summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
4 hoursT9164: coderabbit: surface NOS Jira project alongside legacy VDnos-task-idYuriy Andamasov
VD tracker project renamed to NOS (2026-07). Pins NOS ahead of the retained legacy VD in knowledge_base.jira.project_keys so CodeRabbit resolves the new keys in review summaries. Companion to the mergify task-id regex sweep (canary vyos/vyos-1x#5379). 🤖 Generated by [robots](https://vyos.io)
8 hoursdocs: upgrade vendored DataTables 1.11.5 -> 2.3.8 (#2173)rollingYuriy Andamasov
* docs: upgrade vendored DataTables 1.11.5 -> 2.3.8 Swap the vendored single-component DataTables downloader build from 1.11.5 to 2.3.8 (docs/_static/js/datatables.js, docs/_static/css/datatables.css). The only init site, docs/_static/js/tables.js, uses the option-less jQuery-style $('#id').DataTable() form, which is unchanged in 2.x, so neither it nor docs/_templates/layout.html needed edits. jQuery 3.6.0 is still injected ahead of the bundle by sphinxcontrib-jquery and satisfies 2.x. Remove docs/_static/css/DataTables-1.11.5/ (10 sort-icon images). 2.x draws sort indicators in pure CSS: the new datatables.css contains no url() references at all, and the replaced 1.11.5 stylesheet was the only thing in the repo that referenced those files. Migrate custom selectors for the 2.x generated-class renames, each verified against the downloaded bundle rather than assumed: - .dataTables_info -> .dt-info (tables.css, text.css) - .paginate_button -> .dt-paging-button (tables.css, text.css) - #coverage a.paginate_button{,.current,.next,.previous} -> #coverage button.dt-paging-button{...} 2.x renders paging controls as <button> (was <a> in 1.x), so the old rules failed on both element type and class. The .current/.next/ .previous modifiers are still emitted and are retained. The #table-cfgcmd_wrapper / #table-opcmd_wrapper rules are deliberately untouched: only the wrapper *class* changed (dataTables_wrapper -> dt-container); the element id is still <tableId>_wrapper. Drop the CodeQL exclusion (.github/codeql/codeql-config.yml, plus the optional codeql-cfg-path input in .github/workflows/codeql.yml). That config existed solely to paths-ignore the 1.11.5 bundle, which tripped 7 alerts (5x js/incomplete-multi-character-sanitization, 2x js/incomplete-sanitization). Upstream 2.x hardened the implicated helpers - _stripHtml now runs a do/while fixpoint over the <script> strip, and _escapeHtml uses all-global regexes - so those patterns are not expected to recur. Removing the exclusion restores default CodeQL coverage of the file; this PR's own CodeQL run is the empirical test. Provenance (DataTables downloader builder, styling "DataTables default", component set dt only - the 2.x equivalent of the previous #dt/dt-1.11.5): https://cdn.datatables.net/v/dt/dt-2.3.8/datatables.js sha256 184fb4bd0b9a81a955acd608ba94d0643c74271e78c0fae30f1f40b824f88b1d https://cdn.datatables.net/v/dt/dt-2.3.8/datatables.css sha256 e37677437e0fbe4a463aafc83bc4ea8d60986b72050ba9f47f740b41148184ae Verified with a local make html: build succeeded, and coverage.html renders both tables (table-cfgcmd 9095 rows, table-opcmd 3036 rows) with the 2.3.8 assets injected in the correct order after jQuery. 🤖 Generated by [robots](https://vyos.io) * docs: simplify paging-button hover background to one declaration The hover rule carried 'background-color: #E1E4E5 !important' followed by 'background: none'. The important longhand outranks the later normal-importance shorthand, so the gray hover fill did apply — but the pair is confusing and CodeRabbit read it as a dead declaration. Collapse to a single 'background: #E1E4E5 !important', which produces the identical effective state (gray fill, upstream 2.x hover gradient suppressed) in one declaration. 🤖 Generated by [robots](https://vyos.io) * docs: re-target mobile search-input margin at the 2.x sibling DOM DataTables 1.x nested the search <input> inside its <label>; 2.x renders them as siblings inside div.dt-search, so the narrow-viewport descendant rule 'label input' no longer matched and the 10px top margin was silently lost below 576px. Target '.dt-search input' instead. Flagged independently by the implementation pass and both adversarial reviewers (Codex + agy). 🤖 Generated by [robots](https://vyos.io)
8 hoursdocs: Update Conntrack sync page to VyOS 1.5 standards (#2147)LiudmylaNad
* docs: Update Conntrack sync page to VyOS 1.5 standards * Minor corrections * Update conntrack-sync.md * Use "active/backup" terminology consistent with official conntrackd docs Co-authored-by: Daniil Baturin <daniil@baturin.org> --------- Co-authored-by: Daniil Baturin <daniil@baturin.org>
15 hours docs: Update DNS forwarding page to VyOS 1.5 standards (#2163)LiudmylaNad
* docs: Update DNS forwarding page to VyOS 1.5 standards * Update dns.md * Update dns.md
15 hours docs: Update Dynamic DNS page to VyOS 1.5 standards (#2164)LiudmylaNad
* docs: Update Dynamic DNS page to VyOS 1.5 standards
15 hours docs: Update DHCP Relay page to VyOS 1.5 standards (#2146)LiudmylaNad
15 hours docs: Update Router Advertisements page to VyOS 1.5 standards (#2132)LiudmylaNad
* docs: Update Router Advertisements page to VyOS 1.5 standards
16 hours docs: Update HTTP API page to VyOS 1.5 standards (#2131)LiudmylaNad
* docs: Update HTTP API page to VyOS 1.5 standards * Clarify the wording about self-signed certificates * Fix unsual wording regarding DH parameters configuration * Update https.md --------- Co-authored-by: Daniil Baturin <daniil@baturin.org>
33 hoursci: bump REVIEWER_REF to reviewer-v1.0.3 (rolling branch-map fix) (#2182)Yuriy Andamasov
The reviewer-v1.0.2 tag ships a branches.json that maps docs branch 'rolling' to vyos-1x branch 'current'. The vyos-networks/vyos-1x mirror renamed 'current' to 'rolling', so the 'Checkout vyos-1x at mapped branch' step fails on every rolling-based PR (first observed run 30565684480, PR #2177). reviewer-v1.0.3 carries the corrected mapping (rolling -> rolling) plus CI/docs-only changes; no reviewer Python source changes between the two tags. 🤖 Generated by [robots](https://vyos.io)
36 hoursvyos-api: clarify comment regarding commit failure and partial commits (#2178)John Estabrook
5 daysdocs(Installation): Remove outdated portal link and Proxmox/KVM cloud… (#2176)LiudmylaNad
* docs(Installation): Remove outdated portal link and Proxmox/KVM cloud-init note * Update install.md
7 daysMerge pull request #2172 from ↵Yuriy Andamasov
vyos/dependabot/npm_and_yarn/workers/postcss-8.5.23 chore(deps): bump postcss from 8.5.17 to 8.5.23 in /workers
7 daysMerge pull request #2161 from ↵Yuriy Andamasov
vyos/dependabot/npm_and_yarn/workers/multi-1160cd7046 chore(deps): bump sharp, @cloudflare/vitest-pool-workers and wrangler in /workers
8 dayschore(deps): bump postcss from 8.5.17 to 8.5.23 in /workersdependabot/npm_and_yarn/workers/postcss-8.5.23dependabot[bot]
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.17 to 8.5.23. - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/postcss/postcss/compare/8.5.17...8.5.23) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.23 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
8 dayssecurity: remediate CodeQL code-scanning alerts (#2171)Yuriy Andamasov
* security: remediate CodeQL code-scanning alerts (picker XSS sinks, test sanitization, vendored DataTables exclusion) Remediates all 11 open CodeQL alerts on the default branch: - version-picker.js (js/xss-through-dom, alerts 1-3): percent-encode every DOM-derived path component (select.value, parsed location segments) at URL construction time via encodePath()/langUrlFor(), and tighten the parseLocation slug charset to [A-Za-z0-9._-]. No-op on legitimate sphinx slugs — URLs stay byte-identical (asserted by tests). - workers/apex/test/manifest.test.ts (js/incomplete-multi-character- sanitization, alert 6): strip HTML comments from the root.html fixture repeatedly to a fixpoint instead of a single pass. - docs/_static/js/datatables.js (alerts 4,5,7-11): excluded from CodeQL analysis via .github/codeql/codeql-config.yml (new codeql-cfg-path input to the fleet reusable workflow). The file is vendored stock DataTables 1.11.5; the flagged helpers are display/sort normalization, not sanitization boundaries. Excluding keeps the vendored copy byte-identical to upstream instead of hand-patching it. Adds 9 picker tests (hostile-input encoding + slug-charset accept/reject); workers suite 103/103 green. 🤖 Generated by [robots](https://vyos.io) * security: normalize pre-existing percent escapes in encodePath Adversarial-review finding (Codex, medium): location.pathname returns well-formed escapes verbatim, so blind encodeURIComponent double-encoded them (%2E -> %252E), broke the HEAD probe on escaped deep links, and dumped the user at the version root. Each segment is now decoded first (malformed escapes keep the raw segment — no throw), then re-encoded to canonical single encoding. Decoding cannot resurrect dot-segments: the URL parser resolves '.'/'..' and their percent-encoded forms during navigation, so pathname never presents them (verified against the WHATWG parser in Node). workers suite 106/106 (+2 regression tests, mutation-verified). 🤖 Generated by [robots](https://vyos.io) * security: normalize percent escapes per run, not per segment Round-2 adversarial finding (Codex, medium): whole-segment decode meant one malformed escape (a%20b%zz) threw for the segment and double-encoded the valid escapes beside it. encodeSegment now decodes+re-encodes each well-formed %HH run independently; literal spans (including a bare '%') always pass through encodeURIComponent, so taint neutralization holds unconditionally; a run decoding to invalid UTF-8 stays verbatim (already pure %HH text). workers suite 108/108 (+2 discriminating regression tests). 🤖 Generated by [robots](https://vyos.io)
8 daysMerge pull request #2165 from vyos/claude/remove-superpowerdocs-ba80b9Yuriy Andamasov
docs: exclude superpowers/ from the Sphinx build
8 daysdocs: exclude superpowers/ from the Sphinx buildYuriy Andamasov
`docs/superpowers/` holds Claude Code plugin-generated internal design specs and plans, not user documentation. Adding `superpowers` to `exclude_patterns` guards against Sphinx ever picking the directory up and publishing it should it reappear in the source tree. Guard only — the content itself was already removed in 3ab97e71 and abb8be5b.
10 dayschore(deps): bump sharp, @cloudflare/vitest-pool-workers and wranglerdependabot/npm_and_yarn/workers/multi-1160cd7046dependabot[bot]
Bumps [sharp](https://github.com/lovell/sharp) to 0.35.2 and updates ancestor dependencies [sharp](https://github.com/lovell/sharp), [@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers) and [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler). These dependencies need to be updated together. Updates `sharp` from 0.34.5 to 0.35.2 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](https://github.com/lovell/sharp/compare/v0.34.5...v0.35.2) Updates `@cloudflare/vitest-pool-workers` from 0.18.4 to 0.18.8 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vitest-pool-workers/CHANGELOG.md) - [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-pool-workers@0.18.8/packages/vitest-pool-workers) Updates `wrangler` from 4.110.0 to 4.114.0 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.114.0/packages/wrangler) --- updated-dependencies: - dependency-name: sharp dependency-version: 0.35.2 dependency-type: indirect - dependency-name: "@cloudflare/vitest-pool-workers" dependency-version: 0.18.8 dependency-type: direct:development - dependency-name: wrangler dependency-version: 4.114.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
13 daysMerge pull request #2160 from vyos/claude/smoke-hardening-2Yevhen Bondarenko
docs-gates: re-land HTTPError close + detail logging; widen smoke retry envelope
13 daysdocs-gates: hard-bound the smoke deadline (cap probe timeout + inter-round ↵Yuriy Andamasov
sleep to remaining budget) Codex adversarial finding: DEADLINE_SECONDS was only checked BEFORE each op, so a probe or sleep starting at 479s could overshoot to ~510s — 480 was a soft target, not a hard bound. Make it hard: run() now computes an absolute deadline = start + DEADLINE_SECONDS plus a _remaining() helper. The per-probe socket timeout is capped to min(PROBE_TIMEOUT_SECONDS, max(1, remaining)) — the previously hardcoded 30 is now the PROBE_TIMEOUT_SECONDS constant; a probe with < 1s of budget is skipped and counted unresolved. The inter-round sleep is capped to min(RETRY_SLEEP_SECONDS, remaining) and is skipped entirely when the budget is exhausted (falling into the existing deadline path). No body-read-level deadline is added — pages are small, so the socket-op timeout bounds reads adequately. Deadline-path failure accounting is unchanged. Tests: the probe timeout is capped to the remaining budget (fake opener records the timeout it was opened with); the inter-round sleep is capped to the remaining budget (sleep spy); the existing suite stays green. 🤖 Generated by [robots](https://vyos.io)
13 daysdocs-gates: widen smoke retry envelope for worker-version propagation (5 ↵Yuriy Andamasov
rounds x 30s) The merge-triggered smoke run for the round-based retry work failed on a worker-version propagation race that outlasted the 3-round x 20s envelope: all probes were served the previous SHA through rounds 1-2 and one path (cli.html) was still stale at round 3 (2 sleeps x 20s = 40s insufficient). Widen to MAX_ROUNDS=5 / RETRY_SLEEP_SECONDS=30 -> 4 inter-round sleeps x 30s = 2 min, covering the observed 1-2+ min propagation waves. The green path is unaffected (no retries -> zero added time); DEADLINE_SECONDS=480 still bounds the worst case. Tests read the constants dynamically (monkeypatch), so none pin the old literals. 🤖 Generated by [robots](https://vyos.io)
13 daysdocs-gates: close HTTPError response; name failed assertion in smoke logs ↵Yuriy Andamasov
(CR round 2) Two accepted GitHub-side CodeRabbit findings on the smoke gate: Close the HTTPError response stream: _probe_once read the non-2xx body via e.read() but never closed the HTTPError, which is file-like and owns the response socket — leaking it / raising ResourceWarning on the expected-404 path every run. The read is now wrapped in "with e:" INSIDE the crash-containment nesting, so the stream is closed even if the read raises (still yielding the retryable transport-error result, never a traceback). Name the failed assertion in retry/fail logs: _probe_once now returns a compact `detail` naming which check failed ("status" / "docs-build" / "apex-build" / "search-mount", multiple joined by "+", or the transport error text; None when ok) instead of a bare transport-only field. SMOKE-RETRY / SMOKE-FAIL lines gain `detail=<...>` alongside the existing status / docs-build fields, so an apex-build or search-mount failure no longer logs an opaque "status=200 docs-build=<sha>". ok-path behavior and the JSON / exit contract are unchanged. Tests: HTTPError stream is closed on the happy-404 path and when the read raises (RecordingBody close recorder); apex-build-only and search-mount-only failures name their detail in the logs; _probe_once joins multiple failed checks with "+". Removed the now-unused _http_error helper. 🤖 Generated by [robots](https://vyos.io)
13 daysMerge pull request #2159 from vyos/claude/smoke-hardeningYevhen Bondarenko
docs-gates: smoke per-probe retry + explicit UA; workers: broaden asset-ext classification
13 daysdocs-gates: round-based smoke retries + deadline; contain HTTPError read ↵Yuriy Andamasov
crash; dedup index probe (review round 1) Adversarial round (Codex + agy, both REQUEST CHANGES) on the per-probe retry model shipped in the prior commit — reworked: Round-based retries (both providers' critical): probe the whole plan once, then re-probe ONLY the still-failing probes each round (up to MAX_ROUNDS=3, one RETRY_SLEEP_SECONDS=20 gap between rounds). A probe passing in any round passes. This keeps the full per-probe failure enumeration (diagnostic value) that a fail-fast retry would lose, while bounding added time to at most 2 sleeps. DEADLINE_SECONDS=480 (time.monotonic from run() start, checked before each probe AND before each inter-round sleep) caps total wall-clock; on breach a single SMOKE-DEADLINE line is logged and every unresolved probe counts as failed. Intermediate not-ok logs "SMOKE-RETRY <path>: round <n> ..."; the JSON {"failures": n} summary and exit contract are unchanged. Contain HTTPError read crash (agy critical): a transport error DURING e.read() inside the HTTPError branch previously escaped the outer catch and crashed the gate. _probe_once now nests the open/HTTPError handling so ANY exception on the open OR body-read path yields a retryable transport-error result, never a traceback. Dedup index probe (agy): critical-pages.txt lists index.html, so /en/<slug>/index.html was probed twice. probe_plan now filters index.html out of the critical list; plan[0] stays the single index (and sole search-mount) probe. ua-policy.json intentionally left unchanged (pushback recorded: fail-open plus block-precedence make an allow entry non-protective). Tests reworked for round semantics: transport-error recovery across rounds, HTTPError-read containment, one-sleep-per-inter-round-gap spy, round scoping (only the failed path re-probed), run() JSON + exit contract, zero-deadline path, and index-probe dedup. 🤖 Generated by [robots](https://vyos.io)
13 daysdocs-gates: smoke per-probe retry + explicit UA; workers: broaden asset-ext ↵claude/smoke-hardeningYuriy Andamasov
classification smoke.py — BIC independence: probe requests now send an explicit User-Agent (vyos-docs-smoke/1.0) so the gate no longer depends on a Cloudflare Browser Integrity Check UA-skip rule surviving. The default Python-urllib UA was blocked by BIC until that exemption was added; a silent dependency on it is a latent gate failure the moment the rule is touched. smoke.py — propagation-race tolerance: each probe now retries up to 3 attempts (20s apart; MAX_ATTEMPTS + RETRY_SLEEP_SECONDS are module-level so tests can shrink them) and only fails after the final attempt. A freshly deployed worker version loses a brief propagation race in which a single probe is served by the PREVIOUS version (observed: status 307 + stale X-Docs-Build minutes after deploy), which previously failed the entire gate. Intermediate attempts log SMOKE-RETRY; only exhaustion logs SMOKE-FAIL and counts a failure. Retry fires only on a not-ok outcome (wrong status, wrong/missing build header, missing search mount, or a transport exception); a legitimately-expected 404 passes on the first attempt. workers/branch — broaden asset classification (CodeRabbit post-merge nit): fold .pdf into the case-insensitive ASSET_EXT_RE and add webp + otf, so uppercase .PDF and modern image/font assets get the longer asset cache class. /_static/ and /_images/ path checks unchanged. 🤖 Generated by [robots](https://vyos.io)
13 daysMerge pull request #2158 from vyos/claude/html-handling-parityYevhen Bondarenko
workers: html_handling none + worker index-mapping — RTD .html URL parity
14 daysworkers: bare-directory 301 via asset probe + asset-class images + config ↵Yuriy Andamasov
congruence test (review round 1)
14 daysworkers: html_handling none + worker index-mapping — RTD .html URL parity ↵claude/html-handling-parityYuriy Andamasov
(smoke 307 fix)
2026-07-21Merge pull request #2152 from BradKollmyer/vyos-api-doc-gaps-T9087-T9092Viacheslav Hletenko
vyos-api: fill automation API doc gaps (T9087–T9092)
2026-07-20 docs: Update Event handler page to VyOS 1.5 standards (#2130)LiudmylaNad
* docs: Update Event handler page to VyOS 1.5 standards * Apply suggestions from code review Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-07-20docs: update flowtable and ethernet/bonding documentation (#2106)jvela-dot
* docs: update flowtable and ethernet/bonding documentation * Removing Netfilter word and add the identification of the interfaces to use FlowTables * Fixed warning from commit:c433e15 * Update docs/configuration/firewall/flowtables.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update docs/configuration/firewall/flowtables.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update docs/configuration/firewall/flowtables.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update docs/configuration/firewall/flowtables.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * cfgmc structure and sub-interface offload fixed * Fixed conflicts on flowtable documentation * revert ethernet.md and fixed the latest infos * added subsection to the checks section to show offloaded traffic for sub-interfaces * Final changes * Changed conntrack -L to VyOS command * Replacing new output description with VyOS command --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-07-14vyos-api: T9087: T9092: apply review feedback (line length, retry safety)Brad Kollmyer
Convert the multi-field-node table to wrapped list items per the 80-char docs guideline, and rework the bulk-apply bullet to reconcile state before retrying after a timeout instead of recommending blind retries. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-14vyos-api: T9087: tighten firewall same-request wording (review feedback)Brad Kollmyer
Only port/port-group require protocol in the same request; description alone is fine on an existing rule but fails on a rule no request has created yet. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-14vyos-api: T9092: add bulk configuration guidanceBrad Kollmyer
Batch sizing, geoip/remote-group commit cost, the 1 MB request-body-size-limit, and commit-confirm as a remote safety net. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-14vyos-api: T9090: T9091: batched /configure semantics; save via /config-fileBrad Kollmyer
Document that an operation list commits as one transaction whose error may not identify the failing op (bisect / one-op fallback), and that /configure rejects {"op": "save"} — persistence goes through /config-file. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-14vyos-api: T9089: document /retrieve showConfig on empty pathsBrad Kollmyer
showConfig returns HTTP 400 'Configuration under specified path is empty' for schema-valid but unconfigured paths; recommend probing with exists or treating that error as an empty subtree. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-14vyos-api: T9088: document /show configuration commands exportBrad Kollmyer
The /show endpoint can return the running config as flat set commands (op-mode 'show configuration commands' equivalent) — the natural way to mirror or back up a router over the API; previously undocumented. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-14vyos-api: T9087: document commit atomicity for multi-field nodesBrad Kollmyer
Each /configure request is validated and committed on its own, so fields of one node (task-scheduler executable+interval, NAT translation, firewall action/protocol before port) must be sent in a single request. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-14ci: T9082: onboard CodeQL scanning via central reusable workflow (#2151)Yuriy Andamasov
🤖 Generated by [robots](https://vyos.io)
2026-07-13Merge pull request #2150 from vyos/claude/workers-vitest4Yevhen Bondarenko
docs: fix workers dependency conflict + test workers changes on PRs
2026-07-12docs-infra: use PR number (not head ref) in apex-deploy concurrency groupYuriy Andamasov
Phase-0 CodeRabbit finding on the PR-trigger commit: github.head_ref is not unique across forks, so two PRs from different forks with the same branch name would share a concurrency group. Key on github.event.pull_request.number instead. 🤖 Generated by [robots](https://vyos.io)
2026-07-12docs-infra: run workers tests on PRs (gap let broken deps land)Yuriy Andamasov
apex-deploy.yml's test job only triggered on push to rolling, so no PR-level check ran the workers/ vitest suite — that's how the vitest 3.2/pool-workers 0.18.4 peer conflict landed on rolling undetected (two dependabot PRs merged clean since nothing exercised `npm ci` in workers/ pre-merge). Add a `pull_request` trigger scoped to `workers/**` so the test job runs pre-merge. Gate deploy-canary and deploy-production with `if: github.event_name != 'pull_request'` so PR runs test only — no canary/production deploys fire on a PR (deploy-production would also auto-skip via `needs: deploy-canary` once canary skips, but the explicit `if:` keeps intent visible). Concurrency group now branches per-event so PR runs queue/cancel independently of the rolling deploy group instead of colliding with it. Validated with actionlint + a YAML parse check. 🤖 Generated by [robots](https://vyos.io)
2026-07-12docs-infra: align vitest with pool-workers 0.18 peer (dependabot ERESOLVE)Yuriy Andamasov
Dependabot bumped @cloudflare/vitest-pool-workers to 0.18.4 (peer: vitest ^4.1.0) while workers/package.json still pinned vitest ~3.2.0, so npm ci ERESOLVEs in workers/ on rolling (docs-build run 29153221240; apex-deploy affected too). Bump vitest to ~4.1.0 to match the peer. 0.18.4 also removed the `@cloudflare/vitest-pool-workers/config` subpath export in favor of a `cloudflareTest()` Vite plugin — vitest.config.ts updated to the new shape (defineConfig from vitest/config + plugins: [cloudflareTest(...)]), matching the package's own vitest-v3-to-v4 codemod. No other files reference the old API. Verified: clean `npm ci` from a deleted node_modules resolves without --force/--legacy-peer-deps, `npm audit` reports 0 vulnerabilities (ws/wrangler bumps stay in place), and the full suite (`npx vitest run`) passes 84/84 across all 9 test files. 🤖 Generated by [robots](https://vyos.io)
2026-07-11chore(deps): bump ws and @cloudflare/vitest-pool-workers in /workers (#2141)dependabot[bot]
Bumps [ws](https://github.com/websockets/ws) to 8.21.0 and updates ancestor dependency [@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers). These dependencies need to be updated together. Updates `ws` from 8.18.0 to 8.21.0 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](https://github.com/websockets/ws/compare/8.18.0...8.21.0) Updates `@cloudflare/vitest-pool-workers` from 0.8.71 to 0.18.4 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vitest-pool-workers/CHANGELOG.md) - [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-pool-workers@0.18.4/packages/vitest-pool-workers) --- updated-dependencies: - dependency-name: ws dependency-version: 8.21.0 dependency-type: indirect - dependency-name: "@cloudflare/vitest-pool-workers" dependency-version: 0.18.4 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-11chore(deps): bump wrangler and @cloudflare/vitest-pool-workers (#2142)dependabot[bot]
Bumps [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) to 4.110.0 and updates ancestor dependency [@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers). These dependencies need to be updated together. Updates `wrangler` from 4.35.0 to 4.110.0 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.110.0/packages/wrangler) Updates `@cloudflare/vitest-pool-workers` from 0.8.71 to 0.18.4 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vitest-pool-workers/CHANGELOG.md) - [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-pool-workers@0.18.4/packages/vitest-pool-workers) --- updated-dependencies: - dependency-name: wrangler dependency-version: 4.110.0 dependency-type: indirect - dependency-name: "@cloudflare/vitest-pool-workers" dependency-version: 0.18.4 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-11Merge pull request #2145 from vyos/claude/pdf-image-conversionYevhen Bondarenko
docs: render diagrams in PDF builds (imgconverter + ImageMagick/librsvg)
2026-07-11Merge rolling into claude/pdf-image-conversion (combine constrained apt ↵Yuriy Andamasov
line: imagemagick, librsvg2-bin, poppler-utils) 🤖 Generated by [robots](https://vyos.io)
2026-07-11Merge pull request #2143 from vyos/claude/pdf-xelatex-fixYevhen Bondarenko
docs: force latexmk through per-glyph/per-image errors (fix Devanagari PDF failure)
2026-07-10docs-infra: retry LaTeX only when PDF absent; constrained poppler installYuriy Andamasov
🤖 Generated by [robots](https://vyos.io)
2026-07-10docs-infra: PDF artifact check — exact file, page-count floor, restored retryYuriy Andamasov
🤖 Generated by [robots](https://vyos.io)
generated by cgit v1.2.3 (git 2.39.1) at 2026-08-05 01:41:14 +0000