build(deps): Bump actions/upload-artifact from 4.6.2 to 6.0.0 by dependabot[bot] · Pull Request #1 · kenn-io/agentsview

dependabot · 2026-02-19T19:34:24Z

Bumps actions/upload-artifact from 4.6.2 to 6.0.0.

Release notes

Sourced from actions/upload-artifact's releases.

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Upload Artifact Node 24 support by @salmanmkc in actions/upload-artifact#719

fix: update @actions/artifact for Node.js 24 punycode deprecation by @salmanmkc in actions/upload-artifact#744

prepare release v6.0.0 for Node.js 24 support by @salmanmkc in actions/upload-artifact#745

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

v5.0.0

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

Update README.md by @GhadimiR in actions/upload-artifact#681

Update README.md by @nebuk89 in actions/upload-artifact#712

Readme: spell out the first use of GHES by @danwkennedy in actions/upload-artifact#727

Update GHES guidance to include reference to Node 20 version by @patrikpolyak in actions/upload-artifact#725

Bump @actions/artifact to v4.0.0

Prepare v5.0.0 by @danwkennedy in actions/upload-artifact#734

New Contributors

@GhadimiR made their first contribution in actions/upload-artifact#681

@nebuk89 made their first contribution in actions/upload-artifact#712

@danwkennedy made their first contribution in actions/upload-artifact#727

@patrikpolyak made their first contribution in actions/upload-artifact#725

Full Changelog: actions/upload-artifact@v4...v5.0.0

Commits

b7c566a Merge pull request #745 from actions/upload-artifact-v6-release
e516bc8 docs: correct description of Node.js 24 support in README
ddc45ed docs: update README to correct action name for Node.js 24 support
615b319 chore: release v6.0.0 for Node.js 24 support
017748b Merge pull request #744 from actions/fix-storage-blob
38d4c79 chore: rebuild dist
7d27270 chore: add missing license cache files for @actions/core, @actions/io, and mi...
5f643d3 chore: update license files for @actions/artifact@5.0.1 dependencies
1df1684 chore: update package-lock.json with @actions/artifact@5.0.1
b5b1a91 fix: update @actions/artifact to ^5.0.0 for Node.js 24 punycode fix
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.6.2 to 6.0.0. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@ea165f8...b7c566a) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

roborev-ci · 2026-02-22T17:33:50Z

roborev: Combined Review (`71ef7e4`)

Verdict: ✅ No Medium/High/Critical issues found; this change appears clean.

All reviews agree the update in .github/workflows/release.yml:97 (bumping actions/upload-artifact from v4.6.2 to v6.0.0 with a full commit SHA pin) does not introduce security or functional concerns.

Synthesized from 4 reviews (agents: codex, gemini | types: default, security)

dependabot · 2026-02-22T17:57:14Z

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

Hash-suffixed provider skip-cache entries can outlive the DB row they originally matched. When a Devin transcript is rewritten A -> B -> A with the same mtime, the old A key must not skip while the DB still stores hash B. Check the current Devin fingerprint hash against the stored DB hash before honoring a provider cache hit. Non-hash-required providers keep the prior mtime-only skip behavior. VALID (fixed): kenn-io#1

Devin transcript failures are meant to be safe to surface, but path-bearing os.PathError values can include the raw transcript path and session id when formatted directly. Sanitizing that cause keeps the underlying error available via Unwrap while avoiding accidental source-path disclosure. Malformed Devin rows can also omit both activity timestamps. Treating that freshness value as zero keeps one partial row from breaking discovery or parsing for the provider. VALID (fixed): kenn-io#1, kenn-io#2

Devin freshness checks feed the provider skip paths, so the hash must cover DB values that can change parsed output even when file mtimes do not. Working directory updates affect cwd/project metadata, and missing-transcript sessions parse messages from message_nodes rather than transcript bytes. Include the parsed CWD field and a deterministic digest of the fallback message_nodes rows when there is no transcript, so DB-only changes cannot leave stale Devin sessions behind. VALID (fixed): kenn-io#1

Cursor billing rows intentionally do not have a session project label, but the usage export metadata treated every aggregate row project as a join key. That leaked a synthetic empty-string project identity into v1 payloads whenever a report contained only Cursor usage. The totals and breakdown aggregation still preserve those Cursor rows; only the report-level project identity map now skips non-label projects so legacy absence and real project identities stay distinguishable across SQLite, PostgreSQL, and DuckDB. VALID (fixed): #1 -- Cursor-only usage no longer emits a "" project identity in usage report metadata.

Embedding endpoint 4xx responses are not all document-specific. Treating route, schema, model, or media-type failures as permanent skip-stamped entire corpora and could activate an empty generation, leaving later incremental builds with nothing to retry. Keep embeddings routes registered even when vector serving is disabled so OpenAPI and generated clients expose the API surface, with handlers returning 501 until a manager is wired. Semantic and hybrid search now require an explicit intent header over GET so blind browser no-CORS requests cannot spend embeddings quota through the local daemon; daemon-backed clients set that header. VALID (fixed): #1, #2, #3 INVALID (dismissed): none PEDANTIC (skipped): none

VALID (fixed): kenn-io#1 -- Windsurf same-size/same-mtime SQLite rewrites need to compare the provider file_hash before taking skip-cache or stored-freshness shortcuts. Windsurf now uses a component-labeled content digest for state.vscdb, WAL/SHM, and workspace.json so the fingerprint is stable across roots while still moving when parsed source content changes. The sync freshness allowlist now requires that hash for Windsurf, matching the composite fingerprint contract. The commit also includes the repository hook's automatic Qoder slices.Backward modernization; without staging that generated fix, the pre-commit hook re-applies it and aborts before the Windsurf fix can be committed.

VALID (fixed): kenn-io#1 -- Windsurf remote-sync targets exposed workspaceStorage as a recursive archive root. Windsurf targets now separate import roots from archived files, so the HTTP archive endpoint streams only state.vscdb, sidecars, and workspace.json. Dir-only archive requests for file-scoped Windsurf targets are rejected instead of falling back to recursive tar.

VALID (fixed): kenn-io#1 -- SSH remote sync still resolved Windsurf to workspaceStorage and recursively tarred unrelated workspace files. The SSH resolver now emits the Windsurf import root separately from agent-scoped file records, so transfer can include only state.vscdb, WAL/SHM sidecars, and workspace.json while import keeps the same root metadata. This aligns the default SSH transport with the HTTP remote-sync file-scoped behavior and prevents dir-only Windsurf roots from being archived recursively.

VALID (fixed): kenn-io#1 -- SSH Windsurf remote sync expanded all file-scoped targets into one tar argv list. The SSH transfer now sends the tar script over stdin and feeds selected paths to tar with -T -, so large Windsurf exports do not consume ssh/exec argument space. Message-write benchmarks also silence slow-operation logs because those logs can interleave with benchmark rows and leave benchgate with too few parseable candidate samples.

VALID (fixed): kenn-io#1 -- HTTP remote sync could stream raw Windsurf workspace SQLite state and sidecars to any bearer-token holder allowed to request remote archives. VALID (fixed): kenn-io#2 -- Windsurf freshness and remote target selection treated transient SQLite SHM files as durable session inputs. Windsurf HTTP archives now synthesize a filtered state.vscdb containing only the chat keys the parser consumes, while preserving workspace metadata for project naming. SHM is no longer watched, fingerprinted, or resolved, and SSH tar input skips paths that disappear after resolution so optional WAL sidecars do not abort transfer.

VALID (fixed): kenn-io#1 -- SSH tar path-list mode could treat a dash-leading relative archive input as a tar option. Prefix streamed entries with ./ before they reach tar -T -, preserving root-relative behavior under -C / while keeping file-list parsing safe on GNU tar.

VALID (fixed): kenn-io#1 -- SSH tar path-list mode could split newline-bearing resolved paths into multiple tar entries. Reject CR/LF/NUL target paths before generating the remote shell script. This keeps newline-delimited tar -T input from reinterpreting one existing path as multiple archive requests while preserving the portable tar invocation used for normal paths.

Model-assisted evaluation must not silently weaken the local extraction boundary. Keep judging local by default and require explicit per-run disclosure before a named remote judge receives candidate or transcript-derived evidence. Also bind the merge-hardening plan to the existing source-UUID index, synchronous batched exposure recording, and explicit Milestone 2 ownership of calibration-only APIs and data-retention limits. VALID (fixed): #1-#6, #8. INVALID (dismissed): #7 -- the applicable repository AGENTS.md defines no function-length limit and no repository CLAUDE.md exists. PEDANTIC (skipped): none.

Full-text command-palette search considers one-shot and automated sessions, while the content-search endpoint excludes both unless callers opt in. Send the inclusion flags explicitly so switching to Semantic or Hybrid does not narrow the visible session universe.\n\nVALID (fixed): #1 -- semantic and hybrid requests now include one-shot and automated sessions, with exact request-contract coverage.

Text preselection could discard entries whose only score came from structured metadata or temporal intent, while versioned eval corpora could not be isolated through the supported query surface. Preserve those ranking candidates and expose the existing versioned source-session identity as corpus_id so harnesses can query one corpus without deleting history. VALID (fixed): #1 candidate selection, #2 eval corpus versioning.

A direct session detail route initializes the same filtered sidebar as the Sessions dashboard. Apply explicit or linked date state at the route-entry boundary so the first sidebar request cannot escape the selected range. VALID (fixed): #1 -- restore Sessions dates before loading a direct detail route.

An explicitly dated session detail URL is authoritative cross-page intent when linking is enabled. Publish that intent during parent route initialization, including rolling window provenance, so correctness does not depend on a transient Analytics page mount. VALID (fixed): #1 -- replace the shared range from explicit session detail routes.

A warmed filesystem signature must not make persisted session health invisible. Keep the fast path conditional on an active row with a current parser version and repairable project state, while combining those checks into one scalar query to preserve warm-sync throughput. VALID (fixed): #1 Validation: An isolated 47,081-source warm sync completed in 1.097s versus 1.063s before the guard.

Verified filesystem trust must not override an explicit database request to reprocess every source. Include persisted size and effective mtime in the existing health query so ResetAllMtimes reaches the normal parse path without adding another hot-path round trip. VALID (fixed): #1 Validation: Across 114,184 isolated active source paths, the warmed metadata-aware query took 430.9ms versus 428.5ms for the prior query shape.

A rolling window is durable route intent, while its concrete endpoints are a date-stamped cache. Recompute those endpoints at the Sessions entry boundary so the first sidebar request cannot use stale bounds after the calendar advances. VALID (fixed): #1 -- materialize window_days before loading Sessions and preserve the rolling route parameter.

Refreshing materialized rolling dates must not consume unrelated navigation intent. Keep non-date query parameters intact so message targets survive Sessions route initialization and are processed by the deep-link effect. VALID (fixed): #1 -- preserve non-date route parameters while replacing rolling date keys.

A transcript-only signature cannot safely suppress title refreshes because Codex stores renameable names in a shared sidecar. Trust the raw index identity and change time as part of the source, and make the index cache honor the same change signal so missed watcher events still self-heal without adding title lookups to unchanged warm syncs. VALID (fixed): #1 Validation: An isolated 47,081-source warm sync completed in 1.028s, and 47,000 retained trust records used 10.65 MiB.

Unpinned describes Usage range mode, not whether its materialized endpoints still represent today. Recompute a bare page's rolling window on every entry so crossing midnight cannot make the first request reuse yesterday's bounds. VALID (fixed): #1 -- refresh an unpinned Usage range before its initial request.

Warm no-op syncs briefly use all four configured SQLite readers, but database/sql retained only two and repeatedly paid connection and schema initialization costs. Keeping the burst readers idle until the existing timeout removes that fixed overhead without making them permanent.\n\nA fallback sync owns the startup-maintenance gate once it attempts the skipped work. Release that gate even when the attempt is interrupted so maintenance and daemon idle tracking cannot remain stranded.\n\nVALID (fixed): #1 -- release startup maintenance after every attempted fallback sync.

Usage comparisons must apply the same project selection to both periods or the reported cost delta compares different populations. Copy the complete current filter before replacing its date range, and isolate its exact-label slices so resolved opaque keys and comma-containing labels remain intact without aliasing.\n\nVALID (fixed): #1 -- preserve exact project filters in prior-period usage comparisons.

Ambiguous remote discovery is conflicting evidence, not a root-derived fallback. Dropping it when a resolved remote exists can incorrectly publish a resolved project identity and hide uncertainty from exports and usage consumers. Preserve ambiguous empty-remote rows while continuing to suppress ordinary unknown fallbacks, with matching behavior across SQLite, DuckDB, and PostgreSQL batch publication. VALID (fixed): #1 -- retain ambiguous observations alongside resolved remotes.

Scheduled and API-triggered HTTP syncs must use one lock order or overlapping work can deadlock the daemon. Failed archive extraction setup must also retain downloaded spools for cleanup retry, especially when disk or filesystem failures are already present. Multi-source rebuild safety now evaluates each source independently so successful work from one source cannot authorize swapping an incomplete archive for another, while contributor cancellation and failure diagnostics remain observable. VALID (fixed): #1 lock-order inversion, #2 extraction setup cleanup leak, #3 per-source rebuild safety INVALID (dismissed): none PEDANTIC (skipped): none

Unified local and HTTP rebuilds run before SSH imports, so historical SSH rows must not make an otherwise valid empty participating rebuild look incomplete. Scope the aggregate safety baseline to the machines taking part in the atomic rebuild while retaining each source-specific guard. VALID (fixed): #1 nonparticipating SSH history blocked unified rebuilds INVALID (dismissed): none PEDANTIC (skipped): none

Rebuild coordination can return several independent resource owners through a joined error. Retrying only the first owner can silently release registry blocking while sibling spools or mirror locks remain owned. Retain one bounded aggregate containing only cleanup owners that still fail, preserve the original error chain, and avoid retrying owners after they release. VALID (fixed): #1 joined cleanup errors lost sibling ownership INVALID (dismissed): none PEDANTIC (skipped): none

When the outer HTTP coordinator owns cleanup, a per-host retryable failure must remain a remote failure rather than becoming a fatal local-sync error. Preserve the host while ownership propagates to the registry, and let the coordinator add the sanitized failure exactly once for local-inclusive and remote-only requests. VALID (fixed): #1 retained per-host cleanup lost HTTP attribution INVALID (dismissed): none PEDANTIC (skipped): none

Hashed Claude and Codex skip entries must replace siblings without scanning unrelated archive state; otherwise full sync becomes quadratic and one watcher event scales with total archive size. Build the source-family index once, merge remote cache entries in batch-sized work, and discard ambiguous legacy families so they safely reparse once. VALID (fixed): #1 source-hash skip maintenance scanned the full cache INVALID (dismissed): none PEDANTIC (skipped): none

The literal local label is both ambiguous and a valid remote hostname, so machine-only rebuild guards can attribute one source's history to another and abort a healthy atomic rebuild. Use the operating-system hostname throughout production local ingestion, scope contributor history by its remote ID namespace, and force one reparse so existing source-backed rows adopt the unambiguous identity. VALID (fixed): #1 local and same-named remote history collided in rebuild safety INVALID (dismissed): none PEDANTIC (skipped): none

A service manager or shell can terminate the attached CLI while the old daemon is already stopped. Treat SIGTERM like Ctrl-C so cancellation releases the readiness wait without abandoning the replacement launch. VALID (fixed): #1

The project-evidence shape changed incompatibly after the original v1 surfaces shipped, but the public usage, activity, and session-summary payloads still reported version 1. Mark the current shape as v2 so consumers can reject the transitional 0.38.0/0.38.1 payloads safely. Screenshot extraction also retained source identity evidence outside sessions.machine. Remove those source rows and journals so generated docs assets cannot republish local machine or repository context. VALID (fixed): #1, #2

Repair queue rows are durable, but cancellation after scanning could make status recounts share the canceled context and erase evidence of queued work. Use a bounded detached recount for all post-scan exits, retaining a committed-count fallback when recounting itself fails. Keep the fallback-path test on the vector package's selected SQLite driver so it exercises the same contract on cgo and modernc configurations. VALID (fixed): #1, #2

Repair integrity scans must remain bounded by the scanned documents, even when one document has many chunks. Fetching content once per document avoids multiplying content transfer and allocation by chunk count while preserving the same validation contract. Embeddings commands also need to distinguish an incompatible live daemon from a genuinely unreachable one so users receive the existing restart guidance after an API upgrade. VALID (fixed): #1, #2 INVALID (dismissed): #3, #4 -- already fixed by 929db2d

## What Adds a `--write-timeout` duration flag to `serve` and `pg serve`, making the API write deadline configurable. The default is unchanged at 30s. A non-positive value disables the deadline. ## Why The write deadline was hardcoded at 30s. On large shared datasets the full-history analytics aggregates (heatmap, activity, usage summary) can exceed it and return `503` with `{"error":"request timed out"}`, which surfaces as blank "request timed out" dashboard panels. Operators had no way to raise it. Relates to #1147. ## Where to look - `internal/config/config.go` — the flag is registered on both the `flag` and `pflag` serve flag sets (so `serve` and `pg serve` both accept it) and mapped to `Config.WriteTimeout` in `applyFlagValue`, mirroring `events-coalesce-interval`. - `internal/server/middleware.go` — the standard-handler timeout wrapper now bypasses `http.TimeoutHandler` when the timeout is non-positive, so `0` disables the deadline instead of firing immediately. The typed (Huma) API path already had this guard; this brings the two paths into agreement. - `docs/remote-access.md` — documents raising the timeout for slow aggregates and the flag reference row. ## Tradeoffs and limitations - Raising the timeout treats the symptom. When aggregates are slow enough to need a large value, the underlying database-side cost is usually the real fix — for a multi-tenant read role, a set-based row-level-security predicate rather than a per-row function call. The docs note points there; #1 has the detail. - Flag only; no new config-file or environment key was added, consistent with the neighboring serve duration flags. Co-authored-by: TechnoPhobe01 <Technophobe01@users.noreply.github.com>

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Feb 19, 2026

dependabot Bot force-pushed the dependabot/github_actions/actions/upload-artifact-6.0.0 branch from 7fb882f to 3c426ee Compare February 21, 2026 19:25

dependabot Bot force-pushed the dependabot/github_actions/actions/upload-artifact-6.0.0 branch from 3c426ee to 71ef7e4 Compare February 21, 2026 19:25

wesm mentioned this pull request Feb 22, 2026

build: batch update all dependencies #9

Merged

3 tasks

wesm closed this in #9 Feb 22, 2026

dependabot Bot deleted the dependabot/github_actions/actions/upload-artifact-6.0.0 branch February 22, 2026 17:57

mjacobs mentioned this pull request Jun 16, 2026

feat: add QwenPaw agent support #694

Merged

rodboev mentioned this pull request Jul 11, 2026

serve skips runtime record when data dir is Administrator-owned → serve status blind, desktop app hangs #1097

Open

Technophobe01 mentioned this pull request Jul 14, 2026

feat(serve): make the API write timeout configurable #1148

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): Bump actions/upload-artifact from 4.6.2 to 6.0.0 - #1

build(deps): Bump actions/upload-artifact from 4.6.2 to 6.0.0#1
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions/upload-artifact-6.0.0

dependabot Bot commented on behalf of github Feb 19, 2026 •

edited

Loading

Uh oh!

roborev-ci Bot commented Feb 22, 2026

Uh oh!

dependabot Bot commented on behalf of github Feb 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v6.0.0

v6 - What's new

Node.js 24

What's Changed

v5.0.0

What's Changed

New Contributors

Uh oh!

roborev-ci Bot commented Feb 22, 2026

roborev: Combined Review (71ef7e4)

Uh oh!

dependabot Bot commented on behalf of github Feb 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Feb 19, 2026 •

edited

Loading

roborev: Combined Review (`71ef7e4`)