main
1092 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Rusty Shackleford
|
538600744d |
feat(rawsync): add authenticated HTTP control plane (#1473)
Adds device-authenticated raw-sync control-plane routes on top of #1459. Active devices can exchange credentials for short-lived scoped tokens, negotiate missing objects within their authenticated tenant, and commit manifests with durable receipts and structured head-conflict state. Raw machine routes authenticate before Host/CORS relaxation, bound credentials and JSON bodies, and derive tenant/device identity server-side. Authentication and route handling share the configured write-timeout budget. Writable PostgreSQL-backed servers wire lazy filesystem custody plus PostgreSQL metadata/auth, while read-only and DDL-restricted runtime roles retain startup behavior and receive routes only when they have the exact required DML privileges. Resumable object upload, enrollment, status, laptop capture, and server derivation remain out of scope. Refs #1352 Co-authored-by: Rusty Shackleford <salmonumbrella@users.noreply.github.com> |
||
|
Wes McKinney
|
61e0e33de5 |
fix(sync): skip offline configured HTTP hosts (#1486)
Configured HTTP fleet members that cannot be reached—or that reset or abort an established connection—no longer make a bare `agentsview sync` fail. The collector reports each host as skipped and continues with local and reachable remote sources. Full and automatic rebuilds retain skipped host namespaces in safety accounting, so an all-offline remote-only archive completes and preserves its remote sessions as orphans. Direct incremental syncs emit the same skipped-host progress message instead of succeeding silently. Explicit `agentsview sync --host X` remains strict. Authentication, protocol, response, cleanup, and import errors also remain failures, so only transport unavailability receives the optional-host behavior. Co-authored-by: Wes McKinney <wesm@users.noreply.github.com> |
||
|
Wes McKinney
|
b66a22d90b |
feat(capture): add exact one-shot usage reporting (#1445)
Adds automation-only usage capture for one exact Claude Code or Codex run, without starting the AgentsView daemon or web services. Child output and exit status pass through normally; canonical token and cost usage goes to a separate versioned JSON file. In GitHub Actions, the capture step is: ```bash agentsview capture run --provider claude \ --occurrence "$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT-$GITHUB_JOB" \ --capture-dir "$RUNNER_TEMP/agentsview-capture" \ --result "$RUNNER_TEMP/agentsview-usage.json" \ -- claude -p "Diagnose the build failure." ``` The next step uploads `agentsview-usage.json` with `actions/upload-artifact`. If reporting was interrupted, retry it without rerunning Claude: ```bash agentsview capture report \ --capture-dir "$RUNNER_TEMP/agentsview-capture" \ --result "$RUNNER_TEMP/agentsview-usage.json" ``` Codex uses `--provider codex -- codex exec --json "..."`. Results contain session identity, execution and reporting outcomes, canonical usage, cost, and completeness—not prompts, responses, credentials, or transcript content. The private capture directory does contain transcripts and is sensitive. Version 1 requires a fresh session; resume forms and unproven correlation are rejected. Co-authored-by: Wes McKinney <wesm@users.noreply.github.com> |
||
|
Marius van Niekerk
|
44667b730d |
fix(activity): validate CLI bucket range bounds (#1483)
Rejects local CLI session bucket ranges whose exclusive end exceeds the generated report's bucket count, matching the HTTP endpoint's range domain. A behavioral regression test covers an oversized range on a 288-bucket day. This intentionally does not add cursor-version or request-compatibility handling because the UI and CLI are coupled and this migration does not preserve old client semantics. |
||
|
Marius van Niekerk
|
9ca2e2ddb5 |
fix(ci): generate current pricing before frontend checks (#1485)
Clean frontend API freshness checks now prepare the pinned embedded LiteLLM snapshot when it is missing, before compiling the Go OpenAPI command. The existing CI generation step remains in place, and clean checkouts use the current pinned catalog instead of failing on an absent `go:embed` input. The refresh pins its source and release artifact, removes the supplemental `moonshot/kimi-k3` row that LiteLLM now supplies, and advances the supplemental seed version so existing archives drop that duplicate. Report goldens decode JSON before comparison, require a substantial parsed catalog, and exclude only the catalog row count and digest while keeping the rest of each report exact. |
||
|
Marius van Niekerk
|
534c44eab7 |
refactor(frontend): migrate dashboard charts to LayerChart (#1480)
This replaces eight hand-written SVG chart renderers across Activity, Analytics, Trends, and Usage with LayerChart 2.2.0. The old renderers duplicated sizing, axes, interaction handling, and responsive behavior. The migrated charts keep the existing localized labels, palette assignments, high-cardinality rollups, and keyboard access while moving chart measurement and drawing to the library. The larger line charts now share one frame for axes and grid styling. Date series use time scales instead of categorical labels, long ranges choose a coarser usable view, and treemap layout comes from LayerChart rather than the removed local hierarchy helper. Usage keeps its ten named series plus an Other rollup, with one color map shared by the timeline and attribution views. Range selection is part of the migration rather than a visual-only zoom: - Activity and Analytics brushes retain a visible inclusive range and carry it into the Sessions results. - Usage applies retained daily data immediately, refreshes dependent results in the background, and restores the parent window on clear or failed refresh. - Pointer clicks with no range do not trigger work, and date inputs provide the same Usage selection for keyboard users. - Clear actions, refresh status, and summary values reserve stable space so a selection does not move the chart or surrounding page. The backend and CLI changes are limited to carrying the Activity range through report tokens, pagination, caching, and session queries. They do not add a separate analytics feature outside the chart-selection contract. <sup>generated by a clanker</sup> |
||
|
Marius van Niekerk
|
3661af957b |
fix(quality): show refresh progress for filter changes (#1482)
Quality now shows the same refresh feedback as the other analytics pages when filters trigger a background query. The page keeps existing results visible while the shared refresh control spins and an animated progress bar marks the content busy. Successful Quality reads also update the refresh timestamp. The main review area is `QualityPage.svelte`, where the page now follows the shared refresh scheduler and query-state pattern. |
||
|
Marius van Niekerk
|
b85eae5a79 |
feat: adopt Go 1.27 JSON v2 semantics (#1475)
Moves AgentsView to Go 1.27 and adopts native `encoding/json/v2` behavior throughout. This is a clean migration with no JSON v1 compatibility or checkpoint fallback paths. Typed Huma routes now share JSON v2 request and response semantics with the rest of the application. OpenAPI continues to describe token usage as arbitrary JSON. JSONL rewrite paths retain untouched values as raw JSON, so large integers stay exact, while stored map output is deterministic where bytes define artifact identity. The Go 1.27 audit also adopts generic methods, assignment-context inference, promoted fields in struct literals, `errors.AsType`, and related standard-library simplifications. Build images, local tooling, documentation, and reviewer guidance now require Go 1.27. golangci-lint is pinned to v2.13.0, which can analyze the new language level. |
||
|
renovate[bot]
|
f2e020ca00 |
fix(deps): update go dependencies (#1477)
> ℹ️ **Note** > > This PR body was truncated due to platform limits. This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/danielgtaylor/huma/v2](https://redirect.github.com/danielgtaylor/huma) | `v2.38.0` → `v2.39.1` |  |  | | [github.com/duckdb/duckdb-go/v2](https://redirect.github.com/duckdb/duckdb-go) | `v2.10504.0` → `v2.10505.0` |  |  | | [github.com/klauspost/compress](https://redirect.github.com/klauspost/compress) | `v1.19.0` → `v1.19.2` |  |  | | [github.com/mattn/go-runewidth](https://redirect.github.com/mattn/go-runewidth) | `v0.0.24` → `v0.0.27` |  |  | | [github.com/mattn/go-sqlite3](https://redirect.github.com/mattn/go-sqlite3) | `v1.14.47` → `v1.14.49` |  |  | | [github.com/modelcontextprotocol/go-sdk](https://redirect.github.com/modelcontextprotocol/go-sdk) | `v1.6.1` → `v1.7.0` |  |  | | [github.com/shirou/gopsutil/v4](https://redirect.github.com/shirou/gopsutil) | `v4.26.6` → `v4.26.7` |  |  | | [github.com/testcontainers/testcontainers-go](https://redirect.github.com/testcontainers/testcontainers-go) | `v0.43.0` → `v0.44.0` |  |  | | [github.com/testcontainers/testcontainers-go/modules/postgres](https://redirect.github.com/testcontainers/testcontainers-go) | `v0.43.0` → `v0.44.0` |  |  | | [go.kenn.io/docbank](https://redirect.github.com/kenn-io/docbank) | `v0.11.0` → `v0.12.0` |  |  | | [go.kenn.io/kit](https://redirect.github.com/kenn-io/kit) | `v0.13.1` → `v0.21.1` |  |  | | [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) | `v1.53.0` → `v1.56.0` |  |  | --- ### Release Notes <details> <summary>danielgtaylor/huma (github.com/danielgtaylor/huma/v2)</summary> ### [`v2.39.1`](https://redirect.github.com/danielgtaylor/huma/releases/tag/v2.39.1) [Compare Source](https://redirect.github.com/danielgtaylor/huma/compare/v2.39.0...v2.39.1) ##### v2.39.1 ##### Overview A patch release: correctness fixes for resolvers, validation, and response handling, plus a dependency refresh. ##### Response Status Visible to Middleware Again `WithContext` context propagation in v2.39.0 copied the response status by value, so middleware that called `WithContext` and then read `Status()` after `next()` always saw `0` instead of the status the handler set, breaking access logging and telemetry. The status is now shared by every context copy across all adapters, restoring the pre-2.39 invariant while keeping context propagation intact. ([#​1081](https://redirect.github.com/danielgtaylor/huma/issues/1081)) ##### Resolvers & Defaults in Arrays and Maps - Nested resolvers now run for fixed-size arrays (`[2]Item`), not just slices ([#​1076](https://redirect.github.com/danielgtaylor/huma/issues/1076)) - A resolver on a named collection type (e.g. `type Coords [2]float64`) no longer panics, and is no longer conflated with a resolver on its element type, which previously ran the element's resolver twice and the collection's never ([#​1082](https://redirect.github.com/danielgtaylor/huma/issues/1082)) - Values reached through a map are now written back after being walked, so applying a default no longer panics with `reflect: reflect.Value.Set using unaddressable value` and resolver mutations are no longer silently discarded ([#​1082](https://redirect.github.com/danielgtaylor/huma/issues/1082)) ##### Stricter `email` and `uri` Formats Validation for two string formats is tighter, so payloads that previously passed may now return `422`: - `email` / `idn-email` accept an addr-spec only; full mailbox forms with a display name (`Name <user@example.com>`) are rejected - `uri` / `iri` require an absolute URI with a non-empty scheme, while relative references remain valid under `uri-reference` / `iri-reference` ([#​1068](https://redirect.github.com/danielgtaylor/huma/issues/1068)) ##### Validation Robustness - An unresolvable schema `$ref` during `Validate` now reports `expected schema $ref to resolve: ...` instead of panicking on a nil dereference, covering discriminators and `map[string]any` / `map[any]any` values ([#​1065](https://redirect.github.com/danielgtaylor/huma/issues/1065)) - Named numeric slice parameters (e.g. `type IDs []int64`) are built with their declared element type and validated with item, length, and uniqueness constraints intact ([#​1074](https://redirect.github.com/danielgtaylor/huma/issues/1074)) ##### Other Fixes - Resolver errors that wrap a `HeadersError` now contribute their headers to the response, matching the handler error path ([#​1070](https://redirect.github.com/danielgtaylor/huma/issues/1070)) - A nil interface response body no longer panics in the schema link transformer ([#​1072](https://redirect.github.com/danielgtaylor/huma/issues/1072)) - Dependencies updated ([#​1066](https://redirect.github.com/danielgtaylor/huma/issues/1066)) ##### What's Changed - fix: do not panic on unresolved schema $ref during Validate by [@​baiyuxi930826](https://redirect.github.com/baiyuxi930826) in [#​1065](https://redirect.github.com/danielgtaylor/huma/pull/1065) - chore: update dependencies by [@​wolveix](https://redirect.github.com/wolveix) in [#​1066](https://redirect.github.com/danielgtaylor/huma/pull/1066) - fix: tighten format email and uri validation by [@​baiyuxi930826](https://redirect.github.com/baiyuxi930826) in [#​1068](https://redirect.github.com/danielgtaylor/huma/pull/1068) - fix: preserve wrapped resolver error metadata by [@​ggmolly](https://redirect.github.com/ggmolly) in [#​1070](https://redirect.github.com/danielgtaylor/huma/pull/1070) - fix: handle nil interface response bodies by [@​ggmolly](https://redirect.github.com/ggmolly) in [#​1072](https://redirect.github.com/danielgtaylor/huma/pull/1072) - fix: parse named numeric slice parameters by [@​ggmolly](https://redirect.github.com/ggmolly) in [#​1074](https://redirect.github.com/danielgtaylor/huma/pull/1074) - fix: share response status across WithContext copies by [@​wolveix](https://redirect.github.com/wolveix) in [#​1081](https://redirect.github.com/danielgtaylor/huma/pull/1081) - fix: run nested resolvers in fixed arrays by [@​ggmolly](https://redirect.github.com/ggmolly) in [#​1076](https://redirect.github.com/danielgtaylor/huma/pull/1076) - fix: distinguish collection and element matches when walking input by [@​wolveix](https://redirect.github.com/wolveix) in [#​1082](https://redirect.github.com/danielgtaylor/huma/pull/1082) ##### New Contributors - [@​baiyuxi930826](https://redirect.github.com/baiyuxi930826) made their first contribution in [#​1065](https://redirect.github.com/danielgtaylor/huma/pull/1065) - [@​ggmolly](https://redirect.github.com/ggmolly) made their first contribution in [#​1070](https://redirect.github.com/danielgtaylor/huma/pull/1070) **Full Changelog**: <https://github.com/danielgtaylor/huma/compare/v2.39.0...v2.39.1> ### [`v2.39.0`](https://redirect.github.com/danielgtaylor/huma/releases/tag/v2.39.0) [Compare Source](https://redirect.github.com/danielgtaylor/huma/compare/v2.38.0...v2.39.0) ##### v2.39.0 ##### Overview This release adds a new framework adapter, a handful of developer-facing features, and a large batch of correctness fixes spanning SSE, the Fiber adapter, schema generation, and validation. ##### Echo v5 Support The `humaecho` adapter now supports [Echo v5](https://echo.labstack.com/) alongside the existing versions. ([#​959](https://redirect.github.com/danielgtaylor/huma/issues/959)) ##### No More Faulty Duplicate-Schema Panics Registering operations that use inline structs with differing field names (and an empty operation ID) previously panicked at startup on a false-positive duplicate-schema collision. Conflicting names are now auto-incremented deterministically (`Request`, `Request1`, `Request2`, ...), so the app starts and the generated spec stays readable. ([#​893](https://redirect.github.com/danielgtaylor/huma/issues/893)) ##### Context Propagation to Adapters `WithContext` now propagates the context directly into the underlying adapter's own context wrapper (bun, chi, echo, fiber, gin, go, httprouter) instead of relying on a generic sub-context, so cancellation and context values flow correctly through the request lifecycle. ([#​867](https://redirect.github.com/danielgtaylor/huma/issues/867)) ##### SSE Streaming on Fiber / fasthttp Server-Sent Events (and other streaming responses) previously failed on the Fiber adapters with `unable to flush`, since fasthttp doesn't implement `http.Flusher`. SSE now streams correctly on Fiber v2 and v3 via an internal streaming hook, with no new public API and `fasthttp` remaining an indirect dependency. ([#​1059](https://redirect.github.com/danielgtaylor/huma/issues/1059)) ##### More SSE Improvements - Response headers are now flushed before the user handler runs, so `EventSource.onopen` fires immediately rather than waiting for the first event ([#​1038](https://redirect.github.com/danielgtaylor/huma/issues/1038)) - Comments can now be sent over SSE streams, a common way to keep connections alive ([#​1054](https://redirect.github.com/danielgtaylor/huma/issues/1054)) ##### New Features - **`Schema.Const`** for pinning a schema to a single allowed value ([#​1004](https://redirect.github.com/danielgtaylor/huma/issues/1004)) - **Customizable docs renderer config** for finer control over the documentation UI ([#​1024](https://redirect.github.com/danielgtaylor/huma/issues/1024)) - **`encoding.TextUnmarshaler` support for slice query parameters**, matching the existing behavior for scalar params ([#​1021](https://redirect.github.com/danielgtaylor/huma/issues/1021)) - **Non-file JSON form-data fields**: multipart form fields tagged `contentType:"application/json"` are now unmarshalled and validated ([#​1060](https://redirect.github.com/danielgtaylor/huma/issues/1060)) ##### Validation & Schema Fixes - Integer enums no longer always fail validation on query/path parameters; numeric enum values are now compared numerically rather than by strict Go type ([#​1050](https://redirect.github.com/danielgtaylor/huma/issues/1050)) - Content-Type validation is now case-insensitive per RFC 9110, so e.g. `Application/Json` no longer returns `415` ([#​1052](https://redirect.github.com/danielgtaylor/huma/issues/1052)) - Path parameters are always marked `required: true` in the generated spec, per the OpenAPI specification ([#​1011](https://redirect.github.com/danielgtaylor/huma/issues/1011)) - Prevented a panic (and dropped response) in `uniqueItems` validation when array items are unhashable types, now returning `422` correctly ([#​1045](https://redirect.github.com/danielgtaylor/huma/issues/1045)) - The `json:",inline"` tag is now honored for embedding anonymous fields in schemas ([#​1006](https://redirect.github.com/danielgtaylor/huma/issues/1006)) - Hidden route schemas are no longer leaked into the generated spec ([#​1032](https://redirect.github.com/danielgtaylor/huma/issues/1032)) ##### Adapter & Robustness Fixes - **humafiber (v2):** corrected `EachHeader` iteration (it previously invoked the callback once per byte, breaking cookie reads) and switched `BodyReader` to `Body()` for automatic request-body decompression ([#​1058](https://redirect.github.com/danielgtaylor/huma/issues/1058)) - **autopatch:** prevented chi route-context reuse from recursing internal `GET` sub-requests back into the generated `PATCH` handler and panicking ([#​1049](https://redirect.github.com/danielgtaylor/huma/issues/1049)) - Fixed a URL parsing panic in `getAPIPrefix` when server URLs contain template variables like `{port}` or `{version}` ([#​1027](https://redirect.github.com/danielgtaylor/huma/issues/1027)) - The read deadline is now cleared after the request body is read, so a slow handler can't cause a background read to time out and cancel the connection context ([#​1028](https://redirect.github.com/danielgtaylor/huma/issues/1028)) ##### Docs UI & Documentation - Forms are now permitted in the docs UI CSP ([#​1036](https://redirect.github.com/danielgtaylor/huma/issues/1036)) - Added `allow-downloads` to the Stoplight CSP so the Export button works ([#​1048](https://redirect.github.com/danielgtaylor/huma/issues/1048)) - Updated Restish references to v2 ([#​1041](https://redirect.github.com/danielgtaylor/huma/issues/1041)) ##### What's Changed - Avoid leaking hidden route schemas by [@​wolveix](https://redirect.github.com/wolveix) in [#​1032](https://redirect.github.com/danielgtaylor/huma/pull/1032) - fix: parse server vars on getAPIPrefix to avoid parsing URL panic by [@​kukymbr](https://redirect.github.com/kukymbr) in [#​1027](https://redirect.github.com/danielgtaylor/huma/pull/1027) - Add `encoding.TextUnmarshaler` support for slice query parameters by [@​B94715](https://redirect.github.com/B94715) in [#​1021](https://redirect.github.com/danielgtaylor/huma/pull/1021) - fix: enforce required=true for path parameters per OpenAPI spec by [@​Yanhu007](https://redirect.github.com/Yanhu007) in [#​1011](https://redirect.github.com/danielgtaylor/huma/pull/1011) - huma: clear read deadline on reading by [@​atn18](https://redirect.github.com/atn18) in [#​1028](https://redirect.github.com/danielgtaylor/huma/pull/1028) - feat: support customizing the docs renderer config by [@​johnletey](https://redirect.github.com/johnletey) in [#​1024](https://redirect.github.com/danielgtaylor/huma/pull/1024) - feat: add Schema.Const by [@​seanwu1105](https://redirect.github.com/seanwu1105) in [#​1004](https://redirect.github.com/danielgtaylor/huma/pull/1004) - Permit forms in docs UI CSP by [@​wolveix](https://redirect.github.com/wolveix) in [#​1036](https://redirect.github.com/danielgtaylor/huma/pull/1036) - fix(sse): flush response headers before user handler runs by [@​alswl](https://redirect.github.com/alswl) in [#​1038](https://redirect.github.com/danielgtaylor/huma/pull/1038) - docs: update Restish v2 references by [@​danielgtaylor](https://redirect.github.com/danielgtaylor) in [#​1041](https://redirect.github.com/danielgtaylor/huma/pull/1041) - fix: add 'allow-downloads' to CSP for stoplight by [@​ovikk13](https://redirect.github.com/ovikk13) in [#​1048](https://redirect.github.com/danielgtaylor/huma/pull/1048) - Echov5 support by [@​sharath-09](https://redirect.github.com/sharath-09) in [#​959](https://redirect.github.com/danielgtaylor/huma/pull/959) - fix(autopatch): prevent chi route-context reuse in internal requests by [@​wolveix](https://redirect.github.com/wolveix) in [#​1049](https://redirect.github.com/danielgtaylor/huma/pull/1049) - fix: support json inline tag for embedding anonymous fields in schema by [@​lsdch](https://redirect.github.com/lsdch) in [#​1006](https://redirect.github.com/danielgtaylor/huma/pull/1006) - fix: compare numeric enum values numerically by [@​wolveix](https://redirect.github.com/wolveix) in [#​1050](https://redirect.github.com/danielgtaylor/huma/pull/1050) - fix: content type validation should be case insensitive by [@​hlavacekvit](https://redirect.github.com/hlavacekvit) in [#​1052](https://redirect.github.com/danielgtaylor/huma/pull/1052) - fix(humafiber): correct Fiber v2 EachHeader iteration and body decompression by [@​wolveix](https://redirect.github.com/wolveix) in [#​1058](https://redirect.github.com/danielgtaylor/huma/pull/1058) - feat: propagate context to adapters on WithContext by [@​costela](https://redirect.github.com/costela) in [#​867](https://redirect.github.com/danielgtaylor/huma/pull/867) - Support sending comments with SSE by [@​seanwu1105](https://redirect.github.com/seanwu1105) in [#​1054](https://redirect.github.com/danielgtaylor/huma/pull/1054) - fix(sse): support streaming responses on Fiber/fasthttp adapters by [@​wolveix](https://redirect.github.com/wolveix) in [#​1059](https://redirect.github.com/danielgtaylor/huma/pull/1059) - fix: prevent panic in uniqueItems validation for unhashable types ([#​1042](https://redirect.github.com/danielgtaylor/huma/issues/1042)) by [@​ArdyJunata](https://redirect.github.com/ArdyJunata) in [#​1045](https://redirect.github.com/danielgtaylor/huma/pull/1045) - fix: avoid faulty duplicate detection by [@​Mcklmo](https://redirect.github.com/Mcklmo) in [#​893](https://redirect.github.com/danielgtaylor/huma/pull/893) - feat(form-data): handle unmarshalling and validation of non-file JSON form data fields by [@​lsdch](https://redirect.github.com/lsdch) in [#​1060](https://redirect.github.com/danielgtaylor/huma/pull/1060) ##### New Contributors - [@​kukymbr](https://redirect.github.com/kukymbr) made their first contribution in [#​1027](https://redirect.github.com/danielgtaylor/huma/pull/1027) - [@​B94715](https://redirect.github.com/B94715) made their first contribution in [#​1021](https://redirect.github.com/danielgtaylor/huma/pull/1021) - [@​Yanhu007](https://redirect.github.com/Yanhu007) made their first contribution in [#​1011](https://redirect.github.com/danielgtaylor/huma/pull/1011) - [@​atn18](https://redirect.github.com/atn18) made their first contribution in [#​1028](https://redirect.github.com/danielgtaylor/huma/pull/1028) - [@​johnletey](https://redirect.github.com/johnletey) made their first contribution in [#​1024](https://redirect.github.com/danielgtaylor/huma/pull/1024) - [@​seanwu1105](https://redirect.github.com/seanwu1105) made their first contribution in [#​1004](https://redirect.github.com/danielgtaylor/huma/pull/1004) - [@​alswl](https://redirect.github.com/alswl) made their first contribution in [#​1038](https://redirect.github.com/danielgtaylor/huma/pull/1038) - [@​ovikk13](https://redirect.github.com/ovikk13) made their first contribution in [#​1048](https://redirect.github.com/danielgtaylor/huma/pull/1048) - [@​sharath-09](https://redirect.github.com/sharath-09) made their first contribution in [#​959](https://redirect.github.com/danielgtaylor/huma/pull/959) - [@​hlavacekvit](https://redirect.github.com/hlavacekvit) made their first contribution in [#​1052](https://redirect.github.com/danielgtaylor/huma/pull/1052) - [@​ArdyJunata](https://redirect.github.com/ArdyJunata) made their first contribution in [#​1045](https://redirect.github.com/danielgtaylor/huma/pull/1045) - [@​Mcklmo](https://redirect.github.com/Mcklmo) made their first contribution in [#​893](https://redirect.github.com/danielgtaylor/huma/pull/893) **Full Changelog**: <https://github.com/danielgtaylor/huma/compare/v2.38.0...v2.39.0> </details> <details> <summary>duckdb/duckdb-go (github.com/duckdb/duckdb-go/v2)</summary> ### [`v2.10505.0`](https://redirect.github.com/duckdb/duckdb-go/releases/tag/v2.10505.0) [Compare Source](https://redirect.github.com/duckdb/duckdb-go/compare/v2.10504.0...v2.10505.0) #### What's Changed - Add v1.4.5 to version matrix by [@​mlafeldt](https://redirect.github.com/mlafeldt) in [#​153](https://redirect.github.com/duckdb/duckdb-go/pull/153) - Harden internal type handling with typeName helper by [@​mlafeldt](https://redirect.github.com/mlafeldt) in [#​156](https://redirect.github.com/duckdb/duckdb-go/pull/156) - Fix setEnum for enums with more than 256 values by [@​mlafeldt](https://redirect.github.com/mlafeldt) in [#​157](https://redirect.github.com/duckdb/duckdb-go/pull/157) - Scalar UDF chunk-based API by [@​taniabogatsch](https://redirect.github.com/taniabogatsch) in [#​159](https://redirect.github.com/duckdb/duckdb-go/pull/159) - Bump to v1.5.5 by [@​mlafeldt](https://redirect.github.com/mlafeldt) in [#​160](https://redirect.github.com/duckdb/duckdb-go/pull/160) **Full Changelog**: <https://github.com/duckdb/duckdb-go/compare/v2.10504.0...v2.10505.0> </details> <details> <summary>klauspost/compress (github.com/klauspost/compress)</summary> ### [`v1.19.2`](https://redirect.github.com/klauspost/compress/releases/tag/v1.19.2) [Compare Source](https://redirect.github.com/klauspost/compress/compare/v1.19.1...v1.19.2) ##### What's Changed - huff0: add arm64 assembly for Decompress4X/1X via avo lowering by [@​lizthegrey](https://redirect.github.com/lizthegrey) in [#​1172](https://redirect.github.com/klauspost/compress/pull/1172) - zstd: Re-enable unsafe decodeSync memory copies ([#​1168](https://redirect.github.com/klauspost/compress/issues/1168)) by [@​lizthegrey](https://redirect.github.com/lizthegrey) in [#​1171](https://redirect.github.com/klauspost/compress/pull/1171) - zstd: fix arm64 asm frame offsets placing locals on the saved LR slot by [@​lizthegrey](https://redirect.github.com/lizthegrey) in [#​1176](https://redirect.github.com/klauspost/compress/pull/1176) - zstd: avoid racing MaxDecodedSize write on shared dict litEnc by [@​zanarellidev](https://redirect.github.com/zanarellidev) in [#​1182](https://redirect.github.com/klauspost/compress/pull/1182) - zstd: keep BuildDict recent-offsets positive and loadable by [@​zanarellidev](https://redirect.github.com/zanarellidev) in [#​1184](https://redirect.github.com/klauspost/compress/pull/1184) - zstd: handle zero-literal BuildDict corpus by [@​cyphercodes](https://redirect.github.com/cyphercodes) in [#​1178](https://redirect.github.com/klauspost/compress/pull/1178) - zstd: don't clear the registered dictionary when decoding past the window by [@​sueun-dev](https://redirect.github.com/sueun-dev) in [#​1177](https://redirect.github.com/klauspost/compress/pull/1177) ##### New Contributors - [@​zanarellidev](https://redirect.github.com/zanarellidev) made their first contribution in [#​1183](https://redirect.github.com/klauspost/compress/pull/1183) - [@​cyphercodes](https://redirect.github.com/cyphercodes) made their first contribution in [#​1178](https://redirect.github.com/klauspost/compress/pull/1178) - [@​sueun-dev](https://redirect.github.com/sueun-dev) made their first contribution in [#​1177](https://redirect.github.com/klauspost/compress/pull/1177) **Full Changelog**: <https://github.com/klauspost/compress/compare/v1.19.1...v1.19.2> ### [`v1.19.1`](https://redirect.github.com/klauspost/compress/releases/tag/v1.19.1) [Compare Source](https://redirect.github.com/klauspost/compress/compare/v1.19.0...v1.19.1) #### What's Changed - zstd: Validate SnappyConverter literal copies by [@​klauspost](https://redirect.github.com/klauspost) in [#​1170](https://redirect.github.com/klauspost/compress/pull/1170) - flate: use `Peek` instead of `ReadByte` for the `bufio.Reader` decode path by [@​joechenrh](https://redirect.github.com/joechenrh) in [#​1169](https://redirect.github.com/klauspost/compress/pull/1169) - zstd: bump avo pin, regenerate arm64 asm by [@​lizthegrey](https://redirect.github.com/lizthegrey) in [#​1167](https://redirect.github.com/klauspost/compress/pull/1167) #### New Contributors - [@​joechenrh](https://redirect.github.com/joechenrh) made their first contribution in [#​1169](https://redirect.github.com/klauspost/compress/pull/1169) **Full Changelog**: <https://github.com/klauspost/compress/compare/v1.19.0...v1.19.1> </details> <details> <summary>mattn/go-runewidth (github.com/mattn/go-runewidth)</summary> ### [`v0.0.27`](https://redirect.github.com/mattn/go-runewidth/compare/v0.0.26...v0.0.27) [Compare Source](https://redirect.github.com/mattn/go-runewidth/compare/v0.0.26...v0.0.27) ### [`v0.0.26`](https://redirect.github.com/mattn/go-runewidth/compare/v0.0.25...v0.0.26) [Compare Source](https://redirect.github.com/mattn/go-runewidth/compare/v0.0.25...v0.0.26) ### [`v0.0.25`](https://redirect.github.com/mattn/go-runewidth/compare/v0.0.24...v0.0.25) [Compare Source](https://redirect.github.com/mattn/go-runewidth/compare/v0.0.24...v0.0.25) </details> <details> <summary>mattn/go-sqlite3 (github.com/mattn/go-sqlite3)</summary> ### [`v1.14.49`](https://redirect.github.com/mattn/go-sqlite3/releases/tag/v1.14.49): 1.14.49 [Compare Source](https://redirect.github.com/mattn/go-sqlite3/compare/v1.14.48...v1.14.49) #### What's Changed - Release vtable and cursor handles when SQLite destroys them by [@​mattn](https://redirect.github.com/mattn) in [#​1429](https://redirect.github.com/mattn/go-sqlite3/pull/1429) - Do not clobber SQLite's default cost estimates in BestIndex by [@​mattn](https://redirect.github.com/mattn) in [#​1430](https://redirect.github.com/mattn/go-sqlite3/pull/1430) - Translate SQL NULL filter arguments to nil like goVUpdate by [@​mattn](https://redirect.github.com/mattn) in [#​1431](https://redirect.github.com/mattn/go-sqlite3/pull/1431) - Identify updated row by argv 0 in goVUpdate by [@​mattn](https://redirect.github.com/mattn) in [#​1432](https://redirect.github.com/mattn/go-sqlite3/pull/1432) - Ignore Used for constraints SQLite marked not usable by [@​mattn](https://redirect.github.com/mattn) in [#​1433](https://redirect.github.com/mattn/go-sqlite3/pull/1433) - Reject nil module and nil BestIndex result by [@​mattn](https://redirect.github.com/mattn) in [#​1434](https://redirect.github.com/mattn/go-sqlite3/pull/1434) - Fail upgrade tool on download and write errors by [@​mattn](https://redirect.github.com/mattn) in [#​1435](https://redirect.github.com/mattn/go-sqlite3/pull/1435) - Fix off-by-one truncating SQL in fuzz target by [@​mattn](https://redirect.github.com/mattn) in [#​1436](https://redirect.github.com/mattn/go-sqlite3/pull/1436) - Fix wrong results and cursor state sharing in series example by [@​mattn](https://redirect.github.com/mattn) in [#​1437](https://redirect.github.com/mattn/go-sqlite3/pull/1437) - Use the table name from xCreate args in vtable example by [@​mattn](https://redirect.github.com/mattn) in [#​1438](https://redirect.github.com/mattn/go-sqlite3/pull/1438) - Close leaked rows in hook example by [@​mattn](https://redirect.github.com/mattn) in [#​1439](https://redirect.github.com/mattn/go-sqlite3/pull/1439) - Close prepared statement and fail if limit is not enforced in limit example by [@​mattn](https://redirect.github.com/mattn) in [#​1440](https://redirect.github.com/mattn/go-sqlite3/pull/1440) - Upgrade SQLite to version [`3053004`](https://redirect.github.com/mattn/go-sqlite3/commit/3053004) by [@​mattn](https://redirect.github.com/mattn) in [#​1442](https://redirect.github.com/mattn/go-sqlite3/pull/1442) **Full Changelog**: <https://github.com/mattn/go-sqlite3/compare/v1.14.48...v1.14.49> ### [`v1.14.48`](https://redirect.github.com/mattn/go-sqlite3/releases/tag/v1.14.48): 1.14.48 [Compare Source](https://redirect.github.com/mattn/go-sqlite3/compare/v1.14.47...v1.14.48) #### What's Changed - Add Serialize and Deserialize support by [@​otoolep](https://redirect.github.com/otoolep) in [#​1089](https://redirect.github.com/mattn/go-sqlite3/pull/1089) - Replace namedValue with driver.NamedValue to avoid copying exec/query args by [@​charlievieth](https://redirect.github.com/charlievieth) in [#​1128](https://redirect.github.com/mattn/go-sqlite3/pull/1128) - Add go 1.20 to workflow matrix, remove 1.17 by [@​connyay](https://redirect.github.com/connyay) in [#​1136](https://redirect.github.com/mattn/go-sqlite3/pull/1136) - Add build tags to support both x86 and ARM compilation on macOS by [@​Spaider](https://redirect.github.com/Spaider) in [#​1069](https://redirect.github.com/mattn/go-sqlite3/pull/1069) - Fix virtual table example. by [@​andrzh](https://redirect.github.com/andrzh) in [#​1149](https://redirect.github.com/mattn/go-sqlite3/pull/1149) - Update README.md by [@​parthokr](https://redirect.github.com/parthokr) in [#​1163](https://redirect.github.com/mattn/go-sqlite3/pull/1163) - Update amalgamation code by [@​mattn](https://redirect.github.com/mattn) in [#​1166](https://redirect.github.com/mattn/go-sqlite3/pull/1166) - Update amalgamation code by [@​mattn](https://redirect.github.com/mattn) in [#​1197](https://redirect.github.com/mattn/go-sqlite3/pull/1197) - Fix docker job by [@​itizir](https://redirect.github.com/itizir) in [#​1201](https://redirect.github.com/mattn/go-sqlite3/pull/1201) - Fix musl build ([#​1164](https://redirect.github.com/mattn/go-sqlite3/issues/1164)) by [@​leso-kn](https://redirect.github.com/leso-kn) in [#​1177](https://redirect.github.com/mattn/go-sqlite3/pull/1177) - update go version to 1.19 by [@​mattn](https://redirect.github.com/mattn) in [#​1208](https://redirect.github.com/mattn/go-sqlite3/pull/1208) - Update amalgamation code to 3.45.0 by [@​mattn](https://redirect.github.com/mattn) in [#​1207](https://redirect.github.com/mattn/go-sqlite3/pull/1207) - Update amalgamation code to 3.45.1 by [@​mattn](https://redirect.github.com/mattn) in [#​1211](https://redirect.github.com/mattn/go-sqlite3/pull/1211) - close channel by [@​mattn](https://redirect.github.com/mattn) in [#​1213](https://redirect.github.com/mattn/go-sqlite3/pull/1213) - fix: some typos by [@​pomadev](https://redirect.github.com/pomadev) in [#​1222](https://redirect.github.com/mattn/go-sqlite3/pull/1222) - Add support for libsqlite3 on z/OS by [@​dustin-ward](https://redirect.github.com/dustin-ward) in [#​1239](https://redirect.github.com/mattn/go-sqlite3/pull/1239) - Update amalgamation code to 3.46.1 by [@​mattn](https://redirect.github.com/mattn) in [#​1273](https://redirect.github.com/mattn/go-sqlite3/pull/1273) - close statement when missing query arguments by [@​mattn](https://redirect.github.com/mattn) in [#​1281](https://redirect.github.com/mattn/go-sqlite3/pull/1281) - Upgrade upload-artifact action by [@​jonstacks](https://redirect.github.com/jonstacks) in [#​1300](https://redirect.github.com/mattn/go-sqlite3/pull/1300) - Remove suggestion that CGO isn't always needed by [@​samjewell](https://redirect.github.com/samjewell) in [#​1290](https://redirect.github.com/mattn/go-sqlite3/pull/1290) - remove superfluous use of runtime.SetFinalizer on SQLiteRows by [@​charlievieth](https://redirect.github.com/charlievieth) in [#​1301](https://redirect.github.com/mattn/go-sqlite3/pull/1301) - Fix sqlite3\_opt\_unlock\_notify with USE\_LIBSQLITE3 by [@​q66](https://redirect.github.com/q66) in [#​1262](https://redirect.github.com/mattn/go-sqlite3/pull/1262) - Fix memory leak in callbackRetText function by [@​hionay](https://redirect.github.com/hionay) in [#​1259](https://redirect.github.com/mattn/go-sqlite3/pull/1259) - docs: clarify GCP section by [@​justinsb](https://redirect.github.com/justinsb) in [#​1305](https://redirect.github.com/mattn/go-sqlite3/pull/1305) - Add ability to set an int64 file control by [@​jonstacks](https://redirect.github.com/jonstacks) in [#​1298](https://redirect.github.com/mattn/go-sqlite3/pull/1298) - Update amalgamation code to 3.49.1 by [@​mattn](https://redirect.github.com/mattn) in [#​1335](https://redirect.github.com/mattn/go-sqlite3/pull/1335) - Update amalgamation code to 3.50.3 by [@​mattn](https://redirect.github.com/mattn) in [#​1343](https://redirect.github.com/mattn/go-sqlite3/pull/1343) - Drop userauth implementation by [@​mattn](https://redirect.github.com/mattn) in [#​1344](https://redirect.github.com/mattn/go-sqlite3/pull/1344) - fix syntax error by [@​eraytufan](https://redirect.github.com/eraytufan) in [#​1346](https://redirect.github.com/mattn/go-sqlite3/pull/1346) - update amalgamation code by [@​mattn](https://redirect.github.com/mattn) in [#​1347](https://redirect.github.com/mattn/go-sqlite3/pull/1347) - use quote include instead of angled include for sqlite3-binding.h by [@​nautaa](https://redirect.github.com/nautaa) in [#​1362](https://redirect.github.com/mattn/go-sqlite3/pull/1362) - Upgrade SQLite to version [`3051001`](https://redirect.github.com/mattn/go-sqlite3/commit/3051001) by [@​mattn](https://redirect.github.com/mattn) in [#​1366](https://redirect.github.com/mattn/go-sqlite3/pull/1366) - Feat: add percentile extension option by [@​dsonck92](https://redirect.github.com/dsonck92) in [#​1364](https://redirect.github.com/mattn/go-sqlite3/pull/1364) - Upgrade SQLite to version [`3051002`](https://redirect.github.com/mattn/go-sqlite3/commit/3051002) by [@​mattn](https://redirect.github.com/mattn) in [#​1370](https://redirect.github.com/mattn/go-sqlite3/pull/1370) - Use unsafe slice by [@​mattn](https://redirect.github.com/mattn) in [#​1373](https://redirect.github.com/mattn/go-sqlite3/pull/1373) - Call sqlite3\_clear\_bindings() after sqlite3\_reset() in bind() by [@​mattn](https://redirect.github.com/mattn) in [#​1374](https://redirect.github.com/mattn/go-sqlite3/pull/1374) - Upgrade SQLite to version [`3051003`](https://redirect.github.com/mattn/go-sqlite3/commit/3051003) by [@​mattn](https://redirect.github.com/mattn) in [#​1375](https://redirect.github.com/mattn/go-sqlite3/pull/1375) - Ensure Close always removes runtime finalizer to prevent memory leak by [@​mattn](https://redirect.github.com/mattn) in [#​1376](https://redirect.github.com/mattn/go-sqlite3/pull/1376) - Fix json example by [@​Jaculabilis](https://redirect.github.com/Jaculabilis) in [#​1313](https://redirect.github.com/mattn/go-sqlite3/pull/1313) - Add missing virtual table constraint op constants by [@​theimpostor](https://redirect.github.com/theimpostor) in [#​1379](https://redirect.github.com/mattn/go-sqlite3/pull/1379) - Eliminate unnecessary bounds checks in hot paths by [@​mattn](https://redirect.github.com/mattn) in [#​1381](https://redirect.github.com/mattn/go-sqlite3/pull/1381) - \[codex] optimize sqlite bind fast path by [@​mattn](https://redirect.github.com/mattn) in [#​1382](https://redirect.github.com/mattn/go-sqlite3/pull/1382) - \[codex] batch row column fetches in Next by [@​mattn](https://redirect.github.com/mattn) in [#​1383](https://redirect.github.com/mattn/go-sqlite3/pull/1383) - Raise minimum Go version to 1.21 by [@​mattn](https://redirect.github.com/mattn) in [#​1384](https://redirect.github.com/mattn/go-sqlite3/pull/1384) - Reduce sqlite bind overhead by [@​mattn](https://redirect.github.com/mattn) in [#​1385](https://redirect.github.com/mattn/go-sqlite3/pull/1385) - reduce CGO call overhead for exec and bind paths by [@​mattn](https://redirect.github.com/mattn) in [#​1386](https://redirect.github.com/mattn/go-sqlite3/pull/1386) - \[codex] add opt-in statement cache by [@​mattn](https://redirect.github.com/mattn) in [#​1387](https://redirect.github.com/mattn/go-sqlite3/pull/1387) - Fix panic when querying input with no SQL (only comments/whitespace) by [@​mattn](https://redirect.github.com/mattn) in [#​1392](https://redirect.github.com/mattn/go-sqlite3/pull/1392) - evict least-recently-used stmt when cache is full by [@​mattn](https://redirect.github.com/mattn) in [#​1388](https://redirect.github.com/mattn/go-sqlite3/pull/1388) - Upgrade SQLite to version [`3053000`](https://redirect.github.com/mattn/go-sqlite3/commit/3053000) by [@​mattn](https://redirect.github.com/mattn) in [#​1394](https://redirect.github.com/mattn/go-sqlite3/pull/1394) - add sqlite\_dbstat tag for the DBSTAT virtual table by [@​calmh](https://redirect.github.com/calmh) in [#​1338](https://redirect.github.com/mattn/go-sqlite3/pull/1338) - avoid out of bounds write in unlock\_notify\_wait on 64 bit platforms by [@​calmh](https://redirect.github.com/calmh) in [#​1399](https://redirect.github.com/mattn/go-sqlite3/pull/1399) - modernise reflect.SliceHeader to unsafe.Slice by [@​calmh](https://redirect.github.com/calmh) in [#​1400](https://redirect.github.com/mattn/go-sqlite3/pull/1400) - guard oversized string length in ResultText by [@​dxbjavid](https://redirect.github.com/dxbjavid) in [#​1402](https://redirect.github.com/mattn/go-sqlite3/pull/1402) - bind via sqlite3\_bind\_text64/blob64 to avoid 32-bit length truncation by [@​dxbjavid](https://redirect.github.com/dxbjavid) in [#​1403](https://redirect.github.com/mattn/go-sqlite3/pull/1403) - Upgrade SQLite to version [`3053002`](https://redirect.github.com/mattn/go-sqlite3/commit/3053002) by [@​mattn](https://redirect.github.com/mattn) in [#​1404](https://redirect.github.com/mattn/go-sqlite3/pull/1404) - guard oversized blob length in callbackRetBlob by [@​dxbjavid](https://redirect.github.com/dxbjavid) in [#​1405](https://redirect.github.com/mattn/go-sqlite3/pull/1405) - preserve embedded NUL bytes in custom function text values by [@​dxbjavid](https://redirect.github.com/dxbjavid) in [#​1406](https://redirect.github.com/mattn/go-sqlite3/pull/1406) - Follow documented call order for sqlite3\_value\_blob in callbackArgString by [@​mattn](https://redirect.github.com/mattn) in [#​1407](https://redirect.github.com/mattn/go-sqlite3/pull/1407) - Use atomic.Value for handle table and add concurrent lookup benchmark by [@​mattn](https://redirect.github.com/mattn) in [#​1412](https://redirect.github.com/mattn/go-sqlite3/pull/1412) - cache column metadata for prepared and cached statements by [@​mattn](https://redirect.github.com/mattn) in [#​1413](https://redirect.github.com/mattn/go-sqlite3/pull/1413) - free leaked schema string in GetFilename by [@​dxbjavid](https://redirect.github.com/dxbjavid) in [#​1408](https://redirect.github.com/mattn/go-sqlite3/pull/1408) - Fix race in SQLiteStmt.Close by holding conn lock across cache check by [@​mattn](https://redirect.github.com/mattn) in [#​1416](https://redirect.github.com/mattn/go-sqlite3/pull/1416) - Add CodeRabbit as a sponsor by [@​mattn](https://redirect.github.com/mattn) in [#​1417](https://redirect.github.com/mattn/go-sqlite3/pull/1417) - Return error from vtable cursor open instead of ignoring it by [@​mattn](https://redirect.github.com/mattn) in [#​1419](https://redirect.github.com/mattn/go-sqlite3/pull/1419) - Check sqlite3\_malloc64 result in Deserialize by [@​mattn](https://redirect.github.com/mattn) in [#​1420](https://redirect.github.com/mattn/go-sqlite3/pull/1420) - Fix panic when registered functions return named types by [@​mattn](https://redirect.github.com/mattn) in [#​1421](https://redirect.github.com/mattn/go-sqlite3/pull/1421) - Return error instead of silently ignoring unsupported bind types by [@​mattn](https://redirect.github.com/mattn) in [#​1422](https://redirect.github.com/mattn/go-sqlite3/pull/1422) - Add CodeRabbit configuration by [@​mattn](https://redirect.github.com/mattn) in [#​1418](https://redirect.github.com/mattn/go-sqlite3/pull/1418) - Close database on all error paths in Open by [@​mattn](https://redirect.github.com/mattn) in [#​1423](https://redirect.github.com/mattn/go-sqlite3/pull/1423) - Check preupdate value fetch result to avoid NULL dereference by [@​mattn](https://redirect.github.com/mattn) in [#​1424](https://redirect.github.com/mattn/go-sqlite3/pull/1424) - Use C.int in exported callbacks to match C declarations by [@​mattn](https://redirect.github.com/mattn) in [#​1425](https://redirect.github.com/mattn/go-sqlite3/pull/1425) - Fix leak of extension load error message by [@​mattn](https://redirect.github.com/mattn) in [#​1426](https://redirect.github.com/mattn/go-sqlite3/pull/1426) - Upgrade SQLite to version [`3053003`](https://redirect.github.com/mattn/go-sqlite3/commit/3053003) by [@​mattn](https://redirect.github.com/mattn) in [#​1427](https://redirect.github.com/mattn/go-sqlite3/pull/1427) #### New Contributors - [@​charlievieth](https://redirect.github.com/charlievieth) made their first contribution in [#​1128](https://redirect.github.com/mattn/go-sqlite3/pull/1128) - [@​connyay](https://redirect.github.com/connyay) made their first contribution in [#​1136](https://redirect.github.com/mattn/go-sqlite3/pull/1136) - [@​Spaider](https://redirect.github.com/Spaider) made their first contribution in [#​1069](https://redirect.github.com/mattn/go-sqlite3/pull/1069) - [@​andrzh](https://redirect.github.com/andrzh) made their first contribution in [#​1149](https://redirect.github.com/mattn/go-sqlite3/pull/1149) - [@​parthokr](https://redirect.github.com/parthokr) made their first contribution in [#​1163](https://redirect.github.com/mattn/go-sqlite3/pull/1163) - [@​leso-kn](https://redirect.github.com/leso-kn) made their first contribution in [#​1177](https://redirect.github.com/mattn/go-sqlite3/pull/1177) - [@​pomadev](https://redirect.github.com/pomadev) made their first contribution in [#​1222](https://redirect.github.com/mattn/go-sqlite3/pull/1222) - [@​dustin-ward](https://redirect.github.com/dustin-ward) made their first contribution in [#​1239](https://redirect.github.com/mattn/go-sqlite3/pull/1239) - [@​jonstacks](https://redirect.github.com/jonstacks) made their first contribution in [#​1300](https://redirect.github.com/mattn/go-sqlite3/pull/1300) - [@​samjewell](https://redirect.github.com/samjewell) made their first contribution in [#​1290](https://redirect.github.com/mattn/go-sqlite3/pull/1290) - [@​q66](https://redirect.github.com/q66) made their first contribution in [#​1262](https://redirect.github.com/mattn/go-sqlite3/pull/1262) - [@​hionay](https://redirect.github.com/hionay) made their first contribution in [#​1259](https://redirect.github.com/mattn/go-sqlite3/pull/1259) - [@​justinsb](https://redirect.github.com/justinsb) made their first contribution in [#​1305](https://redirect.github.com/mattn/go-sqlite3/pull/1305) - [@​eraytufan](https://redirect.github.com/eraytufan) made their first contribution in [#​1346](https://redirect.github.com/mattn/go-sqlite3/pull/1346) - [@​nautaa](https://redirect.github.com/nautaa) made their first contribution in [#​1362](https://redirect.github.com/mattn/go-sqlite3/pull/1362) - [@​dsonck92](https://redirect.github.com/dsonck92) made their first contribution in [#​1364](https://redirect.github.com/mattn/go-sqlite3/pull/1364) - [@​Jaculabilis](https://redirect.github.com/Jaculabilis) made their first contribution in [#​1313](https://redirect.github.com/mattn/go-sqlite3/pull/1313) - [@​theimpostor](https://redirect.github.com/theimpostor) made their first contribution in [#​1379](https://redirect.github.com/mattn/go-sqlite3/pull/1379) - [@​calmh](https://redirect.github.com/calmh) made their first contribution in [#​1338](https://redirect.github.com/mattn/go-sqlite3/pull/1338) - [@​dxbjavid](https://redirect.github.com/dxbjavid) made their first contribution in [#​1402](https://redirect.github.com/mattn/go-sqlite3/pull/1402) **Full Changelog**: <https://github.com/mattn/go-sqlite3/compare/v1.14.16...v1.14.48> </details> <details> <summary>modelcontextprotocol/go-sdk (github.com/modelcontextprotocol/go-sdk)</summary> ### [`v1.7.0`](https://redirect.github.com/modelcontextprotocol/go-sdk/releases/tag/v1.7.0) [Compare Source](https://redirect.github.com/modelcontextprotocol/go-sdk/compare/v1.6.1...v1.7.0) This release brings full support for protocol version **`2026-07-28`**. The wire protocol is largely rewritten: a stateless model with per-request `_meta`, a new `server/discover` RPC replacing the `initialize` handshake, multi-round-trip requests (MRTR) replacing server-initiated calls, a unified `subscriptions/listen` stream replacing free-floating change notifications, standardised HTTP headers, and the formal deprecation of the roots, sampling, and logging features. The streamable HTTP transport accepts requests at protocol version `2026-07-28` only when `StreamableHTTPOptions.Stateless = true`. If you want to expose the new protocol over HTTP, set `Stateless = true`; if you want to keep stateful sessions, your clients will negotiate down to `2025-11-25`. Backward compatibility with `2025-11-25` and earlier is preserved on every endpoint. The SDK negotiates the highest mutually-supported version at connect time. The new protocol is enabled by default for new clients; existing legacy clients and servers continue to work unchanged. This release consolidates everything shipped in `v1.7.0-pre.1`, `v1.7.0-pre.2`, and `v1.7.0-pre.3`. Thank you to everyone who exercised the pre-releases and filed feedback. `v1.7.0-pre.3` is already [successfully used](https://github.blog/changelog/2026-07-23-github-mcp-server-supports-the-next-mcp-specification/) by GitHub, serving more than half a million users. #### Make MCP Stateless ([SEP-2575](https://redirect.github.com/modelcontextprotocol/modelcontextprotocol/pull/2575)) & Sessionless ([SEP-2567](https://modelcontextprotocol.io/seps/2567-sessionless-mcp)) The `initialize`/`notifications/initialized` handshake is removed in `2026-07-28`. Each request now carries `_meta.io.modelcontextprotocol/{protocolVersion,clientInfo,clientCapabilities}` so the server can validate the peer without state. A new `server/discover` RPC lets clients learn the server's supported versions and capabilities up front; the SDK falls back to legacy `initialize` if discover fails. Resumability (`Last-Event-ID`, standalone GET) is removed; `ping`, `logging/setLevel`, `resources/subscribe`, and `resources/unsubscribe` are also removed on this revision and rejected with `MethodNotFound`. - mcp: Implement support for SEP-2575 on client side by [@​guglielmo-san](https://redirect.github.com/guglielmo-san) ([#​975](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/975)) - mcp: Implement server-side support for discover method (SEP-2575) by [@​guglielmo-san](https://redirect.github.com/guglielmo-san) ([#​987](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/987)) - mcp: Implement stateless server (SEP-2575) by [@​guglielmo-san](https://redirect.github.com/guglielmo-san) ([#​965](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/965)) - mcp: add support for logging level (SEP-2575) by [@​guglielmo-san](https://redirect.github.com/guglielmo-san) ([#​997](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/997)) - mcp: Remove resumability and introduce `MissingRequiredClientCapability` error data by [@​guglielmo-san](https://redirect.github.com/guglielmo-san) ([#​1005](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/1005)) - mcp: remove session header handling in stateless mode by [@​maciej-kisiel](https://redirect.github.com/maciej-kisiel) ([#​952](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/952)) - mcp: do not call DELETE for sessionless & doc adjustments by [@​maciej-kisiel](https://redirect.github.com/maciej-kisiel) ([#​960](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/960)) - mcp: Implement retry on advised supportedVersions in `UnsupportedProtocolVersion` error by [@​guglielmo-san](https://redirect.github.com/guglielmo-san) ([#​989](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/989)) - mcp: Enable legacy initialize fallback on any error by [@​guglielmo-san](https://redirect.github.com/guglielmo-san) ([#​1014](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/1014)) #### Subscriptions listen ([SEP-2575](https://redirect.github.com/modelcontextprotocol/modelcontextprotocol/pull/2575)) The legacy `tools/list_changed`, `prompts/list_changed`, `resources/list_changed`, and `resources/updated` notifications are replaced by a single long-lived `subscriptions/listen` request whose response stream multiplexes every change notification the client opted into, each tagged with `io.modelcontextprotocol/subscriptionId`. The SDK opens this stream automatically on `Client.Connect` when the corresponding list-changed handler is set; servers route notifications only to subscribed sessions. - mcp: Implement `subscriptions/listen` rpc (SEP-2575) by [@​guglielmo-san](https://redirect.github.com/guglielmo-san) ([#​1007](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/1007)) - mcp: refactor notification of subscribed sessions by [@​guglielmo-san](https://redirect.github.com/guglielmo-san) ([#​1018](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/1018)) #### Multi Round-Trip Requests ([SEP-2322](https://redirect.github.com/modelcontextprotocol/modelcontextprotocol/pull/2322)) Server-to-client requests for elicitation, sampling, and roots are no longer issued as fresh JSON-RPC requests. Instead a tool/prompt/resource handler returns an `InputRequiredResult` whose `inputRequests` field carries the requests; the client fulfils each and retries the original call with `inputResponses` populated. The SDK ships client- and server-side middleware that handles this transparently in both directions, including a server-side compatibility shim that lets MRTR handlers also work against legacy clients. - feat: multi-round-trip request implementation (SEP-2322) by [@​yarolegovich](https://redirect.github.com/yarolegovich) ([#​950](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/950)) #### Cacheable list results ([SEP-2549](https://redirect.github.com/modelcontextprotocol/modelcontextprotocol/pull/2549)) `tools/list`, `prompts/list`, `resources/list`, `resources/templates/list`, `resources/read`, and `server/discover` results now carry `ttlMs` and `cacheScope` fields. Clients honour them as freshness hints to reduce polling; shared intermediaries use `cacheScope` to decide whether responses may be cached. - mcp: add ttl for list results (SEP-2549) by [@​guglielmo-san](https://redirect.github.com/guglielmo-san) ([#​1008](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/1008)) - mcp: add Cacheable fields to `DiscoverResult` by [@​guglielmo-san](https://redirect.github.com/guglielmo-san) ([#​1022](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/1022)) #### HTTP standardization ([SEP-2243](https://redirect.github.com/modelcontextprotocol/modelcontextprotocol/pull/2243)) The streamable HTTP transport now mirrors selected fields from the JSON-RPC body into HTTP headers (`Mcp-Method`, `Mcp-Name`, `Mcp-Protocol-Version`, `Mcp-Param-*`) so network intermediaries can route and observe MCP traffic without deep packet inspection. Tools can declare per-parameter passthrough via `x-mcp-header` annotations on their input schema. Body↔header mismatches return `-32020 HeaderMismatch`. - mcp: HTTP Header Standardization for `x-mcp-header` by [@​guglielmo-san](https://redirect.github.com/guglielmo-san) ([#​915](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/915)) - mcp: fix http-standardization (SEP-2243) by [@​guglielmo-san](https://redirect.github.com/guglielmo-san) ([#​1010](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/1010)) #### Deprecation of roots, sampling, and logging ([SEP-2577](https://redirect.github.com/modelcontextprotocol/modelcontextprotocol/pull/2577)) Roots, sampling, and logging are formally deprecated on the `2026-07-28` revision. The SDK continues to expose the corresponding Go types for backward compatibility with older peers, but new servers should not rely on them. - mcp: Deprecate roots, sampling and logging (SEP-2577) by [@​guglielmo-san](https://redirect.github.com/guglielmo-san) ([#​1017](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/1017)) #### Behavior changes guarded by MCPGODEBUG Seven escape-hatch flags are added in this release to restore behavior that changed as part of spec-compliance fixes. All will be removed in **v1.9.0**. - **`customresnotfounderrcode=1`** — restore the old `-32002` code for `ResourceNotFoundError`. - **`hintomitempty=1`** — restore `omitempty` on `ToolAnnotations.ReadOnlyHint` and `IdempotentHint`. The default now always serializes these fields because the Go types are bare `bool` (not `*bool`), so omitting `false` made it indistinguishable from "unset". - **`allowsessionsinstateless=1`** — restore session-id handling on stateless streamable HTTP servers (read/write `Mcp-Session-Id`, accept `DELETE`). The default behavior is now what the spec requires: stateless servers ignore session IDs entirely and return `405 Method Not Allowed` for `DELETE`. - **`nomethodnotfoundcodeinerror=1`** — restore the previous STDIO behavior where the JSON-RPC `MethodNotFound` (`-32601`) code is omitted from the error response for unhandled methods. The default now includes the code. - **`noprotocoler > ✂ **Note** > > PR body was truncated to here. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/kenn-io/agentsview). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zNS40IiwidXBkYXRlZEluVmVyIjoiNDQuMzUuNCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==--> Co-authored-by: renovate[bot] <renovate[bot]@users.noreply.github.com> |
||
|
Wes McKinney
|
38771b144a |
test(sync): encode issue 1418 fixture consistently (#1479)
The macOS FSEvents job remained red because the issue 1418 regression encoded temporary paths differently from Cursor. Dots and underscores stayed literal, so the filesystem resolver could not match the workspace after it was created. The test now uses the shared Cursor fixture encoder already used by the lifecycle coverage. This keeps the regression focused on refreshing `Cwd` for an unchanged transcript and removes the duplicate encoder that drifted. Co-authored-by: Wes McKinney <wesm@users.noreply.github.com> |
||
|
Wes McKinney
|
a95965b901 |
test(sync): use public macOS paths for Cursor fixtures (#1478)
Cursor workspace integration fixtures now derive encoded paths, filters, and expected values from macOS's public `/var/...` spelling. The resolver already normalizes the runner's `/private/var/...` temporary paths to that spelling; aligning the fixtures removes the macOS-only failures without changing production path handling. Co-authored-by: Wes McKinney <wesm@users.noreply.github.com> |
||
|
Jessie.H
|
cd051fffd7 |
fix(parser): preserve Antigravity CLI effort metadata (#1461)
## Problem Antigravity CLI 1.1.5 stores generation data in a new format. `gen_metadata.idx` identifies a generation. It does not identify a step. Protobuf field 2 contains the step indices for the generation. Generation field 19 contains the base model slug: ```text gemini-3.7-flash ``` The related `executor_metadata` field 28 contains the model effort: ```text gemini-3.7-flash-high ``` AgentsView currently uses `gen_metadata.idx` as the step index. This behavior can attach data to the wrong step. It can also discard usage data when the two indices differ. AgentsView does not read the model effort from the executor metadata. As a result, the parsed model can lose its Low, Medium, or High effort. Closes #1460. ## Change - Read the packed step indices from generation field 2. - Map each generation to its first decoded planner step. - Use protobuf field 1 as the primary step kind. - Use the SQLite `step_type` value only when field 1 is absent. - Use the largest generation step index to select the executor range. - Select the first executor whose `endStep` includes that index. - Read the effort-qualified model from executor field 28. - Apply the executor model only when both base model slugs match. - Keep the complete field 21 display label when it is available. - Use `gen_metadata.idx` only when generation field 2 is absent. - Do not guess a step when field 2 is present but invalid. - Document the observed Antigravity CLI 1.1.5 fields. ## Compatibility The change keeps support for older session formats. Sessions without `executor_metadata` continue to parse. Sessions without generation field 2 continue to use the index-aligned format. A complete field 21 label remains authoritative: ```text Gemini 3.7 Flash (High) ``` AgentsView does not apply an executor model when the base model slugs differ. ## Verification The regression tests cover these conditions: - The generation index differs from the planner step index. - Generation field 2 contains packed step indices. - The SQLite `step_type` value differs from protobuf field 1. - Protobuf field 1 identifies the step as a planner response. - Executor field 28 restores the `-high` suffix. - A different executor base model does not replace the generation model. - A complete field 21 label remains unchanged. - The usage event uses the planner timestamp. - The message receives the correct token counts. - An absent field 2 enables the legacy fallback. - A valid field 2 enables the new mapping. - An invalid field 2 does not enable the legacy fallback. - Older index-aligned sessions work without an executor table. These commands completed successfully: ```text go test -tags fts5 ./internal/parser -count=1 make test-short ``` The Markdown source checks also passed. The complete documentation check could not load `origin/docs-assets`. The fork does not contain that artifact branch. Two independent reviewers found no remaining issues after the final fixes. ## Data safety The parser only reads the existing SQLite metadata. This change does not modify a session database. This change does not connect to the central PostgreSQL database. This change does not run `agentsview pg push`. This change does not start a resync. This change does not change the remote backup. Co-authored-by: Jessie.H <jchuder@users.noreply.github.com> |
||
|
Wes McKinney
|
5e6c6fe18e |
perf(usage): serve usage reports from an exact daily rollup cache (#1454)
SQLite aggregate usage reads (`usage daily`, top sessions, billed and matching session counts) are now served from a disposable cache of daily rollups instead of ranking and pricing every token-bearing message on each request. Warm 30-day reads on a production-scale archive complete in under a second, down from several seconds. Results are byte-identical to the live path. **How it works** - A sibling database (`usage-cache-v1-<id>.db`) holds timezone-neutral normalized facts as a build substrate plus per-timezone daily rollup rows at `(session, local day, model)` grain. - Dedup groups are classified per group at build time. Groups whose resolution cannot vary with the query window or live filters are finalized into daily rows with exact winner, attribution, and web-search semantics. Irreducible groups (cross-session, cross-day, cross-model, Copilot authoritative costs, Cursor events) stay in a narrow exception tier resolved at read time, so exception volume scales with genuine duplicates, not with messages. - Every read captures archive fingerprints, pricing, and Cursor high-water state, then verifies all required installs in one pinned cache transaction. When a fill, Cursor batch, or deletion changes a session's dedup identities, the same cache transaction invalidates every other session sharing a changed identity, so a finalized daily row never survives gaining a sibling. - Stale or racing reads retry up to three times, then fail clearly. The cache never falls back to stale or live aggregate results. - A writable daemon backfills newest sessions first and warms the local plus recently requested timezones. Requests slower than two seconds log privacy-safe per-phase timings. **Archive changes** - The first writable open builds three usage discovery/covering indexes on `messages`; upgrading a large archive blocks startup while they build, and the wait is logged. Read-only binaries require these indexes. - Full resync drops those indexes in the temporary database during the bulk load and rebuilds each once before the swap, and newly inserted sessions skip a redundant sync-marker touch, so resync throughput does not regress. - Finalizing streamed usage now participates in transcript identity (revision bump, mirror refresh, secret-scan invalidation on real changes). **Limits and tradeoffs** - The cache is derived data: safe to delete when nothing is running, rebuilt automatically. The first query after install, upgrade, or deletion pays a cold build; background backfill covers it afterward. - Cursor usage events stay entirely on the exception tier (their keys and per-row headless filters are not window-independent). - PostgreSQL keeps its live implementation under complete-result parity coverage; the PG-native optimization is tracked in #1451. **Where to look** - `internal/db/usage_rollup_classify.go`: group classification and cross-session identity checks - `internal/db/usage_cache_fill.go`: fill, notification, and sibling invalidation - `internal/sync/engine.go`: resync index drop/rebuild - `docs/internal/usage-aggregate-cache.md` and `docs/agents/storage.md`: durable contracts Co-authored-by: Wes McKinney <wesm@users.noreply.github.com> |
||
|
Rod Boev
|
372ed6df71 |
fix(parser): settle unsupported Trae source skips (#1431)
Trae's encrypted layouts can leave `state.vscdb` with an empty or absent session index, so AgentsView repeatedly retries an unreadable source. This treats known-unsupported layouts as clean skips with no failure or presence authority, preserving archived members while supported legacy sessions, valid empty stores, malformed layouts, and anomaly reporting keep their current behavior. The measured layout comes from @Helix-lyh's issue report and the captured international Trae corpus. Closes #1416 Co-authored-by: Rod Boev <rodboev@users.noreply.github.com> |
||
|
Rusty Shackleford
|
f6d25b8af3 |
feat(rawsync): add device authentication core (#1459)
Adds the server-side device authentication boundary for hosted raw custody. Devices enroll once and keep a random credential; PostgreSQL stores only its SHA-256 digest. Active devices exchange that credential for short-lived opaque tokens scoped to negotiation, upload, commit, and status. Authentication derives tenant and device identity from server-side records, and revocation invalidates outstanding tokens. This remains an internal foundation. #1459 does not add HTTP enrollment or upload routes, the laptop uploader, server parsing, or server embeddings, so the authenticated raw transport item in #1352 remains incomplete. The Zensical guide now documents the completed raw custody foundation from #1396, this authentication boundary, their security guarantees, the current delivery status, and the unchanged `pg push` workflow. Co-authored-by: Rusty Shackleford <salmonumbrella@users.noreply.github.com> |
||
|
Rod Boev
|
d4f7148728 |
fix(parser): resolve Cursor workspace cwd from the filesystem (#1432)
This makes the Cursor parser resolve workspace identity through one filesystem-backed authority, with passive discovery and explicit resume using separate policies. Remote imports never search the local filesystem, discovery reuses a resolution only within one operation, and generic sync refreshes stored Cwd when the resolved workspace changes while preserving it when passive probing has no authority. Refs #1418 Co-authored-by: Rod Boev <rodboev@users.noreply.github.com> |
||
|
Marius van Niekerk
|
ed6c844185 |
fix(frontend): keep virtual rows aligned after sort toggle (#1472)
Transcript rows now remain adjacent when users toggle between oldest-first and newest-first order, including after deep scrolling through mixed-height messages. The sort direction is now a reactive input to the message virtualizer, so item keys and cached measurements stay aligned with the rendered order instead of leaving gaps or overlaps. The focused browser regression uses uneven row heights and repeated deep-scroll toggles. The key review point is the virtualizer options closure in `MessageList.svelte`. |
||
|
Marius van Niekerk
|
6018207494 |
fix(frontend): keep localized chart labels visible (#1468)
French USD y-axis amounts on the Usage page now remain inside the chart instead of losing their leading digits at the SVG edge. The fixed 40 px gutter only fit shorter labels such as English currency values. The chart derives the gutter from its widest formatted tick and uses the same value for the plot origin, paths, date labels, viewBox, and legend alignment. Short labels keep the existing 40 px minimum, so English and token layouts do not change. A focused component regression covers the French formatting that exposed the bug. The width calculation uses a conservative estimate for the chart's 9 px monospace labels. This avoids an asynchronous DOM measurement pass and keeps the SVG geometry deterministic. Closes #1463 Co-authored-by: mariusvniekerk <mariusvniekerk@users.noreply.github.com> |
||
|
Marius van Niekerk
|
40ce877d8c |
fix(frontend): use stable project keys in Usage filter (#1464)
The Usage toolbar now identifies Project filter options by stable `project_key` values while keeping resolved project names as display labels. This prevents duplicate display names from sharing one control identity and keeps the toolbar aligned with the project filter applied by the Usage requests. The singleton Usage store retains projects seen in earlier summary responses, so an excluded project remains individually restorable after leaving and returning to the page. Bulk Deselect all adds the listed keys to existing exclusions, so a filtered response that omits a hidden project cannot silently clear it. Legacy name exclusions remain visibly active until Select all clears both forms. The mismatch began when attribution clicks switched to stable keys but the toolbar continued to write name exclusions. A treemap click could hide a project through `excludedProjectKeys` while the dropdown read `excludedProjects`. Stable keys remain response-scoped and stay out of URLs. Existing name-based URL filters remain supported. The main review points are the stable-key catalogue and bulk-selection state in `usage.svelte.ts` and the ID/label split in `FilterDropdown.svelte`. |
||
|
Marius van Niekerk
|
a588d320fd |
fix(frontend): stop 1Password prompt in project picker (#1465)
Opening the All Projects picker could trigger 1Password's credential menu because kit-ui's transient search input could not receive field-specific browser integration attributes. This pins the merged kit-ui Typeahead API and applies `data-1p-ignore` only to project queries. Password and token fields elsewhere remain available to password managers. The component regression opens the picker and checks the rendered combobox marker. |
||
|
godlockin
|
2ad3773c98 |
feat(pricing): add OpenRouter as a second pricing source (#1225)
Adds OpenRouter's public model catalog as a second pricing source under LiteLLM. `pricing.FetchCatalog` fetches LiteLLM and OpenRouter together; if either fetch fails, the last stored catalog is kept. `pricingrefresh` drives every refresh through it, so the `usage` CLI, the statusline, and the server's existing daily refresh loop all pick up OpenRouter with no separate code path. At store time, `Catalog.Reconcile` merges the snapshot over the stored table: an OpenRouter row is dropped when the LiteLLM catalog, or any stored row from another source (LiteLLM, embedded, supplemental), already lists the same canonical model name under any spelling or provider prefix. Adding OpenRouter therefore never changes a lookup that already resolved, and two spellings of one model never tie in the resolver. Rows are copied whole (a zero rate is a valid free-model price, so nothing is backfilled across sources), and no bare aliases are emitted because the resolver already matches a bare session name against a lone qualified key. A single sentinel row, `_openrouter_models`, records which stored rows came from OpenRouter. A later refresh or fallback reseed retires a tracked row once another source covers its model under a different spelling, transfers ownership of exact patterns, and keeps rows OpenRouter merely delisted so old sessions stay priced. `db.ReconcileModelPricing` applies the deletes, upserts, and sentinel in one transaction. `db.PlanModelPricingSync` gives the PostgreSQL and DuckDB pushes the same rules in both directions: a local OpenRouter row is withheld when a target row from another source already covers its model, a target-owned row is removed only when the local catalog covers its model under a different spelling, and target and local ownership are merged so no machine strips ownership another machine recorded on a shared target. PostgreSQL runs the read, plan, and write in one transaction under a schema-scoped advisory lock so concurrent pushes cannot overwrite each other's merged ownership. Sentinel rows compare by value in `FilterChangedModelPricing`; PostgreSQL writes them through a dedicated statement because their `updated_at` is not a timestamp, and DuckDB commits band deletes before parent deletes because it rejects both in one transaction. The OpenRouter parser produces microdollar rates, keeps text-output models (including multimodal-input models), and skips negative or malformed entries per row so a single odd upstream entry cannot block the whole refresh. Docs: pricing-source, `--offline`, and privacy sections describe the two catalogs and their precedence. Reviewers: `internal/pricing/openrouter.go` (`Catalog.Reconcile`, `ShadowedPatterns`), `internal/pricingrefresh/refresh.go` (`storeCatalog`), `internal/db/pricing.go` and `pricing_sync.go`, and the push changes in `internal/postgres/pricing.go` and `internal/duckdb/push.go`. Co-authored-by: godlockin <godlockin@users.noreply.github.com> |
||
|
Wes McKinney
|
4ff8d50617 |
fix(sync): keep fsnotify event reader off native Add and Remove (#1455)
Fixes a Windows-only deadlock that hung `internal/sync` CI runs until the 20-minute timeout (for example [this run](https://github.com/kenn-io/agentsview/actions/runs/32181050198/job/95870822954)), and closes the event-loss recovery gaps found while fixing it. ## Cause fsnotify's Windows backend services `Add` and `Remove` on the same goroutine that delivers events over an unbuffered channel, and only between deliveries. Our event loop was the sole consumer and called `Add`/`Remove` inline, so a native batch with more than one event deadlocked the loop against the watcher, and `Close` could abandon the pending request, hanging `Stop`. inotify and kqueue use direct syscalls, so only Windows was affected. ## Changes - Split the loop into a pump that drains the native channels into a bounded queue (16384 items, inotify's default) and a loop that translates and calls `Add`/`Remove`, so the event consumer never waits on the native watcher. The pump starts with the first native `Add`, because registration runs before `Start`, and `Stop` lets the loop leave any in-flight request before the native watcher closes. - Queue overflow becomes a lost-events full sync, matching kernel overflow. - Overflow can drop events whose side effects maintain watch coverage, so recovery goes beyond the one-time full sync: recursive roots move to polling, shallow watches are re-added (with polling on failure), and the macOS wrapper marks kqueue-backed roots lost in every fallback phase so lifecycle recovery revalidates them. The wrapper also forwards the pathless full-sync marker it previously dropped for lacking an owning root. - The ssh resolve-script tests retry when MSYS bash on Windows runners dies during process startup, a transient runner failure unrelated to the script. ## Where to look - `internal/sync/watch_backend_fsnotify.go`: `nativeEventQueue`, `pump`, `loop`, `forwardNativeError`, `Stop`. - `internal/sync/watch_backend_factory_darwin.go`: `handleKqueueEvent`. - `TestFSNotifyBackendRemoveDuringBatchDoesNotDeadlockEventLoop` reproduces the Windows hang deterministically on any OS and fails on `main`; the other new tests each pin one recovery path. Co-authored-by: Wes McKinney <wesm@users.noreply.github.com> |
||
|
Phillip Cloud
|
5811e84f92 |
fix(activity): restore Grok agent-minutes (#1450)
Restores Grok activity timing by enriching chat-history messages from the timestamped authoritative update stream. Matching follows Grok turn boundaries, keeps parallel tool-call starts separate, uses populated tool identifiers as authoritative, and falls back to exact content only when identifiers are unavailable. Grok tool starts and terminal updates now use the existing tool-result event model. Activity treats terminal completions as sparse timeline anchors: they extend activity after the final transcript message and reset the gap cap before later messages without adding hidden or visible transcript rows, including for backend tools. Same-session overlaps are unioned, and post-range completions remain eligible successors so report-boundary clipping stays correct. The report keeps transcript pairing on its indexed query path and merges sparse completion candidates afterward, avoiding full-transcript scans for ordinary sessions. The parser data version is bumped to reparse existing archives, and the public Grok session-format evidence is documented. Regression coverage uses only synthetic, provider-shaped fixtures. |
||
|
Rod Boev
|
de02740582 |
fix(parser): recover legacy OpenCode session cwd from project metadata (#1436)
Legacy OpenCode sessions now use the matching project metadata worktree when their session file has no directory, so cwd and project are restored. File-backed storage fingerprints derive their identity from raw session, project, message, and part rows before normalization, so cold freshness checks do not build a discarded transcript before parsing the session. The provider-factory-owned project index keeps project refreshes bounded across provider instances, and sources with carried discovery mtime avoid a second composite-mtime traversal. Existing session-directory precedence, provider labels, SQLite behavior, and project-scoped refreshes remain intact. Closes #1248 Co-authored-by: Rod Boev <rodboev@users.noreply.github.com> |
||
|
Rod Boev
|
83070fc1b3 |
fix(server): require consent for shorter session uploads (#1443)
Session uploads currently replace an existing transcript wholesale, so a shorter re-upload can reduce a stored session from 96 messages to 24 with a successful response and no caller consent. This makes shorter replacements return `409 Conflict` by default and requires the caller to pass `allow_shorter=true` for an intentional rewrite. If any member of a multi-session upload would shrink, the whole batch rolls back and the destination file does not move. The guard compares message counts inside the existing atomic batch transaction, keeping the decision and replacement under the same lock. This is the destructive-replacement slice of #1333. It stacks on #1435, which establishes transcript identity and lineage. Closes #1333 Co-authored-by: Rod Boev <rodboev@users.noreply.github.com> |
||
|
Phillip Cloud
|
d2513d6bc6 |
fix(activity): classify Grok non-interactive sessions (#1457)
## Summary Grok sessions now treat an explicit `prompt_context.json` `is_non_interactive` value as durable automation provenance. The provider watches and fingerprints the sidecar so sessions are reparsed when it appears or changes, while missing or false values remain subject to the existing transcript classifier. SQLite and PostgreSQL automation audits preserve this provider classification, so Activity filtering and automated/interactive aggregation consume the corrected stored flag. The format inventory records commit-pinned first-party evidence for this narrow claim. This change is limited to automated-session detection. It does not include Grok usage, timestamp, role, or agent-minute changes. |
||
|
Takuro Onoue
|
540b059d0e |
fix(i18n): refine Japanese activity labels (#1456)
Refines four Japanese activity and data-management labels whose machine translations changed their meaning or implied incorrect behavior. The empty generated-analysis state now accurately states that no saved generated analysis exists. Co-authored-by: kusanaginoturugi <kusanaginoturugi@users.noreply.github.com> |
||
|
Rusty Shackleford
|
3439cd0099 |
feat(rawsync): add hosted raw custody core (#1396)
## Summary Adds the storage layer for raw-first hosted sync (#1352): the server keeps the original agent session files, not just the parsed rows. With the source files on hand, the server can re-parse after a parser fix or rebuild lost data. Nothing calls this yet. There is no upload API, no server-side parsing, and no change to local sync or `pg push`. Those come in later PRs. ## How it works A client uploads content-addressed objects, then a **manifest** that lists one source (for example one Codex session file), its files, and the SHA-256 and length of every piece. - `internal/rawsync/manifest.go` validates the manifest and produces one canonical JSON document. Its SHA-256 is the manifest ID. Tenant and device IDs are embedded, so it cannot be replayed under another identity. Unknown providers and `RemoteSyncExcluded` providers (Omnigent, Trae) are rejected. - `internal/rawsync/object_store*.go` stores objects and manifests immutably in the existing artifact store under a per-tenant prefix. Same content again is a no-op; different content under the same digest is a conflict. - `internal/postgres/raw_ingest_*.go` records verified objects, accepted manifests, each source's current head, and a parse job per manifest, all in one transaction. Same capture ID returns the same receipt. A manifest must name the current head as its parent (compare-and-swap), and every object it references must already be verified. Accepted rows are append-only. - `internal/rawsync/service.go` is the single entry point for later upload handlers. It rejects excluded providers and oversized objects before accepting bytes. ## Notes for reviewers - Source keys and paths can be 4096 bytes, so unique keys use a SHA-256 of the text (see `rawIngestDDL`). - On the schema-current `pg push` fast path, a role without `CREATE` skips the raw custody DDL with a log line instead of failing the push. - End-to-end test: `internal/postgres/raw_ingest_custody_pgtest_test.go`. Refs #1352 Co-authored-by: Rusty Shackleford <salmonumbrella@users.noreply.github.com> |
||
|
Takuro Onoue
|
5dccc9982f |
feat(i18n): add Japanese locale (#1442)
Add a Japanese Paraglide locale with translated interface copy and Japanese locale selection. The translation preserves message keys and message-format structure while aligning common UI terminology. Co-authored-by: Takuro Onoue <kusanaginoturugi@users.noreply.github.com> |
||
|
Wes McKinney
|
41247a7533 |
docs: document the 0.41.1 release (#1449)
AgentsView 0.41.1 shipped Windows system tray support and three reliability fixes, but the published changelog did not yet describe the release as a complete, dated entry. This documents the shipped behavior and credits the contributors responsible for the Windows lifecycle, VS Code Copilot indexing, daily usage snapshots, and subagent-link fixes. The change is limited to release text; existing screenshot assets remain unchanged. Co-authored-by: Wes McKinney <wesm@users.noreply.github.com> |
||
|
Wes McKinney
|
a902515a2f |
Make daily usage snapshot selection planner-independent (#1448)
Daily usage on large SQLite archives no longer depends on SQLite choosing an automatic index for the Claude snapshot-survivor join. Pass-through rows now use an indexed single-column request-key probe, while ranked survivors are appended directly. This keeps the query linear when the planner would otherwise scan the materialized ranking for every usage row. The request key counts identifier bytes, so embedded NUL characters cannot make distinct Claude request identities collide. The hot JSON scanner also returns ordinary escape-free strings without an `encoding/json` round trip; on the preserved 100,000-row benchmark this reduced allocations by about 44% and allocated bytes by about 52%. The planner-independent query adds about 13–21% SQL time on the synthetic snapshot fixture when the old automatic-index plan cooperates. In exchange, disabling automatic indexes changed the 30-day case from about 8.6 seconds with the old join to about 0.25 seconds with the new probe. Wall-clock results on the full benchmark were noisy, while both benchmark-gate orderings remained within the configured threshold. Benchmark coverage now keeps the original merge-base-comparable case and adds validated 1-, 7-, 30-, and 60-day CLI-shaped windows with duplicated snapshots, plus an explicit automatic-index-disabled case. PostgreSQL remains on its existing backend-specific query. DuckDB `sqlite_scan` and the separate offline database-open cost remain deferred. Co-authored-by: Wes McKinney <wesm@users.noreply.github.com>v0.41.1 |
||
|
Wes McKinney
|
bf3f2f033c |
docs: promote changelog in navigation (#1444)
The changelog was at the end of the documentation navigation, which made release history harder to discover. This moves it directly below Quick Start so readers can find recent changes near the main entry point. All existing page labels and routes remain unchanged. Co-authored-by: Wes McKinney <wesm@users.noreply.github.com> |
||
|
Wes McKinney
|
5de6dfdb66 |
docs: document the 0.41.0 release (#1440)
AgentsView 0.41.0 shipped substantial parser, import, generated-insight, usage, synchronization, and daemon changes that were not yet represented consistently in the published documentation. This updates the release history to match the shipped behavior and credits every human contributor in the release range. It also clarifies Qoder's current discovery paths, the CLI-only Gemini Apps import flow, and raw versus formatted tool output. The generated screenshot set now reflects the Quality and Recall organization and includes formatted tool output. Screenshot selection is deterministic against the privacy-filtered docs fixture, while generated PNGs remain on the separate docs asset branch instead of entering the main repository history. |
||
|
Marius van Niekerk
|
5ae0f872d6 |
feat(desktop): add Windows tray lifecycle (#1438)
Windows desktop users can now close the main window without losing access to AgentsView. Closing hides the window, the system tray menu restores and focuses it, and Quit remains the explicit exit path, matching the existing macOS behavior. Windows uses the packaged application icon while macOS keeps its monochrome template icon. Close interception is installed only after the tray is available, so a tray setup failure keeps normal close behavior. Linux retains normal close behavior because enabling its tray support would add separate AppIndicator packaging requirements. The shared lifecycle behavior is covered on macOS and Windows. The Windows build remains an automated CI check because the local host does not have a Windows Rust target installed. <sup>generated by a clanker</sup> |
||
|
Rod Boev
|
e382902b73 |
fix(parser): keep oversized VS Code Copilot snapshots indexable (#1433)
VS Code Copilot sessions with very large tool-output snapshots stay indexable. The parser now bounds oversized payload handling while preserving the metadata and replay state needed for normal indexing. Mixed-content browser coverage opens fixture sessions through the routed session URL, avoiding a WebKit reload race unrelated to the content assertions. Runtime diagnostics ignore browser-generated load failures from external origins, so transient third-party font errors do not mask application regressions. Closes #1412 Co-authored-by: Rod Boev <rodboev@users.noreply.github.com> |
||
|
Rod Boev
|
f2e9b0c86b |
fix(db): ignore self-referential subagent edges (#1428)
SQLite subagent linking now treats a self-referential spawn edge (`tool_calls.session_id = tool_calls.subagent_session_id`, only reachable from a corrupt or crafted transcript) as non-evidence everywhere spawn edges are enumerated: parent resolution in `subagentSpawnerExpr`, the driver sets of the global and scoped linking statements, the surviving-edge check in `clearDanglingSubagentParentQuery`, and `SubagentChildSessionIDs`. A child with a self edge and a real edge resolves to the real spawner; a child with only a self edge is left alone, so a parser-derived parent and relationship type survive. `SanitizeSession` rejects a `ParentSessionID` equal to the session's own id (and a self `ParserParentSessionID`), falling back to the parser-derived parent when it names another session and to no parent otherwise, so no write path — session batch, `UpsertSession`, or artifact import — can store a self-parent. Rows that an earlier build linked to themselves are repaired the same way — `NULLIF(parser_parent_session_id, id)`, since the linker never writes that column — once per archive by a marker-gated pass at the start of `LinkSubagentSessions` (`parent_session_id IS id` cannot use `idx_sessions_parent`, so the scan is not repeated every sync). The archive-rebuild orphan copy applies the same clear to the rows it copies, since the fresh archive's one-time pass usually runs before orphans arrive. Queue semantics, artifact-import behavior, and `CopySyncStateFrom` are unchanged from `main`. Reviewers should look at `subagentSpawnerExpr` and `repairLegacySelfParentedSessions` in `internal/db/sessions.go`, `SanitizeSession` in `internal/db/validate.go`, and `clearCopiedSelfParents` in `internal/db/orphaned.go`. Closes #1250 Co-authored-by: Rod Boev <rodboev@users.noreply.github.com> |
||
|
Wes McKinney
|
82c31c5938 |
Bring the benchmark gate under 20 minutes and fix GetDailyUsage slowdown (#1439)
## Summary Bring the PR benchmark gate under 20 minutes and fix the `GetDailyUsage` slowdown from #1314. ## Gate runtime - `make bench-gate` runs two passes. Large-fixture benchmarks (`BENCH_GATE_HEAVY`) run at 5x. All other benchmarks run at 20x. `bench.yml` passes the same settings to the merge-base run. - The gate job runs on `ubuntu-latest` for every PR. Both sides of the comparison run on one runner, so only absolute speed matters, and `ubuntu-latest` is 2-4x faster on this workload. ## GetDailyUsage fix `snapshotRankedDailyUsageRowsSQL` ranked every Claude row with window functions. SQLite scanned the row source twice and sorted full-width rows once per window. `BenchmarkGetDailyUsage` became 1.65x slower with no change in allocations, so the gate did not catch it. The query now: 1. Finds Claude requests that appear more than once with an index-only pass. 2. Ranks only those rows. 3. Joins the survivors back onto the row source. Rows that are not ranked keep their own session and pass through unchanged. Behavior is unchanged. Tests now seed real messages instead of literal rows, and a new test covers ranked, unranked, and out-of-window rows. PostgreSQL is unchanged. It materializes the shared CTE and does not have this cost. ## Where to look - `internal/db/usage.go`: `snapshotRankedDailyUsageRowsSQL` and its helpers - `Makefile`: `bench-gate` - `.github/workflows/bench.yml` Co-authored-by: Wes McKinney <wesm@users.noreply.github.com>v0.41.0 |
||
|
Wes McKinney
|
649ac6f45d |
feat(activity): scale large reports with streaming aggregation (#1420)
Large Activity reports now finish without sending raw message-pair intervals to the browser or keeping one interval object per pair during aggregation. The version 6 report endpoint streams honest phase and row counters when requested, preserves plain JSON on the same URL, and returns a bounded summary plus the first session page. The CLI uses the same paging contract in daemon and direct SQLite modes. Session sorting, chart-bucket filtering, and subsequent pages now run on the server. The Activity page keeps the current report visible while requests run, cancels obsolete requests, clears stale bucket selections after every full report refresh, and replaces the summary and table together if the archive generation changed.  SQLite reuses its existing session-ordered message index for candidate scans, avoiding a global timestamp index and its append-time write amplification. PostgreSQL and DuckDB retain range-oriented candidate indexes. All three backends feed shared Go semantics for clipping, gap handling, model attribution, bucket membership, and aggregation. The size-bounded cache only accelerates requests; signed, self-describing report IDs let cache misses and daemon restarts recompute safely. PostgreSQL now applies the persisted signing secret, empty keys are rejected, and every decoded report query is checked against the public range, bucket, filter, and gap limits before a rebuild starts. Cache-miss session pages retain the long-running request contract, while streaming progress callbacks stay local to their owning client. The remaining deliberate limit is usage deduplication: exact, mostly unique usage data still needs memory proportional to matching report-range usage rows. A strict bound would require an external spill-and-reduce design and is outside this change. Co-authored-by: Wes McKinney <wesm@users.noreply.github.com> |
||
|
Wes McKinney
|
866f7b69d4 |
ci: retry failed Docker image builds (#1437)
Transient container registry errors could stop image publication before the Dockerfile starts. The Docker workflow now retries the full multi-platform build once after a 15-second delay with the same image configuration. Deterministic failures may take one extra attempt to surface. A second failure still fails the job; registry mirrors and Dockerfile changes remain out of scope. Co-authored-by: Wes McKinney <wesm@users.noreply.github.com> |
||
|
Wes McKinney
|
64e24a74f1 |
Speed up HTTP sync by processing only changed sessions (#1414)
HTTP sync already downloaded only files that changed, but it still scanned and processed every session in the local mirror afterward. On a large history, even a small update could therefore spend minutes revisiting thousands of unchanged sessions. This change carries the list of changed files through the import step. When agentsview can identify the affected sessions precisely, it processes only those sessions. When it cannot, it broadens the work only to the relevant agent type instead of rescanning every remote session. Pending changes are recorded before the mirror is updated, so interrupted syncs can safely continue on the next run. Cache entries are cleared only where needed, including when an archive changes a file without changing its timestamp. Repeated parser failures remain suppressed after one retry instead of causing an endless full replay. First-time syncs, archive rebuilds, legacy mode, recovery from an oversized or damaged change record, and user-requested full syncs still perform a full import. A user-requested full sync now truly reparses unchanged sources instead of accepting cached freshness results. Progress output now distinguishes download size, pending changes, planned import work, fallback work, cache cleanup, and whether pending work was completed or retained for another attempt. Routine local Go test commands also reuse the build cache and limit package fan-out to reduce resource pressure. Co-authored-by: Wes McKinney <wesm@users.noreply.github.com> |
||
|
Marius van Niekerk
|
bf5bce978e |
chore: remove dead code and unused frontend exports (#1434)
Whole-program analysis found internal APIs and test helpers that neither production nor test binaries could reach. This removes those declarations and narrows handwritten frontend exports to symbols with external consumers. Generated API output and the C-to-Go FSEvents callback path remain unchanged. Runtime behavior is preserved; the change reduces obsolete supported-looking surface and makes future reachability reports more useful. Co-authored-by: Marius van Niekerk <mariusvniekerk@users.noreply.github.com> |
||
|
Rod Boev
|
b2116a44b2 |
fix(parser): populate Kimi session cwd (#1427)
Kimi Code records the working directory in top-level `config.update` records, but the parser drops it, so `sync_include_cwd_prefixes` rejects matching sessions. This records the provider cwd in `ParsedSession.Cwd` and advertises the existing capability, preserving Kimi Work and the global filter. Refs #1418 Co-authored-by: Rod Boev <rodboev@users.noreply.github.com> |
||
|
Rod Boev
|
9edbe16161 |
feat(frontend): add raw and formatted tool output display (#1424)
ToolBlock output currently renders result text only as escaped raw text, and absolute paths consume the structured header and metadata width. PR #990 already covers exact input and output copying, leaving the display behavior in this change. Adds a transient Raw/Formatted control for expanded tool output, shortens long path labels while retaining full accessible and copied values, and preserves existing input, history, collapse, and relative-path behavior. The test fixture supplies structured output for the browser check. After view, showing the expanded output mode and shortened path label:  Closes #984 Co-authored-by: Rod Boev <rodboev@users.noreply.github.com> |
||
|
Rod Boev
|
7a1eff5992 |
feat(insights): support OpenAI-compatible endpoints (#1430)
Insight generation currently depends on one of five agent CLIs, which prevents local endpoint use in containers. Adds a selectable OpenAI-compatible chat-completions endpoint with env-backed credentials, bounded errors, and unchanged CLI behavior when endpoint configuration is absent. Closes #1363 Co-authored-by: Rod Boev <rodboev@users.noreply.github.com> |
||
|
Rod Boev
|
ffacbfa0b1 |
fix(parser): support legacy Zed thread schemas (#1429)
Older Zed `threads.db` files can omit `parent_id`, so every Zed listing query fails and makes sync non-authoritative. This detects optional columns once, defaults only absent projections, and keeps modern parent filtering and hard errors for unsupported schemas. Closes #1371 Co-authored-by: Rod Boev <rodboev@users.noreply.github.com> |
||
|
Naveen Jain
|
d95546d0a5 |
perf(signals): index duplicate prompt comparisons (#1425)
Duplicate-prompt scoring rebuilt a token set for every comparison against prior substantive prompts. On long sessions, signal recomputation therefore spent most of its time repeating token hashing and garbage collection even when the prompts were distinct. This change preserves the existing exact and fuzzy scoring semantics while indexing accepted prompts by normalized text and token frequency. Each prompt now evaluates only prior representatives that share tokens. A deterministic reference test compares the indexed implementation with the original pairwise algorithm, and a large-session benchmark is added to the existing PR performance gate. On the same 800-prompt shared-vocabulary fixture, current main takes about 1.42 s and allocates 2.14 GB per operation; this branch takes about 13–19 ms and allocates 16.9 MB. The postings index grows with retained prompt tokens. A pathological session where most distinct prompts share most of their vocabulary can still require many candidate comparisons, but the implementation no longer rebuilds or scans complete token structures for every prompt pair. The main review point is equivalence with the existing asymmetric score, where current tokens are treated as a set and previous tokens remain a multiset. Co-authored-by: Naveen Jain <naveenspark@users.noreply.github.com> |
||
|
Rod Boev
|
6bcff538dc |
fix(config): honor explicit empty agent directory arrays (#1423)
An explicit empty `*_dirs` array, such as `grok_dirs = []`, clears that agent's default local directories, so local discovery finds nothing there. Matching `session_sources` entries for that agent still apply. Provider-wide exclusion is documented under Disabling Session Providers. The decoder treats every present, well-formed array as authoritative, including an empty array; malformed values preserve the existing configuration and environment variables retain precedence. Closes #1417 Co-authored-by: Rod Boev <rodboev@users.noreply.github.com> |
||
|
Weng Jialin
|
46086fe9e1 |
feat(parser): add DeepSeek Harness session support (#1402)
[DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) (`dsh`) is an open-source, plugin-based agent harness developed by DeepSeek AI. Its public documentation describes a durable session model and a dedicated JSONL persistence backend; see the [project documentation](https://github.com/deepseek-ai/deepseek-harness/blob/47f943859bef60e4160492346772ded9b24f765a/README.md) and [user guide](https://github.com/deepseek-ai/deepseek-harness/blob/47f943859bef60e4160492346772ded9b24f765a/docs/user/guide/index.md). This PR adds DeepSeek Harness as a distinct `deepseek-harness` provider. AgentsView discovers sessions from `~/.dsh/sessions` or `$DSH_HOME/sessions`, with `DEEPSEEK_HARNESS_SESSIONS_DIR` and `deepseek_harness_sessions_dirs` available as explicit overrides. It supports both plain `session.jsonl` files and the default checksummed, multi-frame `session.jsonl.zstd` encoding described by the upstream [JSONL persistence backend](https://github.com/deepseek-ai/deepseek-harness/blob/47f943859bef60e4160492346772ded9b24f765a/packages/session/session-persistence-jsonl/README.md). The default home-directory behavior follows the upstream [Harness home resolution](https://github.com/deepseek-ai/deepseek-harness/blob/47f943859bef60e4160492346772ded9b24f765a/packages/util/home-paths/README.md). AgentsView imports the visible conversation, thinking, tool activity, titles, the latest agent preset, model attribution, and token usage from both model responses and summarizing compactions. The parser validates the session path, header identity, cwd, timestamps, contiguous event sequence, and turn/step lifecycle while decoding a size-bounded snapshot of raw JSONL or zstd frames. It preserves the last committed work when the physical or semantic tail is incomplete, and can reconstruct an interrupted chunk-only response at its original transcript position until the final assistant message replaces it on a later sync. Seeded child sessions include only their own transcript and usage, preventing the copied parent prefix from being counted twice while preserving fork and subagent relationships. A filesystem change reparses and replaces only the affected session rather than scanning or content-hashing the rest of the archive. The implementation and format evidence are pinned to upstream revision [`47f943859bef60e4160492346772ded9b24f765a`](https://github.com/deepseek-ai/deepseek-harness/tree/47f943859bef60e4160492346772ded9b24f765a). The exact layout, event, packed-chunk, message, and usage sources are recorded in `docs/internal/session-format-sources.md`. This initial integration supports the JSONL persistence backend only; the optional SQLite persistence backend remains out of scope. Image references are represented as `[image]` transcript placeholders rather than copied from Harness's separate attachment store. Co-authored-by: Weng Jialin <Stool233@users.noreply.github.com> |
||
|
Wes McKinney
|
991dc65dd7 |
test(sync): wait for archive audit stall state (#1422)
The Windows Go test job could observe archive-worker startup before its one-nanosecond stall threshold became measurable. That timing race made a healthy progress test fail intermittently. The test now waits for the public progress state to report the blocked audit as stalled, matching the repository's other stalled-progress coverage. It still checks the initial phase, relayed worker counters, and cleanup after completion. Production behavior is unchanged. Co-authored-by: Wes McKinney <wesm@users.noreply.github.com> |
||
|
renovate[bot]
|
1cfe7fe6c9 |
chore(deps): update github actions dependencies (#1421)
This PR contains the following updates: | Package | Type | Update | Change | Pending | |---|---|---|---|---| | [Swatinem/rust-cache](https://redirect.github.com/Swatinem/rust-cache) | action | patch | `v2.9.1` → `v2.9.2` | | | [actions/cache](https://redirect.github.com/actions/cache) | action | major | `v4.3.0` → `v6.1.0` | | | [actions/checkout](https://redirect.github.com/actions/checkout) | action | patch | `v7.0.0` → `v7.0.1` | | | [actions/setup-go](https://redirect.github.com/actions/setup-go) | action | major | `v6.5.0` → `v7.0.0` | | | [actions/setup-node](https://redirect.github.com/actions/setup-node) | action | major | `v6.4.0` → `v7.0.0` | | | [actions/setup-python](https://redirect.github.com/actions/setup-python) | action | major | `v6.3.0` → `v7.0.0` | | | [astral-sh/setup-uv](https://redirect.github.com/astral-sh/setup-uv) | action | major | `v8.2.0` → `v9.0.0` | `v10.0.1` (+1) | | [docker/build-push-action](https://redirect.github.com/docker/build-push-action) | action | minor | `v7.2.0` → `v7.3.0` | | | [docker/login-action](https://redirect.github.com/docker/login-action) | action | minor | `v4.2.0` → `v4.6.0` | | | [docker/metadata-action](https://redirect.github.com/docker/metadata-action) | action | minor | `v6.1.0` → `v6.2.0` | | | [docker/setup-buildx-action](https://redirect.github.com/docker/setup-buildx-action) | action | minor | `v4.1.0` → `v4.2.0` | | | [docker/setup-qemu-action](https://redirect.github.com/docker/setup-qemu-action) | action | minor | `v4.1.0` → `v4.2.0` | | | [dtolnay/rust-toolchain](https://redirect.github.com/dtolnay/rust-toolchain) ([changelog](https://redirect.github.com/dtolnay/rust-toolchain/compare/4cda84d5c5c54efe2404f9d843567869ab1699d4..4360b52568e2003a75bf9bc1d59f33a8e3fc893c)) | action | digest | `4cda84d` → `4360b52` | | | [pypa/gh-action-pypi-publish](https://redirect.github.com/pypa/gh-action-pypi-publish) | action | patch | `v1.14.0` → `v1.14.2` | | | [softprops/action-gh-release](https://redirect.github.com/softprops/action-gh-release) | action | patch | `v3.0.1` → `v3.0.2` | | --- ### Release Notes <details> <summary>Swatinem/rust-cache (Swatinem/rust-cache)</summary> ### [`v2.9.2`](https://redirect.github.com/Swatinem/rust-cache/releases/tag/v2.9.2) [Compare Source](https://redirect.github.com/Swatinem/rust-cache/compare/v2.9.1...v2.9.2) ##### What's Changed - Typofix by [@​23Skidoo](https://redirect.github.com/23Skidoo) in [#​316](https://redirect.github.com/Swatinem/rust-cache/pull/316) - fix: include target names in build/ and .fingerprint/ cleanup by [@​eitsupi](https://redirect.github.com/eitsupi) in [#​317](https://redirect.github.com/Swatinem/rust-cache/pull/317) - fix: include cdylib/rlib/dylib/staticlib targets in build and fingerprint cleanup by [@​eitsupi](https://redirect.github.com/eitsupi) in [#​320](https://redirect.github.com/Swatinem/rust-cache/pull/320) - Scan content of `$CARGO_HOME/bin` on restore instead of relying on `cargo install` metadata by [@​clechasseur](https://redirect.github.com/clechasseur) in [#​325](https://redirect.github.com/Swatinem/rust-cache/pull/325) - docs: Update checkout action version to latest by [@​sondrelg](https://redirect.github.com/sondrelg) in [#​345](https://redirect.github.com/Swatinem/rust-cache/pull/345) - Fix Windows cache path validation after Rollup migration by [@​eitsupi](https://redirect.github.com/eitsupi) in [#​355](https://redirect.github.com/Swatinem/rust-cache/pull/355) - fix: support Cargo V2 build dir layout by [@​claytonwramsey](https://redirect.github.com/claytonwramsey) in [#​371](https://redirect.github.com/Swatinem/rust-cache/pull/371) ##### New Contributors - [@​23Skidoo](https://redirect.github.com/23Skidoo) made their first contribution in [#​316](https://redirect.github.com/Swatinem/rust-cache/pull/316) - [@​eitsupi](https://redirect.github.com/eitsupi) made their first contribution in [#​317](https://redirect.github.com/Swatinem/rust-cache/pull/317) - [@​clechasseur](https://redirect.github.com/clechasseur) made their first contribution in [#​325](https://redirect.github.com/Swatinem/rust-cache/pull/325) - [@​sondrelg](https://redirect.github.com/sondrelg) made their first contribution in [#​345](https://redirect.github.com/Swatinem/rust-cache/pull/345) - [@​claytonwramsey](https://redirect.github.com/claytonwramsey) made their first contribution in [#​371](https://redirect.github.com/Swatinem/rust-cache/pull/371) **Full Changelog**: <https://github.com/Swatinem/rust-cache/compare/v2.9.1...v2.9.2> </details> <details> <summary>actions/cache (actions/cache)</summary> ### [`v6.1.0`](https://redirect.github.com/actions/cache/releases/tag/v6.1.0) [Compare Source](https://redirect.github.com/actions/cache/compare/v6.0.0...v6.1.0) ##### What's Changed - Bump [@​actions/cache](https://redirect.github.com/actions/cache) to v6.1.0 - handle read-only cache access by [@​jasongin](https://redirect.github.com/jasongin) in [#​1768](https://redirect.github.com/actions/cache/pull/1768) **Full Changelog**: <https://github.com/actions/cache/compare/v6...v6.1.0> ### [`v6.0.0`](https://redirect.github.com/actions/cache/releases/tag/v6.0.0) [Compare Source](https://redirect.github.com/actions/cache/compare/v6.0.0...v6.0.0) #### What's Changed - Update packages, migrate to ESM by [@​Samirat](https://redirect.github.com/Samirat) in [#​1760](https://redirect.github.com/actions/cache/pull/1760) **Full Changelog**: <https://github.com/actions/cache/compare/v5...v6.0.0> ### [`v6`](https://redirect.github.com/actions/cache/compare/v5.0.5...v6.0.0) [Compare Source](https://redirect.github.com/actions/cache/compare/v5.1.0...v6.0.0) ### [`v5.1.0`](https://redirect.github.com/actions/cache/releases/tag/v5.1.0) [Compare Source](https://redirect.github.com/actions/cache/compare/v5.0.5...v5.1.0) ##### What's Changed - Bump [@​actions/cache](https://redirect.github.com/actions/cache) to v5.1.0 - handle read-only cache access by [@​jasongin](https://redirect.github.com/jasongin) in [#​1775](https://redirect.github.com/actions/cache/pull/1775) **Full Changelog**: <https://github.com/actions/cache/compare/v5...v5.1.0> ### [`v5.0.5`](https://redirect.github.com/actions/cache/releases/tag/v5.0.5) [Compare Source](https://redirect.github.com/actions/cache/compare/v5.0.4...v5.0.5) ##### What's Changed - Update ts-http-runtime dependency by [@​yacaovsnc](https://redirect.github.com/yacaovsnc) in [#​1747](https://redirect.github.com/actions/cache/pull/1747) **Full Changelog**: <https://github.com/actions/cache/compare/v5...v5.0.5> ### [`v5.0.4`](https://redirect.github.com/actions/cache/releases/tag/v5.0.4) [Compare Source](https://redirect.github.com/actions/cache/compare/v5.0.3...v5.0.4) ##### What's Changed - Add release instructions and update maintainer docs by [@​Link-](https://redirect.github.com/Link-) in [#​1696](https://redirect.github.com/actions/cache/pull/1696) - Potential fix for code scanning alert no. 52: Workflow does not contain permissions by [@​Link-](https://redirect.github.com/Link-) in [#​1697](https://redirect.github.com/actions/cache/pull/1697) - Fix workflow permissions and cleanup workflow names / formatting by [@​Link-](https://redirect.github.com/Link-) in [#​1699](https://redirect.github.com/actions/cache/pull/1699) - docs: Update examples to use the latest version by [@​XZTDean](https://redirect.github.com/XZTDean) in [#​1690](https://redirect.github.com/actions/cache/pull/1690) - Fix proxy integration tests by [@​Link-](https://redirect.github.com/Link-) in [#​1701](https://redirect.github.com/actions/cache/pull/1701) - Fix cache key in examples.md for bun.lock by [@​RyPeck](https://redirect.github.com/RyPeck) in [#​1722](https://redirect.github.com/actions/cache/pull/1722) - Update dependencies & patch security vulnerabilities by [@​Link-](https://redirect.github.com/Link-) in [#​1738](https://redirect.github.com/actions/cache/pull/1738) ##### New Contributors - [@​XZTDean](https://redirect.github.com/XZTDean) made their first contribution in [#​1690](https://redirect.github.com/actions/cache/pull/1690) - [@​RyPeck](https://redirect.github.com/RyPeck) made their first contribution in [#​1722](https://redirect.github.com/actions/cache/pull/1722) **Full Changelog**: <https://github.com/actions/cache/compare/v5...v5.0.4> ### [`v5.0.3`](https://redirect.github.com/actions/cache/releases/tag/v5.0.3) [Compare Source](https://redirect.github.com/actions/cache/compare/v5.0.2...v5.0.3) ##### What's Changed - Bump `@actions/cache` to v5.0.5 (Resolves: <https://github.com/actions/cache/security/dependabot/33>) - Bump `@actions/core` to v2.0.3 **Full Changelog**: <https://github.com/actions/cache/compare/v5...v5.0.3> ### [`v5.0.2`](https://redirect.github.com/actions/cache/releases/tag/v5.0.2): v.5.0.2 [Compare Source](https://redirect.github.com/actions/cache/compare/v5.0.1...v5.0.2) ##### v5.0.2 ##### What's Changed When creating cache entries, 429s returned from the cache service will not be retried. ### [`v5.0.1`](https://redirect.github.com/actions/cache/releases/tag/v5.0.1) [Compare Source](https://redirect.github.com/actions/cache/compare/v5...v5.0.1) > \[!IMPORTANT] > **`actions/cache@v5` runs on the Node.js 24 runtime and requires a minimum Actions Runner version of `2.327.1`.** > > If you are using self-hosted runners, ensure they are updated before upgrading. *** ##### v5.0.1 ##### What's Changed - fix: update [@​actions/cache](https://redirect.github.com/actions/cache) for Node.js 24 punycode deprecation by [@​salmanmkc](https://redirect.github.com/salmanmkc) in [#​1685](https://redirect.github.com/actions/cache/pull/1685) - prepare release v5.0.1 by [@​salmanmkc](https://redirect.github.com/salmanmkc) in [#​1686](https://redirect.github.com/actions/cache/pull/1686) ##### v5.0.0 ##### What's Changed - Upgrade to use node24 by [@​salmanmkc](https://redirect.github.com/salmanmkc) in [#​1630](https://redirect.github.com/actions/cache/pull/1630) - Prepare v5.0.0 release by [@​salmanmkc](https://redirect.github.com/salmanmkc) in [#​1684](https://redirect.github.com/actions/cache/pull/1684) **Full Changelog**: <https://github.com/actions/cache/compare/v5...v5.0.1> ### [`v5.0.0`](https://redirect.github.com/actions/cache/releases/tag/v5.0.0) [Compare Source](https://redirect.github.com/actions/cache/compare/v5...v5) > \[!IMPORTANT] > **`actions/cache@v5` runs on the Node.js 24 runtime and requires a minimum Actions Runner version of `2.327.1`.** > > If you are using self-hosted runners, ensure they are updated before upgrading. *** ##### What's Changed - Upgrade to use node24 by [@​salmanmkc](https://redirect.github.com/salmanmkc) in [#​1630](https://redirect.github.com/actions/cache/pull/1630) - Prepare v5.0.0 release by [@​salmanmkc](https://redirect.github.com/salmanmkc) in [#​1684](https://redirect.github.com/actions/cache/pull/1684) **Full Changelog**: <https://github.com/actions/cache/compare/v4.3.0...v5.0.0> ### [`v5`](https://redirect.github.com/actions/cache/compare/v4.3.0...v5) [Compare Source](https://redirect.github.com/actions/cache/compare/v4.3.0...v5) </details> <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v7.0.1`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v701) [Compare Source](https://redirect.github.com/actions/checkout/compare/v7.0.0...v7.0.1) - Bump github/codeql-action from 3 to 4 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2475](https://redirect.github.com/actions/checkout/pull/2475) - Bump actions/setup-node from 4 to 6 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2477](https://redirect.github.com/actions/checkout/pull/2477) - Bump docker/build-push-action from 6.5.0 to 7.2.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2478](https://redirect.github.com/actions/checkout/pull/2478) - Bump docker/login-action from 3.3.0 to 4.2.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2479](https://redirect.github.com/actions/checkout/pull/2479) - Bump actions/checkout from 6 to 7 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2488](https://redirect.github.com/actions/checkout/pull/2488) - Bump actions/upload-artifact from 4 to 7 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2476](https://redirect.github.com/actions/checkout/pull/2476) - eslint 9 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2474](https://redirect.github.com/actions/checkout/pull/2474) - Bump the minor-actions-dependencies group with 2 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2499](https://redirect.github.com/actions/checkout/pull/2499) - skip running unsafe pr check if input is default by [@​aiqiaoy](https://redirect.github.com/aiqiaoy) in [#​2518](https://redirect.github.com/actions/checkout/pull/2518) - trim only ascii whitespace for branch by [@​aiqiaoy](https://redirect.github.com/aiqiaoy) in [#​2521](https://redirect.github.com/actions/checkout/pull/2521) - escape values passed to --unset by [@​aiqiaoy](https://redirect.github.com/aiqiaoy) in [#​2530](https://redirect.github.com/actions/checkout/pull/2530) </details> <details> <summary>actions/setup-go (actions/setup-go)</summary> ### [`v7.0.0`](https://redirect.github.com/actions/setup-go/releases/tag/v7.0.0) [Compare Source](https://redirect.github.com/actions/setup-go/compare/v7.0.0...v7.0.0) ##### What's Changed - Migrate to ESM and upgrade dependencies by [@​priyagupta108](https://redirect.github.com/priyagupta108) in [#​763](https://redirect.github.com/actions/setup-go/pull/763) - chore(deps): bump [@​actions/cache](https://redirect.github.com/actions/cache) to 6.2.0 by [@​philip-gai](https://redirect.github.com/philip-gai) in [#​771](https://redirect.github.com/actions/setup-go/pull/771) ##### New Contributors - [@​philip-gai](https://redirect.github.com/philip-gai) made their first contribution in [#​771](https://redirect.github.com/actions/setup-go/pull/771) **Full Changelog**: <https://github.com/actions/setup-go/compare/v6...v7.0.0> ### [`v7`](https://redirect.github.com/actions/setup-go/compare/v6.5.0...v7.0.0) [Compare Source](https://redirect.github.com/actions/setup-go/compare/v6.5.0...v7.0.0) </details> <details> <summary>actions/setup-node (actions/setup-node)</summary> ### [`v7.0.0`](https://redirect.github.com/actions/setup-node/releases/tag/v7.0.0) [Compare Source](https://redirect.github.com/actions/setup-node/compare/v7.0.0...v7.0.0) ##### What's Changed ##### Enhancements: - Add cache-primary-key and cache-matched-key as outputs by [@​gowridurgad](https://redirect.github.com/gowridurgad) in [#​1577](https://redirect.github.com/actions/setup-node/pull/1577) - Migrate to ESM and upgrade dependencies by [@​gowridurgad](https://redirect.github.com/gowridurgad) in [#​1574](https://redirect.github.com/actions/setup-node/pull/1574) ##### Bug fixes: - Remove dummy NODE\_AUTH\_TOKEN export by [@​gowridurgad](https://redirect.github.com/gowridurgad) in [#​1558](https://redirect.github.com/actions/setup-node/pull/1558) - Only use `mirrorToken` in `getManifest` if it's provided by [@​deiga](https://redirect.github.com/deiga) in [#​1548](https://redirect.github.com/actions/setup-node/pull/1548) ##### Documentation updates: - Add documentation for publishing to npm with Trusted Publisher (OIDC) by [@​chiranjib-swain](https://redirect.github.com/chiranjib-swain) in [#​1536](https://redirect.github.com/actions/setup-node/pull/1536) - docs: Update restore-only cache documentation by [@​priya-kinthali](https://redirect.github.com/priya-kinthali) in [#​1550](https://redirect.github.com/actions/setup-node/pull/1550) - docs: Update caching recommendations to mitigate cache poisoning risks by [@​chiranjib-swain](https://redirect.github.com/chiranjib-swain) in [#​1567](https://redirect.github.com/actions/setup-node/pull/1567) ##### Dependency update: - Upgrade [@​actions/cache](https://redirect.github.com/actions/cache) to 5.1.0, log cache write denied by [@​jasongin](https://redirect.github.com/jasongin) in [#​1569](https://redirect.github.com/actions/setup-node/pull/1569) ##### New Contributors - [@​chiranjib-swain](https://redirect.github.com/chiranjib-swain) made their first contribution in [#​1536](https://redirect.github.com/actions/setup-node/pull/1536) - [@​deiga](https://redirect.github.com/deiga) made their first contribution in [#​1548](https://redirect.github.com/actions/setup-node/pull/1548) - [@​jasongin](https://redirect.github.com/jasongin) made their first contribution in [#​1569](https://redirect.github.com/actions/setup-node/pull/1569) **Full Changelog**: <https://github.com/actions/setup-node/compare/v6...v7.0.0> ### [`v7`](https://redirect.github.com/actions/setup-node/compare/v6.5.0...v7.0.0) [Compare Source](https://redirect.github.com/actions/setup-node/compare/v6.5.0...v7.0.0) ### [`v6.5.0`](https://redirect.github.com/actions/setup-node/releases/tag/v6.5.0) [Compare Source](https://redirect.github.com/actions/setup-node/compare/v6.4.0...v6.5.0) ##### What's Changed - Update [@​actions/cache](https://redirect.github.com/actions/cache) to 5.1.0 and add security overrides for undici and fast-xml-parser by [@​HarithaVattikuti](https://redirect.github.com/HarithaVattikuti) in [#​1579](https://redirect.github.com/actions/setup-node/pull/1579) **Full Changelog**: <https://github.com/actions/setup-node/compare/v6.4.0...v6.5.0> </details> <details> <summary>actions/setup-python (actions/setup-python)</summary> ### [`v7.0.0`](https://redirect.github.com/actions/setup-python/compare/v6.3.0...v7.0.0) [Compare Source](https://redirect.github.com/actions/setup-python/compare/v7.0.0...v7.0.0) ### [`v7`](https://redirect.github.com/actions/setup-python/compare/v6.3.0...v7.0.0) [Compare Source](https://redirect.github.com/actions/setup-python/compare/v6.3.0...v7.0.0) </details> <details> <summary>astral-sh/setup-uv (astral-sh/setup-uv)</summary> ### [`v9.0.0`](https://redirect.github.com/astral-sh/setup-uv/compare/v8.3.2...v9.0.0) [Compare Source](https://redirect.github.com/astral-sh/setup-uv/compare/v8.3.2...v9.0.0) ### [`v8.3.2`](https://redirect.github.com/astral-sh/setup-uv/compare/v8.3.1...v8.3.2) [Compare Source](https://redirect.github.com/astral-sh/setup-uv/compare/v8.3.1...v8.3.2) ### [`v8.3.1`](https://redirect.github.com/astral-sh/setup-uv/compare/v8.3.0...v8.3.1) [Compare Source](https://redirect.github.com/astral-sh/setup-uv/compare/v8.3.0...v8.3.1) ### [`v8.3.0`](https://redirect.github.com/astral-sh/setup-uv/compare/v8.2.0...v8.3.0) [Compare Source](https://redirect.github.com/astral-sh/setup-uv/compare/v8.2.0...v8.3.0) </details> <details> <summary>docker/build-push-action (docker/build-push-action)</summary> ### [`v7.3.0`](https://redirect.github.com/docker/build-push-action/compare/v7.2.0...v7.3.0) [Compare Source](https://redirect.github.com/docker/build-push-action/compare/v7.2.0...v7.3.0) </details> <details> <summary>docker/login-action (docker/login-action)</summary> ### [`v4.6.0`](https://redirect.github.com/docker/login-action/compare/v4.5.2...v4.6.0) [Compare Source](https://redirect.github.com/docker/login-action/compare/v4.5.2...v4.6.0) ### [`v4.5.2`](https://redirect.github.com/docker/login-action/compare/v4.5.1...v4.5.2) [Compare Source](https://redirect.github.com/docker/login-action/compare/v4.5.1...v4.5.2) ### [`v4.5.1`](https://redirect.github.com/docker/login-action/compare/v4.5.0...v4.5.1) [Compare Source](https://redirect.github.com/docker/login-action/compare/v4.5.0...v4.5.1) ### [`v4.5.0`](https://redirect.github.com/docker/login-action/compare/v4.4.0...v4.5.0) [Compare Source](https://redirect.github.com/docker/login-action/compare/v4.4.0...v4.5.0) ### [`v4.4.0`](https://redirect.github.com/docker/login-action/compare/v4.3.0...v4.4.0) [Compare Source](https://redirect.github.com/docker/login-action/compare/v4.3.0...v4.4.0) ### [`v4.3.0`](https://redirect.github.com/docker/login-action/releases/tag/v4.3.0) [Compare Source](https://redirect.github.com/docker/login-action/compare/v4.2.0...v4.3.0) - Preserve names in esbuild bundle by [@​crazy-max](https://redirect.github.com/crazy-max) in [#​1022](https://redirect.github.com/docker/login-action/pull/1022) - Bump [@​aws-sdk/client-ecr](https://redirect.github.com/aws-sdk/client-ecr) and [@​aws-sdk/client-ecr-public](https://redirect.github.com/aws-sdk/client-ecr-public) to 3.1076.0 [#​999](https://redirect.github.com/docker/login-action/pull/999) [#​1030](https://redirect.github.com/docker/login-action/pull/1030) - Bump [@​docker/actions-toolkit](https://redirect.github.com/docker/actions-toolkit) from 0.90.0 to 0.92.0 in [#​1004](https://redirect.github.com/docker/login-action/pull/1004) [#​1027](https://redirect.github.com/docker/login-action/pull/1027) - Bump [@​sigstore/core](https://redirect.github.com/sigstore/core) from 3.1.0 to 3.2.1 in [#​1023](https://redirect.github.com/docker/login-action/pull/1023) - Bump [@​sigstore/verify](https://redirect.github.com/sigstore/verify) from 3.1.0 to 3.1.1 in [#​1029](https://redirect.github.com/docker/login-action/pull/1029) - Bump http-proxy-agent and https-proxy-agent to 9.1.0 in [#​1017](https://redirect.github.com/docker/login-action/pull/1017) - Bump js-yaml from 4.1.1 to 5.2.0 in [#​1028](https://redirect.github.com/docker/login-action/pull/1028) - Bump sigstore from 4.1.0 to 4.1.1 in [#​1031](https://redirect.github.com/docker/login-action/pull/1031) - Bump tmp from 0.2.5 to 0.2.7 in [#​1002](https://redirect.github.com/docker/login-action/pull/1002) - Bump undici from 6.24.1 to 6.27.0 in [#​1020](https://redirect.github.com/docker/login-action/pull/1020) - Bump vite from 7.3.3 to 7.3.6 in [#​1019](https://redirect.github.com/docker/login-action/pull/1019) **Full Changelog**: <https://github.com/docker/login-action/compare/v4.2.0...v4.3.0> </details> <details> <summary>docker/metadata-action (docker/metadata-action)</summary> ### [`v6.2.0`](https://redirect.github.com/docker/metadata-action/compare/v6.1.0...v6.2.0) [Compare Source](https://redirect.github.com/docker/metadata-action/compare/v6.1.0...v6.2.0) </details> <details> <summary>docker/setup-buildx-action (docker/setup-buildx-action)</summary> ### [`v4.2.0`](https://redirect.github.com/docker/setup-buildx-action/releases/tag/v4.2.0) [Compare Source](https://redirect.github.com/docker/setup-buildx-action/compare/v4.1.0...v4.2.0) - Preserve names in esbuild bundle by [@​crazy-max](https://redirect.github.com/crazy-max) in [#​572](https://redirect.github.com/docker/setup-buildx-action/pull/572) - Bump [@​actions/core](https://redirect.github.com/actions/core) from 3.0.0 to 3.0.1 in [#​551](https://redirect.github.com/docker/setup-buildx-action/pull/551) - Bump [@​docker/actions-toolkit](https://redirect.github.com/docker/actions-toolkit) from 0.90.0 to 0.92.0 in [#​557](https://redirect.github.com/docker/setup-buildx-action/pull/557) [#​580](https://redirect.github.com/docker/setup-buildx-action/pull/580) - Bump [@​sigstore/core](https://redirect.github.com/sigstore/core) from 3.1.0 to 3.2.1 in [#​573](https://redirect.github.com/docker/setup-buildx-action/pull/573) - Bump [@​sigstore/verify](https://redirect.github.com/sigstore/verify) from 3.1.0 to 3.1.1 in [#​576](https://redirect.github.com/docker/setup-buildx-action/pull/576) - Bump js-yaml from 4.1.1 to 5.2.0 in [#​562](https://redirect.github.com/docker/setup-buildx-action/pull/562) - Bump sigstore from 4.1.0 to 4.1.1 in [#​577](https://redirect.github.com/docker/setup-buildx-action/pull/577) - Bump tmp from 0.2.5 to 0.2.7 in [#​556](https://redirect.github.com/docker/setup-buildx-action/pull/556) - Bump undici from 6.25.0 to 6.27.0 in [#​570](https://redirect.github.com/docker/setup-buildx-action/pull/570) - Bump vite from 7.3.2 to 7.3.6 in [#​569](https://redirect.github.com/docker/setup-buildx-action/pull/569) **Full Changelog**: <https://github.com/docker/setup-buildx-action/compare/v4.1.0...v4.2.0> </details> <details> <summary>docker/setup-qemu-action (docker/setup-qemu-action)</summary> ### [`v4.2.0`](https://redirect.github.com/docker/setup-qemu-action/compare/v4.1.0...v4.2.0) [Compare Source](https://redirect.github.com/docker/setup-qemu-action/compare/v4.1.0...v4.2.0) </details> <details> <summary>pypa/gh-action-pypi-publish (pypa/gh-action-pypi-publish)</summary> ### [`v1.14.2`](https://redirect.github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.2) [Compare Source](https://redirect.github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2) <p align="right"><i>This one probably won't touch you visibly so just bookmark <a href="https://ep2026.europython.eu/session/defending-open-source-from-ai-slop-a-maintainer-s-practical-guide">@​webknjaz's EuroPython 2026 “AI” slop rant for when it's published on YouTube</a> or <a href="https://redirect.github.com/sponsors/webknjaz">encourage him to come back with more to share next year</a>!</i></p> #### 🛠️ Urgh… Another release!? Again? Explain yourself! Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update. > \[!tip] > So what *most* people will find useful is [@​takluyver](https://redirect.github.com/takluyver)[💰](https://redirect.github.com/sponsors/takluyver)'s update of Twine to v7 that we use internally ([#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416)). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI. #### 🧐 Tell me why.. <details> <summary> The rest of the updates bump things related to <code>pypi-attestations</code> and <code>sigstore</code>, which has the most interesting backstory here. @​facutuesca<a href="https://redirect.github.com/sponsors/facutuesca">💰</a> sent a patch in #​417 but a bunch more helped out. </summary> TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like [aio-libs/aiohttp#13226](https://redirect.github.com/aio-libs/aiohttp/pull/13226) around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before. I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections. Over the course of investigation, [@​facutuesca](https://redirect.github.com/facutuesca)[💰](https://redirect.github.com/sponsors/facutuesca) found and fixed a related underlying cache invalidation bug in [sigstore/sigstore-python#1838](https://redirect.github.com/sigstore/sigstore-python/pull/1838), which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python. Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: <https://publishing-five-minute-timeout.tiiny.site>. <center> <a href="https://xkcd.com/2549/"> <img src="https://imgs.xkcd.com/comics/edge_cake_2x.png" alt="Edge Cake XKCD feels just like this release"> </a> </center> </details> #### 🫶 New Contributors - [@​davidbrochart](https://redirect.github.com/davidbrochart) made their first contribution in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) - [@​takluyver](https://redirect.github.com/takluyver) made their first contribution in [#​416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416) **🪞 Full Diff**: <https://github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2> **🧔♂️ Release Manager:** [@​webknjaz](https://redirect.github.com/sponsors/webknjaz) [🇺🇦](https://stand-with-ukraine.pp.ua) **🙏 Special Thanks** to [@​davidbrochart](https://redirect.github.com/davidbrochart)[💰](https://redirect.github.com/sponsors/davidbrochart) and [@​Dreamsorcerer](https://redirect.github.com/Dreamsorcerer)[💰](https://redirect.github.com/sponsors/Dreamsorcerer) for turning my attention (in [#​415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. [@​bdraco](https://redirect.github.com/bdraco)[💰](https://redirect.github.com/sponsors/bdraco) came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. [@​miketheman](https://redirect.github.com/miketheman)[💰](https://redirect.github.com/sponsors/miketheman) confirmed the Warehouse-side details. Also, [@​jku](https://redirect.github.com/jku)[💰](https://redirect.github.com/sponsors/jku) and [@​woodruffw](https://redirect.github.com/woodruffw)[💰](https://redirect.github.com/sponsors/woodruffw) helped work through, review and release the Sigstore ecosystem upstream libs. **💬 Discuss** [on Bluesky 🦋](https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrsqy2xba22j), [on Mastodon 🐘](https://mastodon.social/@​webknjaz/117005132816750073) and [on GitHub][release discussion]. [![GH Sponsors badge]][GH Sponsors URL] [GH Sponsors badge]: https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&logoColor=%23EA4AAA&label=Sponsor&color=2a313c [GH Sponsors URL]: https://redirect.github.com/sponsors/webknjaz [release discussion]: https://redirect.github.com/pypa/gh-action-pypi-publish/discussions/419 ### [`v1.14.1`](https://redirect.github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.1) [Compare Source](https://redirect.github.com/pypa/gh-action-pypi-publish/compare/v1.14.0...v1.14.1) <p align="right"><i>This release was cut at <a href="https://ep2026.europython.eu/sprints/">EuroPython 2026 Sprints</a></i></p> #### 🛠️ Internal Dependencies [@​adisivaprasad](https://redirect.github.com/adisivaprasad)[💰](https://redirect.github.com/sponsors/adisivaprasad) helped get rid of the GitHub Actions runner warning about the old Node 20 runtime being used by updating `actions/setup-python` from v5.6.0 to v6.2.0 in [#​408](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/408). #### 💪 New Contributors - [@​adisivaprasad](https://redirect.github.com/adisivaprasad) made their first contribution in [#​408](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/408) - [@​jylenhof](https://redirect.github.com/jylenhof)[💰](https://redirect.github.com/sponsors/jylenhof) followed up and reminded us to actually cut this release in [#​413](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/413) **🪞 Full Diff**: <https://github.com/pypa/gh-action-pypi-publish/compare/v1.14.0...v1.14.1> **🧔♂️ Release Manager:** [@​webknjaz](https://redirect.github.com/sponsors/webknjaz) [🇺🇦](https://stand-with-ukraine.pp.ua) **🙏 Special Thanks** to [@​jylenhof](https://redirect.github.com/jylenhof)[💰](https://redirect.github.com/sponsors/jylenhof) for reminding me to work on this release! **💬 Discuss** [on Bluesky 🦋](https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrd7jpnxc22d), [on Mastodon 🐘](https://mastodon.social/@​webknjaz/116970132515797444) and [on GitHub][release discussion]. [![GH Sponsors badge]][GH Sponsors URL] [GH Sponsors badge]: https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&logoColor=%23EA4AAA&label=Sponsor&color=2a313c [GH Sponsors URL]: https://redirect.github.com/sponsors/webknjaz [release discussion]: https://redirect.github.com/pypa/gh-action-pypi-publish/discussions/414 </details> <details> <summary>softprops/action-gh-release (softprops/action-gh-release)</summary> ### [`v3.0.2`](https://redirect.github.com/softprops/action-gh-release/releases/tag/v3.0.2) [Compare Source](https://redirect.github.com/softprops/action-gh-release/compare/v3.0.1...v3.0.2) `3.0.2` is a patch release focused on release reliability and compatibility. It reuses existing draft releases when publishing prereleases, supports replacing release assets on Gitea, hardens streamed asset uploads, and provides clearer release-creation diagnostics. It also includes TypeScript, coverage, and tooling maintenance merged since `3.0.1`. This release fixes [#​795](https://redirect.github.com/softprops/action-gh-release/issues/795), [#​438](https://redirect.github.com/softprops/action-gh-release/issues/438), and [#​803](https://redirect.github.com/softprops/action-gh-release/issues/803). The upload transport hardening covers the historical failure reported in [#​790](https://redirect.github.com/softprops/action-gh-release/issues/790), although current hosted Node 24 runners did not reproduce it naturally. The diagnostics work is related to [#​786](https://redirect.github.com/softprops/action-gh-release/issues/786) and does not claim a reproducible release-creation fix. ##### What's Changed ##### Exciting New Features 🎉 - feat: improve release error reporting and test coverage by [@​chenrui333](https://redirect.github.com/chenrui333) in [#​813](https://redirect.github.com/softprops/action-gh-release/pull/813) ##### Bug fixes 🐛 - fix: publish existing draft releases as prereleases by [@​godfengliang](https://redirect.github.com/godfengliang) in [#​801](https://redirect.github.com/softprops/action-gh-release/pull/801) - fix: upload small checksum assets reliably by [@​chenrui333](https://redirect.github.com/chenrui333) in [#​815](https://redirect.github.com/softprops/action-gh-release/pull/815) - fix: replace existing release assets on Gitea by [@​chenrui333](https://redirect.github.com/chenrui333) in [#​816](https://redirect.github.com/softprops/action-gh-release/pull/816) - fix: clarify release creation 404 errors by [@​chenrui333](https://redirect.github.com/chenrui333) in [#​817](https://redirect.github.com/softprops/action-gh-release/pull/817) ##### Other Changes 🔄 - chore(deps): upgrade TypeScript to 7 by [@​chenrui333](https://redirect.github.com/chenrui333) in [#​812](https://redirect.github.com/softprops/action-gh-release/pull/812) - chore(deps): remove unused TypeScript tooling by [@​chenrui333](https://redirect.github.com/chenrui333) in [#​814](https://redirect.github.com/softprops/action-gh-release/pull/814) - dependency, Node 24 pin, and CI maintenance merged since `3.0.1` </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/kenn-io/agentsview). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4yOS41IiwidXBkYXRlZEluVmVyIjoiNDQuMjkuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==--> Co-authored-by: renovate[bot] <renovate[bot]@users.noreply.github.com> |
