Skip to content

feat: bypass vertex creds from client request - #2447

Open
DanielChrn wants to merge 39 commits into
envoyproxy:mainfrom
DanielChrn:main
Open

feat: bypass vertex creds from client request#2447
DanielChrn wants to merge 39 commits into
envoyproxy:mainfrom
DanielChrn:main

Conversation

@DanielChrn

@DanielChrn DanielChrn commented Jul 28, 2026

Copy link
Copy Markdown

Description

As part of our internal AI-gateway integration, we want to be able to take Vertex auth from the client and bypass it to the backend.
Current controller setup does not allow it because:

  • It always overwrites the path into something that does not exist (part of the full Vertex URL.)
  • Client does not have a way to introduce region/project in the request.

Because of that we want to introduce 2 changes.

  1. Move path header translated from the GCP request to gcp-path .
  2. Allow bypassing the region/project form client via gcp-project and gcp-region headers

xiaolin593 and others added 30 commits July 16, 2026 16:56
@xiaolin593 @DanielChrn
feat: add namespace tool and tool_search support for Responses API (e…
c1dfea2 
…nvoyproxy#2317)

**Description**
Add namespace and tool_search tool support for Responses API for Codex
integration. Without these two fields, latest Codex CLI (version >=
0.120.0) fails working with gateway.

Namespace tool request structure
```
{
      "type": "namespace",
      "name": "mcp__node_repl",
      "description": "Use `js` to run JavaScript in the persistent Node-backed kernel. When a skill or prompt says to use `node_repl`, call this server's `js` execution tool. Calls default to a 30000 ms (30 seconds) timeout when `timeout_ms` is omitted. The runtime exposes `nodeRepl.cwd`, `nodeRepl.homeDir`, `nodeRepl.tmpDir`, `nodeRepl.requestMeta`, `nodeRepl.setResponseMeta(...)`, and `await nodeRepl.emitImage(...)`. Top-level bindings persist across `js` calls until `js_reset`; do not redeclare existing `const` or `let` names. Reuse existing bindings, use top-level `var` for reusable state that may be assigned again, or choose a fresh descriptive name. Use `js_add_node_module_dir` before `js` when a skill provides an extra package directory, and use dynamic imports like `await import(\"playwright\")` rather than filesystem paths under `./node_modules`.",
      "tools": [
        {
          "type": "function",
          "name": "js",
          "description": "<========TOO_LONG_SO_OMIT_IT============>.",
          "strict": false,
          "parameters": {
            "type": "object",
            "properties": {
              "code": {
                "type": "string",
                "description": "JavaScript source to execute in the persistent Node-backed kernel. The code runs with top-level await and can use the `nodeRepl` helpers. Examples: `nodeRepl.write(nodeRepl.cwd)`, `const { chromium } = await import(\"playwright\")`, or `await nodeRepl.emitImage(pngBuffer)`."
              },
              "timeout_ms": {
                "type": "integer",
                "description": "Optional execution timeout in milliseconds. Defaults to 30000 (30 seconds) when omitted."
              },
              "title": {
                "type": "string",
                "description": "Short user-facing description of what this code block is doing. Use a few words, for example `Inspect package metadata` or `Render chart preview`."
              }
            },
            "required": [
              "code"
            ],
            "additionalProperties": false
          }
        },
        {
          "type": "function",
          "name": "js_add_node_module_dir",
          "description": "Add an absolute `node_modules` directory to the REPL-wide Node module search roots for future package imports. The directory stays available for this MCP server lifetime, including after `js_reset`. Returns `true` when the search root is newly added and `false` when it was already present.",
          "strict": false,
          "parameters": {
            "type": "object",
            "properties": {
              "path": {
                "type": "string",
                "description": "Absolute path to a node_modules directory to add to Node package resolution."
              }
            },
            "required": [
              "path"
            ],
            "additionalProperties": false
          }
        },
        {
          "type": "function",
          "name": "js_reset",
          "description": "Reset the persistent JavaScript kernel and clear all bindings created by prior `js` calls. Use this when you need a clean state, or when reusing existing bindings, top-level `var` declarations, or fresh names cannot recover from conflicting declarations.",
          "strict": false,
          "parameters": {
            "type": "object",
            "properties": {},
            "additionalProperties": false
          }
        }
      ]
    },
```

tool_search

```
{
      "type": "tool_search",
      "execution": "client",
      "description": "# Tool discovery\n\nSearches over deferred tool metadata with BM25 and exposes matching tools for the next model call.\n\nYou have access to tools from the following sources:\n- Multi-agent tools: Spawn and manage sub-agents.\nSome of the tools may not have been provided to you upfront, and you should use this tool (`tool_search`) to search for the required tools. For MCP tool discovery, always use `tool_search` instead of `list_mcp_resources` or `list_mcp_resource_templates`.",
      "parameters": {
        "type": "object",
        "properties": {
          "limit": {
            "type": "number",
            "description": "Maximum number of tools to return. Defaults to 8."
          },
          "query": {
            "type": "string",
            "description": "Search query for deferred tools."
          }
        },
        "required": [
          "query"
        ],
        "additionalProperties": false
      }
    }
```

---------

Signed-off-by: Xiaolin Lin <xlin158@bloomberg.net>
Signed-off-by: Daniel Chernovsky <daniel.chernovsky@doubleverify.com>
@DanielChrn
Make posible to bypass creds from client request to vertex anthropic
e0e691c 
Signed-off-by: Daniel Chernovsky <daniel.chernovsky@doubleverify.com>
@DanielChrn
Fix tests + Add Bearer token
b16d1f9 
Signed-off-by: Daniel Chernovsky <daniel.chernovsky@doubleverify.com>
@walsm232 @DanielChrn
feat(helm): add controller PodDisruptionBudget to AI Gateway Helm cha…
2b1bfa6 
…rt (envoyproxy#2335)

**Description**

This commit adds an optional `PodDisruptionBudget` to the
`ai-gateway-helm` controller `Deployment`. This allows installations
running multiple controller replicas to protect availability during
voluntary disruptions such as node drains or cluster upgrades.

The `PodDisruptionBudget` is disabled by default to preserve existing
install behavior. When enabled, it uses the same selector labels as the
controller `Deployment` and supports **annotations**, **minAvailable**,
and **maxUnavailable** configuration.

**Related Issues/PRs (if applicable)**

N/A - I didn't open an issue for this but if it needs one let me know!

**Testing**

Tested with:

- **Default render:** PDB is disabled by default.
- **Enabled render:** PDB renders as `policy/v1`.
- Selector labels match the `Deployment` selector because both use the
same helper:
  - PDB uses `ai-gateway-helm.controller.selectorLabels`
- Deployment `spec.selector.matchLabels` uses
`ai-gateway-helm.controller.selectorLabels`
- Deployment pod template labels also use
`ai-gateway-helm.controller.selectorLabels`

Rendered selector was:

```yaml
  selector:
    matchLabels:
      app.kubernetes.io/name: ai-gateway-helm
      app.kubernetes.io/instance: release-name
```

I also ran:

```
  go tool -modfile=tools/go.mod helm lint manifests/charts/ai-gateway-helm
  make helm-test
```

Signed-off-by: Michael Walsh <walshmichael310@gmail.com>
Signed-off-by: Daniel Chernovsky <daniel.chernovsky@doubleverify.com>
@dependabot @DanielChrn
chore(deps): bump the go group across 1 directory with 23 updates (en…
7a7e351 
…voyproxy#2343)

Bumps the go group with 19 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
|
[github.com/Azure/azure-sdk-for-go/sdk/azcore](https://github.com/Azure/azure-sdk-for-go)
| `1.21.1` | `1.22.0` |
|
[github.com/Azure/azure-sdk-for-go/sdk/azidentity](https://github.com/Azure/azure-sdk-for-go)
| `1.13.1` | `1.14.0` |
| [github.com/andybalholm/brotli](https://github.com/andybalholm/brotli)
| `1.2.1` | `1.2.2` |
|
[github.com/anthropics/anthropic-sdk-go](https://github.com/anthropics/anthropic-sdk-go)
| `1.46.0` | `1.52.0` |
| [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) |
`1.41.11` | `1.42.0` |
|
[github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream](https://github.com/aws/aws-sdk-go-v2)
| `1.7.12` | `1.7.13` |
|
[github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2)
| `1.32.22` | `1.32.25` |
| [github.com/coreos/go-oidc/v3](https://github.com/coreos/go-oidc) |
`3.18.0` | `3.19.0` |
| [github.com/moby/moby/api](https://github.com/moby/moby) | `1.54.2` |
`1.55.0` |
| [github.com/openai/openai-go/v3](https://github.com/openai/openai-go)
| `3.39.0` | `3.41.0` |
| [github.com/prometheus/common](https://github.com/prometheus/common) |
`0.68.1` | `0.69.0` |
|
[github.com/testcontainers/testcontainers-go](https://github.com/testcontainers/testcontainers-go)
| `0.42.0` | `0.43.0` |
| [golang.org/x/sync](https://github.com/golang/sync) | `0.20.0` |
`0.21.0` |
| [golang.org/x/tools](https://github.com/golang/tools) | `0.45.0` |
`0.46.0` |
|
[google.golang.org/api](https://github.com/googleapis/google-api-go-client)
| `0.283.0` | `0.286.0` |
| [google.golang.org/genai](https://github.com/googleapis/go-genai) |
`1.59.0` | `1.62.0` |
| gopkg.in/dnaeon/go-vcr.v4 | `4.0.6` | `4.0.7` |
| [k8s.io/api](https://github.com/kubernetes/api) | `0.36.1` | `0.36.2`
|
|
[k8s.io/apiextensions-apiserver](https://github.com/kubernetes/apiextensions-apiserver)
| `0.36.1` | `0.36.2` |

Updates `github.com/Azure/azure-sdk-for-go/sdk/azcore` from 1.21.1 to
1.22.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/Azure/azure-sdk-for-go/releases">github.com/Azure/azure-sdk-for-go/sdk/azcore's
releases</a>.</em></p>
<blockquote>
<h2>sdk/azcore/v1.22.0</h2>
<h2>1.22.0 (2026-06-04)</h2>
<h3>Features Added</h3>
<ul>
<li>Added type <code>datetime.RFC7231</code> for date/time values in RFC
1123 format with a fixed GMT timezone.</li>
</ul>
<h3>Other Changes</h3>
<ul>
<li>Upgraded dependencies.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/Azure/azure-sdk-for-go/commit/a19f613b0e6ecb3d5d71a22980a82d61e7f9fda5"><code>a19f613</code></a>
Prep azcore@v1.22.0 for release (<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/26926">#26926</a>)</li>
<li><a
href="https://github.com/Azure/azure-sdk-for-go/commit/5803c0ee4e3519507cc5cd53cee73ffb6eeb2db8"><code>5803c0e</code></a>
Increment package version after release of storage/azblob (<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/26935">#26935</a>)
(<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/26943">#26943</a>)</li>
<li><a
href="https://github.com/Azure/azure-sdk-for-go/commit/9a979ffe0fca4489633b587ab12464c3d66d6988"><code>9a979ff</code></a>
[Automation] Regenerate SDK based on typespec-go branch main 【batch 6】
(<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/26939">#26939</a>)</li>
<li><a
href="https://github.com/Azure/azure-sdk-for-go/commit/711094d6e2aa4b4430f9012b95fe30bab5236250"><code>711094d</code></a>
eng/tools/generator: release v0.4.14 (<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/26934">#26934</a>)</li>
<li><a
href="https://github.com/Azure/azure-sdk-for-go/commit/20bd67791ff45e58f876a6ed6a903df75c8b4f38"><code>20bd677</code></a>
Deprecate Change Analysis SDK (<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/26913">#26913</a>)</li>
<li><a
href="https://github.com/Azure/azure-sdk-for-go/commit/92a31ec5d094c6d6572317a33c913382b4d2e597"><code>92a31ec</code></a>
[Automation] Regenerate SDK based on typespec-go branch main 【batch 5】
(<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/26932">#26932</a>)</li>
<li><a
href="https://github.com/Azure/azure-sdk-for-go/commit/768459d1788ea7c9649383053dee10235fd5e405"><code>768459d</code></a>
azcertificates: live recording for PlatformManaged + review fixes
(follow-up ...</li>
<li><a
href="https://github.com/Azure/azure-sdk-for-go/commit/e845f721e72a18d094f0e07969dbea9bc374f22b"><code>e845f72</code></a>
Update codeowners (<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/26918">#26918</a>)</li>
<li><a
href="https://github.com/Azure/azure-sdk-for-go/commit/118bb357a68bb51960b061f0a911d4f8f4cef2bb"><code>118bb35</code></a>
eng/tools/internal/exports: handle untyped const with selector expr
value (<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/2">#2</a>...</li>
<li><a
href="https://github.com/Azure/azure-sdk-for-go/commit/2b3767bcef06a057a3139784d5ee94c305dc4790"><code>2b3767b</code></a>
Configurations:
'specification/containerservice/resource-manager/Microsoft.C...</li>
<li>Additional commits viewable in <a
href="https://github.com/Azure/azure-sdk-for-go/compare/sdk/azcore/v1.21.1...sdk/azcore/v1.22.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `github.com/Azure/azure-sdk-for-go/sdk/azidentity` from 1.13.1
to 1.14.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/Azure/azure-sdk-for-go/releases">github.com/Azure/azure-sdk-for-go/sdk/azidentity's
releases</a>.</em></p>
<blockquote>
<h2>sdk/azidentity/v1.14.0</h2>
<h2>1.14.0 (2026-06-15)</h2>
<h3>Breaking Changes</h3>
<blockquote>
<p>These changes affect only code written against a beta version such as
v1.14.0-beta.3</p>
</blockquote>
<ul>
<li>Removed
<code>WorkloadIdentityCredentialOptions.EnableAzureProxy</code>.
It will return in v1.15.0-beta.1</li>
</ul>
<h3>Bugs Fixed</h3>
<ul>
<li><code>AzureDeveloperCLICredential</code> improved reporting of error
messages returned from <code>azd</code></li>
</ul>
<h3>Other Changes</h3>
<ul>
<li>Returned <code>azidentity</code> errors include links to the
troubleshooting guide when appropriate</li>
<li>This module now requires a minimum Go version of 1.25</li>
<li>Upgraded dependencies</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/Azure/azure-sdk-for-go/commit/0495c205a1fd11affa15acfa77b3c22cd25981d5"><code>0495c20</code></a>
Prep azcore 1.14.0 for release (<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/23293">#23293</a>)</li>
<li><a
href="https://github.com/Azure/azure-sdk-for-go/commit/217edee7ec5735e3c2f1bbbb132b7546d5e512a9"><code>217edee</code></a>
fix(generator tool): filter tsp-client diagnostics log (<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/23292">#23292</a>)</li>
<li><a
href="https://github.com/Azure/azure-sdk-for-go/commit/023c88f9f14d6ccddc95f049f0b883ec666ffff0"><code>023c88f</code></a>
Increment package version after release of azidentity (<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/23290">#23290</a>)</li>
<li><a
href="https://github.com/Azure/azure-sdk-for-go/commit/17f3361700979aa8d8b1c365cbc2f9f65121aeef"><code>17f3361</code></a>
Sync eng/common directory with azure-sdk-tools for PR 8760 (<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/23271">#23271</a>)</li>
<li><a
href="https://github.com/Azure/azure-sdk-for-go/commit/f5f32342c2f76a42d6211f3cfb1af645f4de23d2"><code>f5f3234</code></a>
bump proxy to one with an audit log and more correct locking (<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/23288">#23288</a>)</li>
<li><a
href="https://github.com/Azure/azure-sdk-for-go/commit/d707091074e9f04daeae1497776800c5eafcd404"><code>d707091</code></a>
Prepare azidentity v1.8.0-beta.2 for release (<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/23289">#23289</a>)</li>
<li><a
href="https://github.com/Azure/azure-sdk-for-go/commit/84d213cff168fcf348252490ee9f950ecfef394f"><code>84d213c</code></a>
NewManagedIdentityCredential returns an error for unsupported ID options
(<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/23">#23</a>...</li>
<li><a
href="https://github.com/Azure/azure-sdk-for-go/commit/ea67e9c718d871776f484d99ebac0163fb247634"><code>ea67e9c</code></a>
azcontainerregistry: move method to function (<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/23270">#23270</a>)</li>
<li><a
href="https://github.com/Azure/azure-sdk-for-go/commit/40dad0a8cb583784b2331e346c619704b7259cf6"><code>40dad0a</code></a>
fix (<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/23287">#23287</a>)</li>
<li><a
href="https://github.com/Azure/azure-sdk-for-go/commit/a368082ee3a702d19dead9190cb9b994a8730ba5"><code>a368082</code></a>
fix generator tool: ExecuteGoGenerate func (<a
href="https://redirect.github.com/Azure/azure-sdk-for-go/issues/23286">#23286</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/Azure/azure-sdk-for-go/compare/sdk/azidentity/v1.13.1...sdk/azcore/v1.14.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `github.com/andybalholm/brotli` from 1.2.1 to 1.2.2
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/andybalholm/brotli/commit/785aba538b2118979d2c573eccb287c4da157faf"><code>785aba5</code></a>
reuse hgroups</li>
<li><a
href="https://github.com/andybalholm/brotli/commit/b797a3535cbdd227ce3520cb0dfe01d83c2eeda9"><code>b797a35</code></a>
reuse block_type_trees</li>
<li>See full diff in <a
href="https://github.com/andybalholm/brotli/compare/v1.2.1...v1.2.2">compare
view</a></li>
</ul>
</details>
<br />

Updates `github.com/anthropics/anthropic-sdk-go` from 1.46.0 to 1.52.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-go/releases">github.com/anthropics/anthropic-sdk-go's
releases</a>.</em></p>
<blockquote>
<h2>v1.52.0</h2>
<h2>1.52.0 (2026-06-24)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-go/compare/v1.51.1...v1.52.0">v1.51.1...v1.52.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>client:</strong> add support for system.message streaming
events (<a
href="https://github.com/anthropics/anthropic-sdk-go/commit/7bb296db56de13140605495642cf72889f829ed8">7bb296d</a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li><strong>api:</strong> add support for new refusal category (<a
href="https://github.com/anthropics/anthropic-sdk-go/commit/46f86259a94c1d43a21b3d44dd5eb40e9d4b3e13">46f8625</a>)</li>
<li><strong>api:</strong> add support for sending User Profile ID in
request headers (<a
href="https://github.com/anthropics/anthropic-sdk-go/commit/5cab486af669c06349d03bb66f0214557422561c">5cab486</a>)</li>
</ul>
<h2>v1.51.1</h2>
<h2>1.51.1 (2026-06-18)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-go/compare/v1.51.0...v1.51.1">v1.51.0...v1.51.1</a></p>
<h3>Bug Fixes</h3>
<ul>
<li><strong>helpers:</strong> single source for x-stainless-helper,
append semantics, and tag the fallback middleware (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-go/issues/88">#88</a>)
(<a
href="https://github.com/anthropics/anthropic-sdk-go/commit/ebbdb7dea37b15cdd055c53806a51e06422847fe">ebbdb7d</a>)</li>
</ul>
<h2>v1.51.0</h2>
<h2>1.51.0 (2026-06-18)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-go/compare/v1.50.2...v1.51.0">v1.50.2...v1.51.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> add support for new code_execution_20260120
tool (<a
href="https://github.com/anthropics/anthropic-sdk-go/commit/f54a4a8e6f9c271b2b31e0cf504cdab8005f28c4">f54a4a8</a>)</li>
</ul>
<h2>v1.50.2</h2>
<h2>1.50.2 (2026-06-15)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-go/compare/v1.50.1...v1.50.2">v1.50.1...v1.50.2</a></p>
<h3>Chores</h3>
<ul>
<li><strong>api:</strong> remove retired models from API and SDKs (<a
href="https://github.com/anthropics/anthropic-sdk-go/commit/11f5c8239cb11351c5f42aac6bb12c0dc8fdccd2">11f5c82</a>)</li>
</ul>
<h2>v1.50.1</h2>
<h2>1.50.1 (2026-06-09)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-go/compare/v1.50.0...v1.50.1">v1.50.0...v1.50.1</a></p>
<h3>Bug Fixes</h3>
<ul>
<li><strong>api:</strong> add <code>frontier_llm</code> refusal category
(<a
href="https://github.com/anthropics/anthropic-sdk-go/commit/9ebbaf76a334618a062f787bd4937e3370cb117c">9ebbaf7</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-go/blob/main/CHANGELOG.md">github.com/anthropics/anthropic-sdk-go's
changelog</a>.</em></p>
<blockquote>
<h2>1.52.0 (2026-06-24)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-go/compare/v1.51.1...v1.52.0">v1.51.1...v1.52.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>client:</strong> add support for system.message streaming
events (<a
href="https://github.com/anthropics/anthropic-sdk-go/commit/7bb296db56de13140605495642cf72889f829ed8">7bb296d</a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li><strong>api:</strong> add support for new refusal category (<a
href="https://github.com/anthropics/anthropic-sdk-go/commit/46f86259a94c1d43a21b3d44dd5eb40e9d4b3e13">46f8625</a>)</li>
<li><strong>api:</strong> add support for sending User Profile ID in
request headers (<a
href="https://github.com/anthropics/anthropic-sdk-go/commit/5cab486af669c06349d03bb66f0214557422561c">5cab486</a>)</li>
</ul>
<h2>1.51.1 (2026-06-18)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-go/compare/v1.51.0...v1.51.1">v1.51.0...v1.51.1</a></p>
<h3>Bug Fixes</h3>
<ul>
<li><strong>helpers:</strong> single source for x-stainless-helper,
append semantics, and tag the fallback middleware (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-go/issues/88">#88</a>)
(<a
href="https://github.com/anthropics/anthropic-sdk-go/commit/ebbdb7dea37b15cdd055c53806a51e06422847fe">ebbdb7d</a>)</li>
</ul>
<h2>1.51.0 (2026-06-18)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-go/compare/v1.50.2...v1.51.0">v1.50.2...v1.51.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> add support for new code_execution_20260120
tool (<a
href="https://github.com/anthropics/anthropic-sdk-go/commit/f54a4a8e6f9c271b2b31e0cf504cdab8005f28c4">f54a4a8</a>)</li>
</ul>
<h2>1.50.2 (2026-06-15)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-go/compare/v1.50.1...v1.50.2">v1.50.1...v1.50.2</a></p>
<h3>Chores</h3>
<ul>
<li><strong>api:</strong> remove retired models from API and SDKs (<a
href="https://github.com/anthropics/anthropic-sdk-go/commit/11f5c8239cb11351c5f42aac6bb12c0dc8fdccd2">11f5c82</a>)</li>
</ul>
<h2>1.50.1 (2026-06-09)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-go/compare/v1.50.0...v1.50.1">v1.50.0...v1.50.1</a></p>
<h3>Bug Fixes</h3>
<ul>
<li><strong>api:</strong> add <code>frontier_llm</code> refusal category
(<a
href="https://github.com/anthropics/anthropic-sdk-go/commit/9ebbaf76a334618a062f787bd4937e3370cb117c">9ebbaf7</a>)</li>
</ul>
<h2>1.50.0 (2026-06-09)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-go/compare/v1.49.0...v1.50.0">v1.49.0...v1.50.0</a></p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/anthropics/anthropic-sdk-go/commit/2978fa577e78f2eaa4555ac62bfb9e401687a380"><code>2978fa5</code></a>
release: 1.52.0</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-go/commit/92687e70867fae2f0195f84cc9ef4df3b586e4e5"><code>92687e7</code></a>
chore(api): add support for new refusal category</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-go/commit/813e82f2eb9143e73868d62eda722d3e80aeaa02"><code>813e82f</code></a>
chore(api): add support for sending User Profile ID in request
headers</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-go/commit/a36c6ff5d7804d592e2d0be9a526149817e6be09"><code>a36c6ff</code></a>
feat(client): add support for system.message streaming events</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-go/commit/d28739956e5ddd4788189284d8bf5f6222d52b08"><code>d287399</code></a>
release: 1.51.1</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-go/commit/aeca807111b0313928de0ab9e340da51c90e6750"><code>aeca807</code></a>
fix(helpers): single source for x-stainless-helper, append semantics,
and tag...</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-go/commit/4fad069bddb7e48119df97f286a5e0d5f5905bc7"><code>4fad069</code></a>
release: 1.51.0</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-go/commit/0561e1bb82e37c06c832f69d449e8e7e9dd750c4"><code>0561e1b</code></a>
feat(api): add support for new code_execution_20260120 tool</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-go/commit/e65c5be7427d489af7946862078356d9e62f3146"><code>e65c5be</code></a>
release: 1.50.2</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-go/commit/549457673efd0b75dd535e8ef200e76d6fb01bdb"><code>5494576</code></a>
chore(api): remove retired models from API and SDKs</li>
<li>Additional commits viewable in <a
href="https://github.com/anthropics/anthropic-sdk-go/compare/v1.46.0...v1.52.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `github.com/aws/aws-sdk-go-v2` from 1.41.11 to 1.42.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/9a3190f79c9e3f7dce5d602be375c07ecd8973cc"><code>9a3190f</code></a>
Release 2026-06-08</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/b20dd5bb52bbb193b036c3e81525e7a06f3f819b"><code>b20dd5b</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/75a45eaa192d32d7e1247a666f9572a61443b48a"><code>75a45ea</code></a>
Update API model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/e736f55ba6d11d83f9b8d858bbd9ab6c1a883ee2"><code>e736f55</code></a>
Add preview of changes for standard retry mode behind flag (<a
href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/3400">#3400</a>)</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/ba08dc9776ad30b7e5299dd98f3f0360d39656d4"><code>ba08dc9</code></a>
Release 2026-06-05.2</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/9a67e21ffef3d8b3c9c84e9ce7d90314b646f395"><code>9a67e21</code></a>
Revert schema serde (<a
href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/3442">#3442</a>)</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/51692f80a1919052106b080468a7d231649d10a4"><code>51692f8</code></a>
s3/transfermanager: avoid double-closing concurrentReader channel after
read ...</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/f696d5bbafd406a16429239844c6e70627aee935"><code>f696d5b</code></a>
Release 2026-06-05</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/7efb8fd6bd7b33d2242586a63a32eca93f774f89"><code>7efb8fd</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/1a420c53c9599f9267285650a61009933de8c9bb"><code>1a420c5</code></a>
Update endpoints model</li>
<li>Additional commits viewable in <a
href="https://github.com/aws/aws-sdk-go-v2/compare/v1.41.11...v1.42.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream` from
1.7.12 to 1.7.13
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/1257d4e205318d7dea08f5785d51d8ced05ccde6"><code>1257d4e</code></a>
Release 2022-12-15</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/f89f556a125709070bf3614e565233a90d2ee17c"><code>f89f556</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/7c6f2cfe5d8e2c7be134e2210a01ebacda945c33"><code>7c6f2cf</code></a>
Update endpoints model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/7cd0d9d9b4d7dd972da4aaf8983d6aca8d3f5874"><code>7cd0d9d</code></a>
Update API model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/6067fb20cd68b5537e2fad6be41c367be5b78006"><code>6067fb2</code></a>
Unify home dir logic between shared config and sso (<a
href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/1960">#1960</a>)</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/6fad028bc1ecb509e19336122056af6e6ff26abd"><code>6fad028</code></a>
Release 2022-12-14</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/cc6589758306fb4c877c9b4d232a2a3512df79b6"><code>cc65897</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/e04c471a8ec448ab62e3768e36b2d1f2731058eb"><code>e04c471</code></a>
Update endpoints model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/2de26a22ba8b2db393adce4828a90d7d9b079959"><code>2de26a2</code></a>
Update API model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/7ad009a5d8d87c090c79d66e06d865795f994798"><code>7ad009a</code></a>
Release 2022-12-13</li>
<li>Additional commits viewable in <a
href="https://github.com/aws/aws-sdk-go-v2/compare/service/account/v1.7.12...service/account/v1.7.13">compare
view</a></li>
</ul>
</details>
<br />

Updates `github.com/aws/aws-sdk-go-v2/config` from 1.32.22 to 1.32.25
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/0016334f314179e3bb1d63ac7a5dbcb2ee7b3ee1"><code>0016334</code></a>
Release 2026-06-10</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/396a18287497ccfa2cff73a10ae0dd946a167352"><code>396a182</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/3eb85338c6dfc5721c5933253b2d66e5f8e96830"><code>3eb8533</code></a>
Update API model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/7bbea79fac21abb6cc7b037466074575e2138f34"><code>7bbea79</code></a>
Release 2026-06-09</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/1fefa6c28b6345014a2da360a6e47fc5bd5b7e72"><code>1fefa6c</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/a2cf49ff138b824c9a5963c0f8f34429c86a199a"><code>a2cf49f</code></a>
Update endpoints model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/d87be6894e8451a757cc33d65bca734f51e256a9"><code>d87be68</code></a>
Update API model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/9a3190f79c9e3f7dce5d602be375c07ecd8973cc"><code>9a3190f</code></a>
Release 2026-06-08</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/b20dd5bb52bbb193b036c3e81525e7a06f3f819b"><code>b20dd5b</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/75a45eaa192d32d7e1247a666f9572a61443b48a"><code>75a45ea</code></a>
Update API model</li>
<li>Additional commits viewable in <a
href="https://github.com/aws/aws-sdk-go-v2/compare/config/v1.32.22...config/v1.32.25">compare
view</a></li>
</ul>
</details>
<br />

Updates `github.com/aws/aws-sdk-go-v2/service/sts` from 1.43.1 to 1.43.3
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/fa369bd7bb9576e85ac094a43a15e8372a3d0129"><code>fa369bd</code></a>
Release 2026-06-03</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/960ee4dc8380a46ded94f3976e073242d42bf8ed"><code>960ee4d</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/4b6df8b301a6c965903012dda08e9f38fd163f1c"><code>4b6df8b</code></a>
Update endpoints model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/30b15dd22cc690c7d647c32f415111437cfbed2a"><code>30b15dd</code></a>
Update API model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/e8c72af3150fa9c8898c916b2e213a5d3d7d64ed"><code>e8c72af</code></a>
enable schema-serde (<a
href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/3421">#3421</a>)</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/b4d02c534cf7f5c782e10bc3f66e40c081a7bb3a"><code>b4d02c5</code></a>
Release 2026-06-02</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/48e375b484e0ae917f61904db440ef17382093d1"><code>48e375b</code></a>
Regenerated Clients</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/b8a4fc132e65d8310e2de67e0600eec53e2f4b26"><code>b8a4fc1</code></a>
Update API model</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/e8627b4cc01977004c41ff0f42670a44d500982d"><code>e8627b4</code></a>
Merge pull request <a
href="https://redirect.github.com/aws/aws-sdk-go-v2/issues/3430">#3430</a>
from aws/fix-remove-ioutil</li>
<li><a
href="https://github.com/aws/aws-sdk-go-v2/commit/4e258a368c5b421d28bae4a18e718b1b4c7dd16a"><code>4e258a3</code></a>
chore: update changelog description per review</li>
<li>Additional commits viewable in <a
href="https://github.com/aws/aws-sdk-go-v2/compare/service/s3/v1.43.1...service/amp/v1.43.3">compare
view</a></li>
</ul>
</details>
<br />

Updates `github.com/coreos/go-oidc/v3` from 3.18.0 to 3.19.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/coreos/go-oidc/releases">github.com/coreos/go-oidc/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.19.0</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: Key refresh should set <code>no-cache</code> to get most up to
date keys by <a
href="https://github.com/Yanni8"><code>@​Yanni8</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/485">coreos/go-oidc#485</a></li>
<li>oidc: add support for validating back-channel logout tokens by <a
href="https://github.com/ericchiang"><code>@​ericchiang</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/486">coreos/go-oidc#486</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Yanni8"><code>@​Yanni8</code></a> made
their first contribution in <a
href="https://redirect.github.com/coreos/go-oidc/pull/485">coreos/go-oidc#485</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/coreos/go-oidc/compare/v3.18.0...v3.19.0">https://github.com/coreos/go-oidc/compare/v3.18.0...v3.19.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/coreos/go-oidc/commit/4204f0b2b0f903070de5f51a459fe5e23faca113"><code>4204f0b</code></a>
oidc: add support for validating back-channel logout tokens</li>
<li><a
href="https://github.com/coreos/go-oidc/commit/f77e01c50994c6ad4f4c3a6ed3e2380bab1f1ff2"><code>f77e01c</code></a>
fix: Key refresh should set no-cache to get most up to date keys</li>
<li>See full diff in <a
href="https://github.com/coreos/go-oidc/compare/v3.18.0...v3.19.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `github.com/moby/moby/api` from 1.54.2 to 1.55.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/moby/moby/releases">github.com/moby/moby/api's
releases</a>.</em></p>
<blockquote>
<h2>api/v1.55.0</h2>
<h2>1.55.0</h2>
<h3>Changelog</h3>
<ul>
<li><code>POST /containers/{id}/update</code> now supports per-device
blkio resource settingss. <a
href="https://redirect.github.com/moby/moby/pull/52651">moby/moby#52651</a></li>
<li>The new <code>GET /images/{name}/attestations</code> endpoint
returns in-toto attestation statements (such as SLSA provenance and SPDX
SBOM) attached to an image, with optional platform selection, predicate
type filtering, and an opt-in <code>statement</code> query parameter for
retrieving the verbatim statement bodies. Tools can now retrieve
attestation metadata and content directly from the daemon instead of
performing additional registry round-trips. <a
href="https://redirect.github.com/moby/moby/pull/52636">moby/moby#52636</a></li>
<li>docs: clarify swarm join required fields. <a
href="https://redirect.github.com/moby/moby/pull/52763">moby/moby#52763</a></li>
</ul>
<h2>api/v1.55.0-rc.1</h2>
<h2>1.55.0-rc.1</h2>
<h3>Changelog</h3>
<ul>
<li><code>POST /containers/{id}/update</code> now supports per-device
blkio resource settingss. <a
href="https://redirect.github.com/moby/moby/pull/52651">moby/moby#52651</a></li>
<li>The new <code>GET /images/{name}/attestations</code> endpoint
returns in-toto attestation statements (such as SLSA provenance and SPDX
SBOM) attached to an image, with optional platform selection, predicate
type filtering, and an opt-in <code>statement</code> query parameter for
retrieving the verbatim statement bodies. Tools can now retrieve
attestation metadata and content directly from the daemon instead of
performing additional registry round-trips. <a
href="https://redirect.github.com/moby/moby/pull/52636">moby/moby#52636</a></li>
<li>docs: clarify swarm join required fields. <a
href="https://redirect.github.com/moby/moby/pull/52763">moby/moby#52763</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/moby/moby/commit/b6c53c270450e3a0fd47c276ce1008f525e76884"><code>b6c53c2</code></a>
Merge pull request <a
href="https://redirect.github.com/moby/moby/issues/52773">#52773</a>
from vvoland/c8d-amd64-variants</li>
<li><a
href="https://github.com/moby/moby/commit/01115e84b3e5e3d10a286e2ca30ea42070222895"><code>01115e8</code></a>
Merge pull request <a
href="https://redirect.github.com/moby/moby/issues/52906">#52906</a>
from vvoland/fix-TestContainerWithConflictingNoneNe...</li>
<li><a
href="https://github.com/moby/moby/commit/b36296ffc0c128aa143e07d4e6f48799b47b447c"><code>b36296f</code></a>
Merge pull request <a
href="https://redirect.github.com/moby/moby/issues/52913">#52913</a>
from thaJeztah/windows_does_stats</li>
<li><a
href="https://github.com/moby/moby/commit/a81aa78cebd0dbdd17ff039f7aa6be48e400906a"><code>a81aa78</code></a>
TestContainerWithConflictingNoneNetwork: Extend Windows timeout</li>
<li><a
href="https://github.com/moby/moby/commit/908a35a91b0ad0d5ad76101f40b6bf27ebf927bc"><code>908a35a</code></a>
Merge pull request <a
href="https://redirect.github.com/moby/moby/issues/52914">#52914</a>
from thaJeztah/no_stderr</li>
<li><a
href="https://github.com/moby/moby/commit/04d33b5de6c9a5f89b999a490f28e0878b9d6b4a"><code>04d33b5</code></a>
Merge pull request <a
href="https://redirect.github.com/moby/moby/issues/52912">#52912</a>
from thaJeztah/cleanup_GenerateRandomAlphaOnlyString</li>
<li><a
href="https://github.com/moby/moby/commit/3b2f5575b2479b82f2bf2086a04bf0d09662eba2"><code>3b2f557</code></a>
Merge pull request <a
href="https://redirect.github.com/moby/moby/issues/52722">#52722</a>
from notandruu/integration/migrate-TestInspectAPIIm...</li>
<li><a
href="https://github.com/moby/moby/commit/62b3aaee3cf6a172d06fab6828b31f4e0fe58934"><code>62b3aae</code></a>
Merge pull request <a
href="https://redirect.github.com/moby/moby/issues/52901">#52901</a>
from vvoland/c8d-imageusage</li>
<li><a
href="https://github.com/moby/moby/commit/11d334268a7ef719ea71b328c4261e7a0a10714b"><code>11d3342</code></a>
integration-cli: un-skip stats tests on Windows</li>
<li><a
href="https://github.com/moby/moby/commit/a47b1b2d6f71b51d63da6b8387be74609045c693"><code>a47b1b2</code></a>
Merge pull request <a
href="https://redirect.github.com/moby/moby/issues/52891">#52891</a>
from smerkviladze/attestations-clearer-blob-missing...</li>
<li>Additional commits viewable in <a
href="https://github.com/moby/moby/compare/api/v1.54.2...api/v1.55.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `github.com/openai/openai-go/v3` from 3.39.0 to 3.41.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/openai/openai-go/releases">github.com/openai/openai-go/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.41.0</h2>
<h2>3.41.0 (2026-06-17)</h2>
<p>Full Changelog: <a
href="https://github.com/openai/openai-%5Bgo/compare/v3.40.0...v3.41.0%5D(https://www.golinks.io/compare/v3.40.0...v3.41.0?trackSource=github)">v3.40.0...v3.41.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> update OpenAPI spec or Stainless config (<a
href="https://github.com/openai/openai-%5Bgo/commit/868891f7fd02f5f92fa86a8b7a0fcd7a8c950bb1%5D(https://www.golinks.io/commit/868891f7fd02f5f92fa86a8b7a0fcd7a8c950bb1?trackSource=github)">868891f</a>)</li>
</ul>
<h2>v3.40.0</h2>
<h2>3.40.0 (2026-06-16)</h2>
<p>Full Changelog: <a
href="https://github.com/openai/openai-go/compare/v3.39.0...v3.40.0">v3.39.0...v3.40.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> admin spend_alerts (<a
href="https://github.com/openai/openai-go/commit/26992e5e1d4553d51cc63dddb0c0817a6940448c">26992e5</a>)</li>
<li><strong>api:</strong> manual updates (<a
href="https://github.com/openai/openai-go/commit/28f7e092c03b7458c69c0dd467fbcfcfb7a31864">28f7e09</a>)</li>
<li><strong>api:</strong> update OpenAPI spec or Stainless config (<a
href="https://github.com/openai/openai-go/commit/57c307e3893744bfc186d23cbb5c0d1f2e9d798a">57c307e</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/openai/openai-go/blob/main/CHANGELOG.md">github.com/openai/openai-go/v3's
changelog</a>.</em></p>
<blockquote>
<h2>3.41.0 (2026-06-17)</h2>
<p>Full Changelog: <a
href="https://github.com/openai/openai-go/compare/v3.40.0...v3.41.0">v3.40.0...v3.41.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> update OpenAPI spec or Stainless config (<a
href="https://github.com/openai/openai-go/commit/868891f7fd02f5f92fa86a8b7a0fcd7a8c950bb1">868891f</a>)</li>
</ul>
<h2>3.40.0 (2026-06-16)</h2>
<p>Full Changelog: <a
href="https://github.com/openai/openai-go/compare/v3.39.0...v3.40.0">v3.39.0...v3.40.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> admin spend_alerts (<a
href="https://github.com/openai/openai-go/commit/26992e5e1d4553d51cc63dddb0c0817a6940448c">26992e5</a>)</li>
<li><strong>api:</strong> manual updates (<a
href="https://github.com/openai/openai-go/commit/28f7e092c03b7458c69c0dd467fbcfcfb7a31864">28f7e09</a>)</li>
<li><strong>api:</strong> update OpenAPI spec or Stainless config (<a
href="https://github.com/openai/openai-go/commit/57c307e3893744bfc186d23cbb5c0d1f2e9d798a">57c307e</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/openai/openai-go/commit/83efaf1d2caf2015327fc7aee97e27c053f4fce8"><code>83efaf1</code></a>
release: 3.41.0</li>
<li><a
href="https://github.com/openai/openai-go/commit/dd78ead7e4a57d8cceb7579d0f09a937a94a8529"><code>dd78ead</code></a>
feat(api): update OpenAPI spec or Stainless config</li>
<li><a
href="https://github.com/openai/openai-go/commit/8b6b6a7b7ac0748c31c6de43088213008b570a03"><code>8b6b6a7</code></a>
release: 3.40.0</li>
<li><a
href="https://github.com/openai/openai-go/commit/12da0a2285f1aab47c5ce50169fb9410b7928169"><code>12da0a2</code></a>
codegen metadata</li>
<li><a
href="https://github.com/openai/openai-go/commit/746dcf5650a7722d89b66f440cd5075915e81e5d"><code>746dcf5</code></a>
feat(api): manual updates</li>
<li><a
href="https://github.com/openai/openai-go/commit/68333d5f042fa4dfed4384184c87c7b5c8c0e90b"><code>68333d5</code></a>
codegen metadata</li>
<li><a
href="https://github.com/openai/openai-go/commit/4b55308f6314ad24846a2bf85c8f07f7b2bc4cfc"><code>4b55308</code></a>
feat(api): admin spend_alerts</li>
<li><a
href="https://github.com/openai/openai-go/commit/0b3841796392b64da3816dcc586983ae6d1cd55f"><code>0b38417</code></a>
feat(api): update OpenAPI spec or Stainless config</li>
<li><a
href="https://github.com/openai/openai-go/commit/9314b6c3bd913e265f75d0a49600b60d6d25d8ae"><code>9314b6c</code></a>
ci: gate publish after release creation (<a
href="https://redirect.github.com/openai/openai-go/issues/684">#684</a>)</li>
<li><a
href="https://github.com/openai/openai-go/commit/9fb1576cd659d080152c8f635ae24c40acdb1ed2"><code>9fb1576</code></a>
ci: remove scheduled release runs (<a
href="https://redirect.github.com/openai/openai-go/issues/682">#682</a>)</li>
<li>See full diff in <a
href="https://github.com/openai/openai-go/compare/v3.39.0...v3.41.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `github.com/prometheus/common` from 0.68.1 to 0.69.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/prometheus/common/releases">github.com/prometheus/common's
releases</a>.</em></p>
<blockquote>
<h2>v0.69.0</h2>
<h2>What's Changed</h2>
<ul>
<li>config: strip credentials on cross-host redirects by <a
href="https://github.com/roidelapluie"><code>@​roidelapluie</code></a>
in <a
href="https://redirect.github.com/prometheus/common/pull/901">prometheus/common#901</a></li>
<li>Modernize Go by <a
href="https://github.com/SuperQ"><code>@​SuperQ</code></a> in <a
href="https://redirect.github.com/prometheus/common/pull/919">prometheus/common#919</a></li>
<li>config: make isCrossHostRedirect sticky across the redirect chain by
<a
href="https://github.com/roidelapluie"><code>@​roidelapluie</code></a>
in <a
href="https://redirect.github.com/prometheus/common/pull/920">prometheus/common#920</a></li>
<li>config: check cross-host redirect before OAuth2 token fetch by <a
href="https://github.com/roidelapluie"><code>@​roidelapluie</code></a>
in <a
href="https://redirect.github.com/prometheus/common/pull/921">prometheus/common#921</a></li>
<li>expfmt: fix nil pointer panic when parsing empty braces
&quot;{}&quot; by <a
href="https://github.com/roidelapluie"><code>@​roidelapluie</code></a>
in <a
href="https://redirect.github.com/prometheus/common/pull/922">prometheus/common#922</a></li>
<li>model: reduce allocations in Time.UnmarshalJSON by <a
href="https://github.com/bboreham"><code>@​bboreham</code></a> in <a
href="https://redirect.github.com/prometheus/common/pull/918">prometheus/common#918</a></li>
<li>config: resolve LoadHTTPConfigFile paths relative to the config file
by <a
href="https://github.com/roidelapluie"><code>@​roidelapluie</code></a>
in <a
href="https://redirect.github.com/prometheus/common/pull/925">prometheus/common#925</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/prometheus/common/compare/v0.68.1...v0.69.0">https://github.com/prometheus/common/compare/v0.68.1...v0.69.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/prometheus/common/blob/main/CHANGELOG.md">github.com/prometheus/common's
changelog</a>.</em></p>
<blockquote>
<h2>v0.69.0 / 2026-06-17</h2>
<h3>Security / behavior changes</h3>
<ul>
<li><strong>config: credentials are no longer forwarded across
cross-host redirects.</strong> When <code>FollowRedirects</code> is
enabled, the HTTP client now strips <code>Authorization</code>,
<code>Cookie</code>, <code>Proxy-Authorization</code> and other
sensitive headers, and skips basic-auth, bearer-token and OAuth2
credentials, when a redirect points to a different host. This aligns
with Go's <code>net/http</code> behavior. Callers that relied on
credentials being sent to a redirect target on another host will need to
target that host directly. <a
href="https://redirect.github.com/prometheus/common/issues/901">#901</a>
<a
href="https://redirect.github.com/prometheus/common/issues/920">#920</a>
<a
href="https://redirect.github.com/prometheus/common/issues/921">#921</a></li>
<li>config: <code>LoadHTTPConfigFile</code> now resolves relative file
paths (e.g. <code>*_file</code> credentials, <code>http_headers</code>
files) against the config file's own directory instead of its parent
directory. Configs that worked around the old behavior by prefixing
paths with the config's directory name must drop that prefix. <a
href="https://redirect.github.com/prometheus/common/issues/925">#925</a></li>
</ul>
<h3>Bugfixes</h3>
<ul>
<li>expfmt: fix nil pointer panic when parsing empty braces
<code>{}</code>. <a
href="https://redirect.github.com/prometheus/common/issues/922">#922</a></li>
<li>model: fix <code>Time.UnmarshalJSON</code> for larger negative
numbers. <a
href="https://redirect.github.com/prometheus/common/issues/918">#918</a></li>
</ul>
<h3>Performance</h3>
<ul>
<li>model: reduce allocations in <code>Time.UnmarshalJSON</code>. <a
href="https://redirect.github.com/prometheus/common/issues/918">#918</a></li>
</ul>
<h3>Internal</h3>
<ul>
<li>Synchronize common files from prometheus/prometheus. <a
href="https://redirect.github.com/prometheus/common/issues/917">#917</a></li>
<li>Modernize Go. <a
href="https://redirect.github.com/prometheus/common/issues/919">#919</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/prometheus/common/compare/v0.68.1...v0.69.0">https://github.com/prometheus/common/compare/v0.68.1...v0.69.0</a></p>
<h2>v0.67.2 / 2025-10-28</h2>
<h2>What's Changed</h2>
<ul>
<li>config: Fix panic in <code>tlsRoundTripper</code> when CA file is
absent by <a href="https://github.com/ndk"><code>@​ndk</code></a> in <a
href="https://redirect.github.com/prometheus/common/pull/792">prometheus/common#792</a></li>
<li>Cleanup linting issues by <a
href="https://github.com/SuperQ"><code>@​SuperQ</code></a> in <a
href="https://redirect.github.com/prometheus/common/pull/860">prometheus/common#860</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/ndk"><code>@​ndk</code></a> made their
first contribution in <a
href="https://redirect.github.com/prometheus/common/pull/792">prometheus/common#792</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/prometheus/common/compare/v0.67.1...v0.67.2">https://github.com/prometheus/common/compare/v0.67.1...v0.67.2</a></p>
<h2>v0.67.1 / 2025-10-07</h2>
<h2>What's Changed</h2>
<ul>
<li>Remove VERSION file to avoid Go conflict error in <a
href="https://redirect.github.com/prometheus/common/pull/853">prometheus/common#853</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/prometheus/common/compare/v0.67.0...v0.67.1">https://github.com/prometheus/common/compare/v0.67.0...v0.67.1</a></p>
<h2>v0.67.0 / 2025-10-07</h2>
<h2>What's Changed</h2>
<ul>
<li>Create CHANGELOG.md for easier communication of library changes,
especially possible breaking changes. by <a
href="https://github.com/ywwg"><code>@​ywwg</code></a> in <a
href="https://redirect.github.com/prometheus/common/pull/833">prometheus/common#833</a></li>
<li>model: New test for validation with dots by <a
href="https://github.com/m1k1o"><code>@​m1k1o</code></a> in <a
href="https://redirect.github.com/prometheus/common/pull/759">prometheus/common#759</a></li>
<li>expfmt: document NewTextParser as required by <a
href="https://github.com/burgerdev"><code>@​burgerdev</code></a> in <a
href="https://redirect.github.com/prometheus/common/pull/842">prometheus/common#842</a></li>
<li>expfmt: Add support for float histograms and gauge histograms by <a
href="https://github.com/beorn7"><code>@​beorn7</code></a> in <a
href="https://redirect.github.com/prometheus/common/pull/843">prometheus/common#843</a></li>
<li>Updated minimum Go version to 1.24.0, updated Go dependecies by <a
href="https://github.com/SuperQ"><code>@​SuperQ</code></a> in <a
href="https://redirect.github.com/prometheus/common/pull/849">prometheus/common#849</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/prometheus/common/commit/e3c14a039d494d866242b36ac253dfecf9c7210b"><code>e3c14a0</code></a>
Merge pull request <a
href="https://redirect.github.com/prometheus/common/issues/925">#925</a>
from roidelapluie/roidelapluie/fix-loadhttpconfigfile...</li>
<li><a
href="https://github.com/prometheus/common/commit/a7b791d0a0cd8e7be164d7f3fdb33450c1868b1c"><code>a7b791d</code></a>
config: resolve LoadHTTPConfigFile paths relative to the config
file</li>
<li><a
href="https://github.com/prometheus/common/commit/f84efec4e4deb31a8afd39c4f4f7ba2b30f39df3"><code>f84efec</code></a>
Merge pull request <a
href="https://redirect.github.com/prometheus/common/issues/918">#918</a>
from prometheus/time-split</li>
<li><a
href="https://github.com/prometheus/common/commit/2269d3d1af9a40c9324bb523087f7704fabe7f1d"><code>2269d3d</code></a>
Merge pull request <a
href="https://redirect.github.com/prometheus/common/issues/922">#922</a>
from roidelapluie/roidelapluie/fix-textparse-empty-br...</li>
<li><a
href="https://github.com/prometheus/common/commit/a1600af967b7eaa77360339b402b447855c24915"><code>a1600af</code></a>
expfmt: fix nil pointer panic when parsing empty braces
&quot;{}&quot;</li>
<li><a
href="https://github.com/prometheus/common/commit/56fe3954537fa60da94055f19172fafa25347948"><code>56fe395</code></a>
Merge pull request <a
href="https://redirect.github.com/prometheus/common/issues/921">#921</a>
from roidelapluie/roidelapluie/oauth2-cross-host-check</li>
<li><a
href="https://github.com/prometheus/common/commit/0fcda471410c91d285776092b7d768d8ac199bc9"><code>0fcda47</code></a>
Merge pull request <a
href="https://redirect.github.com/prometheus/common/issues/920">#920</a>
from roidelapluie/roidelapluie/cross-host-sticky</li>
<li><a
href="https://github.com/prometheus/common/commit/30ba470f4f55107af9dbe7fbe9c95c0617c13f43"><code>30ba470</code></a>
Merge pull request <a
href="https://redirect.github.com/prometheus/common/issues/919">#919</a>
from prometheus/superq/modernize</li>
<li><a
href="https://github.com/prometheus/common/commit/2b55b3e9e7e899f2cbcbcb7afdcb55c2db6a1754"><code>2b55b3e</code></a>
config: check cross-host redirect before OAuth2 token fetch</li>
<li><a
href="https://github.com/prometheus/common/commit/428856f9a5d0d790dacdf03e789c2ef87b03fc40"><code>428856f</code></a>
config: make isCrossHostRedirect sticky across the redirect chain</li>
<li>Additional commits viewable in <a
href="https://github.com/prometheus/common/compare/v0.68.1...v0.69.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `github.com/testcontainers/testcontainers-go` from 0.42.0 to
0.43.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/testcontainers/testcontainers-go/releases">github.com/testcontainers/testcontainers-go's
releases</a>.</em></p>
<blockquote>
<h2>v0.43.0</h2>
<h1>What's Changed</h1>
<h2>⚠️ Breaking Changes</h2>
<ul>
<li>chore(wait)!: change url callback in wait.ForSQL to accept
network.Port (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3650">#3650</a>)
<a href="https://github.com/thaJeztah"><code>@​thaJeztah</code></a></li>
</ul>
<blockquote>
<p>Users of <code>wait.ForSQL</code> need to follow the new API
contract, using Moby's <code>network.Port</code> instead of
<code>string</code> when building the callback function to check the
URL. Please see <a
href="https://golang.testcontainers.org/features/wait/sql/">https://golang.testcontainers.org/features/wait/sql/</a></p>
</blockquote>
<ul>
<li>feat!: add PullImageWithPlatform to DockerProvider (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3710">#3710</a>)
<a
href="https://github.com/blueprismo"><code>@​blueprismo</code></a></li>
</ul>
<blockquote>
<p>Users implementing their own
<code>testcontainers.ImageProvider</code> need to implement the new
<code>PullImageWithPlatform</code> method introduced by this PR.</p>
</blockquote>
<h2>🚀 Features</h2>
<ul>
<li>feat(k3s): pull image opts (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3716">#3716</a>)
<a
href="https://github.com/blueprismo"><code>@​blueprismo</code></a></li>
<li>feat(wait): implement AnyMultiStrategy: ForAny equivalent to ForAll.
(<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3719">#3719</a>)
<a href="https://github.com/jeanbza"><code>@​jeanbza</code></a></li>
<li>feat(eventhubs): add WithAzuriteContainer and functional-options
config builder (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3722">#3722</a>)
<a
href="https://github.com/mdelapenya"><code>@​mdelapenya</code></a></li>
<li>feat!: add PullImageWithPlatform to DockerProvider (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3710">#3710</a>)
<a
href="https://github.com/blueprismo"><code>@​blueprismo</code></a></li>
<li>feat(modules/dex): add Dex OIDC provider module (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3659">#3659</a>)
<a href="https://github.com/guilycst"><code>@​guilycst</code></a></li>
</ul>
<h2>🐛 Bug Fixes</h2>
<ul>
<li>fix(security): remove debug code that leaks Docker credentials (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3721">#3721</a>)
<a
href="https://github.com/mdelapenya"><code>@​mdelapenya</code></a></li>
<li>fix(ollama): align local exec test with Ollama 0.30.6 log format (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3715">#3715</a>)
<a
href="https://github.com/mdelapenya"><code>@​mdelapenya</code></a></li>
<li>fix: close temp file handle before removal (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3672">#3672</a>)
<a href="https://github.com/acouvreur"><code>@​acouvreur</code></a></li>
<li>fix(compose): close docker clients to prevent goroutine leaks (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3661">#3661</a>)
<a
href="https://github.com/mdelapenya"><code>@​mdelapenya</code></a></li>
<li>fix: wait for log production goroutine to drain on stop (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3660">#3660</a>)
<a
href="https://github.com/mdelapenya"><code>@​mdelapenya</code></a></li>
</ul>
<h2>📖 Documentation</h2>
<ul>
<li>chore: update usage metrics (2026-06) (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3714">#3714</a>)
@<a
href="https://github.com/apps/github-actions">github-actions[bot]</a></li>
</ul>
<h2>🧹 Housekeeping</h2>
<ul>
<li>chore(wait)!: change url callback in wait.ForSQL to accept
network.Port (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3650">#3650</a>)
<a href="https://github.com/thaJeztah"><code>@​thaJeztah</code></a></li>
<li>chore: update usage metrics (2026-05) (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3670">#3670</a>)
@<a
href="https://github.com/apps/github-actions">github-actions[bot]</a></li>
<li>chore: remove cgroupnsMode setting from K3s container configuration
(<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3653">#3653</a>)
<a href="https://github.com/lixin9311"><code>@​lixin9311</code></a></li>
</ul>
<h2>📦 Dependency updates</h2>
<ul>
<li>chore(deps): update dependencies to latest versions in go.mod and
go.sum (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3729">#3729</a>)
<a
href="https://github.com/Steven-Harris"><code>@​Steven-Harris</code></a></li>
<li>chore: bump sshd-docker image to 1.4.0 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3727">#3727</a>)
<a
href="https://github.com/mdelapenya"><code>@​mdelapenya</code></a></li>
<li>chore(deps): bump Ryuk to v0.14.0 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3313">#3313</a>)
<a
href="https://github.com/mdelapenya"><code>@​mdelapenya</code></a></li>
<li>chore(deps): bump github.com/shirou/gopsutil/v4 from 4.26.4 to
4.26.5 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3713">#3713</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump golang.org/x/sys from 0.44.0 to 0.45.0 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3712">#3712</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump mkdocs-include-markdown-plugin from 7.2.2 to 7.3.0
(<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3711">#3711</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump slackapi/slack-github-action from 2.1.1 to 3.0.3
(<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3677">#3677</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump idna from 3.11 to 3.15 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3708">#3708</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump github.com/containerd/containerd/v2 from 2.2.2 to
2.2.4 in /modules/compose (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3709">#3709</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump urllib3 from 2.6.3 to 2.7.0 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3704">#3704</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/0835739aaf45d6cb7eb295f0c820e6f9e92102df"><code>0835739</code></a>
chore: use new version (v0.43.0) in modules and examples</li>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/85b6d7075d69260feb15b9d3b5bdab14d4698546"><code>85b6d70</code></a>
chore(deps): update dependencies to latest versions in go.mod and go.sum
(<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3729">#3729</a>)</li>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/8360f719408c23a4f3b731be25a94b267b624a28"><code>8360f71</code></a>
feat(k3s): pull image opts (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3716">#3716</a>)</li>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/b5e70223aa57f409f7721a89d66abf5b2a453468"><code>b5e7022</code></a>
chore: bump sshd-docker image to 1.4.0 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3727">#3727</a>)</li>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/1c05dd58a894fd52b48ab272ef6cb6aceaa57dd2"><code>1c05dd5</code></a>
chore(deps): bump Ryuk to v0.14.0 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3313">#3313</a>)</li>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/96ab0957556c744987ad7e97f59c78c469604e10"><code>96ab095</code></a>
feat(wait): implement AnyMultiStrategy: ForAny equivalent to ForAll. (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3719">#3719</a>)</li>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/42ac7d2e9a30de22f91da9e45d6084628ae2acb2"><code>42ac7d2</code></a>
chore(wait)!: change url callback in wait.ForSQL to accept network.Port
(<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3650">#3650</a>)</li>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/ab312e0088c3d615d64a4c6159805b9ab6db356d"><code>ab312e0</code></a>
chore(deps): bump github.com/shirou/gopsutil/v4 from 4.26.4 to 4.26.5
(<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3713">#3713</a>)</li>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/c5c95e5f9bbc01ef374cb76f8c63c09d9add93e4"><code>c5c95e5</code></a>
chore(deps): bump golang.org/x/sys from 0.44.0 to 0.45.0 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3712">#3712</a>)</li>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/465d00250e529349f6975e88eb30d9338c6ae991"><code>465d002</code></a>
chore(deps): bump mkdocs-include-markdown-plugin from 7.2.2 to 7.3.0 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3711">#3711</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/testcontainers/testcontainers-go/compare/v0.42.0...v0.43.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `golang.org/x/sync` from 0.20.0 to 0.21.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/sync/commit/5071ed6a9f1617117556b66384f765c934de3698"><code>5071ed6</code></a>
all: fix some comments to improve readability</li>
<li>See full diff in <a
href="https://github.com/golang/sync/compare/v0.20.0...v0.21.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `golang.org/x/tools` from 0.45.0 to 0.46.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/tools/commit/3d6f8dfd4853c8b323940b931f1170c6d0df8d23"><code>3d6f8df</code></a>
go/packages: propagate PATH in
TestConfigEnvDoesNotInheritProcessEnv</li>
<li><a
href="https://github.com/golang/tools/commit/47abf61fcbb4abdcf37a986ce23e20dc140fd018"><code>47abf61</code></a>
gopls: move internal/tool into gopls/internal/tool</li>
<li><a
href="https://github.com/golang/tools/commit/19cebc548e6c35b3bf20bd09490e7db258183507"><code>19cebc5</code></a>
go/packages/gopackages: use standard flag package instead of
internal/tool</li>
<li><a
href="https://github.com/golang/tools/commit/e965c10097987837d9805f8069f4a8278de7180f"><code>e965c10</code></a>
gopls/internal/test/marker: update hover test</li>
<li><a
href="https://github.com/golang/tools/commit/96efd3d65c18f9f8d66bc94ec5d709db0b7e72f0"><code>96efd3d</code></a>
gopls/internal/golang/stubmethods: support generic interfaces</li>
<li><a
href="https://github.com/golang/tools/commit/83be7b7739a3e73db55876c5d396c8d891f61a51"><code>83be7b7</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="https://github.com/golang/tools/commit/bf05c11f9ba6f0ed70931bf0a302e9099897d726"><code>bf05c11</code></a>
internal/typesinternal: ForEachElement: test generic methods</li>
<li><a
href="https://github.com/golang/tools/commit/99df0abf1ba525779b731d2f9ef358c1b8a1b633"><code>99df0ab</code></a>
go/callgraph/static: support generic methods</li>
<li><a
href="https://github.com/golang/tools/commit/6942095782f864dadecfb2839bf2371d676bfb48"><code>6942095</code></a>
go/ssa: fix instantiation of generic methods on non-generic
receivers</li>
<li><a
href="https://github.com/golang/tools/commit/070e85daf671b972397e181b13cd7a0be55fa6b0"><code>070e85d</code></a>
go/callgraph/rta: skip generic methods in fingerprinting</li>
<li>Additional commits viewable in <a
href="https://github.com/golang/tools/compare/v0.45.0...v0.46.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `google.golang.org/api` from 0.283.0 to 0.286.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's
releases</a>.</em></p>
<blockquote>
<h2>v0.286.0</h2>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.285.0...v0.286.0">0.286.0</a>
(2026-06-22)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3629">#3629</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/f25a08b7bd916e0719cc9e0d003454a8aaa8caf9">f25a08b</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3631">#3631</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/b3bb97ff046401ce738b4e6830642b2e6c712536">b3bb97f</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3632">#3632</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/7332dd74f142bba59a27778f115eac98cc254bfb">7332dd7</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3634">#3634</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/36081a00df42df1ca3e3228067737839aa905c9e">36081a0</a>)</li>
</ul>
<h2>v0.285.0</h2>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.284.0...v0.285.0">0.285.0</a>
(2026-06-16)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3618">#3618</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/5c008a7963c278aff6be6c839cbf20bd0b8ae231">5c008a7</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3620">#3620</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/21a12ed9dc47cb8d9b9aa4e1f5759ac2044063a5">21a12ed</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3622">#3622</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/17394ca1afffb6d740e134a0bc148d79106c4c80">17394ca</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3623">#3623</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/087611c9a9b2c0e68f429641a012a43396afb4ce">087611c</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3624">#3624</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/72b67889b20325f1a09222d62b3184a68ad30ee2">72b6788</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3626">#3626</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/4f1d165677d35c4caecd7faf93eec27cb2fd25cd">4f1d165</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3628">#3628</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/894cccb170d1ea81f8bf49ddd072a3ef52df3d25">894cccb</a>)</li>
</ul>
<h2>v0.284.0</h2>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.283.0...v0.284.0">0.284.0</a>
(2026-06-09)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3613">#3613</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/5f021536107adde3063487a75aa9f46078490191">5f02153</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3616">#3616</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/25b429a5431a77dd95eb00466661c1447eab6d16">25b429a</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3617">#3617</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/1ef362535b2f2f3afbc1408adbf6d3b69e58ad26">1ef3625</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.285.0...v0.286.0">0.286.0</a>
(2026-06-22)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3629">#3629</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/f25a08b7bd916e0719cc9e0d003454a8aaa8caf9">f25a08b</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3631">#3631</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/b3bb97ff046401ce738b4e6830642b2e6c712536">b3bb97f</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3632">#3632</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/7332dd74f142bba59a27778f115eac98cc254bfb">7332dd7</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3634">#3634</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/36081a00df42df1ca3e3228067737839aa905c9e">36081a0</a>)</li>
</ul>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.284.0...v0.285.0">0.285.0</a>
(2026-06-16)</h2>
<h3>Features</h3>
<ul>
<…
@dependabot @DanielChrn
chore(deps): bump the github-actions group across 1 directory with 6 …
50af069 
…updates (envoyproxy#2342)

Bumps the github-actions group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `6.0.2` |
`7.0.0` |
| [actions/setup-go](https://github.com/actions/setup-go) | `6.4.0` |
`6.5.0` |
| [actions/cache](https://github.com/actions/cache) | `5.0.5` | `6.1.0`
|
| [github/codeql-action/init](https://github.com/github/codeql-action) |
`4.36.0` | `4.36.2` |
|
[github/codeql-action/autobuild](https://github.com/github/codeql-action)
| `4.36.0` | `4.36.2` |
|
[github/codeql-action/analyze](https://github.com/github/codeql-action)
| `4.36.0` | `4.36.2` |

Updates `actions/checkout` from 6.0.2 to 7.0.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/releases">actions/checkout's
releases</a>.</em></p>
<blockquote>
<h2>v7.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>block checking out fork pr for pull_request_target and workflow_run
by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
<li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the
minor-actions-dependencies group across 1 directory by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li>
<li>Bump flatted from 3.3.1 to 3.4.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li>
<li>Bump js-yaml from 4.1.0 to 4.2.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li>
<li>Bump <code>@​actions/core</code> and
<code>@​actions/tool-cache</code> and Remove uuid by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li>
<li>upgrade module to esm and update dependencies by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li>
<li>Bump the minor-npm-dependencies group across 1 directory with 3
updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li>
<li>getting ready for checkout v7 release by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2464">actions/checkout#2464</a></li>
<li>update error wording by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2467">actions/checkout#2467</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v6.0.3...v7.0.0">https://github.com/actions/checkout/compare/v6.0.3...v7.0.0</a></p>
<h2>v6.0.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Update changelog by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
<li>Fix checkout init for SHA-256 repositories by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li>
<li>Update changelog for v6.0.3 by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/yaananth"><code>@​yaananth</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>v7.0.0</h2>
<ul>
<li>Block checking out fork PR for pull_request_target and workflow_run
by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
<li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the
minor-actions-dependencies group across 1 directory by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li>
<li>Bump flatted from 3.3.1 to 3.4.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li>
<li>Bump js-yaml from 4.1.0 to 4.2.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li>
<li>Bump <code>@​actions/core</code> and
<code>@​actions/tool-cache</code> and Remove uuid by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li>
<li>upgrade module to esm and update dependencies by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li>
<li>Bump the minor-npm-dependencies group across 1 directory with 3
updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li>
</ul>
<h2>v6.0.3</h2>
<ul>
<li>Fix checkout init for SHA-256 repositories by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
</ul>
<h2>v6.0.2</h2>
<ul>
<li>Fix tag handling: preserve annotations and explicit fetch-tags by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li>
</ul>
<h2>v6.0.1</h2>
<ul>
<li>Add worktree support for persist-credentials includeIf by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li>
</ul>
<h2>v6.0.0</h2>
<ul>
<li>Persist creds to a separate file by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li>
<li>Update README to include Node.js 24 support details and requirements
by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li>
</ul>
<h2>v5.0.1</h2>
<ul>
<li>Port v6 cleanup to v5 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li>
</ul>
<h2>v5.0.0</h2>
<ul>
<li>Update actions checkout to use node 24 by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
</ul>
<h2>v4.3.1</h2>
<ul>
<li>Port v6 cleanup to v4 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li>
</ul>
<h2>v4.3.0</h2>
<ul>
<li>docs: update README.md by <a
href="https://github.com/motss"><code>@​motss</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
<li>Add internal repos for checking out multiple repositories by <a
href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
<li>Documentation update - add recommended permissions to Readme by <a
href="https://github.com/benwells"><code>@​benwells</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
<li>Adjust positioning of user email note and permissions heading by <a
href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li>
<li>Update README.md by <a
href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
<li>Update CODEOWNERS for actions by <a
href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li>
<li>Update package dependencies by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
</ul>
<h2>v4.2.2</h2>
<ul>
<li><code>url-helper.ts</code> now leverages well-known environment
variables by <a href="https://github.com/jww3"><code>@​jww3</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li>
<li>Expand unit test coverage for <code>isGhes</code> by <a
href="https://github.com/jww3"><code>@​jww3</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li>
</ul>
<h2>v4.2.1</h2>
<ul>
<li>Check out other refs/* by commit if provided, fall back to ref by <a
href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/checkout/commit/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"><code>9c091bb</code></a>
update error wording (<a
href="https://redirect.github.com/actions/checkout/issues/2467">#2467</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/1044a6dea927916f2c38ba5aeffbc0a847b1221a"><code>1044a6d</code></a>
getting ready for checkout v7 release (<a
href="https://redirect.github.com/actions/checkout/issues/2464">#2464</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/f0282184c7ce73ab54c7e4ab5a617122602e575f"><code>f028218</code></a>
Bump the minor-npm-dependencies group across 1 directory with 3 updates
(<a
href="https://redirect.github.com/actions/checkout/issues/2462">#2462</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/d914b262ffc244530a203ab40decab34c3abf34d"><code>d914b26</code></a>
upgrade module to esm and update dependencies (<a
href="https://redirect.github.com/actions/checkout/issues/2463">#2463</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/537c7ef99cef6e5ddb5e7ff5d16d14510503801d"><code>537c7ef</code></a>
Bump <code>@​actions/core</code> and <code>@​actions/tool-cache</code>
and Remove uuid (<a
href="https://redirect.github.com/actions/checkout/issues/2459">#2459</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/130a169078a413d3a5246a393625e8e742f387f6"><code>130a169</code></a>
Bump js-yaml from 4.1.0 to 4.2.0 (<a
href="https://redirect.github.com/actions/checkout/issues/2461">#2461</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/7d09575332117a40b46e5e020664df234cd416f3"><code>7d09575</code></a>
Bump flatted from 3.3.1 to 3.4.2 (<a
href="https://redirect.github.com/actions/checkout/issues/2460">#2460</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/0f9f3aa320cb53abeb534aeb54048075d9697a0e"><code>0f9f3aa</code></a>
Bump actions/publish-immutable-action (<a
href="https://redirect.github.com/actions/checkout/issues/2458">#2458</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/f9e715a95fcd1f9253f77dd28f11e88d2d6460c7"><code>f9e715a</code></a>
block checking out fork pr for pull_request_target and workflow_run (<a
href="https://redirect.github.com/actions/checkout/issues/2454">#2454</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/df4cb1c069e1874edd31b4311f1884172cec0e10"><code>df4cb1c</code></a>
Update changelog for v6.0.3 (<a
href="https://redirect.github.com/actions/checkout/issues/2446">#2446</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/setup-go` from 6.4.0 to 6.5.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/setup-go/releases">actions/setup-go's
releases</a>.</em></p>
<blockquote>
<h2>v6.5.0</h2>
<h2>What's Changed</h2>
<h3>Dependency update</h3>
<ul>
<li>Upgrade actions dependencies by <a
href="https://github.com/priyagupta108"><code>@​priyagupta108</code></a>
with <a href="https://github.com/Copilot"><code>@​Copilot</code></a> in
<a
href="https://redirect.github.com/actions/setup-go/pull/744">actions/setup-go#744</a></li>
<li>Upgrade <code>@​types/node</code> and typescript-eslint dependencies
to resolve npm audit findings by <a
href="https://github.com/HarithaVattikuti"><code>@​HarithaVattikuti</code></a>
in <a
href="https://redirect.github.com/actions/setup-go/pull/755">actions/setup-go#755</a></li>
<li>Upgrade <code>@​actions/cache</code> to 5.1.0, log cache write
denied by <a
href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a
href="https://redirect.github.com/actions/setup-go/pull/758">actions/setup-go#758</a></li>
<li>Upgrade version to 6.5.0 in package.json and package-lock.json by <a
href="https://github.com/HarithaVattikuti"><code>@​HarithaVattikuti</code></a>
in <a
href="https://redirect.github.com/actions/setup-go/pull/762">actions/setup-go#762</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/priyagupta108"><code>@​priyagupta108</code></a>
with <a href="https://github.com/Copilot"><code>@​Copilot</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/setup-go/pull/744">actions/setup-go#744</a></li>
<li><a href="https://github.com/jasongin"><code>@​jasongin</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/setup-go/pull/758">actions/setup-go#758</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-go/compare/v6...v6.5.0">https://github.com/actions/setup-go/compare/v6...v6.5.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/setup-go/commit/924ae3a1cded613372ab5595356fb5720e22ba16"><code>924ae3a</code></a>
chore: bump version to 6.5.0 in package.json and package-lock.json (<a
href="https://redirect.github.com/actions/setup-go/issues/762">#762</a>)</li>
<li><a
href="https://github.com/actions/setup-go/commit/e91cc3bfe0c3efd0b2d1dc3a51269c9038deb4f1"><code>e91cc3b</code></a>
Bump <code>@​actions/cache</code> to 5.1.0, log cache write denied (<a
href="https://redirect.github.com/actions/setup-go/issues/758">#758</a>)</li>
<li><a
href="https://github.com/actions/setup-go/commit/4a2405e6aebff6aabd8e43618539aa35cf90ac92"><code>4a2405e</code></a>
chore: update <code>@​types/node</code> and <a
href="https://github.com/typescript-eslint"><code>@​typescript-eslint</code></a>
dependencies to latest versi...</li>
<li><a
href="https://github.com/actions/setup-go/commit/78961f6f84d799cd858575bb931c3e51d3b13290"><code>78961f6</code></a>
chore: update <a
href="https://github.com/actions"><code>@​actions</code></a>
dependencies and refresh license cache (<a
href="https://redirect.github.com/actions/setup-go/issues/744">#744</a>)</li>
<li>See full diff in <a
href="https://github.com/actions/setup-go/compare/4a3601121dd01d1626a1e23e37211e3254c1c06c...924ae3a1cded613372ab5595356fb5720e22ba16">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/cache` from 5.0.5 to 6.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/cache/releases">actions/cache's
releases</a>.</em></p>
<blockquote>
<h2>v6.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump <code>@​actions/cache</code> to v6.1.0 - handle read-only cache
access by <a
href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1768">actions/cache#1768</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v6...v6.1.0">https://github.com/actions/cache/compare/v6...v6.1.0</a></p>
<h2>v6.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update packages, migrate to ESM by <a
href="https://github.com/Samirat"><code>@​Samirat</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1760">actions/cache#1760</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v6.0.0">https://github.com/actions/cache/compare/v5...v6.0.0</a></p>
<h2>v5.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump <code>@​actions/cache</code> to v5.1.0 - handle read-only cache
access by <a
href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1775">actions/cache#1775</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v5.1.0">https://github.com/actions/cache/compare/v5...v5.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/cache/blob/main/RELEASES.md">actions/cache's
changelog</a>.</em></p>
<blockquote>
<h1>Releases</h1>
<h2>How to prepare a release</h2>
<blockquote>
<p>[!NOTE]
Relevant for maintainers with write access only.</p>
</blockquote>
<ol>
<li>Switch to a new branch from <code>main</code>.</li>
<li>Run <code>npm test</code> to ensure all tests are passing.</li>
<li>Update the version in <a
href="https://github.com/actions/cache/blob/main/package.json"><code>https://github.com/actions/cache/blob/main/package.json</code></a>.</li>
<li>Run <code>npm run build</code> to update the compiled files.</li>
<li>Update this <a
href="https://github.com/actions/cache/blob/main/RELEASES.md"><code>https://github.com/actions/cache/blob/main/RELEASES.md</code></a>
with the new version and changes in the <code>## Changelog</code>
section.</li>
<li>Run <code>licensed cache</code> to update the license report.</li>
<li>Run <code>licensed status</code> and resolve any warnings by
updating the <a
href="https://github.com/actions/cache/blob/main/.licensed.yml"><code>https://github.com/actions/cache/blob/main/.licensed.yml</code></a>
file with the exceptions.</li>
<li>Commit your changes and push your branch upstream.</li>
<li>Open a pull request against <code>main</code> and get it reviewed
and merged.</li>
<li>Draft a new release <a
href="https://github.com/actions/cache/releases">https://github.com/actions/cache/releases</a>
use the same version number used in <code>package.json</code>
<ol>
<li>Create a new tag with the version number.</li>
<li>Auto generate release notes and update them to match the changes you
made in <code>RELEASES.md</code>.</li>
<li>Toggle the set as the latest release option.</li>
<li>Publish the release.</li>
</ol>
</li>
<li>Navigate to <a
href="https://github.com/actions/cache/actions/workflows/release-new-action-version.yml">https://github.com/actions/cache/actions/workflows/release-new-action-version.yml</a>
<ol>
<li>There should be a workflow run queued with the same version
number.</li>
<li>Approve the run to publish the new version and update the major tags
for this action.</li>
</ol>
</li>
</ol>
<h2>Changelog</h2>
<h3>6.1.0</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v6.1.0 to pick up <a
href="https://redirect.github.com/actions/toolkit/pull/2435">actions/toolkit#2435
Handle cache write error due to read-only token</a></li>
<li>Switch redundant &quot;Cache save failed&quot; warning to debug log
in save-only</li>
</ul>
<h3>6.0.0</h3>
<ul>
<li>Updated <code>@actions/cache</code> to ^6.0.1,
<code>@actions/core</code> to ^3.0.1, <code>@actions/exec</code> to
^3.0.0, <code>@actions/io</code> to ^3.0.2</li>
<li>Migrated to ESM module system</li>
<li>Upgraded Jest to v30 and test infrastructure to be ESM
compatible</li>
</ul>
<h3>5.0.4</h3>
<ul>
<li>Bump <code>minimatch</code> to v3.1.5 (fixes ReDoS via globstar
patterns)</li>
<li>Bump <code>undici</code> to v6.24.1 (WebSocket decompression bomb
protection, header validation fixes)</li>
<li>Bump <code>fast-xml-parser</code> to v5.5.6</li>
</ul>
<h3>5.0.3</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a
href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li>
<li>Bump <code>@actions/core</code> to v2.0.3</li>
</ul>
<h3>5.0.2</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/cache/commit/55cc8345863c7cc4c66a329aec7e433d2d1c52a9"><code>55cc834</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/cache/issues/1768">#1768</a>
from jasongin/readonly-cache</li>
<li><a
href="https://github.com/actions/cache/commit/d8cd72f230726cdf4457ebb61ec1b593a8d12337"><code>d8cd72f</code></a>
Bump <code>@​actions/cache</code> to v6.1.0 - handle cache write error
due to RO token</li>
<li><a
href="https://github.com/actions/cache/commit/2c8a9bd7457de244a408f35966fab2fb45fda9c8"><code>2c8a9bd</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/cache/issues/1760">#1760</a>
from actions/samirat/esm_migration_and_package_update</li>
<li><a
href="https://github.com/actions/cache/commit/e9b91fdc3fea7d79165fceb79042ef45c2d51023"><code>e9b91fd</code></a>
Prettier fixes</li>
<li><a
href="https://github.com/actions/cache/commit/e4884b8ff7f92ef6b52c79eda480bbc86e685adb"><code>e4884b8</code></a>
Rebuild dist</li>
<li><a
href="https://github.com/actions/cache/commit/10baf0191a3c426ea0fa4a3253a5c04233b6e18f"><code>10baf01</code></a>
Fixed licenses</li>
<li><a
href="https://github.com/actions/cache/commit/e39b386c9004d72a15d864ade8c0b3a702d47a37"><code>e39b386</code></a>
Fix test mock return order</li>
<li><a
href="https://github.com/actions/cache/commit/b6928203372a8571ff984c0c883ef3a1adfb0c06"><code>b692820</code></a>
PR feedback</li>
<li><a
href="https://github.com/actions/cache/commit/60749128a44d25d3c520a489e576380cf00ff3f1"><code>6074912</code></a>
Rebuild dist bundles as ESM to match type:module</li>
<li><a
href="https://github.com/actions/cache/commit/5a912e8b4af820fa082a0e75cfd2c782f8fbfe0e"><code>5a912e8</code></a>
Fix lint and jest issues</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action/init` from 4.36.0 to 4.36.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/init's
releases</a>.</em></p>
<blockquote>
<h2>v4.36.2</h2>
<ul>
<li>Cache CodeQL CLI version information across Actions steps. <a
href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li>
<li>Reduce requests while waiting for analysis processing by using
exponential backoff when polling SARIF processing status. <a
href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li>
</ul>
<h2>v4.36.1</h2>
<p>No user facing changes.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/init's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.37.0 - 08 Jul 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li>
<li>In addition to the existing input format, the
<code>config-file</code> input for the <code>codeql-action/init</code>
step will soon support a new <code>[owner/]repo[@ref][:path]</code>
format. All components except the repository name are optional. If
omitted, <code>owner</code> defaults to the same owner as the repository
the analysis is running for, <code>ref</code> to <code>main</code>, and
<code>path</code> to <code>.github/codeql-action.yaml</code>. Support
for this format ships in this version of the CodeQL Action, but will
only be enabled over the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li>
</ul>
<h2>4.36.3 - 01 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.36.2 - 04 Jun 2026</h2>
<ul>
<li>Cache CodeQL CLI version information across Actions steps. <a
href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li>
<li>Reduce requests while waiting for analysis processing by using
exponential backoff when polling SARIF processing status. <a
href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li>
</ul>
<h2>4.36.1 - 02 Jun 2026</h2>
<p>No user facing changes.</p>
<h2>4.36.0 - 22 May 2026</h2>
<ul>
<li><em>Breaking change</em>: Bump the minimum required CodeQL bundle
version to 2.19.4. <a
href="https://redirect.github.com/github/codeql-action/pull/3894">#3894</a></li>
<li>Add support for SHA-256 Git object IDs. <a
href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5">2.25.5</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3926">#3926</a></li>
</ul>
<h2>4.35.5 - 15 May 2026</h2>
<ul>
<li>We have improved how the JavaScript bundles for the CodeQL Action
are generated to avoid duplication across bundles and reduce the size of
the repository by around 70%. This should have no effect on the runtime
behaviour of the CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3899">#3899</a></li>
<li>For performance and accuracy reasons, <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> will now only be enabled on a pull request when
diff-informed analysis is also enabled for that run. If diff-informed
analysis is unavailable (for example, because the PR diff ranges could
not be computed), the action will fall back to a full analysis. <a
href="https://redirect.github.com/github/codeql-action/pull/3791">#3791</a></li>
<li>If multiple inputs are provided for the GitHub-internal
<code>analysis-kinds</code> input, only <code>code-scanning</code> will
be enabled. The <code>analysis-kinds</code> input is experimental, for
GitHub-internal use only, and may change without notice at any time. <a
href="https://redirect.github.com/github/codeql-action/pull/3892">#3892</a></li>
<li>Added an experimental change which, when running a Code Scanning
analysis for a PR with <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> enabled, prefers CodeQL CLI versions that have
a cached overlay-base database for the configured languages. This speeds
up analysis for a repository when there is not yet a cached overlay-base
database for the latest CLI version. We expect to roll this change out
to everyone in May. <a
href="https://redirect.github.com/github/codeql-action/pull/3880">#3880</a></li>
</ul>
<h2>4.35.4 - 07 May 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4">2.25.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3881">#3881</a></li>
</ul>
<h2>4.35.3 - 01 May 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.19.3 and earlier. These versions of
CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise
Server 3.15, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3837">#3837</a></li>
<li>Configurations for private registries that use Cloudsmith or GCP
OIDC are now accepted. <a
href="https://redirect.github.com/github/codeql-action/pull/3850">#3850</a></li>
<li>Best-effort connection tests for private registries now use
<code>GET</code> requests instead of <code>HEAD</code> for better
compatibility with various registry implementations. For NuGet feeds,
the test is now always performed against the service index. <a
href="https://redirect.github.com/github/codeql-action/pull/3853">#3853</a></li>
<li>Fixed a bug where two diagnostics produced within the same
millisecond could overwrite each other on disk, causing one of them to
be lost. <a
href="https://redirect.github.com/github/codeql-action/pull/3852">#3852</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/8aad20d150bbac5944a9f9d289da16a4b0d87c1e"><code>8aad20d</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3949">#3949</a>
from github/update-v4.36.2-dcb947ce1</li>
<li><a
href="https://github.com/github/codeql-action/commit/f521b08cd8f468ab193ea950a589cb2e9c869c6a"><code>f521b08</code></a>
Add additional changelog notes</li>
<li><a
href="https://github.com/github/codeql-action/commit/8aeff0ffb7b78582ee0d0e6eebb8140684400d08"><code>8aeff0f</code></a>
Update changelog for v4.36.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/dcb947ce15976d40ea82935510b2db4872ec124c"><code>dcb947c</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3948">#3948</a>
from github/update-bundle/codeql-bundle-v2.25.6</li>
<li><a
href="https://github.com/github/codeql-action/commit/c251bcefa178f7780f62f150002acffe3d07fde9"><code>c251bce</code></a>
Add changelog note</li>
<li><a
href="https://github.com/github/codeql-action/commit/62953c18b35f59e28351d2f1e806925aef8b1e3c"><code>62953c1</code></a>
Update default bundle to codeql-bundle-v2.25.6</li>
<li><a
href="https://github.com/github/codeql-action/commit/423b570baf1976cd7a3daeba5d6e9f9b76432f37"><code>423b570</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3946">#3946</a>
from github/dependabot/npm_and_yarn/npm-minor-5d507a...</li>
<li><a
href="https://github.com/github/codeql-action/commit/c35d1b164463ee62a100735382aaaa525c5d3496"><code>c35d1b1</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3947">#3947</a>
from github/dependabot/github_actions/dot-github/wor...</li>
<li><a
href="https://github.com/github/codeql-action/commit/cb1a588b02755b176e7b9d033ed4b69312f0e1bd"><code>cb1a588</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3937">#3937</a>
from github/robertbrignull/waitForProcessing_backoff</li>
<li><a
href="https://github.com/github/codeql-action/commit/ba47406412c54532b5b4fcfbaf877c9e2382b206"><code>ba47406</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3943">#3943</a>
from github/henrymercer/cache-cli-version-info</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/7211b7c8077ea37d8641b6271f6a365a22a5fbfa...8aad20d150bbac5944a9f9d289da16a4b0d87c1e">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action/autobuild` from 4.36.0 to 4.36.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/autobuild's
releases</a>.</em></p>
<blockquote>
<h2>v4.36.2</h2>
<ul>
<li>Cache CodeQL CLI version information across Actions steps. <a
href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li>
<li>Reduce requests while waiting for analysis processing by using
exponential backoff when polling SARIF processing status. <a
href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li>
</ul>
<h2>v4.36.1</h2>
<p>No user facing changes.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/autobuild's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.37.0 - 08 Jul 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li>
<li>In addition to the existing input format, the
<code>config-file</code> input for the <code>codeql-action/init</code>
step will soon support a new <code>[owner/]repo[@ref][:path]</code>
format. All components except the repository name are optional. If
omitted, <code>owner</code> defaults to the same owner as the repository
the analysis is running for, <code>ref</code> to <code>main</code>, and
<code>path</code> to <code>.github/codeql-action.yaml</code>. Support
for this format ships in this version of the CodeQL Action, but will
only be enabled over the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li>
</ul>
<h2>4.36.3 - 01 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.36.2 - 04 Jun 2026</h2>
<ul>
<li>Cache CodeQL CLI version information across Actions steps. <a
href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li>
<li>Reduce requests while waiting for analysis processing by using
exponential backoff when polling SARIF processing status. <a
href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li>
</ul>
<h2>4.36.1 - 02 Jun 2026</h2>
<p>No user facing changes.</p>
<h2>4.36.0 - 22 May 2026</h2>
<ul>
<li><em>Breaking change</em>: Bump the minimum required CodeQL bundle
version to 2.19.4. <a
href="https://redirect.github.com/github/codeql-action/pull/3894">#3894</a></li>
<li>Add support for SHA-256 Git object IDs. <a
href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5">2.25.5</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3926">#3926</a></li>
</ul>
<h2>4.35.5 - 15 May 2026</h2>
<ul>
<li>We have improved how the JavaScript bundles for the CodeQL Action
are generated to avoid duplication across bundles and reduce the size of
the repository by around 70%. This should have no effect on the runtime
behaviour of the CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3899">#3899</a></li>
<li>For performance and accuracy reasons, <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> will now only be enabled on a pull request when
diff-informed analysis is also enabled for that run. If diff-informed
analysis is unavailable (for example, because the PR diff ranges could
not be computed), the action will fall back to a full analysis. <a
href="https://redirect.github.com/github/codeql-action/pull/3791">#3791</a></li>
<li>If multiple inputs are provided for the GitHub-internal
<code>analysis-kinds</code> input, only <code>code-scanning</code> will
be enabled. The <code>analysis-kinds</code> input is experimental, for
GitHub-internal use only, and may change without notice at any time. <a
href="https://redirect.github.com/github/codeql-action/pull/3892">#3892</a></li>
<li>Added an experimental change which, when running a Code Scanning
analysis for a PR with <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> enabled, prefers CodeQL CLI versions that have
a cached overlay-base database for the configured languages. This speeds
up analysis for a repository when there is not yet a cached overlay-base
database for the latest CLI version. We expect to roll this change out
to everyone in May. <a
href="https://redirect.github.com/github/codeql-action/pull/3880">#3880</a></li>
</ul>
<h2>4.35.4 - 07 May 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4">2.25.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3881">#3881</a></li>
</ul>
<h2>4.35.3 - 01 May 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.19.3 and earlier. These versions of
CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise
Server 3.15, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3837">#3837</a></li>
<li>Configurations for private registries that use Cloudsmith or GCP
OIDC are now accepted. <a
href="https://redirect.github.com/github/codeql-action/pull/3850">#3850</a></li>
<li>Best-effort connection tests for private registries now use
<code>GET</code> requests instead of <code>HEAD</code> for better
compatibility with various registry implementations. For NuGet feeds,
the test is now always performed against the service index. <a
href="https://redirect.github.com/github/codeql-action/pull/3853">#3853</a></li>
<li>Fixed a bug where two diagnostics produced within the same
millisecond could overwrite each other on disk, causing one of them to
be lost. <a
href="https://redirect.github.com/github/codeql-action/pull/3852">#3852</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/8aad20d150bbac5944a9f9d289da16a4b0d87c1e"><code>8aad20d</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3949">#3949</a>
from github/update-v4.36.2-dcb947ce1</li>
<li><a
href="https://github.com/github/codeql-action/commit/f521b08cd8f468ab193ea950a589cb2e9c869c6a"><code>f521b08</code></a>
Add additional changelog notes</li>
<li><a
href="https://github.com/github/codeql-action/commit/8aeff0ffb7b78582ee0d0e6eebb8140684400d08"><code>8aeff0f</code></a>
Update changelog for v4.36.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/dcb947ce15976d40ea82935510b2db4872ec124c"><code>dcb947c</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3948">#3948</a>
from github/update-bundle/codeql-bundle-v2.25.6</li>
<li><a
href="https://github.com/github/codeql-action/commit/c251bcefa178f7780f62f150002acffe3d07fde9"><code>c251bce</code></a>
Add changelog note</li>
<li><a
href="https://github.com/github/codeql-action/commit/62953c18b35f59e28351d2f1e806925aef8b1e3c"><code>62953c1</code></a>
Update default bundle to codeql-bundle-v2.25.6</li>
<li><a
href="https://github.com/github/codeql-action/commit/423b570baf1976cd7a3daeba5d6e9f9b76432f37"><code>423b570</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3946">#3946</a>
from github/dependabot/npm_and_yarn/npm-minor-5d507a...</li>
<li><a
href="https://github.com/github/codeql-action/commit/c35d1b164463ee62a100735382aaaa525c5d3496"><code>c35d1b1</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3947">#3947</a>
from github/dependabot/github_actions/dot-github/wor...</li>
<li><a
href="https://github.com/github/codeql-action/commit/cb1a588b02755b176e7b9d033ed4b69312f0e1bd"><code>cb1a588</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3937">#3937</a>
from github/robertbrignull/waitForProcessing_backoff</li>
<li><a
href="https://github.com/github/codeql-action/commit/ba47406412c54532b5b4fcfbaf877c9e2382b206"><code>ba47406</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3943">#3943</a>
from github/henrymercer/cache-cli-version-info</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/7211b7c8077ea37d8641b6271f6a365a22a5fbfa...8aad20d150bbac5944a9f9d289da16a4b0d87c1e">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action/analyze` from 4.36.0 to 4.36.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/analyze's
releases</a>.</em></p>
<blockquote>
<h2>v4.36.2</h2>
<ul>
<li>Cache CodeQL CLI version information across Actions steps. <a
href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li>
<li>Reduce requests while waiting for analysis processing by using
exponential backoff when polling SARIF processing status. <a
href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li>
</ul>
<h2>v4.36.1</h2>
<p>No user facing changes.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/analyze's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.37.0 - 08 Jul 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li>
<li>In addition to the existing input format, the
<code>config-file</code> input for the <code>codeql-action/init</code>
step will soon support a new <code>[owner/]repo[@ref][:path]</code>
format. All components except the repository name are optional. If
omitted, <code>owner</code> defaults to the same owner as the repository
the analysis is running for, <code>ref</code> to <code>main</code>, and
<code>path</code> to <code>.github/codeql-action.yaml</code>. Support
for this format ships in this version of the CodeQL Action, but will
only be enabled over the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li>
</ul>
<h2>4.36.3 - 01 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.36.2 - 04 Jun 2026</h2>
<ul>
<li>Cache CodeQL CLI version information across Actions steps. <a
href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li>
<li>Reduce requests while waiting for analysis processing by using
exponential backoff when polling SARIF processing status. <a
href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li>
</ul>
<h2>4.36.1 - 02 Jun 2026</h2>
<p>No user facing changes.</p>
<h2>4.36.0 - 22 May 2026</h2>
<ul>
<li><em>Breaking change</em>: Bump the minimum required CodeQL bundle
version to 2.19.4. <a
href="https://redirect.github.com/github/codeql-action/pull/3894">#3894</a></li>
<li>Add support for SHA-256 Git object IDs. <a
href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5">2.25.5</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3926">#3926</a></li>
</ul>
<h2>4.35.5 - 15 May 2026</h2>
<ul>
<li>We have improved how the JavaScript bundles for the CodeQL Action
are generated to avoid duplication across bundles and reduce the size of
the repository by around 70%. This should have no effect on the runtime
behaviour of the CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3899">#3899</a></li>
<li>For performance and accuracy reasons, <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> will now only be enabled on a pull request when
diff-informed analysis is also enabled for that run. If diff-informed
analysis is unavailable (for example, because the PR diff ranges could
not be computed), the action will fall back to a full analysis. <a
href="https://redirect.github.com/github/codeql-action/pull/3791">#3791</a></li>
<li>If multiple inputs are provided for the GitHub-internal
<code>analysis-kinds</code> input, only <code>code-scanning</code> will
be enabled. The <code>analysis-kinds</code> input is experimental, for
GitHub-internal use only, and may change without notice at any time. <a
href="https://redirect.github.com/github/codeql-action/pull/3892">#3892</a></li>
<li>Added an experimental change which, when running a Code Scanning
analysis for a PR with <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> enabled, prefers CodeQL CLI versions that have
a cached overlay-base database for the configured languages. This speeds
up analysis for a repository when there is not yet a cached overlay-base
database for the latest CLI version. We expect to roll this change out
to everyone in May. <a
href="https://redirect.github.com/github/codeql-action/pull/3880">#3880</a></li>
</ul>
<h2>4.35.4 - 07 May 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4">2.25.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3881">#3881</a></li>
</ul>
<h2>4.35.3 - 01 May 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.19.3 and earlier. These versions of
CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise
Server 3.15, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3837">#3837</a></li>
<li>Configurations for private registries that use Cloudsmith or GCP
OIDC are now accepted. <a
href="https://redirect.github.com/github/codeql-action/pull/3850">#3850</a></li>
<li>Best-effort connection tests for private registries now use
<code>GET</code> requests instead of <code>HEAD</code> for better
compatibility with various registry implementations. For NuGet feeds,
the test is now always performed against the service index. <a
href="https://redirect.github.com/github/codeql-action/pull/3853">#3853</a></li>
<li>Fixed a bug where two diagnostics produced within the same
millisecond could overwrite each other on disk, causing one of them to
be lost. <a
href="https://redirect.github.com/github/codeql-action/pull/3852">#3852</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/8aad20d150bbac5944a9f9d289da16a4b0d87c1e"><code>8aad20d</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3949">#3949</a>
from github/update-v4.36.2-dcb947ce1</li>
<li><a
href="https://github.com/github/codeql-action/commit/f521b08cd8f468ab193ea950a589cb2e9c869c6a"><code>f521b08</code></a>
Add additional changelog notes</li>
<li><a
href="https://github.com/github/codeql-action/commit/8aeff0ffb7b78582ee0d0e6eebb8140684400d08"><code>8aeff0f</code></a>
Update changelog for v4.36.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/dcb947ce15976d40ea82935510b2db4872ec124c"><code>dcb947c</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3948">#3948</a>
from github/update-bundle/codeql-bundle-v2.25.6</li>
<li><a
href="https://github.com/github/codeql-action/commit/c251bcefa178f7780f62f150002acffe3d07fde9"><code>c251bce</code></a>
Add changelog note</li>
<li><a
href="https://github.com/github/codeql-action/commit/62953c18b35f59e28351d2f1e806925aef8b1e3c"><code>62953c1</code></a>
Update default bundle to codeql-bundle-v2.25.6</li>
<li><a
href="https://github.com/github/codeql-action/commit/423b570baf1976cd7a3daeba5d6e9f9b76432f37"><code>423b570</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3946">#3946</a>
from github/dependabot/npm_and_yarn/npm-minor-5d507a...</li>
<li><a
href="https://github.com/github/codeql-action/commit/c35d1b164463ee62a100735382aaaa525c5d3496"><code>c35d1b1</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3947">#3947</a>
from github/dependabot/github_actions/dot-github/wor...</li>
<li><a
href="https://github.com/github/codeql-action/commit/cb1a588b02755b176e7b9d033ed4b69312f0e1bd"><code>cb1a588</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3937">#3937</a>
from github/robertbrignull/waitForProcessing_backoff</li>
<li><a
href="https://github.com/github/codeql-action/commit/ba47406412c54532b5b4fcfbaf877c9e2382b206"><code>ba47406</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3943">#3943</a>
from github/henrymercer/cache-cli-version-info</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/7211b7c8077ea37d8641b6271f6a365a22a5fbfa...8aad20d150bbac5944a9f9d289da16a4b0d87c1e">compare
view</a></li>
</ul>
</details>
<br />

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Daniel Chernovsky <daniel.chernovsky@doubleverify.com>
@Aias00 @DanielChrn
fix: honor namespace on cross-namespace InferencePool backendRef (env…
0017bdb 
…oyproxy#2339)

**Description**

`AIGatewayRoute` `rules[].backendRefs[]` accepts a `namespace` field,
but when a backendRef points at an `InferencePool` in a different
namespace, the controller generated the child `HTTPRoute` backendRef
with the route's *own* namespace instead of the referenced one. The
route then reported `ResolvedRefs: False` with `BackendNotFound: custom
backend InferencePool <route-ns>/<pool-name> not found`, even with a
valid `ReferenceGrant` in the pool's namespace.

This PR makes the controller honor the `namespace` specified on an
`InferencePool` backendRef when generating the `HTTPRoute`, and
validates cross-namespace `InferencePool` references via
`ReferenceGrant` — consistent with the existing `AIServiceBackend`
behavior. Same-namespace references are unaffected and require no
`ReferenceGrant`.

Implementation notes:
- `newHTTPRoute` now uses `backendRef.GetNamespace(route.Namespace)` for
the generated `InferencePool` backendRef instead of hardcoding the route
namespace.
- The `referenceGrantValidator` is refactored to be generic over the
target group/kind; `validateAIServiceBackendReference` is preserved as a
thin wrapper (behavior unchanged) and a new
`validateInferencePoolReference` is added.
- The Gateway controller already resolved the
`InferencePool`/`BackendSecurityPolicy` using the backendRef namespace,
so fixing the generated `HTTPRoute` namespace completes the end-to-end
path.

**Related Issues/PRs (if applicable)**

Fixes envoyproxy#2230

**Special notes for reviewers (if applicable)**

Added unit tests:
- `Test_newHTTPRoute_InferencePool_CrossNamespace` — namespace honored
with a valid `ReferenceGrant`, rejected without one, and same-namespace
needs no grant.
- `TestReferenceGrantValidator_ValidateInferencePoolReference` —
cross-namespace grant matching for `InferencePool` targets.

Verified with `go build`, `go vet`, and `go test
./internal/controller/...` (all passing), and `gofmt`.

Signed-off-by: liuhy <liuhongyu@apache.org>
Signed-off-by: Daniel Chernovsky <daniel.chernovsky@doubleverify.com>
@pjdurden @nacx @DanielChrn
fix(mcpproxy): skip non-response SSE events during initialize (envoyp…
c39627c 
…roxy#2219) (envoyproxy#2267)

**Description**

Fixes envoyproxy#2219.

The MCP proxy fails `initialize` with `500 failed to create MCP session
to any backend` and logs `MCP message is not a response: <nil>` when a
backend's `initialize` SSE response begins with a non-response event (an
empty/keep-alive `data:` line) before the JSON-RPC result. Some FastMCP
backends do this depending on the requested `protocolVersion` (e.g.
firecrawl with `2025-11-25`).

Two layers caused it:

1. `sseEventParser.parseEvent` (`internal/mcpproxy/sse.go`) called
`jsonrpc.DecodeMessage` on an empty `data:` line, which errors, so the
whole leading event was returned as a parse error.
2. The initialize reader loop (`internal/mcpproxy/mcpproxy.go`) treated
that non-EOF error as fatal and broke with `rawMsg` still nil, then
reported it as "not a response".

This change:

- Skips empty `data:` lines in the SSE parser (keep-alive/heartbeat
events carry no message to decode). Non-empty but malformed data still
errors as before.
- Makes the initialize reader skip non-response events and keep reading
until it finds the JSON-RPC `*Response`, instead of requiring the first
event to be the response.

**Testing**

- `TestSSEEventParser_EmptyDataLineSkipped` — a leading event with an
empty data line yields an event with no messages and no error; the
following event still decodes.
- `TestNewSession_SSEWithLeadingKeepAlive` — a backend whose initialize
SSE response starts with an empty keep-alive event before the real
response now initializes successfully (this test reproduced the `MCP
message is not a response: <nil>` failure before the fix).

```
go test ./internal/mcpproxy/
go vet ./internal/mcpproxy/
go build ./...
```

Done with AI assistance; I have reviewed every line and understand the
change.

---------

Signed-off-by: pjdurden <prajjwalchittori1@gmail.com>
Co-authored-by: Ignasi Barrera <ignasi@tetrate.io>
Signed-off-by: Daniel Chernovsky <daniel.chernovsky@doubleverify.com>
@Aias00 @claude
@nacx @DanielChrn
fix: prevent double counting of Anthropic streaming cache tokens (env…
5fe6816 
…oyproxy#2236)

**Description**

The `message_delta` event handler in `anthropicStreamParser` was using
`Add*` methods for input tokens, cached tokens, and cache creation
tokens. However, the Anthropic API reports cumulative (not incremental)
token counts in `message_delta`, and `message_start` already sets these
values correctly via `ExtractTokenUsageFromExplicitCaching`. Using `Add`
on top of the already-set cumulative values caused cache tokens to be
counted twice.

### Bug Example

With `input_tokens=9` and `cache_read_input_tokens=1`:

| Step | Action | InputTokens | CachedInputTokens |
|------|--------|-------------|-------------------|
| `message_start` | `SetInputTokens(10)`, `SetCachedInputTokens(1)` | 10
✅ | 1 ✅ |
| `message_delta` (before fix) | `AddInputTokens(1)`,
`AddCachedInputTokens(1)` | 11 ❌ | 2 ❌ |
| `message_delta` (after fix) | Only `SetOutputTokens(16)` | 10 ✅ | 1 ✅
|

### Root Cause

`ExtractTokenUsageFromExplicitCaching` computes `InputTokens =
input_tokens + cache_read + cache_creation`. In `message_start`, this is
correctly set via `Set*` methods. In `message_delta`, the same
cumulative values were being added via `Add*` methods, causing double
counting.

### Fix

The `message_delta` handler now only updates output tokens using
`SetOutputTokens`, since `message_start` typically reports
`output_tokens=0` and `message_delta` provides the final count. This
matches the pattern already used in `anthropic_anthropic.go`'s
`reflectStreamingEvent`. The `MessageDeltaUsage` struct uses non-pointer
`int64` fields that default to 0 when absent from JSON, making it
impossible to distinguish "not provided" from "actually zero" — so we
cannot safely `Set` override from delta either, as it would erase
correct `message_start` values with zeros.

### Changes

- `internal/translator/anthropic_helper.go`: Removed `Add*` calls for
input/cache tokens from `message_delta` handler; replaced
`AddOutputTokens` with `SetOutputTokens`; removed unused
`ExtractTokenUsageFromExplicitCaching` call; added `>= 0` guard for
`ThinkingTokens`
- `internal/translator/anthropic_helper_test.go`: Added
`TestAnthropicStreamParserTokenUsage_NoDoubleCounting` with 6 test cases

### Test Coverage

- Cache tokens in both `message_start` and `message_delta` (core
double-count scenario)
- Cache creation tokens in both events
- Both cache_read and cache_creation in both events
- No cache tokens (baseline correctness)
- Cache tokens only in `message_start`, not in `message_delta`
- Cache tokens only in `message_delta` — verifies they are ignored
(non-pointer int64 fields cannot distinguish absent from zero)

---------

Signed-off-by: liuhy <liuhongyu@apache.org>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Ignasi Barrera <ignasi@tetrate.io>
Signed-off-by: Daniel Chernovsky <daniel.chernovsky@doubleverify.com>
@Killusions @nacx @DanielChrn
feat: forward reasoning_effort as reasoning_config to AWS Bedrock (en…
81ec760 
…voyproxy#2190)

**Description**

In the OpenAI-to-AWS-Bedrock translator, OpenAI clients send
reasoning_effort (low/medium/high) in chat completion requests but it
was silently dropped. This forwards it as reasoning_config in
AdditionalModelRequestFields for Bedrock models like Nova and GLM that
support it. Unknown keys in that passthrough map are ignored by models
that dont support it.

Fixes envoyproxy#2207

Signed-off-by: Linus Schlumberger <linus.schlumberger@siemens.com>
Co-authored-by: Ignasi Barrera <ignasi@tetrate.io>
Signed-off-by: Daniel Chernovsky <daniel.chernovsky@doubleverify.com>
@walsm232 @nacx @DanielChrn
feat(helm): add controller topologySpreadConstraints to AI Gateway He…
ffe9b24 
…lm chart (envoyproxy#2336)

**Description**

This commit adds Helm chart support for configuring topology spread
constraints on the AI Gateway controller Deployment.

The chart already allows users to influence controller pod placement
with `nodeSelector`, `affinity`, and `tolerations`, but those controls
do not fully cover the case of evenly distributing replicas across
topology domains such as zones, nodes, or other labeled failure domains.
For example, affinity can prefer or require certain nodes, and
tolerations can allow scheduling onto tainted nodes, but they do not
directly express "keep these replicas balanced across zones" in the same
way Kubernetes `topologySpreadConstraints` does.

Exposing `controller.topologySpreadConstraints` gives operators a native
Kubernetes scheduling control for improving controller availability in
multi-node or multi-zone clusters. Users can now configure the Helm
chart to avoid concentrating all controller replicas in the same
topology domain, reducing the chance that a single node or zone
disruption affects every controller pod.

The default value is an empty list, so existing installs and rendered
manifests are unchanged unless users explicitly configure topology
spread constraints.

**Related Issues/PRs (if applicable)**

N/A - I didn't open an issue for this but if it needs one let me know!

**Testing**

- `go tool -modfile=tools/go.mod helm lint
manifests/charts/ai-gateway-helm`
- `make helm-test`
- **Default render:** confirmed no `topologySpreadConstraints` key is
emitted when the value is left at its default `[]`.
- Rendered with a sample constraint set via `--set`:

```yaml
      topologySpreadConstraints:
        - labelSelector:
            matchLabels:
              app.kubernetes.io/name: ai-gateway-helm
          maxSkew: 1
          topologyKey: topology.kubernetes.io/zone
          whenUnsatisfiable: ScheduleAnyway
```

Signed-off-by: Michael Walsh <walshmichael310@gmail.com>
Co-authored-by: Ignasi Barrera <ignasi@tetrate.io>
Signed-off-by: Daniel Chernovsky <daniel.chernovsky@doubleverify.com>
@walsm232 @DanielChrn
feat(helm): add controller security context defaults (envoyproxy#2338)
5ec32be 
**Description**

This commit updates the AI Gateway Helm chart to use hardened pod and
container security contexts for the controller Deployment by default.

The controller image already runs as the distroless `nonroot` user, and
the controller does not seem to require privileged Linux capabilities or
privilege escalation. This change makes those runtime expectations
explicit in the chart defaults by configuring the controller to run as
UID/GID `65532`, require non-root execution, drop all capabilities,
disable privilege escalation, and use the runtime default seccomp
profile.

This brings the controller Deployment closer to the security posture
used by Envoy Gateway's Helm chart and aligns it with the secure
defaults that seem to already be used for the AI Gateway extProc
container injected by the controller:
https://github.com/envoyproxy/ai-gateway/blob/d63a020f166b16d821a3bbe7fab9492ace6c97f5/internal/controller/gateway_mutator.go#L427-L439

The existing `controller.podSecurityContext` and
`controller.securityContext` values remain configurable, so users can
override these defaults if needed.

**Related Issues/PRs (if applicable)**

N/A - I didn't open an issue for this but if it needs one let me know!

**Special notes for reviewers (if applicable)**

This intentionally does not set `readOnlyRootFilesystem: true`. I wasn't
100% sure if that would be a safe change to make here but if folks think
it'd be ok then I'm happy to add it in this PR. If any of these other
settings may potentially cause issues do let me know and I can adjust
this, I did some light testing in a Kind cluster (see below).

**Testing**

  ```console
make helm-lint
make helm-test
```

Also installed the local chart into a Kind cluster with Envoy Gateway installed. Verified that the controller pod reached Running/Ready, the webhook and metrics servers started successfully, leader election completed, and the live pod had the expected pod/container security contexts.

Verified the controller metrics endpoint still responds:

```console
kc port-forward deploy/ai-gateway-controller -n envoy-ai-gateway-system
8080:8080
curl localhost:8080/metrics
```

Signed-off-by: Michael Walsh <walshmichael310@gmail.com>
Signed-off-by: Daniel Chernovsky <daniel.chernovsky@doubleverify.com>
@kanurag94 @nacx @DanielChrn
mcp: share one Backend per namespace instead of one per MCPRoute (env…
2945e6f 
…oyproxy#2257)

**Description**

The MCPRoute controller created one `egv1a1.Backend` per MCPRoute
(`{ns}-{name}-mcp-proxy`),
all pointing at the same dummy IP that the extension server rewrites to
`127.0.0.1:9856`. That
is N identical placeholder Backend CRs per namespace.

Switch to a single shared Backend per namespace (`ai-eg-mcp-proxy`) that
every MCPRoute's main
HTTPRoute references. It lives in the MCPRoute's own namespace, so the
reference is valid for any
number of parent Gateways (including cross-namespace ones). It has no
owner reference and is
deleted when the last MCPRoute in the namespace is removed, via the
finalizer.

This only collapses the redundant Backend CRs; it does not change the
number of CDS clusters
(Envoy Gateway emits one per HTTPRoute rule, not per Backend). No
extension server change is
needed - it matches clusters by the main HTTPRoute name prefix, not the
Backend name.

**Related Issues/PRs (if applicable)**

Closes envoyproxy#2150

---------

Signed-off-by: Anurag Aggarwal <kanurag94@gmail.com>
Co-authored-by: Ignasi Barrera <ignasi@tetrate.io>
Signed-off-by: Daniel Chernovsky <daniel.chernovsky@doubleverify.com>
@dependabot @nacx @DanielChrn
chore(deps): bump golang.org/x/crypto from 0.50.0 to 0.52.0 in /tools (…
220c0b1 
…envoyproxy#2344)

Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from
0.50.0 to 0.52.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/crypto/commit/a1c0d9929856c8aba2b31f079340f00578eda803"><code>a1c0d99</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="https://github.com/golang/crypto/commit/3c7c86938f4541c333d506f719388d9c42d4763d"><code>3c7c869</code></a>
ssh: fix deadlock on unexpected channel responses</li>
<li><a
href="https://github.com/golang/crypto/commit/533fb3f7e4a5ae23f69d1837cd851d35ff5b76ce"><code>533fb3f</code></a>
ssh: fix source-address critical option bypass</li>
<li><a
href="https://github.com/golang/crypto/commit/abbc44d451a6f9236a2bbd26cbcd4d0fec473da3"><code>abbc44d</code></a>
ssh: fix incorrect operator order</li>
<li><a
href="https://github.com/golang/crypto/commit/e052873987615dc96fe67607a9a6adb76311344f"><code>e052873</code></a>
ssh: fix infinite loop on large channel writes due to integer
overflow</li>
<li><a
href="https://github.com/golang/crypto/commit/b61cf853a89d82cad68da5e12a6beca2116f8456"><code>b61cf85</code></a>
ssh: enforce user presence verification for security keys</li>
<li><a
href="https://github.com/golang/crypto/commit/9c2cd33e8d96a96133fd6ff732510ebba539c2bd"><code>9c2cd33</code></a>
ssh: enforce strict limits on DSA key parameters</li>
<li><a
href="https://github.com/golang/crypto/commit/890731877d85f71cfdc9554e7a27fec4684fc4c4"><code>8907318</code></a>
ssh: reject RSA keys with excessively large moduli</li>
<li><a
href="https://github.com/golang/crypto/commit/ffd87b4878fa98ca2908ec534e1a410bf095a35e"><code>ffd87b4</code></a>
ssh: fix panic when authority callbacks are nil</li>
<li><a
href="https://github.com/golang/crypto/commit/4e7a7384ecbc8d519f6f4c11b36fa9d761fc8946"><code>4e7a738</code></a>
ssh: fix deadlock on unexpected global responses</li>
<li>Additional commits viewable in <a
href="https://github.com/golang/crypto/compare/v0.50.0...v0.52.0">compare
view</a></li>
</ul>
</details>
<br />

[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/crypto&package-manager=go_modules&previous-version=0.50.0&new-version=0.52.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/envoyproxy/ai-gateway/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Ignasi Barrera <ignasi@tetrate.io>
Signed-off-by: Daniel Chernovsky <daniel.chernovsky@doubleverify.com>
@walsm232 @nacx @DanielChrn
feat(helm): add controller pod labels (envoyproxy#2337)
75edbea 
**Description**

This commit adds Helm chart support for configuring additional labels on
the AI Gateway controller pod template.

AI Gateway already supports `controller.podAnnotations`, but it did not
expose an equivalent `controller.podLabels` value. This adds that
missing Helm value and renders the configured labels under the
controller Deployment pod template metadata.

Pod labels are useful for selectable pod metadata, including
NetworkPolicy selectors, monitoring and log pipeline selection, cost
allocation, admission policy requirements, and other cluster automation
that groups or selects pods by label.

Follows the same pattern used by the Envoy Gateway Helm chart, which
supports configuring pod labels and annotations on the Envoy Gateway
control plane pod.

**Related Issues/PRs (if applicable)**

N/A - I didn't open an issue for this but if it needs one let me know!

**Special notes for reviewers (if applicable)**

Chart-only change. The default value is an empty map, so rendered
manifests are unchanged unless users explicitly configure
`controller.podLabels`.

**Testing**

  ```console
  make helm-lint

  make helm-test

go tool -modfile=tools/go.mod helm template aigw
manifests/charts/ai-gateway-helm \
    --namespace envoy-gateway-system \
    --show-only templates/deployment.yaml \
    --set controller.podLabels.team=platform \
    --set controller.podLabels.environment=prod
```

Signed-off-by: Michael Walsh <walshmichael310@gmail.com>
Co-authored-by: Ignasi Barrera <ignasi@tetrate.io>
Signed-off-by: Daniel Chernovsky <daniel.chernovsky@doubleverify.com>
@kanurag94 @nacx @DanielChrn
feat: per-request backend credentials from request headers and dynami…
e5f1847 
…c metadata (envoyproxy#2253)

**Description**

BackendSecurityPolicy today uses one static credential for every
request. This adds an optional credentialOverride field so a trusted
upstream filter can supply the credential per-request instead.

Two sources: fromRequestHeaders reads from a request header the filter
injects (stripped before forwarding upstream), fromDynamicMetadata reads
from Envoy filter metadata which the client cannot forge.
fallbackToConfigured decides whether a missing source falls back to the
static credential or returns 401.

Default header names use the x-aigw- prefix (e.g. x-aigw-api-key) so
they don't collide with real provider headers and are redacted from logs
automatically. AWSCredentials is not supported here — it needs three
values plus SigV4 signing, that's a separate follow-up.

Example with header source, falls back to the secret when header is
absent:

```yaml
spec:
  type: APIKey
  apiKey:
    secretRef:
      name: openai-key
  credentialOverride:
    fromRequestHeaders:
      fallbackToConfigured: true
```

Example with dynamic metadata, 401 when key is missing:

```yaml
  credentialOverride:
    fromDynamicMetadata:
      namespace: envoy.filters.http.ext_authz
      key: upstream_api_key
      fallbackToConfigured: false
```

**Related Issues/PRs (if applicable)**

Closes envoyproxy#2216
Related: envoyproxy#2076

**Special notes for reviewers (if applicable)**

The fromRequestHeaders source strips the input header from the request
before it reaches the upstream backend. This is done by adding it to the
backend's HeaderMutation.Remove list, which tells Envoy to drop it while
keeping it visible in the local header map so the handler can still read
it.

---------

Signed-off-by: Anurag Aggarwal <kanurag94@gmail.com>
Co-authored-by: Ignasi Barrera <ignasi@tetrate.io>
Signed-off-by: Daniel Chernovsky <daniel.chernovsky@doubleverify.com>
@pjdurden @nacx @DanielChrn
fix(translator): merge input/cache token usage reported on Anthropic …
0200610 
…message_delta (envoyproxy#2292)

**Description**

Anthropic Messages streaming usage extraction reads input and cache
token counts from `message_start`, and on `message_delta` it only
updates `output_tokens`. Some Anthropic-compatable backends report the
final `input_tokens`, `cache_creation_input_tokens` and
`cache_read_input_tokens` on the `message_delta` event instead. In that
case the input and cache counts get dropped and recorded as zero, which
corrupts usage metrics and any downstream cost or quota accounting that
depends on them.

This runs the `message_delta` usage through the same
`ExtractTokenUsageFromExplicitCaching` path already used for
`message_start` and merges it with `Override`. The fields are only
merged when non-zero, so a standard delta that carries `output_tokens`
alone doesnt overwrite the `message_start` baseline with zeros.

**Related Issues/PRs (if applicable)**

Fixes envoyproxy#2290

**Special notes for reviewers (if applicable)**

Added two streaming subtests (cache-creation and cache-read variants)
using the values from the issue: `input_tokens` 4522 + cache 4511 gives
9033 input total and 9038 total. They fail on main and pass with this
change. The existing streaming and non-streaming usage tests are
untouched.

---------

Signed-off-by: pjdurden <prajjwalchittori1@gmail.com>
Co-authored-by: Ignasi Barrera <ignasi@tetrate.io>
Signed-off-by: Daniel Chernovsky <daniel.chernovsky@doubleverify.com>
@albe2669 @nacx @DanielChrn
feat: add stream idle timeout with fallover to next model (envoyproxy…
5ff6f68 
…#2169)

**Description**

Adds a new optional `streamIdleTimeout` field to `AIGatewayRouteRule` so
callers can bound the time without receiving any upstream bytes on a
streaming response.

*Why*

Today the only deadline on an LLM streaming call is `Timeouts.Request`,
which bounds the whole response. If a model is slow to emit its first
token, the client waits up to the overall budget before failing. We want
to fail fast on idle/slow upstreams and (with retry configured) fall
over to the next backend in the rule before any response headers reach
the client.

*How*

The AI Gateway extension server sets
`route.retry_policy.per_try_idle_timeout` on the generated xDS routes.
In the `PostTranslateModify` hook it walks the final
`RouteConfiguration`s, identifies each `AIGatewayRoute` route by its
rule index, looks up the `AIGatewayRoute`, and for any rule with
`streamIdleTimeout` set it sets `per_try_idle_timeout` to that value.
The timeout is *merged* into the route's existing retry policy, so retry
config produced by a `BackendTrafficPolicy` (`retryOn`, `numRetries`) is
preserved.

*Behavior*

- A rule with `streamIdleTimeout` set has `per_try_idle_timeout` applied
to its routes.
- A rule without it is, of course, left untouched.
- If the timer fires before the first response byte arrives, Envoy
resets the upstream stream before any headers leave the gateway. A
BackendTrafficPolicy with retryOn covering reset will transparently fall
over to the next backend (model) in the rule.
- If the timer fires mid-stream after bytes have already arrived, the
stream is cut and the client receives a 504.

*Testing method*

- Unit tests for the route mutation (timeout applied, existing retry
policy preserved, no-timeout/non-forwarding/missing-route cases) plus
the existing suite.
- Created an example with two tiny applications where one never
responds, set to the first priority in the backend list, and set the
`streamIdleTimeout` to 5 seconds, it should then fallover to the other
application. This ran successfully. I can add it as an example if that
makes sense.
- Verified end-to-end on a local cluster: Envoy's route config dump
shows `per_try_idle_timeout=5s` on the rule (with
`retry_on`/`num_retries` intact), and a streaming request fails over to
the healthy backend after ~5s.

*Notes*

- Generative AI was used to assist in writing this change.
- The route-name prefix encodes Envoy Gateway's internal xDS naming
convention. If that schema changes the lookup will no longer match the
rule — but unlike the JSONPatch approach this is a normal code path that
can log/observe the miss rather than failing silently.

---------

Signed-off-by: albe2669 <albert@risenielsen.dk>
Co-authored-by: Ignasi Barrera <ignasi@tetrate.io>
Signed-off-by: Daniel Chernovsky <daniel.chernovsky@doubleverify.com>
@zhaohuabing @nacx @DanielChrn
fix: split the ext proc config to avoid k8s size limits (envoyproxy#1865
344097d 
)

**Description**

This PR splits the ext proc/mcpproxy config into multiple secrets, so it
can bypass the k8s size limits.

**Related Issues/PRs (if applicable)**

Fixes envoyproxy#1613

cc @nacx

---------

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>
Co-authored-by: Ignasi Barrera <ignasi@tetrate.io>
Signed-off-by: Daniel Chernovsky <daniel.chernovsky@doubleverify.com>
@johnpanos @DanielChrn
fix(translator): preserve tool result cache control (envoyproxy#2358)
5ea30ec 
**Description**

This commit preserves message-level `cache_control` fields on OpenAI
tool result messages when translating requests to Anthropic-compatible
backends. Previously, the OpenAI schema dropped the field before
translation, so AWS Anthropic requests could not place a cache
breakpoint on an outer `tool_result` block.

The translator now prefers the message-level marker and falls back to
the existing content-part marker. Unit tests cover string and multipart
results, consecutive tool messages, and the compatibility path for
content-part markers.

**Related Issues/PRs (if applicable)**
N/A

**Special notes for reviewers (if applicable)**
I raised this PR because prompt caching worked for plain messages, tool
definitions, and `tool_use` blocks, but missed when the breakpoint
landed on a tool result through the OpenAI-compatible endpoint. The
native Anthropic endpoint already preserved this shape.

The E2E matrix checks all five prompt shapes against the in-cluster test
upstream and verifies the exact AWS Anthropic request body. It does not
call a live provider.

I used Cursor to help investigate and implement this change, and I
reviewed and verified the code and tests.

Signed-off-by: John Panos <johncpanos@gmail.com>
Signed-off-by: Daniel Chernovsky <daniel.chernovsky@doubleverify.com>
@johnpanos @DanielChrn
site: add unwrap to adopters (envoyproxy#2370)
b710588 
**Description**

Add Unwrap to the adopter list with its logo, website, and a short
customer intelligence description.

**Related Issues/PRs (if applicable)**

**Test plan**

- `jq empty site/src/data/adopters/adopters.json`
- `git diff --check`

Signed-off-by: John Panos <johncpanos@gmail.com>
Signed-off-by: Daniel Chernovsky <daniel.chernovsky@doubleverify.com>
@0YHR0 @nacx @DanielChrn
fix(extensionserver): handle per-backend route clusters (envoyproxy#2348
b738ac3 
)

**Description**

This handles both route-level cluster names and per-backend cluster
names generated by Envoy Gateway. Per-backend clusters now receive the
upstream ext_proc and header mutation filters together with metadata for
the specific backend reference, so priority-based fallback can apply the
fallback backend's schema translation.

The cluster-name parsing is isolated in a helper that validates the
route rule and backend indexes. Existing route-level cluster behavior is
preserved.

**Related Issues/PRs (if applicable)**

Fixes envoyproxy#2135

**Testing**

- `go test ./internal/extensionserver -run
'TestParseAIGatewayClusterName|TestMaybeModifyClusterPerBackendClusterName|Test_maybeModifyCluster'
-count=1`
- `go test ./internal/extensionserver -count=1`
- `go test ./internal/extensionserver -coverprofile=<temp-file>
-count=1` (package 88.3%; parser and endpoint metadata helper 100%)
- `go vet ./internal/extensionserver`
- `git diff --check`

The repository's `go tool -modfile=tools/go.mod` lint command is not
compatible with the local Go 1.26 tool invocation, so the extension
server lint target was not run.

**Special notes for reviewers (if applicable)**

The regression tests cover both per-backend LoadAssignment metadata and
the EDS-managed cluster-level metadata fallback. This update was
prepared with OpenAI Codex assistance and reviewed against the current
extension server implementation.

---------

Signed-off-by: Yang Haoran <97868579@qq.com>
Co-authored-by: Ignasi Barrera <ignasi@tetrate.io>
Signed-off-by: Daniel Chernovsky <daniel.chernovsky@doubleverify.com>
@DanielChrn
Disable code covarage update
e81785d 
Signed-off-by: Daniel Chernovsky <daniel.chernovsky@doubleverify.com>
@DanielChrn
Revert code coverage
7dc692d 
Signed-off-by: Daniel Chernovsky <daniel.chernovsky@doubleverify.com>
@DanielChrn
Trigget pipeline
a594f0d
@DanielChrn
Allow coverage to fail
a76f4d8
@DanielChrn
Update ai_service_backend.go
c20fac8 
Signed-off-by: DanielChrn <122798071+DanielChrn@users.noreply.github.com>
@DanielChrn
Update ai_gateway_route.go
87d0b13 
Signed-off-by: DanielChrn <122798071+DanielChrn@users.noreply.github.com>
@DanielChrn
Tirgger CI
1e239b6
@DanielChrn
Update Makefile
fd8c5a5 
Signed-off-by: DanielChrn <122798071+DanielChrn@users.noreply.github.com>
@DanielChrn
DanielChrn requested a review from a team as a code owner July 28, 2026 15:20
@dosubot dosubot Bot added the size:L This PR changes 100-499 lines, ignoring generated files. label Jul 28, 2026
@DanielChrn DanielChrn changed the title feaure: bypass vertex creds from client request feat: bypass vertex creds from client request Jul 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

size:L This PR changes 100-499 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.