Standup dashboard for tracking open pull requests, review load, and recent merge activity. PRs are ranked by a severity score that accounts for age, priority labels, staleness, and review status.

return render(() => <RefreshControls />);

PRs are ranked by severity score (based on age, priority labels, staleness, and review status).

return query({ request: "openPrs", key: "openPrs" }).stream()

return query({ request: "mergedPrs", key: "mergedPrs" }).stream()

function OpenSection() {
    const data = openPrsQuery?.data?.parsedBody;
    if (openPrsQuery?.isPending) return <div className="text-sm text-gray-500">Loading open PRs...</div>;
    if (openPrsQuery?.isError) return <div className="text-sm text-red-500">Error loading open PRs</div>;
    if (!Array.isArray(data)) return <div className="text-sm text-gray-500">No data</div>;
    return <PRTable prs={data} type="open" />;
}
return OpenSection;

function MergedOverview() {
    return (
        <div className="flex gap-8 mb-4">
            <div className="flex-1">
                <MergedStats />
            </div>
            <div>
                <MergeHeatmap />
            </div>
        </div>
    );
}
return MergedOverview;

GitHub PR Dashboard

openPrs

mergedPrs

proxy the response error status and body down to the client  (#12528)

https://api.github.com/repos/moment-eng/moment/contents/{+path}

moment

## What this does
rather than returning a 500, proxy the response error status and body. 


---

> [!NOTE]
> **Low Risk**
> Small, localized error-handling change that mainly affects HTTP status/body returned to clients; minimal blast radius outside these two endpoints.
> 
> **Overview**
> Updates Pierre-backed repository endpoints to **proxy upstream error responses** instead of returning generic failures. When `repo.ArchiveStream` or `repo.FileStream` returns a `storage.APIError`, the controller now logs the upstream `status`/`body` and returns `echo.NewHTTPError` with the same status code and body to the client.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 4553af3df4ae07e4bc8fc4917386e422e54b7a68. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

proxy the response error status and body down to the client 

Recovering lita's jj branch lol

Use the Yarn catalog for all Tauri plugins (#12523)

## What this does

Just as the title states :)


---

> [!NOTE]
> **Low Risk**
> Dependency/version-management and CI/test-only changes; main risk is build/runtime issues if the new pinned plugin versions are incompatible.
> 
> **Overview**
> Centralizes Tauri JS plugin versioning by moving plugin deps in `apps/desktop` and `packages/state` to `catalog:` entries and expanding `.yarnrc.yml` to pin specific plugin versions (including bumping `@tauri-apps/plugin-updater` to `^2.10.0`).
> 
> Updates the Rust side to match by bumping `tauri-plugin-updater` to `2.10.0`, expands the Rust version-matching test to validate major/minor alignment across all Tauri plugins (and handle `^`/`~` prefixes), and broadens the desktop PR workflow triggers to run when `.yarnrc.yml`/`yarn.lock` change.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 868f29d41371be39db80d3c96eeeb8c363d6ef22. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

Use the Yarn catalog for all Tauri plugins

allow for {{env._moment.auth_token}} to use moment auth token http request (#12527)

## What this does


---

> [!NOTE]
> **Medium Risk**
> Touches request execution and variable substitution plus introduces token injection, so mistakes could break requests or inadvertently expose tokens via copied cURL/clipboard behavior; overall changes are contained and guarded with fallbacks.
> 
> **Overview**
> Adds support for a new built-in template variable, `{{env._moment.auth_token}}`, which resolves to the user’s current Moment access token during request execution and cURL copy (with unresolved-variable detection updated accordingly).
> 
> Improves authoring and sharing of templated requests: inputs and CodeMirror editors now provide template-variable autocomplete (and highlighting in the body editor), and request copy/paste is upgraded to write/read HTML clipboard payloads that embed the original `HttpRequestPage` so importing a copied request preserves template variables (falling back to plain-text cURL where needed, e.g. Firefox).
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 4aa04d31a9c4424d086bf3f3193a9b72fe93376c. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

allow for {{env._moment.auth_token}} to use moment auth token http request

## What this does

This solves loading issues in the document-list that causes data to start overwriting each other as it loads in, even if the data was cached to begin with



---

> [!NOTE]
> **Medium Risk**
> Touches core document list reconciliation and metadata error-state handling; regressions could cause incorrect titles/dates or loading failures, though changes are guarded and test-covered.
> 
> **Overview**
> Improves document list reliability by changing `DocumentListItem` to carry a `remote` entry (instead of a top-level `workspace`) and updating the docs list UI/linking/disable logic to use that remote workspace data.
> 
> Hardens document/metadata loading by preserving cached collab session data and *enriched* collab metadata (title/updatedAt/type) during remote merges until live collab sessions/metadata arrive, and by ensuring `$setMetadataStateError` and `MetadataNotLoadedError` paths keep existing metadata params/abort controller state. Adds unit tests covering these cache-preservation behaviors, and surfaces collaborative docs in the UI with a badge/tooltip via `WorkspaceIcon`.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit fe719bb85f7f9502e60e4d67bdb8e3f374f3918a. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

Lita/frontend auth token

give feedback to user when checking updates (#12480)

## What this does
I fixed the bug where we were not showing anything when we clicked Check for Updates.

in tauri, when you call `updater.check()` in rust, it will return None, not 

```
UpdateMetadata {
        latest_version: update.version.clone(),
        current_version: update.current_version.clone(),
    })
```
with matching versions, which is what the frontend assumes.

this PR fixes that.



---

> [!NOTE]
> **Low Risk**
> Mostly UX and logging changes around update-check feedback; minimal behavioral risk, mainly limited to when/if update-check toasts appear and how “no update” is represented.
> 
> **Overview**
> Improves the manual *Check for Updates* flow to always provide user feedback via toast notifications.
> 
> The UI now tracks when the tray menu action was invoked and, once the update check finishes (or times out), shows a timed toast for either **“latest version”** or **“new version downloading”** while avoiding late/duplicate toasts.
> 
> On the backend/state side, update metadata fetching logging is promoted to `info`, and the Tauri `fetch_update` command now correctly returns `None` when no update is available (matching `updater.check()` semantics) with additional diagnostic logs.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 2334a6af26e68e96891701b24779f847a6638637. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

give feedback to user when checking updates

> [!NOTE]
> **Low Risk**
> Small path/format change (PNG→SVG) across fetch + gitignore + archive cleanup; main risk is missing previews if the server path or file name doesn’t match.
> 
> **Overview**
> Switches template previews from a top-level `PREVIEW.png` to a versioned `.moment/template-preview.svg` asset.
> 
> The state atom now fetches the preview from the docs API `v2` raw path and returns an SVG data URL, and the Tauri (desktop + iOS) archive init flow deletes `.moment/template-preview.svg` on clone while default `.gitignore` templates explicitly unignore this file under `.moment/*`.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit ae69108df9799ded93185ea57ce91123cf90ef8a. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

Put template preview image in `.moment/template-preview.svg``

Inform user that their session has expired (#12522)

## What this does

Shows a non-blocking pop-up at the bottom right of the app to let the user know that they were logged-out forcefully.

**Note**: I've updated the title of the dialog since taking the screenshot.

<img width="1280" height="720" alt="Screenshot 2026-02-13 at 9 19 53 AM" src="https://github.com/user-attachments/assets/8cb78a87-afd1-409e-8682-80072512c7e5" />

And this is what happens while viewing a collaborative document (i.e. doc shared with me by someone else). The app will no longer automatically open the auth window with the auth0 login page. (The redirect to the local login view already existed.)

https://github.com/user-attachments/assets/17139008-27ab-4c77-bd9a-f291ffc49f2d

## How I tested this

I simulated auth0 not have any refresh token in the cache by wiping out my `localStorage` and tried navigating to a cloud workspace.



---

> [!NOTE]
> **Medium Risk**
> Touches authentication state transitions and token refresh error handling, which can affect login/logout UX and access to cloud documents; changes are localized and primarily UI/state-gating.
> 
> **Overview**
> Adds a new `logged-out-forced` auth state to distinguish unexpected session loss from normal logout, and updates token-refresh error paths in `AuthProvider` to set this state instead of auto-triggering the login flow.
> 
> Introduces a global, non-blocking “Session Expired” popup (`AuthStatusWrapper`) wired into `Providers` that lets users dismiss or re-login, and updates `TopBar` to treat `logged-out-forced` as logged-out. Also clears the stored redirect in `useDoLogout`’s fallback timeout to avoid stale post-logout redirects.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 3028ea49dec26e9d58ca4aadc3d71595f7ccb3a9. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

Inform user that their session has expired

> [!NOTE]
> **Medium Risk**
> Changes loading/config validation in the core ProseMirror editor-state path and alters SSR behavior for a subset of remote documents, which could impact document rendering/loading if misclassified.
> 
> **Overview**
> Template preview documents are now loaded without SSR mode so compute cells aren’t stripped and can run in the preview dialog.
> 
> `$loadEditorState` no longer treats read-only editors as misconfigured when `sendToCollab`/`onPersist` are absent, and it persists `isReadOnly` into the editor params for consistent behavior.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit e7f34ee196852afc54e031bb097c979871563e6f. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

Compute cells should run in the template preview dialog

Bumps the npm_and_yarn group with 1 update in the / directory: [markdown-it](https://github.com/markdown-it/markdown-it).

Updates `markdown-it` from 14.1.0 to 14.1.1
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md">markdown-it's changelog</a>.</em></p>
<blockquote>
<h2>[14.1.1] - 2026-01-11</h2>
<h3>Security</h3>
<ul>
<li>Fixed regression from v13 in linkify inline rule. Specific patterns could
cause high CPU use. Thanks to <a href="https://github.com/ltduc147"><code>@​ltduc147</code></a> for report.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/markdown-it/markdown-it/commit/b4a9b659ef5734223731cfaa3ad5eacc6fc22918"><code>b4a9b65</code></a> 14.1.1 released</li>
<li><a href="https://github.com/markdown-it/markdown-it/commit/4b4bbcae5e0990a5b172378e507b33a59012ed26"><code>4b4bbca</code></a> Fixed perf regression in linkify-it wrapper</li>
<li><a href="https://github.com/markdown-it/markdown-it/commit/d2782d892a51201b25d3eeab172201ad5a53a24c"><code>d2782d8</code></a> Add supplementary example-driven documentation (<a href="https://redirect.github.com/markdown-it/markdown-it/issues/1092">#1092</a>)</li>
<li>See full diff in <a href="https://github.com/markdown-it/markdown-it/compare/14.1.0...14.1.1">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=markdown-it&package-manager=npm_and_yarn&previous-version=14.1.0&new-version=14.1.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/moment-eng/moment/network/alerts).

</details>


---

> [!NOTE]
> **Low Risk**
> Dependency-only patch bumps with no application logic changes; main risk is minor CI/build/runtime differences from updated Cloudflare worker tooling.
> 
> **Overview**
> Updates Cloudflare tooling by bumping `wrangler` from `4.59.1` to `4.59.2` in `cloudflare-proxy` and `tldraw-sync-cloudflare`.
> 
> Refreshes `yarn.lock` to pick up the new `wrangler` transitive set (e.g., `miniflare`, `workerd`, `@cloudflare/*`) and bumps `markdown-it` from `14.1.0` to `14.1.1`.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit f8d458a7537e6593f57ffe38b888ca7c81a82906. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

Pull requests that update a dependency file

dependencies

Pull requests that update Javascript code

javascript

build(deps): bump markdown-it from 14.1.0 to 14.1.1 in the npm_and_yarn group across 1 directory

## What this does

This PR properly terminates the child process rather than simply killing the `Future` on timeout. This bug has been present on all platforms. If anyone ran a script block that would run for more than 30s, the child process would be left running but the Future would just be killed. This is because of the usage of `output()` which does not handle child process termination for run-away scripts.

## How I tested this

Previously, I intentionally executed a long-running script and watched the shell script code cell return after 30s but the process that was spawned by it was left running. I repeated the same test now and watched the child process get killed correctly.


---

> [!NOTE]
> **Medium Risk**
> Changes process execution/timeout behavior; bugs could cause scripts to be killed incorrectly or output/exit codes to be misreported across platforms.
> 
> **Overview**
> Fixes `run_script` so script execution uses `spawn()` and consumes `CommandEvent` output, rather than `output()`, enabling explicit child termination.
> 
> On the 30s timeout, the code now calls `child.kill()` and returns a timeout error, while still collecting `stdout`/`stderr` and exit code when the process terminates normally.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 9a9f6165d770e6bd87d9df88ba37128783eddd9d. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

Kill child process started by ad hoc scripts on timeout

## What this does

Today `run_script` does not work on Windows. It throws a "cannot find specified file" error. The "file" in question is a temp script file containing the script to execute using `powershell.exe`. I tried to keep the temp script around preventing automatic cleanup and still the error persists. My conclusion is that this is something to do with script permissions with the way Tauri's `shell` plugin spawns the `powershell` command. So I wanted to switch to the `std` library to simply invoke `powershell` using [`Command`](https://doc.rust-lang.org/std/process/struct.Command.html). The Rust crate I ended up using is just a wrapper around this with some PowerShell-specific things added to it.

## How I tested this

Ran the app on Windows and saw the various invocations of `run_script` starting to succeed.


---

> [!NOTE]
> **Medium Risk**
> Changes cross-platform script execution behavior and introduces a new PowerShell execution dependency; failures could affect user script running on Windows or non-Windows environments.
> 
> **Overview**
> Fixes `run_script` on Windows by bypassing the temp-file + `tauri-plugin-shell` execution path and instead running the provided script directly via the new `powershell_script` crate (in a `spawn_blocking` task with a 30s timeout).
> 
> Non-Windows behavior is simplified to always write a temp `script` file and execute it with `bash` (removing the Windows-specific temp file naming/command selection logic).
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 1bd6d47776664a6a2ccf8d6de22aeac52553c280. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

Fix custom Tauri command run_script for Windows

## What this does

Fixes an "Access Denied" issue raised by PowerShell when it tries to execute temp scripts.

## How I tested this

Ran the app locally on Windows and my Mac Mini.


---

> [!NOTE]
> **Low Risk**
> Small, localized change to script execution plumbing; main risk is minor cross-platform argument/working-directory differences affecting script invocation.
> 
> **Overview**
> Fixes one-off script execution on Windows by ensuring the temporary script file is **closed before PowerShell runs it**, avoiding "Access Denied" due to an open file handle.
> 
> Updates `run_script` to convert the temp `PathBuf` to a string for argument passing, sets OS-specific command/args (`powershell.exe` vs `bash`), and uses the `temp_dir` handle as the working directory for the spawned command.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 61d545d623d2de7a145f3bf049b8c98744b9f286. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

Close the temp script file created to run one-off scripts on Windows

fix the rust side of downloading clients (#12518)

## What this does

This PR updates the frontend to use the new endpoint in #12515. 

I also had to update the rust code, because gitea would send over the repo within a folder with the name of the repo. Pierre returns a tar file with just the contents, no folder. This PR updates the rust code to make folder with the document id.


---

> [!NOTE]
> **Medium Risk**
> Changes the template download/unpack path and URL parsing in the desktop client, which can break template-based document creation if the new endpoint or archive format differs from expectations.
> 
> **Overview**
> Updates desktop template creation to download archives from the new `/internal/v2/.../archive` endpoint (dropping the `/archive/main.tar.gz` URL format).
> 
> Adjusts the Rust `init_from_archive` flow to stop validating `.tar.gz` URL suffixes and to unpack the tarball into a newly-created subdirectory named after the repo/document id before moving it into place, matching the new archive layout. Also routes Tauri logs to both `Stdout` and the `Webview`, and updates the archive init test to use the new URL path.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 583834e6bbca7861a0c08a91d05d1ce48fa6e0bb. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

fix the rust side of downloading clients

> [!NOTE]
> **Low Risk**
> Small UI toast behavior tweak plus a straightforward error-checking guard around archive downloads; minimal behavioral surface area beyond better failure reporting.
> 
> **Overview**
> Improves failure handling when creating a document from a template: the UI error toast is now *dismissible* so users don’t get stuck with a persistent error message.
> 
> Hardens archive-based repo initialization in the Tauri backend by checking the HTTP response status before streaming/unpacking; non-2xx responses now log the status/body and return a clearer `Error::Archive` instead of proceeding with a bad download.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit c5246e5239fc2b34ac36a85903b39c7686468346. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

Show toasts when `Use template` fails

## What this does
 this PR creates an endpoint `http://localhost:8088/internal/v2/repos/lita/0jeckejkqubu8awzxnwkye3qe/archive` with optional `branch` param to return a tar file of all the contents of the repo.



---

> [!NOTE]
> **High Risk**
> Includes hardcoded Authzed credentials/endpoints and redirects dev Authzed operations to the staging namespace, which can impact shared permissions data if misconfigured.
> 
> **Overview**
> Adds a new authenticated endpoint `GET /internal/v2/repos/:workspaceID/:documentID/archive` (optional `branch`) that streams a tar archive of the entire Pierre repo contents, defaulting to the repo’s default branch when not specified.
> 
> Updates Authzed configuration to use new default staging token/endpoint values and changes Authzed schema namespace generation so *dev* environments write to the *staging* namespace; also adds extra debug logging when Pierre repos are missing.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 4f5bb820a3a7801826f272d3f84369b135acb2cf. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

create archive endpoint that returns all files in a repo

We need this for `claude`.



---

> [!NOTE]
> **Low Risk**
> Tailwind config-only change that slightly increases generated CSS but doesn’t affect runtime logic or security-sensitive code.
> 
> **Overview**
> Extends the Tailwind `safelist` for dynamic color utilities to also generate `dark:hover:` and `dark:focus:` variants, in addition to the existing `hover`, `focus`, and `dark` variants.
> 
> This ensures dark-mode interactive state classes are available even when class names are constructed dynamically (e.g., outside scanned content paths).
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 6545ab02a5952d30b4a6189040295a33f7c818c1. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

Add `dark:hover:` variants to Tailwind safelist

This PR proposes that docs with `type: template` should be publishable.
Mostly this is for our own usage in the `moment-templates` org. But it's
also just a very natural fit, as it turns out.

We don't expect template docs to be be collaboratively edited. We
expect them to mostly be versioned with jj and published to our git
backend. And, when we publish a template, we'd very much like it to have
a website that we can link to in a marketing page. This makes the
workflow very amenable to the normal publishing flow.

Right now, all docs with `request` pages can't be published at all,
because we haven't fully lit up Atlas. But templates have cached data
bundled in the `.moment` directory, so they are in some sense fully
functional. So it doesn't make a lot of sense to prevent publishing
templates. Thus, that's what we propose to do.



---

> [!NOTE]
> **Low Risk**
> UI/validation-only changes that widen an existing publish eligibility check; minimal risk aside from possibly allowing templates with `request` pages to publish unexpectedly.
> 
> **Overview**
> Publishing is now permitted for documents with `type: "template"` even when they contain `request` pages, by exempting templates from the existing “HTTP pages can’t be published” check.
> 
> The publish settings blade now also *hard-blocks* the Publish action when a non-template document includes HTTP request pages and shows a clear inline message explaining the limitation.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 750933b6d76d039631349a28244db42e4b7e7824. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

We SHOULD allow publishing of `template` docs with `request` in them

> [!NOTE]
> **Medium Risk**
> Moderate risk because it changes template selection semantics (preview vs use) and switches identifiers from name to `id`, which could break template actions if any callers still assume the old shape or routing behavior.
> 
> **Overview**
> Improves the template gallery interaction model: non-blank `TemplateCard`s now show a hover/focus overlay with explicit **Use template** and optional **Preview** actions, while the blank-document card remains a single-click action; card styling/focus behavior is adjusted and the template fallback background is simplified.
> 
> Updates the gallery flow to separate “use” vs “preview” callbacks, moves the primary action button into the dialog header (removing the footer), adjusts the grid layout, and restyles the preview pane (adds centered container and title header).
> 
> Aligns state/API typing with a new templates response shape by introducing `Template` and `TemplateWorkspace` types, updating `docsApi.templates.list` and `$templates` to return `Template[]`, and updating UI to use `template.id`/`template.title` instead of the old name-based fields; `AddIcon` is re-pointed to the Material icon export.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 138d3876d704eefe21a4156546400ef5dc3cdf84. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

Fix various style annoyances in `TemplateCard` and  `Header`

## What this does

When logging in after accepting an invite, it drops you on a 404 page because we never created the login route


---

> [!NOTE]
> **Medium Risk**
> Touches the login/redirect flow and auth status updates; mistakes here can strand users on the wrong route or cause redirect loops, though the change is small and localized.
> 
> **Overview**
> Adds a new Next.js `/login` page that serves as the Auth0 `redirect_uri` landing route and, once authenticated, reads a persisted redirect target from `useAuthRedirect`, marks auth status as logged in, navigates back to that path, and then clears the stored redirect to avoid reuse.
> 
> Updates `AGENTS.md` to document that components should prefer `useAuth` from `@moment/state` over directly using Auth0’s `useAuth0` hook (reserved for `AuthProvider` internals).
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit e8f33bbea9e8069c53b59c81aaa64ef217ee6f79. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

web should redirect after login

## What this does

I'm trying to have Claude write a document for me, which it gave me some "debugOutput" in my document to look at and I realized that it's REALLY hard to copy text out of these inspectors. This adds a copy button to make it trivial to help the agents out

[Screencast_20260212_142904.webm](https://github.com/user-attachments/assets/5362fd8c-9956-407a-9dae-ee735850893c)


---

> [!NOTE]
> **Low Risk**
> UI-only change limited to the inspector row component; main risk is minor UX/interaction regressions around row click/expand and clipboard permissions/failures.
> 
> **Overview**
> Adds a copy-to-clipboard affordance to `InspectorRow` so users can quickly copy JSON/primitive values from inspector outputs.
> 
> Each row now renders a hover-revealed copy icon that serializes non-string values via `safeStringify`, writes via `writeClipboardText`, and briefly shows a checkmark on success; click handling is isolated to avoid triggering row expand/collapse and the row is wrapped in a `group` to drive hover styling.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 3a007206a3990f025d50859a9f5b1abbb711dc84. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

add ability to copy data from json outputs

When a user clicks the `New Document` button, it will bring up a dialog with a bunch of templates which they can preview or use outright. Nearly all templates have data, so in order to be useful, they'll have to have some "stock" or "template" data. That is roughly what this PR proposes, but we also add some flourish to make authoring templates a little more ergonomic.

  - First, the "template responses" are going to be stored in `.moment/template-responses.json`. Its schema will be page ID -> query key -> `HttpResponse`.
  - Specifically, any `query()` that uses a `key` will be automatically persisted inside this file when run; `query()` calls without a key don't have a stable identifier and therefore can't be saved, since they'll never be reused or memoized.
  - In local development mode, these "cached" queries will be initially served from the `template-responses.json`, in a stale-while-refetch capacity.
  - In "template mode" (*i.e.*, when the user is viewing the template from the template screen), the data will be served from `git.moment.dev`.
  - This means `.moment/template-responses.json` has to be checked in, so we need to add a rule to not ignore this in the `.gitignore`.
  - Lastly, we add a field in `moment.yml`: `type: template`. This allows us to show a nice batch near the document title that says "Template", and it allows us to know to save responses to the JSON file. This will also allow the Share tab to know to publish to `moment-templates`. We strip this out when we clone the template.


---

> [!NOTE]
> **Medium Risk**
> Medium risk because it changes request execution behavior (introducing template-only short-circuiting, SWR revalidation, and filesystem writes) and adds a new DocsAPI raw-file read path that affects network/error handling.
> 
> **Overview**
> Introduces a new document `type: template` (schema + clone workflow) and surfaces it in the editor header via a **Template** badge.
> 
> Adds template request-response caching via `.moment/template-responses.json`: template previews now **never execute live requests** and instead read cached responses from the remote repo, while local template documents use stale-while-revalidate and automatically persist successful responses for queries with an explicit/stable `key` (serialized with a per-document write queue).
> 
> Extends DocsAPI with `document.readRawFile` to fetch arbitrary raw files, exports `$templateDocuments` for template-preview detection, and updates default `.gitignore` rules to allow committing `.moment/template-responses.json`.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit ec66da79c3a1b763eb9b4b21ee4ba3b0f823717f. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

`request` pages should serve "default" data when in template mode

build(deps): bump the npm_and_yarn group across 1 directory with 8 updates

Bumps [renovatebot/github-action](https://github.com/renovatebot/github-action) from 44.2.3 to 46.0.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/renovatebot/github-action/releases">renovatebot/github-action's releases</a>.</em></p>
<blockquote>
<h2>v46.0.1</h2>
<h2><a href="https://github.com/renovatebot/github-action/compare/v46.0.0...v46.0.1">46.0.1</a> (2026-02-02)</h2>
<h3>Miscellaneous Chores</h3>
<ul>
<li><strong>deps:</strong> update dependency <code>@​tsconfig/strictest</code> to v2.0.8 (<a href="https://redirect.github.com/renovatebot/github-action/issues/959">#959</a>) (<a href="https://github.com/renovatebot/github-action/commit/6ba4a5c49bdc84e5abe747dbed81d165c999671b">6ba4a5c</a>)</li>
<li><strong>deps:</strong> update dependency prettier-plugin-packagejson to v3 (<a href="https://redirect.github.com/renovatebot/github-action/issues/999">#999</a>) (<a href="https://github.com/renovatebot/github-action/commit/bce6a9f3a2fda6ad56daafcf36a91a1f46d1257e">bce6a9f</a>)</li>
<li><strong>deps:</strong> update dependency renovatebot/github-action to v46 (<a href="https://redirect.github.com/renovatebot/github-action/issues/1011">#1011</a>) (<a href="https://github.com/renovatebot/github-action/commit/4d7de5784c7b92e319fd32b1af7a8d38fe64460b">4d7de57</a>)</li>
<li><strong>deps:</strong> update prettier packages (<a href="https://redirect.github.com/renovatebot/github-action/issues/988">#988</a>) (<a href="https://github.com/renovatebot/github-action/commit/8a6192ff3afc4d35378faa05f1263bd5d581f0e3">8a6192f</a>)</li>
</ul>
<h3>Build System</h3>
<ul>
<li><strong>deps:</strong> lock file maintenance (<a href="https://github.com/renovatebot/github-action/commit/2fec0324c9ed9958e191c1584cbbe6393bd4201f">2fec032</a>)</li>
</ul>
<h3>Continuous Integration</h3>
<ul>
<li><strong>deps:</strong> update ghcr.io/renovatebot/renovate docker tag to v43.0.6 (<a href="https://github.com/renovatebot/github-action/commit/d361423d7ca6c8b6aecac06de635f3eab4c50fba">d361423</a>)</li>
<li><strong>deps:</strong> update ghcr.io/renovatebot/renovate docker tag to v43.0.8 (<a href="https://github.com/renovatebot/github-action/commit/c0ab525a8c1ce24e8cfd103da4fc815757517cea">c0ab525</a>)</li>
<li><strong>deps:</strong> update ghcr.io/renovatebot/renovate docker tag to v43.0.9 (<a href="https://github.com/renovatebot/github-action/commit/9f55a793098a593ef48e940e86d2ef8a6d2aaef3">9f55a79</a>)</li>
</ul>
<h2>v46.0.0</h2>
<h2><a href="https://github.com/renovatebot/github-action/compare/v45.0.3...v46.0.0">46.0.0</a> (2026-01-30)</h2>
<h3>⚠ BREAKING CHANGES</h3>
<ul>
<li><strong>deps:</strong> Update ghcr.io/renovatebot/renovate Docker tag to v43 (<a href="https://redirect.github.com/renovatebot/github-action/issues/993">#993</a>)</li>
</ul>
<h3>Features</h3>
<ul>
<li><strong>deps:</strong> Update ghcr.io/renovatebot/renovate Docker tag to v43 (<a href="https://redirect.github.com/renovatebot/github-action/issues/993">#993</a>) (<a href="https://github.com/renovatebot/github-action/commit/ae99b3785a62172a73624ed1b9675e3253859a7b">ae99b37</a>)</li>
</ul>
<h2>v45.0.3</h2>
<h2><a href="https://github.com/renovatebot/github-action/compare/v45.0.2...v45.0.3">45.0.3</a> (2026-01-30)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>deps:</strong> update dependency <code>@​actions/core</code> to v3 (<a href="https://redirect.github.com/renovatebot/github-action/issues/1008">#1008</a>) (<a href="https://github.com/renovatebot/github-action/commit/d724dd314fec182f6a6763dc421f460bc8161514">d724dd3</a>)</li>
</ul>
<h2>v45.0.2</h2>
<h2><a href="https://github.com/renovatebot/github-action/compare/v45.0.1...v45.0.2">45.0.2</a> (2026-01-30)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>deps:</strong> update dependency <code>@​actions/exec</code> to v3 (<a href="https://redirect.github.com/renovatebot/github-action/issues/1009">#1009</a>) (<a href="https://github.com/renovatebot/github-action/commit/e098430c9cb1d90887f879b0a0a7d4179bbb0c13">e098430</a>)</li>
</ul>
<h3>Miscellaneous Chores</h3>
<ul>
<li><strong>deps:</strong> replace dependency <code>@​tsconfig/node20</code> with <code>@​tsconfig/node22</code> (<a href="https://redirect.github.com/renovatebot/github-action/issues/1010">#1010</a>) (<a href="https://github.com/renovatebot/github-action/commit/df519dcd60c57f54daf148ccbc3127b040e77977">df519dc</a>)</li>
<li><strong>deps:</strong> update dependency <code>@​tsconfig/node22</code> to v22.0.5 (<a href="https://github.com/renovatebot/github-action/commit/29e7d615e01933658c14b6943d39bceed217e12c">29e7d61</a>)</li>
</ul>

</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/renovatebot/github-action/commit/3c68caaa9db5ff24332596591dc7c4fed8de16ce"><code>3c68caa</code></a> chore(release): 46.0.1 [skip ci]</li>
<li><a href="https://github.com/renovatebot/github-action/commit/26eb7f37ea0deffa41879ef27f1f4ddfc2f456b2"><code>26eb7f3</code></a> skip: merge (2fec0324c9ed9958e191c1584cbbe6393bd4201f) [skip release]</li>
<li><a href="https://github.com/renovatebot/github-action/commit/2fec0324c9ed9958e191c1584cbbe6393bd4201f"><code>2fec032</code></a> build(deps): lock file maintenance</li>
<li><a href="https://github.com/renovatebot/github-action/commit/898c7b728a8d69cf013b86c547b35f59bd10d663"><code>898c7b7</code></a> skip: merge (9f55a793098a593ef48e940e86d2ef8a6d2aaef3) [skip release]</li>
<li><a href="https://github.com/renovatebot/github-action/commit/9f55a793098a593ef48e940e86d2ef8a6d2aaef3"><code>9f55a79</code></a> ci(deps): update ghcr.io/renovatebot/renovate docker tag to v43.0.9</li>
<li><a href="https://github.com/renovatebot/github-action/commit/a9447b017c443b10a439d8c811669017292f4186"><code>a9447b0</code></a> skip: merge (c0ab525a8c1ce24e8cfd103da4fc815757517cea) [skip release]</li>
<li><a href="https://github.com/renovatebot/github-action/commit/c0ab525a8c1ce24e8cfd103da4fc815757517cea"><code>c0ab525</code></a> ci(deps): update ghcr.io/renovatebot/renovate docker tag to v43.0.8</li>
<li><a href="https://github.com/renovatebot/github-action/commit/a075c0dcc05e5e53046646f8637da4990da67674"><code>a075c0d</code></a> skip: merge (d361423d7ca6c8b6aecac06de635f3eab4c50fba) [skip release]</li>
<li><a href="https://github.com/renovatebot/github-action/commit/d361423d7ca6c8b6aecac06de635f3eab4c50fba"><code>d361423</code></a> ci(deps): update ghcr.io/renovatebot/renovate docker tag to v43.0.6</li>
<li><a href="https://github.com/renovatebot/github-action/commit/fa084f4e6a9f241e138930fc8864acf31d3f0976"><code>fa084f4</code></a> skip: merge (bce6a9f3a2fda6ad56daafcf36a91a1f46d1257e) [skip release]</li>
<li>Additional commits viewable in <a href="https://github.com/renovatebot/github-action/compare/v44.2.3...v46.0.1">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=renovatebot/github-action&package-manager=github_actions&previous-version=44.2.3&new-version=46.0.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>

Pull requests that update GitHub Actions code

github_actions

build(deps): bump renovatebot/github-action from 44.2.3 to 46.0.1

## What this does

I don't think this has worked since before we moved the web app lol

fix invite acceptance

Bumps [css-loader](https://github.com/webpack-contrib/css-loader) from 6.11.0 to 7.1.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/webpack-contrib/css-loader/releases">css-loader's releases</a>.</em></p>
<blockquote>
<h2>v7.1.2</h2>
<h3><a href="https://github.com/webpack-contrib/css-loader/compare/v7.1.1...v7.1.2">7.1.2</a> (2024-05-22)</h3>
<h3>Bug Fixes</h3>
<ul>
<li>keep order of <code>@import</code>s with the <code>webpackIgnore</code> comment (<a href="https://redirect.github.com/webpack-contrib/css-loader/issues/1600">#1600</a>) (<a href="https://github.com/webpack-contrib/css-loader/commit/76757ef30ec37f88ccf9d8b82d8d84b7625c5d66">76757ef</a>)</li>
</ul>
<h2>v7.1.1</h2>
<h3><a href="https://github.com/webpack-contrib/css-loader/compare/v7.1.0...v7.1.1">7.1.1</a> (2024-04-10)</h3>
<h3>Bug Fixes</h3>
<ul>
<li>automatically rename class <code>default</code> to <code>_default</code> when named export is enabled (<a href="https://redirect.github.com/webpack-contrib/css-loader/issues/1590">#1590</a>) (<a href="https://github.com/webpack-contrib/css-loader/commit/d6c31a17a0dde3e2bcf2b5e55f913c3645d32868">d6c31a1</a>)</li>
</ul>
<h2>v7.1.0</h2>
<h2><a href="https://github.com/webpack-contrib/css-loader/compare/v7.0.0...v7.1.0">7.1.0</a> (2024-04-08)</h2>
<h3>Features</h3>
<ul>
<li>added the <code>getJSON</code> option to output CSS modules mapping (<a href="https://redirect.github.com/webpack-contrib/css-loader/issues/1577">#1577</a>) (<a href="https://github.com/webpack-contrib/css-loader/commit/af834b43b375f336108d74ff7bd9ed13bc79200a">af834b4</a>)</li>
</ul>
<h2>v7.0.0</h2>
<h2><a href="https://github.com/webpack-contrib/css-loader/compare/v6.11.0...v7.0.0">7.0.0</a> (2024-04-04)</h2>
<h3>⚠ BREAKING CHANGES</h3>
<ul>
<li>The <code>modules.namedExport</code> option is <code>true</code> by default if you enable the <code>esModule</code> option</li>
</ul>
<p>Migration guide:</p>
<p>Before:</p>
<pre lang="js"><code>import style from &quot;./style.css&quot;;
<p>console.log(style.myClass);<br />
</code></pre></p>
<p>After:</p>
<pre lang="js"><code>import * as style from &quot;./style.css&quot;;
<p>console.log(style.myClass);<br />
</code></pre></p>

</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/webpack/css-loader/blob/main/CHANGELOG.md">css-loader's changelog</a>.</em></p>
<blockquote>
<h3><a href="https://github.com/webpack-contrib/css-loader/compare/v7.1.1...v7.1.2">7.1.2</a> (2024-05-22)</h3>
<h3>Bug Fixes</h3>
<ul>
<li>keep order of <code>@import</code>s with the <code>webpackIgnore</code> comment (<a href="https://redirect.github.com/webpack-contrib/css-loader/issues/1600">#1600</a>) (<a href="https://github.com/webpack-contrib/css-loader/commit/76757ef30ec37f88ccf9d8b82d8d84b7625c5d66">76757ef</a>)</li>
</ul>
<h3><a href="https://github.com/webpack-contrib/css-loader/compare/v7.1.0...v7.1.1">7.1.1</a> (2024-04-10)</h3>
<h3>Bug Fixes</h3>
<ul>
<li>automatically rename class <code>default</code> to <code>_default</code> when named export is enabled (<a href="https://redirect.github.com/webpack-contrib/css-loader/issues/1590">#1590</a>) (<a href="https://github.com/webpack-contrib/css-loader/commit/d6c31a17a0dde3e2bcf2b5e55f913c3645d32868">d6c31a1</a>)</li>
</ul>
<h2><a href="https://github.com/webpack-contrib/css-loader/compare/v7.0.0...v7.1.0">7.1.0</a> (2024-04-08)</h2>
<h3>Features</h3>
<ul>
<li>added the <code>getJSON</code> option to output CSS modules mapping (<a href="https://redirect.github.com/webpack-contrib/css-loader/issues/1577">#1577</a>) (<a href="https://github.com/webpack-contrib/css-loader/commit/af834b43b375f336108d74ff7bd9ed13bc79200a">af834b4</a>)</li>
</ul>
<h2><a href="https://github.com/webpack-contrib/css-loader/compare/v6.11.0...v7.0.0">7.0.0</a> (2024-04-04)</h2>
<h3>⚠ BREAKING CHANGES</h3>
<ul>
<li>The <code>modules.namedExport</code> option is <code>true</code> by default if you enable the <code>esModule</code> option</li>
</ul>
<p>Migration guide:</p>
<p>Before:</p>
<pre lang="js"><code>import style from &quot;./style.css&quot;;
<p>console.log(style.myClass);<br />
</code></pre></p>
<p>After:</p>
<pre lang="js"><code>import * as style from &quot;./style.css&quot;;
<p>console.log(style.myClass);<br />
</code></pre></p>
<p>To restore 6.x behavior, please use:</p>
<pre lang="js"><code>module.exports = {
&lt;/tr&gt;&lt;/table&gt; 
</code></pre>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/webpack/css-loader/commit/d5ba44ae2e0bf20d31fe43fd7a2c467937dde97d"><code>d5ba44a</code></a> chore(release): 7.1.2</li>
<li><a href="https://github.com/webpack/css-loader/commit/76757ef30ec37f88ccf9d8b82d8d84b7625c5d66"><code>76757ef</code></a> fix: keep order of <code>@import</code>s with the <code>webpackIgnore</code> comment (<a href="https://redirect.github.com/webpack-contrib/css-loader/issues/1600">#1600</a>)</li>
<li><a href="https://github.com/webpack/css-loader/commit/4b41689003beb7f44642c6f4f52506d81fc14106"><code>4b41689</code></a> ci: use node v22 (<a href="https://redirect.github.com/webpack-contrib/css-loader/issues/1596">#1596</a>)</li>
<li><a href="https://github.com/webpack/css-loader/commit/20682222edaeb3c752aa301a992719919d3b3ed2"><code>2068222</code></a> chore: update dependencies to latest version (<a href="https://redirect.github.com/webpack-contrib/css-loader/issues/1595">#1595</a>)</li>
<li><a href="https://github.com/webpack/css-loader/commit/e006f66ebf1bed92f643c01af8e542e7519c4611"><code>e006f66</code></a> refactor: use <code>environment</code> to get <code>templateLiteral</code> value (<a href="https://redirect.github.com/webpack-contrib/css-loader/issues/1591">#1591</a>)</li>
<li><a href="https://github.com/webpack/css-loader/commit/5c717c986784f20307aaa66e46c8805b84f22cc8"><code>5c717c9</code></a> chore(release): 7.1.1</li>
<li><a href="https://github.com/webpack/css-loader/commit/d6c31a17a0dde3e2bcf2b5e55f913c3645d32868"><code>d6c31a1</code></a> fix: automatically rename class <code>default</code> to <code>_default</code> when named export is ...</li>
<li><a href="https://github.com/webpack/css-loader/commit/b162e252eef254d6c8271dad1751690ac4214c34"><code>b162e25</code></a> chore(release): 7.1.0</li>
<li><a href="https://github.com/webpack/css-loader/commit/15f793d4fae5bd6addf84a8fce50470af9bf5129"><code>15f793d</code></a> docs: update logic (<a href="https://redirect.github.com/webpack-contrib/css-loader/issues/1587">#1587</a>)</li>
<li><a href="https://github.com/webpack/css-loader/commit/9c165a4b9152d1bb5d8738f9b7775907f5483295"><code>9c165a4</code></a> docs: update migration guide (<a href="https://redirect.github.com/webpack-contrib/css-loader/issues/1586">#1586</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/webpack-contrib/css-loader/compare/v6.11.0...v7.1.2">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=css-loader&package-manager=npm_and_yarn&previous-version=6.11.0&new-version=7.1.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

You can trigger a rebase of this PR by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>

> **Note**
> Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

build(deps-dev): bump css-loader from 6.11.0 to 7.1.2

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 5 to 6.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/actions/upload-artifact/releases">actions/upload-artifact's releases</a>.</em></p>
<blockquote>
<h2>v6.0.0</h2>
<h2>v6 - What's new</h2>
<blockquote>
<p>[!IMPORTANT]
actions/upload-artifact@v6 now runs on Node.js 24 (<code>runs.using: node24</code>) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.</p>
</blockquote>
<h3>Node.js 24</h3>
<p>This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.</p>
<h2>What's Changed</h2>
<ul>
<li>Upload Artifact Node 24 support by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/719">actions/upload-artifact#719</a></li>
<li>fix: update <code>@​actions/artifact</code> for Node.js 24 punycode deprecation by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/744">actions/upload-artifact#744</a></li>
<li>prepare release v6.0.0 for Node.js 24 support by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/745">actions/upload-artifact#745</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/upload-artifact/compare/v5.0.0...v6.0.0">https://github.com/actions/upload-artifact/compare/v5.0.0...v6.0.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/actions/upload-artifact/commit/b7c566a772e6b6bfb58ed0dc250532a479d7789f"><code>b7c566a</code></a> Merge pull request <a href="https://redirect.github.com/actions/upload-artifact/issues/745">#745</a> from actions/upload-artifact-v6-release</li>
<li><a href="https://github.com/actions/upload-artifact/commit/e516bc8500aaf3d07d591fcd4ae6ab5f9c391d5b"><code>e516bc8</code></a> docs: correct description of Node.js 24 support in README</li>
<li><a href="https://github.com/actions/upload-artifact/commit/ddc45ed9bca9b38dbd643978d88e3981cdc91415"><code>ddc45ed</code></a> docs: update README to correct action name for Node.js 24 support</li>
<li><a href="https://github.com/actions/upload-artifact/commit/615b319bd27bb32c3d64dca6b6ed6974d5fbe653"><code>615b319</code></a> chore: release v6.0.0 for Node.js 24 support</li>
<li><a href="https://github.com/actions/upload-artifact/commit/017748b48f8610ca8e6af1222f4a618e84a9c703"><code>017748b</code></a> Merge pull request <a href="https://redirect.github.com/actions/upload-artifact/issues/744">#744</a> from actions/fix-storage-blob</li>
<li><a href="https://github.com/actions/upload-artifact/commit/38d4c7997f5510fcc41fc4aae2a6b97becdbe7fc"><code>38d4c79</code></a> chore: rebuild dist</li>
<li><a href="https://github.com/actions/upload-artifact/commit/7d27270e0cfd253e666c44abac0711308d2d042f"><code>7d27270</code></a> chore: add missing license cache files for <code>@​actions/core</code>, <code>@​actions/io</code>, and mi...</li>
<li><a href="https://github.com/actions/upload-artifact/commit/5f643d3c9475505ccaf26d686ffbfb71a8387261"><code>5f643d3</code></a> chore: update license files for <code>@​actions/artifact</code><a href="https://github.com/5"><code>@​5</code></a>.0.1 dependencies</li>
<li><a href="https://github.com/actions/upload-artifact/commit/1df1684032c88614064493e1a0478fcb3583e1d0"><code>1df1684</code></a> chore: update package-lock.json with <code>@​actions/artifact</code><a href="https://github.com/5"><code>@​5</code></a>.0.1</li>
<li><a href="https://github.com/actions/upload-artifact/commit/b5b1a918401ee270935b6b1d857ae66c85f3be6f"><code>b5b1a91</code></a> fix: update <code>@​actions/artifact</code> to ^5.0.0 for Node.js 24 punycode fix</li>
<li>Additional commits viewable in <a href="https://github.com/actions/upload-artifact/compare/v5...v6">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/upload-artifact&package-manager=github_actions&previous-version=5&new-version=6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

You can trigger a rebase of this PR by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>

> **Note**
> Automatic rebases have been disabled on this pull request as it has been open for over 30 days.


build(deps): bump actions/upload-artifact from 5 to 6

Bumps [tauri](https://github.com/tauri-apps/tauri) from 2.9.1 to 2.9.5.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/tauri-apps/tauri/releases">tauri's releases</a>.</em></p>
<blockquote>
<h2>tauri-cli v2.9.5</h2>

<pre><code>Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 881 security advisories (from /home/runner/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (1060 crate dependencies)
Crate:     atk
Version:   0.18.2
Warning:   unmaintained
Title:     gtk-rs GTK3 bindings - no longer maintained
Date:      2024-03-04
ID:        RUSTSEC-2024-0413
URL:       https://rustsec.org/advisories/RUSTSEC-2024-0413
Dependency tree:
atk 0.18.2
└── gtk 0.18.2
    ├── wry 0.53.4
    │   └── tauri-runtime-wry 2.9.2
    │       └── tauri 2.9.4
    │           ├── tauri-plugin-sample 0.1.0
    │           │   └── api 0.1.0
    │           ├── tauri-plugin-log 2.6.0
    │           │   └── api 0.1.0
    │           ├── tauri-file-associations-demo 0.1.0
    │           ├── tauri 2.9.4
    │           ├── restart 0.1.0
    │           ├── resources 0.1.0
    │           ├── bench_helloworld 0.1.0
    │           ├── bench_files_transfer 0.1.0
    │           ├── bench_cpu_intensive 0.1.0
    │           └── api 0.1.0
    ├── webkit2gtk 2.0.1
    │   ├── wry 0.53.4
    │   ├── tauri-runtime-wry 2.9.2
    │   ├── tauri-runtime 2.9.2
    │   │   ├── tauri-runtime-wry 2.9.2
    │   │   └── tauri 2.9.4
    │   └── tauri 2.9.4
    ├── tauri-runtime-wry 2.9.2
    ├── tauri-runtime 2.9.2
    ├── tauri 2.9.4
    ├── tao 0.34.5
    │   └── tauri-runtime-wry 2.9.2
    ├── muda 0.17.1
    │   ├── tray-icon 0.21.0
    │   │   └── tauri 2.9.4
    │   └── tauri 2.9.4
&lt;/tr&gt;&lt;/table&gt; 
</code></pre>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/tauri-apps/tauri/commit/f2e0405dc2d8bae949de6bb5e479bbf3cde401b6"><code>f2e0405</code></a> apply version updates (<a href="https://redirect.github.com/tauri-apps/tauri/issues/14592">#14592</a>)</li>
<li><a href="https://github.com/tauri-apps/tauri/commit/54e8d93db1278e4bd3e9e1ae57ecb4ac1b4f63cd"><code>54e8d93</code></a> ci(renovate): group worker-rs updates</li>
<li><a href="https://github.com/tauri-apps/tauri/commit/251203b8963419cb3b40741767393e8f3c909ef9"><code>251203b</code></a> fix(linux): work area returns logical rect (<a href="https://redirect.github.com/tauri-apps/tauri/issues/14637">#14637</a>)</li>
<li><a href="https://github.com/tauri-apps/tauri/commit/91becd9e4fa2db089ddc6b21dadc06133e939e08"><code>91becd9</code></a> fix(nsis): plugins not signed (<a href="https://redirect.github.com/tauri-apps/tauri/issues/14627">#14627</a>)</li>
<li><a href="https://github.com/tauri-apps/tauri/commit/018b4db22e167fa67b37b0933e192a0f3556d3e5"><code>018b4db</code></a> fix(bundler): skip signing for nsis uninstaller on <code>--no-sign</code> (<a href="https://redirect.github.com/tauri-apps/tauri/issues/14625">#14625</a>)</li>
<li><a href="https://github.com/tauri-apps/tauri/commit/731dd5bfdc62505c904bf8e7262bb5c1428b5a5a"><code>731dd5b</code></a> docs: remove <code>$APP</code> and <code>$LOG</code> from <code>FsScope</code> (<a href="https://redirect.github.com/tauri-apps/tauri/issues/14623">#14623</a>)</li>
<li><a href="https://github.com/tauri-apps/tauri/commit/7b1b3514df771e6e9859b9f54fa4df332433948e"><code>7b1b351</code></a> changes(cli): log npm package version parse in debug level (<a href="https://redirect.github.com/tauri-apps/tauri/issues/14621">#14621</a>)</li>
<li><a href="https://github.com/tauri-apps/tauri/commit/546b296405bfff42f2181e1bacbb9724e32c469e"><code>546b296</code></a> fix(tauri-bundler): add a bit more context to error message (<a href="https://redirect.github.com/tauri-apps/tauri/issues/14606">#14606</a>)</li>
<li><a href="https://github.com/tauri-apps/tauri/commit/514cf21e1417c7a78a0db494f891ba79d948b73d"><code>514cf21</code></a> chore(deps): update num-bigint-dig to version 0.8.6 (<a href="https://redirect.github.com/tauri-apps/tauri/issues/14591">#14591</a>)</li>
<li><a href="https://github.com/tauri-apps/tauri/commit/60174527c06950964ed5146eca1be0088321c800"><code>6017452</code></a> chore(deps): update rust crate ico to 0.5 (<a href="https://redirect.github.com/tauri-apps/tauri/issues/14589">#14589</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/tauri-apps/tauri/compare/tauri-v2.9.1...tauri-v2.9.5">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tauri&package-manager=cargo&previous-version=2.9.1&new-version=2.9.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

You can trigger a rebase of this PR by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>

> **Note**
> Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

rust

build(deps): bump tauri from 2.9.1 to 2.9.5 in /tauri-app/src-tauri

Bumps the go_modules group with 1 update in the /docsapi directory: [github.com/quic-go/quic-go](https://github.com/quic-go/quic-go).

Updates `github.com/quic-go/quic-go` from 0.49.1 to 0.57.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/quic-go/quic-go/releases">github.com/quic-go/quic-go's releases</a>.</em></p>
<blockquote>
<h2>v0.57.0</h2>
<p>This release contains a fix for CVE-2025-64702 by reworking the HTTP/3 header processing logic:</p>
<ul>
<li>Both client and server now send their respective header size constraints using the SETTINGS_MAX_FIELD_SECTION_SIZE setting: <a href="https://redirect.github.com/quic-go/quic-go/issues/5431">#5431</a></li>
<li>For any QPACK-related errors, the correct error code (QPACK_DECOMPRESSION_FAILED) is now used: <a href="https://redirect.github.com/quic-go/quic-go/issues/5439">#5439</a></li>
<li>QPACK header parsing is now incremental (instead of parsing all headers at once), which is ~5-10% faster and reduces allocations: <a href="https://redirect.github.com/quic-go/quic-go/issues/5435">#5435</a> (and <a href="https://redirect.github.com/quic-go/qpack/pull/67">quic-go/qpack#67</a>)</li>
<li>The server now sends a 431 status code (Request Header Fields Too Large) when encountering HTTP header fields exceeding the size constraint: <a href="https://redirect.github.com/quic-go/quic-go/issues/5452">#5452</a></li>
</ul>
<p> </p>
<h2>Breaking Changes</h2>
<ul>
<li>http3: <code>Transport.MaxResponseBytes</code> is now an <code>int</code> (before: <code>int64</code>): <a href="https://redirect.github.com/quic-go/quic-go/issues/5433">#5433</a>
 </li>
</ul>
<h2>Notable Fixes</h2>
<ul>
<li>qlogwriter: fix storing of event schemas (this prevented qlog event logging from working for HTTP/3): <a href="https://redirect.github.com/quic-go/quic-go/issues/5430">#5430</a></li>
<li>http3: errors sending the request are now ignored, instead, the response from the server is read (thereby allowing the client to read the status code, for example): <a href="https://redirect.github.com/quic-go/quic-go/issues/5432">#5432</a></li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>build(deps): bump golangci/golangci-lint-action from 8 to 9 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/quic-go/quic-go/pull/5426">quic-go/quic-go#5426</a></li>
<li>qlogwriter: fix storing of event schemas by <a href="https://github.com/marten-seemann"><code>@​marten-seemann</code></a> in <a href="https://redirect.github.com/quic-go/quic-go/pull/5430">quic-go/quic-go#5430</a></li>
<li>http3: send SETTINGS_MAX_FIELD_SECTION_SIZE in the SETTINGS frame by <a href="https://github.com/marten-seemann"><code>@​marten-seemann</code></a> in <a href="https://redirect.github.com/quic-go/quic-go/pull/5431">quic-go/quic-go#5431</a></li>
<li>http3: read response after encountering error sending the request by <a href="https://github.com/marten-seemann"><code>@​marten-seemann</code></a> in <a href="https://redirect.github.com/quic-go/quic-go/pull/5432">quic-go/quic-go#5432</a></li>
<li>http3: make Transport.MaxResponseBytes an int by <a href="https://github.com/marten-seemann"><code>@​marten-seemann</code></a> in <a href="https://redirect.github.com/quic-go/quic-go/pull/5433">quic-go/quic-go#5433</a></li>
<li>http3: add a benchmark for header parsing by <a href="https://github.com/marten-seemann"><code>@​marten-seemann</code></a> in <a href="https://redirect.github.com/quic-go/quic-go/pull/5435">quic-go/quic-go#5435</a></li>
<li>update qpack to v0.6.0 by <a href="https://github.com/marten-seemann"><code>@​marten-seemann</code></a> in <a href="https://redirect.github.com/quic-go/quic-go/pull/5434">quic-go/quic-go#5434</a></li>
<li>http3: use QPACK_DECOMPRESSION_FAILED for QPACK errors by <a href="https://github.com/marten-seemann"><code>@​marten-seemann</code></a> in <a href="https://redirect.github.com/quic-go/quic-go/pull/5439">quic-go/quic-go#5439</a></li>
<li>add documentation for Conn.NextConnection by <a href="https://github.com/marten-seemann"><code>@​marten-seemann</code></a> in <a href="https://redirect.github.com/quic-go/quic-go/pull/5442">quic-go/quic-go#5442</a></li>
<li>ackhandler: don’t generate an immediate ACK for the first packet by <a href="https://github.com/marten-seemann"><code>@​marten-seemann</code></a> in <a href="https://redirect.github.com/quic-go/quic-go/pull/5447">quic-go/quic-go#5447</a></li>
<li>don’t arm connection timer for connection ID retirement by <a href="https://github.com/marten-seemann"><code>@​marten-seemann</code></a> in <a href="https://redirect.github.com/quic-go/quic-go/pull/5449">quic-go/quic-go#5449</a></li>
<li>README: add nodepass to list of projects by <a href="https://github.com/yosebyte"><code>@​yosebyte</code></a> in <a href="https://redirect.github.com/quic-go/quic-go/pull/5448">quic-go/quic-go#5448</a></li>
<li>qlogwriter: use synctest to make tests deterministic by <a href="https://github.com/marten-seemann"><code>@​marten-seemann</code></a> in <a href="https://redirect.github.com/quic-go/quic-go/pull/5454">quic-go/quic-go#5454</a></li>
<li>http3: limit size of decompressed headers by <a href="https://github.com/marten-seemann"><code>@​marten-seemann</code></a> in <a href="https://redirect.github.com/quic-go/quic-go/pull/5452">quic-go/quic-go#5452</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/yosebyte"><code>@​yosebyte</code></a> made their first contribution in <a href="https://redirect.github.com/quic-go/quic-go/pull/5448">quic-go/quic-go#5448</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/quic-go/quic-go/compare/v0.56.0...v0.57.0">https://github.com/quic-go/quic-go/compare/v0.56.0...v0.57.0</a></p>
<h2>v0.56.0</h2>
<p>This release introduces qlog support for HTTP/3 (<a href="https://redirect.github.com/quic-go/quic-go/issues/5367">#5367</a>, <a href="https://redirect.github.com/quic-go/quic-go/issues/5372">#5372</a>, <a href="https://redirect.github.com/quic-go/quic-go/issues/5374">#5374</a>, <a href="https://redirect.github.com/quic-go/quic-go/issues/5375">#5375</a>, <a href="https://redirect.github.com/quic-go/quic-go/issues/5376">#5376</a>, <a href="https://redirect.github.com/quic-go/quic-go/issues/5381">#5381</a>, <a href="https://redirect.github.com/quic-go/quic-go/issues/5383">#5383</a>).</p>
<p>For this, we completely changed how connection tracing works. Instead of a general-purpose <code>logging.ConnectionTracer</code> (which we removed entirely), we now have a qlog-specific tracer (<a href="https://redirect.github.com/quic-go/quic-go/issues/5356">#5356</a>, <a href="https://redirect.github.com/quic-go/quic-go/issues/5417">#5417</a>). quic-go users can now implement their own qlog events.</p>
<p>It also removes the Prometheus-based metrics collection. Please comment on the tracking issue (<a href="https://redirect.github.com/quic-go/quic-go/issues/5294">#5294</a>) if you rely on metrics and are interested in seeing metrics brought back in a future release.</p>
<h2>Notable Changes</h2>
<ul>
<li>replaced the unmaintained gojay with a custom, performance-optimized JSON encoder (<a href="https://redirect.github.com/quic-go/quic-go/issues/5353">#5353</a>, <a href="https://redirect.github.com/quic-go/quic-go/issues/5371">#5371</a>)</li>
</ul>

</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/quic-go/quic-go/commit/5b2d2129f8315da41e01eff0a847ab38a34e83a8"><code>5b2d212</code></a> http3: limit size of decompressed headers (<a href="https://redirect.github.com/quic-go/quic-go/issues/5452">#5452</a>)</li>
<li><a href="https://github.com/quic-go/quic-go/commit/e80b378bc2674934ecc92225af66e6a0fbd3f703"><code>e80b378</code></a> qlogwriter: use synctest to make tests deterministic (<a href="https://redirect.github.com/quic-go/quic-go/issues/5454">#5454</a>)</li>
<li><a href="https://github.com/quic-go/quic-go/commit/d43c5894f8522279fc2cda80ba9a59c4e75d5e72"><code>d43c589</code></a> README: add nodepass to list of projects (<a href="https://redirect.github.com/quic-go/quic-go/issues/5448">#5448</a>)</li>
<li><a href="https://github.com/quic-go/quic-go/commit/ca2835de95c75aaddf20eca9008625f32907c940"><code>ca2835d</code></a> don’t arm connection timer for connection ID retirement (<a href="https://redirect.github.com/quic-go/quic-go/issues/5449">#5449</a>)</li>
<li><a href="https://github.com/quic-go/quic-go/commit/e84ebae666e9a2f4f1141ec89821225778569e62"><code>e84ebae</code></a> ackhandler: don’t generate an immediate ACK for the first packet (<a href="https://redirect.github.com/quic-go/quic-go/issues/5447">#5447</a>)</li>
<li><a href="https://github.com/quic-go/quic-go/commit/d4d168f0f09377779ddeaabb4437b8cc247ef062"><code>d4d168f</code></a> add documentation for Conn.NextConnection (<a href="https://redirect.github.com/quic-go/quic-go/issues/5442">#5442</a>)</li>
<li><a href="https://github.com/quic-go/quic-go/commit/4cdebbea6cf8e54def24906ee91389cb60705709"><code>4cdebbe</code></a> http3: use QPACK_DECOMPRESSION_FAILED for QPACK errors (<a href="https://redirect.github.com/quic-go/quic-go/issues/5439">#5439</a>)</li>
<li><a href="https://github.com/quic-go/quic-go/commit/b7886d5c901700febc41c739bd93851eac5d315e"><code>b7886d5</code></a> update qpack to v0.6.0 (<a href="https://redirect.github.com/quic-go/quic-go/issues/5434">#5434</a>)</li>
<li><a href="https://github.com/quic-go/quic-go/commit/2fc9705d14a5a5a269482544c032fcc53d696d92"><code>2fc9705</code></a> http3: add a benchmark for header parsing (<a href="https://redirect.github.com/quic-go/quic-go/issues/5435">#5435</a>)</li>
<li><a href="https://github.com/quic-go/quic-go/commit/dafdd6f9b2b04cd67cf27805bf44ea616ac8f251"><code>dafdd6f</code></a> http3: make Transport.MaxResponseBytes an int (<a href="https://redirect.github.com/quic-go/quic-go/issues/5433">#5433</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/quic-go/quic-go/compare/v0.49.1...v0.57.0">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/quic-go/quic-go&package-manager=go_modules&previous-version=0.49.1&new-version=0.57.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

You can trigger a rebase of this PR by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/moment-eng/moment/network/alerts).

</details>

> **Note**
> Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

build(deps): bump github.com/quic-go/quic-go from 0.49.1 to 0.57.0 in /docsapi in the go_modules group across 1 directory

Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p>
<blockquote>
<h2>v6.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li>
<li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li>
<li>v6-beta by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2298">actions/checkout#2298</a></li>
<li>update readme/changelog for v6 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2311">actions/checkout#2311</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v5.0.0...v6.0.0">https://github.com/actions/checkout/compare/v5.0.0...v6.0.0</a></p>
<h2>v6-beta</h2>
<h2>What's Changed</h2>
<p>Updated persist-credentials to store the credentials under <code>$RUNNER_TEMP</code> instead of directly in the local git config.</p>
<p>This requires a minimum Actions Runner version of <a href="https://github.com/actions/runner/releases/tag/v2.329.0">v2.329.0</a> to access the persisted credentials for <a href="https://docs.github.com/en/actions/tutorials/use-containerized-services/create-a-docker-container-action">Docker container action</a> scenarios.</p>
<h2>v5.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v5...v5.0.1">https://github.com/actions/checkout/compare/v5...v5.0.1</a></p>
<h2>v5.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
<li>Prepare v5.0.0 release by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2238">actions/checkout#2238</a></li>
</ul>
<h2>⚠️ Minimum Compatible Runner Version</h2>
<p><strong>v2.327.1</strong><br />
<a href="https://github.com/actions/runner/releases/tag/v2.327.1">Release Notes</a></p>
<p>Make sure your runner is updated to this version or newer to use this release.</p>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v4...v5.0.0">https://github.com/actions/checkout/compare/v4...v5.0.0</a></p>
<h2>v4.3.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v4...v4.3.1">https://github.com/actions/checkout/compare/v4...v4.3.1</a></p>
<h2>v4.3.0</h2>
<h2>What's Changed</h2>
<ul>
<li>docs: update README.md by <a href="https://github.com/motss"><code>@​motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
<li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
<li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@​benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
</ul>

</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>v6.0.2</h2>
<ul>
<li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li>
</ul>
<h2>v6.0.1</h2>
<ul>
<li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li>
</ul>
<h2>v6.0.0</h2>
<ul>
<li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li>
<li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li>
</ul>
<h2>v5.0.1</h2>
<ul>
<li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li>
</ul>
<h2>v5.0.0</h2>
<ul>
<li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
</ul>
<h2>v4.3.1</h2>
<ul>
<li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li>
</ul>
<h2>v4.3.0</h2>
<ul>
<li>docs: update README.md by <a href="https://github.com/motss"><code>@​motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
<li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
<li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@​benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
<li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li>
<li>Update README.md by <a href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
<li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li>
<li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
</ul>
<h2>v4.2.2</h2>
<ul>
<li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@​jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li>
<li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@​jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li>
</ul>
<h2>v4.2.1</h2>
<ul>
<li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li>
</ul>
<h2>v4.2.0</h2>
<ul>
<li>Add Ref and Commit outputs by <a href="https://github.com/lucacome"><code>@​lucacome</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1180">actions/checkout#1180</a></li>
<li>Dependency updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>- <a href="https://redirect.github.com/actions/checkout/pull/1777">actions/checkout#1777</a>, <a href="https://redirect.github.com/actions/checkout/pull/1872">actions/checkout#1872</a></li>
</ul>
<h2>v4.1.7</h2>
<ul>
<li>Bump the minor-npm-dependencies group across 1 directory with 4 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1739">actions/checkout#1739</a></li>
<li>Bump actions/checkout from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1697">actions/checkout#1697</a></li>
<li>Check out other refs/* by commit by <a href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1774">actions/checkout#1774</a></li>
<li>Pin actions/checkout's own workflows to a known, good, stable version. by <a href="https://github.com/jww3"><code>@​jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1776">actions/checkout#1776</a></li>
</ul>
<h2>v4.1.6</h2>
<ul>
<li>Check platform to set archive extension appropriately by <a href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1732">actions/checkout#1732</a></li>
</ul>

</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/actions/checkout/commit/8e8c483db84b4bee98b60c0593521ed34d9990e8"><code>8e8c483</code></a> Clarify v6 README (<a href="https://redirect.github.com/actions/checkout/issues/2328">#2328</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/033fa0dc0b82693d8986f1016a0ec2c5e7d9cbb1"><code>033fa0d</code></a> Add worktree support for persist-credentials includeIf (<a href="https://redirect.github.com/actions/checkout/issues/2327">#2327</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/c2d88d3ecc89a9ef08eebf45d9637801dcee7eb5"><code>c2d88d3</code></a> Update all references from v5 and v4 to v6 (<a href="https://redirect.github.com/actions/checkout/issues/2314">#2314</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/1af3b93b6815bc44a9784bd300feb67ff0d1eeb3"><code>1af3b93</code></a> update readme/changelog for v6 (<a href="https://redirect.github.com/actions/checkout/issues/2311">#2311</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/71cf2267d89c5cb81562390fa70a37fa40b1305e"><code>71cf226</code></a> v6-beta (<a href="https://redirect.github.com/actions/checkout/issues/2298">#2298</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/069c6959146423d11cd0184e6accf28f9d45f06e"><code>069c695</code></a> Persist creds to a separate file (<a href="https://redirect.github.com/actions/checkout/issues/2286">#2286</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493"><code>ff7abcd</code></a> Update README to include Node.js 24 support details and requirements (<a href="https://redirect.github.com/actions/checkout/issues/2248">#2248</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/08c6903cd8c0fde910a37f88322edcfb5dd907a8"><code>08c6903</code></a> Prepare v5.0.0 release (<a href="https://redirect.github.com/actions/checkout/issues/2238">#2238</a>)</li>
<li><a href="https://github.com/actions/checkout/commit/9f265659d3bb64ab1440b03b12f4d47a24320917"><code>9f26565</code></a> Update actions checkout to use node 24 (<a href="https://redirect.github.com/actions/checkout/issues/2226">#2226</a>)</li>
<li>See full diff in <a href="https://github.com/actions/checkout/compare/v4...v6">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/checkout&package-manager=github_actions&previous-version=4&new-version=6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

You can trigger a rebase of this PR by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>

> **Note**
> Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

build(deps): bump actions/checkout from 4 to 6

Bumps [actions/cache](https://github.com/actions/cache) from 4 to 5.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/actions/cache/releases">actions/cache's releases</a>.</em></p>
<blockquote>
<h2>v5.0.0</h2>
<blockquote>
<p>[!IMPORTANT]
<strong><code>actions/cache@v5</code> runs on the Node.js 24 runtime and requires a minimum Actions Runner version of <code>2.327.1</code>.</strong></p>
<p>If you are using self-hosted runners, ensure they are updated before upgrading.</p>
</blockquote>
<hr />
<h2>What's Changed</h2>
<ul>
<li>Upgrade to use node24 by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1630">actions/cache#1630</a></li>
<li>Prepare v5.0.0 release by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1684">actions/cache#1684</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v4.3.0...v5.0.0">https://github.com/actions/cache/compare/v4.3.0...v5.0.0</a></p>
<h2>v4.3.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Add note on runner versions by <a href="https://github.com/GhadimiR"><code>@​GhadimiR</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1642">actions/cache#1642</a></li>
<li>Prepare <code>v4.3.0</code> release by <a href="https://github.com/Link"><code>@​Link</code></a>- in <a href="https://redirect.github.com/actions/cache/pull/1655">actions/cache#1655</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/GhadimiR"><code>@​GhadimiR</code></a> made their first contribution in <a href="https://redirect.github.com/actions/cache/pull/1642">actions/cache#1642</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v4...v4.3.0">https://github.com/actions/cache/compare/v4...v4.3.0</a></p>
<h2>v4.2.4</h2>
<h2>What's Changed</h2>
<ul>
<li>Update README.md by <a href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1620">actions/cache#1620</a></li>
<li>Upgrade <code>@actions/cache</code> to <code>4.0.5</code> and move <code>@protobuf-ts/plugin</code> to dev depdencies by <a href="https://github.com/Link"><code>@​Link</code></a>- in <a href="https://redirect.github.com/actions/cache/pull/1634">actions/cache#1634</a></li>
<li>Prepare release <code>4.2.4</code> by <a href="https://github.com/Link"><code>@​Link</code></a>- in <a href="https://redirect.github.com/actions/cache/pull/1636">actions/cache#1636</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/nebuk89"><code>@​nebuk89</code></a> made their first contribution in <a href="https://redirect.github.com/actions/cache/pull/1620">actions/cache#1620</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v4...v4.2.4">https://github.com/actions/cache/compare/v4...v4.2.4</a></p>
<h2>v4.2.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Update to use <code>@​actions/cache</code> 4.0.3 package &amp; prepare for new release by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1577">actions/cache#1577</a> (SAS tokens for cache entries are now masked in debug logs)</li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> made their first contribution in <a href="https://redirect.github.com/actions/cache/pull/1577">actions/cache#1577</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v4.2.2...v4.2.3">https://github.com/actions/cache/compare/v4.2.2...v4.2.3</a></p>

</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/actions/cache/blob/main/RELEASES.md">actions/cache's changelog</a>.</em></p>
<blockquote>
<h1>Releases</h1>
<h2>Changelog</h2>
<h3>5.0.1</h3>
<ul>
<li>Update <code>@azure/storage-blob</code> to <code>^12.29.1</code> via <code>@actions/cache@5.0.1</code> <a href="https://redirect.github.com/actions/cache/pull/1685">#1685</a></li>
</ul>
<h3>5.0.0</h3>
<blockquote>
<p>[!IMPORTANT]
<code>actions/cache@v5</code> runs on the Node.js 24 runtime and requires a minimum Actions Runner version of <code>2.327.1</code>.
If you are using self-hosted runners, ensure they are updated before upgrading.</p>
</blockquote>
<h3>4.3.0</h3>
<ul>
<li>Bump <code>@actions/cache</code> to <a href="https://redirect.github.com/actions/toolkit/pull/2132">v4.1.0</a></li>
</ul>
<h3>4.2.4</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v4.0.5</li>
</ul>
<h3>4.2.3</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v4.0.3 (obfuscates SAS token in debug logs for cache entries)</li>
</ul>
<h3>4.2.2</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v4.0.2</li>
</ul>
<h3>4.2.1</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v4.0.1</li>
</ul>
<h3>4.2.0</h3>
<p>TLDR; The cache backend service has been rewritten from the ground up for improved performance and reliability. <a href="https://github.com/actions/cache">actions/cache</a> now integrates with the new cache service (v2) APIs.</p>
<p>The new service will gradually roll out as of <strong>February 1st, 2025</strong>. The legacy service will also be sunset on the same date. Changes in these release are <strong>fully backward compatible</strong>.</p>
<p><strong>We are deprecating some versions of this action</strong>. We recommend upgrading to version <code>v4</code> or <code>v3</code> as soon as possible before <strong>February 1st, 2025.</strong> (Upgrade instructions below).</p>
<p>If you are using pinned SHAs, please use the SHAs of versions <code>v4.2.0</code> or <code>v3.4.0</code></p>
<p>If you do not upgrade, all workflow runs using any of the deprecated <a href="https://github.com/actions/cache">actions/cache</a> will fail.</p>
<p>Upgrading to the recommended versions will not break your workflows.</p>
<h3>4.1.2</h3>

</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/actions/cache/commit/9255dc7a253b0ccc959486e2bca901246202afeb"><code>9255dc7</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1686">#1686</a> from actions/cache-v5.0.1-release</li>
<li><a href="https://github.com/actions/cache/commit/8ff5423e8b66eacab4e638ee52abbd2cb831366a"><code>8ff5423</code></a> chore: release v5.0.1</li>
<li><a href="https://github.com/actions/cache/commit/9233019a152bc768059ac1768b8e4403b5da16c1"><code>9233019</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1685">#1685</a> from salmanmkc/node24-storage-blob-fix</li>
<li><a href="https://github.com/actions/cache/commit/b975f2bb844529e1063ad882c609b224bcd66eb6"><code>b975f2b</code></a> fix: add peer property to package-lock.json for dependencies</li>
<li><a href="https://github.com/actions/cache/commit/d0a0e1813491d01d574c95f8d189f62622bbb2ae"><code>d0a0e18</code></a> fix: update license files for <code>@​actions/cache</code>, fast-xml-parser, and strnum</li>
<li><a href="https://github.com/actions/cache/commit/74de208dcfcbe85c0e7154e7b17e4105fe2554ff"><code>74de208</code></a> fix: update <code>@​actions/cache</code> to ^5.0.1 for Node.js 24 punycode fix</li>
<li><a href="https://github.com/actions/cache/commit/ac7f1152ead02e89c14b5456d14ab17591e74cfb"><code>ac7f115</code></a> peer</li>
<li><a href="https://github.com/actions/cache/commit/b0f846b50b6061d7a2ca6f1a2fea61d4a65d1a16"><code>b0f846b</code></a> fix: update <code>@​actions/cache</code> with storage-blob fix for Node.js 24 punycode depr...</li>
<li><a href="https://github.com/actions/cache/commit/a7833574556fa59680c1b7cb190c1735db73ebf0"><code>a783357</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1684">#1684</a> from actions/prepare-cache-v5-release</li>
<li><a href="https://github.com/actions/cache/commit/3bb0d78750a39cefce0c2b5a0a9801052b4359ad"><code>3bb0d78</code></a> docs: highlight v5 runner requirement in releases</li>
<li>Additional commits viewable in <a href="https://github.com/actions/cache/compare/v4...v5">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/cache&package-manager=github_actions&previous-version=4&new-version=5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

You can trigger a rebase of this PR by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>

> **Note**
> Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

build(deps): bump actions/cache from 4 to 5

Bumps [@graphql-codegen/cli](https://github.com/dotansimha/graphql-code-generator/tree/HEAD/packages/graphql-codegen-cli) from 5.0.5 to 6.1.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/dotansimha/graphql-code-generator/blob/master/packages/graphql-codegen-cli/CHANGELOG.md"><code>@​graphql-codegen/cli</code>'s changelog</a>.</em></p>
<blockquote>
<h2>6.1.0</h2>
<h3>Minor Changes</h3>
<ul>
<li><a href="https://redirect.github.com/dotansimha/graphql-code-generator/pull/10510">#10510</a> <a href="https://github.com/dotansimha/graphql-code-generator/commit/9e70bcbf5390e815a6844f1965b04056e5d8e670"><code>9e70bcb</code></a> Thanks <a href="https://github.com/nickmessing"><code>@​nickmessing</code></a>! - add importExtension configuration option</li>
</ul>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a href="https://github.com/dotansimha/graphql-code-generator/commit/9e70bcbf5390e815a6844f1965b04056e5d8e670"><code>9e70bcb</code></a>]:
<ul>
<li><code>@​graphql-codegen/plugin-helpers</code><a href="https://github.com/6"><code>@​6</code></a>.1.0</li>
<li><code>@​graphql-codegen/client-preset</code><a href="https://github.com/5"><code>@​5</code></a>.2.0</li>
</ul>
</li>
</ul>
<h2>6.0.2</h2>
<h3>Patch Changes</h3>
<ul>
<li><a href="https://redirect.github.com/dotansimha/graphql-code-generator/pull/10430">#10430</a> <a href="https://github.com/dotansimha/graphql-code-generator/commit/aad7f03bf812d671d3c60ff21be0b3b8da55d79f"><code>aad7f03</code></a> Thanks <a href="https://github.com/apps/renovate"><code>@​renovate</code></a>! - dependencies updates:
<ul>
<li>Updated dependency <a href="https://www.npmjs.com/package/@graphql-tools/github-loader/v/9.0.0"><code>@graphql-tools/github-loader@^9.0.0</code> ↗︎</a> (from <code>^8.0.0</code>, in <code>dependencies</code>)</li>
<li>Updated dependency <a href="https://www.npmjs.com/package/@graphql-tools/url-loader/v/9.0.0"><code>@graphql-tools/url-loader@^9.0.0</code> ↗︎</a> (from <code>^8.0.0</code>, in <code>dependencies</code>)</li>
</ul>
</li>
<li>Updated dependencies []:
<ul>
<li><code>@​graphql-codegen/client-preset</code><a href="https://github.com/5"><code>@​5</code></a>.1.2</li>
</ul>
</li>
</ul>
<h2>6.0.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a href="https://redirect.github.com/dotansimha/graphql-code-generator/pull/10468">#10468</a> <a href="https://github.com/dotansimha/graphql-code-generator/commit/cb1b9d99c413a96fde6c9af0b2315b3ad721ee4e"><code>cb1b9d9</code></a> Thanks <a href="https://github.com/eddeee888"><code>@​eddeee888</code></a>! - In watch mode, do not write output on failure</p>
<p>Previously, on partial or full failure, watch mode still write to output. However, since the output'd be an empty array, it will then call <code>removeStaleFiles</code> internally to remove all previously generated files.</p>
<p>This patch puts a temporary fix to avoid writing output on any failure to fix the described behaviour.</p>
<p>This also means the <code>config.allowPartialOutputs</code> does not work in watch mode for now.</p>
</li>
</ul>
<h2>6.0.0</h2>
<h3>Major Changes</h3>
<ul>
<li>
<p><a href="https://redirect.github.com/dotansimha/graphql-code-generator/pull/10218">#10218</a> <a href="https://github.com/dotansimha/graphql-code-generator/commit/140298a33b257a0b7958e361971b5bc97bbc01c2"><code>140298a</code></a> Thanks <a href="https://github.com/eddeee888"><code>@​eddeee888</code></a>! - Drop <code>@​graphql-tools/prisma-loader</code></p>
</li>
<li>
<p><a href="https://redirect.github.com/dotansimha/graphql-code-generator/pull/10218">#10218</a> <a href="https://github.com/dotansimha/graphql-code-generator/commit/140298a33b257a0b7958e361971b5bc97bbc01c2"><code>140298a</code></a> Thanks <a href="https://github.com/eddeee888"><code>@​eddeee888</code></a>! - Add <code>allowPartialOutputs</code> flag to partially write successful generation to files</p>
</li>
<li>
<p><a href="https://redirect.github.com/dotansimha/graphql-code-generator/pull/10218">#10218</a> <a href="https://github.com/dotansimha/graphql-code-generator/commit/140298a33b257a0b7958e361971b5bc97bbc01c2"><code>140298a</code></a> Thanks <a href="https://github.com/eddeee888"><code>@​eddeee888</code></a>! - Migrate inquirer to <code>@​inquirer/prompts</code></p>
</li>
<li>
<p><a href="https://redirect.github.com/dotansimha/graphql-code-generator/pull/10218">#10218</a> <a href="https://github.com/dotansimha/graphql-code-generator/commit/140298a33b257a0b7958e361971b5bc97bbc01c2"><code>140298a</code></a> Thanks <a href="https://github.com/eddeee888"><code>@​eddeee888</code></a>! - Bump dependencies major versions:</p>
<ul>
<li>cosmiconfig v9</li>
<li>debounce v2</li>
<li>jiti v2.3</li>
</ul>
</li>
</ul>

</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/dotansimha/graphql-code-generator/commit/bec7e74a58992189cc67b9c9788b0ff023fd5a04"><code>bec7e74</code></a> chore(release): update monorepo packages versions (<a href="https://github.com/dotansimha/graphql-code-generator/tree/HEAD/packages/graphql-codegen-cli/issues/10513">#10513</a>)</li>
<li><a href="https://github.com/dotansimha/graphql-code-generator/commit/9e70bcbf5390e815a6844f1965b04056e5d8e670"><code>9e70bcb</code></a> feat: add importExtension configuration option (<a href="https://github.com/dotansimha/graphql-code-generator/tree/HEAD/packages/graphql-codegen-cli/issues/10510">#10510</a>)</li>
<li><a href="https://github.com/dotansimha/graphql-code-generator/commit/135ce4d4c22a5a3ae115c662d6e5919dfa03028d"><code>135ce4d</code></a> chore(release): update monorepo packages versions (<a href="https://github.com/dotansimha/graphql-code-generator/tree/HEAD/packages/graphql-codegen-cli/issues/10484">#10484</a>)</li>
<li><a href="https://github.com/dotansimha/graphql-code-generator/commit/aad7f03bf812d671d3c60ff21be0b3b8da55d79f"><code>aad7f03</code></a> fix(deps): update graphql-tools (major) (<a href="https://github.com/dotansimha/graphql-code-generator/tree/HEAD/packages/graphql-codegen-cli/issues/10430">#10430</a>)</li>
<li><a href="https://github.com/dotansimha/graphql-code-generator/commit/c87b779b9b400813d733fa89dcb16724b30c6d16"><code>c87b779</code></a> [CLI] Create watcher.run.spec to test actual running behaviour (<a href="https://github.com/dotansimha/graphql-code-generator/tree/HEAD/packages/graphql-codegen-cli/issues/10474">#10474</a>)</li>
<li><a href="https://github.com/dotansimha/graphql-code-generator/commit/ed30b56572f2e63540af68dcb454c013423f2ad6"><code>ed30b56</code></a> chore(deps): update dependency vitest to v4 (<a href="https://github.com/dotansimha/graphql-code-generator/tree/HEAD/packages/graphql-codegen-cli/issues/10475">#10475</a>)</li>
<li><a href="https://github.com/dotansimha/graphql-code-generator/commit/8fd495f72e28500abff32777c242b58710040cb7"><code>8fd495f</code></a> chore(release): update monorepo packages versions (<a href="https://github.com/dotansimha/graphql-code-generator/tree/HEAD/packages/graphql-codegen-cli/issues/10469">#10469</a>)</li>
<li><a href="https://github.com/dotansimha/graphql-code-generator/commit/cb1b9d99c413a96fde6c9af0b2315b3ad721ee4e"><code>cb1b9d9</code></a> CODEGEN-866 [CLI] Fix generated files disappearing in watch mode (<a href="https://github.com/dotansimha/graphql-code-generator/tree/HEAD/packages/graphql-codegen-cli/issues/10468">#10468</a>)</li>
<li><a href="https://github.com/dotansimha/graphql-code-generator/commit/c1a8fd4ffbe4baa9451229c6bb550a29ea362be0"><code>c1a8fd4</code></a> chore(release): update monorepo packages versions (<a href="https://github.com/dotansimha/graphql-code-generator/tree/HEAD/packages/graphql-codegen-cli/issues/10426">#10426</a>)</li>
<li><a href="https://github.com/dotansimha/graphql-code-generator/commit/140298a33b257a0b7958e361971b5bc97bbc01c2"><code>140298a</code></a> Next major version feature branch (<a href="https://github.com/dotansimha/graphql-code-generator/tree/HEAD/packages/graphql-codegen-cli/issues/10218">#10218</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/dotansimha/graphql-code-generator/commits/@graphql-codegen/cli@6.1.0/packages/graphql-codegen-cli">compare view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a href="https://www.npmjs.com/~theguild-bot">theguild-bot</a>, a new releaser for <code>@​graphql-codegen/cli</code> since your current version.</p>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@graphql-codegen/cli&package-manager=npm_and_yarn&previous-version=5.0.5&new-version=6.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

You can trigger a rebase of this PR by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>

> **Note**
> Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

build(deps-dev): bump @graphql-codegen/cli from 5.0.5 to 6.1.0

Bumps [@observablehq/parser](https://github.com/observablehq/parser) from 4.5.0 to 6.1.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/observablehq/parser/releases"><code>@​observablehq/parser</code>'s releases</a>.</em></p>
<blockquote>
<h2>v6.1.0</h2>
<ul>
<li>Add NotificationClient feature. <a href="https://redirect.github.com/observablehq/parser/pull/212">observablehq/parser#212</a></li>
</ul>
<h2>v6.0.0</h2>
<ul>
<li>Adopt ES modules.</li>
<li>Upgrade to Acorn 8, adding support for class fields. <a href="https://redirect.github.com/observablehq/parser/issues/64">#64</a></li>
<li>Remove experimental parseModule functionality.</li>
</ul>
<p>This package now requires Node.js 14.5 or higher. For more on adopting ES modules, please read <a href="https://gist.github.com/sindresorhus/a39789f98801d908bbc7ff3ecc99d99c">Sindre Sorhus’s FAQ</a>.</p>
<h2>v5.0.0</h2>
<ul>
<li>Added cell tag parsing. <a href="https://redirect.github.com/observablehq/parser/issues/203">#203</a></li>
<li><strong>[Breaking]</strong> <em>cell</em>.tag is now a CellTag node instead of a string.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/observablehq/parser/commit/b6ec1db139913493b39c9d0ccb02a1636570a64e"><code>b6ec1db</code></a> 6.1.0 (<a href="https://redirect.github.com/observablehq/parser/issues/213">#213</a>)</li>
<li><a href="https://github.com/observablehq/parser/commit/82211b86d712372c9fa007a7960725a20d1c3c9f"><code>82211b8</code></a> Add NotificationClient as feature (<a href="https://redirect.github.com/observablehq/parser/issues/212">#212</a>)</li>
<li><a href="https://github.com/observablehq/parser/commit/09901d06904ec2277baa56eca74efe7aedc2720a"><code>09901d0</code></a> 6.0.0</li>
<li><a href="https://github.com/observablehq/parser/commit/44799d18bdf41ee65b3b3916555e487138213751"><code>44799d1</code></a> Update README</li>
<li><a href="https://github.com/observablehq/parser/commit/23025bc50c4bf29a13edc2d2791fa4b0eee3584d"><code>23025bc</code></a> acorn 8, esm, mocha (<a href="https://redirect.github.com/observablehq/parser/issues/205">#205</a>)</li>
<li><a href="https://github.com/observablehq/parser/commit/a9da65af4b53f8af6c71d622eeba41619cecb6aa"><code>a9da65a</code></a> 5.0.0</li>
<li><a href="https://github.com/observablehq/parser/commit/b1a898444d2c1165763f9c28fa9921321cf3f02a"><code>b1a8984</code></a> Parse provided tag (<a href="https://redirect.github.com/observablehq/parser/issues/203">#203</a>)</li>
<li>See full diff in <a href="https://github.com/observablehq/parser/compare/v4.5.0...v6.1.0">compare view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a href="https://www.npmjs.com/~tophtucker">tophtucker</a>, a new releaser for <code>@​observablehq/parser</code> since your current version.</p>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@observablehq/parser&package-manager=npm_and_yarn&previous-version=4.5.0&new-version=6.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

You can trigger a rebase of this PR by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>

> **Note**
> Automatic rebases have been disabled on this pull request as it has been open for over 30 days.


build(deps): bump @observablehq/parser from 4.5.0 to 6.1.0

Bumps the npm_and_yarn group with 1 update in the / directory: [mdast-util-to-hast](https://github.com/syntax-tree/mdast-util-to-hast).

Updates `mdast-util-to-hast` from 13.2.0 to 13.2.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/syntax-tree/mdast-util-to-hast/releases">mdast-util-to-hast's releases</a>.</em></p>
<blockquote>
<h2>13.2.1</h2>
<h4>Fix</h4>
<ul>
<li>ab3a795 Fix support for spaces in class names</li>
</ul>
<h4>Types</h4>
<ul>
<li>efb5312 Refactor to use <code>@import</code>s</li>
<li>a5bc210 Add declaration maps</li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/syntax-tree/mdast-util-to-hast/compare/13.2.0...13.2.1">https://github.com/syntax-tree/mdast-util-to-hast/compare/13.2.0...13.2.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/syntax-tree/mdast-util-to-hast/commit/174795b21f7757fffb54dd8d5fb4012f4751f791"><code>174795b</code></a> 13.2.1</li>
<li><a href="https://github.com/syntax-tree/mdast-util-to-hast/commit/3d05b3a715133df55689fe3753c2e47101315b4e"><code>3d05b3a</code></a> Update Node in Actions</li>
<li><a href="https://github.com/syntax-tree/mdast-util-to-hast/commit/ab3a79570a1afbfa7efef5d4a0cd9b5caafbc5d7"><code>ab3a795</code></a> Fix support for spaces in class names</li>
<li><a href="https://github.com/syntax-tree/mdast-util-to-hast/commit/efb531231020055e0dab7b39a18d80b569d5b566"><code>efb5312</code></a> Refactor to use <code>@import</code>s</li>
<li><a href="https://github.com/syntax-tree/mdast-util-to-hast/commit/a5bc210f1aa308e4c6141ac374893c9237fcd746"><code>a5bc210</code></a> Add declaration maps</li>
<li><a href="https://github.com/syntax-tree/mdast-util-to-hast/commit/b54955d4e123b0167eac13646333c809bb8f301c"><code>b54955d</code></a> Add <code>.tsbuildinfo</code> to <code>.gitignore</code></li>
<li>See full diff in <a href="https://github.com/syntax-tree/mdast-util-to-hast/compare/13.2.0...13.2.1">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=mdast-util-to-hast&package-manager=npm_and_yarn&previous-version=13.2.0&new-version=13.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

You can trigger a rebase of this PR by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/moment-eng/moment/network/alerts).

</details>

> **Note**
> Automatic rebases have been disabled on this pull request as it has been open for over 30 days.


build(deps): bump mdast-util-to-hast from 13.2.0 to 13.2.1 in the npm_and_yarn group across 1 directory

Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 8 to 9.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/golangci/golangci-lint-action/releases">golangci/golangci-lint-action's releases</a>.</em></p>
<blockquote>
<h2>v9.0.0</h2>
<p>In the scope of this release, we change Nodejs runtime from node20 to node24 (<a href="https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/">https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/</a>).</p>
<h2>What's Changed</h2>
<h3>Changes</h3>
<ul>
<li>feat: add install-only option by <a href="https://github.com/ldez"><code>@​ldez</code></a> in <a href="https://redirect.github.com/golangci/golangci-lint-action/pull/1305">golangci/golangci-lint-action#1305</a></li>
<li>feat: support Module Plugin System by <a href="https://github.com/ldez"><code>@​ldez</code></a> in <a href="https://redirect.github.com/golangci/golangci-lint-action/pull/1306">golangci/golangci-lint-action#1306</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/golangci/golangci-lint-action/compare/v8.0.0...v9.0.0">https://github.com/golangci/golangci-lint-action/compare/v8.0.0...v9.0.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/golangci/golangci-lint-action/commit/0a35821d5c230e903fcfe077583637dea1b27b47"><code>0a35821</code></a> docs: update readme</li>
<li><a href="https://github.com/golangci/golangci-lint-action/commit/043b1b8d1c47e4591c1719682a050a7a0a82e19c"><code>043b1b8</code></a> feat: support Module Plugin System (<a href="https://redirect.github.com/golangci/golangci-lint-action/issues/1306">#1306</a>)</li>
<li><a href="https://github.com/golangci/golangci-lint-action/commit/a66d26a4652b1a0b28a56b7c8b194c20f7c0b7f6"><code>a66d26a</code></a> feat: add install-only option (<a href="https://redirect.github.com/golangci/golangci-lint-action/issues/1305">#1305</a>)</li>
<li><a href="https://github.com/golangci/golangci-lint-action/commit/7fe1b22e0c4632d6260fedfafd4b6025ac7418c3"><code>7fe1b22</code></a> build(deps): bump the dependencies group with 2 updates (<a href="https://redirect.github.com/golangci/golangci-lint-action/issues/1303">#1303</a>)</li>
<li><a href="https://github.com/golangci/golangci-lint-action/commit/14973f18c82b6d66679563f71666ccee11907cb2"><code>14973f1</code></a> build(deps-dev): bump the dev-dependencies group with 2 updates (<a href="https://redirect.github.com/golangci/golangci-lint-action/issues/1299">#1299</a>)</li>
<li><a href="https://github.com/golangci/golangci-lint-action/commit/8c2d575d9b37153325eebc4bb3a94cd09e1fae5d"><code>8c2d575</code></a> build(deps): bump <code>@​types/node</code> from 24.8.1 to 24.9.1 in the dependencies group...</li>
<li><a href="https://github.com/golangci/golangci-lint-action/commit/b002b6ecfcabe6ac0e2c6cba1bcc779eb34ac51f"><code>b002b6e</code></a> build(deps): bump actions/setup-node from 5 to 6 (<a href="https://redirect.github.com/golangci/golangci-lint-action/issues/1296">#1296</a>)</li>
<li><a href="https://github.com/golangci/golangci-lint-action/commit/c13f4ed1a9a677a28be0df3e11c34a78db85c77c"><code>c13f4ed</code></a> build(deps): bump <code>@​types/node</code> from 24.7.2 to 24.8.1 in the dependencies group...</li>
<li><a href="https://github.com/golangci/golangci-lint-action/commit/b68d21b131098f33ec55c11c242113b4a10dc30a"><code>b68d21b</code></a> docs: improve readme</li>
<li><a href="https://github.com/golangci/golangci-lint-action/commit/06188a2a4a13a4786b4584e086b2040214cd4ca5"><code>06188a2</code></a> build(deps): bump github/codeql-action from 3 to 4 (<a href="https://redirect.github.com/golangci/golangci-lint-action/issues/1293">#1293</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/golangci/golangci-lint-action/compare/v8...v9">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golangci/golangci-lint-action&package-manager=github_actions&previous-version=8&new-version=9)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

You can trigger a rebase of this PR by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>

> **Note**
> Automatic rebases have been disabled on this pull request as it has been open for over 30 days.


build(deps): bump golangci/golangci-lint-action from 8 to 9

fix updating permissions in the share modal (#12510)

## What this does
I am not 100% sure when this broke, but right now, you cannot revoke any permissions after a document has been shared. you also can't update permissions of a collab doc once it has been shared. **this is broken in production**.

but this PR fixes the following bugs:
* the frontend is sending "revoke" as a relation, which the backend will not accept. "relation" needs to the be the relationship (aka collaborator, reader, etc) you are revoking. 
* after creating a collab document, for some reason, the local branch would get behind remote, causing the plan not to execute due to "unachievable-behind-remote". not sure what the correct behavior is, but for now, if the document is a collab doc, i ignore this so that we can update the permisisons. 



---

> [!NOTE]
> **Medium Risk**
> Touches document sharing/permission update flow; while mostly a payload/state fix, mistakes here can cause incorrect permission grants/revocations in production.
> 
> **Overview**
> Fixes share modal permission updates by ensuring **revoke actions send the existing permission relation** (e.g. `reader`/`collaborator`) instead of incorrectly sending `revoke` as the `relation`, aligning with backend expectations.
> 
> Updates the share tab state handling to store the selected `PermRelation` in pending updates while still reflecting revoked items locally for UI, and tightens backend logging in `changeDocumentPermission` by elevating bind/invalid-relation logs to errors.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 5562cf3d6f3d344b9994dbf2415bb78921791945. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

fix updating permissions in the share modal

## What this does
slowly deleting unused code


---

> [!NOTE]
> <sup>[Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) is generating a summary for commit 9aaa7b5db1c29e05f19b48134a97acc4fe293849. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

delete more gitea code slowly

## What this does
THIS IS NOT PRODUCTION READY

I prototype using jj-lib as our underlying version control system for our local documents.

I implemented `jj_init_repo`, `jj_commit`, `jj_list_bookmarks` and `jj_diff` in this prototype.

Note that i make a git repo first and use git as the backend. and then use jj as an overlay to handle the diffs

calling jj_diff returns the diff like this - https://gist.github.com/lita/ba29138e03de03346170843ca7235a81

I am not sure what the right API is here, but I was doing a lot of work to conform the JJ structs into MomentDiff and MomentDiffFileHunks, as they were designed with git datastructures in mind.

@hausdorff suggested we not do that and just change the UI to conform to what JJ gives us. I thought i provide what I have and have @hausdorff work off of that.


prototype of using jj 

> [!NOTE]
> **Low Risk**
> Low risk defensive changes: avoids crashes when command availability data is missing and prevents mutating cached environment vars while defaulting unresolved secret/command outputs to empty strings.
> 
> **Overview**
> Improves robustness of the terminal command picker by treating missing `commandAvailability` entries as *not installed* (using optional chaining/defaults) instead of assuming data is always present.
> 
> Adjusts `$selectedEnvironmentVars` to `structuredClone` the loaded vars before resolving `op://` secrets or `$()` shell substitutions, and replaces non-null assertions with `?? ""` so unresolved values don’t propagate `undefined` or crash.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 29943f9a80816533adae349b9597571d8be877be. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

Fix problems code review issues identified in #12484

## What this does
we should move away from using gitea.GetLoggedInUserFromContext  and move towards reading the claims


---

> [!NOTE]
> **High Risk**
> Touches authentication/authorization paths (permission middleware, sharing/invites, workspace/repo ownership), so incorrect claim handling could inadvertently deny access or grant permissions. Some handlers now assume non-nil claims/subject, increasing risk of panics or behavior changes when auth context is missing or uses publish-password tokens.
> 
> **Overview**
> Updates docsapi controllers and permission middleware to derive the acting user from `auth.GetClaimsFromContext(ctx)` (using `claims.Subject`) instead of `gitea.GetLoggedInUserFromContext`, including document sharing/invite flows, workspace listing/creation, and Pierre repo ownership setup.
> 
> Adjusts `AuthnHasDocumentPermission` subject selection to treat publish-password tokens as `Everyone` while still applying the publish-password caveat check, and updates unit tests accordingly. Includes a minor `Cargo.lock` whitespace change.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 10565b57b54c129db0fe3ecc3dc9569a4d9682a4. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

use claims

create personal workspace for new user in dynamodb (#12507)

## What this does
i thought we could turn off post-login, but turns out we were also creating a personal workspace entry in dynamo in this flow.

rather than bringing back the post-login endpoint, i just check the error type and create one if a personal workspace does not exist.


---

> [!NOTE]
> **Medium Risk**
> Adds write-side behavior to `GetUserFromClaims` by creating a DynamoDB personal workspace and Authzed ownership when a workspace lookup returns `NotFoundWorkspaceError`, which could affect login flows and permissions if mis-triggered.
> 
> **Overview**
> `GetUserFromClaims` now detects `workspacesdb.NotFoundWorkspaceError` during user hydration and automatically **creates the user’s personal workspace in DynamoDB**, sets `MomentWorkspace`, and calls `EnsureWorkspaceOwner` before caching the user.
> 
> Removes the prior *dev-only* workspace auto-recreation path (now commented out) and updates the `WorkspaceDBClient` mock to support `CreateWorkspace` assertions; adds a focused unit test covering the missing-workspace creation flow.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit c735abb98cbd9099a96257130f72642579131e73. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

create personal workspace for new user in dynamodb

fix rust logger (#12486)

## What this does
this adds a rust logger explicitly. before, we were sending rust logs via forwarding all logs to the main webview console. but by doing that we lose out on rust logs via terminal.

rather than forwarding all the rust logs, i prefer to just send them separately in rust. the agent did suggest just writing our own log parser in rust and forwarding it, which seems reasonable as we might want to process them differently. 


---

> [!NOTE]
> **Medium Risk**
> Changes the desktop app’s Rust logging pipeline and adds a background thread that ships logs over HTTP to Datadog in non-local environments, which could affect log volume, performance, or failure modes under network issues.
> 
> **Overview**
> Adds `fern` and wires `tauri-plugin-log` to emit to multiple targets: *Webview* plus an optional Datadog `Dispatch` when `APP_ENV` is `staging`/`production`.
> 
> Introduces `datadog_log_dispatch` in `datadog.rs`, which embeds the Datadog client token from packaged `conf.json`, formats log records as JSON with env/platform tags, and sends them via a dedicated blocking sender thread.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 05119d133c714efe4ddf0d50a7344efc624dcc0b. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

fix rust logger

make permission url work for reboot (#12505)

## What this does
looks like we do need to rewruite `github-1234' to `github|1234` so that reboot permissions work.

if that does not work, we will need to look at the context explictly but that is more work.


---

> [!NOTE]
> **Medium Risk**
> Touches request middleware that mutates route params used for downstream authorization/routing; incorrect rewriting could break workspace endpoints, but the change is small and covered by a new unit test.
> 
> **Overview**
> Fixes workspace routing for permission checks by rewriting the `workspaceID` Echo route param from a human slug (e.g. `github-1234`) to the canonical Authzed `PermissionsID` (e.g. `github|1234`) inside `processWorkspacePath`.
> 
> Removes the unused commented-out URL rewrite helper and adds a focused unit test ensuring `processWorkspacePath` mutates the `workspaceID` param as expected when resolving personal workspaces.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 06d554454d30e66c30604edaeabc58503d1231d5. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

make permission url work for reboot

Load PATH env var from system shell (#12506)

## What this does

Fixes an issue in the packaged versions of the app that prevents us from executing commands that are found in the user's PATH but inaccessible to macOS apps due to sandboxing. I did exactly the same thing with our Electron app too where I used [`shellenv`](https://www.npmjs.com/package/shell-env) to achieve the same effect.

Looking at https://github.com/tauri-apps/fix-path-env-rs, it seems that it's a problem on Windows too but I have never personally experienced that. 

We should close #12497 in favor of this PR. Using a login shell for one-off command execution is not a good idea since user's login shells are expensive to load (what with initializations, echo statements, custom settings etc.) that can affect the output.

## How I tested this

I didn't test this on macOS but it's most likely to fix the issue.


Load PATH env var from system shell

The shell dropdown menu will generally give you a list of default commands based on what's installed, *e.g.*, `claude`. Sadly, we are somehow blowing away our environment, and we therefore do not discover the commands in any prod builds.


---

> [!NOTE]
> **Medium Risk**
> Changes how shell commands are executed to detect installed CLIs; risk is mainly platform-specific PATH/quoting issues or unexpected environment differences on macOS/Linux.
> 
> **Overview**
> Fixes command discovery on macOS/Linux desktop builds by running `which` with a login-shell-derived `PATH` (via `bash -l -c 'echo $PATH'`) before checking for executables.
> 
> Windows behavior (`Get-Command`) is unchanged; the availability check now relies less on the app’s inherited environment when detecting tools like `claude`/`op`.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 5bcfa1eff00dafbf63e8de4a225c8ff87ca2d25c. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

Attempt to fix the fact that prod builds don't discover commands

Revert "upgrade codemirror and add logging (#12454)"

still use slug for reboot stuff (#12503)

## What this does
we still need to pass back the sluggifed workspace id for reboot stuff.


---

> [!NOTE]
> **Medium Risk**
> Changes a backend API response contract consumed by the frontend; risk is mainly around client compatibility and correctness of slug computation for routing/collab.
> 
> **Overview**
> The `/internal/v1/workspaces` response shape is changed to return a new `RespWorkspace` object (instead of `model.Workspace`) for `owned`, `member`, and `guest`, adding `sluggified_id` computed from the workspace `id`.
> 
> Frontend sync/collab logging is updated to include the workspace in collab initialization logs, and the share-collab workflow now logs the chosen publish workspace before calling `$initializeCollab`.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 76ec488f86972dc8f8cbcfb6c030fbea7a9f3693. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

still use slug for reboot stuff

implement templates (#12502)

## What this does

this fixes templates such that we are no longer querying gitea anymore, but rather querying authzed to fetch all the templates with read permissions.

this only works for internal templates as it leverages the templates workspace id as the prefix. if we want to support users publishing templates, we will need to make further permissions changes to handle that.


---

> [!NOTE]
> **Medium Risk**
> Changes the data source and response shape for the templates listing to rely on Authzed relationship scans and Pierre lookups, which could affect correctness/performance and omit templates when metadata fetches fail.
> 
> **Overview**
> The `/internal/v1/templates` endpoint is reworked to stop querying Gitea and instead list templates by asking Authzed for all documents in the `moment-templates` workspace that have a `reader` relationship, then hydrating each entry with metadata from Pierre and sorting by `updatedAt`.
> 
> Authzed gains a new `GetTemplatesWithReadPermission` API implemented via a prefix-based `ReadRelationships` query (plus mock support), and dev initialization now also creates/registers the `moment-templates` workspace in Dynamo and ensures the configured owner relationship.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 157bd825c22a24cc2adecd45ae15cb5f846d56eb. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

implement templates

fix v2 endpoint (#12500)

## What this does
introduced a bug where we are not returning the proper type back


---

> [!NOTE]
> **Low Risk**
> Small, localized change to HTTP response shaping for repo creation; main risk is client compatibility if any consumer depended on the previous (incorrect) response type.
> 
> **Overview**
> Fixes the repo creation response types across API versions.
> 
> `POST /internal/v1/repos/:workspaceID` now returns the expected model repo by converting the Pierre repo via `PierreRepoToModelRepo`, and the legacy `createRepo` helper is inlined/removed. Conversely, `POST /internal/v2/repos/:workspaceID` returns the raw Pierre repo object instead of the v1 model wrapper.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 1ac3721eab931be3d200b694297d976f3862d852. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

fix v2 endpoint

## What this does

We don't need to ensure a Gitea user anymore as part of the login flow since we have moved to Pierre.

## Future follow-ups

Once this is also released to production, we can remove the endpoints that these actions were using in `docsapi`.

Delete auth0 post-login actions

Address PR feedback from #12484 (#12495)

## What this does

Addresses some automated code review comments from #12484.


Address PR feedback from #12484

do not depend on gitea user data anymore (#12496)

## What this does
when looking up personal workspaces, we were looking to verify that a user had a gitea user account before allowing users to share.

 this is not necessary anymore now that we have moved off of gitea and onto pierre. 

this PR fixes that.

I did comment out the ListTemplateRepos as that needs to be reimplemented with pierre. but i did not want to do that in this PR as right now, new users who sign up cannot share at this time.


---

> [!NOTE]
> **Medium Risk**
> Touches core request context/middleware and repo/permissions flows while swapping the backing storage/metadata source, which can affect authorization checks, URL routing, and document discovery if IDs or context values are mis-propagated.
> 
> **Overview**
> Removes the `GiteaWorkspaceID` concept from the core `model.Workspace`/`model.User` and updates request middleware and permission flows to use Authzed `PermissionsID` + workspace `PrettyName` instead of rewriting URLs to Gitea slugs.
> 
> Introduces a `pierre.Client` wrapper (`GetRepo`, `GetMetadata`, `ErrRepoNotFound`) and switches repo existence checks, repo listing/query hydration, Vercel revalidation metadata reads, and sharing email title lookup from Gitea metadata to Pierre-backed lookups.
> 
> Disables/strips Gitea-dependent functionality and tests that no longer apply (e.g., `ListTemplateRepos` now returns empty, repo creation no longer creates a Gitea repo, repo delete no longer falls back to Gitea, and assorted integration tests are commented out), and updates CLI/email tooling and controller mocks to accept the new Pierre dependency signature.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit d8c9cddab4827ce5eeb190bf04dd9b9215792679. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

do not depend on gitea user data anymore

When deleting/archiving pages before, it would show the user a 404 page. We should instead navigate them to the index page.

better delete/archive behavior

> [!NOTE]
> **Low Risk**
> Low risk: purely presentational Tailwind class tweaks in the canvas header with no behavioral or data-flow changes.
> 
> **Overview**
> Adjusts the canvas `Header` layout to add right padding (`pr-0.5`) so the `HeaderPopOver` focus ring isn’t visually clipped.
> 
> Tweaks rename mode styling by making the `EditInPlaceInput` title field bold (`className="font-bold"`) to match the non-editing title appearance.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 80b8976ef623d077808ee5b4faeef908032ce634. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

Fix up minor style issues in `Header`

> [!NOTE]
> **Low Risk**
> Small deletion of an apparently unused hotkey; main risk is only if something still references `new-canvas` at runtime, which appears unlikely given no matches in the app source.
> 
> **Overview**
> Removes the `new-canvas` command from `hotkeyCommands` and deletes its keybinding/metadata entry in `hotkeys`, eliminating the `Cmd/Ctrl+Shift+N` shortcut from the app’s registered hotkeys.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 71907d8174e6b8842401d9b6fd3651e3e69f65ed. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

Remove unused hotkey (we plan to never use this)

- Lita's new AWS auth stuff, although we'll have to change it again when `request` pages support custom code.
  - `text` type for `request` page body, but also instructions that nearly all APIs probably want `json`.
  - GREATLY PREFER standalone components in `render` calls, instead of inline components.


---

> [!NOTE]
> **Medium Risk**
> Touches request execution/header handling and request schema, which can affect how outgoing requests are formed and interpreted by APIs; changes are localized but impact core request-page behavior.
> 
> **Overview**
> Adds a new `text` request body mode to the request-page schema and execution paths, ensuring `Content-Type` is set to `text/plain` when not explicitly provided and making header checks case-insensitive.
> 
> Updates the request page UI body-mode mapping so schema `text` is preserved (and `graphql` remains mapped to `raw`).
> 
> Bumps `AGENTS.md` template version and expands guidance for agents/JS code cells (standalone React components, request body mode recommendations, AWS SDK usage), and extends Tailwind `safelist` to include standard color utilities for dynamically-generated classes in code cells.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit b47bdc44b7e38297c87dcf17f1828ba0e60eb2e1. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

Bump AGENTS.md with a bunch important new stuff

> [!NOTE]
> **Low Risk**
> UI-only change to document creation entry points; underlying creation and import logic is unchanged, with minimal risk beyond potential UX confusion.
> 
> **Overview**
> On the docs list, the primary **`New Document`** button now opens the `TemplateGallery` (template selector) instead of immediately creating a blank document.
> 
> The dropdown is simplified by removing the separate *New from Template* option (and associated icon import), leaving blank-document creation available via *New Blank Document* and keeping *Import Git Repository* unchanged.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit fbd7d464faa7e17c640eb38b3a4ad78ded94a816. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

`New document` will default to the template selector

## What this does

Exactly what it did last time.

## Potential Risks

The same as when there was code in Praneet's PR

## Future follow-ups

Hopefully, there will be no follow-ups such as creating the same PR again.

## How I tested this

I did not.


---

> [!NOTE]
> **High Risk**
> Introduces runtime execution of shell commands and secret-resolution via external CLI, which is security-sensitive and can affect request execution if commands fail or return unexpected output.
> 
> **Overview**
> Environment variables now support *dynamic values*: `op://...` 1Password secret references are resolved via the `op` CLI, and values containing `$(` are resolved by executing a script via Tauri’s `run_script` before request substitution.
> 
> The env editor is updated with CodeMirror autocompletion/placeholder guidance for these patterns, and command availability tracking is extended to include the 1Password CLI; `TerminalPopover` also removes its hardcoded fallback command availability map.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 1f9dd4ddb7ea545c5260d3cf1d38f77642465307. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

Lita merged Praneet's PR but went ahead and deleted all the contents first, so here it is again

## What this does

* Adds a static auto-completion source for 1Password (triggered by typing `op`) [secret reference](https://developer.1password.com/docs/cli/secret-reference-syntax/) and shell interpolation (triggered by typing `$(`) in the environments editor dialog.
  * Also triggered by the [default completion keymaps](https://codemirror.net/docs/ref/#autocomplete.completionKeymap).
  * **Note**: For the 1Password CLI to communicate with the desktop app, you must [enable the integration in the desktop app](https://developer.1password.com/docs/cli/get-started#step-2-turn-on-the-1password-desktop-app-integration) first.
* Checks if the 1Password CLI is installed if a variable's value is a 1Password secret reference
* Fetches the value of the 1Password secret reference from the `op` cli using [`op read`](https://developer.1password.com/docs/cli/reference/commands/read/).
* Executes the shell command if the variable's value is a shell command.

## Future follow-ups

* Add support for more commonly-used popular secrets provider.
* Maybe improve the auto-completion a bit more.
* 
## How I tested this

I ran the app locally and added variables of each type and used them in an HTTP request page. Then, I examined the HTTP request that was made to verify that the variables' values were correctly injected in the request.


Add auto-complete for 1Password secret references and shell interpolation

## What this does

Allows importing templates as pages (and subpages) in a document. I also protect against importing templates that contain HTTP Request pages into published documents, though I have not tested that specifically because none of our templates have HTTP Request pages yet.

<img width="437" height="294" alt="image" src="https://github.com/user-attachments/assets/cda7bf1a-a93d-48eb-b310-65e8cc709559" />
<img width="684" height="356" alt="image" src="https://github.com/user-attachments/assets/b5a1b063-4e8d-45c3-8fd1-b606d718574e" />
<img width="1351" height="744" alt="image" src="https://github.com/user-attachments/assets/7d6af743-b820-4c10-ac2a-cab515f61900" />


ability to import templates as pages

catalog prosemirror dependencies (#12483)

Before the revert #12482 we had catalogged most of the prosemirror dependencies. I wanted to make a clean revert with a follow-up PR to keep them catalogged

catalog prosemirror dependencies

- Fix isLoading using && instead of || so it correctly reflects when any data source is still loading, and remove isLoadingWorkspaces from global isLoading since personal workspace is sufficient to share
- Always include personalWorkspace in workspacesByName so the dropdown has at least one option even before the full workspace list loads
- Fix unsafe property accesses on potentially undefined personalWorkspace and publishWorkspace
- Add a tooltip to the CTA button when it's disabled showing the reason

fix sharetab without workspaces, add reasons

Reverts moment-eng/moment#12472

There are some weirdo issues going on somewhere deep inside ProseMirror that I wasn't able to figure out. Shane and I poked at the debugger for a little bit and he suggested just backing out the upgrade until we have a day to debug what's going on

Revert "upgrade prosemirror dependencies"

## What this does
delete reading from gitea and use the createdAt data from pierre


---

> [!NOTE]
> **Medium Risk**
> Changes `QueryDocuments` to rely solely on Pierre for repo discovery/metadata and removes the Gitea fallback/hydration path, which can change which documents appear and their timestamps. Test coverage is reduced by deleting most `QueryDocuments` behavior tests.
> 
> **Overview**
> **`QueryDocuments` now fetches repo metadata exclusively from Pierre.** The Gitea concurrent fetch fallback and the subsequent `gitea.HydrateMetadata` step (including filtering on hydration errors) are removed.
> 
> **Pierre-derived timestamps are adjusted.** `CreatedAt` is parsed from `pierreRepo.CreatedAt` (falling back to `moment.yml`), and `UpdatedAt` is clamped to be at least the Pierre `CreatedAt` when `moment.yml` is missing/older.
> 
> **Tests trimmed.** Removes the main `QueryDocuments` permission/role cases, leaving only `NoUser` and `EmptyResults` tests.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit ba9b4ccdf267d7ab8640ea0dabdf3e51abc401cb. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

look for createAt in repos

> [!NOTE]
> **High Risk**
> Adds a new AWS OAuth/credential flow and a global `fetch` interceptor that proxies and re-signs `*.amazonaws.com` requests, touching security-sensitive auth/credential and networking paths across TS and Rust.
> 
> **Overview**
> Adds **desktop AWS SSO support** via a new Tauri `aws` crate that can open the browser login flow (or reuse AWS CLI login cache), track session/status, and **SigV4-sign + execute AWS HTTP requests** through a Rust proxy.
> 
> Exposes this capability to the app through new `@moment/state` AWS atoms + `useAwsSso`, updates the Environments popover to include an **AWS tab** (region pickers, login/logout, account/role display), and wires code-cell runtime support by injecting `env._aws` plus a **global `fetch` interceptor** that routes AWS SDK v3 traffic through the Rust signer/proxy.
> 
> Minor cleanup: removes a debug log in `AuthProvider` and drops an unused `[parallel]` marker from `justfile`.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 3b80e703755c57d4d77e297401ad07b04e1c49df. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

AWS OAUTH2 FLOW - ALEX THIS IS THE REAL PR

Fixes this error that would come up in the console on dev:

```
[Error] Warning: React.jsx: type is invalid -- expected a string (for built-in components) or a class/function (for composite components) but got: object.
```

fix svg import errors

## What this does












|        | Screenshot                 |
| ------ | -------------------------- |
| Before | {{ paste screenshot/gif }} |
| After  | {{ paste screenshot/gif }} |

## Potential Risks



## Future follow-ups



## How I tested this




---

> [!NOTE]
> **High Risk**
> Introduces new authentication (AWS sign-in) flows and a global `fetch` interceptor plus a Rust request-signing proxy, which are security- and networking-critical and could impact unrelated HTTP behavior if mis-scoped.
> 
> **Overview**
> Adds **desktop-only AWS support** end-to-end: a new AWS tab in the Environments popover lets users sign in/out via AWS Sign-In (OAuth+PKCE) and shows the active account/role, with region selection via a new `AwsRegionCombobox`.
> 
> Introduces a code-cell AWS runtime (`env._aws`) that installs a global `fetch` interceptor for `*.amazonaws.com` requests, strips SDK-added auth headers, and forwards requests to a new Tauri/Rust AWS proxy for SigV4 signing and execution.
> 
> On the backend, adds a new `tauri-app` Rust workspace crate `crates/aws` exposing Tauri commands (`aws_sso_login/status/logout`, `execute_aws_request`, profile listing/status), including credential loading, request signing, and S3 region-redirect handling; state exports and a new `useAwsSso` hook are added to `@moment/state`. Minor cleanups include a CI branch trigger tweak, removing a `justfile` parallel marker, and dropping a noisy Auth0 cached-token debug log.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 209a653f9f49e95f80a76fdeb0dfb4ed8b2a65e3. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

temporary. close this

## What this does

a risky one, as always, but there are relevant bug fixes (especially in react-prosemirror)

upgrade prosemirror dependencies

This PR primarily proposes to allow users to do the equivalent of the `jj describe` or `git commit --amend`: when they click a commit in the `BranchTimeline` there will be a little text box that lets them edit the PR description in place, and it will take care of automatically rebasing all the descendant commits that come after in the chain.

But, along the way I noticed a bunch of bugs, so I wrote tests that express them, and then fixed them. The worst is a family of bugs that look roughly as follows:

  - We have some commit checked out.
  - We mutate some ancestor commit with either `jj_describe` or `jj_resolve_conflict`.
  - Boom, suddenly you have two "conflicting" copies of a the commit you modified, as well as all descendants.

So, why does this happen? The super quick answer is that we did not finalize the transaction with `finish()` or call `reset_head`, so the things those two functions update  are both out-of-date. There's a bit more to it, of course:

  - The transaction API basically produces operations in the *operation log*, or *op log*.
  - Whenyou mutate the object metadata and then call `finish(op_id)` you are basically  stamping the on-disk working copy with a message that says "I correspond to this operation."
  - If you *don't* do this, then the WC copy might say something like "I'm at operation 3" when the `txn.commit()` produced operation 4.
  - The next time we call any routine that checks the repo state, we're going to try to reconcile those things. We'll notice one commit correpsonds to operation 3 and one corresponds to operation 4.
  - Next time we call `jj_snapshot`, we'll write the WC commit as the working copy sees it, which is the outdated ref. Not wanting to throw away any data, jj does not delete the "conflicting" commits, which leaves two commit objects around with the same change IDs, but different SHAs.

So that's why we *ABSOLUTELY MUST* call `finish()`. Why do we need to call `reset_head`? Well, we still have to sync the WC commit to git `HEAD`, or it will be out of sync and you will get very annoying problems like "two blank commits when you switch branches."

So anyway that's all the stuff we do!


---

> [!NOTE]
> **Medium Risk**
> Touches JJ-backed git mutation paths (describe/resolve conflict) and working-copy/head synchronization, which can impact history integrity and user repos if incorrect, though changes are well-covered by new tests.
> 
> **Overview**
> Adds **in-place commit message editing** in the `BranchTimeline` via a new `describe` operation (JJ equivalent of amend), including committing drafts directly from the commit details blade and closing the versioning dialog afterward.
> 
> Introduces a shared `useDraftCommitMessage` atom so draft commit messages persist across the status bar commit popover and timeline editor, removes the old `CommitDiffSheet`, and hardens blade selection by re-resolving rewritten commits by `changeId`.
> 
> Extends the desktop (Tauri/Rust) git layer with a new `describe` command and updates JJ `describe`/`resolve_conflict` to properly `finish()` WC mutations, `reset_head`, reattach branch HEAD, and return the rewritten commit hash; adds regression tests to prevent divergent change IDs/forked history when rewriting commits deep in the stack.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit d80eab67ce00a81d28acb7347dc248437ffd9697. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

`jj_describe` and various fixes relating to auto-rebasing

gitignore next-env

This was not important in the world of git, but is important in the world of jj!

If this looks like it was submitted twice, that's because it was, lol. I forgot to submit `hausdorff/diff-lol` so when I merged it, I merged directly into that branch like an idiot.


---

> [!NOTE]
> **Medium Risk**
> Moderate risk because it changes the cross-layer history data contract (Rust -> JSON -> Zod -> UI) and adds new derived logic for JJ commits; failures would mostly manifest as incorrect/absent indicators rather than data loss.
> 
> **Overview**
> Adds an `is_empty`/`isEmpty` flag to the repo history/commit graph model end-to-end (Tauri Rust types + Zod schema + `useCommitGraph` mapping).
> 
> JJ history now computes `is_empty` by comparing a commit’s tree to its first parent, while Git-backed commits default it to `false`. The BranchTimeline UI uses this to render an **“empty”** badge (with the same hover “more →” affordance) for empty commits and tweaks the styling of the default “more →” label.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 58308ddd6029a6fb8d5407af60d95f5fbbc3d833. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

Commit graph should have a visual indicator commit is empty

- Remove `Delete branch` option from `CommitNode` dropdown menu. We aren't supporting this right now.
  - Disable `Create branch here...` optoin for draft commits, including a `disabledMessage` that explains why (you can only branch from a "real" commit or it doesn't make sense in git, lol)
  - Delete unused `UncommittedChangesPanel`.`


---

> [!NOTE]
> **Low Risk**
> Low risk UI/UX-only changes in the git history dialog: removes unsupported actions and tightens menu disabling logic, with no data/auth flows changed.
> 
> **Overview**
> Cleans up the git history UI by removing the **branch delete** actions from `CommitNode` and adding a `isDraft` check (empty commit message) that **disables “Create branch here…”** with an explanatory `disabledMessage`.
> 
> Also deletes the unused `UncommittedChangesPanel` component.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 0b9be6af4421c03c84cdf5f1436195a37e4974ba. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

Various branch/jj UI cleanups

To get started quickly, we moved to jj with a very naive "diff" "algorithm". This "diff" "algorithm" simply reported the entire file as being replaced, every single time. Hilarious! And not helpful.

This PR replaces it with a new implementation based on `jj::Diff`. It's a drop-in replacement for what was already there.



---

> [!NOTE]
> **Medium Risk**
> Changes the core hunk-generation logic for JJ-backed `show` output and adds a new dependency; incorrect line ranges or token-to-string conversion could affect diff rendering in the UI.
> 
> **Overview**
> Replaces the JJ `create_diff_hunks` implementation from a naive “entire file replaced” hunk to jj-lib’s real unified diff (`unified_diff_hunks`), producing context/added/removed lines with proper per-hunk line ranges.
> 
> Adds the `bstr` dependency to build `jj_lib::merge::Diff` inputs, and expands unit tests to cover single-line edits, multi-hunk diffs, and completely different files (plus a trailing-newline-sensitive identical-content case).
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit fd84c61dd5a4952844003a901ba03ead4b747011. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

Replace naive `diff` with line-by-line diff

Small nit which is annoying.


---

> [!NOTE]
> **Low Risk**
> Small UI focus change scoped to dialog close behavior; main risk is a brittle selector/timing issue if the editor DOM isn’t present when the RAF runs.
> 
> **Overview**
> When `DocumentVersioningDialog` closes, it now restores focus back to the ProseMirror editor by scheduling a `requestAnimationFrame` DOM query (`.ProseMirror`) and calling `.focus()`.
> 
> This is done inside the dialog `onOpenChange` close path after resetting blades and closing the dialog, with a comment noting the dialog sits outside the ProseMirror provider tree.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 5a00f6be70cd94ebb6f8da75381abdc8ed786fe2. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

Autofocus the document when we close `DocumentVersioningDialog`

We have historically avoided passing in the `-l` (interactive login) flag largely because we weren't sure how we wanted terminal environments to work. Our customers have been very clear: they want it to work like basically any other terminal. Specifically:

  - Without the `-l` flag you of course load the normal configuration files, like `.zshenv`, `.zshrc` (or equivalent).
  - Depending on setup, you may NOT load `.zshenv`, `.zprofile`, or `.zlogin`.
  - But empirically our users do want us to ALWAYS load those things.

The "easy" fix to this is just to pass the `-l` flag in when invoking shell processes, at least on Unix derivatives. This should cause the shell env to work under many more circumstances. There are of course downsides, like:

  - You'll probably get wacky stuff like duplicate `PATH` entries in some cases, like if you are running the app from CLI instead of launchd (which many Linux  users probably will).
  - Startup will likely be perceptibly slower for zsh which is already really slow.
  - Shell startup and init may or may not do what you expect, like display MOTD/startup messages at the wrong times.

But, given how strongly users expressed the preference to do it this way, all of this seems pretty minor in comparison.


---

> [!NOTE]
> **Medium Risk**
> Changes how the embedded PTY is spawned by adding `-l` for default shells on non-Windows platforms, which can alter startup behavior and environment initialization. Risk is moderate due to potential user-environment side effects (PATH duplication, slower startup, unexpected login scripts).
> 
> **Overview**
> The embedded terminal now spawns the *default shell* with the login flag (`-l`) on non-Windows platforms, while leaving custom commands and Windows behavior unchanged.
> 
> This updates `$connectTerminalPty` to choose `args` based on whether the instance is using the default shell vs a custom `command`.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 161f7effee95576c882f07b7f223858c77282a40. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

Pass `-l` to embedded terminal

This was not important in the world of git, but is important in the world of jj!

https://github.com/user-attachments/assets/2ae4c07a-0adc-4348-88e4-35c9d52595ed



---

> [!NOTE]
> **Low Risk**
> Small, additive metadata + UI rendering change; main risk is misclassification of empty commits from the new JJ tree comparison or missing backend population causing inconsistent indicators.
> 
> **Overview**
> Adds an `isEmpty`/`is_empty` flag to commit history data end-to-end (Tauri JJ history computation, Rust history types, Zod schema, and `useCommitGraph` mapping) so the UI can distinguish empty commits.
> 
> Updates the BranchTimeline commit row to display an **“empty”** pill (and “more →” on hover) when a commit has no changes vs its parent, and tweaks the hover styling for the default “more →” affordance.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 48efff6ab1f0e9986ed6b6e55bcac6d2422cafa2. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

A long time ago "it was decided" that we should not support all of gitconfig, since it supports a lot of stuff that we can't, at least right now (like post-commit hooks). The idea was to store this config in some place like `~/.moment/.gitconfig`, and if you start the app without such a config, we'd bootstrap it from available global configs.

We didn't quite implement that successfully this time around, specifically we need to fall back to the global configs when bootstrapping. This PR should fix it though.


---

> [!NOTE]
> **Medium Risk**
> Touches startup config resolution and adds multiple fallback sources, which could change which identity values get picked up in edge cases across platforms.
> 
> **Overview**
> When `~/.moment.../jj-config.toml` is missing, bootstrapping now pulls `user.name`/`user.email` from external sources instead of only the Moment-scoped `.gitconfig`.
> 
> `ensure_jj_config` checks (in order) JJ’s global config locations, then Moment’s `.gitconfig`, then Git’s default/global config via `git2::Config::open_default()`, and writes the first non-empty values found into the Moment `jj-config.toml` before proceeding with normal layered config reads.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 480767db1eea11de10a22cf822ea07d7c26226ac. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

Fall back to constructing jj config from globals if missing

This PR proposes a new implementation for our "branch switch" procedures, via a new `jj_branch_switch` function. Like PR #12466, the implementation is a little intricate, because the world of jj is slightly different than the world of git:

  - Perhaps obviously, switching to a revision that does not include a branch is an error.
  - Switching to a branch that does not have a draft commit causes us to *create* a draft commit at the tip of that branch. (Recall from #12466 that a "draft" commit is just a commit without a commit description, since git hosts will generally reject such commits.)
  - Switching to a branch with a draft commit will just switch you to that draft commit.

Mostly this should be intuitive to git users.



---

> [!NOTE]
> **Medium Risk**
> Touches core branch-switch behavior and git/jj ref synchronization, which can easily cause incorrect HEAD/bookmark state or phantom commits if edge cases are missed; new integration tests mitigate but don’t eliminate runtime-environment risk.
> 
> **Overview**
> Updates `jj_branch_switch` to **only allow switching to an existing bookmark** and to handle *draft vs described* targets differently: draft bookmarks now `edit` the working copy in place, while described bookmarks create a new draft working-copy commit on top and use a two-phase bookmark update so exported git refs stay at the described commit.
> 
> Removes the prior git2-based branch lookup/checkout flow during switching and standardizes on `reset_head` + `export_refs`, then attaches git `HEAD` to `refs/heads/<target>`. Adds a comprehensive integration test suite (`jj_bookmark_sync.rs`) covering draft/described switching, non-existent targets, round-trip switching, and regression coverage for snapshot/ensure interactions and duplicate change IDs.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit e2c2945bebb429f737a624ebb7e3601cb85d0a03. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

jj_branch_switch

This PR proposes a revamped "new branch" implementation via a `jj_branch_new` command. This is an intricate command in the jj world. This is well-tested, but to expedite things, I will give you a taste of these intricacies below.

  - We have a notion of a "draft" commit: a commit without a description. You can't push these commits to GitHub so this matches our semantics anyway.
  - We DO NOT allow you to create a branch from a draft commit. You can only branch from a "normal" commit, *i.e.*, one with a description.
  - When you create a branch, we create a new draft commit, and assign both the jj bookmark AND the git branch to it. I'll include a screenshot below in the PR description to show you what it means.
  - CRITICALLY: this is slightly different than the git/jj interop semantics, because this commit kind-of-does-not-exist to git. Why?
  - The "draft" commit (in jj parlance the "working copy" commit at the branch tip which has no description) does not exist from git's perspective. We "sync" this draft commit to git as unstaged changes in the index!
  - So, it doesn't really make sense to set the git branch at this commit, since of course, it would not show up in (*e.g.*) `git log`. But, the commit does exist in the `.git` folder, so it will accept the branch as pointing to that git object OID.
  - So we do that because it's convenient. It will make the state look slightly wacky if you open it with a git client, but fixing this is more trouble than it's worth.

Finally, per the comment above, the outcome of `jj_branch_new` is below. You can see for branch `test-2` we've created a draft commit to branch off from `main`.

<img width="494" height="199" alt="Screenshot 2026-02-09 at 12 55 19" src="https://github.com/user-attachments/assets/bb8677ae-8b66-4a1c-be7a-2b97f9ff8d4f" />



---

> [!NOTE]
> **High Risk**
> Changes core branch/working-copy semantics across UI, state refresh, and Rust JJ/git interop, including HEAD/bookmark movement and snapshot behavior. Bugs here could desync repo state or unexpectedly change on-disk files during branch operations.
> 
> **Overview**
> Updates *new branch creation* to be JJ-native and to **create + check out** the branch in a single operation, removing the UI’s explicit post-create `branchSwitch` call.
> 
> On the Rust side, `jj_branch_new` is reworked to reject draft (empty-description) targets and duplicate names, create a new working-copy commit on top of the target, export git refs, and attach git `HEAD` to the new branch; related git state refresh/purge behavior is expanded in the app state layer to reflect the working-copy change.
> 
> Branch listing becomes JJ-aware (`list_local_branches` routes to `jj_list_local_branches`), snapshotting is made idempotent while keeping bookmarks/`HEAD` in sync, and `ensure_jj_repo` sync logic is adjusted for cases where git `HEAD` already points at the JJ working-copy commit. Adds extensive new integration tests for `jj_branch_new` semantics and updates existing branch tests for async branch listing.
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 2280ffda88e4b1cf58c73bedc659a28af826f8f5. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

jj_branch_new

Update the trigger for desktop app workflow (#12465)

## What this does

...since `app/**` is no more...

GitHub PR Dashboard

Team Load

Open Pull Requests

Recently Merged

Appendix