Release v1.19.3 - #858
Merged
Merged
Release v1.19.3#858
Conversation
## Summary - Close Dependabot #234 by forcing `decode-uri-component` to 0.5.0 (CVE-2026-45822). - Close the Snyk Apache Thrift finding by replacing `github.com/apache/thrift` to v0.24.0 (CVE-2026-41602); Arrow v15 still pins 0.17.0. - `image-size` (Dependabot #230 / #231) has no published fix. Dismiss those alerts as Docusaurus build-only per `docs/COMPLIANCE.md`. ## Linear Ticket Fixes: [ENG-6446](https://linear.app/overmind/issue/ENG-6446/triage-and-patch-4-open-dependency-vulnerabilities) — Triage and patch 4 open dependency vulnerabilities - **Purpose**: Patch or ignore the four open dependency findings (3 GitHub Dependabot, 1 Snyk). ## Changes - `pnpm-workspace.yaml`: security override `decode-uri-component@<=0.4.2` → `0.5.0`, lockfile updated. - `go.mod`: `replace github.com/apache/thrift => github.com/apache/thrift v0.24.0`. Made with [Cursor](https://cursor.com) Co-authored-by: Cursor <cursoragent@cursor.com> GitOrigin-RevId: 22fdc6a49ad1c5a33b657c99c7e929af5a902956
Allow MCP OAuth handoffs to the exact Linear Agent and Amp website callback URIs through `auth.IsAllowedMCPRedirect`. Loopback remains supported through the existing generic check; no Auth0 callback or Amp CLI URI was added. Verified with: - `go test ./go/auth -run 'TestIsAllowedMCPRedirect|TestIsLocalhostRedirect' -count=1` - `go test ./services/until-backend/service -run 'TestMCPAuthorizeProxy_(AllowedRedirect|DeniedRedirect)' -count=1` - `golangci-lint run --timeout 8m ./go/auth` <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > Changes OAuth redirect validation by widening the fixed allowlist; risk is mitigated by exact-match checks and new negative test cases, but mis-typed URIs would still be a security concern. > > **Overview** > **Expands MCP OAuth redirect allowlisting** so `IsAllowedMCPRedirect` accepts two additional **exact** HTTPS callback URLs: Linear Agent (`https://linear.app/connect/mcp/callback`) and Amp website (`https://ampcode.com/auth/mcp/callback`). Existing Cursor desktop, Cursor Cloud Agents, and loopback checks are unchanged. > > Docs and comments now describe a general MCP handoff allowlist rather than Cursor-only targets. Tests cover the new allowed URIs and reject near-misses (extra path segments or query strings), preserving strict string equality rather than prefix matching. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit ac9b44956eb5e8ac8fd5099530e25cc5e0d03c55. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY --> Co-authored-by: linear-code[bot] <222613912+linear-code[bot]@users.noreply.github.com> GitOrigin-RevId: 0d52eac8fafeef478432867ac1fc2d498138b2d0
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/Azure/azure-sdk-for-go/sdk/azcore](https://redirect.github.com/Azure/azure-sdk-for-go) | `v1.23.0` → `v1.23.1` |  |  | | [github.com/Azure/azure-sdk-for-go/sdk/azidentity](https://redirect.github.com/Azure/azure-sdk-for-go) | `v1.14.0` → `v1.14.1` |  |  | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/370) for more information. --- ### Release Notes <details> <summary>Azure/azure-sdk-for-go (github.com/Azure/azure-sdk-for-go/sdk/azcore)</summary> ### [`v1.23.1`](https://redirect.github.com/Azure/azure-sdk-for-go/releases/tag/sdk/azcore/v1.23.1) #### 1.23.1 (2026-08-27) ##### Other Changes - Upgraded dependencies. </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/London) - Branch creation - "after 6pm on thursday,before 10am on friday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/overmindtech/workspace). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC40Ni4wIiwidXBkYXRlZEluVmVyIjoiNDQuNjEuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIiwiZ29sYW5nIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> GitOrigin-RevId: 95113887772058a8210e848a338efb6cbe7c8e24
<!-- CURSOR_AGENT_PR_BODY_BEGIN --> ## Summary - combine the dependency upgrades from #6624 and #6625 - migrate all `go-github` imports from v90 to v91 - migrate all `resend-go` imports from v3 to v4 - adapt issue-comment creation and updates to the v91 request API - remove the superseded direct module requirements so the new SDK versions are actually used ## Bugbot findings addressed - fixes the unused `github.com/google/go-github/v91` requirement reported on #6624 - fixes the unused `github.com/resend/resend-go/v4` requirement reported on #6625 ## Verification - `go test -run '^$' ./services/api-server/service/... ./services/until-backend/...` - `go test ./services/api-server/service/githubapp` - `go test ./services/api-server/service -run 'Test(ResendContact|Webflow|Changelog|RenderChangelog|ParseWebflow)'` - `go test ./services/until-backend/integrations/github ./services/until-backend/loops ./services/until-backend/mailer ./services/until-backend/notifications/email ./services/until-backend/until ./services/until-backend/workers` - `go mod verify` - `golangci-lint run` across all changed package scopes - confirmed the module graph contains neither `go-github/v90` nor `resend-go/v3` <!-- CURSOR_AGENT_PR_BODY_END --> <div><a href="https://cursor.com/agents/bc-1dc3bbed-156d-4104-8088-92438365ff1b?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a href="https://cursor.com/background-agent?bcId=bc-1dc3bbed-156d-4104-8088-92438365ff1b&cursor_ref=pr_footer&cursor_cta=open_in_cursor"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> GitOrigin-RevId: 0f089970bd99546cd773172e2b7496d5b2832ead
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/aws/aws-sdk-go-v2/service/ec2](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.325.1` → `v1.328.0` |  |  | | [github.com/aws/aws-sdk-go-v2/service/ecs](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.94.0` → `v1.95.0` |  |  | | [github.com/aws/aws-sdk-go-v2/service/eks](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.96.0` → `v1.97.0` |  |  | | [github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.61.0` → `v1.61.1` |  |  | | [github.com/aws/aws-sdk-go-v2/service/lambda](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.105.0` → `v1.106.0` |  |  | | [github.com/aws/aws-sdk-go-v2/service/sesv2](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.70.0` → `v1.71.0` |  |  | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/370) for more information. --- ### Release Notes <details> <summary>aws/aws-sdk-go-v2 (github.com/aws/aws-sdk-go-v2/service/ec2)</summary> ### [`v1.328.0`](https://redirect.github.com/aws/aws-sdk-go-v2/blob/HEAD/CHANGELOG.md#Release-2026-09-02) #### Module Highlights - `github.com/aws/aws-sdk-go-v2/service/appintegrations`: [v1.44.0](service/appintegrations/CHANGELOG.md#v1440-2026-09-02) - **Feature**: This release adds a force parameter to DeleteApplication and a ConflictException to UpdateApplication, letting customers delete applications with existing associations in one call and get a clear error when an update conflicts with the application's current state. - `github.com/aws/aws-sdk-go-v2/service/bedrockagentcore`: [v1.45.0](service/bedrockagentcore/CHANGELOG.md#v1450-2026-09-02) - **Feature**: Batch evaluation now supports up to 10 CloudWatch log groups per CloudWatchLogsSource - `github.com/aws/aws-sdk-go-v2/service/ec2`: [v1.328.0](service/ec2/CHANGELOG.md#v13280-2026-09-02) - **Feature**: This release adds support to retain interruptible Capacity Reservations in an active state when all capacity is reclaimed. - `github.com/aws/aws-sdk-go-v2/service/medialive`: [v1.108.0](service/medialive/CHANGELOG.md#v11080-2026-09-02) - **Feature**: AWS Elemental MediaLive now supports AB forensic video watermarking - `github.com/aws/aws-sdk-go-v2/service/mgn`: [v1.53.0](service/mgn/CHANGELOG.md#v1530-2026-09-02) - **Feature**: AWS Transform for migrations adds a second network migration option - apply your source security posture to existing VPCs. Upload a source network file with firewall rules, tag the in-scope VPCs, and AWS Transform matches source subnets to them by CIDR and generates the security groups. - `github.com/aws/aws-sdk-go-v2/service/odb`: [v1.20.0](service/odb/CHANGELOG.md#v1200-2026-09-02) - **Feature**: Adds the ListFlexComponents API for listing the flex components available for a given DB system shape. - `github.com/aws/aws-sdk-go-v2/service/sagemaker`: [v1.273.0](service/sagemaker/CHANGELOG.md#v12730-2026-09-02) - **Feature**: Amazon SageMaker Feature Store now supports the Standard V2 online store type, which enables feature-level writes to feature groups. You can select Standard V2 when creating a feature group, and update the storage type of an existing feature group via UpdateFeatureGroup. - `github.com/aws/aws-sdk-go-v2/service/sagemakerfeaturestoreruntime`: [v1.42.0](service/sagemakerfeaturestoreruntime/CHANGELOG.md#v1420-2026-09-02) - **Feature**: Amazon SageMaker Feature Store now supports the UpdateRecord API, enabling partial updates to individual feature values in an existing Online Store record without rewriting the entire record. This reduces write payloads and latency for high-frequency feature-level writes . ### [`v1.327.0`](https://redirect.github.com/aws/aws-sdk-go-v2/blob/HEAD/CHANGELOG.md#Release-2026-09-01) #### Module Highlights - `github.com/aws/aws-sdk-go-v2/service/bedrockagentcorecontrol`: [v1.63.0](service/bedrockagentcorecontrol/CHANGELOG.md#v1630-2026-09-01) - **Feature**: Online evaluation configurations now support up to 25 evaluators. CloudWatch Logs data sources for online evaluation now support up to 10 log groups. - `github.com/aws/aws-sdk-go-v2/service/ec2`: [v1.327.0](service/ec2/CHANGELOG.md#v13270-2026-09-01) - **Feature**: Update UserData and UploadPolicy shapes to use SecureBlob - `github.com/aws/aws-sdk-go-v2/service/guardduty`: [v1.89.0](service/guardduty/CHANGELOG.md#v1890-2026-09-01) - **Feature**: Amazon GuardDuty now supports custom detection rules, including APIs to manage rule associations and organization-level configurations. - `github.com/aws/aws-sdk-go-v2/service/iotsitewise`: [v1.60.0](service/iotsitewise/CHANGELOG.md#v1600-2026-09-01) - **Feature**: AWS IoT SiteWise Scenario Discovery now supports mounting Amazon S3 data directly into pipeline task containers via S3 Access Points, and configuring additional ephemeral storage per task. Mount configurations can be overridden at execution time. See the API guide for details. - `github.com/aws/aws-sdk-go-v2/service/kinesis`: [v1.52.0](service/kinesis/CHANGELOG.md#v1520-2026-09-01) - **Feature**: Amazon Kinesis Data Streams now supports a dry run feature for data-plane APIs to validate the permissions and request parameters. If all checks complete successfully, the API returns a 'DryRunOperationException', confirming the request would have succeeded without the 'DryRun' parameter. - `github.com/aws/aws-sdk-go-v2/service/lambda`: [v1.106.0](service/lambda/CHANGELOG.md#v11060-2026-09-01) - **Feature**: AWS Lambda now provides configurable control over S3 direct access, allowing you to explicitly enable or disable how functions stream file reads directly from S3 buckets. This gives you flexibility to tune data access behavior based on your workload requirements, independent of memory size. - `github.com/aws/aws-sdk-go-v2/service/lightsail`: [v1.63.0](service/lightsail/CHANGELOG.md#v1630-2026-09-01) - **Feature**: This release adds support for the Amazon Lightsail GetProfile API, which returns the profile for the specified account. - `github.com/aws/aws-sdk-go-v2/service/marketplaceagreement`: [v1.24.0](service/marketplaceagreement/CHANGELOG.md#v1240-2026-09-01) - **Feature**: This release adds renewal support for AWS Marketplace private offers. Agreements report whether they renew and, if not, why. Renewal terms add price increases, renewal limits, renewal decision deadlines, and payment schedule templates. SearchAgreements adds filters. - `github.com/aws/aws-sdk-go-v2/service/marketplacediscovery`: [v1.8.0](service/marketplacediscovery/CHANGELOG.md#v180-2026-09-01) - **Feature**: GetOfferTerms now returns renewalTerm for offers with pre-authorized renewals, exposing maxRenewals, lockoutPeriod, adjustmentDeadline, priceIncrease (fixed percentage or percentage range), and termTemplates (renewal payment schedules). Enables buyers to view renewal pricing and terms. - `github.com/aws/aws-sdk-go-v2/service/mediaconvert`: [v1.101.0](service/mediaconvert/CHANGELOG.md#v11010-2026-09-01) - **Feature**: Adds support for AAC passthrough. Adds ManifestCues option to support HLS manifest Cue marker passthrough. Adds playback device compatibility mode for DASH H.265 outputs. Adds TTML caption styling options. Adds interlace mode support for XAVC HD Intra CBG profile. - `github.com/aws/aws-sdk-go-v2/service/sesv2`: [v1.71.0](service/sesv2/CHANGELOG.md#v1710-2026-09-01) - **Feature**: Added support for managing SMIME signing certificates for email identities, including associating, listing, and disassociating certificates. Added the UpdateConfigurationSet operation to configure message security options such as signing scheme. - `github.com/aws/aws-sdk-go-v2/service/taxsettings`: [v1.25.0](service/taxsettings/CHANGELOG.md#v1250-2026-09-01) - **Feature**: France and Monaco Additional Info changes </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/London) - Branch creation - "after 6pm on thursday,before 10am on friday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/overmindtech/workspace). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC42MS4zIiwidXBkYXRlZEluVmVyIjoiNDQuNjEuMyIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIiwiZ29sYW5nIl19--> <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Routine patch/minor SDK bumps with lockfile-only changes; risk is mainly regression in AWS API clients used by aws-source adapters, mitigated by existing integration tests if run on merge. > > **Overview** > Bumps six **aws-sdk-go-v2** service modules in `go.mod` / `go.sum` only—no application or adapter code changes. > > | Package | Version change | > |---------|----------------| > | `service/ec2` | v1.325.1 → v1.328.0 | > | `service/ecs` | v1.94.0 → v1.95.0 | > | `service/eks` | v1.96.0 → v1.97.0 | > | `service/elasticloadbalancingv2` | v1.61.0 → v1.61.1 | > | `service/lambda` | v1.105.0 → v1.106.0 | > | `service/sesv2` | v1.70.0 → v1.71.0 | > > Upstream release notes add new API surface (e.g. EC2 interruptible capacity reservation retention, Lambda S3 direct-access controls, SESv2 SMIME / configuration-set options). Existing calls should behave the same unless the codebase starts using those new operations. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit c52bb1dff01cd6a318596245103033321d61c6c0. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY --> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> GitOrigin-RevId: 2be73170240dce094be114611232cb02b1400e59
…e (#6636) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [github.com/hashicorp/terraform-config-inspect](https://redirect.github.com/hashicorp/terraform-config-inspect) | require | digest | `2fb54c2` → `75d64de` | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/370) for more information. --- ### Configuration 📅 **Schedule**: (in timezone Europe/London) - Branch creation - "after 6pm on thursday,before 10am on friday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/overmindtech/workspace). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC42MS4zIiwidXBkYXRlZEluVmVyIjoiNDQuNjEuMyIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIiwiZ29sYW5nIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> GitOrigin-RevId: 58443b98543cf9fbcccefa0d61ef139c38949a7f
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go | `v1.36.12-20260825204119-511051f7f437.1` → `v1.36.12-20260825204119-511051f7f437.2` |  |  | | buf.build/gen/go/depot/api/protocolbuffers/go | `v1.36.12-20260805103418-70b5c163d960.1` → `v1.36.12-20260805103418-70b5c163d960.2` |  |  | | [buf.build/go/protovalidate](https://redirect.github.com/bufbuild/protovalidate-go) | `v1.3.0` → `v1.4.0` |  |  | | [github.com/auth0/go-auth0/v3](https://redirect.github.com/auth0/go-auth0) | `v3.3.0` → `v3.4.0` |  |  | | [github.com/coreos/go-oidc/v3](https://redirect.github.com/coreos/go-oidc) | `v3.20.0` → `v3.21.0` |  |  | | [github.com/go-jose/go-jose/v4](https://redirect.github.com/go-jose/go-jose) | `v4.1.4` → `v4.1.5` |  |  | | [github.com/googleapis/gax-go/v2](https://redirect.github.com/googleapis/gax-go) | `v2.24.0` → `v2.24.1` |  |  | | [github.com/harness/harness-go-sdk](https://redirect.github.com/harness/harness-go-sdk) | `v0.8.26` → `v0.8.27` |  |  | | [github.com/openai/openai-go/v3](https://redirect.github.com/openai/openai-go) | `v3.54.0` → `v3.56.0` |  |  | | [github.com/openrdap/rdap](https://redirect.github.com/openrdap/rdap) | `v0.10.1` → `v0.10.2` |  |  | | [github.com/posthog/posthog-go](https://redirect.github.com/posthog/posthog-go) | `v1.24.4` → `v1.25.1` |  |  | | [github.com/resend/resend-go/v4](https://redirect.github.com/resend/resend-go) | `v4.2.0` → `v4.3.0` |  |  | | [github.com/stripe/stripe-go/v86](https://redirect.github.com/stripe/stripe-go) | `v86.4.0` → `v86.4.1` |  |  | | [gitlab.com/gitlab-org/api/client-go/v2](https://gitlab.com/gitlab-org/api/client-go) | `v2.61.0` → `v2.62.0` |  |  | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/370) for more information. --- ### Release Notes <details> <summary>bufbuild/protovalidate-go (buf.build/go/protovalidate)</summary> ### [`v1.4.0`](https://redirect.github.com/bufbuild/protovalidate-go/releases/tag/v1.4.0) [Compare Source](https://redirect.github.com/bufbuild/protovalidate-go/compare/v1.3.0...v1.4.0) <!-- Release notes generated using configuration in .github/release.yml at main --> #### What's Changed - Update deps and minimum Go version to 1.26 by [@​rodaine](https://redirect.github.com/rodaine) in [#​337](https://redirect.github.com/bufbuild/protovalidate-go/pull/337) **Full Changelog**: <bufbuild/protovalidate-go@v1.3.0...v1.4.0> </details> <details> <summary>auth0/go-auth0 (github.com/auth0/go-auth0/v3)</summary> ### [`v3.4.0`](https://redirect.github.com/auth0/go-auth0/blob/HEAD/CHANGELOG.md#v340-2026-09-02) [Compare Source](https://redirect.github.com/auth0/go-auth0/compare/v3.3.0...v3.4.0) [Full Changelog](https://redirect.github.com/auth0/go-auth0/compare/v3.3.0...v3.4.0) **Breaking Changes** - Renamed `EventStreamCloudEventContextTenant.TenantID` (`json:"tenant_id"`) to `ID` (`json:"id"`), replacing the `GetTenantID`/`SetTenantID` accessors with `GetID`/`SetID`, to match the API contract [#​856](https://redirect.github.com/auth0/go-auth0/pull/856) ([fern-api\[bot\]](https://redirect.github.com/apps/fern-api)) - Removed the `ClientAppTypeEnumB2BIntegration` (`b2b_integration`) `app_type` value, which was released in beta by mistake; B2B integration is now configured through the new `b2b_integration_configuration` client field [#​856](https://redirect.github.com/auth0/go-auth0/pull/856) ([fern-api\[bot\]](https://redirect.github.com/apps/fern-api)) **Added** - feat: add `OrganizationTemplates` client with `List` (checkpoint-paginated, sorted by `id`), `Create`, `Get`, `Update`, and `ListOrganizations`, plus the `Organizations.OrganizationTemplate` client with `Get`, `AssignOrganizationTemplate`, and `UnassignOrganizationTemplate`, along with the `OrganizationTemplate` and `OrganizationTemplateAssignedOrganization` types (role visibility policy and override, allowed strategies, use-for-organization-discovery, and `organization_deletion_behavior`/`connection_deletion_behavior` options) and the `create:organization_templates`, `read:organization_templates`, and `update:organization_templates` OAuth scopes [#​856](https://redirect.github.com/auth0/go-auth0/pull/856) ([fern-api\[bot\]](https://redirect.github.com/apps/fern-api)) - feat: add `HTTPMessageSignature` field to `NetworkACLMatch` so a tenant network ACL rule can match on an HTTP Message Signature, along with the `NetworkAclHttpMessageSignature`, `NetworkAclHttpMessageSignatureKey`, and `NetworkAclHttpMessageSignatureKeys` types [#​856](https://redirect.github.com/auth0/go-auth0/pull/856) ([fern-api\[bot\]](https://redirect.github.com/apps/fern-api)) - feat: add `Keys.NetworkACLs.Delete` to delete a network ACL key, along with the `OauthScopeDeleteNetworkACLKeys` (`delete:network_acl_keys`) scope [#​856](https://redirect.github.com/auth0/go-auth0/pull/856) ([fern-api\[bot\]](https://redirect.github.com/apps/fern-api)) - feat: add the `B2BIntegrationConfiguration` type (carrying `sso_profiles` and an `integration_type` enum) via a `B2BIntegrationConfiguration` field on the client create, update, get, and rotate-secret payloads [#​856](https://redirect.github.com/auth0/go-auth0/pull/856) ([fern-api\[bot\]](https://redirect.github.com/apps/fern-api)) - feat: add SCIM provisioning to connection profiles via the `Provisioning` field, with the `ConnectionProfileProvisioning`, `ConnectionProfileProvisioningSCIM`, `ConnectionProfileProvisioningSCIMTokens`, `ConnectionProfileProvisioningSCIMTokenScopes`, `ConnectionProfileProvisioningSCIMTokenScopeEnum`, `ConnectionProfileProvisioningSCIMTokenDefaultExpiry`, and `ConnectionProfileProvisioningSCIMTokenMaxAllowedExpiry` types [#​856](https://redirect.github.com/auth0/go-auth0/pull/856) ([fern-api\[bot\]](https://redirect.github.com/apps/fern-api)) - feat: add Pushed Authorization Request support to OIDC and Okta connection options via the `EnablePushedAuthorizationRequests`, `PushedAuthorizationRequestEndpoint`, and `RequirePushedAuthorizationRequests` fields [#​856](https://redirect.github.com/auth0/go-auth0/pull/856) ([fern-api\[bot\]](https://redirect.github.com/apps/fern-api)) - feat: add `DiscoveryURL` and `OidcMetadata` to SAML connection options, and `CrossAppAccessResourceApp` (the `CrossAppAccessResourceApp` type) to SAML connection create, update, and response content [#​856](https://redirect.github.com/auth0/go-auth0/pull/856) ([fern-api\[bot\]](https://redirect.github.com/apps/fern-api)) - feat: add the `ServerKey` field to `FormWidgetGMapsAddressConfig` [#​856](https://redirect.github.com/auth0/go-auth0/pull/856) ([fern-api\[bot\]](https://redirect.github.com/apps/fern-api)) - feat: add the `LocalResourceDiscovery` flag to `TenantSettingsFlags` [#​856](https://redirect.github.com/auth0/go-auth0/pull/856) ([fern-api\[bot\]](https://redirect.github.com/apps/fern-api)) - feat: add the `ActionTriggerTypeEnumPostCredentialValidation` (`post-credential-validation`) action trigger type [#​856](https://redirect.github.com/auth0/go-auth0/pull/856) ([fern-api\[bot\]](https://redirect.github.com/apps/fern-api)) - feat: add the `UnprocessableEntityError` type and map HTTP `422` responses to it [#​856](https://redirect.github.com/auth0/go-auth0/pull/856) ([fern-api\[bot\]](https://redirect.github.com/apps/fern-api)) </details> <details> <summary>coreos/go-oidc (github.com/coreos/go-oidc/v3)</summary> ### [`v3.21.0`](https://redirect.github.com/coreos/go-oidc/releases/tag/v3.21.0) [Compare Source](https://redirect.github.com/coreos/go-oidc/compare/v3.20.0...v3.21.0) #### What's Changed - oidc: ignore JWKs with unsupported key types rather than failing by [@​nicoske](https://redirect.github.com/nicoske) in [#​499](https://redirect.github.com/coreos/go-oidc/pull/499) #### New Contributors - [@​nicoske](https://redirect.github.com/nicoske) made their first contribution in [#​499](https://redirect.github.com/coreos/go-oidc/pull/499) **Full Changelog**: <coreos/go-oidc@v3.20.0...v3.21.0> </details> <details> <summary>go-jose/go-jose (github.com/go-jose/go-jose/v4)</summary> ### [`v4.1.5`](https://redirect.github.com/go-jose/go-jose/releases/tag/v4.1.5) ### Fixed security issues - cipher/cbc\_hmac: don't panic on empty ciphertext ([#​292](https://redirect.github.com/go-jose/go-jose/issues/292)) - cipher/cbc\_hmac: don't panic on invalid key ([#​291](https://redirect.github.com/go-jose/go-jose/issues/291)) - json: limit stack depth ([#​290](https://redirect.github.com/go-jose/go-jose/issues/290)) - jwt: reject out-of-range NumericDate values ([#​278](https://redirect.github.com/go-jose/go-jose/issues/278)) - Check alg against pubkey curve during verify. ([#​293](https://redirect.github.com/go-jose/go-jose/issues/293)) - Reject malformed [`Ed25519`](https://redirect.github.com/go-jose/go-jose/commit/Ed25519) JWKs ([#​250](https://redirect.github.com/go-jose/go-jose/issues/250)) - jws: choose verification key per-signature ([#​243](https://redirect.github.com/go-jose/go-jose/issues/243)) ### Changed - Verify OpaqueSigner's Public() return is public ([#​260](https://redirect.github.com/go-jose/go-jose/issues/260)) - jws: skip signature on ErrJWKSKidNotFound ([#​248](https://redirect.github.com/go-jose/go-jose/issues/248)) - Handle JWE JSON without protected header ([#​240](https://redirect.github.com/go-jose/go-jose/issues/240)) - jws: don't strip internal whitespace before parsing JSON ([#​239](https://redirect.github.com/go-jose/go-jose/issues/239)) - jws: fewer calls to OpaqueSigner.Public() ([#​224](https://redirect.github.com/go-jose/go-jose/issues/224)) - Return a specific error when parsing empty string ([#​216](https://redirect.github.com/go-jose/go-jose/issues/216)) - Reject typed nil at Verify time </details> <details> <summary>googleapis/gax-go (github.com/googleapis/gax-go/v2)</summary> ### [`v2.24.1`](https://redirect.github.com/googleapis/gax-go/releases/tag/v2.24.1) [Compare Source](https://redirect.github.com/googleapis/gax-go/compare/v2.24.0...v2.24.1) ##### Bug Fixes - split implementation of ProtoJSONStream for 1.27 and later ([#​532](https://redirect.github.com/googleapis/gax-go/issues/532)) ([d0623a1](https://redirect.github.com/googleapis/gax-go/commit/d0623a1d3c843a64e85ad8b4d4ea37695a668868)) </details> <details> <summary>harness/harness-go-sdk (github.com/harness/harness-go-sdk)</summary> ### [`v0.8.27`](https://redirect.github.com/harness/harness-go-sdk/compare/v0.8.26...v0.8.27) [Compare Source](https://redirect.github.com/harness/harness-go-sdk/compare/v0.8.26...v0.8.27) </details> <details> <summary>openai/openai-go (github.com/openai/openai-go/v3)</summary> ### [`v3.56.0`](https://redirect.github.com/openai/openai-go/releases/tag/v3.56.0) [Compare Source](https://redirect.github.com/openai/openai-go/compare/v3.55.0...v3.56.0) ##### Features - **api:** add gpt-6-astra and related features ([#​880](https://redirect.github.com/openai/openai-\[go/issues/880]\(https://www.golinks.io/issues/880?trackSource=github\))) ([94a240c](https://redirect.github.com/openai/openai-\[go/commit/94a240c1d3f0c70a80436d4a29ec6c1de83b943f]\(https://www.golinks.io/commit/94a240c1d3f0c70a80436d4a29ec6c1de83b943f?trackSource=github\))) ### [`v3.55.0`](https://redirect.github.com/openai/openai-go/releases/tag/v3.55.0) [Compare Source](https://redirect.github.com/openai/openai-go/compare/v3.54.0...v3.55.0) ##### Features - **api:** add compute\_units to Responses and Chat Completions usage ([#​866](https://redirect.github.com/openai/openai-go/issues/866)) ([4d06294](https://redirect.github.com/openai/openai-go/commit/4d062949c62507e56514af8c7beb186dc09ac075)) - **api:** update usage APIs and documentation ([#​876](https://redirect.github.com/openai/openai-go/issues/876)) ([d8a7e6c](https://redirect.github.com/openai/openai-go/commit/d8a7e6c70d1bf67e744ea8e4fb617b622372ca0e)) ##### Bug Fixes - isolate provider dependencies from root consumers ([#​874](https://redirect.github.com/openai/openai-go/issues/874)) ([8de3444](https://redirect.github.com/openai/openai-go/commit/8de344439ca10236fc958a468bfbd5807737a15f)) </details> <details> <summary>openrdap/rdap (github.com/openrdap/rdap)</summary> ### [`v0.10.2`](https://redirect.github.com/openrdap/rdap/releases/tag/v0.10.2) [Compare Source](https://redirect.github.com/openrdap/rdap/compare/v0.10.1...v0.10.2) #### What's Changed - fix: use cached bootstrap registry files instead of downloading by [@​wolveix](https://redirect.github.com/wolveix) in [#​55](https://redirect.github.com/openrdap/rdap/pull/55) **Full Changelog**: <openrdap/rdap@v0.10.1...v0.10.2> </details> <details> <summary>posthog/posthog-go (github.com/posthog/posthog-go)</summary> ### [`v1.25.1`](https://redirect.github.com/PostHog/posthog-go/releases/tag/v1.25.1): 1.25.1 [Compare Source](https://redirect.github.com/posthog/posthog-go/compare/v1.25.0...v1.25.1) #### Unreleased ### [`v1.25.0`](https://redirect.github.com/PostHog/posthog-go/releases/tag/v1.25.0): 1.25.0 [Compare Source](https://redirect.github.com/posthog/posthog-go/compare/v1.24.4...v1.25.0) #### Unreleased </details> <details> <summary>resend/resend-go (github.com/resend/resend-go/v4)</summary> ### [`v4.3.0`](https://redirect.github.com/resend/resend-go/compare/v4.2.0...v4.3.0) [Compare Source](https://redirect.github.com/resend/resend-go/compare/v4.2.0...v4.3.0) </details> <details> <summary>stripe/stripe-go (github.com/stripe/stripe-go/v86)</summary> ### [`v86.4.1`](https://redirect.github.com/stripe/stripe-go/releases/tag/v86.4.1) [Compare Source](https://redirect.github.com/stripe/stripe-go/compare/v86.4.0...v86.4.1) - [#​2424](https://redirect.github.com/stripe/stripe-go/pull/2424) Harden API requestor code against malicious URLs See [the changelog for more details](https://redirect.github.com/stripe/stripe-go/blob/v86.4.1/CHANGELOG.md). </details> <details> <summary>gitlab-org/api/client-go (gitlab.com/gitlab-org/api/client-go/v2)</summary> ### [`v2.62.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.62.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.61.0...v2.62.0) #### 2.62.0 ##### 🚀 Features - #​2257 Add Work Item Saved Views API support ([!2947](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2947)) by [Sina Moghaddas](https://gitlab.com/SinaMoghaddas) ##### 🔄 Other Changes - chore(deps): update module buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go to v1.36.12-20260825204119-511051f7f437.1 ([!3020](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/3020)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) - chore(deps): update module golang.org/x/text to v0.41.0 ([!3018](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/3018)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) ### [2.62.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.61.0...v2.62.0) (2026-09-02) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/London) - Branch creation - "after 6pm on thursday,before 10am on friday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/overmindtech/workspace). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC42MS4zIiwidXBkYXRlZEluVmVyIjoiNDQuNjEuMyIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIiwiZ29sYW5nIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> GitOrigin-RevId: 5833a273b71fbbe70cdbfdb5e3250c15bc708ba8
<!-- CURSOR_AGENT_PR_BODY_BEGIN --> ## Summary - update the requested Google Cloud modules to their specified releases - update Gomega to v1.43.0 - update the requested OpenTelemetry modules to the v1.46.0 release train and the AWS EC2 detector to v2.5.3 - retain only the transitive module graph changes required by those releases ## Validation - `go mod tidy` - pending local verification and CI <!-- CURSOR_AGENT_PR_BODY_END --> <div><a href="https://cursor.com/agents/bc-f41d0403-c2e1-4e58-867a-90d664599d9e?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a href="https://cursor.com/background-agent?bcId=bc-f41d0403-c2e1-4e58-867a-90d664599d9e&cursor_ref=pr_footer&cursor_cta=open_in_cursor"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div> Co-authored-by: Cursor Agent <cursoragent@cursor.com> GitOrigin-RevId: a4a84bf3bb2358341716cd7404e27d036a1fac08
Plan ID: UNTIL-1061
## Summary
- Allow Until MCP sign-in to redirect to Antigravity's OAuth callback.
- Ship a native `agy` plugin package (manifest, MCP config, hooks) so
install is not a Claude-skills import.
- Teach the shared Until hooks Antigravity tool names and `{ "decision":
... }` / `injectSteps` envelopes, and document
install/auth/troubleshooting.
## Test plan
- [x] `go test ./go/auth -run TestIsAllowedMCPRedirect`
- [x] until-plugin-contracts: package, hook envelopes, tool
classification
- [x] `agy plugin validate` processes skills, MCP, and 4 hooks
- [x] Isolated `agy plugin install` of `plugins/` lists `source:
antigravity` with skills, mcpServers, and hooks (not a Claude import)
- [ ] Live `agy` sign-in after this allowlist is deployed
- [ ] Live session: edit/shell without a cleared Plan is denied;
`/hooks` shows the gate
## Plan differences
changed-antigravity-preplan-gate-remains-open: intentional. Antigravity
uses the same shared commit gate as Claude, Cursor, and Droid. In an
ordinary repository that gate stays inactive until Plan submission or
source-control setup begins; `.until-method` repos are default-closed.
Making `agy` deny every pre-Plan edit in unmarked repos would be a
host-specific Rule, not the shared adapter this Plan chose.
missing-antigravity-dogfood-validation: native install is proven (`agy
plugin validate` and isolated `agy plugin install` both show native
source `antigravity` with MCP and hooks). Full sign-in and a live
no-Plan denial still need this allowlist deployed and a fresh `agy`
session; those remaining dogfood steps are listed in the test plan
above.
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Medium Risk**
> Touches OAuth redirect allowlisting and shared enforcement hooks used
by multiple agents; changes are scoped and tested, but a misclassified
payload could weaken or break gating until caught.
>
> **Overview**
> Adds **Antigravity CLI (`agy`)** as a first-class Until host:
server-side MCP OAuth may redirect to
`https://antigravity.google/oauth-callback`, and the plugin ships as a
**native package** (`plugin.json`, `mcp_config.json`, `hooks.json`)
installable via `agy plugin install` instead of a Claude import.
>
> Shared hooks now speak Antigravity’s envelopes—**`injectSteps`** for
session bootstrap and prompt reminders (only on `invocationNum` 0),
**`decision`/`reason`** for PreToolUse gating, and **`toolCall`**
parsing for commit-gate and plan state tracking. Tool coverage includes
`run_command`, Antigravity file tools, and `invoke_subagent`, with
stricter host detection so Claude/Cursor payloads that merely mention
`toolCall` are not misclassified. **`agy-plugin-cmd`** resolves the
installed plugin path for hook commands.
>
> User-facing docs cover install, MCP auth, update/uninstall, and a
troubleshooting section for native hooks. Contract tests assert the
package manifest, hook envelopes, and gate behavior for `agy`.
>
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
da7fdbc7c35418004bb1d378640ccf9840d3e3cb. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
GitOrigin-RevId: 76f8349fa92993c1c4a580585f6ec9429e9c716f
<!-- CURSOR_AGENT_PR_BODY_BEGIN --> ## Summary - make readiness HTTP shutdown single-owner and guaranteed on failure paths - isolate NSC tests from unrelated compose services and disposable resolver state, with health gating and prune membership assertions - replace all public DNS and Reddit dependencies in the affected tests with deterministic fixtures - serialize source deletion against stale in-flight heartbeats so deleted sources stay out of caches - document the deleted-source cache invariant ## Validation - readiness lifecycle: 200 race-enabled repetitions - DNS search/get/timeout: 50 race-enabled repetitions and full adapter suite - source-status suite: 20 race-enabled repetitions plus 200 targeted deletion-race repetitions - API test helper suite: 20 race-enabled repetitions - NSC mutation/prune suite: 50 race-enabled repetitions; final prune synchronization: 5 repetitions - complete Until backend race-enabled suite - API server and gateway service test-package compilation - `golangci-lint` on every modified Go package - NATS configuration validation and workflow static validation (only pre-existing custom-runner warnings) - `go fix` deterministic check - GitHub Actions: all 138 checks passed - Until Plan check: passed with no differences Plan ID: UNTIL-1062 Linear: [ENG-6478](https://linear.app/overmind/issue/ENG-6478/investigate-and-stabilise-recurring-workspace-ci-test-flakes) <!-- CURSOR_AGENT_PR_BODY_END --> <div><a href="https://cursor.com/agents/bc-ca6ab58b-3e88-487e-b490-3564660c8793?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a href="https://cursor.com/background-agent?bcId=bc-ca6ab58b-3e88-487e-b490-3564660c8793&cursor_ref=pr_footer&cursor_cta=open_in_cursor"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> GitOrigin-RevId: 015b68852479e4512914ad4690caf6a3929af5df
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/onsi/ginkgo/v2](https://redirect.github.com/onsi/ginkgo) | `v2.32.1` → `v2.32.2` |  |  | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/370) for more information. --- ### Release Notes <details> <summary>onsi/ginkgo (github.com/onsi/ginkgo/v2)</summary> ### [`v2.32.2`](https://redirect.github.com/onsi/ginkgo/compare/v2.32.1...v2.32.2) [Compare Source](https://redirect.github.com/onsi/ginkgo/compare/v2.32.1...v2.32.2) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/London) - Branch creation - "after 6pm on thursday,before 10am on friday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/overmindtech/workspace). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC43OS4xIiwidXBkYXRlZEluVmVyIjoiNDQuNzkuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIiwiZ29sYW5nIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> GitOrigin-RevId: a05ff79e539b41a85ff8248013af3efd8bd676f6
## Summary - Custom loops can declare `on.ScheduleFired` with a UTC cron no denser than every five minutes, so weekly digests and other cadences start from Events like every other loop. - Ingest stores `schedule_cron` and the next future fire time; changing or removing the schedule recomputes or clears that cursor so a broken file cannot keep firing. - A one-minute sweep writes a targeted `ScheduleFired` Event for fresh due rows and skips ticks that are five or more minutes late, then always advances the cursor from now. ## Linear Ticket Fixes: [ENG-6505](https://linear.app/overmind/issue/ENG-6505/build-a-cron-mechanism-for-until-loops) — Build a cron mechanism for until loops - **Purpose**: Give custom loops a UTC cron `on:` so cadence work can start without a new enqueue path. ## Changes - `ScheduleFired` proto field 96; `ParseOnYAML` accepts `cron:` only on that key; `robfig/cron` validates UTC, rejects `CRON_TZ`, and rejects a min gap under five minutes. - `loops.schedule_cron` / `schedule_next_run_at` plus `until.loop_schedule_sweep`. The sweep only `AdminWriteEvent`s; the listener enqueues solely the loop whose `external_id` matches the payload. - Authoring docs: `loops_syntax.md`, event catalogue, until-backend README sweep inventory. Reviewers should focus on ingest cursor upsert (`COALESCE` when the cron is unchanged), listener targeting by `loop_external_id`, and the late-tick skip vs always-advance behavior. ## Until Plan Plan ID: UNTIL-1070 - **Plan**: Cron mechanism for Until custom loops - **Approved by**: Elliot Waddington ## Plan differences These extras from review are intentional: - `beyond-sweep-row-failure-isolation`: keep per-row savepoints so one stored invalid cron cannot roll back sibling ticks, and NULL `schedule_next_run_at` so that row does not stay due forever. - `beyond-clear-cron-on-inactive-loop`: also set `schedule_cron = ''` on failed-parse and soft-delete so inactive rows do not retain a cron string after the cursor is cleared. > Deviation analysis and reviewer assignment are handled automatically by the > pre-approved PR review automation (see docs/PREAPPROVED_CHANGES.md). <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > Introduces time-based loop enqueue with cursor semantics, late-tick skipping, and per-row sweep isolation—bugs could miss schedules or fire the wrong loop, but scope is limited to scheduled custom loops. > > **Overview** > Adds **UTC cron scheduling** for Until custom loops via a `ScheduleFired` event, so cadence-driven work (e.g. weekly digests) uses the same `on:` / listener path as domain events. > > Loop authors can declare `on.ScheduleFired` with a required `cron:` (5-field UTC only; `TZ=` / `CRON_TZ=` rejected; minimum five minutes between fires). Ingest persists `schedule_cron` and `schedule_next_run_at`, recomputing or clearing the cursor when the schedule changes or the loop is inactive. A **one-minute** `until.loop_schedule_sweep` job emits a targeted `ScheduleFired` for due loaded loops (payload `loop_external_id`, etc.), **skips** ticks five or more minutes late, and **always advances** the next-run cursor from now so outages do not backlog. The event listener loads **only** the matching loop for `ScheduleFired` instead of scanning all account loops. > > This diff also documents `ScheduleFired` in the event catalogue and adds `github.com/robfig/cron/v3` for parsing and density validation. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit fc74fabee7ce220a2e4097b28b8b48da3712e724. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY --> --------- Co-authored-by: Cursor <cursoragent@cursor.com> GitOrigin-RevId: 3a9aae769f060bb007e8a3946572ab4e68d7da81
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/aws/aws-sdk-go-v2](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.45.1` → `v1.47.0` |  |  | | [github.com/aws/aws-sdk-go-v2/config](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.33.2` → `v1.33.4` |  |  | | [github.com/aws/aws-sdk-go-v2/credentials](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.20.2` → `v1.20.4` |  |  | | [github.com/aws/aws-sdk-go-v2/feature/ec2/imds](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.19.1` → `v1.20.0` |  |  | | [github.com/aws/aws-sdk-go-v2/service/apigateway](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.45.0` → `v1.47.0` |  |  | | [github.com/aws/aws-sdk-go-v2/service/autoscaling](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.76.0` → `v1.78.0` |  |  | | [github.com/aws/aws-sdk-go-v2/service/cloudfront](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.71.0` → `v1.73.0` |  |  | | [github.com/aws/aws-sdk-go-v2/service/cloudwatch](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.70.0` → `v1.72.0` |  |  | | [github.com/aws/aws-sdk-go-v2/service/directconnect](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.48.0` → `v1.50.0` |  |  | | [github.com/aws/aws-sdk-go-v2/service/dynamodb](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.66.0` → `v1.68.0` |  |  | | [github.com/aws/aws-sdk-go-v2/service/ec2](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.328.0` → `v1.332.0` |  |  | | [github.com/aws/aws-sdk-go-v2/service/ecs](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.95.0` → `v1.97.0` |  |  | | [github.com/aws/aws-sdk-go-v2/service/efs](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.47.0` → `v1.49.0` |  |  | | [github.com/aws/aws-sdk-go-v2/service/eks](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.97.0` → `v1.99.0` |  |  | | [github.com/aws/aws-sdk-go-v2/service/elasticloadbalancing](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.39.0` → `v1.41.0` |  |  | | [github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.61.1` → `v1.63.0` |  |  | | [github.com/aws/aws-sdk-go-v2/service/iam](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.62.0` → `v1.64.0` |  |  | | [github.com/aws/aws-sdk-go-v2/service/kms](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.58.0` → `v1.60.0` |  |  | | [github.com/aws/aws-sdk-go-v2/service/lambda](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.106.0` → `v1.108.0` |  |  | | [github.com/aws/aws-sdk-go-v2/service/networkfirewall](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.70.0` → `v1.72.0` |  |  | | [github.com/aws/aws-sdk-go-v2/service/networkmanager](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.48.0` → `v1.50.0` |  |  | | [github.com/aws/aws-sdk-go-v2/service/rds](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.127.0` → `v1.129.0` |  |  | | [github.com/aws/aws-sdk-go-v2/service/route53](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.68.0` → `v1.70.0` |  |  | | [github.com/aws/aws-sdk-go-v2/service/s3](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.110.0` → `v1.113.0` |  |  | | [github.com/aws/aws-sdk-go-v2/service/sesv2](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.71.0` → `v1.73.0` |  |  | | [github.com/aws/aws-sdk-go-v2/service/sns](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.45.0` → `v1.47.0` |  |  | | [github.com/aws/aws-sdk-go-v2/service/sqs](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.50.0` → `v1.52.0` |  |  | | [github.com/aws/aws-sdk-go-v2/service/ssm](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.76.0` → `v1.78.0` |  |  | | [github.com/aws/aws-sdk-go-v2/service/sts](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.48.0` → `v1.50.0` |  |  | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/370) for more information. --- ### Release Notes <details> <summary>aws/aws-sdk-go-v2 (github.com/aws/aws-sdk-go-v2)</summary> ### [`v1.47.0`](https://redirect.github.com/aws/aws-sdk-go-v2/blob/HEAD/CHANGELOG.md#Release-2026-08-21) [Compare Source](https://redirect.github.com/aws/aws-sdk-go-v2/compare/v1.46.0...v1.47.0) #### Module Highlights - `github.com/aws/aws-sdk-go-v2/service/backup`: [v1.60.4](service/backup/CHANGELOG.md#v1604-2026-08-21) - **Documentation**: Updating CLI Docs for Backup Audit Manager List Job Summaries APIs. - `github.com/aws/aws-sdk-go-v2/service/bedrockagentcorecontrol`: [v1.59.0](service/bedrockagentcorecontrol/CHANGELOG.md#v1590-2026-08-21) - **Feature**: Update Dataset schema to THIRDPARTYEVALUATIONV1 - `github.com/aws/aws-sdk-go-v2/service/cloudwatch`: [v1.67.0](service/cloudwatch/CHANGELOG.md#v1670-2026-08-21) - **Feature**: Allows customers to specify an initial warm up period to wait for metrics to arrive when creating metric or log alarms - `github.com/aws/aws-sdk-go-v2/service/devicefarm`: [v1.43.0](service/devicefarm/CHANGELOG.md#v1430-2026-08-21) - **Feature**: Added support to CreateRemoveAccessSession for selecting a server version on the mobile WebDriver endpoint. - `github.com/aws/aws-sdk-go-v2/service/kinesis`: [v1.47.0](service/kinesis/CHANGELOG.md#v1470-2026-08-21) - **Feature**: Generate account endpoint for Kinesis Data Streams requests when the account ID is available - `github.com/aws/aws-sdk-go-v2/service/wafv2`: [v1.77.7](service/wafv2/CHANGELOG.md#v1777-2026-08-21) - **Documentation**: DataProtectionConfig field Key Documentation Update ### [`v1.46.0`](https://redirect.github.com/aws/aws-sdk-go-v2/blob/HEAD/CHANGELOG.md#Release-2025-11-26) [Compare Source](https://redirect.github.com/aws/aws-sdk-go-v2/compare/v1.45.1...v1.46.0) #### Module Highlights - `github.com/aws/aws-sdk-go-v2/service/bedrockruntime`: [v1.46.0](service/bedrockruntime/CHANGELOG.md#v1460-2025-11-26) - **Feature**: Bedrock Runtime Reserved Service Support - `github.com/aws/aws-sdk-go-v2/service/computeoptimizer`: [v1.49.0](service/computeoptimizer/CHANGELOG.md#v1490-2025-11-26) - **Feature**: Compute Optimizer now identifies idle NAT Gateway resources for cost optimization based on traffic patterns and backup configuration analysis. Access recommendations via the GetIdleRecommendations API. - `github.com/aws/aws-sdk-go-v2/service/costoptimizationhub`: [v1.22.0](service/costoptimizationhub/CHANGELOG.md#v1220-2025-11-26) - **Feature**: This release enables AWS Cost Optimization Hub to show cost optimization recommendations for NAT Gateway. </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/London) - Branch creation - "after 6pm on thursday,before 10am on friday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/overmindtech/workspace). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC43OS4xIiwidXBkYXRlZEluVmVyIjoiNDQuNzkuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIiwiZ29sYW5nIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> GitOrigin-RevId: 506aabd642b34c0b041e1184278f4f8b513a6ae7
![https://cursor.com/assets/images/open-in-web-dark.png"><source](https://cursor.com/assets/images/open-in-web-dark.png"><source){kind=link}
![https://cursor.com/assets/images/open-in-web-light.png"><img](https://cursor.com/assets/images/open-in-web-light.png"><img){kind=link}
![https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a](https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a){kind=link}
![https://cursor.com/assets/images/open-in-cursor-dark.png"><source](https://cursor.com/assets/images/open-in-cursor-dark.png"><source){kind=link}
![https://cursor.com/assets/images/open-in-cursor-light.png"><img](https://cursor.com/assets/images/open-in-cursor-light.png"><img){kind=link}
![https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div](https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div){kind=link}
Plan ID: UNTIL-1073 ## Summary - Bring five soaked direct Go modules to the Ready now candidates: BigQuery, Storage, pgx, gofakeit, and the GitLab API client. - River, otelpgx, Kubernetes client-go, the anthropic SDK pin, and AWS SDK v2 stay at current versions. - Mechanical follow-ups forced by pgx v5.11: `TypeMap` on a `pgx.Rows` test stub; principal upsert conflict arms use `clock_timestamp()` so `isFreshInsert` still sees one created=true under concurrent first-runs. ## Test plan - [x] `go get` of the Allowed set only, then `go mod tidy` - [x] `go list -m` reports the five candidates - [x] `go build` of packages that import those modules - [x] `go test -race` on `go/pgtest`, `go/dbkit`, GitLab integration, GCP shared/manual/dynamic adapters, and until-backend plans/workspaces/testutil - [x] `go test -race -count=50` on `TestProvisionPrincipalTx_ConcurrentFirstRuns` - [x] CI on this PR ## Plan differences - scope-principal-upsert-clock-timestamps: acknowledged — conflict-arm wall clock is required to keep the existing created-once contract after the pgx bump; not extra product work. --------- Co-authored-by: Cursor <cursoragent@cursor.com> GitOrigin-RevId: fb23b6794facc472975a18cf3d897f97500af514
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [goreleaser/goreleaser](https://redirect.github.com/goreleaser/goreleaser) | patch | `v2.18.0` → `v2.18.1` | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/370) for more information. --- ### Release Notes <details> <summary>goreleaser/goreleaser (goreleaser/goreleaser)</summary> ### [`v2.18.1`](https://redirect.github.com/goreleaser/goreleaser/releases/tag/v2.18.1) [Compare Source](https://redirect.github.com/goreleaser/goreleaser/compare/v2.18.0...v2.18.1) ##### Announcement Read the official announcement: [Announcing GoReleaser v2.18](https://goreleaser.com/blog/goreleaser-v2.18/). ##### Changelog ##### Security updates - [`628c889`](https://redirect.github.com/goreleaser/goreleaser/commit/628c889d7f2a34066649833be419fdb9abe01174): sec(deps): bump golang.org/x/crypto and golang.org/x/mod ([#​6872](https://redirect.github.com/goreleaser/goreleaser/issues/6872)) ([@​caarlos0](https://redirect.github.com/caarlos0)) ##### Bug fixes - [`e38e2fd`](https://redirect.github.com/goreleaser/goreleaser/commit/e38e2fdbaccdbcca5829666567c13f194d126112): fix(archive): report stripped binary paths ([#​6820](https://redirect.github.com/goreleaser/goreleaser/issues/6820)) ([@​davicbtoliveira](https://redirect.github.com/davicbtoliveira)) - [`315a4fd`](https://redirect.github.com/goreleaser/goreleaser/commit/315a4fdf835630e29c96d90460dfc74d67895c68): fix(aursources): clarify error and document source.enabled requirement ([#​6816](https://redirect.github.com/goreleaser/goreleaser/issues/6816)) ([@​0jaspahwa](https://redirect.github.com/0jaspahwa)) - [`b7f1239`](https://redirect.github.com/goreleaser/goreleaser/commit/b7f12392a12d8f07a27a81682f1dabe4ee1fac8d): fix(cask): deprecate url.verified ([#​6871](https://redirect.github.com/goreleaser/goreleaser/issues/6871)) ([@​caarlos0](https://redirect.github.com/caarlos0)) - [`2c613de`](https://redirect.github.com/goreleaser/goreleaser/commit/2c613deb92c0404d6f79bd4a5361ec45696deb13): fix(chocolatey): a skipped chocolatey entry stops the ones after it ([#​6853](https://redirect.github.com/goreleaser/goreleaser/issues/6853)) ([@​hktitof](https://redirect.github.com/hktitof)) - [`33cc363`](https://redirect.github.com/goreleaser/goreleaser/commit/33cc3630f87fb3dd96fc2958bb756d9bbe1d18f3): fix(client): apply the commit config per command ([#​6852](https://redirect.github.com/goreleaser/goreleaser/issues/6852)) ([@​caarlos0](https://redirect.github.com/caarlos0)) - [`db7a1e6`](https://redirect.github.com/goreleaser/goreleaser/commit/db7a1e6c6dcef3b64bd04e600ee89be6e5ca5c47): fix(client): stop TestGitLabRateLimitRetryAfter racing the clock ([#​6846](https://redirect.github.com/goreleaser/goreleaser/issues/6846)) ([@​caarlos0](https://redirect.github.com/caarlos0)) - [`c8126af`](https://redirect.github.com/goreleaser/goreleaser/commit/c8126aff2a412d91eced253b993369091b47f264): fix(cmd): drop setup's unused return value ([#​6845](https://redirect.github.com/goreleaser/goreleaser/issues/6845)) ([@​caarlos0](https://redirect.github.com/caarlos0)) - [`d951018`](https://redirect.github.com/goreleaser/goreleaser/commit/d9510181e0e999536de2a3ac2d1e8afb146bb3aa): fix(docker): only use wheels of the configured ids ([#​6860](https://redirect.github.com/goreleaser/goreleaser/issues/6860)) ([@​caarlos0](https://redirect.github.com/caarlos0)) - [`0a6f83e`](https://redirect.github.com/goreleaser/goreleaser/commit/0a6f83e9a575f15d09cefb633a27f0f8a2f95390): fix(git): report repository detection errors ([#​6869](https://redirect.github.com/goreleaser/goreleaser/issues/6869)) ([@​caarlos0](https://redirect.github.com/caarlos0)) - [`edcfdec`](https://redirect.github.com/goreleaser/goreleaser/commit/edcfdec377860163720d03ac186f5ea523950167): fix(gitlab): own the retries, and honor replace\_existing\_artifacts ([#​6843](https://redirect.github.com/goreleaser/goreleaser/issues/6843)) ([@​caarlos0](https://redirect.github.com/caarlos0)) - [`f5edd73`](https://redirect.github.com/goreleaser/goreleaser/commit/f5edd7395693c0c6b501dc722d445d2e86af854d): fix(gomod): don't read the module path from stderr ([#​6864](https://redirect.github.com/goreleaser/goreleaser/issues/6864)) ([@​caarlos0](https://redirect.github.com/caarlos0)) - [`35051e4`](https://redirect.github.com/goreleaser/goreleaser/commit/35051e4a552b0e8ab8e93a7088aeb9eea745a15e): fix(sign): warn when the signer writes no file, fail in v3 ([#​6842](https://redirect.github.com/goreleaser/goreleaser/issues/6842)) ([@​caarlos0](https://redirect.github.com/caarlos0)) - [`e1a1e9c`](https://redirect.github.com/goreleaser/goreleaser/commit/e1a1e9c12120d168c27259cd5b3bad4ed8c8f67c): fix: map every 32-bit ARM variant to Termux's "arm" ([#​6857](https://redirect.github.com/goreleaser/goreleaser/issues/6857)) ([@​dylanpulver](https://redirect.github.com/dylanpulver)) ##### Documentation updates - [`e5730eb`](https://redirect.github.com/goreleaser/goreleaser/commit/e5730eb35fe8c009da1351b54f4cb4770b3c64fe): docs: fix broken commands, dead links, and inaccurate options ([#​6841](https://redirect.github.com/goreleaser/goreleaser/issues/6841)) ([@​caarlos0](https://redirect.github.com/caarlos0)) ##### Other work - [`8afe0bb`](https://redirect.github.com/goreleaser/goreleaser/commit/8afe0bbaf7b981e5f526fb93364856aae30a2236): chore: auto-update generated files ([#​6811](https://redirect.github.com/goreleaser/goreleaser/issues/6811)) ([@​goreleaserbot](https://redirect.github.com/goreleaserbot)) - [`c1493d3`](https://redirect.github.com/goreleaser/goreleaser/commit/c1493d33a25b3b9c971f0c1ed9362375beeaaf48): chore: auto-update generated files ([#​6812](https://redirect.github.com/goreleaser/goreleaser/issues/6812)) ([@​goreleaserbot](https://redirect.github.com/goreleaserbot)) - [`3294442`](https://redirect.github.com/goreleaser/goreleaser/commit/329444276458e817b2a26e61d839bbf690f32746): chore: auto-update generated files ([#​6861](https://redirect.github.com/goreleaser/goreleaser/issues/6861)) ([@​goreleaserbot](https://redirect.github.com/goreleaserbot)) - [`6e40871`](https://redirect.github.com/goreleaser/goreleaser/commit/6e408712b39222ebd7ac5a8dadd628852617bbb5): chore: update to Go 1.27.1 ([#​6859](https://redirect.github.com/goreleaser/goreleaser/issues/6859)) ([@​caarlos0](https://redirect.github.com/caarlos0)) - [`4181c4f`](https://redirect.github.com/goreleaser/goreleaser/commit/4181c4f2bab6e2359bfd4dd97d2827d7e973c33f): perf(git): ask git once ([#​6850](https://redirect.github.com/goreleaser/goreleaser/issues/6850)) ([@​caarlos0](https://redirect.github.com/caarlos0)) - [`dcbe117`](https://redirect.github.com/goreleaser/goreleaser/commit/dcbe1176a0bec459682ca299dbc9fcb17477571e): perf(node): faster dist extraction, and stop leaking it into TMPDIR ([#​6844](https://redirect.github.com/goreleaser/goreleaser/issues/6844)) ([@​caarlos0](https://redirect.github.com/caarlos0)) - [`36e43dd`](https://redirect.github.com/goreleaser/goreleaser/commit/36e43dd08f724956b188af2f6f3bcfd5efd355ec): perf: skip needless docker probes; make the ko registry test hermetic ([#​6827](https://redirect.github.com/goreleaser/goreleaser/issues/6827)) ([@​caarlos0](https://redirect.github.com/caarlos0)) **Full Changelog**: <goreleaser/goreleaser@v2.18.0...v2.18.1> ##### Helping out This release is only possible thanks to **all** the support of some **awesome people**! Want to be one of them? You can [sponsor](https://goreleaser.com/sponsors/), get a [Pro License](https://goreleaser.com/pro) or [contribute with code](https://goreleaser.com/contributing). ##### Where to go next? - Find examples and commented usage of all options in our [website](https://goreleaser.com/intro/). - Reach out on [Discord](https://discord.gg/RGEBtg8vQ6), [Twitter](https://twitter.com/goreleaser), and [Telegram](https://t.me/goreleasernews)! <a href="https://goreleaser.com"><img src="https://raw.githubusercontent.com/goreleaser/artwork/master/opencollective-header.png" with="100%" alt="GoReleaser logo"></a> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/London) - Branch creation - "after 6pm on thursday,before 10am on friday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/overmindtech/workspace). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC43OS4xIiwidXBkYXRlZEluVmVyIjoiNDQuNzkuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> GitOrigin-RevId: 7a571fa6a6ffac4b436e11b85520d0efe1ddac80
This PR contains the following updates: | Update | Change | |---|---| | lockFileMaintenance | All locks refreshed | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/370) for more information. 🔧 This Pull Request updates lock files to use the latest dependency versions. --- ### Configuration 📅 **Schedule**: (in timezone Europe/London) - Branch creation - "before 4am on monday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/overmindtech/workspace). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC43OS4xIiwidXBkYXRlZEluVmVyIjoiNDQuNzkuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> GitOrigin-RevId: 1cf08bb439a9aec876910089b90c7f0d8704858f
tphoney
approved these changes
Sep 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Copybara Sync - Release v1.19.3
This PR was automatically created by Copybara, syncing changes from the overmindtech/workspace monorepo.
Original author: renovate[bot] (29139614+renovate[bot]@users.noreply.github.com)
What happens when this PR is merged?
tag-on-mergeworkflow will automatically create thev1.19.3tag on mainReview Checklist