11.28.1</h2>
<h4>🐛 Bug Fix</h4>
<ul>
<li>Return additional build info on action rerun <a
href="https://redirect.github.com/chromaui/chromatic-cli/pull/1174">#1174</a>
(<a
href="https://github.com/justin-thurman"><code>@justin-thurman</code></a>)</li>
<li>✏️ Update help text to reflect actual state of
exitOnceUploaded. <a
href="https://redirect.github.com/chromaui/chromatic-cli/pull/1169">#1169</a>
(<a href="https://github.com/jwir3"><code>@jwir3</code></a>)</li>
</ul>
<h4>Authors: 2</h4>
<ul>
<li>Justin Thurman (<a
href="https://github.com/justin-thurman"><code>@justin-thurman</code></a>)</li>
<li>Scott Johnson (<a
href="https://github.com/jwir3"><code>@jwir3</code></a>)</li>
</ul>
<h2>v11.28.0</h2>
<h4>🚀 Enhancement</h4>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/chromaui/chromatic-cli/blob/main/CHANGELOG.md">chromatic's
changelog</a>.</em></p>
<blockquote>
<h1>v11.29.0 (Fri May 23 2025)</h1>
<h4>🚀 Enhancement</h4>
<ul>
<li>Export <code>createLogger</code> and make all arguments optional <a
href="https://redirect.github.com/chromaui/chromatic-cli/pull/1182">#1182</a>
(<a
href="https://github.com/ghengeveld"><code>@ghengeveld</code></a>)</li>
</ul>
<h4>Authors: 1</h4>
<ul>
<li>Gert Hengeveld (<a
href="https://github.com/ghengeveld"><code>@ghengeveld</code></a>)</li>
</ul>
<hr />
<h1>v11.28.4 (Fri May 23 2025)</h1>
<h4>🐛 Bug Fix</h4>
<ul>
<li>Revert "Add git command logging and pass
<code>--no-relative</code> to <code>git diff</code>." <a
href="https://redirect.github.com/chromaui/chromatic-cli/pull/1183">#1183</a>
(<a
href="https://github.com/ghengeveld"><code>@ghengeveld</code></a>)</li>
</ul>
<h4>Authors: 1</h4>
<ul>
<li>Gert Hengeveld (<a
href="https://github.com/ghengeveld"><code>@ghengeveld</code></a>)</li>
</ul>
<hr />
<h1>v11.28.3 (Thu May 22 2025)</h1>
<h4>🐛 Bug Fix</h4>
<ul>
<li>Add git command logging and pass <code>--no-relative</code> to
<code>git diff</code>. <a
href="https://redirect.github.com/chromaui/chromatic-cli/pull/1181">#1181</a>
(<a href="https://github.com/tmeasday"><code>@tmeasday</code></a>)</li>
</ul>
<h4>Authors: 1</h4>
<ul>
<li>Tom Coleman (<a
href="https://github.com/tmeasday"><code>@tmeasday</code></a>)</li>
</ul>
<hr />
<h1>v11.28.2 (Thu Apr 17 2025)</h1>
<h4>🐛 Bug Fix</h4>
<ul>
<li>Use pagination to get all tests in the build <a
href="https://redirect.github.com/chromaui/chromatic-cli/pull/1175">#1175</a>
(<a href="https://github.com/codykaup"><code>@codykaup</code></a>)</li>
</ul>
<h4>Authors: 1</h4>
<ul>
<li>Cody Kaup (<a
href="https://github.com/codykaup"><code>@codykaup</code></a>)</li>
</ul>
<hr />
<h1>v11.28.1 (Thu Apr 17 2025)</h1>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="6004745462"><code>6004745</code></a>
Bump version to: 11.29.0 [skip ci]</li>
<li><a
href="15caa2ae27"><code>15caa2a</code></a>
Update CHANGELOG.md [skip ci]</li>
<li><a
href="092db515eb"><code>092db51</code></a>
Merge pull request <a
href="https://redirect.github.com/chromaui/chromatic-cli/issues/1182">#1182</a>
from chromaui/export-createLogger</li>
<li><a
href="71ad899f7f"><code>71ad899</code></a>
Merge branch 'main' into export-createLogger</li>
<li><a
href="e6127ede88"><code>e6127ed</code></a>
Bump version to: 11.28.4 [skip ci]</li>
<li><a
href="88ca20e2f8"><code>88ca20e</code></a>
Update CHANGELOG.md [skip ci]</li>
<li><a
href="ac3689eae4"><code>ac3689e</code></a>
Merge pull request <a
href="https://redirect.github.com/chromaui/chromatic-cli/issues/1183">#1183</a>
from chromaui/revert-1181-tom/cap-2840-turbosnap-det...</li>
<li><a
href="46ef6376e1"><code>46ef637</code></a>
Revert "Add git command logging and pass <code>--no-relative</code>
to <code>git diff</code>."</li>
<li><a
href="fd1bbfe989"><code>fd1bbfe</code></a>
Export createLogger and make all arguments optional</li>
<li><a
href="24e63156d5"><code>24e6315</code></a>
Bump version to: 11.28.3 [skip ci]</li>
<li>Additional commits viewable in <a
href="https://github.com/chromaui/chromatic-cli/compare/v11.25.2...v11.29.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
[//]: # (dependabot-start)
⚠️ **Dependabot is rebasing this PR** ⚠️
Rebasing might not happen immediately, so don't worry if this takes some
time.
Note: if you make any changes to this PR yourself, they will take
precedence over the rebase.
---
[//]: # (dependabot-end)
Bumps [sanitize-html](https://github.com/apostrophecms/sanitize-html)
and
[@types/sanitize-html](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/sanitize-html).
These dependencies needed to be updated together.
Updates `sanitize-html` from 2.14.0 to 2.17.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/apostrophecms/sanitize-html/blob/main/CHANGELOG.md">sanitize-html's
changelog</a>.</em></p>
<blockquote>
<h2>2.17.0 (2025-05-14)</h2>
<ul>
<li>Add <code>preserveEscapedAttributes</code>, allowing attributes on
escaped disallowed tags to be retained. Thanks to <a
href="https://github.com/benelliott">Ben Elliot</a> for this new
option.</li>
</ul>
<h2>2.16.0 (2025-04-16)</h2>
<ul>
<li>Add <code>onOpenTag</code> and <code>onCloseTag</code> events to
enable advanced filtering to hook into the parser. Thanks to <a
href="https://github.com/naktinis">Rimvydas Naktinis</a>.</li>
</ul>
<h2>2.15.0 (2025-03-19)</h2>
<ul>
<li>Allow keeping tag content when discarding with exclusive filter by
returning <code>"excludeTag"</code>. Thanks to <a
href="https://github.com/rChaoz">rChaoz</a>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="86efc067a6"><code>86efc06</code></a>
Merge pull request <a
href="https://redirect.github.com/apostrophecms/sanitize-html/issues/705">#705</a>
from apostrophecms/release-2.17.0</li>
<li><a
href="c487e7796a"><code>c487e77</code></a>
release 2.17.0</li>
<li><a
href="da16903bed"><code>da16903</code></a>
Merge pull request <a
href="https://redirect.github.com/apostrophecms/sanitize-html/issues/704">#704</a>
from apostrophecms/add-thanks-to-changelog</li>
<li><a
href="0e5d881f48"><code>0e5d881</code></a>
Update CHANGELOG</li>
<li><a
href="614e7dfc2c"><code>614e7df</code></a>
Merge pull request <a
href="https://redirect.github.com/apostrophecms/sanitize-html/issues/668">#668</a>
from benelliott/feature/preserve-escaped-attributes-2</li>
<li><a
href="8628ceaa17"><code>8628cea</code></a>
Update README.md</li>
<li><a
href="f07ce9dff8"><code>f07ce9d</code></a>
README.md: Add warning on usage of
<code>preserveEscapedAttributes</code></li>
<li><a
href="27de3a879a"><code>27de3a8</code></a>
Add test demonstrating that preserveEscapedAttributes doesn't affect
behaviou...</li>
<li><a
href="3d2893e013"><code>3d2893e</code></a>
Add documentation for <code>preserveEscapedAttributes</code> option</li>
<li><a
href="ae1dc35af6"><code>ae1dc35</code></a>
Add <code>preserveEscapedAttributes</code> option to allow attributes on
escaped disallo...</li>
<li>Additional commits viewable in <a
href="https://github.com/apostrophecms/sanitize-html/compare/2.14.0...2.17.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `@types/sanitize-html` from 2.13.0 to 2.16.0
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/sanitize-html">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[@chakra-ui/react](https://github.com/chakra-ui/chakra-ui/tree/HEAD/packages/react)
from 2.10.5 to 2.10.9.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/chakra-ui/chakra-ui/commits/@chakra-ui/react@2.10.9/packages/react">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next)
from 14.2.23 to 14.2.33.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/next.js/releases">eslint-config-next's
releases</a>.</em></p>
<blockquote>
<h2>v14.2.33</h2>
<blockquote>
<p>[!NOTE]<br />
This release is backporting bug fixes. It does <strong>not</strong>
include all pending features/changes on canary.</p>
</blockquote>
<h3>Core Changes</h3>
<ul>
<li>omit searchParam data from FlightRouterState before transport (<a
href="https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next/issues/80734">#80734</a>)</li>
</ul>
<h3>Credits</h3>
<p>Huge thanks to <a
href="https://github.com/ztanner"><code>@ztanner</code></a> for
helping!</p>
<h2>v14.2.32</h2>
<blockquote>
<p>[!NOTE]<br />
This release is backporting bug fixes. It does <strong>not</strong>
include all pending features/changes on canary.</p>
</blockquote>
<h3>Core Changes</h3>
<ul>
<li>fix router handling when setting a location response header <a
href="https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next/issues/82588">#82588</a></li>
</ul>
<h3>Credits</h3>
<p>Huge thanks to <a
href="https://github.com/ztanner"><code>@ztanner</code></a> for
helping!</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="5a97b408c2"><code>5a97b40</code></a>
v14.2.33</li>
<li><a
href="89ee561552"><code>89ee561</code></a>
v14.2.32</li>
<li><a
href="55f76620ff"><code>55f7662</code></a>
v14.2.31</li>
<li><a
href="243072b7a8"><code>243072b</code></a>
v14.2.30</li>
<li><a
href="ca9211576c"><code>ca92115</code></a>
v14.2.29</li>
<li><a
href="e65628a237"><code>e65628a</code></a>
v14.2.28</li>
<li><a
href="43f10b8ead"><code>43f10b8</code></a>
v14.2.27</li>
<li><a
href="10a042cdca"><code>10a042c</code></a>
v14.2.26</li>
<li><a
href="d36a1f3c35"><code>d36a1f3</code></a>
v14.2.25</li>
<li><a
href="756be15c4c"><code>756be15</code></a>
v14.2.24</li>
<li>See full diff in <a
href="https://github.com/vercel/next.js/commits/v14.2.33/packages/eslint-config-next">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[@types/lodash](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/lodash)
from 4.17.15 to 4.17.20.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/lodash">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## Description
Add UI support for the new `Task Events` notification templates (`Task
Working` and `Task Idle`) added in backend PR
https://github.com/coder/coder/pull/19965. The
`/api/v2/notifications/templates/system` endpoint now returns these
templates, therefore this PR keeps the UI in sync.
## Changes
* Added `Task Working` and `Task Idle` to notification template mocks so
Storybook reflects backend data.
* Deployment Settings already lists all templates from the API, so no
code change was needed (stories updated automatically).
* Updated the User Settings filter to include `Task Events` so they
appear for end users.
<img width="2930" height="1666" alt="Screenshot 2025-09-29 at 17 06 22"
src="https://github.com/user-attachments/assets/045d5dd7-13a4-4378-9bf3-9fd86a86e64b"
/>
Depends on: https://github.com/coder/coder/pull/19965
---------
Co-authored-by: blink-so[bot] <211532188+blink-so[bot]@users.noreply.github.com>
Co-authored-by: Ben Potter <ben@coder.com>
Co-authored-by: Atif Ali <atif@coder.com>
Note: this requires owner-level perms on the token. This can be removed once it becomes possible to search org members by GitHub ID without owner-level perms.
---------
Co-authored-by: Mathias Fredriksson <mafredri@gmail.com>
Similar idea as in #19811, this runner doesn't need to conform to `Runnable`, so we have it return the workspace from the `RunReturningWorkspace` function, instead of the more fragile `Run`, followed by a `.WorkspaceID()`.
Relates to https://github.com/coder/internal/issues/889.
This PR adds a scaletest runner that simulates a single Coder Connect client receiving workspace updates.
An instance of a workspace updates runner does the following:
- Creates a user, if a session token is not supplied.
- Attempts to repeatedly dial the Coder Connect endpoint, with a configurable (two minutes by default) timeout.
- Once dialed successfully, waits for any other concurrently executing runners to also dial successfully, or timeout (using the barrier).
- Starts a configurable number of workspace builds.
- Waits for that many workspaces to be seen over the workspace updates stream (with a configurable timeout).
Exposes two prometheus metrics:
- `workspace_updates_latency_seconds` - `HistogramVec`. Labels = `{username, num_owned_workspaces, workspace_name}`
- This is the time between starting a workspace build, and receiving both the corresponding workspace update.
- `workspace_updates_errors_total` - `NewCounterVec`. Labels = `{username, num_owned_workspaces, action}`
- The number of times a specific action of the runner has failed, per user/client.
We're seeing some timeouts from starting the db cleaner, e.g. https://github.com/coder/internal/issues/1026
My suspicion is that in CI the go build cache might not be warm, and so it can take a while to compile and run the dbcleaner subprocess.
This fix builds the cleaner once prior to starting a test run via `make test` to ensure we have a warm cache.
## Description
Send a notification to the workspace owner when an AI task’s app state
becomes `Working` or `Idle`.
An AI task is identified by a workspace build with `HasAITask = true`
and `AITaskSidebarAppID` matching the agent app’s ID.
## Changes
* Add `TemplateTaskWorking` notification template.
* Add `TemplateTaskIdle` notification template.
* Add `GetLatestWorkspaceAppStatusesByAppID` SQL query to get the
workspace app statuses ordered by latest first.
* Update `PATCH /workspaceagents/me/app-status` to enqueue:
* `TemplateTaskWorking` when state transitions to `working`
* `TemplateTaskIdle` when state transitions to `idle`
* Notification labels include:
* `task`: task initial prompt
* `workspace`: workspace name
* Notification dedupe: include a minute-bucketed timestamp (UTC
truncated to the minute) in the enqueue data to allow identical content
to resend within the same day (but not more than once per minute).
Closes: https://github.com/coder/coder/issues/19776
Fixes https://github.com/coder/internal/issues/1035
Or, at least, closes a remaining race that seems pretty likely.
The tests in question write a file, close the file, then execute the file. Sometimes Linux errors saying "text file busy" which means the file is still open for writing.
What I think is going on is:
1. Test_sshConfigProxyCommandEscape goroutine opens the file and begins writing.
2. Some other, unrelated test execs a command, which causes a `fork()` syscall. The child process now has a copy of the file descriptor to our open file.
3. Test_sshConfigProxyCommandEscape goroutine executes the file and gets "text file busy".
4. The child process calls the `exec` syscall, which closes the file (due to `CLOEXEC` being set).
The race is very tight because 3 has to happen before 4 (and, 3 involves it's own fork/exec), but it's not impossible on a busy system.
c.f. #14233 which was an earlier attempt to fix this. It only prevented the subtests from running in parallel. When the subtests were all running in parallel, the flake was fairly likely because you've got all this fork() activity happening at the same time. But, since the main test was in parallel there is still a chance a totally different test is `fork`'ing at in inopportune time.
# Add Composite API Key Scopes
This PR adds high-level composite API key scopes to simplify token creation with common permission sets:
- `coder:workspaces.create` - Create and update workspaces
- `coder:workspaces.operate` - Read and update workspaces
- `coder:workspaces.delete` - Read and delete workspaces
- `coder:workspaces.access` - Read, SSH, and connect to workspace applications
- `coder:templates.build` - Read templates and create/read files
- `coder:templates.author` - Full template management with insights
- `coder:apikeys.manage_self` - Manage your own API keys
These composite scopes are persisted in the database and expanded during authorization, providing a more intuitive way to grant permissions compared to the granular resource:action scopes.
v0.41.0 seems to have a bug where it passes nil for tool definitions
instead of an empty map like it used to.
Signed-off-by: Danny Kopping <danny@coder.com>
Closes https://github.com/coder/internal/issues/268
Wraps the assertions in a `testutil.Eventually` so that hopefully any
transient timing issues resolve themselves. If this does not resolve the
issue, we may need to plumb through some kind of `chan struct{}` into
`api.Entitlements.Update()`
resolves#15451
> Solution: Selecting days is always be enabled and rounds (up) the
hours to the nearest day. I.e. 25 hours -> 2 days.
tested with 26hrs saved, then toggled to days. result = value changed to
2 days
If you have used AI to produce some or all of this PR, please ensure you
have read our [AI Contribution
guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING)
before submitting.
blink helped
---------
Co-authored-by: Claude <noreply@anthropic.com>
closes#19397
dependency: #19709#19635 covered a large chunk of deprecated `Popover`s which open on
hover, specifically the ones which instantiated `HelpTooltip`. This PR
replaces all of the non-`HelpTooltip` hover-triggered popovers, and
removes the deprecated popover component :)
---------
Co-authored-by: ケイラ <mckayla@hey.com>
## Summary
In this pull request we're removing `agent_name` from subdomains in APP
urls when an `app` is used in the subdomain. `agent_names` will still be
used when a `port` is used in the subdomain.
Closes: https://github.com/coder/coder/issues/18485
### Changes
- Updated regex to support an optional agent name
- Added logic to support checking the app slug for a matching port
(e.g., 8080 or 8080s)
### Testing
- Updated all tests to support an optional `agent_name`
Sometimes users can misconfigure the app used for chat. When that
happens, we should make it clear to the user.
<img width="1197" height="727" alt="Screenshot 2025-09-24 at 14 15 12"
src="https://github.com/user-attachments/assets/6afe2c22-e7c3-47d4-8446-76000535a492"
/>
- Handle “chat app not found.”
- Simplify stories.
- Have `TaskAppIframe` handle all task iframes so we don’t need a
separate iframe component for chat.
Since React 19 supports head tags natively, we no longer need to use
`react-helmet`.
---------
Co-authored-by: ケイラ <mckayla@hey.com>
Co-authored-by: Andrew Aquino <dawneraq@gmail.com>
Builds upon https://github.com/coder/coder/pull/19970
I got kinda carried away when I saw the extra stuff we could add in
here, so I went ahead and added it:
* User ID
* Organization IDs
* Roles
This technically duplicates functionality from `coder users show` but I
figure folks may find it useful.
<!--
If you have used AI to produce some or all of this PR, please ensure you have read our [AI Contribution guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING) before submitting.
-->
Publish supported OAuth2 scopes from RBAC external scope names
This PR updates the OAuth2 metadata endpoints to publish the supported scopes from the RBAC external scope names. Previously, the `ScopesSupported` field was empty with a TODO to implement a scope system. Now, both the authorization server metadata and protected resource metadata endpoints return the list of scopes from `rbac.ExternalScopeNames()`.
The tests have been updated to verify that the correct scopes are being returned in the metadata responses.
# Canonicalize API Key Scopes
This PR introduces canonical API key scopes with a `coder:` namespace prefix to avoid collisions with low-level resource:action names. It:
1. Renames special API key scopes in the database:
- `all` → `coder:all`
- `application_connect` → `coder:application_connect`
2. Adds support for a new `scopes` field in the API key creation request, allowing multiple scopes to be specified while maintaining backward compatibility with the singular `scope` field.
3. Updates the API documentation to reflect these changes, including the new endpoint for listing public API key scopes.
4. Ensures backward compatibility by mapping between legacy and canonical scope names in relevant code paths.
# Add support for low-level API key scopes
This PR adds support for fine-grained API key scopes based on RBAC resource:action pairs. It includes:
1. A new endpoint `/api/v2/auth/scopes` to list all public low-level API key scopes
2. Generated constants in the SDK for all public scopes
3. Tests to verify scope validation during token creation
4. Updated API documentation to reflect the expanded scope options
The implementation allows users to create API keys with specific permissions like `workspace:read` or `template:use` instead of only the legacy `all` or `application_connect` scopes.
Fixes#19847
* Improves logic for `exp task status --watch` so that it will also exit
on task idle status.
* Adds workspace agent health to `exp task status` output.
# Add a curated catalog of public RBAC scopes
This PR introduces a curated catalog of public RBAC scopes that are exposed to users. It adds:
- A `publicLowLevel` map in `scopes_catalog.go` that defines which resource:action pairs are user-requestable
- `IsPublicLowLevel()` function to check if a scope is in the public catalog
- `PublicLowLevelScopeNames()` function that returns a sorted list of public scopes
- Tests to verify the catalog entries are valid and properly sorted
- Updated documentation in the check-scopes README to clarify that public scopes should be added to this catalog
This change helps distinguish between internal-only scopes and those that should be exposed to users in the API.
This changes the task get endpoint to omit app statuses for previous
'lifetimes' of a workspace.
It also introduces a [breaking
change](https://github.com/coder/coder/blob/release/2.26/codersdk/aitasks.go#L83)
to bring `TaskStateComplete` in line with
`WorkspaceAppStatusStateComplete`. I can alternatively revert this
change and add a conversion function between the two SDK types.
This addresses a long-standing gripe of mine: to get your logged in
username you would have to do
```bash
coder whoami | awk '{print $9}'
```
This allows you to do:
```
coder whoami -o json | jq -r '.username'
```
or
```
coder whoami -f table -c username
```
I ended up on the Coder Desktop docs page and thought half of it had disappeared, though it was actually tucked away behind a second page. This PR adds a next steps section to the first page that links there, as it seems very easy to miss right now.
relates to https://github.com/coder/internal/issues/912
Adds a new scaletest Runner to generate dynamic parameters load.
A later PR will add the CLI command, including creating the template & version.
Closes#19812
## Problem
> When I try to SSH into my workspace with multiple agents. It does not
provide an intuitive way to do that successfully and instead misguides
by printing wrong instructions.
This PR enhances the error handling to provide suggestions with SSH
commands that users can copy and paste directly.
Before:
```
Encountered an error running "coder ssh", see "coder ssh --help" for more information
error: multiple agents found, please specify the agent name, available agents: [coder dev]
```
After:
```
Encountered an error running "coder ssh", see "coder ssh --help" for more information
error: multiple agents found, please specify the agent name, available agents: [coder dev]
Try running:
$ ssh coder.dogfood.me.coder
$ ssh dev.dogfood.me.coder
```
for #19397
dependency: #19635
This PR specifically covers components which open a popover that's
triggered by a click, rather than a hover.
---------
Co-authored-by: ケイラ <mckayla@hey.com>
# Generate RBAC scope name constants
This PR adds a new generated file `coderd/rbac/scopes_constants_gen.go` that contains typed constants for all RBAC scope names in the format `Scope<Resource><Action>`. For example, `ScopeWorkspaceRead` for the scope "workspace:read".
These constants make it easier to reference specific scopes in code without using string literals, improving type safety and making refactoring easier.
The PR:
- Adds a new template file `scripts/typegen/scopenames.gotmpl`
- Updates the typegen script to support generating scope name constants
- Updates the Makefile to include the new generated file in build targets
Added a script/linter to ensure all `policy.RBACPermissions` entries are part of the `api_key_scope` enumerated in the `coderd/database/dump.sql` file.
Fixes#19846
There is currently an issue with subdomain workspace apps on workspace
proxies, where if you have a workspace proxy wildcard nested beneath the
primary wildcard, cookies from the primary may be sent to the server
before cookies from the proxy specifically.
Currently:
1. Use a subdomain app via the primary proxy `*.coder.corp.com`
a. Client sends no cookies
a. Server does token smuggling flow
a. Server sets a cookie `coder_subdomain_app_session_token` on
`*.coder.corp.com`
a. Server redirects client to reload the page
a. Request should succeed as usual
1. Wait until the primary proxy's session token cookie has expired in
the database (or make it invalid yourself)
1. Use a subdomain app via a separate proxy `*.sydney.coder.corp.com`
a. Client sends `coder_subdomain_app_session_token` cookie from
`*.coder.corp.com`
a. Server validates supplied cookie, it fails because it's expired
a. Server does token smuggling flow
a. Server sets a cookie `coder_subdomain_app_session_token` on
`*.sydney.coder.corp.com`
a. Server redirects client to reload page
a. Client sends BOTH cookies.
a. The server will only process the first cookie it receives, so if the
expired cookie for the primary proxy is sent first the request will end
up in a permanent loop on step b.
The fix is to append `_{hash(wildcard_access_url)}` to the subdomain
cookies as we cannot control browser behavior further. This avoids the
conflict as each proxy will only read it's specific cookie.
## Summary
In this pull request we're adding support for a `tooltip` to the
JetBrains module in the dogfood template. Tooltip support was added to
the JetBrains module in https://github.com/coder/registry/pull/421
### Testing
Added `tooltip` to the JetBrains app in the example `docker` template
and verified that the tooltip appeared in my workspace
<img width="1039" height="560" alt="Screenshot 2025-09-23 at 10 01 52"
src="https://github.com/user-attachments/assets/9277f343-f73e-4fb8-a5cc-145f1aad9725"
/>
This PR adds a readiness wait to OAuth2 metadata endpoint tests to avoid rare races with server startup. Instead of immediately making HTTP requests, the tests now use `testutil.Eventually` to retry the requests until they succeed, with a short interval between attempts. This helps prevent flaky tests that might fail due to timing issues during server initialization.
Fixes: https://github.com/coder/internal/issues/996
As part of converting production code to use the new ClientBuilder, I noticed some dead code that creates a client with a URL for the only purpose of later accessing the URL. This PR removes the cruft.
Refactors the CLI to create the `*codersdk.Client` in the handlers. This is groundwork for changing the `rootCmd.InitClient()` to use the new `ClientOption`s.
It also improves variable locality, scoping the Client to the handler. This makes misuse less likely and reduces the memory allocations to just the command being executed, rather than allocating a Client for every command regardless of whether it is executed.
Adds a GH workflow to start a workspace with a pre-determined template,
perform a first pass over a given GitHub issue, and persist the changes
in a GCS bucket for later refining. Tested locally with `nektos/act`.
Co-authored-by: Mathias Fredriksson <mafredri@gmail.com>
Adds ClientBuilder to build a codersdk.Client. This is a safer pattern than the current usage which modifies properties of the Client after creating it, opening us up to race conditions.
Refactors agentsdk to use the builder.
Bumps
[github.com/brianvoe/gofakeit/v7](https://github.com/brianvoe/gofakeit)
from 7.6.0 to 7.7.1.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="6fcd2f7ef8"><code>6fcd2f7</code></a>
address - alias and keyword updates to better target address</li>
<li><a
href="12b7447d08"><code>12b7447</code></a>
payment - remove redundent check</li>
<li><a
href="de74230681"><code>de74230</code></a>
person - added ein number</li>
<li><a
href="69b8730a1a"><code>69b8730</code></a>
payment - added alias</li>
<li>See full diff in <a
href="https://github.com/brianvoe/gofakeit/compare/v7.6.0...v7.7.1">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the github-actions group with 2 updates:
[chromaui/action](https://github.com/chromaui/action) and
[tj-actions/changed-files](https://github.com/tj-actions/changed-files).
Updates `chromaui/action` from 13.1.4 to 13.2.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="20c7e42e1b"><code>20c7e42</code></a>
v13.2.0</li>
<li><a
href="8c981a1b5e"><code>8c981a1</code></a>
v13.1.5</li>
<li>See full diff in <a
href="d0795df816...20c7e42e1b">compare
view</a></li>
</ul>
</details>
<br />
Updates `tj-actions/changed-files` from
1ac60965030588f3b867cdd4a3900f37ec99970c to
4563c729c555b4141fac99c80f699f571219b836
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/tj-actions/changed-files/blob/main/HISTORY.md">tj-actions/changed-files's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h1><a
href="https://github.com/tj-actions/changed-files/compare/v46.0.5...v47.0.0">47.0.0</a>
- (2025-09-13)</h1>
<h2><!-- raw HTML omitted -->🚀 Features</h2>
<ul>
<li>Add any_added to outputs (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2567">#2567</a>)
(<a
href="c260d49a82">c260d49</a>)
- (Jellyfrog)</li>
</ul>
<h2><!-- raw HTML omitted -->➖ Remove</h2>
<ul>
<li>Commit and push step from build job (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2538">#2538</a>)
(<a
href="be393a9038">be393a9</a>)
- (Tonye Jack)</li>
</ul>
<h2><!-- raw HTML omitted -->🔄 Update</h2>
<ul>
<li>Updated README.md (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2592">#2592</a>)</li>
</ul>
<p>Co-authored-by: github-actions[bot]
<41898282+github-actions[bot]<a
href="https://github.com/users"><code>@users</code></a>.noreply.github.com>
(<a
href="3dbc1e1812">3dbc1e1</a>)
- (github-actions[bot])</p>
<ul>
<li>Updated README.md (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2591">#2591</a>)</li>
</ul>
<p>Co-authored-by: github-actions[bot]
<41898282+github-actions[bot]<a
href="https://github.com/users"><code>@users</code></a>.noreply.github.com>
(<a
href="b1ccff8c08">b1ccff8</a>)
- (github-actions[bot])</p>
<ul>
<li>Updated README.md (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2574">#2574</a>)</li>
</ul>
<p>Co-authored-by: github-actions[bot]
<41898282+github-actions[bot]<a
href="https://github.com/users"><code>@users</code></a>.noreply.github.com>
(<a
href="050a3d3360">050a3d3</a>)
- (github-actions[bot])</p>
<h2><!-- raw HTML omitted -->📚 Documentation</h2>
<ul>
<li>Update link to glob patterns (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2590">#2590</a>)
(<a
href="a892f50f7a">a892f50</a>)
- (Tonye Jack)</li>
<li>Add Jellyfrog as a contributor for code, and doc (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2573">#2573</a>)
(<a
href="f000a9b97f">f000a9b</a>)
- (allcontributors[bot])</li>
</ul>
<h2><!-- raw HTML omitted -->🧪 Testing</h2>
<ul>
<li>Manual triggered workflows (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2637">#2637</a>)
(<a
href="c2ca249319">c2ca249</a>)
- (Tonye Jack)</li>
</ul>
<h2><!-- raw HTML omitted -->⚙️ Miscellaneous Tasks</h2>
<ul>
<li><strong>deps-dev:</strong> Bump jest from 30.0.5 to 30.1.3 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2655">#2655</a>)
(<a
href="9a6755550a">9a67555</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump tj-actions/git-cliff from 2.1.0 to 2.2.0
(<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2660">#2660</a>)
(<a
href="b67e30df88">b67e30d</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump github/codeql-action from 3.30.2 to
3.30.3 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2661">#2661</a>)
(<a
href="62aef422ff">62aef42</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump github/codeql-action from 3.29.11 to
3.30.2 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2659">#2659</a>)
(<a
href="e874f3cddd">e874f3c</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump actions/setup-node from 4.4.0 to 5.0.0
(<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2656">#2656</a>)
(<a
href="8c14441336">8c14441</a>)
- (dependabot[bot])</li>
<li><strong>deps-dev:</strong> Bump <code>@types/node</code> from
24.3.0 to 24.3.1 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2657">#2657</a>)
(<a
href="e995ac4be5">e995ac4</a>)
- (dependabot[bot])</li>
<li><strong>deps-dev:</strong> Bump <code>@types/node</code> from
24.2.1 to 24.3.0 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2649">#2649</a>)
(<a
href="3b04099b21">3b04099</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump github/codeql-action from 3.29.9 to
3.29.11 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2651">#2651</a>)
(<a
href="e7b6c977e5">e7b6c97</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump tj-actions/git-cliff from 2.0.2 to 2.1.0
(<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2648">#2648</a>)
(<a
href="765d62bc04">765d62b</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump github/codeql-action from 3.29.8 to
3.29.9 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2647">#2647</a>)
(<a
href="2036da178f">2036da1</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump github/codeql-action from 3.29.7 to
3.29.8 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2644">#2644</a>)
(<a
href="239aef84a5">239aef8</a>)
- (dependabot[bot])</li>
<li><strong>deps-dev:</strong> Bump <code>@types/node</code> from
24.2.0 to 24.2.1 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2645">#2645</a>)
(<a
href="a7d5f5f491">a7d5f5f</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump actions/checkout from 4.2.2 to 5.0.0 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2646">#2646</a>)
(<a
href="5107f3abcc">5107f3a</a>)
- (dependabot[bot])</li>
<li><strong>deps-dev:</strong> Bump <code>@types/node</code> from
24.1.0 to 24.2.0 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2640">#2640</a>)
(<a
href="f963b3f356">f963b3f</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump actions/download-artifact from 4.3.0 to
5.0.0 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2641">#2641</a>)
(<a
href="f956744105">f956744</a>)
- (dependabot[bot])</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="4563c729c5"><code>4563c72</code></a>
chore(deps-dev): bump <code>@types/node</code> from 24.4.0 to 24.5.2
(<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2669">#2669</a>)</li>
<li><a
href="257f3acedc"><code>257f3ac</code></a>
chore(deps-dev): bump <code>@types/uuid</code> from 10.0.0 to 11.0.0
(<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2668">#2668</a>)</li>
<li><a
href="cac596ed08"><code>cac596e</code></a>
chore(deps-dev): bump <code>@vercel/ncc</code> from 0.38.3 to 0.38.4
(<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2670">#2670</a>)</li>
<li><a
href="4fb6914af9"><code>4fb6914</code></a>
chore(deps-dev): bump ts-jest from 29.4.1 to 29.4.3 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2671">#2671</a>)</li>
<li><a
href="2371aa7cd2"><code>2371aa7</code></a>
chore(deps-dev): bump <code>@types/node</code> from 24.3.1 to 24.4.0
(<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2664">#2664</a>)</li>
<li>See full diff in <a
href="1ac6096503...4563c729c5">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
relates to https://github.com/coder/internal/issues/927
Refactors dbtestutil to use a `Broker` struct to create test databases. Additionally uses a `coder_testing` database to record test databases that are created and when they are dropped.
This is in preparation for the PR above this in the stack which adds a "cleaner" subprocess that cleans out any databases that were left when the test process ends.
Relates to https://github.com/coder/internal/issues/889
The existing implementation for exposing read and written bytes was a little awkward - we're going to be adding a bunch of scaletest runners / load generators that *don't* transfer any bytes. This PR has the scaletest reports expose a map of arbitrary string-keyed metrics instead.
FWIW, the latest iteration of the scaletesting infrastructure doesn't parse these reports right now - they're just logged to stdout, so we're good to break the json schema here.
Closes https://github.com/coder/internal/issues/985
Simple refactor of the user creation logic into it's own test runner. This lets us create users independently of workspaces, for use in a bunch of load generators, including the Coder Connect load generator.
This PR creates the new runner, and has the existing `createworkspaces` runner use it.
Relates to https://github.com/coder/internal/issues/985.
Some scaletest runners would autogenerate names if they weren't supplied on the config, while others required a name be supplied, and a name was autogenerated in the CLI command handler. This PR unifies the runners to make names and emails optional on each config, and generate them in the scaletest runner if omitted.
The create user runner in the PR above in the stack will do this too.
Move `ACTIVE_BUILD_STATUSES` constant from `WorkspacesPage.tsx` to a
module to break the circular dependency between `WorkspacesPage.tsx` and
`BatchUpdateModalForm.tsx`. This resolves the circular dependency lint
error and ensures proper code organization.
**Error:**
```
• Circular Dependencies
1) src/pages/WorkspacesPage/WorkspacesPage.tsx -> src/pages/WorkspacesPage/BatchUpdateModalForm.tsx
```
---------
Co-authored-by: Claude <noreply@anthropic.com>
Adds shared_with_user and shared_with_group filters to the /workspaces
endpoint.
- `shared_with_user`: filters workspaces shared with a specific user.
Accepts a user UUID or username.
- `shared_with_group`: filters workspaces shared with a specific group.
Accepts:
- a group UUID, or
- `<organization name>/<group name>`, or
- `<group name>` (resolved in the default organization).
Closes
[coder/internal#1004](https://github.com/coder/internal/issues/1004)
Solves #15575
Adds OAuth access token revocation when unlinking external auth
provider. Due to revocation not being consistently implemented by
providers this is only best effort attempt. Unsuccessful revocation
won't influence link removal.
fixes https://github.com/coder/internal/issues/946
Some tests tear down the server before we are done with PostgreSQL work, and the default `clitest` infrastructure fails the test if any errors like that are thrown. This PR modifies the tests like that to ignore postgreSQL errors like this.
# Update Node.js from 20.19.4 to 22.19.0
This PR updates Node.js from v20.19.4 to v22.19.0 across the codebase. The change includes:
- Updated Node.js version in GitHub Actions setup-node workflow
- Updated Node.js version in the dogfood Dockerfile
- Changed from `pkgs.nodejs_20` to `unstablePkgs.nodejs_22` in the Nix flake
- Updated the Node.js engine version constraints in package.json files to allow Node.js 22
- Updated Playwright from v1.47.0 to v1.50.1
- Updated tzdata dependency from v1.0.44 to v1.0.46
- Updated the flake.lock file with latest nixpkgs references
The PR also improves the error message for Playwright version mismatches by showing the actual versions in the error.
This is a feature to create Role & RoleBinding entries on a per
namespace basis to support deploying workspaces in separate namespace to
where Coder is deployed. The idea behind this is to avoid the creation
of custom RBAC entries or the use of ClusterRoles (in order to maintain
priciple of least privilege).
> If you have used AI to produce some or all of this PR, please ensure
you have read our [AI Contribution
guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING)
before submitting.
This is a blink assisted PR.
Example `helm template` without
`coder.serviceAccount.workspaceNamespaces` enabled (existing behaviour
as of current release) is below. Outcome = 1 x SA, 1 x Role, 1 x
RoleBinding, all in the coder (`.Release.Namespace`) namespace.
```
➜ coder git:(feat/helm_namespace_rbac_improvements) ✗ helm template -n coder coder . --set coder.image.tag=v2.25.1
---
...
---
# Source: coder/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: coder-workspace-perms
namespace: coder
rules:
- apiGroups: [""]
resources: ["pods"]
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- apps
resources:
- deployments
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
---
# Source: coder/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: "coder"
namespace: coder
subjects:
- kind: ServiceAccount
name: "coder"
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: coder-workspace-perms
---
```
Example `helm template` *with*
`coder.serviceAccount.workspaceNamespaces` enabled is below. Outcome = 1
x SA, 1 x Role, 1 x RoleBinding, all in the coder (`.Release.Namespace`)
namespace PLUS a Role and RoleBinding in the `dev-ws` namespace with
each of the RoleBindings referencing the coder SA in the coder
(`.Release.Namespace`) namespace:
```
➜ coder git:(feat/helm_namespace_rbac_improvements) ✗ helm template -n coder coder . --set coder.image.tag=v2.25.1 --set-json 'coder.serviceAccount.workspaceNamespaces=[{"name":"dev-ws","workspacePerms":true,"enableDeployments":true,"extraRules":[]}]'
---
...
---
# Source: coder/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: coder-workspace-perms
namespace: coder
rules:
- apiGroups: [""]
resources: ["pods"]
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- apps
resources:
- deployments
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
---
# Source: coder/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: coder-workspace-perms
namespace: dev-ws
rules:
- apiGroups: [""]
resources: ["pods"]
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- apps
resources:
- deployments
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
---
# Source: coder/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: "coder"
namespace: coder
subjects:
- kind: ServiceAccount
name: "coder"
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: coder-workspace-perms
---
# Source: coder/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: "coder"
namespace: dev-ws
subjects:
- kind: ServiceAccount
name: "coder"
namespace: coder
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: coder-workspace-perms
---
```
Closes https://github.com/coder/coder/issues/18879
Builds on https://github.com/coder/coder/pull/18895
## Changes made
- Deleted `BatchUpdateConfirmation` component, replacing it with
`BatchUpdateModalForm`
- Added stories for the new component, trying to capture every variant I
could think of
## Screenshots
<img width="840" height="1059" alt="image"
src="https://github.com/user-attachments/assets/0fdac28e-19e8-4a14-a20a-fc1fd3758c81"
/>
## Notes
- There's too many problems to list, but look at the issue to see all
the problems we had with the old implementation
- It's definitely helpful to look at the stories to see all the things
the component is meant to cover
Take 2
Closes https://github.com/coder/internal/issues/644
## Changes made
- Updated how `useAgentLogs` was defined to make it easier to inject
specific data dependencies (basically making the hook more
unit-testable)
- Simplified the hook API to limit the amount of scope of data it needs
to work
- Added more test cases, and re-enabled the one test case we had
previously disabled
- Extracted our mock websocket code into a separate file, and added more
methods to it
- Updated all runtime code to accommodate new changes
## Changes made
- Patched React `CSSProperties` type to add support for custom CSS
properties
- Updated several of the components in the `components` directory to
Tailwind
- Updated most of the `WorkspacePageBuildView` component to Tailwind to
account for CSS specificity changes
- Updated `Search` to address accessibility violation and removed all
MUI logic
- Updated `Search` stories (added new story, decoupled all stories from
single decorator)
- Updated `autoFocus` behavior in `SearchField`
- Updated the styling for `WorkspacePageBuildView` to make sure the tabs
had enough padding
- Fixed layout effect in `WorkspacePageBuildView` to fire correctly
I noticed during a scaletest that many warning logs were being generated when enqueuing notifications. The error was:
```
failed to notify of workspace creation: notification is not enabled
```
I don't think we should be warning if automated notifications fail to send to users because they have them disabled.
To fix, we'll stop returning these errors.
Fixes https://github.com/coder/internal/issues/970
The test doesn't wait for `monitor()` to complete, and the mock database call that we assert takes place in a `defer` within `monitor()`. This allows the mock assertions to race with the defer and flake the test.
Solution is to explicitly wait for `monitor()` to complete before the end of the test, so that mock assertions (which happen in a `t.Cleanup()`) don't race.
fixes https://github.com/coder/internal/issues/966
TestCloserStack_Timeout creates `asyncCloser`s which allow control over the exact timing and order of their close method returning. They also, as a final backstop will throw an error if the test context ends before they are unblocked.
TestCloserStack_Timeout unblocks all `asyncCloser`s in a defer and then ends the test. This defer _unblocks_ the running close goroutines, but does not wait for them to finish. Since the test context is canceled as soon as the test completes, this creates a race condition where the close goroutines can trigger the context cancelled arm of the `select` statement.
The fix is to both unblock and wait for all close goroutines to complete before ending the test and cancelling the context.
The slack message will now look something like:
> ❌ CI Failure in main
>
> View failure: Click here
>
> @.Blink Investigate this CI failure. Before starting, use your
workspace to read
da95920805/blink-flake-instructions.md
(The prompt section is stored in a GHA variable so it can be modified
without committing.)
fix a grammar issue.
Added an extra whitespace to the end / expanded the width of the table
to maintain space as adding the one char would have pushed `helps` hard
up against the table edge.
> If you have used AI to produce some or all of this PR, please ensure
you have read our [AI Contribution
guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING)
before submitting.
no AI
Co-authored-by: david-fraley <67079030+david-fraley@users.noreply.github.com>
Hopefully fixes https://github.com/coder/internal/issues/993
```
file path must be absolute: "/test/some/path"
```
Not sure if this is the right fix though, since I am not sure how this
only flakes rather than always failing. It looks like starting with `/`
should not be considered absolute in Windows, but then how did it ever
pass at all?
The input schemas of `coder_workspace_edit_file` and
`coder_workspace_edit_files` were violating the JSON Schemas of both
Anthropic and OpenAI.
Follow-up: we should add a test to ensure future compatibility with
these specs.
Signed-off-by: Danny Kopping <danny@coder.com>
Dynamic parameters are now GA as of v2.25.0, so this PR updates the
troubleshooting section to remove outdated beta references and clarify
current support.
**Changes:**
- Updated "Template variables not showing up" section to remove beta
references
- Clarified that template variables are fully supported in GA version
- Simplified troubleshooting guidance
Fixes the outdated documentation mentioned in the Slack thread.
---------
Co-authored-by: blink-so[bot] <211532188+blink-so[bot]@users.noreply.github.com>
Co-authored-by: bpmct <22407953+bpmct@users.noreply.github.com>
Co-authored-by: david-fraley <67079030+david-fraley@users.noreply.github.com>
Bumps [github.com/gohugoio/hugo](https://github.com/gohugoio/hugo) from
0.149.1 to 0.150.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/gohugoio/hugo/releases">github.com/gohugoio/hugo's
releases</a>.</em></p>
<blockquote>
<h2>v0.150.0</h2>
<p>The big new feature in this relase is the new <code>version</code>
config option on <a
href="https://gohugo.io/configuration/module/#version">Module
imports</a>, which allows you to set the requested module <a
href="https://go.dev/ref/mod#version-queries">version query</a> directly
in your Hugo configuration (e.g. <code>hugo.toml</code>). This is a
feature that have been requested by many, and I (<a
href="https://github.com/bep"><code>@bep</code></a>) was reminded about
it by <a
href="https://discourse.gohugo.io/t/mounting-different-branches-tags-from-the-same-repository/55849/5">this
recent thread</a>, which also outlines a common use case for this:
Mounting multiple old versions/branches of API documentation into the
project.</p>
<h2>What's Changed</h2>
<ul>
<li>build(deps): bump golang.org/x/mod from 0.27.0 to 0.28.0 d1f6a1dc5
<a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]</li>
<li>modules: Add support for direct version module imports in hugo.toml
747cf4ad6 <a href="https://github.com/bep"><code>@bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/13964">#13964</a></li>
<li>resources/page: Fix truncated summary logic d8774d7fc <a
href="https://github.com/jmooring"><code>@jmooring</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/13967">#13967</a>
<a
href="https://redirect.github.com/gohugoio/hugo/issues/13968">#13968</a></li>
<li>config/security: Add PROGRAMDATA to the osenv allowlist 3b8947d82 <a
href="https://github.com/jmooring"><code>@jmooring</code></a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="3f5473b7d4"><code>3f5473b</code></a>
releaser: Bump versions for release of 0.150.0</li>
<li><a
href="d1f6a1dc59"><code>d1f6a1d</code></a>
build(deps): bump golang.org/x/mod from 0.27.0 to 0.28.0</li>
<li><a
href="747cf4ad65"><code>747cf4a</code></a>
modules: Add support for direct version module imports in hugo.toml</li>
<li><a
href="d8774d7fc3"><code>d8774d7</code></a>
resources/page: Fix truncated summary logic</li>
<li><a
href="3b8947d821"><code>3b8947d</code></a>
config/security: Add PROGRAMDATA to the osenv allowlist</li>
<li><a
href="321a66ef19"><code>321a66e</code></a>
releaser: Prepare repository for 0.150.0-DEV</li>
<li>See full diff in <a
href="https://github.com/gohugoio/hugo/compare/v0.149.1...v0.150.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the github-actions group with 3 updates:
[step-security/harden-runner](https://github.com/step-security/harden-runner),
[tj-actions/changed-files](https://github.com/tj-actions/changed-files)
and [github/codeql-action](https://github.com/github/codeql-action).
Updates `step-security/harden-runner` from 2.13.0 to 2.13.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/step-security/harden-runner/releases">step-security/harden-runner's
releases</a>.</em></p>
<blockquote>
<h2>v2.13.1</h2>
<h2>What's Changed</h2>
<ul>
<li>
<p>Graceful handling of HTTP errors: Improved error handling when
fetching Harden Runner policies from the StepSecurity Policy Store API,
ensuring more reliable execution even in case of temporary network/API
issues.</p>
</li>
<li>
<p>Security updates for npm dependencies: Updated vulnerable npm package
dependencies to the latest secure versions.</p>
</li>
<li>
<p>Faster enterprise agent downloads: The enterprise agent is now
downloaded from GitHub Releases instead of packages.stepsecurity.io,
improving download speed and reliability.</p>
</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/step-security/harden-runner/compare/v2.13.0...v2.13.1">https://github.com/step-security/harden-runner/compare/v2.13.0...v2.13.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="f4a75cfd61"><code>f4a75cf</code></a>
Merge pull request <a
href="https://redirect.github.com/step-security/harden-runner/issues/588">#588</a>
from step-security/rc-26</li>
<li><a
href="95503d076c"><code>95503d0</code></a>
ci: remove code-review workflow</li>
<li><a
href="4b250a0739"><code>4b250a0</code></a>
ci: add job to confirm dist is as expected</li>
<li><a
href="5b0ab6abcf"><code>5b0ab6a</code></a>
update dependencies</li>
<li><a
href="d11f2c1d65"><code>d11f2c1</code></a>
fix bug where status code was not being preserved</li>
<li><a
href="b3fc98e4df"><code>b3fc98e</code></a>
improve error handling for policy store sceanrio</li>
<li><a
href="92fc5d4bf7"><code>92fc5d4</code></a>
update error message</li>
<li><a
href="b61b0a4938"><code>b61b0a4</code></a>
policy store improvements</li>
<li><a
href="e3d3f2baea"><code>e3d3f2b</code></a>
use GitHub release instead of packages</li>
<li><a
href="646ac01e72"><code>646ac01</code></a>
update agent</li>
<li>Additional commits viewable in <a
href="ec9f2d5744...f4a75cfd61">compare
view</a></li>
</ul>
</details>
<br />
Updates `tj-actions/changed-files` from
8c14441336bb3d84fd6b7fa83b6d7201c740baf5 to
1ac60965030588f3b867cdd4a3900f37ec99970c
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/tj-actions/changed-files/blob/main/HISTORY.md">tj-actions/changed-files's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h1><a
href="https://github.com/tj-actions/changed-files/compare/v46.0.5...v47.0.0">47.0.0</a>
- (2025-09-13)</h1>
<h2><!-- raw HTML omitted -->🚀 Features</h2>
<ul>
<li>Add any_added to outputs (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2567">#2567</a>)
(<a
href="c260d49a82">c260d49</a>)
- (Jellyfrog)</li>
</ul>
<h2><!-- raw HTML omitted -->➖ Remove</h2>
<ul>
<li>Commit and push step from build job (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2538">#2538</a>)
(<a
href="be393a9038">be393a9</a>)
- (Tonye Jack)</li>
</ul>
<h2><!-- raw HTML omitted -->🔄 Update</h2>
<ul>
<li>Updated README.md (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2592">#2592</a>)</li>
</ul>
<p>Co-authored-by: github-actions[bot]
<41898282+github-actions[bot]<a
href="https://github.com/users"><code>@users</code></a>.noreply.github.com>
(<a
href="3dbc1e1812">3dbc1e1</a>)
- (github-actions[bot])</p>
<ul>
<li>Updated README.md (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2591">#2591</a>)</li>
</ul>
<p>Co-authored-by: github-actions[bot]
<41898282+github-actions[bot]<a
href="https://github.com/users"><code>@users</code></a>.noreply.github.com>
(<a
href="b1ccff8c08">b1ccff8</a>)
- (github-actions[bot])</p>
<ul>
<li>Updated README.md (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2574">#2574</a>)</li>
</ul>
<p>Co-authored-by: github-actions[bot]
<41898282+github-actions[bot]<a
href="https://github.com/users"><code>@users</code></a>.noreply.github.com>
(<a
href="050a3d3360">050a3d3</a>)
- (github-actions[bot])</p>
<h2><!-- raw HTML omitted -->📚 Documentation</h2>
<ul>
<li>Update link to glob patterns (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2590">#2590</a>)
(<a
href="a892f50f7a">a892f50</a>)
- (Tonye Jack)</li>
<li>Add Jellyfrog as a contributor for code, and doc (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2573">#2573</a>)
(<a
href="f000a9b97f">f000a9b</a>)
- (allcontributors[bot])</li>
</ul>
<h2><!-- raw HTML omitted -->🧪 Testing</h2>
<ul>
<li>Manual triggered workflows (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2637">#2637</a>)
(<a
href="c2ca249319">c2ca249</a>)
- (Tonye Jack)</li>
</ul>
<h2><!-- raw HTML omitted -->⚙️ Miscellaneous Tasks</h2>
<ul>
<li><strong>deps-dev:</strong> Bump jest from 30.0.5 to 30.1.3 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2655">#2655</a>)
(<a
href="9a6755550a">9a67555</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump tj-actions/git-cliff from 2.1.0 to 2.2.0
(<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2660">#2660</a>)
(<a
href="b67e30df88">b67e30d</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump github/codeql-action from 3.30.2 to
3.30.3 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2661">#2661</a>)
(<a
href="62aef422ff">62aef42</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump github/codeql-action from 3.29.11 to
3.30.2 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2659">#2659</a>)
(<a
href="e874f3cddd">e874f3c</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump actions/setup-node from 4.4.0 to 5.0.0
(<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2656">#2656</a>)
(<a
href="8c14441336">8c14441</a>)
- (dependabot[bot])</li>
<li><strong>deps-dev:</strong> Bump <code>@types/node</code> from
24.3.0 to 24.3.1 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2657">#2657</a>)
(<a
href="e995ac4be5">e995ac4</a>)
- (dependabot[bot])</li>
<li><strong>deps-dev:</strong> Bump <code>@types/node</code> from
24.2.1 to 24.3.0 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2649">#2649</a>)
(<a
href="3b04099b21">3b04099</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump github/codeql-action from 3.29.9 to
3.29.11 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2651">#2651</a>)
(<a
href="e7b6c977e5">e7b6c97</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump tj-actions/git-cliff from 2.0.2 to 2.1.0
(<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2648">#2648</a>)
(<a
href="765d62bc04">765d62b</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump github/codeql-action from 3.29.8 to
3.29.9 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2647">#2647</a>)
(<a
href="2036da178f">2036da1</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump github/codeql-action from 3.29.7 to
3.29.8 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2644">#2644</a>)
(<a
href="239aef84a5">239aef8</a>)
- (dependabot[bot])</li>
<li><strong>deps-dev:</strong> Bump <code>@types/node</code> from
24.2.0 to 24.2.1 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2645">#2645</a>)
(<a
href="a7d5f5f491">a7d5f5f</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump actions/checkout from 4.2.2 to 5.0.0 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2646">#2646</a>)
(<a
href="5107f3abcc">5107f3a</a>)
- (dependabot[bot])</li>
<li><strong>deps-dev:</strong> Bump <code>@types/node</code> from
24.1.0 to 24.2.0 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2640">#2640</a>)
(<a
href="f963b3f356">f963b3f</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump actions/download-artifact from 4.3.0 to
5.0.0 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2641">#2641</a>)
(<a
href="f956744105">f956744</a>)
- (dependabot[bot])</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="1ac6096503"><code>1ac6096</code></a>
Upgraded to v47 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2663">#2663</a>)</li>
<li><a
href="24d32ffd49"><code>24d32ff</code></a>
upgrade: to node24 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2662">#2662</a>)</li>
<li><a
href="9a6755550a"><code>9a67555</code></a>
chore(deps-dev): bump jest from 30.0.5 to 30.1.3 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2655">#2655</a>)</li>
<li><a
href="b67e30df88"><code>b67e30d</code></a>
chore(deps): bump tj-actions/git-cliff from 2.1.0 to 2.2.0 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2660">#2660</a>)</li>
<li><a
href="62aef422ff"><code>62aef42</code></a>
chore(deps): bump github/codeql-action from 3.30.2 to 3.30.3 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2661">#2661</a>)</li>
<li><a
href="e874f3cddd"><code>e874f3c</code></a>
chore(deps): bump github/codeql-action from 3.29.11 to 3.30.2 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2659">#2659</a>)</li>
<li>See full diff in <a
href="8c14441336...1ac6096503">compare
view</a></li>
</ul>
</details>
<br />
Updates `github/codeql-action` from 3.30.1 to 3.30.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action's
releases</a>.</em></p>
<blockquote>
<h2>v3.30.3</h2>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>3.30.3 - 10 Sep 2025</h2>
<p>No user facing changes.</p>
<p>See the full <a
href="https://github.com/github/codeql-action/blob/v3.30.3/CHANGELOG.md">CHANGELOG.md</a>
for more information.</p>
<h2>v3.30.2</h2>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>3.30.2 - 09 Sep 2025</h2>
<ul>
<li>Fixed a bug which could cause language autodetection to fail. <a
href="https://redirect.github.com/github/codeql-action/pull/3084">#3084</a></li>
<li>Experimental: The <code>quality-queries</code> input that was added
in <code>3.29.2</code> as part of an internal experiment is now
deprecated and will be removed in an upcoming version of the CodeQL
Action. It has been superseded by a new <code>analysis-kinds</code>
input, which is part of the same internal experiment. Do not use this in
production as it is subject to change at any time. <a
href="https://redirect.github.com/github/codeql-action/pull/3064">#3064</a></li>
</ul>
<p>See the full <a
href="https://github.com/github/codeql-action/blob/v3.30.2/CHANGELOG.md">CHANGELOG.md</a>
for more information.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<ul>
<li>We have improved the CodeQL Action's ability to validate that the
workflow it is used in does not use different versions of the CodeQL
Action for different workflow steps. Mixing different versions of the
CodeQL Action in the same workflow is unsupported and can lead to
unpredictable results. A warning will now be emitted from the
<code>codeql-action/init</code> step if different versions of the CodeQL
Action are detected in the workflow file. Additionally, an error will
now be thrown by the other CodeQL Action steps if they load a
configuration file that was generated by a different version of the
<code>codeql-action/init</code> step. <a
href="https://redirect.github.com/github/codeql-action/pull/3099">#3099</a>
and <a
href="https://redirect.github.com/github/codeql-action/pull/3100">#3100</a></li>
<li>We added support for reducing the size of dependency caches for Java
analyses, which will reduce cache usage and speed up workflows. This
will be enabled automatically at a later time. <a
href="https://redirect.github.com/github/codeql-action/pull/3107">#3107</a></li>
</ul>
<h2>3.30.3 - 10 Sep 2025</h2>
<p>No user facing changes.</p>
<h2>3.30.2 - 09 Sep 2025</h2>
<ul>
<li>Fixed a bug which could cause language autodetection to fail. <a
href="https://redirect.github.com/github/codeql-action/pull/3084">#3084</a></li>
<li>Experimental: The <code>quality-queries</code> input that was added
in <code>3.29.2</code> as part of an internal experiment is now
deprecated and will be removed in an upcoming version of the CodeQL
Action. It has been superseded by a new <code>analysis-kinds</code>
input, which is part of the same internal experiment. Do not use this in
production as it is subject to change at any time. <a
href="https://redirect.github.com/github/codeql-action/pull/3064">#3064</a></li>
</ul>
<h2>3.30.1 - 05 Sep 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.23.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3077">#3077</a></li>
</ul>
<h2>3.30.0 - 01 Sep 2025</h2>
<ul>
<li>Reduce the size of the CodeQL Action, speeding up workflows by
approximately 4 seconds. <a
href="https://redirect.github.com/github/codeql-action/pull/3054">#3054</a></li>
</ul>
<h2>3.29.11 - 21 Aug 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.22.4. <a
href="https://redirect.github.com/github/codeql-action/pull/3044">#3044</a></li>
</ul>
<h2>3.29.10 - 18 Aug 2025</h2>
<p>No user facing changes.</p>
<h2>3.29.9 - 12 Aug 2025</h2>
<p>No user facing changes.</p>
<h2>3.29.8 - 08 Aug 2025</h2>
<ul>
<li>Fix an issue where the Action would autodetect unsupported languages
such as HTML. <a
href="https://redirect.github.com/github/codeql-action/pull/3015">#3015</a></li>
</ul>
<h2>3.29.7 - 07 Aug 2025</h2>
<p>This release rolls back 3.29.6 to address issues with language
autodetection. It is identical to 3.29.5.</p>
<h2>3.29.6 - 07 Aug 2025</h2>
<ul>
<li>The <code>cleanup-level</code> input to the <code>analyze</code>
Action is now deprecated. The CodeQL Action has written a limited amount
of intermediate results to the database since version 2.2.5, and now
automatically manages cleanup. <a
href="https://redirect.github.com/github/codeql-action/pull/2999">#2999</a></li>
<li>Update default CodeQL bundle version to 2.22.3. <a
href="https://redirect.github.com/github/codeql-action/pull/3000">#3000</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="192325c861"><code>192325c</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3104">#3104</a>
from github/update-v3.30.3-b660efdcf</li>
<li><a
href="e68956d90b"><code>e68956d</code></a>
Update changelog for v3.30.3</li>
<li><a
href="b660efdcfd"><code>b660efd</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3103">#3103</a>
from github/mbg/fix/category-check</li>
<li><a
href="e49458befe"><code>e49458b</code></a>
Fix <code>runInterpretResultsFor</code> using the wrong
<code>AnalysisConfig</code> for <code>category</code> fix</li>
<li><a
href="f374a62c8b"><code>f374a62</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3098">#3098</a>
from github/kaspersv/increase-overlay-base-size-limit</li>
<li><a
href="5efa438e92"><code>5efa438</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3101">#3101</a>
from github/mbg/public-repo-notice-in-pr-template</li>
<li><a
href="8a84a62542"><code>8a84a62</code></a>
Overlay: Increase size limit for cached overlay base database</li>
<li><a
href="eb50a881d8"><code>eb50a88</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3097">#3097</a>
from github/redsun82/only-dump-sarif</li>
<li><a
href="4c534612bf"><code>4c53461</code></a>
Tweak sarif dump log</li>
<li><a
href="dae3742b0a"><code>dae3742</code></a>
Dump soon to be uploaded SARIF on request</li>
<li>Additional commits viewable in <a
href="f1f6e5f6af...192325c861">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2)
from 1.38.1 to 1.39.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="648027edb8"><code>648027e</code></a>
Release 2025-09-08</li>
<li><a
href="a3b9b7b130"><code>a3b9b7b</code></a>
Regenerated Clients</li>
<li><a
href="67dad834dc"><code>67dad83</code></a>
Update endpoints model</li>
<li><a
href="2bfe86a2ca"><code>2bfe86a</code></a>
Update API model</li>
<li><a
href="59e7410f27"><code>59e7410</code></a>
add businessmetrics feature ID for env-based bearer token (<a
href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/3182">#3182</a>)</li>
<li><a
href="1cdc15880e"><code>1cdc158</code></a>
Patching override s3expire shape (<a
href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/3180">#3180</a>)</li>
<li><a
href="1745ede8f6"><code>1745ede</code></a>
Release 2025-09-05</li>
<li><a
href="f84de5375a"><code>f84de53</code></a>
Regenerated Clients</li>
<li><a
href="7cdaa31849"><code>7cdaa31</code></a>
Update API model</li>
<li><a
href="498b5c42d5"><code>498b5c4</code></a>
remove service/sms (<a
href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/3177">#3177</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/aws/aws-sdk-go-v2/compare/v1.38.1...v1.39.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the x group with 3 updates:
[golang.org/x/crypto](https://github.com/golang/crypto),
[golang.org/x/net](https://github.com/golang/net) and
[golang.org/x/tools](https://github.com/golang/tools).
Updates `golang.org/x/crypto` from 0.41.0 to 0.42.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="5307a0ce6d"><code>5307a0c</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="9d779377cf"><code>9d77937</code></a>
acme: include order problem in OrderError</li>
<li><a
href="8f580defa0"><code>8f580de</code></a>
ssh: remove Go 1.24 build tag for ML-KEM kex</li>
<li><a
href="a4d1237429"><code>a4d1237</code></a>
ssh/knownhosts: improve IPv6 support in Normalize</li>
<li><a
href="b8d8dae13d"><code>b8d8dae</code></a>
curve25519: include potential fips140=only error in panic message</li>
<li><a
href="f5a2eabcab"><code>f5a2eab</code></a>
ssh: use curve25519.X25519 instead of curve25519.ScalarMult</li>
<li><a
href="44ecf3af99"><code>44ecf3a</code></a>
all: upgrade go directive to at least 1.24.0 [generated]</li>
<li>See full diff in <a
href="https://github.com/golang/crypto/compare/v0.41.0...v0.42.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `golang.org/x/net` from 0.43.0 to 0.44.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="3b23d576ea"><code>3b23d57</code></a>
http2: fix race condition when disabling goroutine debugging for one
test</li>
<li><a
href="87410502ff"><code>8741050</code></a>
http2: simplify TestServer_Push_RejectAfterGoAway</li>
<li><a
href="96e405cac1"><code>96e405c</code></a>
http2: modernize TestTransportRoundtripCloseOnWriteError</li>
<li><a
href="6dc6880bcd"><code>6dc6880</code></a>
http2: simplify ClientConn Close and Shutdown tests</li>
<li><a
href="4e2915b652"><code>4e2915b</code></a>
http2: modernize TestTransportAllocationsAfterResponseBodyClose</li>
<li><a
href="30b0e78859"><code>30b0e78</code></a>
http2: modernize TestRoundTripDoesntConsumeRequestBodyEarly</li>
<li><a
href="b9acd777f1"><code>b9acd77</code></a>
http2: speed up TestTransportFlowControl</li>
<li><a
href="5153f4db31"><code>5153f4d</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="9338bdd9ee"><code>9338bdd</code></a>
http2: speed up TestTransportHandlerBodyClose</li>
<li><a
href="6b200364a6"><code>6b20036</code></a>
http2: add synchronous handler support to serverTester</li>
<li>Additional commits viewable in <a
href="https://github.com/golang/net/compare/v0.43.0...v0.44.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `golang.org/x/tools` from 0.36.0 to 0.37.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="d49da96b80"><code>d49da96</code></a>
go/analysis/internal/checker: fix panic due to nil Pass</li>
<li><a
href="9da4f7b448"><code>9da4f7b</code></a>
gopls/internal/test/integration/completion: make test go1.26-robust</li>
<li><a
href="4409ea71cc"><code>4409ea7</code></a>
gopls/internal/server: add telemetry for Zed, Helix clientInfo</li>
<li><a
href="75023ae586"><code>75023ae</code></a>
go/ast/inspector: update outdated documentation</li>
<li><a
href="785cd66cb7"><code>785cd66</code></a>
gopls/internal/test/integration/completion: skip TestFuzzFunc
pre-go1.25</li>
<li><a
href="ac2e4a594c"><code>ac2e4a5</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="bc9374dde1"><code>bc9374d</code></a>
go/callgraph/vta: remove unnecessary use of unsafe</li>
<li><a
href="12d7e15245"><code>12d7e15</code></a>
gopls/internal/analysis/modernize: add test of no gopls imports</li>
<li><a
href="263a769405"><code>263a769</code></a>
gopls/internal/mcp: use official go mcp sdk</li>
<li><a
href="e548c709d4"><code>e548c70</code></a>
gopls/internal/analysis/modernize: fix bad edit in var ( ... ) decl</li>
<li>Additional commits viewable in <a
href="https://github.com/golang/tools/compare/v0.36.0...v0.37.0">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[github.com/brianvoe/gofakeit/v7](https://github.com/brianvoe/gofakeit)
from 7.5.1 to 7.6.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="2122822d4d"><code>2122822</code></a>
datetime - added time and time range</li>
<li><a
href="f98f33cefb"><code>f98f33c</code></a>
category - change time to datetime</li>
<li><a
href="7e975bcbce"><code>7e975bc</code></a>
misc - len and nil check cleanup</li>
<li><a
href="73dfff0115"><code>73dfff0</code></a>
datetime - file rename</li>
<li><a
href="3ee1f294eb"><code>3ee1f29</code></a>
string - fix randomstring lookup output</li>
<li><a
href="fdde0cc092"><code>fdde0cc</code></a>
payment - cvv alias/keyword fix</li>
<li>See full diff in <a
href="https://github.com/brianvoe/gofakeit/compare/v7.5.1...v7.6.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Breaking API Change:
> The presence of the `ip` field on `codersdk.ConnectionLog` cannot be
guaranteed, and so the field has been made optional. It may be omitted
on API responses.
When running a scaletest, I noticed logs of the form:
```
2025-09-12 06:34:10.924 [erro] coderd.workspaceapps: upsert connection log failed trace=0xa17580 span=0xa17620 workspace_id=81b937d7-5777-4df5-b5cb-80241f30326f agent_id=78b2ff6d-b4a6-4a4e-88a7-283e05455a88 app_id=00000000-0000-0000-0000-000000000000 user_id=00000000-0000-0000-0000-000000000000 user_agent="" app_slug_or_port=terminal status_code=404 request_id=67f03cf8-9523-444a-97bc-90de080a54c8 ...
error= 1 error occurred:
* pq: null value in column "ip" of relation "connection_logs" violates not-null constraint
```
to ensure logs are never omitted from the connection log due to a
missing IP again (i.e. I'm not sure if we can always rely on a valid,
parseable, IP from `(http.Request).RemoteAddr`), I've removed the `NOT
NULL` constraint on `ip` on `connection_logs`, and made `ip` on the API
response optional.
The specific cause for these null IPs was the
`/workspaceproxies/me/issue-signed-app-token [post]` endpoint
constructing it's own `http.Request` without a `RemoteAddr` set, and
then passing that to the token issuer.
To solve this, we'll have workspace proxies send the real IP of the
client when calling `/workspaceproxies/me/issue-signed-app-token [post]`
via the header `Coder-Workspace-Proxy-Real-IP`.
## Description
Adds support for sending an ad‑hoc custom notification to the
authenticated user via API and CLI. This is useful for surfacing the
result of scripts or long‑running tasks. Notifications are delivered
through the configured method and the dashboard Inbox, respecting
existing preferences and delivery settings.
## Changes
* New notification template: “Custom Notification” with a label for a
custom title and a custom message.
* New API endpoint: `POST /api/v2/notifications/custom` to send a custom
notification to the requesting user.
* New API endpoint: `GET /notifications/templates/custom` to get custom
notification template.
* New CLI subcommand: `coder notifications custom <title> <message>` to
send a custom notification to the requesting user.
* Documentation updates: Add a “Custom notifications” section under
Administration > Monitoring > Notifications, including instructions on
sending custom notifications and examples of when to use them.
Closes: https://github.com/coder/coder/issues/19611
Relates to: https://github.com/coder/coder/issues/18101
This PR introduces a new `backedpipe` package that provides reliable
bidirectional byte streams over unreliable network connections. The
implementation includes:
- `BackedPipe`: Orchestrates a reader and writer to provide transparent
reconnection and data replay
- `BackedReader`: Handles reading with automatic reconnection, blocking
reads when disconnected
- `BackedWriter`: Maintains a ring buffer of recent writes for replay
during reconnection
- `RingBuffer`: Efficient circular buffer implementation for storing
data
The package enables resilient connections by tracking sequence numbers
and replaying missed data after reconnection. It handles connection
failures gracefully, automatically reconnecting and resuming data
transfer from the appropriate point.
Follows similarly to the bash tool (and some code to connect to an agent
was extracted from it).
There are two main parts: a new agent endpoint, and then a new MCP tool
that consumes that endpoint.
Closes: https://github.com/coder/internal/issues/964
This PR addresses the significant database load issue where the
`GetWorkspaces` query was causing performance problems in the license
entitlements code.
Closes https://github.com/coder/internal/issues/935
This PR enhances the AwaitWorkspaceBuildJobCompleted func in coderdtest
pkg to provide better visibility into test failures and debugging
information.
## Summary
In this pull request we're updating search to support queries with
spaces in addition to the `field:value` pattern that is currently
supported.
Additionally templates search now defaults to `display_name` (since
`display_name` is optional the search will fallback to `name`) when
searching without the `field:value` pattern
Closes: https://github.com/coder/coder/issues/14384
### Downsides with searching on `name` and `display_name`
Because the `name` field cannot include spaces, we end up in a situation
where including a space in the query will result in no results since the
query searches on both `name` AND `display_name`. In the following
example, we can see the results of searching by both `name` and
`display_name` on these templates:
| Name | Display Name |
| ------ | ------------- |
| docker | Docker Template |
| faketemplate | A Fake Template |
| azure | Fake Azure Template |
| anotherfake | Another Fake Template |
| azurefake | Another Fake Fake Azure Template |
https://github.com/user-attachments/assets/b0e0793e-e77d-46bc-9a42-d7cf4f8bd910
### Proposal: Search on `display_name` by default and allow for `name`
using the `field:value` pattern
If we remove `name` from the default template search, we're now able to
search with spaces on template `display_names`. Since `display_names`
are what users see in the templates list they might expect the search to
work this way.
Below is an example of `name` being removed from the default template
search.
https://github.com/user-attachments/assets/9aba5911-4960-4384-befb-08ea1acaa3ab
With this approach users would still be able to search on template names
by specifying `exact_name:foo`.
### Testing
Added additional test cases to ensure spaces were handled as expected in
combination with `field:value` patterns.
for #19397
Currently there are 24 files that import bindings from the deprecated
`Popover` component. One of those is `HelpTooltip`, which is
instantiated in 24 other files. After this PR, the remaining files that
import the deprecated `Popover` should be able to be migrated in just
1-2 more PRs. 🤞🏽
I opted for `Tooltip` as a replacement because it's triggered on hover,
unlike our new `Popover` which is triggered on click.
Closes https://github.com/coder/internal/issues/885
Adds a new database method GetProvisionerJobByIDWithLock that uses FOR
UPDATE without SKIP LOCKED to fix workspace build cancellation returning
500 errors when jobs are locked.
Update OAuth2 metadata endpoint routes to support path suffixes
This PR updates the OAuth2 metadata endpoint routes to include a wildcard character (*) at the end of the paths. This change allows the endpoints to match requests with path suffixes, making our OAuth2 discovery implementation more flexible and compliant with the relevant RFCs.
The updated routes are:
- `/.well-known/oauth-authorization-server*` for RFC 8414 discovery
- `/.well-known/oauth-protected-resource*` for RFC 9728 discovery
Bumps [github.com/gohugoio/hugo](https://github.com/gohugoio/hugo) from
0.148.1 to 0.149.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/gohugoio/hugo/releases">github.com/gohugoio/hugo's
releases</a>.</em></p>
<blockquote>
<h2>v0.149.1</h2>
<p>The main motivation behind this release is the <a
href="https://groups.google.com/g/golang-announce/c/PtW9VW21NPs/m/DJhMQ-m5AQAJ">Go
1.25.1</a> upgrade, which comes with a <a
href="https://redirect.github.com/golang/go/issues/75054">security
fix</a>. Hugo does not use the feature in question, but we understand
that many Hugo users like to have a clean security report.</p>
<h2>Note</h2>
<p>Note that CSS minification now targets CSS3, removing certain
optimizations that were specific to CSS2.</p>
<h2>What's Changed</h2>
<ul>
<li>Remove noindex meta tag from alias.html 25c0f2408 <a
href="https://github.com/lzap"><code>@lzap</code></a></li>
<li>Fix nilpointer on ToC heading 4f2d2b2cc <a
href="https://github.com/bep"><code>@bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/11843">#11843</a></li>
<li>tpl/collections: Require collections.D args to be ints b8eb45c9d <a
href="https://github.com/bep"><code>@bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/13952">#13952</a></li>
<li>Upgrade to Go 1.25.1 1d90afff1 <a
href="https://github.com/bep"><code>@bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/13960">#13960</a></li>
<li>Fix config env handling for some slice options e751afa9b <a
href="https://github.com/PikachuTW"><code>@PikachuTW</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/13950">#13950</a></li>
<li>minifiers: Update deprecation handling a09b8a60e <a
href="https://github.com/jmooring"><code>@jmooring</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/11893">#11893</a>
<a
href="https://redirect.github.com/gohugoio/hugo/issues/13947">#13947</a>
<a
href="https://redirect.github.com/gohugoio/hugo/issues/13948">#13948</a></li>
</ul>
<h2>v0.149.0</h2>
<blockquote>
<p>[!NOTE]<br />
If running on Netlify, make sure you have configured your build with
their latest build image, see <a
href="https://redirect.github.com/gohugoio/hugo/issues/13942#issuecomment-3228959652">this
issue</a>.</p>
</blockquote>
<p>Hugo <code>v0.149.0</code> comes with bug fixes and a set of new
features/improvements, notably:</p>
<ul>
<li>We now build with the recently released <a
href="https://tip.golang.org/doc/go1.25">Go 1.25</a></li>
<li>A new <a
href="https://gohugo.io/functions/collections/d/">collections.D</a>
template function that generates random sequences of integers using J.
S. Vitter’s Method D, by some called <a
href="https://getkerf.wordpress.com/2016/03/30/the-best-algorithm-no-one-knows-about/">The
Best Algorithm No One Knows About</a>.</li>
<li>Two new <a
href="https://gohugo.io/configuration/permalinks/#tokens">permalinks
tokens</a>, <code>:sectionslug</code> and <code>:sectionslugs</code>,
especially useful in multilingual Hugo projects.</li>
<li>A new <code>--omitClassComments</code> flag on <code>hugo gen
chromastyles</code></li>
<li>Several improvements to how ToC from Markdown gets rendered, see <a
href="https://redirect.github.com/gohugoio/hugo/issues/13401">#13401</a>
and <a
href="https://redirect.github.com/gohugoio/hugo/issues/12605">#12605</a>.</li>
<li>A new <code>format</code> option in <a
href="https://gohugo.io/functions/transform/unmarshal/">transform.Unmarshal</a></li>
</ul>
<h2>Note</h2>
<ul>
<li>Remove test with deprecated path usage 80e973ea5 <a
href="https://github.com/bep"><code>@bep</code></a></li>
</ul>
<h2>Bug fixes</h2>
<ul>
<li>create: Fix new content command with future dates bb4e66cd7 <a
href="https://github.com/justuswilhelm"><code>@justuswilhelm</code></a>
<a
href="https://redirect.github.com/gohugoio/hugo/issues/12599">#12599</a></li>
<li>Fix server rebuild when adding a new leaf bundle with resources in
one go 13b43e611 <a href="https://github.com/bep"><code>@bep</code></a>
<a
href="https://redirect.github.com/gohugoio/hugo/issues/13925">#13925</a></li>
<li>Fix rebuild when deleting a content adapter file 87e100e61 <a
href="https://github.com/bep"><code>@bep</code></a></li>
</ul>
<h2>Improvements</h2>
<ul>
<li>tpl/collections: Add an integration test for collections.D 84b512391
<a href="https://github.com/bep"><code>@bep</code></a></li>
<li>tpl/collections: Add collections.D using Vitter's Method D for
sequential random sampling 1ba80874e <a
href="https://github.com/bep"><code>@bep</code></a></li>
<li>commands: Deprecate --omitEmpty on chromastyles command 61ec7a20a <a
href="https://github.com/bep"><code>@bep</code></a></li>
<li>commands: Add --omitClassComments to the chromastyles command
c289fcaaa <a href="https://github.com/bep"><code>@bep</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="57a784e027"><code>57a784e</code></a>
releaser: Bump versions for release of 0.149.1</li>
<li><a
href="25c0f2408a"><code>25c0f24</code></a>
Remove noindex meta tag from alias.html</li>
<li><a
href="4f2d2b2cc4"><code>4f2d2b2</code></a>
Fix nilpointer on ToC heading</li>
<li><a
href="b8eb45c9df"><code>b8eb45c</code></a>
tpl/collections: Require collections.D args to be ints</li>
<li><a
href="1d90afff1b"><code>1d90aff</code></a>
Upgrade to Go 1.25.1</li>
<li><a
href="e751afa9bd"><code>e751afa</code></a>
Fix config env handling for some slice options</li>
<li><a
href="a09b8a60eb"><code>a09b8a6</code></a>
minifiers: Update deprecation handling</li>
<li><a
href="0071b47b8b"><code>0071b47</code></a>
Update README.md</li>
<li><a
href="70d62993ee"><code>70d6299</code></a>
releaser: Prepare repository for 0.150.0-DEV</li>
<li><a
href="66240338f1"><code>6624033</code></a>
releaser: Bump versions for release of 0.149.0</li>
<li>Additional commits viewable in <a
href="https://github.com/gohugoio/hugo/compare/v0.148.1...v0.149.1">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [github.com/zclconf/go-cty](https://github.com/zclconf/go-cty)
from 1.16.3 to 1.17.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/zclconf/go-cty/releases">github.com/zclconf/go-cty's
releases</a>.</em></p>
<blockquote>
<h2>v1.17.0</h2>
<p><code>cty</code> now requires Go 1.23 or later.</p>
<ul>
<li>
<p><code>cty.Value.Elements</code> offers a modern
<code>iter.Seq2</code>-based equivalent of
<code>cty.Value.ElementIterator</code>.</p>
</li>
<li>
<p><code>cty.DeepValues</code> offers a modern
<code>iter.Seq2</code>-based equivalent of <code>cty.Walk</code>.</p>
</li>
<li>
<p><code>cty.Value.WrangleMarksDeep</code> allows inspecting and
modifying individual marks throughout a possibly-nested data
structure.</p>
<p>Having now got some experience using marks more extensively in some
callers, it's become clear that it's often necessary for different
subsystems to be able to collaborate using independent marks without
upsetting each other's assumptions. Today that tends to be achieved
using hand-written transforms either with <code>cty.Transform</code> or
<code>cty.Value.UnmarkDeepWithPaths</code>/<code>cty.Value.MarkWithPaths</code>,
both of which can be pretty expensive even in the common case where
there are no marks present at all.</p>
<p>This new function allows inspecting and transforming marks with far
less overhead, by creating new values only for parts of a structure that
actually need to change and by reusing (rather than recreating) the
"payloads" of the values being modified when we know that only
the marks have changed.</p>
</li>
<li>
<p><code>cty.ValueMarksOfType</code> and
<code>cty.ValueMarksOfTypeDeep</code> make it easier to use type-based
rather than value-based mark schemes, where different values of a common
type are used to track a specific kind of relationship with multiple
external values.</p>
</li>
<li>
<p><code>cty.Value.HasMarkDeep</code> provides a "deep"
version of the existing <code>cty.Value.HasMark</code>, searching
throughout a possibly-nested structure for any values that have the
given mark.</p>
</li>
<li>
<p><code>cty.Value.UnmarkDeep</code> and
<code>cty.Value.UnmarkDeepWithPaths</code> are now implemented in terms
of <code>cty.Value.WrangleMarksDeep</code>, so they benefit from its
reduced overhead. In particular they avoid reconstructing a data
structure that contains no marked values at all.</p>
</li>
<li>
<p><code>cty.Value.MarkWithPaths</code> now has a fast path when it's
given a zero-length <code>PathValueMarks</code>, in which case it just
returns the value it was given with no modifications.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/zclconf/go-cty/blob/main/CHANGELOG.md">github.com/zclconf/go-cty's
changelog</a>.</em></p>
<blockquote>
<h1>1.17.0 (September 5, 2025)</h1>
<p><code>cty</code> now requires Go 1.23 or later.</p>
<ul>
<li>
<p><code>cty.Value.Elements</code> offers a modern
<code>iter.Seq2</code>-based equivalent of
<code>cty.Value.ElementIterator</code>.</p>
</li>
<li>
<p><code>cty.DeepValues</code> offers a modern
<code>iter.Seq2</code>-based equivalent of <code>cty.Walk</code>.</p>
</li>
<li>
<p><code>cty.Value.WrangleMarksDeep</code> allows inspecting and
modifying individual marks throughout a possibly-nested data
structure.</p>
<p>Having now got some experience using marks more extensively in some
callers, it's become clear that it's often necessary for different
subsystems to be able to collaborate using independent marks without
upsetting each other's assumptions. Today that tends to be achieved
using hand-written transforms either with <code>cty.Transform</code> or
<code>cty.Value.UnmarkDeepWithPaths</code>/<code>cty.Value.MarkWithPaths</code>,
both of which can be pretty expensive even in the common case where
there are no marks present at all.</p>
<p>This new function allows inspecting and transforming marks with far
less overhead, by creating new values only for parts of a structure that
actually need to change and by reusing (rather than recreating) the
"payloads" of the values being modified when we know that only
the marks have changed.</p>
</li>
<li>
<p><code>cty.ValueMarksOfType</code> and
<code>cty.ValueMarksOfTypeDeep</code> make it easier to use type-based
rather than value-based mark schemes, where different values of a common
type are used to track a specific kind of relationship with multiple
external values.</p>
</li>
<li>
<p><code>cty.Value.HasMarkDeep</code> provides a "deep"
version of the existing <code>cty.Value.HasMark</code>, searching
throughout a possibly-nested structure for any values that have the
given mark.</p>
</li>
<li>
<p><code>cty.Value.UnmarkDeep</code> and
<code>cty.Value.UnmarkDeepWithPaths</code> are now implemented in terms
of <code>cty.Value.WrangleMarksDeep</code>, so they benefit from its
reduced overhead. In particular they avoid reconstructing a data
structure that contains no marked values at all.</p>
</li>
<li>
<p><code>cty.Value.MarkWithPaths</code> now has a fast path when it's
given a zero-length <code>PathValueMarks</code>, in which case it just
returns the value it was given with no modifications.</p>
</li>
</ul>
<h1>1.16.4 (August 20, 2025)</h1>
<ul>
<li><code>cty.UnknownAsNull</code> now accepts marked values and
preserves the given marks in its result. Previously it had no direct
support for marks and so would either panic or return incorrect results
when given marked values.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="da4c600729"><code>da4c600</code></a>
CHANGELOG: Prepare for v1.17.0 release</li>
<li><a
href="b13ddd40b1"><code>b13ddd4</code></a>
cty: Use WrangleMarksDeep for UnmarkDeep and UnmarkDeepWithPaths</li>
<li><a
href="4453ac2b7f"><code>4453ac2</code></a>
cty: Use DeepValues instead of Walk for deep marks inspections</li>
<li><a
href="f833b10b8e"><code>f833b10</code></a>
Bulk replace interface{} -> any</li>
<li><a
href="d4bb9d4fb6"><code>d4bb9d4</code></a>
cty: Various new mark-inspecting helpers</li>
<li><a
href="31572cfc28"><code>31572cf</code></a>
cty+ctymarks: Deep mark wrangling helper</li>
<li><a
href="d95a68cf6b"><code>d95a68c</code></a>
cty: Modern iter.Seq2 equivalents of Value.ElementIterator and Walk</li>
<li><a
href="e76eeea526"><code>e76eeea</code></a>
v1.16.4 release</li>
<li><a
href="700a2bccfe"><code>700a2bc</code></a>
cty: UnknownAsNull accepts marked values and preserves marks</li>
<li><a
href="3c2b6a0e21"><code>3c2b6a0</code></a>
Prepare for future v1.16.4 release</li>
<li>See full diff in <a
href="https://github.com/zclconf/go-cty/compare/v1.16.3...v1.17.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [github.com/moby/moby](https://github.com/moby/moby) from
28.3.0+incompatible to 28.4.0+incompatible.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/moby/moby/releases">github.com/moby/moby's
releases</a>.</em></p>
<blockquote>
<h2>v28.4.0</h2>
<h2>28.4.0</h2>
<p>For a full list of pull requests and changes in this release, refer
to the relevant GitHub milestones:</p>
<ul>
<li><a
href="https://github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.4.0">docker/cli,
28.4.0 milestone</a></li>
<li><a
href="https://github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.4.0">moby/moby,
28.4.0 milestone</a></li>
<li>Deprecated and removed features, see <a
href="https://github.com/docker/cli/blob/v28.4.0/docs/deprecated.md">Deprecated
Features</a>.</li>
<li>Changes to the Engine API, see <a
href="https://github.com/moby/moby/blob/v28.4.0/docs/api/version-history.md">API
version history</a>.</li>
</ul>
<h3>New</h3>
<ul>
<li>Allow Docker CLI to set the <code>GODEBUG</code> environment
variable when the key-value pair
(<code>"GODEBUG":"..."</code>) exists inside the
docker context metadata. <a
href="https://redirect.github.com/docker/cli/pull/6399">docker/cli#6399</a></li>
</ul>
<h3>Bug fixes and enhancements</h3>
<ul>
<li>Add shell completion for <code>docker pull</code> and <code>docker
image pull</code>. <a
href="https://redirect.github.com/docker/cli/pull/6420">docker/cli#6420</a></li>
<li>Fix a regression in v28.3.3 that could cause a panic on <code>docker
push</code> if the client did not send an <code>X-Registry-Auth</code>
header. <a
href="https://redirect.github.com/moby/moby/pull/50738">moby/moby#50738</a></li>
<li>Windows: Potentially fix an issue with "access denied"
error when pulling images. <a
href="https://redirect.github.com/moby/moby/pull/50871">moby/moby#50871</a></li>
<li>containerd image store: Fix <code>docker history</code> failing with
<code>snapshot X does not exist</code> when calling on a non-native
image that was built locally. <a
href="https://redirect.github.com/moby/moby/pull/50875">moby/moby#50875</a></li>
<li>containerd image store: Fix <code>docker image prune</code> to emit
correct <code>untag</code> and <code>delete</code> events and list only
the deleted images root digests instead of every blob. <a
href="https://redirect.github.com/moby/moby/pull/50837">moby/moby#50837</a></li>
<li>Remove interactive login prompt from <code>docker push</code> and
<code>docker pull</code> after a failure caused by missing
authentication. <a
href="https://redirect.github.com/docker/cli/pull/6256">docker/cli#6256</a></li>
</ul>
<h3>Packaging updates</h3>
<ul>
<li>Update BuildKit to <a
href="https://github.com/moby/buildkit/releases/tag/v0.24.0">v0.24.0</a>.
<a
href="https://redirect.github.com/moby/moby/pull/50888">moby#50888</a></li>
<li>Update Go runtime to <a
href="https://go.dev/doc/devel/release#go1.24.6">1.24.7</a>. <a
href="https://redirect.github.com/moby/moby/pull/50889">moby/moby#50889</a>,
<a
href="https://redirect.github.com/docker/cli/pull/6422">docker/cli#6422</a></li>
<li>Update <code>runc</code> to <a
href="https://github.com/opencontainers/runc/releases/tag/v1.3.0">v1.3.0</a>.
<a
href="https://redirect.github.com/moby/moby/pull/50699">moby/moby#50699</a></li>
<li>Update containerd (static binaries only) to <a
href="https://github.com/containerd/containerd/releases/tag/v1.7.28">v1.7.28</a>.
<a
href="https://redirect.github.com/moby/moby/pull/50700">moby/moby#50700</a></li>
</ul>
<h3>Networking</h3>
<ul>
<li>Fix an issue that could cause slow container restart on
live-restore. <a
href="https://redirect.github.com/moby/moby/pull/50829">moby/moby#50829</a></li>
</ul>
<h3>API</h3>
<ul>
<li>Update deprecation message for <code>AuthConfig.Email</code> field.
<a
href="https://redirect.github.com/moby/moby/pull/50797">moby/moby#50797</a></li>
</ul>
<h3>Go SDK</h3>
<ul>
<li>Deprecate profiles package which got migrated to <a
href="https://github.com/moby/profiles">github.com/moby/profiles</a>. <a
href="https://redirect.github.com/moby/moby/pull/50513">moby/moby#50513</a></li>
</ul>
<h3>Deprecations</h3>
<ul>
<li>Deprecate special handling for quoted values for the
<code>--tlscacert</code>, <code>--tlscert</code>, and
<code>--tlskey</code> command-line flags. <a
href="https://redirect.github.com/docker/cli/pull/6291">docker/cli#6291</a></li>
<li>Mark legacy links env vars
(<code>DOCKER_KEEP_DEPRECATED_LEGACY_LINKS_ENV_VARS</code>) as
deprecated in v28.4 and set for removal in v30.0. <a
href="https://redirect.github.com/docker/cli/pull/6309">docker/cli#6309</a></li>
<li>Go-SDK: Deprecate field <code>NetworkSettingsBase.Bridge</code>,
struct <code>NetworkSettingsBase</code>, all the fields of
<code>DefaultNetworkSettings</code>, and struct
<code>DefaultNetworkSettings</code>. <a
href="https://redirect.github.com/moby/moby/pull/50839">moby/moby#50839</a></li>
<li>Go-SDK: api/types: <code>build.CacheDiskUsage</code>,
<code>container.DiskUsage</code>, <code>images.DiskUsage</code> and
<code>volumes.DiskUsage</code> are now deprecated and will be removed in
the next major release. <a
href="https://redirect.github.com/moby/moby/pull/50768">moby/moby#50768</a></li>
<li>Go-SDK: cli-plugins/manager: deprecate <code>ReexecEnvvar</code>. <a
href="https://redirect.github.com/docker/cli/pull/6411">docker/cli#6411</a></li>
<li>Go-SDK: cli-plugins/manager: deprecate annotation aliases
(<code>CommandAnnotationPlugin</code>,
<code>CommandAnnotationPluginVendor</code>,
<code>CommandAnnotationPluginVersion</code>,
<code>CommandAnnotationPluginInvalid</code>,
<code>CommandAnnotationPluginCommandPath</code>) in favor of their
equivalent in <code>cli-plugins/manager/metadata</code>. <a
href="https://redirect.github.com/docker/cli/pull/6298">docker/cli#6298</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="249d679a6b"><code>249d679</code></a>
Merge pull request <a
href="https://redirect.github.com/moby/moby/issues/50890">#50890</a>
from vvoland/50889-28.x</li>
<li><a
href="d664cfe139"><code>d664cfe</code></a>
update to go1.24.7</li>
<li><a
href="b384cd2a45"><code>b384cd2</code></a>
Merge pull request <a
href="https://redirect.github.com/moby/moby/issues/50888">#50888</a>
from vvoland/50885-28.x</li>
<li><a
href="c1ce88e7f8"><code>c1ce88e</code></a>
vendor: update buildkit to v0.24.0</li>
<li><a
href="4a34e8e9f6"><code>4a34e8e</code></a>
Merge pull request <a
href="https://redirect.github.com/moby/moby/issues/50875">#50875</a>
from vvoland/50867-28.x</li>
<li><a
href="cfa70d073e"><code>cfa70d0</code></a>
gha/arm64: Setup qemu</li>
<li><a
href="d70382e442"><code>d70382e</code></a>
integration/internal: Print Buildkit logs</li>
<li><a
href="687b206c6b"><code>687b206</code></a>
c8d/history: Fix non-native platforms</li>
<li><a
href="e4224f86c0"><code>e4224f8</code></a>
integration/internal: Handle Buildkit in GetImageIDFromBody</li>
<li><a
href="5d5332b00c"><code>5d5332b</code></a>
Merge pull request <a
href="https://redirect.github.com/moby/moby/issues/50871">#50871</a>
from vvoland/50870-28.x</li>
<li>Additional commits viewable in <a
href="https://github.com/moby/moby/compare/v28.3.0...v28.4.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the x group with 6 updates:
| Package | From | To |
| --- | --- | --- |
| [golang.org/x/mod](https://github.com/golang/mod) | `0.27.0` |
`0.28.0` |
| [golang.org/x/oauth2](https://github.com/golang/oauth2) | `0.30.0` |
`0.31.0` |
| [golang.org/x/sync](https://github.com/golang/sync) | `0.16.0` |
`0.17.0` |
| [golang.org/x/sys](https://github.com/golang/sys) | `0.35.0` |
`0.36.0` |
| [golang.org/x/term](https://github.com/golang/term) | `0.34.0` |
`0.35.0` |
| [golang.org/x/text](https://github.com/golang/text) | `0.28.0` |
`0.29.0` |
Updates `golang.org/x/mod` from 0.27.0 to 0.28.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="1759e969da"><code>1759e96</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="f060e16ef6"><code>f060e16</code></a>
all: upgrade go directive to at least 1.24.0 [generated]</li>
<li>See full diff in <a
href="https://github.com/golang/mod/compare/v0.27.0...v0.28.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `golang.org/x/oauth2` from 0.30.0 to 0.31.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="014cf778b4"><code>014cf77</code></a>
all: upgrade go directive to at least 1.24.0 [generated]</li>
<li><a
href="3c76ce5d23"><code>3c76ce5</code></a>
endpoints: correct Naver OAuth2 endpoint URLs</li>
<li>See full diff in <a
href="https://github.com/golang/oauth2/compare/v0.30.0...v0.31.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `golang.org/x/sync` from 0.16.0 to 0.17.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="04914c200c"><code>04914c2</code></a>
all: upgrade go directive to at least 1.24.0 [generated]</li>
<li>See full diff in <a
href="https://github.com/golang/sync/compare/v0.16.0...v0.17.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `golang.org/x/sys` from 0.35.0 to 0.36.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="b06ce0514e"><code>b06ce05</code></a>
windows: add FILE_ZERO_DATA_INFORMATION</li>
<li><a
href="689cc11b26"><code>689cc11</code></a>
unix: fix Listen on solaris</li>
<li><a
href="a4712b9054"><code>a4712b9</code></a>
plan9: drop go version tags for unsupported versions</li>
<li><a
href="0293703b0a"><code>0293703</code></a>
unix: add IFAL_* consts and ifaddrlblmsg on linux</li>
<li><a
href="ab85cbbe91"><code>ab85cbb</code></a>
unix/linux: extend rtnetlink constants</li>
<li><a
href="9bd37534d8"><code>9bd3753</code></a>
unix: switch (*CPUSet).Zero to clear builtin</li>
<li><a
href="899c23279d"><code>899c232</code></a>
windows/mkwinsyscall: use syscall.SyscallN instead of
syscall.Syscall{6,9,12,15}</li>
<li><a
href="543f21a056"><code>543f21a</code></a>
all: upgrade go directive to at least 1.24.0 [generated]</li>
<li>See full diff in <a
href="https://github.com/golang/sys/compare/v0.35.0...v0.36.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `golang.org/x/term` from 0.34.0 to 0.35.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="1a11b45a6f"><code>1a11b45</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="d862cd548e"><code>d862cd5</code></a>
all: upgrade go directive to at least 1.24.0 [generated]</li>
<li>See full diff in <a
href="https://github.com/golang/term/compare/v0.34.0...v0.35.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `golang.org/x/text` from 0.28.0 to 0.29.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="e69f31bf9c"><code>e69f31b</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="60c9786d9e"><code>60c9786</code></a>
all: upgrade go directive to at least 1.24.0 [generated]</li>
<li>See full diff in <a
href="https://github.com/golang/text/compare/v0.28.0...v0.29.0">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[github.com/anthropics/anthropic-sdk-go](https://github.com/anthropics/anthropic-sdk-go)
from 1.4.0 to 1.11.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-go/releases">github.com/anthropics/anthropic-sdk-go's
releases</a>.</em></p>
<blockquote>
<h2>v1.11.0</h2>
<h2>1.11.0 (2025-09-05)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-go/compare/v1.10.0...v1.11.0">v1.10.0...v1.11.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> adds support for Documents in tool results (<a
href="7161c2ce98">7161c2c</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>client:</strong> fix issue in Go with nested document
content params (<a
href="b442cc3fd4">b442cc3</a>)</li>
<li>use release please annotations on more places (<a
href="31a09b0799">31a09b0</a>)</li>
</ul>
<h2>v1.10.0</h2>
<h2>1.10.0 (2025-09-02)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-go/compare/v1.9.1...v1.10.0">v1.9.1...v1.10.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> makes 1 hour TTL Cache Control generally
available (<a
href="c28a9a3272">c28a9a3</a>)</li>
<li><strong>client:</strong> adds support for code-execution-2025-08-26
tool (<a
href="066a126a92">066a126</a>)</li>
<li>use custom decoder for []ContentBlockParamUnion (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-go/issues/464">#464</a>)
(<a
href="4731597924">4731597</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>close body before retrying (<a
href="c970e10ff4">c970e10</a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li>deprecate older claude-3-5 sonnet models (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-go/issues/453">#453</a>)
(<a
href="e49d59b14b">e49d59b</a>)</li>
</ul>
<h2>v1.9.1</h2>
<h2>1.9.1 (2025-08-12)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-go/compare/v1.9.0...v1.9.1">v1.9.0...v1.9.1</a></p>
<h2>v1.9.0</h2>
<h2>1.9.0 (2025-08-12)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-go/compare/v1.8.0...v1.9.0">v1.8.0...v1.9.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>betas:</strong> add context-1m-2025-08-07 (<a
href="c086118c9a">c086118</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-go/blob/main/CHANGELOG.md">github.com/anthropics/anthropic-sdk-go's
changelog</a>.</em></p>
<blockquote>
<h2>1.11.0 (2025-09-05)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-go/compare/v1.10.0...v1.11.0">v1.10.0...v1.11.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> adds support for Documents in tool results (<a
href="7161c2ce98">7161c2c</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>client:</strong> fix issue in Go with nested document
content params (<a
href="b442cc3fd4">b442cc3</a>)</li>
<li>use release please annotations on more places (<a
href="31a09b0799">31a09b0</a>)</li>
</ul>
<h2>1.10.0 (2025-09-02)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-go/compare/v1.9.1...v1.10.0">v1.9.1...v1.10.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> makes 1 hour TTL Cache Control generally
available (<a
href="c28a9a3272">c28a9a3</a>)</li>
<li><strong>client:</strong> adds support for code-execution-2025-08-26
tool (<a
href="066a126a92">066a126</a>)</li>
<li>use custom decoder for []ContentBlockParamUnion (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-go/issues/464">#464</a>)
(<a
href="4731597924">4731597</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>close body before retrying (<a
href="c970e10ff4">c970e10</a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li>deprecate older claude-3-5 sonnet models (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-go/issues/453">#453</a>)
(<a
href="e49d59b14b">e49d59b</a>)</li>
</ul>
<h2>1.9.1 (2025-08-12)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-go/compare/v1.9.0...v1.9.1">v1.9.0...v1.9.1</a></p>
<h2>1.9.0 (2025-08-12)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-go/compare/v1.8.0...v1.9.0">v1.8.0...v1.9.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>betas:</strong> add context-1m-2025-08-07 (<a
href="c086118c9a">c086118</a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li><strong>internal:</strong> detect breaking changes when removing
endpoints (<a
href="91ea519764">91ea519</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="7182eab5e7"><code>7182eab</code></a>
release: 1.11.0</li>
<li><a
href="b90d70029a"><code>b90d700</code></a>
fix(client): fix issue in Go with nested document content params</li>
<li><a
href="cc676e4666"><code>cc676e4</code></a>
feat(api): adds support for Documents in tool results</li>
<li><a
href="c93b7cd87f"><code>c93b7cd</code></a>
fix: use release please annotations on more places</li>
<li><a
href="92995ec5b5"><code>92995ec</code></a>
release: 1.10.0</li>
<li><a
href="0663f951e5"><code>0663f95</code></a>
feat(client): adds support for code-execution-2025-08-26 tool</li>
<li><a
href="90eb81bfbb"><code>90eb81b</code></a>
feat: use custom decoder for []ContentBlockParamUnion (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-go/issues/464">#464</a>)</li>
<li><a
href="2f2b92cd98"><code>2f2b92c</code></a>
fix: close body before retrying</li>
<li><a
href="722cf6bed0"><code>722cf6b</code></a>
codegen metadata</li>
<li><a
href="1cea167dfa"><code>1cea167</code></a>
codegen metadata</li>
<li>Additional commits viewable in <a
href="https://github.com/anthropics/anthropic-sdk-go/compare/v1.4.0...v1.11.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This change adds a support-index for `GetAPIKeysLastUsedAfter`.
On dogfood (24h): called 4.4k times, 380ms average.
Change for tested time range: `170ms` -> `3.3ms`.
Fixescoder/internal#724
This change adds an index to optimize the
`GetProvisionerDaemonsWithStatusByOrganization` query.
Execution time dropped from `18s 838ms` to `107ms`.
We run an additional test suite with the latest major version of Postgres. Until now, it hasn't been required that this suite pass before merging, prior discussion available [here](https://github.com/coder/coder/pull/13665#discussion_r1654933195).
Making it required also means we'll receive slack notifications when it fails on `main`.
Closes https://github.com/coder/internal/issues/961
Likely the same deal as in #19599, the body of `require.Eventually` now fires immediately, when it used to fire after 250ms (the interval). Presumably, the deployment stats become ready before the vs code session count gets incremented. This was never an issue with the 250ms delay, as this flake has only cropped up after the testify version bump.
We'll fix the issue by making it possible to wait for a full metrics cache refresh, i.e. removing `require.Eventually` in this test altogether.
When clients disconnected from the /containers/watch endpoint, the WebSocket
connection between coderd and the agent stayed open. This caused heartbeat
traffic every 15s that was incorrectly counted as workspace activity,
extending workspace lifetimes indefinitely.
Now properly cancels the agent connection context when the client disconnects.
Adds a `sharing add` command for sharing Workspaces with other users and
groups.
The command allows sharing with multiple users, and groups within one
command as well as specifying the role (`use`, or `admin`) defaulting to
`use` if none is specified.
In the current implementation when the command completes we show the
user the current state of the workspace ACL.
```
$ coder sharing add apricot-catfish-86 --user=member:admin --group=contractors:use
USER GROUP ROLE
member - admin
member contractors use
```
If a user is a part of multiple groups, or the workspace has been
individually shared with them they will show up multiple times. Although
this is a bit confusing at first glance it's important to be able to
tell what the maximum role a user may have, and via what ACL they have
it.
---
One piece of UX to consider is that in order to be able to share a
Workspace with a user they must have a role that can read that user. In
the tests we give the user the `ScopedRoleOrgAuditor` role.
Closes
[coder/internal#859](https://github.com/coder/internal/issues/859)
see https://github.com/coder/internal/issues/959 but the tl; dr is:
- we call this DB query on an interval (every 15s) and it would be
called on each coderd replica as well
- the generated values update very infrequently (for our most used
internal template I saw the builds created/claimed update twice in a 1h
period)
- we have no index on the initiator ID, so this query has to scan the
entire workspace_builds table on every request
In reality this should likely just be a Prometheus metric, and
Prometheus can handle the counter reset behaviour at query time, but for
now this should at least cut the load of the query to 25% of it's
current impact.
---------
Signed-off-by: Callum Styan <callumstyan@gmail.com>
I noticed that our docs mention the possibility of using the
Tailscale-managed DERP server fleet.
https://github.com/coder/coder/pull/15901 changed the phrasing from
> However, Tailscale has graciously allowed us to use
to
> However, our Wireguard integration through Tailscale has graciously
allowed us to use
This change alters the original meaning of the sentence. AFAIK, the
original meant that we contacted Tailscale directly and asked if it
would be ok for our customers to use the Tailscale-managed DERP server
fleet, and Tailscale graciously agreed. The new phrasing conveys
something different. This PR reverts the phrasing to the original.
---------
Co-authored-by: david-fraley <67079030+david-fraley@users.noreply.github.com>
In trying to address confusion with the `-` (for stdin) directory flag last year, I had `template push` read from stdin if stdin was not a TTY. However, I made the mistake of checking if the directory flag was set or not by comparing it to the default value. This meant in something like GitHub Actions, where you don't have a TTY for stdin, it was impossible to read from the current working directory. The fix is just to check if the flag was explicitly set, using pflags.
If users encounter this bug, and this fix is unavailable in their version of Coder, they can workaround it by setting `-d "$(pwd)"`
This PR improves the ruleguard rule for detecting `t.Fail` calls in goroutines. It picks up additional violations, of which are fixed in this PR.
See self-review for details.
The motivation for fixing this comes from a flake I fixed in https://github.com/coder/coder/pull/19599, where tests would fail from a `require` in an `Eventually`.
The latest release of all `pg_dump` major versions, going back to 13,
started inserting `\restrict` `\unrestrict` keywords into dumps. This
currently breaks sqlc in `gen/dump` and our check migration script. Full
details of the postgres change are available here:
https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=575f54d4c
To fix, we'll always use the `pg_dump` in our postgres 13.21 docker
image for schema dumps, instead of what's on the runner/local machine.
Coder doesn't restore from postgres dumps, so we're not vulnerable to
attacks that would be patched by the latest postgres version.
Regardless, we'll unpin ASAP.
Once sqlc is updated to handle these keywords, we need to start
stripping them when comparing the schema in the migration check script,
and then we can unpin the pg_dump version. This is being tracked at
https://github.com/coder/internal/issues/965
Updated toolsdk documentation link to the latest version.
If you have used AI to produce some or all of this PR, please ensure you
have read our [AI Contribution
guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING)
before submitting.
fixes https://github.com/coder/internal/issues/958
Logging was being done at error level, but most likely any errors are from simple races between an update triggered around the same time as a client disconnecting. Debug is fine for these.
Fixes https://github.com/coder/internal/issues/933
Refactors CLI tests that check the `--auth` flag parsing for various public clouds into a unit test that just creates the agent Client and asserts on the type.
Testing that the agent client actually authenticates correctly with these auth types is well covered by Coderd tests, so we don't need to retread that ground here, and the deleted tests were flaky on Windows.
Refactors Agent instance identity to be a SessionTokenProvider.
Refactors the CLI to create Agent clients via a centralized function, rather than add-hoc via individual command handlers and their flags.
This allows commands besides `coder agent`, but which still use the agent identity, to support instance identity authentication.
Fixes#19111 by unifying all API requests to go thru the SessionTokenProvider for auth credentials.
Fixes: https://github.com/coder/internal/issues/950
Pretty sure the intention of the `hold` wait group is to try to get the two goroutines that the test starts running at the same time. But, that should be the case for two goroutines started anyway.
The use of `hold` doesn't actually guarantee concurrent execution of `Acquire`, just that both goroutines get as far as `Done()` --- the go scheduler could run them serially without incident.
So I've chosen to just remove the use of `hold` to simplify.
But, for posterity, the data race was due to incrementing by 1 in the loop along with the goroutine that calls Done. You could increment by 1 and then back down to 0 before the second iteration of the loop starts. This then causes a data race with calling `Wait()` in the first goroutine and `Add()` in the second iteration. c.f. https://pkg.go.dev/sync#WaitGroup.Add
Due to how we currently label a workspace as a task, there is a delay
between when a task workspace is created and when it is labelled as a
task.
This PR introduces fallback check for when a workspace does _not_ have
`HasAITask` set. This fallback check tests to see if the special "AI
Prompt" parameter is present in the workspace's build parameters.
* provisionerdserver: Expires prebuild user token for workspace, if it
exists, when regenerating session token.
* dbauthz: disallow prebuilds user from creating api keys
* dbpurge: added functionality to expire stale api keys owned by the
prebuilds user
Relates to https://github.com/coder/internal/issues/893
Instead of `coder task create <template> --input <input>`, it is now
`coder task create <input> --template <template>`.
If there is only one AI task template on the deployment, the
`--template` parameter can be omitted.
A Dependabot PR got blocked by a typo in a 2.10 changelog! I then noticed we're keeping these old changelogs (<= 2.10) around, even though we haven't been updating this directory for many months now.
I'm putting this PR up as I assume we want to delete those, it seems they'd be more confusing to users than anything. They're not referenced on the website nor in the docs manifest.json.
If I'm mistaken, and we do want to keep these, feel free to close this PR.
Got sick of seeing blink create duplicates, so I'm updating the prompt. To make it configurable without committing I'm making it a variable, here's what I've got:
> Investigate this CI failure. Check logs, and figure out what went wrong. Search for existing issues in coder/internal. If an issue for the CI failure does not exist already, create one ONLY in coder/internal. Do NOT create duplicate issues. Use title format \"flake: TestName\" for flaky tests, and assign them to the person from git blame.
If multiple tests fail with the reason `unknown`, the test process exited unexpectedly, perhaps due to a panic.
Once blink supports per-slack-channel contexts, i'll probably just set the variable to the empty string and use that instead.
Bumps
[github.com/brianvoe/gofakeit/v7](https://github.com/brianvoe/gofakeit)
from 7.4.0 to 7.5.1.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="c0093afece"><code>c0093af</code></a>
payment - alias and keyword updates</li>
<li><a
href="521ca8fadc"><code>521ca8f</code></a>
aliases and keywords - completed</li>
<li><a
href="fe7530dc54"><code>fe7530d</code></a>
aliases and keywords - continue to refine</li>
<li><a
href="002a6c57e4"><code>002a6c5</code></a>
work in progress</li>
<li>See full diff in <a
href="https://github.com/brianvoe/gofakeit/compare/v7.4.0...v7.5.1">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This PR should resolve https://github.com/coder/internal/issues/719 by
limiting the `workspace_builds` rows selected by the query to the most
recent 100 builds of a template, as opposed to all builds in the last
30d. For our own internal templates with the most builds (1700-2000 in a
30d period) this should cut the query execution time by about 80%.
Unless we have some restriction on keeping the 30d period, contract
related or otherwise, this seems like a safe change to make. In addition
to the execution speed improvements it also means the memory for the
query is bounded as well.
If we want to keep a 30d time period for the avg build time value I
think it's worth exploring a purpose built solution such as histogram
structures where the build times could be bucketized by template ID as
they're observed.
---------
Signed-off-by: Callum Styan <callumstyan@gmail.com>
This test still flakes occasionally, see
https://github.com/coder/internal/issues/954#issuecomment-3237154735
The cause appears to be related to the assignment of `time.Now()` as the
`LastSeenAt` time when creating a provisioner which can flake with the
calculated scheduled next autostart and the code to set then
`require.Eventually` the updated provisioner LastSeenAt.
Instead we should simply calculate all time values for the stale portion
of the test based on the provisioners LastSeenAt value to avoid such
issues.
Signed-off-by: Callum Styan <callumstyan@gmail.com>
- Removes GetManagedAgentCount query
- Adds new table `usage_events_daily` which stores aggregated usage
events by the type and UTC day
- Adds trigger to update the values in this table when a new row is
inserted into `usage_events`
- Adds a migration that adds `usage_events_daily` rows for existing data
in `usage_events`
- Adds tests for the trigger
- Adds tests for the backfill query in the migration
Since the `usage_events` table is unreleased currently, this migration
will do nothing on real deployments and will only affect preview
deployments such as dogfood.
Closes https://github.com/coder/internal/issues/943
## Description
When creating a prebuilt workspace, both `flags.IsPrebuild` and
`flags.IsFirstBuild` are true. Previously, the logic rejected cases with
multiple flags, so `coderd_workspace_creation_duration_seconds` wasn’t
updated for prebuilt creations. This is the only valid scenario where
two flags can be true.
## Changes
* Fix logic to update `coderd_workspace_creation_duration_seconds`
metric for prebuilt workspaces.
* Add prebuild helper functions to coderdenttest (other prebuild tests
can reuse this).
* Update workspace's provisionerdmetric tests to include this metric.
Follow-up: https://github.com/coder/coder/pull/19503
Related to: https://github.com/coder/coder/issues/19528
Previously, if you had a new license that would start before the current
one fully expired, you would get a warning. Now, the license validity
periods are merged together, and a warning is only generated based on
the end of the current contiguous period of license coverage.
Closes#19498
Coder Tasks requires us to create a workspace, but we want to be able to
return a `codersdk.Task` instead of a `codersdk.Workspace`. This
requires untangling `createWorkspace` from directly writing to
`http.ResponseWriter`.
Refactors `codersdk.Client`'s use of session tokens to use a `SessionTokenProvider`, which abstracts the obtaining and storing of the session token.
The main motiviation is to unify Agent authentication an an upstack PR, which can use cloud instance identity via token exchange, rather than a fixed session token.
However, the abstraction could also allow functionality like obtaining the session token from other external sources like the OS credential manager, or an external secret/key management system like Vault.
Relates to https://github.com/coder/internal/issues/888
As part of our renewed connection scaletesting efforts, we want to
scaletest coder in a scenario where direct connections aren't available
(relatively common for our customers), and all concurrent connections
are relayed via DERP.
This PR adds a flag, `--disable-direct` that can be included on the
existing`coder exp scaletest workspace-traffic -ssh` to disable direct
connections.
# Update dependencies: Tailscale and xz compression library
This PR updates two dependencies:
- Bumps our fork of Tailscale from
`v1.1.1-0.20250729141742-067f1e5d9716` to
`v1.1.1-0.20250829055033-3536204c8d21`
- Updates the xz compression library from `v0.5.12` to `v0.5.15`
The flake here had two causes:
1. related to usage of time.Now() in MustWaitForProvisionersAvailable
and
2. the fact that UpdateProvisionerLastSeenAt can not use a time that is
further in the past than the current LastSeenAt time
Previously the test here was calling
`coderdtest.MustWaitForProvisionersAvailable` which was using `time.Now`
rather than the next tick time like the real `hasProvisionersAvailable`
function does. Additionally, when using `UpdateProvisionerLastSeenAt`
the underlying db query enforces that the time we're trying to set
`LastSeenAt` to cannot be older than the current value.
I was able to reliably reproduce the flake by executing both the
`UpdateProvisionerLastSeenAt` call and `tickCh <- next` in their own
goroutines, the former with a small sleep to reliably ensure we'd
trigger the autobuild before we set the `LastSeenAt` time. That's when I
also noticed that `coderdtest.MustWaitForProvisionersAvailable` was
using `time.Now` instead of the tick time. When I updated that function
to take in a tick time + added a 2nd call to
`UpdateProvisionerLastSeenAt` to set an original non-stale time, we
could then never get the test to pass because the later call to set the
stale time would not actually modify `LastSeenAt`. On top of that,
calling the provisioner daemons closer in the middle of the function
doesn't really do anything of value in this test.
**The fix for the flake is to keep the go routines, ensuring there would
be a flake if there was not a relevant fix, but to include the fix which
is to ensure that we explicitly wait for the provisioner to be stale
before passing the time to `tickCh`.**
---------
Signed-off-by: Callum Styan <callumstyan@gmail.com>
Addresses comment raised on previous PR
https://github.com/coder/coder/pull/19619#discussion_r2307943410
We know we can skip sub agents when searching for which agent is related
to the task, as this is not an explicitly supported feature at the
moment. When we come to properly setting up a Task -> Agent relationship
this limitation will be dropped.
The coder-login module was recently updated to set environment variables
instead of running `coder login`.
This unfortunately broke `develop.sh`:
```
Encountered an error running "coder login", see "coder login --help" for more information
error: Trace=[create api key: ]
```
Unsetting these env vars so that they do not interfere.
Closes https://github.com/coder/internal/issues/949
Adds the following fields to `codersdk.Task`
- OwnerName
- TemplateName
- TemplateDisplayName
- TemplateIcon
- WorkspaceAgentID
- WorkspaceAgentLifecycle
- WorkspaceAgentHealth
The implementation is unfortunately not compatible with multiple agents
as we have no reliable way to tell which agent has the AI task running
in it. For now we just pick the first agent found, but in the future
this will need to be changed.
This pull request makes a minor update to an external documentation link
in the `OverviewPageView` component. The change ensures that users are
directed to the correct reference section for CLI server experiments.
* Updated the `href` attribute in the documentation link to point to
`https://coder.com/docs/reference/cli/server#--experiments` instead of
the previous URL, improving the accuracy of the reference for users.
## Description
This PR introduces one counter and two histograms related to workspace
creation and claiming. The goal is to provide clearer observability into
how workspaces are created (regular vs prebuild) and the time cost of
those operations.
### `coderd_workspace_creation_total`
* Metric type: Counter
* Name: `coderd_workspace_creation_total`
* Labels: `organization_name`, `template_name`, `preset_name`
This counter tracks whether a regular workspace (not created from a
prebuild pool) was created using a preset or not.
Currently, we already expose `coderd_prebuilt_workspaces_claimed_total`
for claimed prebuilt workspaces, but we lack a comparable metric for
regular workspace creations. This metric fills that gap, making it
possible to compare regular creations against claims.
Implementation notes:
* Exposed as a `coderd_` metric, consistent with other workspace-related
metrics (e.g. `coderd_api_workspace_latest_build`:
https://github.com/coder/coder/blob/main/coderd/prometheusmetrics/prometheusmetrics.go#L149).
* Every `defaultRefreshRate` (1 minute ), DB query
`GetRegularWorkspaceCreateMetrics` is executed to fetch all regular
workspaces (not created from a prebuild pool).
* The counter is updated with the total from all time (not just since
metric introduction). This differs from the histograms below, which only
accumulate from their introduction forward.
### `coderd_workspace_creation_duration_seconds` &
`coderd_prebuilt_workspace_claim_duration_seconds`
* Metric types: Histogram
* Names:
* `coderd_workspace_creation_duration_seconds`
* Labels: `organization_name`, `template_name`, `preset_name`, `type`
(`regular`, `prebuild`)
* `coderd_prebuilt_workspace_claim_duration_seconds`
* Labels: `organization_name`, `template_name`, `preset_name`
We already have `coderd_provisionerd_workspace_build_timings_seconds`,
which tracks build run times for all workspace builds handled by the
provisioner daemon.
However, in the context of this issue, we are only interested in
creation and claim build times, not all transitions; additionally, this
metric does not include `preset_name`, and adding it there would
significantly increase cardinality. Therefore, separate more focused
metrics are introduced here:
* `coderd_workspace_creation_duration_seconds`: Build time to create a
workspace (either a regular workspace or the build into a prebuild pool,
for prebuild initial provisioning build).
* `coderd_prebuilt_workspace_claim_duration_seconds`: Time to claim a
prebuilt workspace from the pool.
The reason for two separate histograms is that:
* Creation (regular or prebuild): provisioning builds with similar time
magnitude, generally expected to take longer than a claim operation.
* Claim: expected to be a much faster provisioning build.
#### Native histogram usage
Provisioning times vary widely between projects. Using static buckets
risks unbalanced or poorly informative histograms.
To address this, these metrics use [Prometheus native
histograms](https://prometheus.io/docs/specs/native_histograms/):
* First introduced in Prometheus v2.40.0
* Recommended stable usage from v2.45+
* Requires Go client `prometheus/client_golang` v1.15.0+
* Experimental and must be explicitly enabled on the server
(`--enable-feature=native-histograms`)
For compatibility, we also retain a classic bucket definition (aligned
with the existing provisioner metric:
https://github.com/coder/coder/blob/main/provisionerd/provisionerd.go#L182-L189).
* If native histograms are enabled, Prometheus ingests the
high-resolution histogram.
* If not, it falls back to the predefined buckets.
Implementation notes:
* Unlike the counter, these histograms are updated in real-time at
workspace build job completion.
* They reflect data only from the point of introduction forward (no
historical backfill).
## Relates to
Closes: https://github.com/coder/coder/issues/19528
Native histograms tested in observability stack:
https://github.com/coder/observability/pull/50
The previous logic verified a generated name was valid, _and then
appended a suffix to it_. This was flawed as it would allow a 32
character name, and then append an extra 5 characters to it.
Instead we now append the suffix _and then_ verify it is valid.
We've successfully migrated the latest iteration of our scaletest
infrastructure (`scaletest/terraform/action`) to
https://github.com/coder/scaletest (private repo). This PR removes the
older iterations, and the scriptsfor spinning up & running the load
generators against that infrastructure (`scaletest.sh`). The tooling for
generating load against a Coder deployment remains untouched, as does
the public documentation for that tooling (i.e. `coder exp scaletest`).
If we ever need that old scaletest Terraform code, it's always in the
git history!
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2)
from 1.30.2 to 1.31.3.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="e1909a587c"><code>e1909a5</code></a>
Release 2025-08-26</li>
<li><a
href="2dead49460"><code>2dead49</code></a>
Regenerated Clients</li>
<li><a
href="8f87507c4d"><code>8f87507</code></a>
Update endpoints model</li>
<li><a
href="9f13166e6c"><code>9f13166</code></a>
Update API model</li>
<li><a
href="92833dd046"><code>92833dd</code></a>
drop opsworks and opsworkscm (<a
href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/3172">#3172</a>)</li>
<li><a
href="50d1314f18"><code>50d1314</code></a>
Release 2025-08-25.2</li>
<li><a
href="d163c8cb48"><code>d163c8c</code></a>
Deprecate opsworks/opsworkscm (<a
href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/3171">#3171</a>)</li>
<li><a
href="f0a97a78c2"><code>f0a97a7</code></a>
Release 2025-08-25</li>
<li><a
href="3b73a3be84"><code>3b73a3b</code></a>
Regenerated Clients</li>
<li><a
href="9c6a548460"><code>9c6a548</code></a>
Update endpoints model</li>
<li>Additional commits viewable in <a
href="https://github.com/aws/aws-sdk-go-v2/compare/v1.30.2...config/v1.31.3">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This PR reverts github.com/mark3labs/mcp-go to 0.32.0, which was the
version used by https://github.com/coder/coder/pull/18670 that
introduced MCP HTTP support in Coder, and ensures dependabot doesn't
upgrade it automatically.
A bug has been introduced in a recent version of mcp-go that causes some
HTTP MCP requests to fail with the error message
```
[erro] coderd.mcp: Failed to handle sampling response: no active session found for session mcp-session-e3cb7333-284f-46bd-a009-d611f1b690f6
```
The bug may be related to this issue:
https://github.com/mark3labs/mcp-go/issues/554.
closes https://github.com/coder/coder/issues/18274
This pull request makes system users visible in various group related
queries so that they can be added to and removed from groups. This
allows system user quotas to be configured. System users are still
ignored in certain queries, such as when license seat consumption is
determined.
This pull request further ensures the existence of a
"coder_prebuilt_workspaces" group in any organization that needs
prebuilt workspaces
---------
Co-authored-by: Susana Ferreira <susana@coder.com>
Quick fix for following issue in CLI:
```
$ go run ./cmd/coder exp task list
Encountered an error running "coder exp task list", see "coder exp task list --help" for more information
error: Trace=[list tasks: ]
Internal error fetching task prompts and states.
workspace 14d548f4-aaad-40dd-833b-6ffe9c9d31bc is not an AI task workspace
exit status 1
```
This occurs in a short time window directly after creating a new task.
I took a stab at writing a test for this, but ran out of time. I'm not
entirely sure what causes non-AI-task workspaces to be returned in the
query but I suspect it's when a workspace build is pending or running.
Closes https://github.com/coder/internal/issues/942
The flakey test, `RemoteForwardUnixSocket`, was using `netstat` to check if the unix socket was forwarded properly. In the flake, it looks like netstat was hanging. This PR has `RemoteForwardUnixSocket` be rewritten to match the implementation of `RemoteForwardMultipleUnixSockets`, where we send bytes over the socket in-process instead. More importantly, that test hasn't flaked (yet).
Note: The implementation has been copied directly from the other test, comments and all.
Fix https://github.com/coder/internal/issues/826
I wasn't able to recreate the flake, but my underlying assumption (from
reading the logs we have) is that there is a race condition where the
test will begin cleanup before the dev container recreation goroutine
has a chance to call `devcontainer up`.
I've refactored the test slightly and made it so that the test will not
finish until either the context has timed out, or `Up` has been called.
This works around the issue where a task may "disappear" on stop.
Re-using the previous value of `has_ai_task` and `sidebar_app_id` on a
stop transition.
---------
Co-authored-by: Mathias Fredriksson <mafredri@gmail.com>
2025-08-27 10:33:17 +01:00
1354 changed files with 86370 additions and 30504 deletions
If you have used AI to produce some or all of this PR, please ensure you have read our [AI Contribution guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING) before submitting.
echo "deb [signed-by=/usr/share/keyrings/helm.gpg] https://packages.buildkite.com/helm-linux/helm-debian/any/ any main" | sudo tee /etc/apt/sources.list.d/helm-stable-debian.list
curl -X POST -H 'Content-type: application/json' \
--data '{
"blocks": [
@@ -1625,23 +1543,6 @@ jobs:
"emoji": true
}
},
{
"type": "section",
"fields": [
{
"type": "mrkdwn",
"text": "*Workflow:*\n'"${GITHUB_WORKFLOW}"'"
},
{
"type": "mrkdwn",
"text": "*Committer:*\n'"${GITHUB_ACTOR}"'"
},
{
"type": "mrkdwn",
"text": "*Commit:*\n'"${GITHUB_SHA}"'"
}
]
},
{
"type": "section",
"text": {
@@ -1653,7 +1554,7 @@ jobs:
"type": "section",
"text": {
"type": "mrkdwn",
"text": "<@U08TJ4YNCA3> investigate this CI failure. Check logs, search for existing issues, use git blame to find who last modified failing tests, create issue in coder/internal (not public repo), use title format \"flake: TestName\" for flaky tests, and assign to the person from git blame."
curl -X POST -H 'Content-type: application/json' \
--data '{
"blocks": [
@@ -181,23 +182,6 @@ jobs:
"emoji": true
}
},
{
"type": "section",
"fields": [
{
"type": "mrkdwn",
"text": "*Workflow:*\n'"${GITHUB_WORKFLOW}"'"
},
{
"type": "mrkdwn",
"text": "*Committer:*\n'"${GITHUB_ACTOR}"'"
},
{
"type": "mrkdwn",
"text": "*Commit:*\n'"${GITHUB_SHA}"'"
}
]
},
{
"type": "section",
"text": {
@@ -209,7 +193,7 @@ jobs:
"type": "section",
"text": {
"type": "mrkdwn",
"text": "<@U08TJ4YNCA3> investigate this CI failure. Check logs, search for existing issues, use git blame to find who last modified failing tests, create issue in coder/internal (not public repo), use title format \"flake: TestName\" for flaky tests, and assign to the person from git blame."
You are an experienced, pragmatic software engineer. You don't over-engineer a solution when a simple one is possible.
Rule #1: If you want exception to ANY rule, YOU MUST STOP and get explicit permission first. BREAKING THE LETTER OR SPIRIT OF THE RULES IS FAILURE.
## Foundational rules
- Doing it right is better than doing it fast. You are not in a rush. NEVER skip steps or take shortcuts.
- Tedious, systematic work is often the correct solution. Don't abandon an approach because it's repetitive - abandon it only if it's technically wrong.
- Honesty is a core value.
## Our relationship
- Act as a critical peer reviewer. Your job is to disagree with me when I'm wrong, not to please me. Prioritize accuracy and reasoning over agreement.
- YOU MUST speak up immediately when you don't know something or we're in over our heads
- YOU MUST call out bad ideas, unreasonable expectations, and mistakes - I depend on this
- NEVER be agreeable just to be nice - I NEED your HONEST technical judgment
- NEVER write the phrase "You're absolutely right!" You are not a sycophant. We're working together because I value your opinion. Do not agree with me unless you can justify it with evidence or reasoning.
- YOU MUST ALWAYS STOP and ask for clarification rather than making assumptions.
- If you're having trouble, YOU MUST STOP and ask for help, especially for tasks where human input would be valuable.
- When you disagree with my approach, YOU MUST push back. Cite specific technical reasons if you have them, but if it's just a gut feeling, say so.
- If you're uncomfortable pushing back out loud, just say "Houston, we have a problem". I'll know what you mean
- We discuss architectutral decisions (framework changes, major refactoring, system design) together before implementation. Routine fixes and clear implementations don't need discussion.
## Proactiveness
When asked to do something, just do it - including obvious follow-up actions needed to complete the task properly.
Only pause to ask for confirmation when:
- Multiple valid approaches exist and the choice matters
- The action would delete or significantly restructure existing code
- You genuinely don't understand what's being asked
- Your partner asked a question (answer the question, don't jump to implementation)
NEVER use `time.Sleep` to mitigate timing issues. If an issue
seems like it should use `time.Sleep`, read through https://github.com/coder/quartz and specifically the [README](https://github.com/coder/quartz/blob/main/README.md) to better understand how to handle timing issues.
## 🎯 Code Style
## Code Style
### Detailed guidelines in imported WORKFLOWS.md
- Follow [Uber Go Style Guide](https://github.com/uber-go/guide/blob/master/style.md)
# Count the number of test databases created per test package.
count-test-databases:
PGPASSWORD=postgres psql -h localhost -U postgres -d coder_testing -P pager=off -c 'SELECT test_package, count(*) as count from test_databases GROUP BY test_package ORDER BY count DESC'
assert.GreaterOrEqualf(t,expected[i].Value,m.GetGauge().GetValue(),"expected %s to be greater than or equal to %f, got %f",expected[i].Name,expected[i].Value,m.GetGauge().GetValue())
assert.NoError(t,expected[i].CheckFn(m.GetGauge().GetValue()),"check fn for %s failed",expected[i].Name)
assert.GreaterOrEqualf(t,expected[i].Value,m.GetCounter().GetValue(),"expected %s to be greater than or equal to %f, got %f",expected[i].Name,expected[i].Value,m.GetCounter().GetValue())
assert.NoError(t,expected[i].CheckFn(m.GetCounter().GetValue()),"check fn for %s failed",expected[i].Name)
t.Logf("update golden file for: %q: %s",goldenName,goldenFile)
err:=os.MkdirAll(filepath.Dir(goldenFile),0o755)
require.NoError(t,err,"want no error creating golden file directory")
err=os.WriteFile(goldenFile,[]byte(dot),0o600)
require.NoError(t,err,"update golden file")
}
expected,err:=os.ReadFile(goldenFile)
require.NoError(t,err,"read golden file, run \"make gen/golden-files\" and commit the changes")
// Normalize line endings for cross-platform compatibility
expected=normalizeLineEndings(expected)
normalizedDot:=normalizeLineEndings([]byte(dot))
assert.Empty(t,cmp.Diff(string(expected),string(normalizedDot)),"golden file mismatch (-want +got): %s, run \"make gen/golden-files\", verify and commit the changes",goldenFile)
}
// normalizeLineEndings ensures that all line endings are normalized to \n.
returnnil,xerrors.Errorf("field %q in type %q is marked as recursive but does not contain a struct or a pointer to a struct",field.Name,fieldType.String())
Short:"Configure the Claude Code server. You will need to run this command for each project you want to use. Specify the project directory as the first argument.",
concurrencyLong,concurrencyEnv,concurrencyDescription:="concurrency","CODER_SCALETEST_CONCURRENCY","Number of concurrent jobs to run. 0 means unlimited."
concurrencyLong,concurrencyEnv,concurrencyDescription:="concurrency","CODER_SCALETEST_CONCURRENCY","Number of concurrent jobs to run. 0 means unlimited."
timeoutLong,timeoutEnv,timeoutDescription:="timeout","CODER_SCALETEST_TIMEOUT","Timeout for the entire test run. 0 means unlimited."
jobTimeoutLong,jobTimeoutEnv,jobTimeoutDescription:="job-timeout","CODER_SCALETEST_JOB_TIMEOUT","Timeout per job. Jobs may take longer to complete under higher concurrency limits."
Short:"Creates many users, then creates a workspace for each user and waits for them finish building and fully come online. Optionally runs a command inside each workspace, and connects to the workspace over WireGuard.",
Long:`It is recommended that all rate limits are disabled on the server before running this scaletest. This test generates many login events which will be rate limited against the (most likely single) IP.`,
Middleware:r.InitClient(client),
Use:"create-workspaces",
Short:"Creates many users, then creates a workspace for each user and waits for them finish building and fully come online. Optionally runs a command inside each workspace, and connects to the workspace over WireGuard.",
Long:`It is recommended that all rate limits are disabled on the server before running this scaletest. This test generates many login events which will be rate limited against the (most likely single) IP.`,
Short:"Generates load on the Coder server evaluating dynamic parameters",
Long:`It is recommended that all rate limits are disabled on the server before running this scaletest. This test generates many login events which will be rate limited against the (most likely single) IP.`,
Handler:func(inv*serpent.Invocation)error{
ctx:=inv.Context()
outputs,err:=output.parse()
iferr!=nil{
returnxerrors.Errorf("could not parse --output flags")
returntemplateAndVersionFoundHandler(t,ctx,organizationID,"my-template","my-template-version","","reads prompt from stdin","task-wild-goldfish-27",codersdk.Me)
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
