Gcp context cache by sivanantha321 · Pull Request #1 · sivanantha321/agent-router

sivanantha321 · 2026-08-25T11:31:23Z

Description

Related Issues/PRs (if applicable)

Special notes for reviewers (if applicable)

…tlptracehttp from 1.42.0 to 1.43.0 (theagentrouter#2028) Bumps [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp](https://github.com/open-telemetry/opentelemetry-go) from 1.42.0 to 1.43.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md">go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp's changelog</a>.</em></p> <blockquote> <h2>[1.43.0/0.65.0/0.19.0] 2026-04-02</h2> <h3>Added</h3> <ul> <li>Add <code>IsRandom</code> and <code>WithRandom</code> on <code>TraceFlags</code>, and <code>IsRandom</code> on <code>SpanContext</code> in <code>go.opentelemetry.io/otel/trace</code> for <a href="https://www.w3.org/TR/trace-context-2/#random-trace-id-flag">W3C Trace Context Level 2 Random Trace ID Flag</a> support. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8012">#8012</a>)</li> <li>Add service detection with <code>WithService</code> in <code>go.opentelemetry.io/otel/sdk/resource</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7642">#7642</a>)</li> <li>Add <code>DefaultWithContext</code> and <code>EnvironmentWithContext</code> in <code>go.opentelemetry.io/otel/sdk/resource</code> to support plumbing <code>context.Context</code> through default and environment detectors. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8051">#8051</a>)</li> <li>Support attributes with empty value (<code>attribute.EMPTY</code>) in <code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li> <li>Support attributes with empty value (<code>attribute.EMPTY</code>) in <code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li> <li>Support attributes with empty value (<code>attribute.EMPTY</code>) in <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li> <li>Support attributes with empty value (<code>attribute.EMPTY</code>) in <code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li> <li>Support attributes with empty value (<code>attribute.EMPTY</code>) in <code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li> <li>Support attributes with empty value (<code>attribute.EMPTY</code>) in <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li> <li>Support attributes with empty value (<code>attribute.EMPTY</code>) in <code>go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li> <li>Add support for per-series start time tracking for cumulative metrics in <code>go.opentelemetry.io/otel/sdk/metric</code>. Set <code>OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true</code> to enable. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8060">#8060</a>)</li> <li>Add <code>WithCardinalityLimitSelector</code> for metric reader for configuring cardinality limits specific to the instrument kind. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7855">#7855</a>)</li> </ul> <h3>Changed</h3> <ul> <li>Introduce the <code>EMPTY</code> Type in <code>go.opentelemetry.io/otel/attribute</code> to reflect that an empty value is now a valid value, with <code>INVALID</code> remaining as a deprecated alias of <code>EMPTY</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li> <li>Improve slice handling in <code>go.opentelemetry.io/otel/attribute</code> to optimize short slice values with fixed-size fast paths. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8039">#8039</a>)</li> <li>Improve performance of span metric recording in <code>go.opentelemetry.io/otel/sdk/trace</code> by returning early if self-observability is not enabled. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8067">#8067</a>)</li> <li>Improve formatting of metric data diffs in <code>go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8073">#8073</a>)</li> </ul> <h3>Deprecated</h3> <ul> <li>Deprecate <code>INVALID</code> in <code>go.opentelemetry.io/otel/attribute</code>. Use <code>EMPTY</code> instead. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8038">#8038</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Return spec-compliant <code>TraceIdRatioBased</code> description. This is a breaking behavioral change, but it is necessary to make the implementation <a href="https://opentelemetry.io/docs/specs/otel/trace/sdk/#traceidratiobased">spec-compliant</a>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8027">#8027</a>)</li> <li>Fix a race condition in <code>go.opentelemetry.io/otel/sdk/metric</code> where the lastvalue aggregation could collect the value 0 even when no zero-value measurements were recorded. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8056">#8056</a>)</li> <li>Limit HTTP response body to 4 MiB in <code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code> to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108">#8108</a>)</li> <li>Limit HTTP response body to 4 MiB in <code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code> to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108">#8108</a>)</li> <li>Limit HTTP response body to 4 MiB in <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code> to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108">#8108</a>)</li> <li><code>WithHostID</code> detector in <code>go.opentelemetry.io/otel/sdk/resource</code> to use full path for <code>kenv</code> command on BSD. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8113">#8113</a>)</li> <li>Fix missing <code>request.GetBody</code> in <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code> to correctly handle HTTP2 GOAWAY frame. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8096">#8096</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/9276201a64b623606e3eaa0d61ae8ee6d62756c0"><code>9276201</code></a> Release v1.43.0 / v0.65.0 / v0.19.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8128">#8128</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/61b8c9466c4e6b17e69b622279fe9b63fb15c89a"><code>61b8c94</code></a> chore(deps): update module github.com/mattn/go-runewidth to v0.0.22 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8131">#8131</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/97a086e82ffe01502f4c620e9c447efa229e2a23"><code>97a086e</code></a> chore(deps): update github.com/golangci/dupl digest to c99c5cf (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8122">#8122</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/5e363de517dba6db62736b2f5cdef0e0929b4cd0"><code>5e363de</code></a> limit response body size for OTLP HTTP exporters (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8108">#8108</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/35214b60138eac8dec97a2d2b851d8c8471680c7"><code>35214b6</code></a> Use an absolute path when calling bsd kenv (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8113">#8113</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/290024ceaf695f9cdbf29a0c6731a317d92bc361"><code>290024c</code></a> fix(deps): update module google.golang.org/grpc to v1.80.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8121">#8121</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/e70658e098033d6bb5ec1b399de16bbb2642f6dc"><code>e70658e</code></a> fix: support getBody in otelploghttp (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8096">#8096</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/4afe468e3b4859c949a1c1e8d92684d43d86ef8a"><code>4afe468</code></a> fix(deps): update googleapis to 9d38bb4 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8117">#8117</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/b9ca729776309e3c08fe700c131797a3b4d10634"><code>b9ca729</code></a> chore(deps): update module github.com/go-git/go-git/v5 to v5.17.2 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8115">#8115</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/69472ec56cb7674d55ca2e2bcb04dea73228ab79"><code>69472ec</code></a> chore(deps): update fossas/fossa-action action to v1.9.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8118">#8118</a>)</li> <li>Additional commits viewable in <a href="https://github.com/open-telemetry/opentelemetry-go/compare/v1.42.0...v1.43.0">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Ignasi Barrera <ignasi@tetrate.io>

…eagentrouter#2041) Bumps [helm.sh/helm/v3](https://github.com/helm/helm) from 3.19.4 to 3.20.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/helm/helm/releases">helm.sh/helm/v3's releases</a>.</em></p> <blockquote> <h2>Helm v3.20.2</h2> <h2>v3.20.2</h2> <p>Helm v3.20.2 is a security patch release. Users are encouraged to upgrade for the best experience.</p> <p>The community keeps growing, and we'd love to see you there!</p> <ul> <li>Join the discussion in <a href="https://kubernetes.slack.com">Kubernetes Slack</a>: <ul> <li>for questions and just to hang out</li> <li>for discussing PRs, code, and bugs</li> </ul> </li> <li>Hang out at the Public Developer Call: Thursday, 9:30 Pacific via <a href="https://zoom.us/j/696660622">Zoom</a></li> <li>Test, debug, and contribute charts: <a href="https://artifacthub.io/packages/search?kind=0">ArtifactHub/packages</a></li> </ul> <h2>Security fixes</h2> <ul> <li><a href="https://github.com/helm/helm/security/advisories/GHSA-hr2v-4r36-88hr">GHSA-hr2v-4r36-88hr</a> Helm Chart extraction output directory collapse via <code>Chart.yaml</code> name dot-segment</li> </ul> <h2>Installation and Upgrading</h2> <p>Download Helm v3.20.2. The common platform binaries are here:</p> <ul> <li><a href="https://get.helm.sh/helm-v3.20.2-darwin-amd64.tar.gz">MacOS amd64</a> (<a href="https://get.helm.sh/helm-v3.20.2-darwin-amd64.tar.gz.sha256sum">checksum</a> / 7de04301f28b902a74f6286ed941cadc86ee5e6a9086a18f2ccf1f548e99d618)</li> <li><a href="https://get.helm.sh/helm-v3.20.2-darwin-arm64.tar.gz">MacOS arm64</a> (<a href="https://get.helm.sh/helm-v3.20.2-darwin-arm64.tar.gz.sha256sum">checksum</a> / 139c794c22f16b579d08ddd3008c8038b9bb2814f35b5bcca91f50a1f458978d)</li> <li><a href="https://get.helm.sh/helm-v3.20.2-linux-amd64.tar.gz">Linux amd64</a> (<a href="https://get.helm.sh/helm-v3.20.2-linux-amd64.tar.gz.sha256sum">checksum</a> / 258e830a9e613c8a7a302d6059b4bb3b9758f2f3e1bb8ea0d707ce10a9a72fea)</li> <li><a href="https://get.helm.sh/helm-v3.20.2-linux-arm.tar.gz">Linux arm</a> (<a href="https://get.helm.sh/helm-v3.20.2-linux-arm.tar.gz.sha256sum">checksum</a> / a8a614c740399ff1ef32bcea6be6e4523f17e3376f9cf55c192cc48c8f2d1f19)</li> <li><a href="https://get.helm.sh/helm-v3.20.2-linux-arm64.tar.gz">Linux arm64</a> (<a href="https://get.helm.sh/helm-v3.20.2-linux-arm64.tar.gz.sha256sum">checksum</a> / 5ea2d6bc2cda3f8edf985e028809f5a9278f404fb8ab24044de9b7cb9b79a691)</li> <li><a href="https://get.helm.sh/helm-v3.20.2-linux-386.tar.gz">Linux i386</a> (<a href="https://get.helm.sh/helm-v3.20.2-linux-386.tar.gz.sha256sum">checksum</a> / 88e4c1834307cdbc9f3b80920e1a383e4ba50bb488fb0be1b1fbd4918bb6ae73)</li> <li><a href="https://get.helm.sh/helm-v3.20.2-linux-ppc64le.tar.gz">Linux ppc64le</a> (<a href="https://get.helm.sh/helm-v3.20.2-linux-ppc64le.tar.gz.sha256sum">checksum</a> / 98bb26a2f3c0b0c1a50db3181dff192554e0c204a07427d98d6b01e259f23cbe)</li> <li><a href="https://get.helm.sh/helm-v3.20.2-linux-s390x.tar.gz">Linux s390x</a> (<a href="https://get.helm.sh/helm-v3.20.2-linux-s390x.tar.gz.sha256sum">checksum</a> / 584dd77ef8096d6ef939a1822f72840e749fc8311b2b13ae94df5f786862a56b)</li> <li><a href="https://get.helm.sh/helm-v3.20.2-linux-riscv64.tar.gz">Linux riscv64</a> (<a href="https://get.helm.sh/helm-v3.20.2-linux-riscv64.tar.gz.sha256sum">checksum</a> / 957391d0710d72678acd09959b5dc77888cd007a78a4b99944d3b2fc7e1895ca)</li> <li><a href="https://get.helm.sh/helm-v3.20.2-windows-amd64.zip">Windows amd64</a> (<a href="https://get.helm.sh/helm-v3.20.2-windows-amd64.zip.sha256sum">checksum</a> / 24e8e5b71bab4ee17e6f989931ecf4fb144f9916cbe9990c0b6b2ec7b925c454)</li> <li><a href="https://get.helm.sh/helm-v3.20.2-windows-arm64.zip">Windows arm64</a> (<a href="https://get.helm.sh/helm-v3.20.2-windows-arm64.zip.sha256sum">checksum</a> / 7c940a73a6882f50b69aec3282549da4a49917669db18fc503db930fb74b9789)</li> </ul> <p>The <a href="https://helm.sh/docs/intro/quickstart/">Quickstart Guide</a> will get you going from there. For <strong>upgrade instructions</strong> or detailed installation notes, check the <a href="https://helm.sh/docs/intro/install/">install guide</a>. You can also use a <a href="https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3">script to install</a> on any system with <code>bash</code>.</p> <h2>What's Next</h2> <ul> <li>4.1.5 and 3.20.3 are the next patch (bug fix) releases and will be on April 8, 2026</li> <li>4.2.0 and 3.21.0 are the next minor (feature) releases and will be on May 13, 2026</li> </ul> <h2>Changelog</h2> <ul> <li>fix: Chart dot-name path bug 8fb76d6ab555577e98e23b7500009537a471feee (George Jenkins)</li> <li>fix: pin codeql-action/upload-sarif to commit SHA in scorecards workflow 3a8927e275c50cecde273872dad2a5576bd46375 (Terry Howe)</li> </ul> <p>Helm v3.20.1 is a patch release. Users are encouraged to upgrade for the best experience.</p> <p>The community keeps growing, and we'd love to see you there!</p> <ul> <li>Join the discussion in <a href="https://kubernetes.slack.com">Kubernetes Slack</a>:</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/helm/helm/commit/8fb76d6ab555577e98e23b7500009537a471feee"><code>8fb76d6</code></a> fix: Chart dot-name path bug</li> <li><a href="https://github.com/helm/helm/commit/3a8927e275c50cecde273872dad2a5576bd46375"><code>3a8927e</code></a> fix: pin codeql-action/upload-sarif to commit SHA in scorecards workflow</li> <li><a href="https://github.com/helm/helm/commit/a2369ca71c0ef633bf6e4fccd66d634eb379b371"><code>a2369ca</code></a> chore(deps): bump the k8s-io group with 7 updates</li> <li><a href="https://github.com/helm/helm/commit/90e10564f7ae746a153f3a03006e7061a54ad490"><code>90e1056</code></a> add image index test</li> <li><a href="https://github.com/helm/helm/commit/911f2e908ae40b01ca95b857e94b8894043f64fd"><code>911f2e9</code></a> fix pulling charts from OCI indices</li> <li><a href="https://github.com/helm/helm/commit/76dad33fb1a2b6451920429b4f5f2dd575ea71bb"><code>76dad33</code></a> Remove refactorring changes from coalesce_test.go</li> <li><a href="https://github.com/helm/helm/commit/45c12f71407b6054a37d3e425d5293ee79a1ab37"><code>45c12f7</code></a> Fix import</li> <li><a href="https://github.com/helm/helm/commit/26c6f19f967941dbe53bfb5e52d419b3b3e46075"><code>26c6f19</code></a> Update pkg/chart/common/util/coalesce_test.go</li> <li><a href="https://github.com/helm/helm/commit/09f5129d49a14c9336cea6f33adf5f52889915ef"><code>09f5129</code></a> Fix lint warning</li> <li><a href="https://github.com/helm/helm/commit/417deb2b6b7504357b0f580b76f5eed1bb8a5270"><code>417deb2</code></a> Preserve nil values in chart already</li> <li>Additional commits viewable in <a href="https://github.com/helm/helm/compare/v3.19.4...v3.20.2">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=helm.sh/helm/v3&package-manager=go_modules&previous-version=3.19.4&new-version=3.20.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/envoyproxy/ai-gateway/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…ntrouter#2043) **Description** The `gateway.envoyproxy.io/envoy-proxy` annotation is ignored in current Envoy Gateway version, causing AWS examples to ignore the custom EnvoyProxy configuration. Changes: - Replace the legacy annotation with `spec.infrastructure.parametersRef` in Gateway resources. - Move `EnvoyProxy` resources from 'envoy-gateway-system' to the 'default' namespace to match the Gateway and simplify example deployment. - Fixes AWS IRSA and Pod Identity examples which were previously non-functional. Signed-off-by: Lukasz Biegaj <lukasz.biegaj@univio.com> Co-authored-by: Ignasi Barrera <ignasi@tetrate.io>

**Description** Go 1.25.9 and 1.26.2 fix several low CVEs and one high one. This PR upgrades to Go 1.26.2. **Related Issues/PRs (if applicable)** N/A **Special notes for reviewers (if applicable)** N/A --------- Signed-off-by: Ignasi Barrera <nacx@apache.org>

…slateModify (theagentrouter#2050) **Description** ## Summary This PR ensures proper propagation of `context.Context` through the extension server request flow, allowing downstream Kubernetes API calls to respect cancellation and deadlines. The changes primarily affect `internal/extensionserver/post_translate_modify.go` and related test updates in `extensionserver_test.go`. --- ## Fix ```go // BEFORE func (s *Server) PostTranslateModify(_ context.Context, req *...) (*..., error) { err = s.k8sClient.Get(context.Background(), key, &aigwRoute) } // AFTER func (s *Server) PostTranslateModify(ctx context.Context, req *...) (*..., error) { err = s.k8sClient.Get(ctx, key, &aigwRoute) } ``` --- ## Verification All existing unit tests were updated to pass the correct arguments and executed successfully (`go test ./internal/extensionserver/...`). The change was verified by ensuring context flows correctly through the call chain without altering existing behavior, while enabling proper cancellation and timeout handling. Signed-off-by: ashnaaseth2325-oss <ashnaaseth2325@gmail.com>

**Description** This PR adds the response model from the upstream response to the dynamic metadata. This gives the proxy access to the actual model serving the request, unaffected by mode name overrides or other backend routing changes. **Related Issues/PRs (if applicable)** Close theagentrouter#2044 --------- Signed-off-by: William-Rom <william.rom@intility.no>

…r#1863) **Description** Use strict json marshalling and unmarshalling configuration. **Related Issues/PRs (if applicable)** N/A **Special notes for reviewers (if applicable)** N/A --------- Signed-off-by: Ignasi Barrera <nacx@apache.org>

…on header (theagentrouter#2053) **Description** ## Summary This PR fixes a potential index out of bounds panic in `extractSubject` when the `Authorization` header contains a `bearer` scheme without a token. It adds a defensive length check and a corresponding test case in `handlers_test.go`. --- ## Fix ```go // BEFORE parts := strings.SplitN(authzHeader, " ", 2) if !strings.EqualFold(parts[0], "bearer") { return "" } _, _, _ = jwt.NewParser().ParseUnverified(parts[1], &claims) // AFTER parts := strings.SplitN(authzHeader, " ", 2) if !strings.EqualFold(parts[0], "bearer") { return "" } if len(parts) < 2 { return "" } _, _, _ = jwt.NewParser().ParseUnverified(parts[1], &claims) ``` --- ## Verification All unit tests pass locally with `go test ./internal/mcpproxy/...`, including the newly added case for `Authorization: bearer`. The change was also validated by confirming that malformed headers are handled gracefully without causing a panic. Signed-off-by: ashnaaseth2325-oss <ashnaaseth2325@gmail.com>

…er#2055) **Description** Adds a new doc page explaining how and why to run the AI Gateway controller with multiple replicas. The controller has two independent components: - Kubernetes controller — requires leader election for mutable operations - Extension server — read-only gRPC server that scales horizontally Since EG's xDS server communicates with all Envoy instances and each EG replica calls the AIGW extension server, running a single AIGW replica can become a bottleneck. This doc explains the architecture, provides Helm and plain-Deployment configuration examples, and includes an HPA example for dynamic scaling. Note: This doc was written with AI assistance (Claude Code). **Related Issues/PRs (if applicable)** Fixes theagentrouter#1215 **Special notes for reviewers (if applicable)** The new page is at `site/docs/capabilities/scaling.md` (sidebar position 3, autogenerated). The Helm values (`controller.replicaCount`, `controller.leaderElection.enabled`) were verified against `manifests/charts/ai-gateway-helm/values.yaml`. --------- Signed-off-by: Varun Nuthalapati <nuthalapativarun@gmail.com> Co-authored-by: Ignasi Barrera <ignasi@tetrate.io>

**Description** Allow Lua filters configured via `EnvoyExtensionPolicy` to run after the AI Gateway ext_proc filter, consistent with how Wasm filters are already handled. The `afterExtProcFilterPrefixes` slice controls which filters AIGW's ext_proc is inserted before. Wasm was already in this list, but Lua was missing, so Lua filters would end up running before AIGW's ext_proc rather than after it. This prevented users from using Lua scripts to act on AIGW metadata (e.g. the `x-ai-eg-model` header set by ext_proc). This PR adds `EnvoyFilterLua` to `afterExtProcFilterPrefixes` in the same position as `EnvoyFilterWasm`, and adds a corresponding test case. Note: This code was written with AI assistance (Claude Code). **Related Issues/PRs (if applicable)** Fixes theagentrouter#1469 **Special notes for reviewers (if applicable)** The fix follows the exact same pattern used for `EnvoyFilterWasm` (line 799). `EnvoyFilterLua` is defined in the `egv1a1` package (`envoy.filters.http.lua`) so no new dependencies are introduced. Signed-off-by: Varun Nuthalapati <nuthalapativarun@gmail.com> Co-authored-by: Ignasi Barrera <ignasi@tetrate.io>

…uter#2057) Bumps the github-actions group with 4 updates: [dorny/paths-filter](https://github.com/dorny/paths-filter), [codecov/codecov-action](https://github.com/codecov/codecov-action), [docker/login-action](https://github.com/docker/login-action) and [github/codeql-action](https://github.com/github/codeql-action). Updates `dorny/paths-filter` from 61f87a10cd2c304679af17bb73ef192addf33c1c to f3ceefdc7ef57bc2d8560787d4b6c33e44044cec <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md">dorny/paths-filter's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v4.0.0</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/294">Update action runtime to node24</a></li> </ul> <h2>v3.0.3</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/279">Add missing predicate-quantifier</a></li> </ul> <h2>v3.0.2</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/224">Add config parameter for predicate quantifier</a></li> </ul> <h2>v3.0.1</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/133">Compare base and ref when token is empty</a></li> </ul> <h2>v3.0.0</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/210">Update to Node.js 20</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/215">Update all dependencies</a></li> </ul> <h2>v2.11.1</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/167">Update <code>@actions/core</code> to v1.10.0 - Fixes warning about deprecated set-output</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/168">Document need for pull-requests: read permission</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/164">Updating to actions/checkout@v3</a></li> </ul> <h2>v2.11.0</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/157">Set list-files input parameter as not required</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/161">Update Node.js</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/162">Fix incorrect handling of Unicode characters in exec()</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/163">Use Octokit pagination</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/160">Updates real world links</a></li> </ul> <h2>v2.10.2</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/91">Fix getLocalRef() returns wrong ref</a></li> </ul> <h2>v2.10.1</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/85">Improve robustness of change detection</a></li> </ul> <h2>v2.10.0</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/82">Add ref input parameter</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/83">Fix change detection in PR when pullRequest.changed_files is incorrect</a></li> </ul> <h2>v2.9.3</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/78">Fix change detection when base is a tag</a></li> </ul> <h2>v2.9.2</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/75">Fix fetching git history</a></li> </ul> <h2>v2.9.1</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/74">Fix fetching git history + fallback to unshallow repo</a></li> </ul> <h2>v2.9.0</h2>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/dorny/paths-filter/commit/f3ceefdc7ef57bc2d8560787d4b6c33e44044cec"><code>f3ceefd</code></a> fix: use rev-parse instead of branch --show-current for older git compat (<a href="https://redirect.github.com/dorny/paths-filter/issues/303">#303</a>)</li> <li>See full diff in <a href="https://github.com/dorny/paths-filter/compare/61f87a10cd2c304679af17bb73ef192addf33c1c...f3ceefdc7ef57bc2d8560787d4b6c33e44044cec">compare view</a></li> </ul> </details> <br /> Updates `codecov/codecov-action` from 5.5.2 to 6.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/codecov/codecov-action/releases">codecov/codecov-action's releases</a>.</em></p> <blockquote> <h2>v6.0.0</h2> <h2>⚠️ This version introduces support for node24 which make cause breaking changes for systems that do not currently support node24. ⚠️</h2> <h2>What's Changed</h2> <ul> <li>Revert "Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0"" by <a href="https://github.com/thomasrockhu-codecov"><code>@thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1929">codecov/codecov-action#1929</a></li> <li>Th/6.0.0 by <a href="https://github.com/thomasrockhu-codecov"><code>@thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1928">codecov/codecov-action#1928</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v5.5.4...v6.0.0">https://github.com/codecov/codecov-action/compare/v5.5.4...v6.0.0</a></p> <h2>v5.5.4</h2> <p>This is a mirror of <code>v5.5.2</code>. <code>v6</code> will be released which requires <code>node24</code></p> <h2>What's Changed</h2> <ul> <li>Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0" by <a href="https://github.com/thomasrockhu-codecov"><code>@thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1926">codecov/codecov-action#1926</a></li> <li>chore(release): 5.5.4 by <a href="https://github.com/thomasrockhu-codecov"><code>@thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1927">codecov/codecov-action#1927</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v5.5.3...v5.5.4">https://github.com/codecov/codecov-action/compare/v5.5.3...v5.5.4</a></p> <h2>v5.5.3</h2> <h2>What's Changed</h2> <ul> <li>build(deps): bump actions/github-script from 7.0.1 to 8.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/codecov/codecov-action/pull/1874">codecov/codecov-action#1874</a></li> <li>chore(release): bump to 5.5.3 by <a href="https://github.com/thomasrockhu-codecov"><code>@thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1922">codecov/codecov-action#1922</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v5.5.2...v5.5.3">https://github.com/codecov/codecov-action/compare/v5.5.2...v5.5.3</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md">codecov/codecov-action's changelog</a>.</em></p> <blockquote> <h2>v5.5.2</h2> <h3>What's Changed</h3> <p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2">https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2</a></p> <h2>v5.5.1</h2> <h3>What's Changed</h3> <ul> <li>fix: overwrite pr number on fork by <a href="https://github.com/thomasrockhu-codecov"><code>@thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1871">codecov/codecov-action#1871</a></li> <li>build(deps): bump actions/checkout from 4.2.2 to 5.0.0 by <code>@app/dependabot</code> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1868">codecov/codecov-action#1868</a></li> <li>build(deps): bump github/codeql-action from 3.29.9 to 3.29.11 by <code>@app/dependabot</code> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1867">codecov/codecov-action#1867</a></li> <li>fix: update to use local app/ dir by <a href="https://github.com/thomasrockhu-codecov"><code>@thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1872">codecov/codecov-action#1872</a></li> <li>docs: fix typo in README by <a href="https://github.com/datalater"><code>@datalater</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1866">codecov/codecov-action#1866</a></li> <li>Document a <code>codecov-cli</code> version reference example by <a href="https://github.com/webknjaz"><code>@webknjaz</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1774">codecov/codecov-action#1774</a></li> <li>build(deps): bump github/codeql-action from 3.28.18 to 3.29.9 by <code>@app/dependabot</code> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1861">codecov/codecov-action#1861</a></li> <li>build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by <code>@app/dependabot</code> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1833">codecov/codecov-action#1833</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1">https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1</a></p> <h2>v5.5.0</h2> <h3>What's Changed</h3> <ul> <li>feat: upgrade wrapper to 0.2.4 by <a href="https://github.com/jviall"><code>@jviall</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1864">codecov/codecov-action#1864</a></li> <li>Pin actions/github-script by Git SHA by <a href="https://github.com/martincostello"><code>@martincostello</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1859">codecov/codecov-action#1859</a></li> <li>fix: check reqs exist by <a href="https://github.com/joseph-sentry"><code>@joseph-sentry</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1835">codecov/codecov-action#1835</a></li> <li>fix: Typo in README by <a href="https://github.com/spalmurray"><code>@spalmurray</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1838">codecov/codecov-action#1838</a></li> <li>docs: Refine OIDC docs by <a href="https://github.com/spalmurray"><code>@spalmurray</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1837">codecov/codecov-action#1837</a></li> <li>build(deps): bump github/codeql-action from 3.28.17 to 3.28.18 by <code>@app/dependabot</code> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1829">codecov/codecov-action#1829</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0">https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0</a></p> <h2>v5.4.3</h2> <h3>What's Changed</h3> <ul> <li>build(deps): bump github/codeql-action from 3.28.13 to 3.28.17 by <code>@app/dependabot</code> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1822">codecov/codecov-action#1822</a></li> <li>fix: OIDC on forks by <a href="https://github.com/joseph-sentry"><code>@joseph-sentry</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1823">codecov/codecov-action#1823</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3">https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3</a></p> <h2>v5.4.2</h2>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/codecov/codecov-action/commit/57e3a136b779b570ffcdbf80b3bdc90e7fab3de2"><code>57e3a13</code></a> Th/6.0.0 (<a href="https://redirect.github.com/codecov/codecov-action/issues/1928">#1928</a>)</li> <li><a href="https://github.com/codecov/codecov-action/commit/f67d33dda8a42b51c42a8318a1f66468119e898b"><code>f67d33d</code></a> Revert "Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0""...</li> <li><a href="https://github.com/codecov/codecov-action/commit/75cd11691c0faa626561e295848008c8a7dddffe"><code>75cd116</code></a> chore(release): 5.5.4 (<a href="https://redirect.github.com/codecov/codecov-action/issues/1927">#1927</a>)</li> <li><a href="https://github.com/codecov/codecov-action/commit/87d39f4a2cec2673cf9505764fb20a38792ea722"><code>87d39f4</code></a> Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0" (<a href="https://redirect.github.com/codecov/codecov-action/issues/1926">#1926</a>)</li> <li><a href="https://github.com/codecov/codecov-action/commit/1af58845a975a7985b0beb0cbe6fbbb71a41dbad"><code>1af5884</code></a> chore(release): bump to 5.5.3 (<a href="https://redirect.github.com/codecov/codecov-action/issues/1922">#1922</a>)</li> <li><a href="https://github.com/codecov/codecov-action/commit/c143300dea6c9a730986ff862c5bf4d458927ef8"><code>c143300</code></a> build(deps): bump actions/github-script from 7.0.1 to 8.0.0 (<a href="https://redirect.github.com/codecov/codecov-action/issues/1874">#1874</a>)</li> <li>See full diff in <a href="https://github.com/codecov/codecov-action/compare/671740ac38dd9b0130fbe1cec585b89eea48d3de...57e3a136b779b570ffcdbf80b3bdc90e7fab3de2">compare view</a></li> </ul> </details> <br /> Updates `docker/login-action` from 3.7.0 to 4.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/docker/login-action/releases">docker/login-action's releases</a>.</em></p> <blockquote> <h2>v4.1.0</h2> <ul> <li>Fix scoped Docker Hub cleanup path when registry is omitted by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/login-action/pull/945">docker/login-action#945</a></li> <li>Bump <code>@aws-sdk/client-ecr</code> and <code>@aws-sdk/client-ecr-public</code> to 3.1020.0 in <a href="https://redirect.github.com/docker/login-action/pull/930">docker/login-action#930</a></li> <li>Bump <code>@docker/actions-toolkit</code> from 0.77.0 to 0.86.0 in <a href="https://redirect.github.com/docker/login-action/pull/932">docker/login-action#932</a> <a href="https://redirect.github.com/docker/login-action/pull/936">docker/login-action#936</a></li> <li>Bump brace-expansion from 1.1.12 to 1.1.13 in <a href="https://redirect.github.com/docker/login-action/pull/952">docker/login-action#952</a></li> <li>Bump fast-xml-parser from 5.3.4 to 5.3.6 in <a href="https://redirect.github.com/docker/login-action/pull/942">docker/login-action#942</a></li> <li>Bump flatted from 3.3.3 to 3.4.2 in <a href="https://redirect.github.com/docker/login-action/pull/944">docker/login-action#944</a></li> <li>Bump glob from 10.3.12 to 10.5.0 in <a href="https://redirect.github.com/docker/login-action/pull/940">docker/login-action#940</a></li> <li>Bump handlebars from 4.7.8 to 4.7.9 in <a href="https://redirect.github.com/docker/login-action/pull/949">docker/login-action#949</a></li> <li>Bump http-proxy-agent and https-proxy-agent to 8.0.0 in <a href="https://redirect.github.com/docker/login-action/pull/937">docker/login-action#937</a></li> <li>Bump lodash from 4.17.23 to 4.18.1 in <a href="https://redirect.github.com/docker/login-action/pull/958">docker/login-action#958</a></li> <li>Bump minimatch from 3.1.2 to 3.1.5 in <a href="https://redirect.github.com/docker/login-action/pull/941">docker/login-action#941</a></li> <li>Bump picomatch from 4.0.3 to 4.0.4 in <a href="https://redirect.github.com/docker/login-action/pull/948">docker/login-action#948</a></li> <li>Bump undici from 6.23.0 to 6.24.1 in <a href="https://redirect.github.com/docker/login-action/pull/938">docker/login-action#938</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/login-action/compare/v4.0.0...v4.1.0">https://github.com/docker/login-action/compare/v4.0.0...v4.1.0</a></p> <h2>v4.0.0</h2> <ul> <li>Node 24 as default runtime (requires <a href="https://github.com/actions/runner/releases/tag/v2.327.1">Actions Runner v2.327.1</a> or later) by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/login-action/pull/929">docker/login-action#929</a></li> <li>Switch to ESM and update config/test wiring by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/login-action/pull/927">docker/login-action#927</a></li> <li>Bump <code>@actions/core</code> from 1.11.1 to 3.0.0 in <a href="https://redirect.github.com/docker/login-action/pull/919">docker/login-action#919</a></li> <li>Bump <code>@aws-sdk/client-ecr</code> from 3.890.0 to 3.1000.0 in <a href="https://redirect.github.com/docker/login-action/pull/909">docker/login-action#909</a> <a href="https://redirect.github.com/docker/login-action/pull/920">docker/login-action#920</a></li> <li>Bump <code>@aws-sdk/client-ecr-public</code> from 3.890.0 to 3.1000.0 in <a href="https://redirect.github.com/docker/login-action/pull/909">docker/login-action#909</a> <a href="https://redirect.github.com/docker/login-action/pull/920">docker/login-action#920</a></li> <li>Bump <code>@docker/actions-toolkit</code> from 0.63.0 to 0.77.0 in <a href="https://redirect.github.com/docker/login-action/pull/910">docker/login-action#910</a> <a href="https://redirect.github.com/docker/login-action/pull/928">docker/login-action#928</a></li> <li>Bump <code>@isaacs/brace-expansion</code> from 5.0.0 to 5.0.1 in <a href="https://redirect.github.com/docker/login-action/pull/921">docker/login-action#921</a></li> <li>Bump js-yaml from 4.1.0 to 4.1.1 in <a href="https://redirect.github.com/docker/login-action/pull/901">docker/login-action#901</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/login-action/compare/v3.7.0...v4.0.0">https://github.com/docker/login-action/compare/v3.7.0...v4.0.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/docker/login-action/commit/4907a6ddec9925e35a0a9e82d7399ccc52663121"><code>4907a6d</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/930">#930</a> from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...</li> <li><a href="https://github.com/docker/login-action/commit/1e233e691a8881d7f35ca7c2d5dfaaed80b39636"><code>1e233e6</code></a> chore: update generated content</li> <li><a href="https://github.com/docker/login-action/commit/6c24ead68057f18c30c808a431f0b85dc25663cb"><code>6c24ead</code></a> build(deps): bump the aws-sdk-dependencies group with 2 updates</li> <li><a href="https://github.com/docker/login-action/commit/ee034d70944e3546349cd24295914f139342f1e6"><code>ee034d7</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/958">#958</a> from docker/dependabot/npm_and_yarn/lodash-4.18.1</li> <li><a href="https://github.com/docker/login-action/commit/1527209db9734bd2352a2dc1a63d79c9aa5358bb"><code>1527209</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/937">#937</a> from docker/dependabot/npm_and_yarn/proxy-agent-depen...</li> <li><a href="https://github.com/docker/login-action/commit/d39362aba4d72f8d9d93e0962119840690133e1b"><code>d39362a</code></a> build(deps): bump lodash from 4.17.23 to 4.18.1</li> <li><a href="https://github.com/docker/login-action/commit/a6f092b568105cbb6d9deb7e55e0a4c5c1025fce"><code>a6f092b</code></a> chore: update generated content</li> <li><a href="https://github.com/docker/login-action/commit/60953f0bed2120ec69659d271fe18d34bc069779"><code>60953f0</code></a> build(deps): bump the proxy-agent-dependencies group with 2 updates</li> <li><a href="https://github.com/docker/login-action/commit/62c688590fb4ab6c6e89a217ced0a7b2ddcf1340"><code>62c6885</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/936">#936</a> from docker/dependabot/npm_and_yarn/docker/actions-to...</li> <li><a href="https://github.com/docker/login-action/commit/102c0e672992d2e992c89b6f4808d65a353b5a1a"><code>102c0e6</code></a> chore: update generated content</li> <li>Additional commits viewable in <a href="https://github.com/docker/login-action/compare/c94ce9fb468520275223c153574b00df6fe4bcc9...4907a6ddec9925e35a0a9e82d7399ccc52663121">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action` from 4.32.4 to 4.35.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action's releases</a>.</em></p> <blockquote> <h2>v4.35.1</h2> <ul> <li>Fix incorrect minimum required Git version for <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a>: it should have been 2.36.0, not 2.11.0. <a href="https://redirect.github.com/github/codeql-action/pull/3781">#3781</a></li> </ul> <h2>v4.35.0</h2> <ul> <li>Reduced the minimum Git version required for <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> from 2.38.0 to 2.11.0. <a href="https://redirect.github.com/github/codeql-action/pull/3767">#3767</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1">2.25.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3773">#3773</a></li> </ul> <h2>v4.34.1</h2> <ul> <li>Downgrade default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3">2.24.3</a> due to issues with a small percentage of Actions and JavaScript analyses. <a href="https://redirect.github.com/github/codeql-action/pull/3762">#3762</a></li> </ul> <h2>v4.34.0</h2> <ul> <li>Added an experimental change which disables TRAP caching when <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. <a href="https://redirect.github.com/github/codeql-action/pull/3569">#3569</a></li> <li>We are rolling out improved incremental analysis to C/C++ analyses that use build mode <code>none</code>. We expect this rollout to be complete by the end of April 2026. <a href="https://redirect.github.com/github/codeql-action/pull/3584">#3584</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.0">2.25.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3585">#3585</a></li> </ul> <h2>v4.33.0</h2> <ul> <li> <p>Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. <a href="https://redirect.github.com/github/codeql-action/pull/3562">#3562</a></p> <p>To opt out of this change:</p> <ul> <li><strong>Repositories owned by an organization:</strong> Create a custom repository property with the name <code>github-codeql-file-coverage-on-prs</code> and the type "True/false", then set this property to <code>true</code> in the repository's settings. For more information, see <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">Managing custom properties for repositories in your organization</a>. Alternatively, if you are using an advanced setup workflow, you can set the <code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable to <code>true</code> in your workflow.</li> <li><strong>User-owned repositories using default setup:</strong> Switch to an advanced setup workflow and set the <code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable to <code>true</code> in your workflow.</li> <li><strong>User-owned repositories using advanced setup:</strong> Set the <code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable to <code>true</code> in your workflow.</li> </ul> </li> <li> <p>Fixed <a href="https://redirect.github.com/github/codeql-action/issues/3555">a bug</a> which caused the CodeQL Action to fail loading repository properties if a "Multi select" repository property was configured for the repository. <a href="https://redirect.github.com/github/codeql-action/pull/3557">#3557</a></p> </li> <li> <p>The CodeQL Action now loads <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">custom repository properties</a> on GitHub Enterprise Server, enabling the customization of features such as <code>github-codeql-disable-overlay</code> that was previously only available on GitHub.com. <a href="https://redirect.github.com/github/codeql-action/pull/3559">#3559</a></p> </li> <li> <p>Once <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">private package registries</a> can be configured with OIDC-based authentication for organizations, the CodeQL Action will now be able to accept such configurations. <a href="https://redirect.github.com/github/codeql-action/pull/3563">#3563</a></p> </li> <li> <p>Fixed the retry mechanism for database uploads. Previously this would fail with the error "Response body object should not be disturbed or locked". <a href="https://redirect.github.com/github/codeql-action/pull/3564">#3564</a></p> </li> <li> <p>A warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3570">#3570</a></p> </li> </ul> <h2>v4.32.6</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3">2.24.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3548">#3548</a></li> </ul> <h2>v4.32.5</h2> <ul> <li>Repositories owned by an organization can now set up the <code>github-codeql-disable-overlay</code> custom repository property to disable <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis for CodeQL</a>. First, create a custom repository property with the name <code>github-codeql-disable-overlay</code> and the type "True/false" in the organization's settings. Then in the repository's settings, set this property to <code>true</code> to disable improved incremental analysis. For more information, see <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">Managing custom properties for repositories in your organization</a>. This feature is not yet available on GitHub Enterprise Server. <a href="https://redirect.github.com/github/codeql-action/pull/3507">#3507</a></li> <li>Added an experimental change so that when <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> fails on a runner — potentially due to insufficient disk space — the failure is recorded in the Actions cache so that subsequent runs will automatically skip improved incremental analysis until something changes (e.g. a larger runner is provisioned or a new CodeQL version is released). We expect to roll this change out to everyone in March. <a href="https://redirect.github.com/github/codeql-action/pull/3487">#3487</a></li> <li>The minimum memory check for improved incremental analysis is now skipped for CodeQL 2.24.3 and later, which has reduced peak RAM usage. <a href="https://redirect.github.com/github/codeql-action/pull/3515">#3515</a></li> <li>Reduced log levels for best-effort private package registry connection check failures to reduce noise from workflow annotations. <a href="https://redirect.github.com/github/codeql-action/pull/3516">#3516</a></li> <li>Added an experimental change which lowers the minimum disk space requirement for <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a>, enabling it to run on standard GitHub Actions runners. We expect to roll this change out to everyone in March. <a href="https://redirect.github.com/github/codeql-action/pull/3498">#3498</a></li> <li>Added an experimental change which allows the <code>start-proxy</code> action to resolve the CodeQL CLI version from feature flags instead of using the linked CLI bundle version. We expect to roll this change out to everyone in March. <a href="https://redirect.github.com/github/codeql-action/pull/3512">#3512</a></li> <li>The previously experimental changes from versions 4.32.3, 4.32.4, 3.32.3 and 3.32.4 are now enabled by default. <a href="https://redirect.github.com/github/codeql-action/pull/3503">#3503</a>, <a href="https://redirect.github.com/github/codeql-action/pull/3504">#3504</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.35.2 - 15 Apr 2026</h2> <ul> <li>The undocumented TRAP cache cleanup feature that could be enabled using the <code>CODEQL_ACTION_CLEANUP_TRAP_CACHES</code> environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the <code>trap-caching: false</code> input to the <code>init</code> Action. <a href="https://redirect.github.com/github/codeql-action/pull/3795">#3795</a></li> <li>The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. <a href="https://redirect.github.com/github/codeql-action/pull/3789">#3789</a></li> <li>Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. <a href="https://redirect.github.com/github/codeql-action/pull/3794">#3794</a></li> <li>Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. <a href="https://redirect.github.com/github/codeql-action/pull/3807">#3807</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2">2.25.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3823">#3823</a></li> </ul> <h2>4.35.1 - 27 Mar 2026</h2> <ul> <li>Fix incorrect minimum required Git version for <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a>: it should have been 2.36.0, not 2.11.0. <a href="https://redirect.github.com/github/codeql-action/pull/3781">#3781</a></li> </ul> <h2>4.35.0 - 27 Mar 2026</h2> <ul> <li>Reduced the minimum Git version required for <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> from 2.38.0 to 2.11.0. <a href="https://redirect.github.com/github/codeql-action/pull/3767">#3767</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1">2.25.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3773">#3773</a></li> </ul> <h2>4.34.1 - 20 Mar 2026</h2> <ul> <li>Downgrade default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3">2.24.3</a> due to issues with a small percentage of Actions and JavaScript analyses. <a href="https://redirect.github.com/github/codeql-action/pull/3762">#3762</a></li> </ul> <h2>4.34.0 - 20 Mar 2026</h2> <ul> <li>Added an experimental change which disables TRAP caching when <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. <a href="https://redirect.github.com/github/codeql-action/pull/3569">#3569</a></li> <li>We are rolling out improved incremental analysis to C/C++ analyses that use build mode <code>none</code>. We expect this rollout to be complete by the end of April 2026. <a href="https://redirect.github.com/github/codeql-action/pull/3584">#3584</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.0">2.25.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3585">#3585</a></li> </ul> <h2>4.33.0 - 16 Mar 2026</h2> <ul> <li> <p>Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. <a href="https://redirect.github.com/github/codeql-action/pull/3562">#3562</a></p> <p>To opt out of this change:</p> <ul> <li><strong>Repositories owned by an organization:</strong> Create a custom repository property with the name <code>github-codeql-file-coverage-on-prs</code> and the type "True/false", then set this property to <code>true</code> in the repository's settings. For more information, see <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">Managing custom properties for repositories in your organization</a>. Alternatively, if you are using an advanced setup workflow, you can set the <code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable to <code>true</code> in your workflow.</li> <li><strong>User-owned repositories using default setup:</strong> Switch to an advanced setup workflow and set the <code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable to <code>true</code> in your workflow.</li> <li><strong>User-owned repositories using advanced setup:</strong> Set the <code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable to <code>true</code> in your workflow.</li> </ul> </li> <li> <p>Fixed <a href="https://redirect.github.com/github/codeql-action/issues/3555">a bug</a> which caused the CodeQL Action to fail loading repository properties if a "Multi select" repository property was configured for the repository. <a href="https://redirect.github.com/github/codeql-action/pull/3557">#3557</a></p> </li> <li> <p>The CodeQL Action now loads <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">custom repository properties</a> on GitHub Enterprise Server, enabling the customization of features such as <code>github-codeql-disable-overlay</code> that was previously only available on GitHub.com. <a href="https://redirect.github.com/github/codeql-action/pull/3559">#3559</a></p> </li> <li> <p>Once <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">private package registries</a> can be configured with OIDC-based authentication for organizations, the CodeQL Action will now be able to accept such configurations. <a href="https://redirect.github.com/github/codeql-action/pull/3563">#3563</a></p> </li> <li> <p>Fixed the retry mechanism for database uploads. Previously this would fail with the error "Response body object should not be disturbed or locked". <a href="https://redirect.github.com/github/codeql-action/pull/3564">#3564</a></p> </li> <li> <p>A warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3570">#3570</a></p> </li> </ul> <h2>4.32.6 - 05 Mar 2026</h2>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/95e58e9a2cdfd71adc6e0353d5c52f41a045d225"><code>95e58e9</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3824">#3824</a> from github/update-v4.35.2-d2e135a73</li> <li><a href="https://github.com/github/codeql-action/commit/6f31bfe060e817d81e938dbec767969d20031e25"><code>6f31bfe</code></a> Update changelog for v4.35.2</li> <li><a href="https://github.com/github/codeql-action/commit/d2e135a73a39154e3a231aeb49163c4661c5b8b1"><code>d2e135a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3823">#3823</a> from github/update-bundle/codeql-bundle-v2.25.2</li> <li><a href="https://github.com/github/codeql-action/commit/60abb65df09fcf213c398e064c8a80db1f15cdaf"><code>60abb65</code></a> Add changelog note</li> <li><a href="https://github.com/github/codeql-action/commit/5a0a562209255e956ad8aafcee303294e64eefa2"><code>5a0a562</code></a> Update default bundle to codeql-bundle-v2.25.2</li> <li><a href="https://github.com/github/codeql-action/commit/65216971a11ded447a6b76263d5a144519e5eee1"><code>6521697</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3820">#3820</a> from github/dependabot/github_actions/dot-github/wor...</li> <li><a href="https://github.com/github/codeql-action/commit/3c45af2dd258e1623af1898da5c86545b514e028"><code>3c45af2</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3821">#3821</a> from github/dependabot/npm_and_yarn/npm-minor-345b93...</li> <li><a href="https://github.com/github/codeql-action/commit/f1c339364c12f922998186ed897e45e3b4ae8874"><code>f1c3393</code></a> Rebuild</li> <li><a href="https://github.com/github/codeql-action/commit/1024fc496c87e944a93e98d8cf2c09e2c7602a30"><code>1024fc4</code></a> Rebuild</li> <li><a href="https://github.com/github/codeql-action/commit/9dd4cfed96030ccdfe1af4daf7a7964322704fed"><code>9dd4cfe</code></a> Bump the npm-minor group across 1 directory with 6 updates</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/89a39a4e59826350b863aa6b6252a07ad50cf83e...95e58e9a2cdfd71adc6e0353d5c52f41a045d225">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…agentrouter#2068) Bumps [github.com/moby/spdystream](https://github.com/moby/spdystream) from 0.5.0 to 0.5.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/moby/spdystream/releases">github.com/moby/spdystream's releases</a>.</em></p> <blockquote> <h2>v0.5.1</h2> <h2>What's Changed</h2> <ul> <li>spdy: fix duplicate license headers, add LICENSE, PATENTS, and update NOTICE <a href="https://redirect.github.com/moby/spdystream/pull/106">moby/spdystream#106</a></li> <li>ci: update actions and test against latest Go versions <a href="https://redirect.github.com/moby/spdystream/pull/107">moby/spdystream#107</a></li> <li>use ioutil.Discard for go1.13 compatibility <a href="https://redirect.github.com/moby/spdystream/pull/109">moby/spdystream#109</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/moby/spdystream/compare/v0.5.0...v0.5.1">https://github.com/moby/spdystream/compare/v0.5.0...v0.5.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/moby/spdystream/commit/c59e5d73daa301bde452ea77545bdf51e32554a2"><code>c59e5d7</code></a> Merge pull request <a href="https://redirect.github.com/moby/spdystream/issues/109">#109</a> from thaJeztah/use_ioutil</li> <li><a href="https://github.com/moby/spdystream/commit/2fd0155e904f1f9b834b8460e8fdb8522bb59f84"><code>2fd0155</code></a> use ioutil.Discard for go1.13 compatibility</li> <li><a href="https://github.com/moby/spdystream/commit/ef6121f62c730110bf5ae604a865a8613bfb787f"><code>ef6121f</code></a> Merge commit from fork</li> <li><a href="https://github.com/moby/spdystream/commit/241cec95b8f02919845dc4758f1f5310fc886739"><code>241cec9</code></a> compare with signed Int for 32-bit Arm</li> <li><a href="https://github.com/moby/spdystream/commit/21c38640c8c8f43173b17e5bc6690a5fa25d6935"><code>21c3864</code></a> Add options to customize limits</li> <li><a href="https://github.com/moby/spdystream/commit/acf9b456d06816c5cf23bf3892e13441f947d5fd"><code>acf9b45</code></a> spdy: update godoc for MaxDataLength</li> <li><a href="https://github.com/moby/spdystream/commit/eb6360582bf1343f485ca87b76efc9e72b49d690"><code>eb63605</code></a> spdy: limit header-size and header-count</li> <li><a href="https://github.com/moby/spdystream/commit/2f21da42eaab90f03a82fb03d0de8e91eb1d0fc6"><code>2f21da4</code></a> spdy: fix header block byte accounting</li> <li><a href="https://github.com/moby/spdystream/commit/5976b6612f07a27f2e9a4de875485defb43b5d50"><code>5976b66</code></a> spdy: enforce 24-bit frame length limits</li> <li><a href="https://github.com/moby/spdystream/commit/cf0ec5d0fe4dbb2f3525f733946e0d0ddbfd5b13"><code>cf0ec5d</code></a> Guard against oversized SPDY frames</li> <li>Additional commits viewable in <a href="https://github.com/moby/spdystream/compare/v0.5.0...v0.5.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/moby/spdystream&package-manager=go_modules&previous-version=0.5.0&new-version=0.5.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/envoyproxy/ai-gateway/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…n /tools (theagentrouter#2069) Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.17.1 to 5.18.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-git/go-git/releases">github.com/go-git/go-git/v5's releases</a>.</em></p> <blockquote> <h2>v5.18.0</h2> <h2>What's Changed</h2> <ul> <li>plumbing: transport/http, Add support for followRedirects policy by <a href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2004">go-git/go-git#2004</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.17.2...v5.18.0">https://github.com/go-git/go-git/compare/v5.17.2...v5.18.0</a></p> <h2>v5.17.2</h2> <h2>What's Changed</h2> <ul> <li>build: Update module github.com/go-git/go-git/v5 to v5.17.1 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/1941">go-git/go-git#1941</a></li> <li>dotgit: skip writing pack files that already exist on disk by <a href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1944">go-git/go-git#1944</a></li> </ul> <p>:warning: This release fixes a bug (<a href="https://redirect.github.com/go-git/go-git/issues/1942">go-git/go-git#1942</a>) that blocked some users from upgrading to <code>v5.17.1</code>. Thanks <a href="https://github.com/pskrbasu"><code>@pskrbasu</code></a> for reporting it. 🙇</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.17.1...v5.17.2">https://github.com/go-git/go-git/compare/v5.17.1...v5.17.2</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-git/go-git/commit/ea3e7ec9dfc54f577a01afb4dd601c0284604264"><code>ea3e7ec</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2004">#2004</a> from go-git/v5-http-hardening</li> <li><a href="https://github.com/go-git/go-git/commit/bcd20a9c525826081262a06a9ed9c3167abfcd53"><code>bcd20a9</code></a> plumbing: transport/http, Add support for followRedirects policy</li> <li><a href="https://github.com/go-git/go-git/commit/45ae193b3a60aa8ec8a3e373f7265a7819473d5f"><code>45ae193</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/1944">#1944</a> from go-git/fix-perms</li> <li><a href="https://github.com/go-git/go-git/commit/fda4f7464b597ff33d2dea1c026482a5e900037c"><code>fda4f74</code></a> storage: filesystem/dotgit, Skip writing pack files that already exist on disk</li> <li><a href="https://github.com/go-git/go-git/commit/2212dc7caeb2a389fe2129923811ef63f75a557a"><code>2212dc7</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/1941">#1941</a> from go-git/renovate/releases/v5.x-go-github.com-go-...</li> <li><a href="https://github.com/go-git/go-git/commit/ebb2d7da7f5d5aebeaa0b5e13276d72d602c1ae3"><code>ebb2d7d</code></a> build: Update module github.com/go-git/go-git/v5 to v5.17.1 [SECURITY]</li> <li>See full diff in <a href="https://github.com/go-git/go-git/compare/v5.17.1...v5.18.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-git/go-git/v5&package-manager=go_modules&previous-version=5.17.1&new-version=5.18.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/envoyproxy/ai-gateway/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…router#2029) **Description** This PR is an alternative to theagentrouter#1780 's implementation. It fixes pre-route LLMRequestCosts configuration, allowing different routes to use different CEL calculation formulas for the same metadataKey. Previously even if a user configures different LLMRequestsCosts for each route with same metadataKey, the implementation would pick one of the LLMRequestsCosts and apply it globally to all the routes. this PR fixes that implementation theagentrouter#1780 also implemented the same thing but by combining CEL expressions from all routes into a single CEL expression. this ran into CEL length limitations. This PR instead stores individual route-specific CELs in extproc's filterconfig and allows extrpoc to choose among them based on the route used by the current requests. This PR also introduces GlobalLLMRequestCosts in GatewayConfig allowing to configure LLMRequestCosts that apply to all routes. during conflicts route-specific costs are prioritized over global costs. **Breaking Change:** This PR fixes the existing issue where if one ai-gateway route CR had LLMRequestCosts configured they will be applied to all route (even if they are not configured with it). After this PR is merged, costs will apply only to the route on which they are configured. Users can instead configure GatewayConfig.GlobalLLMRequestCosts to configure costs that apply to all routes. **Related Issues/PRs (if applicable)** Fixes: theagentrouter#1688 Related PR: theagentrouter#1780 --------- Signed-off-by: jonasHanhan <zqhmusic121@gmail.com> Signed-off-by: Aaron Choo <achoo30@bloomberg.net> Signed-off-by: Sukumar Gaonkar <sgaonkar4@bloomberg.net> Co-authored-by: jonasHanhan <zqhmusic121@gmail.com> Co-authored-by: Aaron Choo <achoo30@bloomberg.net>

@aabchoo

**Description** - Add missing OfAdaptive thinking config handling: `getThinkingConfigParamUnion` only handled `OfEnabled` and `OfDisabled`, silently dropping `{"type": "adaptive"}` thinking configs. theagentrouter#1842 - Fix `reasoning_effort` model support: The `reasoning_effort` → `output_config.effort` mapping was incorrectly using `outputConfigAvailable`, which includes models that don't support the effort parameter (e.g., Claude Sonnet 4.5, Claude Haiku 4.5). Added a new effortAvailable function to use a list as suggested by @aabchoo so that correctly limits effort support to Claude Opus 4.6, Claude Sonnet 4.6, and Claude Opus 4.5. Referece: https://platform.claude.com/docs/en/build-with-claude/effort theagentrouter#1892 --------- Signed-off-by: yxia216 <yxia216@bloomberg.net>

**Description** Adds the information of the tool being called to Envoy access logs for MCP. **Related Issues/PRs (if applicable)** Fixes theagentrouter#2059 **Special notes for reviewers (if applicable)** N/A Signed-off-by: Ignasi Barrera <nacx@apache.org>

…Credentials (theagentrouter#1979) **Description** Add support for GKE Workload Identity via Application Default Credentials (ADC). When neither `credentialsFile` nor `workloadIdentityFederationConfig` is specified in `BackendSecurityPolicyGCPCredentials`, the extproc now uses ADC to obtain tokens dynamically. This enables GKE Workload Identity without additional configuration, matching the existing AWS IRSA/Pod Identity pattern. **Related Issues/PRs (if applicable)** **Special notes for reviewers (if applicable)** This PR was developed with AI assistance (Claude). All changes were reviewed by human. --------- Signed-off-by: Rajat Vig <rvig@etsy.com> Co-authored-by: Ignasi Barrera <ignasi@tetrate.io>

…theagentrouter#2064) **Description** The OTEL Go SDK defaults SpanLimits.AttributeCountLimit to 128. In LLM tracing, each conversation message generates multiple indexed span attributes (role, content, tool calls), so a conversation with 100+ messages easily exceeds this limit. The SDK silently drops excess attributes, and since header-mapped attributes (session IDs, user emails) are set last, they are always the first to be lost — appearing in production as "incomplete traces" with no error or log. Uses WithRawSpanLimits (not the deprecated WithSpanLimits, which silently replaces negative values with the default) to set AttributeCountLimit to -1 (unlimited), gated on OpenInference message capture being enabled via a new TraceConfig.CapturesMessages() helper. When operators opt out via OPENINFERENCE_HIDE_INPUTS / HIDE_OUTPUTS / HIDE_INPUT_MESSAGES / HIDE_OUTPUT_MESSAGES, the recorders emit no high-cardinality attributes and OTEL's default limit is preserved. NewSpanLimits() is used as the base so all other limits (value length, event count, etc.) keep their defaults and respect environment variable overrides. Closes theagentrouter#2051 --------- Signed-off-by: Edan Binshtok <edan.binshtok@gmail.com> Co-authored-by: Ignasi Barrera <ignasi@tetrate.io>

…r#2075) **Description** Fixed the issue where `HTTPRoute` and `HTTPRouteFilter` were left behind as orphaned resources when `backendRefs` were removed from `MCPRoute`. To avoid performance impact even in workloads with many HTTPRoute resources, such as large-scale environments, made the processing more efficient by adding an index on the OwnerRef set by MCPRoute. **Related Issues/PRs (if applicable)** Fixes theagentrouter#1814 **Special notes for reviewers (if applicable)** N/A --------- Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> Co-authored-by: Ignasi Barrera <ignasi@tetrate.io>

…rename support (theagentrouter#2047) **Description** Add per-backend `forwardHeaders` to `MCPRouteBackendRef`, enabling explicit header forwarding from client requests to individual backend MCP servers with optional header renaming. This supports per-user authentication passthrough (e.g., personal access tokens) without requiring OAuth configuration, and ensures headers are only forwarded to explicitly opted-in backends. **Related Issues/PRs (if applicable)** Ref theagentrouter#1966 **Motivation** Many MCP backends (Atlassian, Glean, Sourcegraph, etc.) accept per-user authentication via custom HTTP headers. Currently, the only way to populate forwardHeaders in the internal filter config is through OAuth claimToHeaders, which requires a full OIDC flow. For simpler scenarios — enterprise users passing personal access tokens — a direct header passthrough is more ergonomic and deployment-friendly. Per the discussion in theagentrouter#1966, maintainers preferred per-backend forwarding on MCPRouteBackendRef to avoid leaking tokens to unrelated backends during fan-out operations like tools/list. **Changes** | Layer | File | Change | |-------|------|--------| | CRD | api/v1alpha1/mcp_route.go | Add MCPHeaderForward type (name + optional backendHeader for rename). Add ForwardHeaders to MCPRouteBackendRef | | CRD | api/v1alpha1/zz_generated.deepcopy.go | DeepCopy for MCPHeaderForward and updated MCPRouteBackendRef | | Internal API | internal/filterapi/mcpconfig.go | Add MCPHeaderForward and ForwardHeaders to MCPBackend | | Controller | internal/controller/gateway.go | Read per-backend ForwardHeaders from CRD and populate filterapi.MCPBackend | | Proxy | internal/mcpproxy/handlers.go | Add extractPerBackendForwardHeaders() with rename support | | Proxy | internal/mcpproxy/mcpproxy.go | Populate perBackendExtraHeaders in session creation and reconstruction | | Proxy | internal/mcpproxy/session.go | Add perBackendExtraHeaders to session; apply per-backend in sendRequestPerBackend | | Docs | site/docs/capabilities/mcp/index.md | Add "Header Forwarding" section with usage examples | | Docs | site/versioned_docs/version-0.5/capabilities/mcp/index.md | Same doc update for v0.5 | **Design** Headers are forwarded at two levels: 1. **Route-level** (MCPRoute.ForwardHeaders in filterapi) — populated by OAuth claimToHeaders only. Applied to ALL backends in the route (backward compatible with existing behavior). 2. **Per-backend** (MCPRouteBackendRef.ForwardHeaders) — new. Applied only to the specific backend. Each entry specifies: - name: the header to extract from the client request - backendHeader (optional): the header name to use when forwarding (enables renaming, e.g., Authorization -> X-Backend-Token) During fan-out operations (tools/list, resources/list), only explicitly opted-in backends receive the forwarded headers. This prevents token leakage to unrelated backends. **Example Usage** ```yaml apiVersion: aigateway.envoyproxy.io/v1alpha1 kind: MCPRoute metadata: name: all-route spec: path: "/mcp" backendRefs: - name: atlassian-mcp port: 8080 forwardHeaders: - name: X-Atlassian-Jira-Personal-Token - name: X-Atlassian-Jira-Url - name: Authorization backendHeader: X-Original-Auth # rename example - name: sourcegraph-mcp port: 9090 # No forwardHeaders - won't receive any client tokens ``` **Test plan** - [x] Verified end-to-end on live deployment: client sends per-user Jira headers through aggregated /mcp route -> gateway forwards them ONLY to Atlassian backend -> comment posted as user's identity ("Mohit Gurnani"), not service account - [x] Verified aggregated route with 10+ backends all initialize successfully (per-backend headers don't break other backends) - [x] Unit tests for extractPerBackendForwardHeaders() with rename - [x] Unit tests for mcpConfig() with per-backend ForwardHeaders - [x] Integration test with mock MCP backend asserting per-backend header scoping **Special notes for reviewers (if applicable)** - The internal plumbing for route-level forwarding (forwardHeaders in mcpProxyConfigRoute, extractForwardHeaders()) is preserved for backward compatibility with OAuth claimToHeaders. Per-backend forwarding is additive. - MCPHeaderForward uses BackendHeader *string in the CRD (optional pointer) and BackendHeader string in filterapi (empty string = use original name) to keep the internal API simple. - The perBackendExtraHeaders map on session is re-extracted from each incoming request (not persisted in the session ID), consistent with how route-level extraHeaders already works. > Note: I used Cursor (AI) as a coding assistant. I fully understand and own > all changes in this PR. --------- Signed-off-by: Mohit Gurnani <mohit.gurnani@nutanix.com> Co-authored-by: Ignasi Barrera <ignasi@tetrate.io>

…r#1969) **Description** This PR adds translation support for the OpenAI `/v1/embeddings` endpoint targeting AWS Bedrock Titan Embed Text models (`amazon.titan-embed-text-v1` and `amazon.titan-embed-text-v2:0). It follows the same patterns established by the existing openai_awsbedrock.go translator (JSON decoding strategy, error handling, path header construction via url.PathEscape, span recording). Changes: - **awsbedrock.go**: Added `TitanEmbeddingRequest` and `TitanEmbeddingResponse schema structs covering both Titan v1 and v2 fields (InputText, dimensions, normalize, embeddingTypes). - **openai_awsbedrock_embeddings.go**: New OpenAIEmbeddingTranslator implementation: translates EmbeddingRequest → TitanEmbeddingRequest, maps TitanEmbeddingResponse back to EmbeddingResponse, handles error responses (JSON and non-JSON), records token usage and span. - **endpointspec.go** — Wired `NewEmbeddingOpenAIToAWSBedrockTranslator` into the APISchemaAWSBedrock embedding path. - **openai_awsbedrock_embeddings_test.go**: 26 test cases across RequestBody, ResponseHeaders, ResponseBody, and ResponseError, covering Titan v1/v2 behavior, model override, batch rejection, dimensions forwarding, and error paths. - **supported-endpoints.md** — Updated embeddings provider list and compatibility table to reflect Titan support. **What is NOT supported in this PR:** - **Batch embeddings**: Titan InvokeModel accepts only a single inputText per request. The translator returns a 400 for len(input) != 1. - **embeddingsByType (quantized outputs)**: Titan v2 can return quantized vectors under `embeddingsByType, but the OpenAI response schema has no equivalent. The top-level embedding float array is always present and used. - Cohere Embed models (e.g. cohere.embed-english-v3): Cohere's embedding API uses texts (array) instead of inputText and requires a semantic `input_type field with no OpenAI equivalent. This needs its own translator, planned as a follow-up PR. # Special notes/questions for reviewers Two design decisions I'd like maintainer input on before considering follow-up work: **1. Should normalize be user-configurable via vendor fields?** Currently normalize (Titan v2 only) is always left unset, using Titan's default (true). The GCP embeddings translator exposes a similar per-provider option via `GCPVertexAIEmbeddingVendorFields.TaskType. Should we follow the same pattern and add an `AWSBedrockTitanEmbeddingVendorFields struct with normalize? Or is leaving it as the default acceptable. Same question for the embeddingsByType. **2. Should embeddingsByType be surfaced in the response?** Titan v2 can return quantized binary vectors under embeddingsByType alongside the standard float embedding. This PR always discards it and returns only the float array. If the community wants to expose this, it would require either a vendor extension on EmbeddingResponse or a new field there is no OpenAI equivalent. Should this be in scope, and if so, what is the preferred approach? Amazon Titan Embeddings docs for reference: https://docs.aws.amazon.com/bedrock/latest/userguide/model-parameters-titan-embed-text.html --------- Signed-off-by: Joao Folgado <jfolgado94@gmail.com> Co-authored-by: Ignasi Barrera <ignasi@tetrate.io>

…ter#2079) Bumps the node group in /site with 9 updates: | Package | From | To | | --- | --- | --- | | [@docusaurus/core](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus) | `3.9.2` | `3.10.0` | | [@docusaurus/preset-classic](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic) | `3.9.2` | `3.10.0` | | [@docusaurus/theme-classic](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-classic) | `3.9.2` | `3.10.0` | | [@docusaurus/theme-mermaid](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-mermaid) | `3.9.2` | `3.10.0` | | [react](https://github.com/facebook/react/tree/HEAD/packages/react) | `19.2.4` | `19.2.5` | | [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) | `19.2.4` | `19.2.5` | | [@docusaurus/module-type-aliases](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-module-type-aliases) | `3.9.2` | `3.10.0` | | [@docusaurus/tsconfig](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-tsconfig) | `3.9.2` | `3.10.0` | | [@docusaurus/types](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-types) | `3.9.2` | `3.10.0` | Updates `@docusaurus/core` from 3.9.2 to 3.10.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/facebook/docusaurus/releases"><code>@docusaurus/core</code>'s releases</a>.</em></p> <blockquote> <h2>3.10.0 (2026-04-07)</h2> <h4>:rocket: New Feature</h4> <ul> <li><code>docusaurus-types</code>, <code>docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11896">#11896</a> feat(core): add <code>future.v4.mdx1CompatDisabledByDefault</code> flag (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11797">#11797</a> feat(core): promote <code>siteConfig.storage</code> to stable + add <code>future.v4.siteStorageNamespacing</code> flag [Claude] (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11571">#11571</a> feat(core): support custom html elements in head tags (<a href="https://github.com/lebalz"><code>@lebalz</code></a>)</li> </ul> </li> <li><code>create-docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11897">#11897</a> feat(create-docusaurus): update init template to <code>.mdx</code> extension and strict MDX syntax (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11696">#11696</a> feat(create-docusaurus): Newly initialized TS sites should use "strict: true" (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11611">#11611</a> feat(create-docusaurus): enable creation in current directory (<a href="https://github.com/Mcheung7272"><code>@Mcheung7272</code></a>)</li> </ul> </li> <li>Other <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11874">#11874</a> feat(ci): improve npm supply chain security - improve Dependabot config (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11712">#11712</a> feat(publish): Use trusted publishing (OIDC) for canary releases (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>create-docusaurus</code>, <code>docusaurus-bundler</code>, <code>docusaurus-plugin-content-blog</code>, <code>docusaurus-plugin-content-docs</code>, <code>docusaurus-plugin-content-pages</code>, <code>docusaurus-plugin-pwa</code>, <code>docusaurus-types</code>, <code>docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11802">#11802</a> feat(core): Docusaurus Faster is stable + v4 future flag turns it on by default (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>docusaurus-mdx-loader</code>, <code>docusaurus-utils</code>, <code>docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11777">#11777</a> feat(cli): <code>write-heading-ids</code> CLI now supports the <code>--syntax</code> and <code>--migrate</code> options (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>docusaurus-mdx-loader</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11755">#11755</a> feat(mdx-loader): add support for explicit <code>headingId</code> based on MD/MDX comments (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>docusaurus-theme-live-codeblock</code>, <code>docusaurus-theme-translations</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11675">#11675</a> feat(theme-live-codeblock): reset button + wire <code>position</code> prop (<a href="https://github.com/NPX2218"><code>@NPX2218</code></a>)</li> </ul> </li> <li><code>docusaurus-theme-classic</code>, <code>docusaurus-theme-common</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11734">#11734</a> feat(theme): Split <code><DocCard></code>, improve extensibility, better handling of emoji icons, stable classNames (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11733">#11733</a> feat(theme): Use React context for <code><Tabs></code>, allow custom <code><TabItem></code> components (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>docusaurus-faster</code>, <code>docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11715">#11715</a> feat(bundler): upgrade to Rspack 1.7, remove useless experimental feature flags (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>docusaurus-plugin-content-pages</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11666">#11666</a> feat(pages): add support for Markdown file path links (<a href="https://github.com/VedantMadane"><code>@VedantMadane</code></a>)</li> </ul> </li> <li><code>docusaurus-mdx-loader</code>, <code>docusaurus-theme-classic</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11642">#11642</a> feat(mdx-loader): add admonitions directive support for class/id shortcuts (<a href="https://github.com/lebalz"><code>@lebalz</code></a>)</li> </ul> </li> <li><code>docusaurus-theme-classic</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11635">#11635</a> feat(theme): add MDXComponents/Li to swizzle config (<a href="https://github.com/moskalakamil"><code>@moskalakamil</code></a>)</li> </ul> </li> <li><code>docusaurus-theme-search-algolia</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11581">#11581</a> feat(theme-search-algolia): allow overriding transformSearchClient (<a href="https://github.com/hugohaggmark"><code>@hugohaggmark</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11541">#11541</a> feat(theme-search-algolia): add support for DocSearch v4.3.2 and new Suggested Questions (<a href="https://github.com/NatanTechofNY"><code>@NatanTechofNY</code></a>)</li> </ul> </li> <li><code>create-docusaurus</code>, <code>docusaurus-plugin-content-blog</code>, <code>docusaurus-plugin-content-docs</code>, <code>docusaurus-plugin-content-pages</code>, <code>docusaurus-plugin-sitemap</code>, <code>docusaurus-types</code>, <code>docusaurus-utils</code>, <code>docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11512">#11512</a> feat(core): New siteConfig <code>future.experimental_vcs</code> API + <code>future.experimental_faster.gitEagerVcs</code> flag (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> </ul> <h4>:bug: Bug Fix</h4> <ul> <li><code>docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11844">#11844</a> fix(core): fix <code>url.resolve()</code> Node.js deprecation warning (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11833">#11833</a> fix(core): upgrade serve handler min version to for upgrade users to a secure version (<a href="https://github.com/BearAlliance"><code>@BearAlliance</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11763">#11763</a> fix(cli): fix <code>write-heading-ids</code> CLI when no files provided (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11693">#11693</a> fix(core): Remove deprecated experiments.lazyBarrel config for RsPack (<a href="https://github.com/VedikaGupt"><code>@VedikaGupt</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11604">#11604</a> fix(core): webpack aliases shouldn't be created for test files and typedefs (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11603">#11603</a> fix(core): Fix openBrowser AppleScript support for Arc (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11579">#11579</a> fix(core): in <code>isInternalUrl()</code>, URI protocol scheme detection should implement the spec more strictly (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/facebook/docusaurus/blob/main/CHANGELOG.md"><code>@docusaurus/core</code>'s changelog</a>.</em></p> <blockquote> <h2>3.10.0 (2026-04-07)</h2> <h4>:rocket: New Feature</h4> <ul> <li><code>docusaurus-types</code>, <code>docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11896">#11896</a> feat(core): add <code>future.v4.mdx1CompatDisabledByDefault</code> flag (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11797">#11797</a> feat(core): promote <code>siteConfig.storage</code> to stable + add <code>future.v4.siteStorageNamespacing</code> flag [Claude] (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11571">#11571</a> feat(core): support custom html elements in head tags (<a href="https://github.com/lebalz"><code>@lebalz</code></a>)</li> </ul> </li> <li><code>create-docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11897">#11897</a> feat(create-docusaurus): update init template to <code>.mdx</code> extension and strict MDX syntax (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11696">#11696</a> feat(create-docusaurus): Newly initialized TS sites should use "strict: true" (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11611">#11611</a> feat(create-docusaurus): enable creation in current directory (<a href="https://github.com/Mcheung7272"><code>@Mcheung7272</code></a>)</li> </ul> </li> <li>Other <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11874">#11874</a> feat(ci): improve npm supply chain security - improve Dependabot config (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11712">#11712</a> feat(publish): Use trusted publishing (OIDC) for canary releases (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>create-docusaurus</code>, <code>docusaurus-bundler</code>, <code>docusaurus-plugin-content-blog</code>, <code>docusaurus-plugin-content-docs</code>, <code>docusaurus-plugin-content-pages</code>, <code>docusaurus-plugin-pwa</code>, <code>docusaurus-types</code>, <code>docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11802">#11802</a> feat(core): Docusaurus Faster is stable + v4 future flag turns it on by default (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>docusaurus-mdx-loader</code>, <code>docusaurus-utils</code>, <code>docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11777">#11777</a> feat(cli): <code>write-heading-ids</code> CLI now supports the <code>--syntax</code> and <code>--migrate</code> options (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>docusaurus-mdx-loader</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11755">#11755</a> feat(mdx-loader): add support for explicit <code>headingId</code> based on MD/MDX comments (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>docusaurus-theme-live-codeblock</code>, <code>docusaurus-theme-translations</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11675">#11675</a> feat(theme-live-codeblock): reset button + wire <code>position</code> prop (<a href="https://github.com/NPX2218"><code>@NPX2218</code></a>)</li> </ul> </li> <li><code>docusaurus-theme-classic</code>, <code>docusaurus-theme-common</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11734">#11734</a> feat(theme): Split <code><DocCard></code>, improve extensibility, better handling of emoji icons, stable classNames (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11733">#11733</a> feat(theme): Use React context for <code><Tabs></code>, allow custom <code><TabItem></code> components (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>docusaurus-faster</code>, <code>docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11715">#11715</a> feat(bundler): upgrade to Rspack 1.7, remove useless experimental feature flags (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>docusaurus-plugin-content-pages</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11666">#11666</a> feat(pages): add support for Markdown file path links (<a href="https://github.com/VedantMadane"><code>@VedantMadane</code></a>)</li> </ul> </li> <li><code>docusaurus-mdx-loader</code>, <code>docusaurus-theme-classic</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11642">#11642</a> feat(mdx-loader): add admonitions directive support for class/id shortcuts (<a href="https://github.com/lebalz"><code>@lebalz</code></a>)</li> </ul> </li> <li><code>docusaurus-theme-classic</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11635">#11635</a> feat(theme): add MDXComponents/Li to swizzle config (<a href="https://github.com/moskalakamil"><code>@moskalakamil</code></a>)</li> </ul> </li> <li><code>docusaurus-theme-search-algolia</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11581">#11581</a> feat(theme-search-algolia): allow overriding transformSearchClient (<a href="https://github.com/hugohaggmark"><code>@hugohaggmark</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11541">#11541</a> feat(theme-search-algolia): add support for DocSearch v4.3.2 and new Suggested Questions (<a href="https://github.com/NatanTechofNY"><code>@NatanTechofNY</code></a>)</li> </ul> </li> <li><code>create-docusaurus</code>, <code>docusaurus-plugin-content-blog</code>, <code>docusaurus-plugin-content-docs</code>, <code>docusaurus-plugin-content-pages</code>, <code>docusaurus-plugin-sitemap</code>, <code>docusaurus-types</code>, <code>docusaurus-utils</code>, <code>docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11512">#11512</a> feat(core): New siteConfig <code>future.experimental_vcs</code> API + <code>future.experimental_faster.gitEagerVcs</code> flag (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> </ul> <h4>:bug: Bug Fix</h4> <ul> <li><code>docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11844">#11844</a> fix(core): fix <code>url.resolve()</code> Node.js deprecation warning (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11833">#11833</a> fix(core): upgrade serve handler min version to for upgrade users to a secure version (<a href="https://github.com/BearAlliance"><code>@BearAlliance</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11763">#11763</a> fix(cli): fix <code>write-heading-ids</code> CLI when no files provided (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11693">#11693</a> fix(core): Remove deprecated experiments.lazyBarrel config for RsPack (<a href="https://github.com/VedikaGupt"><code>@VedikaGupt</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11604">#11604</a> fix(core): webpack aliases shouldn't be created for test files and typedefs (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11603">#11603</a> fix(core): Fix openBrowser AppleScript support for Arc (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11579">#11579</a> fix(core): in <code>isInternalUrl()</code>, URI protocol scheme detection should implement the spec more strictly (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/facebook/docusaurus/commit/0d98888a7645a5fb1330c905b75faf868f829f5c"><code>0d98888</code></a> v3.10.0</li> <li><a href="https://github.com/facebook/docusaurus/commit/4892e7f25716e392f38060171172cbdd4f5ccbed"><code>4892e7f</code></a> feat(core): add <code>future.v4.mdx1CompatDisabledByDefault</code> flag (<a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus/issues/11896">#11896</a>)</li> <li><a href="https://github.com/facebook/docusaurus/commit/543eaeb9e43b611e0c25e23e735439c82477e355"><code>543eaeb</code></a> fix(core): fix <code>url.resolve()</code> Node.js deprecation warning (<a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus/issues/11844">#11844</a>)</li> <li><a href="https://github.com/facebook/docusaurus/commit/1a52592d730789cad2f888228c03d14132a7f0b5"><code>1a52592</code></a> fix(faster): upgrade Rspack, fix Yarn PnP support (<a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus/issues/11817">#11817</a>)</li> <li><a href="https://github.com/facebook/docusaurus/commit/4a0273fab294ba7cafe5014a2af502ce98097380"><code>4a0273f</code></a> fix(create-docusaurus): fix support for TypeScript 6.0 + fix our CI (<a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus/issues/11843">#11843</a>)</li> <li><a href="https://github.com/facebook/docusaurus/commit/f659aefec430be995494d8730cb77b38acda4b2a"><code>f659aef</code></a> fix(core): upgrade serve handler min version to for upgrade users to a secure...</li> <li><a href="https://github.com/facebook/docusaurus/commit/1451780784ead3ce343e023cd1240b939425f52d"><code>1451780</code></a> chore(ci): fixes for the npm trusted publishing workflow (<a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus/issues/11823">#11823</a>)</li> <li><a href="https://github.com/facebook/docusaurus/commit/5dff744ac60c9ca63466ace95afa92253d1608a0"><code>5dff744</code></a> chore(ci): add Trusted Publishing release workflow through dispatch action (#...</li> <li><a href="https://github.com/facebook/docusaurus/commit/29c3b5ce11c98695cd74b87b3584c5fd565685b7"><code>29c3b5c</code></a> feat(core): Docusaurus Faster is stable + v4 future flag turns it on by defau...</li> <li><a href="https://github.com/facebook/docusaurus/commit/2a7f8b96e6670957a30bc16488a69bb364d25314"><code>2a7f8b9</code></a> feat(core): promote <code>siteConfig.storage</code> to stable + add `future.v4.siteStora...</li> <li>Additional commits viewable in <a href="https://github.com/facebook/docusaurus/commits/v3.10.0/packages/docusaurus">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for <code>@docusaurus/core</code> since your current version.</p> </details> <br /> Updates `@docusaurus/preset-classic` from 3.9.2 to 3.10.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/facebook/docusaurus/releases"><code>@docusaurus/preset-classic</code>'s releases</a>.</em></p> <blockquote> <h2>3.10.0 (2026-04-07)</h2> <h4>:rocket: New Feature</h4> <ul> <li><code>docusaurus-types</code>, <code>docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11896">#11896</a> feat(core): add <code>future.v4.mdx1CompatDisabledByDefault</code> flag (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11797">#11797</a> feat(core): promote <code>siteConfig.storage</code> to stable + add <code>future.v4.siteStorageNamespacing</code> flag [Claude] (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11571">#11571</a> feat(core): support custom html elements in head tags (<a href="https://github.com/lebalz"><code>@lebalz</code></a>)</li> </ul> </li> <li><code>create-docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11897">#11897</a> feat(create-docusaurus): update init template to <code>.mdx</code> extension and strict MDX syntax (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11696">#11696</a> feat(create-docusaurus): Newly initialized TS sites should use "strict: true" (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11611">#11611</a> feat(create-docusaurus): enable creation in current directory (<a href="https://github.com/Mcheung7272"><code>@Mcheung7272</code></a>)</li> </ul> </li> <li>Other <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11874">#11874</a> feat(ci): improve npm supply chain security - improve Dependabot config (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11712">#11712</a> feat(publish): Use trusted publishing (OIDC) for canary releases (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>create-docusaurus</code>, <code>docusaurus-bundler</code>, <code>docusaurus-plugin-content-blog</code>, <code>docusaurus-plugin-content-docs</code>, <code>docusaurus-plugin-content-pages</code>, <code>docusaurus-plugin-pwa</code>, <code>docusaurus-types</code>, <code>docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11802">#11802</a> feat(core): Docusaurus Faster is stable + v4 future flag turns it on by default (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>docusaurus-mdx-loader</code>, <code>docusaurus-utils</code>, <code>docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11777">#11777</a> feat(cli): <code>write-heading-ids</code> CLI now supports the <code>--syntax</code> and <code>--migrate</code> options (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>docusaurus-mdx-loader</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11755">#11755</a> feat(mdx-loader): add support for explicit <code>headingId</code> based on MD/MDX comments (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>docusaurus-theme-live-codeblock</code>, <code>docusaurus-theme-translations</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11675">#11675</a> feat(theme-live-codeblock): reset button + wire <code>position</code> prop (<a href="https://github.com/NPX2218"><code>@NPX2218</code></a>)</li> </ul> </li> <li><code>docusaurus-theme-classic</code>, <code>docusaurus-theme-common</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11734">#11734</a> feat(theme): Split <code><DocCard></code>, improve extensibility, better handling of emoji icons, stable classNames (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11733">#11733</a> feat(theme): Use React context for <code><Tabs></code>, allow custom <code><TabItem></code> components (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>docusaurus-faster</code>, <code>docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11715">#11715</a> feat(bundler): upgrade to Rspack 1.7, remove useless experimental feature flags (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>docusaurus-plugin-content-pages</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11666">#11666</a> feat(pages): add support for Markdown file path links (<a href="https://github.com/VedantMadane"><code>@VedantMadane</code></a>)</li> </ul> </li> <li><code>docusaurus-mdx-loader</code>, <code>docusaurus-theme-classic</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11642">#11642</a> feat(mdx-loader): add admonitions directive support for class/id shortcuts (<a href="https://github.com/lebalz"><code>@lebalz</code></a>)</li> </ul> </li> <li><code>docusaurus-theme-classic</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11635">#11635</a> feat(theme): add MDXComponents/Li to swizzle config (<a href="https://github.com/moskalakamil"><code>@moskalakamil</code></a>)</li> </ul> </li> <li><code>docusaurus-theme-search-algolia</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11581">#11581</a> feat(theme-search-algolia): allow overriding transformSearchClient (<a href="https://github.com/hugohaggmark"><code>@hugohaggmark</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11541">#11541</a> feat(theme-search-algolia): add support for DocSearch v4.3.2 and new Suggested Questions (<a href="https://github.com/NatanTechofNY"><code>@NatanTechofNY</code></a>)</li> </ul> </li> <li><code>create-docusaurus</code>, <code>docusaurus-plugin-content-blog</code>, <code>docusaurus-plugin-content-docs</code>, <code>docusaurus-plugin-content-pages</code>, <code>docusaurus-plugin-sitemap</code>, <code>docusaurus-types</code>, <code>docusaurus-utils</code>, <code>docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11512">#11512</a> feat(core): New siteConfig <code>future.experimental_vcs</code> API + <code>future.experimental_faster.gitEagerVcs</code> flag (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> </ul> <h4>:bug: Bug Fix</h4> <ul> <li><code>docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11844">#11844</a> fix(core): fix <code>url.resolve()</code> Node.js deprecation warning (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11833">#11833</a> fix(core): upgrade serve handler min version to for upgrade users to a secure version (<a href="https://github.com/BearAlliance"><code>@BearAlliance</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11763">#11763</a> fix(cli): fix <code>write-heading-ids</code> CLI when no files provided (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11693">#11693</a> fix(core): Remove deprecated experiments.lazyBarrel config for RsPack (<a href="https://github.com/VedikaGupt"><code>@VedikaGupt</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11604">#11604</a> fix(core): webpack aliases shouldn't be created for test files and typedefs (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11603">#11603</a> fix(core): Fix openBrowser AppleScript support for Arc (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11579">#11579</a> fix(core): in <code>isInternalUrl()</code>, URI protocol scheme detection should implement the spec more strictly (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/facebook/docusaurus/blob/main/CHANGELOG.md"><code>@docusaurus/preset-classic</code>'s changelog</a>.</em></p> <blockquote> <h2>3.10.0 (2026-04-07)</h2> <h4>:rocket: New Feature</h4> <ul> <li><code>docusaurus-types</code>, <code>docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11896">#11896</a> feat(core): add <code>future.v4.mdx1CompatDisabledByDefault</code> flag (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11797">#11797</a> feat(core): promote <code>siteConfig.storage</code> to stable + add <code>future.v4.siteStorageNamespacing</code> flag [Claude] (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11571">#11571</a> feat(core): support custom html elements in head tags (<a href="https://github.com/lebalz"><code>@lebalz</code></a>)</li> </ul> </li> <li><code>create-docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11897">#11897</a> feat(create-docusaurus): update init template to <code>.mdx</code> extension and strict MDX syntax (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11696">#11696</a> feat(create-docusaurus): Newly initialized TS sites should use "strict: true" (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11611">#11611</a> feat(create-docusaurus): enable creation in current directory (<a href="https://github.com/Mcheung7272"><code>@Mcheung7272</code></a>)</li> </ul> </li> <li>Other <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11874">#11874</a> feat(ci): improve npm supply chain security - improve Dependabot config (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11712">#11712</a> feat(publish): Use trusted publishing (OIDC) for canary releases (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>create-docusaurus</code>, <code>docusaurus-bundler</code>, <code>docusaurus-plugin-content-blog</code>, <code>docusaurus-plugin-content-docs</code>, <code>docusaurus-plugin-content-pages</code>, <code>docusaurus-plugin-pwa</code>, <code>docusaurus-types</code>, <code>docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11802">#11802</a> feat(core): Docusaurus Faster is stable + v4 future flag turns it on by default (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>docusaurus-mdx-loader</code>, <code>docusaurus-utils</code>, <code>docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11777">#11777</a> feat(cli): <code>write-heading-ids</code> CLI now supports the <code>--syntax</code> and <code>--migrate</code> options (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>docusaurus-mdx-loader</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11755">#11755</a> feat(mdx-loader): add support for explicit <code>headingId</code> based on MD/MDX comments (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>docusaurus-theme-live-codeblock</code>, <code>docusaurus-theme-translations</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11675">#11675</a> feat(theme-live-codeblock): reset button + wire <code>position</code> prop (<a href="https://github.com/NPX2218"><code>@NPX2218</code></a>)</li> </ul> </li> <li><code>docusaurus-theme-classic</code>, <code>docusaurus-theme-common</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11734">#11734</a> feat(theme): Split <code><DocCard></code>, improve extensibility, better handling of emoji icons, stable classNames (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11733">#11733</a> feat(theme): Use React context for <code><Tabs></code>, allow custom <code><TabItem></code> components (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>docusaurus-faster</code>, <code>docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11715">#11715</a> feat(bundler): upgrade to Rspack 1.7, remove useless experimental feature flags (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>docusaurus-plugin-content-pages</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11666">#11666</a> feat(pages): add support for Markdown file path links (<a href="https://github.com/VedantMadane"><code>@VedantMadane</code></a>)</li> </ul> </li> <li><code>docusaurus-mdx-loader</code>, <code>docusaurus-theme-classic</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11642">#11642</a> feat(mdx-loader): add admonitions directive support for class/id shortcuts (<a href="https://github.com/lebalz"><code>@lebalz</code></a>)</li> </ul> </li> <li><code>docusaurus-theme-classic</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11635">#11635</a> feat(theme): add MDXComponents/Li to swizzle config (<a href="https://github.com/moskalakamil"><code>@moskalakamil</code></a>)</li> </ul> </li> <li><code>docusaurus-theme-search-algolia</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11581">#11581</a> feat(theme-search-algolia): allow overriding transformSearchClient (<a href="https://github.com/hugohaggmark"><code>@hugohaggmark</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11541">#11541</a> feat(theme-search-algolia): add support for DocSearch v4.3.2 and new Suggested Questions (<a href="https://github.com/NatanTechofNY"><code>@NatanTechofNY</code></a>)</li> </ul> </li> <li><code>create-docusaurus</code>, <code>docusaurus-plugin-content-blog</code>, <code>docusaurus-plugin-content-docs</code>, <code>docusaurus-plugin-content-pages</code>, <code>docusaurus-plugin-sitemap</code>, <code>docusaurus-types</code>, <code>docusaurus-utils</code>, <code>docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11512">#11512</a> feat(core): New siteConfig <code>future.experimental_vcs</code> API + <code>future.experimental_faster.gitEagerVcs</code> flag (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> </ul> <h4>:bug: Bug Fix</h4> <ul> <li><code>docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11844">#11844</a> fix(core): fix <code>url.resolve()</code> Node.js deprecation warning (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11833">#11833</a> fix(core): upgrade serve handler min version to for upgrade users to a secure version (<a href="https://github.com/BearAlliance"><code>@BearAlliance</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11763">#11763</a> fix(cli): fix <code>write-heading-ids</code> CLI when no files provided (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11693">#11693</a> fix(core): Remove deprecated experiments.lazyBarrel config for RsPack (<a href="https://github.com/VedikaGupt"><code>@VedikaGupt</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11604">#11604</a> fix(core): webpack aliases shouldn't be created for test files and typedefs (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11603">#11603</a> fix(core): Fix openBrowser AppleScript support for Arc (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11579">#11579</a> fix(core): in <code>isInternalUrl()</code>, URI protocol scheme detection should implement the spec more strictly (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/facebook/docusaurus/commit/0d98888a7645a5fb1330c905b75faf868f829f5c"><code>0d98888</code></a> v3.10.0</li> <li><a href="https://github.com/facebook/docusaurus/commit/1451780784ead3ce343e023cd1240b939425f52d"><code>1451780</code></a> chore(ci): fixes for the npm trusted publishing workflow (<a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic/issues/11823">#11823</a>)</li> <li><a href="https://github.com/facebook/docusaurus/commit/5dff744ac60c9ca63466ace95afa92253d1608a0"><code>5dff744</code></a> chore(ci): add Trusted Publishing release workflow through dispatch action (#...</li> <li><a href="https://github.com/facebook/docusaurus/commit/bca9ce746fea7b97d6809d9855e24269578c3a41"><code>bca9ce7</code></a> chore: release v3.9.2 (<a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic/issues/11491">#11491</a>)</li> <li>See full diff in <a href="https://github.com/facebook/docusaurus/commits/v3.10.0/packages/docusaurus-preset-classic">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for <code>@docusaurus/preset-classic</code> since your current version.</p> </details> <br /> Updates `@docusaurus/theme-classic` from 3.9.2 to 3.10.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/facebook/docusaurus/releases"><code>@docusaurus/theme-classic</code>'s releases</a>.</em></p> <blockquote> <h2>3.10.0 (2026-04-07)</h2> <h4>:rocket: New Feature</h4> <ul> <li><code>docusaurus-types</code>, <code>docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11896">#11896</a> feat(core): add <code>future.v4.mdx1CompatDisabledByDefault</code> flag (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11797">#11797</a> feat(core): promote <code>siteConfig.storage</code> to stable + add <code>future.v4.siteStorageNamespacing</code> flag [Claude] (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11571">#11571</a> feat(core): support custom html elements in head tags (<a href="https://github.com/lebalz"><code>@lebalz</code></a>)</li> </ul> </li> <li><code>create-docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11897">#11897</a> feat(create-docusaurus): update init template to <code>.mdx</code> extension and strict MDX syntax (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11696">#11696</a> feat(create-docusaurus): Newly initialized TS sites should use "strict: true" (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11611">#11611</a> feat(create-docusaurus): enable creation in current directory (<a href="https://github.com/Mcheung7272"><code>@Mcheung7272</code></a>)</li> </ul> </li> <li>Other <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11874">#11874</a> feat(ci): improve npm supply chain security - improve Dependabot config (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11712">#11712</a> feat(publish): Use trusted publishing (OIDC) for canary releases (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>create-docusaurus</code>, <code>docusaurus-bundler</code>, <code>docusaurus-plugin-content-blog</code>, <code>docusaurus-plugin-content-docs</code>, <code>docusaurus-plugin-content-pages</code>, <code>docusaurus-plugin-pwa</code>, <code>docusaurus-types</code>, <code>docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11802">#11802</a> feat(core): Docusaurus Faster is stable + v4 future flag turns it on by default (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>docusaurus-mdx-loader</code>, <code>docusaurus-utils</code>, <code>docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11777">#11777</a> feat(cli): <code>write-heading-ids</code> CLI now supports the <code>--syntax</code> and <code>--migrate</code> options (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>docusaurus-mdx-loader</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11755">#11755</a> feat(mdx-loader): add support for explicit <code>headingId</code> based on MD/MDX comments (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>docusaurus-theme-live-codeblock</code>, <code>docusaurus-theme-translations</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11675">#11675</a> feat(theme-live-codeblock): reset button + wire <code>position</code> prop (<a href="https://github.com/NPX2218"><code>@NPX2218</code></a>)</li> </ul> </li> <li><code>docusaurus-theme-classic</code>, <code>docusaurus-theme-common</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11734">#11734</a> feat(theme): Split <code><DocCard></code>, improve extensibility, better handling of emoji icons, stable classNames (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11733">#11733</a> feat(theme): Use React context for <code><Tabs></code>, allow custom <code><TabItem></code> components (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>docusaurus-faster</code>, <code>docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11715">#11715</a> feat(bundler): upgrade to Rspack 1.7, remove useless experimental feature flags (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>docusaurus-plugin-content-pages</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11666">#11666</a> feat(pages): add support for Markdown file path links (<a href="https://github.com/VedantMadane"><code>@VedantMadane</code></a>)</li> </ul> </li> <li><code>docusaurus-mdx-loader</code>, <code>docusaurus-theme-classic</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11642">#11642</a> feat(mdx-loader): add admonitions directive support for class/id shortcuts (<a href="https://github.com/lebalz"><code>@lebalz</code></a>)</li> </ul> </li> <li><code>docusaurus-theme-classic</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11635">#11635</a> feat(theme): add MDXComponents/Li to swizzle config (<a href="https://github.com/moskalakamil"><code>@moskalakamil</code></a>)</li> </ul> </li> <li><code>docusaurus-theme-search-algolia</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11581">#11581</a> feat(theme-search-algolia): allow overriding transformSearchClient (<a href="https://github.com/hugohaggmark"><code>@hugohaggmark</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11541">#11541</a> feat(theme-search-algolia): add support for DocSearch v4.3.2 and new Suggested Questions (<a href="https://github.com/NatanTechofNY"><code>@NatanTechofNY</code></a>)</li> </ul> </li> <li><code>create-docusaurus</code>, <code>docusaurus-plugin-content-blog</code>, <code>docusaurus-plugin-content-docs</code>, <code>docusaurus-plugin-content-pages</code>, <code>docusaurus-plugin-sitemap</code>, <code>docusaurus-types</code>, <code>docusaurus-utils</code>, <code>docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11512">#11512</a> feat(core): New siteConfig <code>future.experimental_vcs</code> API + <code>future.experimental_faster.gitEagerVcs</code> flag (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> </ul> <h4>:bug: Bug Fix</h4> <ul> <li><code>docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11844">#11844</a> fix(core): fix <code>url.resolve()</code> Node.js deprecation warning (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11833">#11833</a> fix(core): upgrade serve handler min version to for upgrade users to a secure version (<a href="https://github.com/BearAlliance"><code>@BearAlliance</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11763">#11763</a> fix(cli): fix <code>write-heading-ids</code> CLI when no files provided (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11693">#11693</a> fix(core): Remove deprecated experiments.lazyBarrel config for RsPack (<a href="https://github.com/VedikaGupt"><code>@VedikaGupt</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11604">#11604</a> fix(core): webpack aliases shouldn't be created for test files and typedefs (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11603">#11603</a> fix(core): Fix openBrowser AppleScript support for Arc (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11579">#11579</a> fix(core): in <code>isInternalUrl()</code>, URI protocol scheme detection should implement the spec more strictly (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/facebook/docusaurus/blob/main/CHANGELOG.md"><code>@docusaurus/theme-classic</code>'s changelog</a>.</em></p> <blockquote> <h2>3.10.0 (2026-04-07)</h2> <h4>:rocket: New Feature</h4> <ul> <li><code>docusaurus-types</code>, <code>docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11896">#11896</a> feat(core): add <code>future.v4.mdx1CompatDisabledByDefault</code> flag (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11797">#11797</a> feat(core): promote <code>siteConfig.storage</code> to stable + add <code>future.v4.siteStorageNamespacing</code> flag [Claude] (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11571">#11571</a> feat(core): support custom html elements in head tags (<a href="https://github.com/lebalz"><code>@lebalz</code></a>)</li> </ul> </li> <li><code>create-docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11897">#11897</a> feat(create-docusaurus): update init template to <code>.mdx</code> extension and strict MDX syntax (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11696">#11696</a> feat(create-docusaurus): Newly initialized TS sites should use "strict: true" (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11611">#11611</a> feat(create-docusaurus): enable creation in current directory (<a href="https://github.com/Mcheung7272"><code>@Mcheung7272</code></a>)</li> </ul> </li> <li>Other <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11874">#11874</a> feat(ci): improve npm supply chain security - improve Dependabot config (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11712">#11712</a> feat(publish): Use trusted publishing (OIDC) for canary releases (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>create-docusaurus</code>, <code>docusaurus-bundler</code>, <code>docusaurus-plugin-content-blog</code>, <code>docusaurus-plugin-content-docs</code>, <code>docusaurus-plugin-content-pages</code>, <code>docusaurus-plugin-pwa</code>, <code>docusaurus-types</code>, <code>docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11802">#11802</a> feat(core): Docusaurus Faster is stable + v4 future flag turns it on by default (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>docusaurus-mdx-loader</code>, <code>docusaurus-utils</code>, <code>docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11777">#11777</a> feat(cli): <code>write-heading-ids</code> CLI now supports the <code>--syntax</code> and <code>--migrate</code> options (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>docusaurus-mdx-loader</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11755">#11755</a> feat(mdx-loader): add support for explicit <code>headingId</code> based on MD/MDX comments (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>docusaurus-theme-live-codeblock</code>, <code>docusaurus-theme-translations</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11675">#11675</a> feat(theme-live-codeblock): reset button + wire <code>position</code> prop (<a href="https://github.com/NPX2218"><code>@NPX2218</code></a>)</li> </ul> </li> <li><code>docusaurus-theme-classic</code>, <code>docusaurus-theme-common</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11734">#11734</a> feat(theme): Split <code><DocCard></code>, improve extensibility, better handling of emoji icons, stable classNames (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11733">#11733</a> feat(theme): Use React context for <code><Tabs></code>, allow custom <code><TabItem></code> components (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>docusaurus-faster</code>, <code>docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11715">#11715</a> feat(bundler): upgrade to Rspack 1.7, remove useless experimental feature flags (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>docusaurus-plugin-content-pages</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11666">#11666</a> feat(pages): add support for Markdown file path links (<a href="https://github.com/VedantMadane"><code>@VedantMadane</code></a>)</li> </ul> </li> <li><code>docusaurus-mdx-loader</code>, <code>docusaurus-theme-classic</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11642">#11642</a> feat(mdx-loader): add admonitions directive support for class/id shortcuts (<a href="https://github.com/lebalz"><code>@lebalz</code></a>)</li> </ul> </li> <li><code>docusaurus-theme-classic</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11635">#11635</a> feat(theme): add MDXComponents/Li to swizzle config (<a href="https://github.com/moskalakamil"><code>@moskalakamil</code></a>)</li> </ul> </li> <li><code>docusaurus-theme-search-algolia</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11581">#11581</a> feat(theme-search-algolia): allow overriding transformSearchClient (<a href="https://github.com/hugohaggmark"><code>@hugohaggmark</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11541">#11541</a> feat(theme-search-algolia): add support for DocSearch v4.3.2 and new Suggested Questions (<a href="https://github.com/NatanTechofNY"><code>@NatanTechofNY</code></a>)</li> </ul> </li> <li><code>create-docusaurus</code>, <code>docusaurus-plugin-content-blog</code>, <code>docusaurus-plugin-content-docs</code>, <code>docusaurus-plugin-content-pages</code>, <code>docusaurus-plugin-sitemap</code>, <code>docusaurus-types</code>, <code>docusaurus-utils</code>, <code>docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11512">#11512</a> feat(core): New siteConfig <code>future.experimental_vcs</code> API + <code>future.experimental_faster.gitEagerVcs</code> flag (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> </ul> <h4>:bug: Bug Fix</h4> <ul> <li><code>docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11844">#11844</a> fix(core): fix <code>url.resolve()</code> Node.js deprecation warning (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11833">#11833</a> fix(core): upgrade serve handler min version to for upgrade users to a secure version (<a href="https://github.com/BearAlliance"><code>@BearAlliance</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11763">#11763</a> fix(cli): fix <code>write-heading-ids</code> CLI when no files provided (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11693">#11693</a> fix(core): Remove deprecated experiments.lazyBarrel config for RsPack (<a href="https://github.com/VedikaGupt"><code>@VedikaGupt</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11604">#11604</a> fix(core): webpack aliases shouldn't be created for test files and typedefs (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11603">#11603</a> fix(core): Fix openBrowser AppleScript support for Arc (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11579">#11579</a> fix(core): in <code>isInternalUrl()</code>, URI protocol scheme detection should implement the spec more strictly (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/facebook/docusaurus/commit/0d98888a7645a5fb1330c905b75faf868f829f5c"><code>0d98888</code></a> v3.10.0</li> <li><a href="https://github.com/facebook/docusaurus/commit/1451780784ead3ce343e023cd1240b939425f52d"><code>1451780</code></a> chore(ci): fixes for the npm trusted publishing workflow (<a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-classic/issues/11823">#11823</a>)</li> <li><a href="https://github.com/facebook/docusaurus/commit/5dff744ac60c9ca63466ace95afa92253d1608a0"><code>5dff744</code></a> chore(ci): add Trusted Publishing release workflow through dispatch action (#...</li> <li><a href="https://github.com/facebook/docusaurus/commit/8a2f526833138f0029c1f22bef4a2643625ecca2"><code>8a2f526</code></a> fix(theme): restore copy-text-to-clipboard as lazy fallback for non-secure co...</li> <li><a href="https://github.com/facebook/docusaurus/commit/eac406c8e8e06078a658a65fda4b0dfc65f7c6fa"><code>eac406c</code></a> feat(theme): Split <code>\<DocCard></code>, improve extensibility, better handling of emo...</li> <li><a href="https://github.com/facebook/docusaurus/commit/2c6b9207db9f0a9ff5aab6bdb1a7b88e0e34b42c"><code>2c6b920</code></a> feat(theme): Use React context for <code>\<Tabs></code>, allow custom <code>\<TabItem></code> compone...</li> <li><a href="https://github.com/facebook/docusaurus/commit/5997f3ab3ced61ba14d08f4ca89c1528b96dd332"><code>5997f3a</code></a> docs: fix package readme consistency (<a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-classic/issues/11721">#11721</a>)</li> <li><a href="https://github.com/facebook/docusaurus/commit/cb34b331570d9be3dc201ad81c660614389620cf"><code>cb34b33</code></a> fix(a11y): remove <code>useKeyboardNavigation</code> hook (<a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-classic/issues/11713">#11713</a>)</li> <li><a href="https://github.com/facebook/docusaurus/commit/bbc726992277c06e7ee71a12c6c5b86029c0d1ed"><code>bbc7269</code></a> chore(monorepo): upgrade React packages to v19 (<a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-classic/issues/11698">#11698</a>)</li> <li><a href="https://github.com/facebook/docusaurus/commit/81248ee5504a13875b4f518ce34487e7b70e67fa"><code>81248ee</code></a> chore(monorepo): upgrade to Jest 30 (<a href="https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-classic/issues/11702">#11702</a>)</li> <li>Additional commits viewable in <a href="https://github.com/facebook/docusaurus/commits/v3.10.0/packages/docusaurus-theme-classic">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for <code>@docusaurus/theme-classic</code> since your current version.</p> </details> <br /> Updates `@docusaurus/theme-mermaid` from 3.9.2 to 3.10.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/facebook/docusaurus/releases"><code>@docusaurus/theme-mermaid</code>'s releases</a>.</em></p> <blockquote> <h2>3.10.0 (2026-04-07)</h2> <h4>:rocket: New Feature</h4> <ul> <li><code>docusaurus-types</code>, <code>docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11896">#11896</a> feat(core): add <code>future.v4.mdx1CompatDisabledByDefault</code> flag (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11797">#11797</a> feat(core): promote <code>siteConfig.storage</code> to stable + add <code>future.v4.siteStorageNamespacing</code> flag [Claude] (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11571">#11571</a> feat(core): support custom html elements in head tags (<a href="https://github.com/lebalz"><code>@lebalz</code></a>)</li> </ul> </li> <li><code>create-docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11897">#11897</a> feat(create-docusaurus): update init template to <code>.mdx</code> extension and strict MDX syntax (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11696">#11696</a> feat(create-docusaurus): Newly initialized TS sites should use "strict: true" (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11611">#11611</a> feat(create-docusaurus): enable creation in current directory (<a href="https://github.com/Mcheung7272"><code>@Mcheung7272</code></a>)</li> </ul> </li> <li>Other <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11874">#11874</a> feat(ci): improve npm supply chain security - improve Dependabot config (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11712">#11712</a> feat(publish): Use trusted publishing (OIDC) for canary releases (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>create-docusaurus</code>, <code>docusaurus-bundler</code>, <code>docusaurus-plugin-content-blog</code>, <code>docusaurus-plugin-content-docs</code>, <code>docusaurus-plugin-content-pages</code>, <code>docusaurus-plugin-pwa</code>, <code>docusaurus-types</code>, <code>docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11802">#11802</a> feat(core): Docusaurus Faster is stable + v4 future flag turns it on by default (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>docusaurus-mdx-loader</code>, <code>docusaurus-utils</code>, <code>docusaurus</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11777">#11777</a> feat(cli): <code>write-heading-ids</code> CLI now supports the <code>--syntax</code> and <code>--migrate</code> options (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>docusaurus-mdx-loader</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11755">#11755</a> feat(mdx-loader): add support for explicit <code>headingId</code> based on MD/MDX comments (<a href="https://github.com/slorber"><code>@slorber</code></a>)</li> </ul> </li> <li><code>docusaurus-theme-live-codeblock</code>, <code>docusaurus-theme-translations</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11675">#11675</a> feat(theme-live-codeblock): reset button + wire <code>position</code> prop (<a href="https://github.com/NPX2218"><code>@NPX2218</code></a>)</li> </ul> </li> <li><code>docusaurus-theme-classic</code>, <code>docusaurus-theme-common</code> <ul> <li><a href="https://redirect.github.com/facebook/docusaurus/pull/11734">#11734</a> feat(theme): Split <code><DocCard></code>, improve extensibility, better handling of emoji icons, stable classNames (<a href="https://github.com/slorber"><code>@slorber</cod…

…heagentrouter#2081) **Description** `TestWithRealProviders` exercises `POST /v1/embeddings` with model `amazon.titan-embed-text-v2:0` against the aws-bedrock backend. The data-plane test Envoy config routes by exact `x-ai-eg-model` match to a cluster. That model had no matching route, so requests never reached Bedrock and the client saw HTTP 404 until the test timed out—breaking the embeddings health check and anything that depends on that job (e.g. release CI). Add an Envoy route mapping amazon.titan-embed-text-v2:0 → aws_bedrock, consistent with other models already listed in tests/data-plane/envoy.yaml. This change is test harness only (tests/data-plane/envoy.yaml); it does not alter production gateway routing. Related Issues/PRs theagentrouter#1969 Signed-off-by: Joao Folgado <jfolgado94@gmail.com>

…theagentrouter#1995) **Description** Non-streaming Vertex / Gemini chat completions now follow the `LiteLLM-style` split already discussed in the community: `reasoning_content` is always a plain string (the visible thinking summary text), and optional `thinking_blocks` carry structured metadata (e.g. signatures) that OpenAI’s core schema does not define. This matches the direction agreed on in Slack [1] and avoids exposing a Bedrock-shaped nested object in reasoning_content, which breaks common OpenAI-compatible clients. Implementation highlights: - Extend the OpenAI-shaped `ChatCompletionResponseChoiceMessage` schema with ThinkingBlock - In the Gemini helper, map thought parts to the string union for `reasoning_content` and populate `thinking_blocks`; when the model attaches a thought signature to the first function-call part (parallel tools) or only there, merge or attach that signature into `thinking_blocks` so clients can **round-trip history together with tool_calls** and assistant content parts of type thinking + signature. - Add unit tests in internal/translator/gemini_helper_test.go for geminiCandidatesToOpenAIChoices and for signature extraction in extractTextAndThoughtSummaryFromGeminiParts. This commit improves interoperability with LiteLLM, LangChain, and other clients that expect `reasoning_content` to be a string while still preserving provider-specific seals for advanced use cases. Fixes theagentrouter#1974 **Special notes for reviewers** - Request-side replay of thinking continues to use assistant content as structured parts (type: "thinking", text, signature) plus tool_calls where applicable; this PR focuses on response shape and mapping from Gemini parts. - Optional follow-up (not in this PR): emit or accept Google’s OpenAI-compat extra_content.google.thought_signature on tool_calls for clients that follow that dialect verbatim; the LiteLLM-style fields remain the primary contract. **Testing**: - Manually verified chat completions against Vertex with gemini-2.5-flash and gemini-3.1-pro-preview (thinking enabled): reasoning_content is a plain string, thinking_blocks present when expected, and multi-turn replay with thinking + signature in assistant content. --- 1: https://envoyproxy.slack.com/archives/C07Q4N24VAA/p1774221731287089 --------- Signed-off-by: Joao Folgado <jfolgado94@gmail.com> Co-authored-by: Ignasi Barrera <ignasi@tetrate.io>

**Description** PR theagentrouter#1930 introduced patchFinalizersWithServerSideApply which uses client.ForceOwnership with field owner aigateway-controller. While intended only to manage the finalizers field, the SSA call marshals the entire object, causing the controller to claim ownership of every field on the resource — including labels managed by Helm (helm.sh/chart, app.kubernetes.io/managed-by, etc.). This breaks Helm-managed deployments. When users install AI Gateway resources (e.g. AIServiceBackend) via a Helm chart, subsequent helm upgrade operations fail with: ``` Apply failed with 1 conflict: conflict with "aigateway-controller": .metadata.labels.helm.sh/chart ``` This commit restores the previous behavior using client.Update() to persist finalizers. **Related Issues/PRs (if applicable)** reverts theagentrouter#1930 **Special notes for reviewers (if applicable)** The client.Update() is used for simplicity as I am not sure of a solid use case for forcing ownerships on resources hence preferring simplicity, that said if we have a use I am happy to explore options where ownership is claimed only for finalizers and not for the entire object. --------- Signed-off-by: siddharth1036 <siddharthshah1036@gmail.com>

**Description** In standalone mode, handle EG infrastructure errors and exit gracefully instead of hanging. **Related Issues/PRs (if applicable)** Related to: theagentrouter#1304 **Special notes for reviewers (if applicable)** N/A --------- Signed-off-by: Ignasi Barrera <nacx@apache.org> Co-authored-by: Aaron Choo <achoo30@bloomberg.net>

…ions group (theagentrouter#2093) Bumps the github-actions group with 1 update: [actions/cache](https://github.com/actions/cache). Updates `actions/cache` from 5.0.4 to 5.0.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/cache/releases">actions/cache's releases</a>.</em></p> <blockquote> <h2>v5.0.5</h2> <h2>What's Changed</h2> <ul> <li>Update ts-http-runtime dependency by <a href="https://github.com/yacaovsnc"><code>@yacaovsnc</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1747">actions/cache#1747</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v5.0.5">https://github.com/actions/cache/compare/v5...v5.0.5</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/cache/blob/main/RELEASES.md">actions/cache's changelog</a>.</em></p> <blockquote> <h1>Releases</h1> <h2>How to prepare a release</h2> <blockquote> <p>[!NOTE]<br /> Relevant for maintainers with write access only.</p> </blockquote> <ol> <li>Switch to a new branch from <code>main</code>.</li> <li>Run <code>npm test</code> to ensure all tests are passing.</li> <li>Update the version in <a href="https://github.com/actions/cache/blob/main/package.json"><code>https://github.com/actions/cache/blob/main/package.json</code></a>.</li> <li>Run <code>npm run build</code> to update the compiled files.</li> <li>Update this <a href="https://github.com/actions/cache/blob/main/RELEASES.md"><code>https://github.com/actions/cache/blob/main/RELEASES.md</code></a> with the new version and changes in the <code>## Changelog</code> section.</li> <li>Run <code>licensed cache</code> to update the license report.</li> <li>Run <code>licensed status</code> and resolve any warnings by updating the <a href="https://github.com/actions/cache/blob/main/.licensed.yml"><code>https://github.com/actions/cache/blob/main/.licensed.yml</code></a> file with the exceptions.</li> <li>Commit your changes and push your branch upstream.</li> <li>Open a pull request against <code>main</code> and get it reviewed and merged.</li> <li>Draft a new release <a href="https://github.com/actions/cache/releases">https://github.com/actions/cache/releases</a> use the same version number used in <code>package.json</code> <ol> <li>Create a new tag with the version number.</li> <li>Auto generate release notes and update them to match the changes you made in <code>RELEASES.md</code>.</li> <li>Toggle the set as the latest release option.</li> <li>Publish the release.</li> </ol> </li> <li>Navigate to <a href="https://github.com/actions/cache/actions/workflows/release-new-action-version.yml">https://github.com/actions/cache/actions/workflows/release-new-action-version.yml</a> <ol> <li>There should be a workflow run queued with the same version number.</li> <li>Approve the run to publish the new version and update the major tags for this action.</li> </ol> </li> </ol> <h2>Changelog</h2> <h3>5.0.4</h3> <ul> <li>Bump <code>minimatch</code> to v3.1.5 (fixes ReDoS via globstar patterns)</li> <li>Bump <code>undici</code> to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)</li> <li>Bump <code>fast-xml-parser</code> to v5.5.6</li> </ul> <h3>5.0.3</h3> <ul> <li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li> <li>Bump <code>@actions/core</code> to v2.0.3</li> </ul> <h3>5.0.2</h3> <ul> <li>Bump <code>@actions/cache</code> to v5.0.3 <a href="https://redirect.github.com/actions/cache/pull/1692">#1692</a></li> </ul> <h3>5.0.1</h3> <ul> <li>Update <code>@azure/storage-blob</code> to <code>^12.29.1</code> via <code>@actions/cache@5.0.1</code> <a href="https://redirect.github.com/actions/cache/pull/1685">#1685</a></li> </ul> <h3>5.0.0</h3> <blockquote> <p>[!IMPORTANT] <code>actions/cache@v5</code> runs on the Node.js 24 runtime and requires a minimum Actions Runner version of <code>2.327.1</code>.</p> </blockquote>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/cache/commit/27d5ce7f107fe9357f9df03efb73ab90386fccae"><code>27d5ce7</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1747">#1747</a> from actions/yacaovsnc/update-dependency</li> <li><a href="https://github.com/actions/cache/commit/f280785d7b6e1884c7d12b9136eb0f4a1574fcfd"><code>f280785</code></a> licensed changes</li> <li><a href="https://github.com/actions/cache/commit/619aeb1606e195be0b36fd0ff68dcf1aff6b65a7"><code>619aeb1</code></a> npm run build generated dist files</li> <li><a href="https://github.com/actions/cache/commit/bcf16c2893940a4899761e55c7ac3c1cf88a04f6"><code>bcf16c2</code></a> Update ts-http-runtime to 0.3.5</li> <li>See full diff in <a href="https://github.com/actions/cache/compare/668228422ae6a00e4ad889ee87cd7109ec5666a7...27d5ce7f107fe9357f9df03efb73ab90386fccae">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/cache&package-manager=github_actions&previous-version=5.0.4&new-version=5.0.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

**Description** Upgrade the `MCPRoute` api to `v1beta1`. **Related Issues/PRs (if applicable)** Related to: theagentrouter#2083 **Special notes for reviewers (if applicable)** N/A --------- Signed-off-by: Ignasi Barrera <nacx@apache.org>

**Description** The tool used to generate the API reference docs has a bug where links for multi-versioned CRDs are not properly generated, linking to the wrong versions of the resources. This PR updates the version of the tool being used to use a patched version of the tool. **Related Issues/PRs (if applicable)** Issue: elastic/crd-ref-docs#60 PR used in this change: elastic/crd-ref-docs#118 **Special notes for reviewers (if applicable)** N/A Signed-off-by: Ignasi Barrera <nacx@apache.org>

Introduce the internal/gcpcache package and the GCPAuthHandler interface required to surface GCP credentials to the resolver without duplicating credential management. Changes: - internal/filterapi/runtime.go: add GCPAuthHandler interface extending BackendAuthHandler with GCPTokenSource(), GCPRegion(), GCPProject() methods so in-process components can authenticate to GCP APIs. - internal/backendauth/gcp.go: implement GCPAuthHandler on gcpHandler; add GCPTokenSource() (wraps static token in StaticTokenSource), GCPRegion() and GCPProject() accessors. - internal/translator/gemini_helper.go: export OpenAIMessagesToGeminiContents and OpenAIToolsToGeminiTools so gcpcache can build the cached prefix in Gemini wire format without duplicating conversion logic. - internal/gcpcache/gcpcache.go: new CacheResolver interface and resolver implementation with breakpoint detection, prefix split, deterministic SHA-256 cache key (stored as Google cachedContents displayName), in-memory TTL memo, Google cachedContents list/create client, and post-create re-list to converge duplicate-create races across replicas. - internal/gcpcache/gcpcache_test.go: unit tests covering findBreakpoint, extractTTL, computeCacheKey determinism, cache miss+create, cache hit from Google list, memo hit (no API calls), memo expiry/refetch, create failure, TTL default/override, and duplicate-create race convergence. Signed-off-by: Sivanantham Chinnaiyan <sivanantham.chinnaiyan@ideas2it.com>

Add the GCPCacheSetter interface to the translator package so the GCP Vertex AI translator can receive a resolved cache entry before RequestBody is called. The translator injects the cachedContent resource name into the Gemini request, uses the filtered (non-cached) message remainder as the request contents, and records cache-write token counts in ResponseBody for both streaming and non-streaming responses. Populate a shared CacheResolver on RuntimeBackend (via Server.LoadConfig) for every GCP Vertex AI backend so the in-memory TTL memo is preserved across requests. In upstreamProcessor.ProcessRequestHeaders, after the translator is selected, attempt cache resolution when the resolver, a GCPAuthHandler, and a GCPCacheSetter-capable translator are all present. Resolver failures produce a 502 ImmediateResponse; nil results (no cache_control markers) are a no-op. Add unit tests covering: resolver not called without GCPCacheSetter, resolver not called without GCPAuthHandler, cache hit injection, cache creation token propagation, resolver error → 502, and translator-level SetGCPCacheResult / cacheWriteTokens attribution for both streaming and non-streaming response bodies. Signed-off-by: Sivanantham Chinnaiyan <sivanantham.chinnaiyan@ideas2it.com>

Add a GCPContextCachingSpec to AIServiceBackend in both api/v1beta1 and api/v1alpha1. The field carries Enabled (bool) and DefaultTTL (a GCP seconds-format duration string validated by a kubebuilder regex pattern). The controller wires it into filterapi.Backend.GCPContextCaching so the extproc layer can gate cache-resolver creation on the feature flag. In extproc/server.go, the shared CacheResolver is now only attached when GCPContextCaching.Enabled is true, keeping the resolver nil (and all cachedContents API calls suppressed) for backends that do not opt in. Generated: run make apigen codegen apidoc to regenerate CRD YAML, deepcopy functions, typed clients/listers/informers, and API reference. Tests added: - tests/crdcel: two AIServiceBackend fixtures (valid and invalid defaultTTL) exercised against the live envtest apiserver to verify CRD validation. - internal/controller/gateway_test.go: two reconcileFilterConfigSecret tests asserting that GCPContextCaching is populated when set and nil when absent. - internal/extproc/server_test.go: LoadConfig test asserting resolver creation is gated on Enabled=true / absent field / non-GCP backend. Signed-off-by: Sivanantham Chinnaiyan <sivanantham.chinnaiyan@ideas2it.com>

**Description** Add missing `additional_tools` field in Responses API. ``` {"type":"error","error":{"type":"BadRequest","code":"400","message":"malformed request: failed to parse JSON for /v1/responses: cannot unmarshal unknown input type: additional_tools"}} ``` --------- Signed-off-by: Xiaolin Lin <xlin158@bloomberg.net>

…heagentrouter#2404) **Description** Add `/tokenize` support for chat completion on AWS Bedrock Converse API CountTokens API. This is a split from theagentrouter#1650 as planned. --------- Signed-off-by: yxia216 <yxia216@bloomberg.net>

**Description** Implements the OpenAI `/v1/responses/input_tokens` endpoint — a token counting API that accepts the same request body as the Responses API and returns `{"input_tokens": <int>}`. ### Motivation Codex and other tools need a way to count input tokens before sending a full Responses API request, enabling clients to validate context window fit and estimate cost without incurring an inference call. --------- Signed-off-by: yxia216 <yxia216@bloomberg.net> Co-authored-by: Aaron Choo <achoo30@bloomberg.net>

**Description** Update the current maintainer profile for Xunzhuo from Tencent to AMD following an employment change. Historical talks and release entries retain the affiliation that applied when they were published. **Related Issues/PRs (if applicable)** - CNCF affiliation update: cncf/gitdm#1210 **Special notes for reviewers (if applicable)** This intentionally changes only the current author profile. Signed-off-by: Xunzhuo <xunzhuo.liu@amd.com>

…outer#2470) **Description** The space after `data:` is optional per the SSE specification, but the translators only matched the spaced form, so a stream sending `data:{...}` had every event silently skipped. The response bytes still reach the client untouched, but the gateway observes nothing: token usage, the resolved response model, and tracing chunks are all lost. In production this looks like requests succeeding while usage is recorded as zero, which breaks usage-based metrics and any downstream cost or quota logic. This adds `cutSSEFieldPrefix`, which strips an SSE field name and removes at most one leading space, and uses it at every `data:` read site plus the `event:` read site in the Anthropic stream parser. Emitted streams are unchanged and keep the canonical spaced form. **Related Issues/PRs (if applicable)** Related to theagentrouter#2149 **Special notes for reviewers (if applicable)** The new streaming regression tests fail without the fix: usage comes back all zeros while the response itself passes through normally. Signed-off-by: Zixin Zhou <zhouzixin@apache.org>

…uter#2363) **Description** Reject malformed `quotaRateLimitServiceAddr` values instead of treating every `net.SplitHostPort` error as a missing port. Hostnames and bare IPv6 literals continue to use the default port, while malformed addresses now fail fast during extension server startup. Fixes theagentrouter#2362 **Testing** - go test ./internal/extensionserver -count=1 Signed-off-by: Yang Haoran <97868579@qq.com> Co-authored-by: Ignasi Barrera <ignasi@tetrate.io>

…agentrouter#2427) **Description** The mutating webhook injects the extproc container config only at pod creation time, but the previous drift check only compared the container image, `-logLevel`, and `-mcpAddr` presence. Restarting the controller with changed extproc settings, or editing `GatewayConfig.spec.extProc.kubernetes`, could leave existing pods running stale injected config until they were recreated for some unrelated reason. This PR computes a stable desired hash from the extproc injection inputs and writes it to the Deployment/DaemonSet pod template annotation `aigateway.envoyproxy.io/extproc-config-hash`. Kubernetes then owns the rollout whenever injected extproc config changes. Upgrade behavior: workloads created before this annotation existed will not have the desired hash on their pod template. On the next Gateway reconcile, Deployments/DaemonSets with effective routes get the template hash annotation and Kubernetes performs one rollout to converge pods onto the current injected extproc config. After that first convergence rollout, reconciles are no-op unless the desired hash changes again. The existing direct pod UUID annotation path remains for filter-config Secret refresh because it speeds projected-volume updates without restarting pods. Workload pod template patching is limited to cases where pod template state must change: sidecar add/remove, inconsistent pod state self-heal, or extproc config hash drift. To avoid rollout loops from Kubernetes API shape/defaulting changes, the hash serializes an explicit digest of the inputs that affect extproc injection instead of hashing a full `corev1.Container`. The hash covers controller flags, GatewayConfig extproc settings, image pull secrets, and MCP input. It intentionally excludes secret-presence-driven `-configPath` / `-configBundlePath` args and legacy/bundle volume mounts. **Related Issues/PRs (if applicable)** Fixes theagentrouter#2395 **Special notes for reviewers (if applicable)** - The shared builder in `internal/controller/extproc_builder.go` is the single source of truth for the injected container and the desired template hash. - `GatewayConfig.spec.extProc.kubernetes.image` / `imageRepository` are used when checking whether an existing extproc sidecar is current. - The reconciler uses the cached route-list path; the no-cache fallback remains only on the admission webhook path. - Tests cover deterministic hashing, drift-relevant inputs, GatewayConfig-resolved image checks, and Deployment/DaemonSet template hash rollout behavior. --------- Signed-off-by: liuhy <liuhongyu@apache.org> Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: Ignasi Barrera <ignasi@tetrate.io>

…#2374) **Description** Adds an importable dashboard covering `gen_ai_*` metrics: total requests and tokens, TTFT and request duration (as quick-glance stats and as percentile trends), token usage by type, original-vs-response model mismatches, request throughput (QPS), token consumption rate by type, overall error rate, and success rate by model. Also adds a README section explaining how to import the dashboard and validate it locally with `aigw run`. The success rate query uses an `or` fallback so models with a 100% failure rate (no matching series in the failure-count vector) still show up in the table instead of being silently dropped. **Related Issues/PRs (if applicable)** **Special notes for reviewers (if applicable)** **Screenshot** <img width="2556" height="1253" alt="Screenshot From 2026-07-21 23-09-27" src="https://github.com/user-attachments/assets/6da6bef4-1f6a-42a6-929a-5c3ea60b72f7" /> <img width="2556" height="323" alt="Screenshot From 2026-07-21 23-09-36" src="https://github.com/user-attachments/assets/0e3da8f8-dec4-4d5e-a533-0df33d1ab99f" /> --------- Signed-off-by: baiyutang <irichardwang@gmail.com> Co-authored-by: Ignasi Barrera <ignasi@tetrate.io>

Signed-off-by: Ignasi Barrera <ignasi@tetrate.io>

**Description** Allow Responses API requests containing Codex-emitted agent_message and agent_reasoning input items to pass through OpenAI-compatible backends. **Root cause** The Responses input-item union rejected these types before the request reached the upstream provider. **Fix** Preserve the raw JSON for both types, so their evolving Codex-specific fields are forwarded unchanged without requiring an incomplete schema model. **Related Issue** Fixes theagentrouter#2442 **Testing** - go test ./internal/apischema/openai -run '^TestResponseInputItemUnionParam(MarshalJSON|UnmarshalJSON)$' -count=1 Signed-off-by: 0YHR0 <97868579@qq.com> Co-authored-by: Ignasi Barrera <ignasi@tetrate.io>

Update the context cache documentation URL to point to the new docs.cloud.google.com location under gemini-enterprise-agent-platform. Signed-off-by: Sivanantham Chinnaiyan <sivanantham.chinnaiyan@ideas2it.com>

…#2473) **Description** Sometimes, gemini models return ` negative` with a leading space for `text/x.enum`, violating the enum contract that the output should be exactly one of the provided values. The gateway had trimming logic for `responseModeRegex` (strips wrapping quotes) but nothing for `responseModeEnum`, so just strip whitespaces for `responseModeEnum`. Signed-off-by: yxia216 <yxia216@bloomberg.net> Co-authored-by: Ignasi Barrera <ignasi@tetrate.io>

…ment (theagentrouter#2476) **Description** `toolConfig.tools[]` in the Bedrock Converse API is a union: an element sets exactly one of `toolSpec`, `systemTool`, `modelTool` or `cachePoint`. When an OpenAI request carried `cache_control` on a tool definition, `openAIToolsToBedrockToolConfig` set both `toolSpec` and `cachePoint` on the same element, and Bedrock rejected the whole request with a non-retryable 400: ``` The value at toolConfig.tools.11 can only set one of the following keys: toolSpec, systemTool, modelTool, or cachePoint. ``` This blocks any client that caches tool definitions from using a Bedrock backend at all, since every request carrying such a tool fails on the first inference call. The cache point is now appended as its own `tools[]` element, which is how every content block path already handles it — user text, image, assistant content and system content each append a standalone cache point block. The tools path was the one place that folded it into the preceding element, which is why this only surfaced for clients that cache tool definitions rather than only system prompts and messages. `Tool.ToolSpec` also needed `omitempty`. Without it a cache-point-only element marshals as `{"toolSpec":null,"cachePoint":{"type":"default"}}`, which Bedrock rejects for the same reason. `ContentBlock.CachePoint` and the tool result variant were already `omitempty`, so only the `Tool` union needed the tag. Tests: the existing "cache control on tool definition" case in `TestOpenAIToAWSBedrockTranslator_CacheControl` asserted the rejected shape and is updated to the two-element form. `TestOpenAIToolsToBedrockToolConfig` gains a cache control case, plus an assertion across every case that no `tools[]` element sets both members and that a cache-point-only element marshals without a `toolSpec` key. Both fail on `main` and pass with this change. **Related Issues/PRs (if applicable)** Fixes theagentrouter#2475 Related PR: theagentrouter#1717, which fixed the same union violation for message content blocks but did not cover the tools path. **Special notes for reviewers (if applicable)** The Anthropic to Bedrock translator (`anthropic_awsbedrock.go`, `convertTools`) never sets a cache point on tools, so it does not hit this 400, but it silently drops `cache_control` on tool definitions. That looks like a separate gap and is left out of this change; happy to file it separately if it is worth tracking. Per the generative AI policy: an AI assistant was used while preparing this change. I have reviewed it, understand it, and take full ownership of it. Signed-off-by: Paul Merrison <paul@tetrate.io> Co-authored-by: Ignasi Barrera <ignasi@tetrate.io>

…uter#2398) **Description** The extproc router filter writes two "original path" internal headers from the incoming request path: `x-ai-eg-original-path` and `x-envoy-original-path`. The first is set unconditionally, but the second was only set when it was empty. Because of that, a client-supplied or otherwise pre-existing `x-envoy-original-path` survives and shadows the gateway's own value, and downstream logic that keys off the original path (for example the upstream-filter processor lookup on retry) then operates on the wrong path. This change makes extproc the authoritative writer of the internal headers it owns. `x-envoy-original-path` is now set unconditionally, matching the sibling `x-ai-eg-original-path`. The header is already treated as gateway-owned elsewhere in extproc (the header mutator ignores it so users can't change it through the header mutation API), so writing it unconditionally simply aligns the two headers' behavior. A unit test is added asserting that pre-existing values on both original-path headers are overwritten with the request path. **Related Issues/PRs (if applicable)** **Special notes for reviewers (if applicable)** The MCP proxy sets both original-path headers with set-if-missing semantics when forwarding to its own upstream; that is a separate hop and is not affected by this change. Since the router filter already wrote `x-ai-eg-original-path` unconditionally, this only brings `x-envoy-original-path` in line with existing behavior rather than introducing new behavior. --------- Signed-off-by: Anurag Aggarwal <kanurag94@gmail.com> Co-authored-by: Ignasi Barrera <ignasi@tetrate.io>

**Description** MCPRoute currently generates host-less HTTPRoutes, so they land in the Gateway's wildcard virtual host. When the same Gateway also has a host-scoped inference route (`AIGatewayRoute.Hostnames` set), that host-scoped virtual host shadows the host-less MCP route and `/mcp` returns 404. This adds a `Hostnames` field to `MCPRouteSpec`, mirroring the existing `AIGatewayRoute.Hostnames`, and carries it onto every HTTPRoute the MCPRoute controller generates (both the main mcp-proxy route and the per-backend routes). When set, the generated HTTPRoute includes these hostnames so the MCP route lands in the correct per-host virtual host instead of the wildcard vhost. The field is optional and additive, so existing MCPRoutes are unaffected. **Related Issues/PRs (if applicable)** **Special notes for reviewers (if applicable)** - Tests: a dedicated set/not-set unit test on `newMainHTTPRoute`, plus carry-through assertions on both the main and per-backend HTTPRoutes in the reconcile test. --------- Signed-off-by: Anurag Aggarwal <kanurag94@gmail.com> Co-authored-by: Ignasi Barrera <ignasi@tetrate.io>

…g in extproc (theagentrouter#2410) **Description** While working on theagentrouter#2398, realised that the header `x-ai-eg-model` can also be appended instead of overwritten. The router filter in extproc sets the gateway-owned `x-ai-eg-model` header via a `HeaderValueOption` that leaves `AppendAction` at its default. That default is `APPEND_IF_EXISTS_OR_ADD`, so if a client sends its own `x-ai-eg-model` header, Envoy appends the gateway's value to it instead of replacing it, producing a multi-value header. Anything that keys off `x-ai-eg-model` downstream (route header matching, rate limiting) can then act on the wrong value. This sets `AppendAction: OVERWRITE_IF_EXISTS_OR_ADD` on that header so the gateway's value always wins. The header already carries the `x-ai-eg-` prefix, so the header mutator treats it as gateway-owned and users can't change it through the header mutation API; this just makes the actual mutation match that ownership. The same pattern is already used elsewhere in this file (upstream auth and header-mutator sets). **Related Issues/PRs (if applicable)** Follow-up to the same class of issue addressed for the original-path headers in theagentrouter#2398. **Special notes for reviewers (if applicable)** Scoped intentionally to the model header only. The original-path headers are handled separately in theagentrouter#2398. Signed-off-by: Anurag Aggarwal <kanurag94@gmail.com>

**Description** Adds a `spec.forwardProxy` field to `GatewayConfig` that routes all upstream AI/LLM traffic from Gateways referencing the config through an HTTP CONNECT forward proxy. This is for data planes in locked-down networks that have no direct egress to providers and must send all outbound traffic through a proxy. At xDS translation time the extension server resolves the proxy from the owning Gateway's `GatewayConfig` (route `parentRefs` → Gateway → `aigateway.envoyproxy.io/gateway-config` annotation) and wraps each upstream cluster's transport socket in Envoy's `http_11_proxy` transport, keeping the upstream TLS session nested inside the CONNECT tunnel. InferencePool clusters are excluded, wrapping is idempotent, and it is a no-op when no proxy is configured. **Config** ```yaml apiVersion: aigateway.envoyproxy.io/v1beta1 kind: GatewayConfig metadata: name: my-gateway-config spec: forwardProxy: address: proxy.corp:3128 # host:port of the HTTP CONNECT proxy ``` The Gateway opts in via the existing `aigateway.envoyproxy.io/gateway-config` annotation. **Non-goals** Proxy authentication (`Proxy-Authorization`) and TLS to the proxy itself are not supported yet — the proxy is expected to authorize the gateway by network policy (e.g. an IP allowlist). **Related Issues/PRs (if applicable)** Fixes theagentrouter#1759 --------- Signed-off-by: Anurag Aggarwal <kanurag94@gmail.com> Co-authored-by: Ignasi Barrera <ignasi@tetrate.io>

…uter#2392) **Description** Strips `content-length` from the response header mutation when the ext_proc switches from BUFFERED to STREAMED mode (via `ModeOverride`). Without this, a `content-length` header from the upstream causes Envoy to truncate the streaming response to the first body chunk. ### Security Impacts - [x] No, this change does NOT impact security --- ### What does this PR do? Strips `content-length` from the response header mutation when the ext_proc switches from BUFFERED to STREAMED mode (via `ModeOverride`). Without this, a `content-length` header from the upstream causes Envoy to truncate the streaming response to the first body chunk. ### Context Fixes theagentrouter#2391 When the ai-gateway ext_proc switches its `response_body_mode` from `BUFFERED` to `STREAMED` for streaming SSE responses (e.g. `/v1/responses` with `stream: true`), it does not remove the `content-length` header. If the upstream includes `content-length` (e.g. computed by a prior HTTP/2 hop when an EPP ext_proc copies `transfer-encoding: chunked`), Envoy truncates the response to the first body chunk, cutting off the SSE stream after the first few events. ### Changes - `internal/extproc/processor_impl.go`: append `content-length` to `RemoveHeaders` when `mode != nil` (i.e. switching to STREAMED mode) - `internal/extproc/processor_impl_test.go`: update `Test_chatCompletionProcessorUpstreamFilter_ProcessResponseHeaders/ok/streaming` to verify `content-length` is in `RemoveHeaders` ### Testing - All existing tests pass (`go test ./internal/extproc/... -count=1`) - Verified on a dev cluster with a two-hop topology (EPP → ai-gateway ext_proc → client): `/v1/responses` streaming now returns all SSE events instead of being truncated to the first 2 Signed-off-by: Fernando Foroughi <ffa@corti.ai> Co-authored-by: Ignasi Barrera <ignasi@tetrate.io>

…gentrouter#2244) **Description** Give each tenant a different rate limit while every tenant shares one policy and one set of routes. The tenant's limit travels with the request as dynamic metadata, so there are no per-tenant config objects. This is documentation and an e2e. There is no API change: Envoy Gateway's `limit.fromMetadata` can read the limit from any metadata namespace, so whichever filter knows the tenant can write it and the policy reads it directly. AI Gateway's part is the other half — turning the LLM's token usage into the cost charged against that limit, which already exists as `globalLLMRequestCosts`. **How it works** 1. `ext_authz` resolves the tenant and returns its budget as dynamic metadata. 2. One `BackendTrafficPolicy` reads that budget with `limit.fromMetadata`, bucketed per tenant with `Distinct`. 3. AI Gateway emits the request's token usage, and the policy charges it against the budget. **Usage** The auth server returns the budget in its Check response. Envoy files it under `envoy.filters.http.ext_authz`. The value must be the struct Envoy's rate limit override reads: ```json { "dynamic_metadata": { "fields": { "total_limit": { "struct_value": { "fields": { "requests_per_unit": { "number_value": 100000 }, "unit": { "string_value": "HOUR" } } } } } } } ``` `unit` is one of `SECOND`, `MINUTE`, `HOUR`, `DAY`, `MONTH`, `YEAR`. Dynamic metadata is used rather than a header because only filters can write it, so a tenant cannot raise its own limit. `GatewayConfig` declares the cost to charge: ```yaml apiVersion: aigateway.envoyproxy.io/v1beta1 kind: GatewayConfig metadata: name: envoy-ai-gateway namespace: default spec: globalLLMRequestCosts: - metadataKey: llm_total_token type: TotalToken ``` One policy then serves every tenant: ```yaml apiVersion: gateway.envoyproxy.io/v1alpha1 kind: BackendTrafficPolicy metadata: name: tenant-token-budget namespace: default spec: targetRefs: - group: gateway.networking.k8s.io kind: Gateway name: envoy-ai-gateway rateLimit: type: Global global: rules: - clientSelectors: - headers: - name: x-tenant-id type: Distinct limit: requests: 1000 # default when ext_authz says nothing unit: Hour fromMetadata: namespace: envoy.filters.http.ext_authz # where ext_authz writes key: total_limit cost: request: { from: Number, number: 0 } # charge tokens, not requests response: from: Metadata metadata: namespace: io.envoy.ai_gateway key: llm_total_token ``` For separate input, output and total budgets, declare one cost key per token kind (`InputToken`, `OutputToken`, `TotalToken`), have the auth server return one budget per kind, and add one rule per kind. A tenant stops at whichever budget it exhausts first. **Behavior** Request-time cost is 0 and tokens are charged from the response, so a budget of N against a cost of C allows N/C + 1 calls. | Metadata value | Effect | | ------------------------------------- | -------------------------------------------------- | | valid `{ requests_per_unit, unit }` | becomes the limit for that request | | absent | the static `requests`/`unit` on the rule applies | | `requests_per_unit: 0` | a real limit of 0, which suspends the tenant | Two things to plan for: - Missing metadata fails open to the static default, so keep that default a conservative ceiling rather than a placeholder. - `0` is a real limit and does not fall back. A source with no opinion about a request must omit the field, not send `0` — an uninitialized field or a failed lookup will otherwise suspend the tenant. **Why no API change** An earlier revision of this PR added `GatewayConfig.spec.globalRateLimits`, which read the limit from one namespace and re-emitted it into `io.envoy.ai_gateway`. That was written when the source was a request **header** (theagentrouter#2223), which Envoy's override cannot read, so something had to bridge it. Review moved the source to dynamic metadata so clients cannot forge it — and that removed the need for the bridge, because the filter writing the metadata can write the final struct itself. What remained was reshaping `"100000/HOUR"` into a struct. It cost a `metadata` request attribute on the router ext_proc filter, a change to how every request is classified router vs upstream, and a rolling-upgrade break needing its own workaround. Not worth it for a string reshape on the path of every request. A source that cannot produce the struct — a `jwt_authn` claim, or a third-party auth sidecar returning a plain string — still needs something to transcode. The docs point at a Lua filter. If that case turns out to be common, an API is worth revisiting on its own merits. **Testing** `Test_DynamicMetadataRateLimit` runs the configuration above and asserts each tier is throttled at its own number: | tier | budget from ext_authz | calls allowed | | ------------ | --------------------------- | ------------- | | `premium` | 6 total tokens/HOUR | 4 | | `basic` | 2 total tokens/HOUR | 2 | | `unknown` | none — static `requests: 4` | 3 | | `suspended` | 0 total tokens/HOUR | 1, then 429 | | `tri-input` | 6 input, others generous | 3 | | `tri-output` | 3 output, others generous | 4 | | `tri-total` | 12 total, others generous | 4 | The triplet cases use a lopsided reply (3 in, 1 out, 4 total) so the three budgets produce different counts. With an even reply, input and output would be indistinguishable and a mix-up between them would go unnoticed. The test skips unless Envoy Gateway has `limit.fromMetadata` (envoyproxy/gateway#9216), which is on main but not yet in a tagged release. There is a TODO on the version check to relax it once a release includes it. **Related Issues/PRs** Closes theagentrouter#2223, with documentation instead of the API that issue proposed — see above. Consumes envoyproxy/gateway#9216 (`limit.fromMetadata` on `BackendTrafficPolicy`). Signed-off-by: Anurag Aggarwal <kanurag94@gmail.com> Co-authored-by: Ignasi Barrera <ignasi@tetrate.io>

Replace the local createCacheRequest/createCacheResponse/cacheUsageMetadata types in gcpcache with shared types defined in internal/apischema/gcp: - Add CreateCachedContent, CachedContent, CachedContentUsageMetadata, and EncryptionSpec to the gcp schema package so they can be reused across the codebase. - Set CreateCachedContent.TTL as string (GCP duration format e.g. "300s") rather than time.Duration, which marshals as a nanosecond integer and would be rejected by the Vertex AI REST API. - Set CachedContent.ExpireTime as time.Time so the response can be used directly without a separate time.Parse call. - Cast CachedContentUsageMetadata.TotalTokenCount (int32) to int when populating ResolveResult.TokenCount. - Update tests to unmarshal the POST body into gcp.CreateCachedContent instead of the now-removed local type. Signed-off-by: Sivanantham Chinnaiyan <sivanantham.chinnaiyan@ideas2it.com>

Signed-off-by: Sivanantham Chinnaiyan <sivanantham.chinnaiyan@ideas2it.com>

Resolve held the resolver mutex only inside getMemo/setMemo, so nothing serialized the list -> create span between them. N concurrent requests sharing a cached prefix all missed the memo, all listed, and all created, an N-times amplification within a single replica. Wrap the Google-side resolution in a singleflight group so simultaneous misses for one key issue a single list+create. The memo check stays outside the flight: a memo hit should not queue behind an in-flight create. singleflight hands the same value to every waiter, which needs care on two fronts. Callers copy the result struct before setting Messages, since they share a prefix but differ in their non-cached remainder. And only the flight leader may report Created, because the write happened once -- otherwise the request path records the cache-write token count per waiter and over-bills it. Leadership is captured inside the closure rather than from Do's shared return value, which is true for the leader as well and so cannot identify followers. Make the test server's list/create counters atomic. They are incremented from per-request handler goroutines and would otherwise race once tests drive concurrent requests. Signed-off-by: Sivanantham Chinnaiyan <sivanantham.chinnaiyan@ideas2it.com>

NewGatewayController folded its extproc image and log level parameters into *Options, but the two GCP context caching tests still passed them positionally, so the package's tests failed to build. Construct the options with newTestExtProcOptions as the neighbouring call sites already do. Signed-off-by: Sivanantham Chinnaiyan <sivanantham.chinnaiyan@ideas2it.com>

The context cache previously kept its resolved cachedContents names in a per-replica in-memory map, so two gateway replicas seeing the same prefix each created their own Google cache. Replace the map with a CacheStore interface and a Redis-backed implementation that all replicas share. Creation is arbitrated with SET NX PX: the replica that claims a key creates the cache while the others poll for its result, so a cold prefix arriving at N replicas produces one create rather than N. A waiter that times out resolves against Google itself, which degrades a stuck leader into an extra list rather than a duplicate create. Store failures are never fatal to a request. An unconfigured or unreachable Redis is treated as a cache miss and the request is served uncached, since caching is an optimization. Google-side failures keep failing fast, because those are actionable by the user: a create rejected for being below the model's minimum token count means the cache_control markers are misplaced, and silently serving the request uncached would hide a cost increase. Resolvers are now carried across config reloads, keyed by backend name and Redis URL, so a filterapi update does not tear down and rebuild each backend's connection pool. Note that singleflight and the store cover different callers and both are needed: singleflight collapses callers that overlap in time, the store collapses callers separated by it. Signed-off-by: Sivanantham Chinnaiyan <sivanantham.chinnaiyan@ideas2it.com>

The package doc still described an in-process memo and named CacheResolver as the seam for a future external cache service, both of which are stale now that the store is the storage layer. Replace them with the two-level dedup rationale and the store-fails-open / Google-fails-fast asymmetry. Tighten the singleflight comment and correct a Redis error message that said "redis get" for a failure the caller cannot distinguish from a miss. Signed-off-by: Sivanantham Chinnaiyan <sivanantham.chinnaiyan@ideas2it.com>

dependabot Bot and others added 30 commits April 9, 2026 16:52

sivanantha321 and others added 29 commits July 31, 2026 13:58

chore: fix format

5064ea1

Signed-off-by: Ignasi Barrera <ignasi@tetrate.io>

fix: carry Anthropic tool input schemas as-is (theagentrouter#2472)

5fc9c79

docs: update GCP context cache documentation URL

28e1906

Update the context cache documentation URL to point to the new docs.cloud.google.com location under gemini-enterprise-agent-platform. Signed-off-by: Sivanantham Chinnaiyan <sivanantham.chinnaiyan@ideas2it.com>

Merge remote-tracking branch 'upstream/main' into gcp-context-cache

f481370

Signed-off-by: Sivanantham Chinnaiyan <sivanantham.chinnaiyan@ideas2it.com>

sivanantha321 closed this Aug 25, 2026

Navigation Menu

Repository navigation

Gcp context cache - #1

Gcp context cache#1
sivanantha321 wants to merge 196 commits into
mainfrom
gcp-context-cache

sivanantha321 commented Aug 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

Conversation

sivanantha321 commented Aug 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants