)]}' { "log": [ { "commit": "8bfd72689f1fbba4e858f7440dc77b764cd653b9", "tree": "f132b783623f9624127674f24d4eef3fcf2c6751", "parents": [ "3fea9372d73fc06ab4f1165f63fdf729bd7bda57" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 19 10:28:30 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 10:28:30 2026 +0100" }, "message": "ci(deps): bump js-yaml from 4.3.1 to 4.3.2 in /website (#929)\n\nBumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.3.1 to 4.3.2.\n- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md)\n- [Commits](https://github.com/nodeca/js-yaml/compare/4.3.1...4.3.2)\n\n---\nupdated-dependencies:\n- dependency-name: js-yaml\n dependency-version: 4.3.2\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "3fea9372d73fc06ab4f1165f63fdf729bd7bda57", "tree": "19085ab45b61991b3cc34bb769bd9901b445d30d", "parents": [ "f8274cfd6020a475bae3167eceb9195cff087f0e" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 19 10:27:24 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 10:27:24 2026 +0100" }, "message": "ci(deps): bump @babel/core from 7.29.0 to 7.29.7 in /website (#930)\n\nBumps [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) from 7.29.0 to 7.29.7.\n- [Release notes](https://github.com/babel/babel/releases)\n- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-core)\n\n---\nupdated-dependencies:\n- dependency-name: \"@babel/core\"\n dependency-version: 7.29.7\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "f8274cfd6020a475bae3167eceb9195cff087f0e", "tree": "7dfa256111d5bf8f60fdc920602ff72d7036a053", "parents": [ "f6982d222a1c84309248243e1940b95b35a48f99" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 19 10:20:09 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 10:20:09 2026 +0100" }, "message": "ci(deps-dev): bump js-yaml from 4.3.1 to 4.3.2 in /telemetry/ui (#935)\n\nBumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.3.1 to 4.3.2.\n- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md)\n- [Commits](https://github.com/nodeca/js-yaml/compare/4.3.1...4.3.2)\n\n---\nupdated-dependencies:\n- dependency-name: js-yaml\n dependency-version: 4.3.2\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "f6982d222a1c84309248243e1940b95b35a48f99", "tree": "cded06b11f00ed9f4f5cf4672ab34650b029c8ce", "parents": [ "dc88202fc111ade772605cd8cb124849a2e4e299" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 19 10:19:14 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 10:19:14 2026 +0100" }, "message": "ci(deps): bump ip-address from 10.4.0 to 10.7.2 in /website (#940)\n\nBumps [ip-address](https://github.com/beaugunderson/ip-address) from 10.4.0 to 10.7.2.\n- [Release notes](https://github.com/beaugunderson/ip-address/releases)\n- [Commits](https://github.com/beaugunderson/ip-address/compare/v10.4.0...v10.7.2)\n\n---\nupdated-dependencies:\n- dependency-name: ip-address\n dependency-version: 10.7.2\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "dc88202fc111ade772605cd8cb124849a2e4e299", "tree": "ae48edabb5ac7a053738437c970b6edbbcc8818b", "parents": [ "3e107da5857c38f72b27027c4fb8dd835d116dca" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 19 10:05:54 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 10:05:54 2026 +0100" }, "message": "ci(deps): bump brace-expansion in /telemetry/ui (#955)\n\nBumps and [brace-expansion](https://github.com/juliangruber/brace-expansion). These dependencies needed to be updated together.\n\nUpdates `brace-expansion` from 1.1.18 to 1.1.21\n- [Release notes](https://github.com/juliangruber/brace-expansion/releases)\n- [Commits](https://github.com/juliangruber/brace-expansion/compare/v1.1.18...v1.1.21)\n\nUpdates `brace-expansion` from 2.1.4 to 2.1.7\n- [Release notes](https://github.com/juliangruber/brace-expansion/releases)\n- [Commits](https://github.com/juliangruber/brace-expansion/compare/v1.1.18...v1.1.21)\n\n---\nupdated-dependencies:\n- dependency-name: brace-expansion\n dependency-version: 1.1.21\n dependency-type: indirect\n- dependency-name: brace-expansion\n dependency-version: 2.1.7\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "3e107da5857c38f72b27027c4fb8dd835d116dca", "tree": "e015fc97266750634e8814b41af437255d81d554", "parents": [ "01e2ca0f189683f958ef4f8d1af699e96f0cea0e" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 19 10:05:07 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 10:05:07 2026 +0100" }, "message": "ci(deps): bump @modelcontextprotocol/sdk in /website (#956)\n\nBumps [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) from 1.27.1 to 1.32.1.\n- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)\n- [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/v1.27.1...1.32.1)\n\n---\nupdated-dependencies:\n- dependency-name: \"@modelcontextprotocol/sdk\"\n dependency-version: 1.32.1\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "01e2ca0f189683f958ef4f8d1af699e96f0cea0e", "tree": "84817f63c5d67cc90bedec30099842d78a689b7f", "parents": [ "86ef746df047348673803007e3cabee61dd2633f" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 19 10:04:23 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 10:04:23 2026 +0100" }, "message": "ci(deps): bump next from 15.5.24 to 15.5.27 in /website (#969)\n\nBumps [next](https://github.com/vercel/next.js) from 15.5.24 to 15.5.27.\n- [Release notes](https://github.com/vercel/next.js/releases)\n- [Commits](https://github.com/vercel/next.js/compare/v15.5.24...v15.5.27)\n\n---\nupdated-dependencies:\n- dependency-name: next\n dependency-version: 15.5.27\n dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "86ef746df047348673803007e3cabee61dd2633f", "tree": "9239a4ee6ec7033b3af01e7c6b20c38e17924775", "parents": [ "045d18ccbafacbdd270a4106d64c7b1fa9a80147" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 19 10:03:39 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 10:03:39 2026 +0100" }, "message": "ci(deps): bump source-map-js from 1.2.1 to 1.2.2 in /website (#971)\n\nBumps [source-map-js](https://github.com/7rulnik/source-map-js) from 1.2.1 to 1.2.2.\n- [Release notes](https://github.com/7rulnik/source-map-js/releases)\n- [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/7rulnik/source-map-js/compare/v1.2.1...v1.2.2)\n\n---\nupdated-dependencies:\n- dependency-name: source-map-js\n dependency-version: 1.2.2\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "045d18ccbafacbdd270a4106d64c7b1fa9a80147", "tree": "ce6815db34181075c078a1200439d1bb5695644f", "parents": [ "77aad1e2a26b01323ee0d1f8c7a6fad4d39a45ac" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 19 10:03:04 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 10:03:04 2026 +0100" }, "message": "ci(deps): bump fast-uri from 3.1.7 to 3.1.8 in /website (#972)\n\nBumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.7 to 3.1.8.\n- [Release notes](https://github.com/fastify/fast-uri/releases)\n- [Commits](https://github.com/fastify/fast-uri/compare/v3.1.7...v3.1.8)\n\n---\nupdated-dependencies:\n- dependency-name: fast-uri\n dependency-version: 3.1.8\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "77aad1e2a26b01323ee0d1f8c7a6fad4d39a45ac", "tree": "89a386fe8584a0be2c73c7af4cbe2a560fe5d35a", "parents": [ "5369eb85d071e91044d09e73c791c8a95c48c98c" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 19 10:02:31 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 10:02:31 2026 +0100" }, "message": "ci(deps): bump sharp from 0.35.4 to 0.35.5 in /website (#973)\n\nBumps [sharp](https://github.com/lovell/sharp) from 0.35.4 to 0.35.5.\n- [Release notes](https://github.com/lovell/sharp/releases)\n- [Commits](https://github.com/lovell/sharp/compare/v0.35.4...v0.35.5)\n\n---\nupdated-dependencies:\n- dependency-name: sharp\n dependency-version: 0.35.5\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "5369eb85d071e91044d09e73c791c8a95c48c98c", "tree": "a6b204abc11ec5a76e111384545341dff98f4cfc", "parents": [ "75e9c7d359ea6f621932d6c6a87753f9524b9ebf" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 19 10:01:54 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 10:01:54 2026 +0100" }, "message": "ci(deps): bump postcss-selector-parser from 7.1.5 to 7.1.6 in /website (#974)\n\nBumps [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser) from 7.1.5 to 7.1.6.\n- [Release notes](https://github.com/postcss/postcss-selector-parser/releases)\n- [Changelog](https://github.com/postcss/postcss-selector-parser/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/postcss/postcss-selector-parser/compare/7.1.5...7.1.6)\n\n---\nupdated-dependencies:\n- dependency-name: postcss-selector-parser\n dependency-version: 7.1.6\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "75e9c7d359ea6f621932d6c6a87753f9524b9ebf", "tree": "74dc284e06f10b865cc861122f87071380b1afcd", "parents": [ "9088aad8cb6de62b9923816b89eaa562c1162c65" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 19 10:01:17 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 10:01:17 2026 +0100" }, "message": "ci(deps): bump brace-expansion in /website (#975)\n\nBumps and [brace-expansion](https://github.com/juliangruber/brace-expansion). These dependencies needed to be updated together.\n\nUpdates `brace-expansion` from 5.0.9 to 5.0.12\n- [Release notes](https://github.com/juliangruber/brace-expansion/releases)\n- [Commits](https://github.com/juliangruber/brace-expansion/compare/v5.0.9...v5.0.12)\n\nUpdates `brace-expansion` from 1.1.18 to 1.1.21\n- [Release notes](https://github.com/juliangruber/brace-expansion/releases)\n- [Commits](https://github.com/juliangruber/brace-expansion/compare/v5.0.9...v5.0.12)\n\n---\nupdated-dependencies:\n- dependency-name: brace-expansion\n dependency-version: 5.0.12\n dependency-type: indirect\n- dependency-name: brace-expansion\n dependency-version: 1.1.21\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "9088aad8cb6de62b9923816b89eaa562c1162c65", "tree": "63f6368919dd8643aa91b022bdd871d7ac172739", "parents": [ "42a2e71391eb484c8f363068149cb49341de6e07" ], "author": { "name": "MIRS571", "email": "259312884+MIRS571@users.noreply.github.com", "time": "Sun Oct 18 01:17:11 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 17:17:11 2026 +0000" }, "message": "fix: keep missing in-memory state loads out of application lists (#958)\n\nGenerated-by: OpenAI Codex\n\nCo-authored-by: Elijah Ben Izzy \u003celijahbenizzy@users.noreply.github.com\u003e" }, { "commit": "42a2e71391eb484c8f363068149cb49341de6e07", "tree": "e21f81e060e3777287f0c031de5c4c5eb05e37ea", "parents": [ "5ab8bd33bfdcc470d31dbdb0f2cca84b6297c586" ], "author": { "name": "Kuang-xianxin", "email": "2764905233@qq.com", "time": "Sun Oct 18 01:17:07 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 17:17:07 2026 +0000" }, "message": "fix: select latest SQLite checkpoint when timestamps tie (#920)\n\nUse insertion order to disambiguate same-second checkpoints in sync and async SQLite persisters. Add durable reopening and partition regressions.\n\nAssisted-by: Codex\n\nCo-authored-by: Kuang-xianxin \u003c243476082+Kuang-xianxin@users.noreply.github.com\u003e\nCo-authored-by: Elijah Ben Izzy \u003celijahbenizzy@users.noreply.github.com\u003e" }, { "commit": "5ab8bd33bfdcc470d31dbdb0f2cca84b6297c586", "tree": "703a24baa6ce84fb71843c8713ab6b9481c8aa3d", "parents": [ "0db6e6b40b818802cc5f01214deb9aa62bd8d6aa" ], "author": { "name": "IronMurphy", "email": "hepushuo@gmail.com", "time": "Sun Oct 18 01:09:52 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 10:09:52 2026 -0700" }, "message": "fix(core): round-trip dicts that carry the serde marker key (#934)\n\nserialize_dict passed an ordinary dict through unchanged, so a dict whose own\nkeys include __burr_serde__ was read back as a serde envelope. deserialize then\nraised \"No deserializer registered for key\", which surfaced through\nState.deserialize as a state field that cannot be restored. The key is not\ndocumented as reserved.\n\nWrap such a dict in an envelope that restores it verbatim; every other dict\nkeeps its serialized form, and real envelopes still dispatch (or still raise\nthe informative error when their module was not imported)." }, { "commit": "0db6e6b40b818802cc5f01214deb9aa62bd8d6aa", "tree": "472f7cd8f340626505f9ac0b4ab3a6bafa0e6599", "parents": [ "c96b5f78f68a8071b2411f23ab53c42e82726533" ], "author": { "name": "Tai An", "email": "antai12232931@outlook.com", "time": "Sat Oct 17 09:16:22 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 16:16:22 2026 +0000" }, "message": "fix(integrations/hamilton): drop the stale extra argument to require_plugin (#905)\n\nrequire_plugin(import_error, plugin_name) takes two arguments. The hamilton\nintegration passes three, so when sf-hamilton is not installed the ImportError\nhandler raises\n\n TypeError: require_plugin() takes 2 positional arguments but 3 were given\n\ninstead of the actionable \"install burr[hamilton]\" message the helper exists to\nproduce. The other eleven call sites all pass (e, \"\u003cextras-target\u003e\"); the extra\n[\"sf-hamilton\"] here is a leftover from an older signature." }, { "commit": "c96b5f78f68a8071b2411f23ab53c42e82726533", "tree": "a107bcf18ba35b38395bfdfa57996e1c5be79ae7", "parents": [ "5e0ab348e791fd5014885168492afe2e18fb680d" ], "author": { "name": "Rolly Calma", "email": "115199279+Ghraven@users.noreply.github.com", "time": "Sun Oct 18 00:16:13 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 16:16:13 2026 +0000" }, "message": "fix(examples): bound image telephone downloads (#879)" }, { "commit": "5e0ab348e791fd5014885168492afe2e18fb680d", "tree": "53048a0c4f8221357bce8077dce0db372f081d1b", "parents": [ "918e323f4fbc5b22c087b5cb95afdf92df20335c" ], "author": { "name": "Matt Van Horn", "email": "mvanhorn@users.noreply.github.com", "time": "Sat Oct 17 09:16:01 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 16:16:01 2026 +0000" }, "message": "fix: allow union types in streaming_action.pydantic stream_type parameter (#732)\n\n* fix: allow union types in streaming_action.pydantic stream_type parameter\n\nAccept types.UnionType in stream_type so Python 3.10+ union syntax\n(MyModel1 | MyModel2) works with streaming_action.pydantic decorator.\n\nFixes #607\n\n* fix: guard types.UnionType on Python 3.9 to unblock test collection\n\n`types.UnionType` was added in Python 3.10 to represent PEP 604 `X | Y`\nunion syntax. Burr supports Python \u003e\u003d 3.9, so on 3.9 any module that\nreferences `types.UnionType` at import time hits an AttributeError at\ncollection time, which is why CI was showing:\n\n ERROR tests/core/test_action.py - AttributeError: module \u0027types\u0027 has no attribute \u0027UnionType\u0027\n ERROR tests/core/test_application.py - AttributeError: module \u0027types\u0027 has no attribute \u0027UnionType\u0027\n ERROR tests/core/test_graph.py - AttributeError: module \u0027types\u0027 has no attribute \u0027UnionType\u0027\n\nIntroduce a `_UnionType` compatibility alias in `burr/core/action.py`:\n`types.UnionType` on Python \u003e\u003d 3.10, a placeholder sentinel class on\nPython \u003c 3.10. Replace every `types.UnionType` reference in\n`burr/core/action.py` and `burr/integrations/pydantic.py` with that\nalias. `pydantic.py` imports it from `burr.core.action`, matching the\nconvention used for the other shared symbols imported from that module.\n\nSince PEP 604 syntax doesn\u0027t exist on Python 3.9, no real union type can\nreach those call sites on 3.9 anyway, so the sentinel path is\nnever hit at runtime. 3.10+ behavior is unchanged.\n\nVerified with full test run under a clean venv:\n tests/core/test_action.py + test_application.py + test_graph.py: 250 passed\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n\n* test(pydantic): add streaming union-type test, widen return annotation\n\nPer @andreahlert\u0027s review on PR #732:\n- Add test_streaming_pydantic_action_union_stream_type exercising\n stream_type\u003dModel1 | Model2 (PEP 604), guarded with\n sys.version_info \u003e\u003d (3, 10) skip for 3.9 compatibility.\n- Widen the _validate_and_extract_signature_types_streaming return\n type to Union[Type[dict], Type[pydantic.BaseModel], _UnionType] so\n the annotation matches the runtime values returned in the union case.\n\nVerified: pytest tests/integrations/test_burr_pydantic.py - 34 passed\n(Python 3.12).\n\n* test: cover union stream_type (Model1 | Model2) in pydantic integration\n\nAdds the union-type test requested in review and the supporting\ntouches; focused pydantic suite verified locally (34/34).\n\n---------\n\nCo-authored-by: Matt Van Horn \u003c455140+mvanhorn@users.noreply.github.com\u003e\nCo-authored-by: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e" }, { "commit": "918e323f4fbc5b22c087b5cb95afdf92df20335c", "tree": "6dffc203eab4fef9ce76222080bc9270daebf27c", "parents": [ "347c58bfcc7664e26093c84b2422980c029b11e5" ], "author": { "name": "tonghzhang", "email": "107253801+tonghzhang@users.noreply.github.com", "time": "Sat Oct 17 23:38:06 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 08:38:06 2026 -0700" }, "message": "fix(core): reject unsupported dictionary unpacking in safe_expr (#939)\n\nReject ast.Dict unpacking at validation time so unsupported expressions do\nnot silently evaluate using a None key. Cover nested and short-circuited\nunpacking, and preserve ordinary dictionary literals with None keys.\n\nGenerated-by: OpenAI Codex" }, { "commit": "347c58bfcc7664e26093c84b2422980c029b11e5", "tree": "63cc2596524eee79bde980cc9b594fab9ce55a20", "parents": [ "cd427baf7faa3fd0e2efa2937ff513c381a6e1fc" ], "author": { "name": "digit50", "email": "93092234+digit50@users.noreply.github.com", "time": "Sat Oct 17 18:37:57 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 08:37:57 2026 -0700" }, "message": "fix: include DataFrame content in pandas serde file name (#963)\n\nThe pandas serializer named the parquet file after a hash of the columns, shape and dtypes only, so two same-shape DataFrames serialized to one path shared a file and the earlier state loaded the later data. The hash now also covers the DataFrame content, using pandas row hashes and falling back to the parquet bytes for cells pandas cannot hash, such as lists.\n\nCloses https://github.com/apache/burr/issues/961" }, { "commit": "cd427baf7faa3fd0e2efa2937ff513c381a6e1fc", "tree": "f018cea198157961161225c431f9b5450982f628", "parents": [ "383b118881c51401bf08936566bc9c9a9eb03f18" ], "author": { "name": "digit50", "email": "93092234+digit50@users.noreply.github.com", "time": "Sat Oct 17 18:37:41 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 08:37:41 2026 -0700" }, "message": "fix: resolve state keys before builtins in Condition.safe_expr (#962)\n\nCondition.safe_expr looked up its allowlisted builtins before state, so a state key named max, sum or any evaluated to the builtin function and gave a different answer than Condition.expr. Names are now read from state first and fall back to the builtin, and every name that is not the target of a call is reported in reads.\n\nCloses https://github.com/apache/burr/issues/960" }, { "commit": "383b118881c51401bf08936566bc9c9a9eb03f18", "tree": "09c523c8113345cc1d55d82f5155b06cd2b80f6a", "parents": [ "1c2f03e424a8121d42c20a297142ad642bfe5d37" ], "author": { "name": "Rolly Calma", "email": "115199279+Ghraven@users.noreply.github.com", "time": "Sat Oct 17 23:34:30 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 15:34:30 2026 +0000" }, "message": "fix(streamlit): read state logs as utf-8 (#907)\n\n* fix(streamlit): read state logs as utf-8\n\n* test: isolate streamlit optional dependencies and close log files\n\n* test: explicitly import importlib.util" }, { "commit": "1c2f03e424a8121d42c20a297142ad642bfe5d37", "tree": "02d734d36277cbc51475dca58dae6da465d5d9be", "parents": [ "c17ddbf05d86035fdef0b76deedfdb63870d00f5" ], "author": { "name": "Sangkyoon Nam", "email": "sangkyoon.nam@namsang.co", "time": "Sun Oct 18 00:34:25 2026 +0900" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 15:34:25 2026 +0000" }, "message": "fix: log and uncache OTel spans that end on another thread (#941)\n\n* fix: log and uncache OTel spans that end on another thread\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* test: cover OTel spans after a nested app step\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n---------\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "c17ddbf05d86035fdef0b76deedfdb63870d00f5", "tree": "2c5d4524e553c3fc640ee398a0329e2bc8982916", "parents": [ "f35bcbd7e71185ea76e491b17ef13b9af5480198" ], "author": { "name": "breken", "email": "support@brekfuz.com", "time": "Sat Oct 17 23:34:01 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 15:34:01 2026 +0000" }, "message": "fix(core): pass __context/__tracer to async and streaming class-based actions (#937)\n\n* Pass __context/__tracer to async and streaming class-based actions\n\nA class-based action that declares `__context` (or `__tracer`) in its\nrun signature has that parameter name-mangled by Python, e.g. to\n`_MyAction__context`. The sync run path remaps the injected input to\nthe mangled name, but the async run path and both multi-step streaming\npaths passed `__context\u003d` as-is, so the action failed with\n`TypeError: run() got an unexpected keyword argument \u0027__context\u0027`.\n\nApply the same remap in `_arun_function` and in the sync and async\nmulti-step streaming runners.\n\nGenerated-by: Claude Code (Claude Opus 5.5)\nCo-Authored-By: Claude Opus 5.5 (1M context) \u003cnoreply@anthropic.com\u003e\n\n* Note the missing __context/__tracer remap in single-step runners\n\nThe single-step runners call run_and_update / stream_run_and_update with\nthe injected inputs as-is, so a SingleStepAction that names __context in\nits signature still gets a TypeError. SingleStepAction is internal and\nin-tree subclasses take **run_kwargs, so leave a TODO at each site rather\nthan change behavior here.\n\nGenerated-by: Claude Code (Claude Opus 5.5)\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n---------\n\nCo-authored-by: breken-ai \u003c312387581+breken-ai@users.noreply.github.com\u003e\nCo-authored-by: Claude Opus 5.5 (1M context) \u003cnoreply@anthropic.com\u003e" }, { "commit": "f35bcbd7e71185ea76e491b17ef13b9af5480198", "tree": "e9250183a831a7f11c328f06eabb469ae8897944", "parents": [ "16c6e2df1fd2c0ea744e6973225002b6fc8b3b00" ], "author": { "name": "breken", "email": "support@brekfuz.com", "time": "Sat Oct 17 23:33:31 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 15:33:31 2026 +0000" }, "message": "fix(core): accept edge_attr and other attribute dicts in visualize() (#938)\n\n* Accept edge_attr and other attr dicts in visualize()\n\nGraph.visualize() (and Application.visualize()) pass **engine_kwargs to\ngraphviz.Digraph, merging dict values into Burr\u0027s defaults. Only\ngraph_attr and node_attr have defaults, so passing any other dict such\nas edge_attr\u003d{\"color\": \"red\"} raised KeyError: \u0027edge_attr\u0027.\n\nMerge into an empty dict when Burr has no default for that key.\n\nGenerated-by: Claude Code (Claude Opus 5.5)\nCo-Authored-By: Claude Opus 5.5 (1M context) \u003cnoreply@anthropic.com\u003e\n\n* Keep visualize() defaults when an attr dict is None\n\nPassing graph_attr\u003dNone (or node_attr/edge_attr\u003dNone) replaced Burr\u0027s\ndefault attributes with None, so rankdir, ranksep and the node styling\nwere dropped. Treat a None *_attr like an omitted one.\n\nAlso cover the user-facing path: Application.visualize(edge_attr\u003d...)\nnow has its own test.\n\nGenerated-by: Claude Code (Claude Opus 5.5)\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n---------\n\nCo-authored-by: breken-ai \u003c312387581+breken-ai@users.noreply.github.com\u003e\nCo-authored-by: Claude Opus 5.5 (1M context) \u003cnoreply@anthropic.com\u003e" }, { "commit": "16c6e2df1fd2c0ea744e6973225002b6fc8b3b00", "tree": "426c3a2ffc438c327ba6cc87fd0c77c7c8348aae", "parents": [ "ca7616478f18e4a5e7cd2b07e3842864d0be62ee" ], "author": { "name": "Sangkyoon Nam", "email": "sangkyoon.nam@namsang.co", "time": "Sun Oct 18 00:33:12 2026 +0900" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 15:33:12 2026 +0000" }, "message": "fix: list each app once in SQL persister list_app_ids, newest save first (#942)\n\n* fix: list each app once in SQL persister list_app_ids, newest save first\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* docs: note list_app_ids order for SQL persisters\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n---------\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "ca7616478f18e4a5e7cd2b07e3842864d0be62ee", "tree": "bcb2f020d6525477674f99290b514a42ee04eb9e", "parents": [ "2dcf75c06f910614a496a77d2c98d8be6fcab084" ], "author": { "name": "Sangkyoon Nam", "email": "sangkyoon.nam@namsang.co", "time": "Sun Oct 18 00:30:00 2026 +0900" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 08:30:00 2026 -0700" }, "message": "fix: save Redis state for apps without a partition key (#952)\n\nCo-authored-by: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e" }, { "commit": "2dcf75c06f910614a496a77d2c98d8be6fcab084", "tree": "182ecfe5c9ac6338c8257d252d889551b7bcd2a9", "parents": [ "406331e73bcf20a53e7611cedc278e1d066ebd70" ], "author": { "name": "MIRS571", "email": "259312884+MIRS571@users.noreply.github.com", "time": "Sat Oct 17 23:29:39 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 08:29:39 2026 -0700" }, "message": "fix: preserve SQLite factory connection options on copy and unpickle (#957)\n\nGenerated-by: OpenAI Codex" }, { "commit": "406331e73bcf20a53e7611cedc278e1d066ebd70", "tree": "ef4fd917268e320286f5e2db1d12abe14838bcd7", "parents": [ "f71a347a3c765ed171b9efcc45557803330af4b6" ], "author": { "name": "Sangkyoon Nam", "email": "sangkyoon.nam@namsang.co", "time": "Sun Oct 18 00:29:30 2026 +0900" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 08:29:30 2026 -0700" }, "message": "fix: save Postgres state for apps without a partition key (#949)\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "f71a347a3c765ed171b9efcc45557803330af4b6", "tree": "4119a689ecfc86f9ac35d9a44a8cf09733817129", "parents": [ "b575283fbab94fd404761af4f5f045dadc8758a8" ], "author": { "name": "Rolly Calma", "email": "115199279+Ghraven@users.noreply.github.com", "time": "Sat Oct 17 23:27:38 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 08:27:38 2026 -0700" }, "message": "fix(cli): bound readiness poll requests (#911)\n\n* fix(cli): bound readiness poll requests\n\n* test: cover readiness timeout retry and optional CLI imports" }, { "commit": "b575283fbab94fd404761af4f5f045dadc8758a8", "tree": "1f4c97d93daa1a3532a1740df9a194db0a5e23be", "parents": [ "bd539bf2597476c808259db77167fd60797014c2" ], "author": { "name": "digit50", "email": "93092234+digit50@users.noreply.github.com", "time": "Sat Oct 17 18:27:32 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 08:27:32 2026 -0700" }, "message": "fix: run post execute hooks when stream_result fails before streaming (#968)\n\nstream_result and astream_result called the pre execute hook before validating halt conditions and fast-forwarding, but only called the post hook on errors raised later. A failure in that early section left the LangfuseBridge root span and its propagate_attributes context attached. The early section now calls the post hook with the exception before re-raising." }, { "commit": "bd539bf2597476c808259db77167fd60797014c2", "tree": "5a587ca448cb7b9e11c8d8ae50d4dbe084e7b415", "parents": [ "37213397bae08a40e3f1d5141af62559f1e16f9b" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sat Oct 17 08:16:55 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 08:16:55 2026 -0700" }, "message": "ci(deps): bump proxy-addr from 2.0.7 to 2.0.8 in /website (#959)\n\nBumps [proxy-addr](https://github.com/jshttp/proxy-addr) from 2.0.7 to 2.0.8.\n- [Release notes](https://github.com/jshttp/proxy-addr/releases)\n- [Changelog](https://github.com/jshttp/proxy-addr/blob/master/HISTORY.md)\n- [Commits](https://github.com/jshttp/proxy-addr/compare/v2.0.7...v2.0.8)\n\n---\nupdated-dependencies:\n- dependency-name: proxy-addr\n dependency-version: 2.0.8\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "37213397bae08a40e3f1d5141af62559f1e16f9b", "tree": "b9b28dac8ae6246261c0b92f4168b745818decee", "parents": [ "784bbaefdbbb1df805e4d0d2329c7e4eaae72be9" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sat Oct 17 08:16:48 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 08:16:48 2026 -0700" }, "message": "ci(deps-dev): bump handlebars from 4.7.9 to 4.7.10 in /telemetry/ui (#970)\n\nBumps [handlebars](https://github.com/handlebars-lang/handlebars.js) from 4.7.9 to 4.7.10.\n- [Release notes](https://github.com/handlebars-lang/handlebars.js/releases)\n- [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.10/release-notes.md)\n- [Commits](https://github.com/handlebars-lang/handlebars.js/compare/v4.7.9...v4.7.10)\n\n---\nupdated-dependencies:\n- dependency-name: handlebars\n dependency-version: 4.7.10\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "784bbaefdbbb1df805e4d0d2329c7e4eaae72be9", "tree": "1c4f2d50b2777f012a0fad6ee364e3b080d7f16c", "parents": [ "9c5101a427868558e9bd21caaa20a5a4c3675a8e" ], "author": { "name": "John Bampton", "email": "jbampton@users.noreply.github.com", "time": "Sun Oct 18 01:15:38 2026 +1000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 08:15:38 2026 -0700" }, "message": "misc: fix typos (#883)\n\nGeneral spelling clean up" }, { "commit": "9c5101a427868558e9bd21caaa20a5a4c3675a8e", "tree": "fad607e1d386f25bd8b3605b43b3a922cba8081e", "parents": [ "f8488d0cd034fa292c6d7e5fd1a431f12f403ff5" ], "author": { "name": "Elijah ben Izzy", "email": "elijahbenizzy@users.noreply.github.com", "time": "Sat Oct 17 08:05:27 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 08:05:27 2026 -0700" }, "message": "docs: add SECURITY.md describing the reporting process and security model (#944)\n\n* docs: add SECURITY.md describing the reporting process and security model\n\n* docs: clarify tracking server trust boundaries\n\n---------\n\nCo-authored-by: Stefan Krawczyk \u003cskrawczyk@salesforce.com\u003e" }, { "commit": "f8488d0cd034fa292c6d7e5fd1a431f12f403ff5", "tree": "f8515a51b54cf76624c3e9047c5c6d063003e639", "parents": [ "8161159148e9b9c795f683625d6721f2c955f9d8" ], "author": { "name": "mengxiaopeng", "email": "602012854@qq.com", "time": "Wed Oct 14 12:31:46 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 14 04:31:46 2026 +0000" }, "message": "feat(telemetry): highlight matching actions when hovering the graph (#953)\n\nGraph nodes are actions, and one action can run many times, so this hover\nis the action name scoped to its application. Telemetry rows and insight\nlines for that action use the same highlight as a direct row hover.\n\nCo-authored-by: Cursor Agent \u003ccursoragent@cursor.com\u003e" }, { "commit": "8161159148e9b9c795f683625d6721f2c955f9d8", "tree": "f11f495844ec228498278795bd3ff4f0ba0bb34f", "parents": [ "e833e4f404034f79d71af021a495e05c21cc3f87" ], "author": { "name": "Stefan Krawczyk", "email": "stefank@cs.stanford.edu", "time": "Sun Sep 20 12:36:07 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Sep 20 12:36:07 2026 -0700" }, "message": "ci: standardize JavaScript builds on Node 22 (#933)" }, { "commit": "e833e4f404034f79d71af021a495e05c21cc3f87", "tree": "9502905251e0da9e098af1345c25147b48e52bbd", "parents": [ "ef36e65c666dc3c48cf79b575155bcd1b9cd22ff" ], "author": { "name": "jf", "email": "50105951+jernejfrank@users.noreply.github.com", "time": "Sat Sep 12 05:14:45 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 11 21:14:45 2026 -0700" }, "message": "fix(release): address 0.43.0 RC verification feedback (#882)\n\nUse the source commit epoch throughout release and voter rebuilds so byte-for-byte sdist verification is reproducible. Fix the tracking UI nanoid advisory and enforce clean lint and formatting checks.\n\nCo-authored-by: Elijah Ben Izzy \u003celijahbenizzy@users.noreply.github.com\u003e" }, { "commit": "ef36e65c666dc3c48cf79b575155bcd1b9cd22ff", "tree": "ab37180ef40c9419309f9098777e51bce7d9523f", "parents": [ "24f05e37ace7914791005083bc948ab619257781" ], "author": { "name": "adawang", "email": "adawang12101210@gmail.com", "time": "Sat Sep 12 12:05:32 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Sep 12 04:05:32 2026 +0000" }, "message": "fix: display state reads and writes on separate lines in graph visualization (#805)\n\nSigned-off-by: adawang \u003cadawang12101210@gmail.com\u003e" }, { "commit": "24f05e37ace7914791005083bc948ab619257781", "tree": "c363695fd07875c699b76be8e7d12af5591abae0", "parents": [ "336676f4bac745950bd50631af786a2c3f48ad9d" ], "author": { "name": "Rolly Calma", "email": "115199279+Ghraven@users.noreply.github.com", "time": "Sat Sep 12 05:12:23 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 11 21:12:23 2026 +0000" }, "message": "fix: harden token cost refresh script (#918)" }, { "commit": "336676f4bac745950bd50631af786a2c3f48ad9d", "tree": "d677d2cb9dadd5bb8dbb2ba10db71fb3f0032fc6", "parents": [ "69cfe29c9d27f145720656c08287085cfd90384a" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Sep 11 12:57:35 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 11 12:57:35 2026 -0700" }, "message": "ci(deps): bump actions/setup-java from 5 to 6 (#912)\n\nBumps the github-dependencies group with 1 update: [actions/setup-java](https://github.com/actions/setup-java).\n\n\nUpdates `actions/setup-java` from 5 to 6\n- [Release notes](https://github.com/actions/setup-java/releases)\n- [Commits](https://github.com/actions/setup-java/compare/v5...v6)\n\n---\nupdated-dependencies:\n- dependency-name: actions/setup-java\n dependency-version: \u00276\u0027\n dependency-type: direct:production\n update-type: version-update:semver-major\n dependency-group: github-dependencies\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "69cfe29c9d27f145720656c08287085cfd90384a", "tree": "dd107ed200b3b7543528219e126068bd061797ef", "parents": [ "2b6a79f744228949f6c6dcbd2020a7d17ee5cf55" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Sep 11 12:57:32 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 11 12:57:32 2026 -0700" }, "message": "ci(deps): bump postcss-selector-parser from 7.1.1 to 7.1.5 in /website (#914)\n\nBumps [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser) from 7.1.1 to 7.1.5.\n- [Release notes](https://github.com/postcss/postcss-selector-parser/releases)\n- [Changelog](https://github.com/postcss/postcss-selector-parser/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/postcss/postcss-selector-parser/compare/v7.1.1...7.1.5)\n\n---\nupdated-dependencies:\n- dependency-name: postcss-selector-parser\n dependency-version: 7.1.5\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "2b6a79f744228949f6c6dcbd2020a7d17ee5cf55", "tree": "4f0bc10ec9e79672788cde7f8f7a61ee1d6be4f1", "parents": [ "2a6cf139dbce37c9d180d751415ae46f28edca2d" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Sep 11 12:57:28 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 11 12:57:28 2026 -0700" }, "message": "ci(deps): bump fast-uri from 3.1.5 to 3.1.7 in /website (#915)\n\nBumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.5 to 3.1.7.\n- [Release notes](https://github.com/fastify/fast-uri/releases)\n- [Commits](https://github.com/fastify/fast-uri/compare/v3.1.5...v3.1.7)\n\n---\nupdated-dependencies:\n- dependency-name: fast-uri\n dependency-version: 3.1.7\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "2a6cf139dbce37c9d180d751415ae46f28edca2d", "tree": "5a9872b7a4f46ecb7d3de3964ce6fa7dde51bb2e", "parents": [ "d68f533068ba91c8d607ecedf3019d01836a2401" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Sep 11 12:57:24 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 11 12:57:24 2026 -0700" }, "message": "ci(deps): bump qs from 6.15.3 to 6.16.0 in /website (#916)\n\nBumps [qs](https://github.com/ljharb/qs) from 6.15.3 to 6.16.0.\n- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/ljharb/qs/compare/v6.15.3...v6.16.0)\n\n---\nupdated-dependencies:\n- dependency-name: qs\n dependency-version: 6.16.0\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "d68f533068ba91c8d607ecedf3019d01836a2401", "tree": "4f15828064bb56f7ac7368c1ef6ab630bc25b227", "parents": [ "6524938f2d4f6c10a0e67ac6f28234319b8d1d13" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Sep 11 12:57:20 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 11 12:57:20 2026 -0700" }, "message": "ci(deps-dev): bump @humanfs/node from 0.16.7 to 0.16.8 in /website (#917)\n\nBumps [@humanfs/node](https://github.com/humanwhocodes/humanfs/tree/HEAD/packages/node) from 0.16.7 to 0.16.8.\n- [Release notes](https://github.com/humanwhocodes/humanfs/releases)\n- [Changelog](https://github.com/humanwhocodes/humanfs/blob/main/packages/node/CHANGELOG.md)\n- [Commits](https://github.com/humanwhocodes/humanfs/commits/node-v0.16.8/packages/node)\n\n---\nupdated-dependencies:\n- dependency-name: \"@humanfs/node\"\n dependency-version: 0.16.8\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "6524938f2d4f6c10a0e67ac6f28234319b8d1d13", "tree": "296b977681a9b1d26e79e510182c79f381e3ca09", "parents": [ "631fb6c9b1fa9b0b5af5519415cafabb7c8e47ab" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Sep 11 12:57:16 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 11 12:57:16 2026 -0700" }, "message": "ci(deps): bump browserslist from 4.28.1 to 4.28.9 in /website (#919)\n\nBumps [browserslist](https://github.com/browserslist/browserslist) from 4.28.1 to 4.28.9.\n- [Release notes](https://github.com/browserslist/browserslist/releases)\n- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/browserslist/browserslist/compare/4.28.1...4.28.9)\n\n---\nupdated-dependencies:\n- dependency-name: browserslist\n dependency-version: 4.28.9\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "631fb6c9b1fa9b0b5af5519415cafabb7c8e47ab", "tree": "14d421df0c87086c94fea8d92ea3a2a42e892a72", "parents": [ "e9a5f066dbb2388e4a5f5565b3e81ab253b95d72" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Sep 11 12:57:12 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 11 12:57:12 2026 -0700" }, "message": "ci(deps-dev): bump browserslist from 4.28.2 to 4.28.9 in /telemetry/ui (#921)\n\nBumps [browserslist](https://github.com/browserslist/browserslist) from 4.28.2 to 4.28.9.\n- [Release notes](https://github.com/browserslist/browserslist/releases)\n- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/browserslist/browserslist/compare/4.28.2...4.28.9)\n\n---\nupdated-dependencies:\n- dependency-name: browserslist\n dependency-version: 4.28.9\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "e9a5f066dbb2388e4a5f5565b3e81ab253b95d72", "tree": "934ffc1ba432c9a8c78a642689ae94dc78a5b143", "parents": [ "81b13096b37efd2cc8776af23344f7974b2638f2" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Sep 11 12:57:08 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 11 12:57:08 2026 -0700" }, "message": "ci(deps): bump hono from 4.13.0 to 4.13.7 in /website (#923)\n\nBumps [hono](https://github.com/honojs/hono) from 4.13.0 to 4.13.7.\n- [Release notes](https://github.com/honojs/hono/releases)\n- [Commits](https://github.com/honojs/hono/compare/v4.13.0...v4.13.7)\n\n---\nupdated-dependencies:\n- dependency-name: hono\n dependency-version: 4.13.7\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "81b13096b37efd2cc8776af23344f7974b2638f2", "tree": "eebdc089d31023afef2ec20889ed1f3d486faee6", "parents": [ "41e13d7df14963a2c4bbe63aa698847bba262529" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Sep 11 12:57:04 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 11 12:57:04 2026 -0700" }, "message": "ci(deps): bump sharp from 0.34.5 to 0.35.4 in /website (#928)\n\nBumps [sharp](https://github.com/lovell/sharp) from 0.34.5 to 0.35.4.\n- [Release notes](https://github.com/lovell/sharp/releases)\n- [Commits](https://github.com/lovell/sharp/compare/v0.34.5...v0.35.4)\n\n---\nupdated-dependencies:\n- dependency-name: sharp\n dependency-version: 0.35.4\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "41e13d7df14963a2c4bbe63aa698847bba262529", "tree": "7259f7b39248a7387bf2c6fe8276ae5792b851a4", "parents": [ "69ba3bc58a2507e84535d27a008b949656a33302" ], "author": { "name": "Rolly Calma", "email": "115199279+Ghraven@users.noreply.github.com", "time": "Fri Sep 11 06:15:03 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 10 22:15:03 2026 +0000" }, "message": "fix: use utf-8 for redirect pyproject generation (#925)" }, { "commit": "69ba3bc58a2507e84535d27a008b949656a33302", "tree": "f9630eb7359e4b44ae9efcd6632d04c8a0b88b2f", "parents": [ "aaa3c14653b100052217482e0005fae40e683ea9" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sat Aug 29 13:03:35 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Aug 29 13:03:35 2026 -0700" }, "message": "ci(deps): bump sharp and next in /website (#904)\n\nBumps [sharp](https://github.com/lovell/sharp) to 0.35.4 and updates ancestor dependency [next](https://github.com/vercel/next.js). These dependencies need to be updated together.\n\n\nUpdates `sharp` from 0.34.5 to 0.35.4\n- [Release notes](https://github.com/lovell/sharp/releases)\n- [Commits](https://github.com/lovell/sharp/compare/v0.34.5...v0.35.4)\n\nUpdates `next` from 15.5.21 to 15.5.24\n- [Release notes](https://github.com/vercel/next.js/releases)\n- [Commits](https://github.com/vercel/next.js/compare/v15.5.21...v15.5.24)\n\n---\nupdated-dependencies:\n- dependency-name: sharp\n dependency-version: 0.35.4\n dependency-type: indirect\n- dependency-name: next\n dependency-version: 15.5.24\n dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "aaa3c14653b100052217482e0005fae40e683ea9", "tree": "a8b094f022a64f1b7a32dc74cb6d9c4a32f0b3dc", "parents": [ "bec4c366e64367a179d41404330a1468f94d3907" ], "author": { "name": "jf", "email": "50105951+jernejfrank@users.noreply.github.com", "time": "Sat Aug 29 20:58:46 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Aug 29 20:58:46 2026 +0100" }, "message": "Bump to 0.43.0 (#902)\n\n* Bump to 0.43.0\n\nAdd JF and AA as maintainers in pyproject metadata\nto reflect PPMCs\n\n* Add 0.43 to release list on website\n\n* Document the 3.9 failure\n\n---------\n\nCo-authored-by: jernejfrank \u003cjernejfrank@apache.org\u003e" }, { "commit": "bec4c366e64367a179d41404330a1468f94d3907", "tree": "36ca007ec1fd30baa912846c2f91070bb5e762d9", "parents": [ "b75c01d861ecf0e75c2afd9b131c7f036b96c0e0" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sat Aug 29 15:36:16 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Aug 29 15:36:16 2026 +0100" }, "message": "ci(deps): bump the github-dependencies group with 11 updates (#881)\n\nBumps the github-dependencies group with 11 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [actions/github-script](https://github.com/actions/github-script) | `7` | `9` |\n| [actions/labeler](https://github.com/actions/labeler) | `5` | `7` |\n| [actions/checkout](https://github.com/actions/checkout) | `3` | `7` |\n| [actions/setup-node](https://github.com/actions/setup-node) | `4` | `7` |\n| [actions/setup-python](https://github.com/actions/setup-python) | `4` | `7` |\n| [hasura/comment-progress](https://github.com/hasura/comment-progress) | `2.2.0` | `2.3.0` |\n| [peaceiris/actions-gh-pages](https://github.com/peaceiris/actions-gh-pages) | `3` | `4` |\n| [actions/cache](https://github.com/actions/cache) | `3` | `6` |\n| [actions/setup-java](https://github.com/actions/setup-java) | `4` | `5` |\n| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4` | `7` |\n| [actions/download-artifact](https://github.com/actions/download-artifact) | `4` | `8` |\n\n\nUpdates `actions/github-script` from 7 to 9\n- [Release notes](https://github.com/actions/github-script/releases)\n- [Commits](https://github.com/actions/github-script/compare/v7...v9)\n\nUpdates `actions/labeler` from 5 to 7\n- [Release notes](https://github.com/actions/labeler/releases)\n- [Commits](https://github.com/actions/labeler/compare/v5...v7)\n\nUpdates `actions/checkout` from 3 to 7\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/actions/checkout/compare/v3...v7)\n\nUpdates `actions/setup-node` from 4 to 7\n- [Release notes](https://github.com/actions/setup-node/releases)\n- [Commits](https://github.com/actions/setup-node/compare/v4...v7)\n\nUpdates `actions/setup-python` from 4 to 7\n- [Release notes](https://github.com/actions/setup-python/releases)\n- [Commits](https://github.com/actions/setup-python/compare/v4...v7)\n\nUpdates `hasura/comment-progress` from 2.2.0 to 2.3.0\n- [Release notes](https://github.com/hasura/comment-progress/releases)\n- [Commits](https://github.com/hasura/comment-progress/compare/v2.2.0...v2.3.0)\n\nUpdates `peaceiris/actions-gh-pages` from 3 to 4\n- [Release notes](https://github.com/peaceiris/actions-gh-pages/releases)\n- [Changelog](https://github.com/peaceiris/actions-gh-pages/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/peaceiris/actions-gh-pages/compare/v3...v4)\n\nUpdates `actions/cache` from 3 to 6\n- [Release notes](https://github.com/actions/cache/releases)\n- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)\n- [Commits](https://github.com/actions/cache/compare/v3...v6)\n\nUpdates `actions/setup-java` from 4 to 5\n- [Release notes](https://github.com/actions/setup-java/releases)\n- [Commits](https://github.com/actions/setup-java/compare/v4...v5)\n\nUpdates `actions/upload-artifact` from 4 to 7\n- [Release notes](https://github.com/actions/upload-artifact/releases)\n- [Commits](https://github.com/actions/upload-artifact/compare/v4...v7)\n\nUpdates `actions/download-artifact` from 4 to 8\n- [Release notes](https://github.com/actions/download-artifact/releases)\n- [Commits](https://github.com/actions/download-artifact/compare/v4...v8)\n\n---\nupdated-dependencies:\n- dependency-name: actions/github-script\n dependency-version: \u00279\u0027\n dependency-type: direct:production\n update-type: version-update:semver-major\n dependency-group: github-dependencies\n- dependency-name: actions/labeler\n dependency-version: \u00277\u0027\n dependency-type: direct:production\n update-type: version-update:semver-major\n dependency-group: github-dependencies\n- dependency-name: actions/checkout\n dependency-version: \u00277\u0027\n dependency-type: direct:production\n update-type: version-update:semver-major\n dependency-group: github-dependencies\n- dependency-name: actions/setup-node\n dependency-version: \u00277\u0027\n dependency-type: direct:production\n update-type: version-update:semver-major\n dependency-group: github-dependencies\n- dependency-name: actions/setup-python\n dependency-version: \u00277\u0027\n dependency-type: direct:production\n update-type: version-update:semver-major\n dependency-group: github-dependencies\n- dependency-name: hasura/comment-progress\n dependency-version: 2.3.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: github-dependencies\n- dependency-name: peaceiris/actions-gh-pages\n dependency-version: \u00274\u0027\n dependency-type: direct:production\n update-type: version-update:semver-major\n dependency-group: github-dependencies\n- dependency-name: actions/cache\n dependency-version: \u00276\u0027\n dependency-type: direct:production\n update-type: version-update:semver-major\n dependency-group: github-dependencies\n- dependency-name: actions/setup-java\n dependency-version: \u00275\u0027\n dependency-type: direct:production\n update-type: version-update:semver-major\n dependency-group: github-dependencies\n- dependency-name: actions/upload-artifact\n dependency-version: \u00277\u0027\n dependency-type: direct:production\n update-type: version-update:semver-major\n dependency-group: github-dependencies\n- dependency-name: actions/download-artifact\n dependency-version: \u00278\u0027\n dependency-type: direct:production\n update-type: version-update:semver-major\n dependency-group: github-dependencies\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "b75c01d861ecf0e75c2afd9b131c7f036b96c0e0", "tree": "a00d53249827dab9626a8bf0d389b102c5068e7e", "parents": [ "49e7770d0169bf3512636a25688b34fdacd0f577" ], "author": { "name": "Excelius", "email": "57819425+Excelius-Wang@users.noreply.github.com", "time": "Sat Aug 29 22:32:17 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Aug 29 15:32:17 2026 +0100" }, "message": "docs: fix the Graph API example on the applications page (#894)\n\nThe snippet was missing a dot on .with_state, so it raised a SyntaxError\nwhen copied, and it imported default/expr while leaving GraphBuilder\nundefined.\n\nCo-authored-by: zhao.wang \u003czhao.wang@bytedance.com\u003e\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e" }, { "commit": "49e7770d0169bf3512636a25688b34fdacd0f577", "tree": "fc3ac94f6254819cf9ea068fa826a493ba6d85ab", "parents": [ "cdac52e2785024151f183537c74d37f8bd3a5fc3" ], "author": { "name": "Eilen Shin", "email": "136898293+Eilen6316@users.noreply.github.com", "time": "Sat Aug 29 22:30:11 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Aug 29 15:30:11 2026 +0100" }, "message": "Fix async step persistence for synchronous actions (#895)\n\n* Fix async step persistence for synchronous actions\n\n* Test persisted state for synchronous single-step actions\n\n* Clarify async hooks for synchronous steps" }, { "commit": "cdac52e2785024151f183537c74d37f8bd3a5fc3", "tree": "8e456199385fadb7e3a0f33b88ce0873d569332b", "parents": [ "7a7190c24a710247521b7a8c68d89d69f365046a" ], "author": { "name": "Excelius", "email": "57819425+Excelius-Wang@users.noreply.github.com", "time": "Sat Aug 29 17:42:17 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Aug 29 10:42:17 2026 +0100" }, "message": "Document how to hand off control to a human (#893)\n\n* docs: explain how to hand off control to a human\n\nThe mechanics for pausing an agent to collect human input were only\ndiscoverable by reading the email-assistant example, so add a concepts\npage that spells out the halt_before + inputs loop and links the existing\nexamples that already use it.\n\nCloses #56\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n\n* docs: fix Sphinx warnings on the human-in-the-loop page\n\nTwo section rules were shorter than their titles, and the shorthand\n:ref: links to applications / state-persistence had no caption because\nthose labels sit after the headings.\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n\n---------\n\nCo-authored-by: zhao.wang \u003czhao.wang@bytedance.com\u003e\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e" }, { "commit": "7a7190c24a710247521b7a8c68d89d69f365046a", "tree": "f765d2e45105ba0e51908382dded8ebfec11106e", "parents": [ "f7989f05195b8d66a999af7871f7fab8d870728c" ], "author": { "name": "jf", "email": "50105951+jernejfrank@users.noreply.github.com", "time": "Sat Aug 29 10:10:54 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Aug 29 10:10:54 2026 +0100" }, "message": "Create sdist license (#899)\n\nThe root level license involves packages excluded in sdist;\nthis adjust the release helper to create a temp dir and\ncopying over the necessary artifacts for creating the sdist.\n\nFlint only copies LICENSE so the rename happens during copy.\n\nCo-authored-by: jernejfrank \u003cjernejfrank@apache.org\u003e" }, { "commit": "f7989f05195b8d66a999af7871f7fab8d870728c", "tree": "4b953425cbd8661427c9f65251203235daf48a19", "parents": [ "cae4fcbfb116f34450e4ed2e47425afd0e132464" ], "author": { "name": "John Bampton", "email": "jbampton@users.noreply.github.com", "time": "Thu Aug 13 18:22:43 2026 +1000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 13 09:22:43 2026 +0100" }, "message": "Add dependabot config for `github-actions` ecosystem (#624)\n\n* Add dependabot config for `github-actions` ecosystem\n\nBasic setup added to automate updates\n\n* Auto-assign apache/burr-committers as reviewers on dependabot PRs\n\nWithout a reviewers entry, dependabot PRs land unowned and rely on\nsomeone happening to spot them in the PR list. Routing review to the\nburr-committers team makes it visible to everyone with merge rights.\n\n* Tag dependabot PRs with labels and a ci scope prefix\n\n- labels: dependencies (matches the convention already used by\n GitHub-generated security PRs) and area/ci (matches the auto-labeler\n rule for .github/** in .github/labeler.yml).\n- commit-message: prefix \"ci\" with scope, so commit titles become e.g.\n \"ci(deps): bump actions/checkout from v3 to v4\", matching the\n conventional-commit style used in recent commits on main.\n\n---------\n\nCo-authored-by: André Ahlert \u003candre@aex.partners\u003e" }, { "commit": "cae4fcbfb116f34450e4ed2e47425afd0e132464", "tree": "6f8f924b0a4fca0a039d63690132167c9949f445", "parents": [ "e5e01c5f3a08d76f660c725ee27d228b97473447" ], "author": { "name": "André Ahlert", "email": "andre@aex.partners", "time": "Thu Aug 13 05:14:23 2026 -0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 13 09:14:23 2026 +0100" }, "message": "fix(packaging): repair developer extra reference and dedupe tests extra (#792)\n\nThe \u0027developer\u0027 optional-dependency referenced apache-burr[bloat], but the\n\u0027bloat\u0027 extra was renamed to \u0027examples\u0027 in cd801c88 and the reference was\nnever updated, so \u0027pip install apache-burr[developer]\u0027 failed to resolve.\n\nAlso drop a duplicate apache-burr[hamilton] entry in the \u0027tests\u0027 extra.\n\nSigned-off-by: André Ahlert \u003candre@aex.partners\u003e" }, { "commit": "e5e01c5f3a08d76f660c725ee27d228b97473447", "tree": "6f8f924b0a4fca0a039d63690132167c9949f445", "parents": [ "6d8cda1ecd71d4e9e48ee74deb8c8d1a89349036" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Aug 13 09:12:39 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 13 09:12:39 2026 +0100" }, "message": "chore(deps): bump js-yaml from 4.1.1 to 4.3.1 in /website (#878)\n\nBumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.1.1 to 4.3.1.\n- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md)\n- [Commits](https://github.com/nodeca/js-yaml/compare/4.1.1...4.3.1)\n\n---\nupdated-dependencies:\n- dependency-name: js-yaml\n dependency-version: 4.3.1\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "6d8cda1ecd71d4e9e48ee74deb8c8d1a89349036", "tree": "5784d154277ca6f4f9e9b4044308e168f7a5d485", "parents": [ "5759ac52af314009340d5b3c20d51ad513eb3c5d" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Aug 13 09:12:10 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 13 09:12:10 2026 +0100" }, "message": "chore(deps): bump nanoid from 3.3.11 to 3.3.18 in /website (#877)\n\nBumps [nanoid](https://github.com/ai/nanoid) from 3.3.11 to 3.3.18.\n- [Release notes](https://github.com/ai/nanoid/releases)\n- [Changelog](https://github.com/ai/nanoid/blob/3.3.18/CHANGELOG.md)\n- [Commits](https://github.com/ai/nanoid/compare/3.3.11...3.3.18)\n\n---\nupdated-dependencies:\n- dependency-name: nanoid\n dependency-version: 3.3.18\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "5759ac52af314009340d5b3c20d51ad513eb3c5d", "tree": "3727fb9e41115a55a23b310e256185271a8ea2cf", "parents": [ "a05875f09687b958bd83a5767be25d37821bee83" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Aug 13 09:05:41 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 13 09:05:41 2026 +0100" }, "message": "chore(deps): bump @hono/node-server from 1.19.14 to 1.19.17 in /website (#880)\n\nBumps [@hono/node-server](https://github.com/honojs/node-server) from 1.19.14 to 1.19.17.\n- [Release notes](https://github.com/honojs/node-server/releases)\n- [Commits](https://github.com/honojs/node-server/compare/v1.19.14...v1.19.17)\n\n---\nupdated-dependencies:\n- dependency-name: \"@hono/node-server\"\n dependency-version: 1.19.17\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "a05875f09687b958bd83a5767be25d37821bee83", "tree": "725d1edaa745b6c0ceb397bfc32d6b7b6d2d1817", "parents": [ "ecb6f0accd16f9ed6d561bb1cdddc750eea442cd" ], "author": { "name": "Rolly Calma", "email": "115199279+Ghraven@users.noreply.github.com", "time": "Thu Aug 06 03:53:50 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Aug 05 21:53:50 2026 +0200" }, "message": "Use UTF-8 for test case JSON files (#860)" }, { "commit": "ecb6f0accd16f9ed6d561bb1cdddc750eea442cd", "tree": "8d9ce67d44729221bb73b2ae3778c4e7474eff4f", "parents": [ "977f13a904522cc67b2b054288c2e7e51f25cf25" ], "author": { "name": "Rolly Calma", "email": "115199279+Ghraven@users.noreply.github.com", "time": "Thu Aug 06 03:48:15 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Aug 05 21:48:15 2026 +0200" }, "message": "fix(testing): read test case json as utf-8 (#872)" }, { "commit": "977f13a904522cc67b2b054288c2e7e51f25cf25", "tree": "558ed90fda451402f22cfcd9cdfec606cfd70920", "parents": [ "76d908100fca82b0a599395d55286b5405aafe71" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Aug 05 21:46:04 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Aug 05 21:46:04 2026 +0200" }, "message": "chore(deps): bump brace-expansion, eslint and eslint-config-next (#866)\n\nBumps [brace-expansion](https://github.com/juliangruber/brace-expansion) to 5.0.9 and updates ancestor dependencies [brace-expansion](https://github.com/juliangruber/brace-expansion), [eslint](https://github.com/eslint/eslint) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). These dependencies need to be updated together.\n\n\nUpdates `brace-expansion` from 5.0.5 to 5.0.9\n- [Release notes](https://github.com/juliangruber/brace-expansion/releases)\n- [Commits](https://github.com/juliangruber/brace-expansion/compare/v5.0.5...v5.0.9)\n\nUpdates `eslint` from 9.39.4 to 10.8.0\n- [Release notes](https://github.com/eslint/eslint/releases)\n- [Commits](https://github.com/eslint/eslint/compare/v9.39.4...v10.8.0)\n\nUpdates `eslint-config-next` from 15.5.18 to 16.2.12\n- [Release notes](https://github.com/vercel/next.js/releases)\n- [Commits](https://github.com/vercel/next.js/commits/v16.2.12/packages/eslint-config-next)\n\n---\nupdated-dependencies:\n- dependency-name: brace-expansion\n dependency-version: 5.0.9\n dependency-type: indirect\n- dependency-name: eslint\n dependency-version: 10.8.0\n dependency-type: direct:development\n- dependency-name: eslint-config-next\n dependency-version: 16.2.12\n dependency-type: direct:development\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "76d908100fca82b0a599395d55286b5405aafe71", "tree": "bfe19673de5c0ec0e78a0dc6e0b477e0fe091889", "parents": [ "8772b11fabb37d91394c594f8b86307462d7b177" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Thu Aug 06 03:44:57 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Aug 05 21:44:57 2026 +0200" }, "message": "Fix the shipped npm advisories, and actually run the UI test suite (#869)\n\n* Apply npm audit fix to the UI dependencies\n\nA fresh `npm ci` from the shipped lockfile reported 16 advisories, 7 of\nthem (1 moderate, 6 high) outside devDependencies. Checking each against\nthe build sourcemap, two reached users in the compiled bundle:\n\n - mdast-util-to-hast 13.1.0, moderate, unsanitized class attribute.\n 28 modules in the bundle, reached via react-markdown, which renders\n trace and chat content. Fixed by 13.2.1.\n - react-router 7.18.1, high, RSC mode CSRF bypass.\n\n`npm audit fix` (no --force) takes care of everything semver-compatible,\nincluding mdast-util-to-hast and postcss; the rest were build-time only\nand never shipped. That drops the count from 16 to 2.\n\nThe remaining 2 are react-router / react-router-dom, still inside the\nadvisory range at 7.18.2. The only fix is react-router 8.3.0, a major\nbump. The advisory covers RSC mode, and the tracking UI is a static\nclient-side SPA with no RSC and no server actions, so it is not reachable\nhere -- the upgrade is worth doing on its own merits, not as a security\nfix bundled into a release repair.\n\nLICENSE-wheel is regenerated for the two bundled version changes. The\n--check gate added alongside it caught this drift, which is what it is\nfor.\n\nGenerated-by: Claude Opus 5 (1M context)\n\n* Treat localStorage as best-effort in useTheme\n\nuseTheme read and wrote window.localStorage directly, guarded only by a\n`typeof window \u003d\u003d\u003d \u0027undefined\u0027` check. That assumption does not hold:\na sandboxed iframe raises SecurityError on access, browsers with storage\ndisabled omit it entirely, and Node\u0027s own experimental localStorage\nglobal shadows jsdom\u0027s under vitest, leaving window.localStorage\nundefined. In every one of those cases the hook threw during the initial\nuseState, which takes down the whole App render -- not just the theme.\n\nRoute both reads and writes through a helper that returns null when\nstorage is unreachable and swallows access errors. The theme then falls\nback to the system preference and simply is not persisted.\n\nThis also makes the existing App.test.tsx pass again on Node 26.\n\nGenerated-by: Claude Opus 5 (1M context)\n\n* Run the UI test suite in CI\n\nThe Node CI workflow built, linted and formatted the UI but never ran\nvitest, so App.test.tsx -- the only UI test -- was not executed anywhere.\nIt had been failing on newer Node with no signal.\n\n`npm test` starts vitest in watch mode and would hang the job, so invoke\n`npx vitest run` explicitly.\n\nGenerated-by: Claude Opus 5 (1M context)" }, { "commit": "8772b11fabb37d91394c594f8b86307462d7b177", "tree": "e0f205a20dce5616768cfc2b5feb804c704ecbd1", "parents": [ "f7317404ec4f2718ba4d6cc21643584944dad9fd" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Aug 05 21:33:59 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Aug 05 21:33:59 2026 +0200" }, "message": "chore(deps): bump ip-address from 10.2.0 to 10.4.0 in /website (#870)\n\nBumps [ip-address](https://github.com/beaugunderson/ip-address) from 10.2.0 to 10.4.0.\n- [Release notes](https://github.com/beaugunderson/ip-address/releases)\n- [Commits](https://github.com/beaugunderson/ip-address/compare/v10.2.0...v10.4.0)\n\n---\nupdated-dependencies:\n- dependency-name: ip-address\n dependency-version: 10.4.0\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "f7317404ec4f2718ba4d6cc21643584944dad9fd", "tree": "8b46bbccd77143bb7c475e68e28e2b9531339d13", "parents": [ "7703e07e57899651291d3e939d333c23a3fdbd18" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Aug 05 21:33:34 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Aug 05 21:33:34 2026 +0200" }, "message": "chore(deps): bump hono from 4.12.32 to 4.13.0 in /website (#871)\n\nBumps [hono](https://github.com/honojs/hono) from 4.12.32 to 4.13.0.\n- [Release notes](https://github.com/honojs/hono/releases)\n- [Commits](https://github.com/honojs/hono/compare/v4.12.32...v4.13.0)\n\n---\nupdated-dependencies:\n- dependency-name: hono\n dependency-version: 4.13.0\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "7703e07e57899651291d3e939d333c23a3fdbd18", "tree": "c5215a850b205936b82effea70bc479b9ced760d", "parents": [ "e3ca78d5d088bc607d79da13c20a3a5b5186c041" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Aug 05 21:32:07 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Aug 05 21:32:07 2026 +0200" }, "message": "chore(deps): bump fast-uri from 3.1.4 to 3.1.5 in /website (#873)\n\nBumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.4 to 3.1.5.\n- [Release notes](https://github.com/fastify/fast-uri/releases)\n- [Commits](https://github.com/fastify/fast-uri/compare/v3.1.4...v3.1.5)\n\n---\nupdated-dependencies:\n- dependency-name: fast-uri\n dependency-version: 3.1.5\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "e3ca78d5d088bc607d79da13c20a3a5b5186c041", "tree": "243e99219ca5baaedbf4b6d2a2abacaf13d31654", "parents": [ "8a91bcc23b0e91bd2084dbeea36b67ad9726f041" ], "author": { "name": "jf", "email": "50105951+jernejfrank@users.noreply.github.com", "time": "Wed Aug 05 21:31:31 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Aug 05 21:31:31 2026 +0200" }, "message": "Remove bentoburr (#859)" }, { "commit": "8a91bcc23b0e91bd2084dbeea36b67ad9726f041", "tree": "e4e5bc88b0989c9825e7d2343a13be0e7c0e14d5", "parents": [ "b23fa3e98276f1dda2b7b007501e2735be0cc063" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Mon Aug 03 06:28:08 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 03 14:28:08 2026 +1000" }, "message": "Make LICENSE-wheel reflect the bundled UI dependencies, plus two 0.43.0 RC0 fixes (#868)\n\n* Generate the wheel\u0027s third-party license section from the UI build\n\nThe wheel\u0027s only non-source content is the compiled tracking UI at\nburr/tracking/server/build/assets/index-*.js, which bundles code from\n130 npm packages under MIT, ISC, Apache-2.0, BSD-3-Clause and PSF.\nLICENSE-wheel listed exactly one third-party work, so the binary\ndistribution\u0027s LICENSE did not reflect its contents.\n\nRather than maintain that list by hand, derive it from the build:\nscripts/generate_wheel_license.py runs a sourcemap build, reads the\nsources array to find every node_modules file compiled into the bundle,\nresolves each to its owning package, and rewrites everything below the\ngenerated marker in LICENSE-wheel. --check fails when the file is stale,\nso CI can catch drift on dependency bumps.\n\nNone of the bundled packages ships a NOTICE file, so NOTICE is unchanged.\n\nGenerated-by: Claude Opus 5 (1M context)\n\n* Skip the Bedrock tests instead of aborting collection without boto3\n\ntest_bip0042_bedrock.py imported botocore at module level, above the\npytest.importorskip(\"boto3\") guard, which made the guard dead code:\nbotocore ships with boto3, so without the [bedrock] extra the import\nraised and pytest reported a collection error rather than a skip. Since\na collection error interrupts the whole run, `pytest tests/` -- the\ncommand scripts/README.md gives release voters -- executed no tests at\nall on a plain `pip install -e \".[tests]\"`.\n\nCI did not catch this because the main test job passes\n--ignore\u003dtests/integrations/test_bip0042_bedrock.py.\n\nMove the botocore import below the guard. Without boto3 the module now\nskips and the rest of the suite runs; with it, the tests are unchanged.\n\nGenerated-by: Claude Opus 5 (1M context)\n\n* Use importlib.metadata for /api/v0/version instead of pkg_resources\n\nThe version endpoint imported pkg_resources, which is a setuptools\nmodule. setuptools is not a declared dependency of apache-burr, is not\npresent in a venv created by modern tooling, and dropped pkg_resources\nentirely in 81.0. On a clean install of the 0.43.0 wheel the endpoint\ntherefore raised ModuleNotFoundError and returned 500.\n\nimportlib.metadata is in the standard library on every Python we\nsupport. Behaviour is otherwise unchanged, including the fallback to\nthe legacy \"burr\" distribution and then to \"unknown\".\n\nGenerated-by: Claude Opus 5 (1M context)\n\n* Fail release validation when LICENSE-wheel drifts from the UI bundle\n\nRAT excludes burr/tracking/server/build/**, so the existing license step\nnever inspects the compiled UI -- the only content the wheel adds over\nthe sdist. That is exactly where the LICENSE gap went unnoticed, and it\nis what silently drifts whenever a UI dependency is added or bumped.\n\nAdd a release-validation step that re-derives the bundled npm packages\nfrom a sourcemap build and fails if LICENSE-wheel no longer matches. It\nruns after the artifact build, which has already installed\ntelemetry/ui/node_modules.\n\nGenerated-by: Claude Opus 5 (1M context)" }, { "commit": "b23fa3e98276f1dda2b7b007501e2735be0cc063", "tree": "e6cc02c14c76f471cb672f6faee46c51af85c773", "parents": [ "5e19324927b1f7844cd40ec56f9fe13d7db531f6" ], "author": { "name": "jf", "email": "50105951+jernejfrank@users.noreply.github.com", "time": "Sun Jul 26 21:26:47 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jul 26 21:26:47 2026 +0100" }, "message": "Minor fixes for the release (#858)\n\n* Populate dependecies in redirect from main pyproject.toml\n\n* Fix ASF header linter to derive root relative to script rather than file\n\n* Fix licence for the file renaming\n\n* Conform sdist to release readme rules and exclude website" }, { "commit": "5e19324927b1f7844cd40ec56f9fe13d7db531f6", "tree": "15562b370ae2df7ed8cea27b28f952400016bd2c", "parents": [ "71d4fd3e0c0afbc5162ad59dd94f14de0f7a19ee" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sun Jul 26 17:34:41 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jul 26 17:34:41 2026 +0100" }, "message": "chore(deps): bump qs from 6.15.0 to 6.15.3 in /website (#787)\n\nBumps [qs](https://github.com/ljharb/qs) from 6.15.0 to 6.15.3.\n- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/ljharb/qs/compare/v6.15.0...v6.15.3)\n\n---\nupdated-dependencies:\n- dependency-name: qs\n dependency-version: 6.15.2\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "71d4fd3e0c0afbc5162ad59dd94f14de0f7a19ee", "tree": "af0993785106ae0f5bce7e21ca56966b134cc7d2", "parents": [ "764e1fac51a721dfbf806513b3366500bbb83449" ], "author": { "name": "Rolly Calma", "email": "115199279+Ghraven@users.noreply.github.com", "time": "Mon Jul 27 00:30:49 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jul 26 17:30:49 2026 +0100" }, "message": "Use UTF-8 for adaptive CRAG docs (#852)" }, { "commit": "764e1fac51a721dfbf806513b3366500bbb83449", "tree": "53a91169cbfdb82587fd98c87dc4f0ef10f7466e", "parents": [ "0476e7276bb7658985ab00010d7433d5b29f3b20" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sun Jul 26 16:18:28 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jul 26 16:18:28 2026 +0000" }, "message": "chore(deps): bump prismjs and react-syntax-highlighter in /telemetry/ui (#857)\n\nBumps [prismjs](https://github.com/PrismJS/prism) to 1.30.0 and updates ancestor dependency [react-syntax-highlighter](https://github.com/react-syntax-highlighter/react-syntax-highlighter). These dependencies need to be updated together.\n\n\nUpdates `prismjs` from 1.29.0 to 1.30.0\n- [Release notes](https://github.com/PrismJS/prism/releases)\n- [Changelog](https://github.com/PrismJS/prism/blob/v2/CHANGELOG.md)\n- [Commits](https://github.com/PrismJS/prism/compare/v1.29.0...v1.30.0)\n\nUpdates `react-syntax-highlighter` from 15.5.0 to 16.1.1\n- [Release notes](https://github.com/react-syntax-highlighter/react-syntax-highlighter/releases)\n- [Changelog](https://github.com/react-syntax-highlighter/react-syntax-highlighter/blob/master/CHANGELOG.MD)\n- [Commits](https://github.com/react-syntax-highlighter/react-syntax-highlighter/compare/15.5.0...v16.1.1)\n\n---\nupdated-dependencies:\n- dependency-name: prismjs\n dependency-version: 1.30.0\n dependency-type: indirect\n- dependency-name: react-syntax-highlighter\n dependency-version: 16.1.1\n dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "0476e7276bb7658985ab00010d7433d5b29f3b20", "tree": "0dab8114b85abc6bc93eb8c6705059eedeec10d4", "parents": [ "83ce6c623a09100b9214cec67a39a7bd28c9395d" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sun Jul 26 17:15:21 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jul 26 17:15:21 2026 +0100" }, "message": "chore(deps): bump lilconfig and tailwindcss in /telemetry/ui (#855)\n\nBumps [lilconfig](https://github.com/antonk52/lilconfig) to 3.1.3 and updates ancestor dependency [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss). These dependencies need to be updated together.\n\n\nUpdates `lilconfig` from 3.1.0 to 3.1.3\n- [Release notes](https://github.com/antonk52/lilconfig/releases)\n- [Commits](https://github.com/antonk52/lilconfig/compare/v3.1.0...v3.1.3)\n\nUpdates `tailwindcss` from 3.4.1 to 3.4.19\n- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)\n- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v3.4.19/packages/tailwindcss)\n\n---\nupdated-dependencies:\n- dependency-name: lilconfig\n dependency-version: 3.1.3\n dependency-type: indirect\n- dependency-name: tailwindcss\n dependency-version: 3.4.19\n dependency-type: direct:development\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "83ce6c623a09100b9214cec67a39a7bd28c9395d", "tree": "d17677c58b392d30a87df3d79c5f77487d908e0e", "parents": [ "7bde981fc9d47cc87a2880b14aa09b5e95262dea" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sun Jul 26 17:14:47 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jul 26 17:14:47 2026 +0100" }, "message": "chore(deps): bump cross-spawn from 7.0.3 to 7.0.6 in /telemetry/ui (#856)\n\nBumps [cross-spawn](https://github.com/moxystudio/node-cross-spawn) from 7.0.3 to 7.0.6.\n- [Changelog](https://github.com/moxystudio/node-cross-spawn/blob/master/CHANGELOG.md)\n- [Commits](https://github.com/moxystudio/node-cross-spawn/compare/v7.0.3...v7.0.6)\n\n---\nupdated-dependencies:\n- dependency-name: cross-spawn\n dependency-version: 7.0.6\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "7bde981fc9d47cc87a2880b14aa09b5e95262dea", "tree": "703144114f60b059ab043310d1301313720c840f", "parents": [ "6e70a80a3af532dbd7efb911f9ae7e164d82b155" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sun Jul 26 16:12:39 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jul 26 16:12:39 2026 +0000" }, "message": "chore(deps): bump @babel/runtime from 7.23.9 to 7.29.7 in /telemetry/ui (#854)\n\nBumps [@babel/runtime](https://github.com/babel/babel/tree/HEAD/packages/babel-runtime) from 7.23.9 to 7.29.7.\n- [Release notes](https://github.com/babel/babel/releases)\n- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-runtime)\n\n---\nupdated-dependencies:\n- dependency-name: \"@babel/runtime\"\n dependency-version: 7.29.7\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "6e70a80a3af532dbd7efb911f9ae7e164d82b155", "tree": "f53a1718f965fddfcfe8b7578880366f1773019f", "parents": [ "d4d60f6f40c08f0102be1457ca91227ee80bb7eb" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sun Jul 26 17:10:07 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jul 26 17:10:07 2026 +0100" }, "message": "chore(deps): bump lodash from 4.17.21 to 4.18.1 in /telemetry/ui (#851)\n\nBumps [lodash](https://github.com/lodash/lodash) from 4.17.21 to 4.18.1.\n- [Release notes](https://github.com/lodash/lodash/releases)\n- [Commits](https://github.com/lodash/lodash/compare/4.17.21...4.18.1)\n\n---\nupdated-dependencies:\n- dependency-name: lodash\n dependency-version: 4.18.1\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "d4d60f6f40c08f0102be1457ca91227ee80bb7eb", "tree": "503ef3209b9d5391648ca7eefd02b39bed2142cb", "parents": [ "268bb34ae88fbc8f4130e984d99f05cb0c227c3b" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sun Jul 26 17:09:49 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jul 26 17:09:49 2026 +0100" }, "message": "chore(deps): bump react-router and react-router-dom in /telemetry/ui (#850)\n\nBumps [react-router](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router) to 7.18.1 and updates ancestor dependency [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom). These dependencies need to be updated together.\n\n\nUpdates `react-router` from 6.22.1 to 7.18.1\n- [Release notes](https://github.com/remix-run/react-router/releases)\n- [Changelog](https://github.com/remix-run/react-router/blob/react-router@7.18.1/packages/react-router/CHANGELOG.md)\n- [Commits](https://github.com/remix-run/react-router/commits/react-router@7.18.1/packages/react-router)\n\nUpdates `react-router-dom` from 6.22.1 to 7.18.1\n- [Release notes](https://github.com/remix-run/react-router/releases)\n- [Changelog](https://github.com/remix-run/react-router/blob/react-router-dom@7.18.1/packages/react-router-dom/CHANGELOG.md)\n- [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.18.1/packages/react-router-dom)\n\n---\nupdated-dependencies:\n- dependency-name: react-router\n dependency-version: 7.18.1\n dependency-type: indirect\n- dependency-name: react-router-dom\n dependency-version: 7.18.1\n dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "268bb34ae88fbc8f4130e984d99f05cb0c227c3b", "tree": "626053975c57ca9afbb3cd2be8616e9b0b6f04e1", "parents": [ "946d4c5881e16386dc24c88ff77336dce374a1ae" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sun Jul 26 17:09:30 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jul 26 17:09:30 2026 +0100" }, "message": "chore(deps): bump hono from 4.12.18 to 4.12.32 in /website (#849)\n\nBumps [hono](https://github.com/honojs/hono) from 4.12.18 to 4.12.32.\n- [Release notes](https://github.com/honojs/hono/releases)\n- [Commits](https://github.com/honojs/hono/compare/v4.12.18...v4.12.32)\n\n---\nupdated-dependencies:\n- dependency-name: hono\n dependency-version: 4.12.32\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "946d4c5881e16386dc24c88ff77336dce374a1ae", "tree": "b28fffaf4a27cec11f77fef6e5695502665d24f1", "parents": [ "ff4a4070be3a7eab30e67673cbdd6074b72cde83" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sun Jul 26 17:09:12 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jul 26 17:09:12 2026 +0100" }, "message": "chore(deps-dev): bump vitest from 3.2.4 to 3.2.6 in /telemetry/ui (#848)\n\nBumps [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) from 3.2.4 to 3.2.6.\n- [Release notes](https://github.com/vitest-dev/vitest/releases)\n- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)\n- [Commits](https://github.com/vitest-dev/vitest/commits/v3.2.6/packages/vitest)\n\n---\nupdated-dependencies:\n- dependency-name: vitest\n dependency-version: 3.2.6\n dependency-type: direct:development\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "ff4a4070be3a7eab30e67673cbdd6074b72cde83", "tree": "8e13f4daf1d28cc5f31745881c019c4aa7b79b8e", "parents": [ "80f75b8ba714737f0bc89c7be799e85abf14883a" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sun Jul 26 17:08:50 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jul 26 17:08:50 2026 +0100" }, "message": "chore(deps): bump next from 15.5.18 to 15.5.21 in /website (#847)\n\nBumps [next](https://github.com/vercel/next.js) from 15.5.18 to 15.5.21.\n- [Release notes](https://github.com/vercel/next.js/releases)\n- [Commits](https://github.com/vercel/next.js/compare/v15.5.18...v15.5.21)\n\n---\nupdated-dependencies:\n- dependency-name: next\n dependency-version: 15.5.21\n dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "80f75b8ba714737f0bc89c7be799e85abf14883a", "tree": "472868031f15581cd146788b36316d84165e8b6a", "parents": [ "805131a742b6ac5742e494fe45c74400c60455d5" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sun Jul 26 17:08:03 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jul 26 17:08:03 2026 +0100" }, "message": "chore(deps): bump fast-uri from 3.1.2 to 3.1.4 in /website (#846)\n\nBumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.2 to 3.1.4.\n- [Release notes](https://github.com/fastify/fast-uri/releases)\n- [Commits](https://github.com/fastify/fast-uri/compare/v3.1.2...v3.1.4)\n\n---\nupdated-dependencies:\n- dependency-name: fast-uri\n dependency-version: 3.1.4\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "805131a742b6ac5742e494fe45c74400c60455d5", "tree": "eaa12a334454a6eb4b7eb32fb65822dfa3321a7c", "parents": [ "f9b9fd6204fd616ef815df95523ae1cc453861a0" ], "author": { "name": "Han Nguyen", "email": "45792660+hannguyen0712@users.noreply.github.com", "time": "Fri Jul 24 02:59:12 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 24 10:59:12 2026 +0100" }, "message": "feat: add Langfuse tracing integration (LangfuseBridge) (#844)\n\n* feat: add Langfuse integration (LangfuseBridge) (#206)\n\nImplements all features scoped in #206 via lifecycle hooks, built on\nOpenTelemetryBridge and the OTel-native Langfuse SDK:\n\n- One trace per application execution call (via the #203 interface)\n- One span per step; one span per __tracer span call\n- State observations: action inputs/read state and results/written state\n as observation input/output (capture_state\u003dFalse to disable);\n log_attributes as observation metadata\n- Access to the Langfuse client via bridge.langfuse_client\n- app_id/partition_key map to Langfuse session/user (overridable)\n- Injects a should_export_span filter so Burr spans survive langfuse\n v4\u0027s default LLM-only export filtering (public: burr_span_export_filter)\n\nUses the OTel bridge instead of the tracking/client.py pattern per the\nissue thread (May 31): the SDK\u0027s OTel rewrite and the closure of #205\nmade this the cleaner path, and it nests third-party OTel LLM\ninstrumentation inside step spans automatically.\n\nIncludes tests, docs, a runnable example, and a langfuse pyproject extra.\n\n* fix: JSON-serialize complex logged attributes for Langfuse metadata\n\nOTel attributes reject sequences of non-primitives, so list-of-dict values\n(e.g. chat_history logged by @trace) were dropped with a warning. Complex\nvalues are now JSON-serialized into observation metadata.\n\n* fix(langfuse): preserve OTel provider context\n\nRoute Burr spans through custom tracer providers and propagate session and user attributes to child instrumentation. Serialize mixed-type sequences before passing them to OpenTelemetry.\n\n* fix: import propagate_attributes defensively for langfuse\u003c3.9\n\nPropagate_attributes was added in langfuse 3.9.0 and Python 3.9 CI resolves an older 3.x (v4 requires py3.10+), so the unconditional import failed and was masked as \u0027plugin missing\u0027. Falls back to per-span session/user attributes on older SDKs, with a regression test.\n\n* fix(langfuse): support v3 attribute API\n\nLangfuse 3.7 is the latest SDK available on Python 3.9 and does not export propagate_attributes. Fall back to per-span legacy attributes.\n\n---------\n\nCo-authored-by: jernejfrank \u003cjernej@safeintelligence.ai\u003e" }, { "commit": "f9b9fd6204fd616ef815df95523ae1cc453861a0", "tree": "e3130693db6aa4b98ff556af167f7d33f6f11bf8", "parents": [ "7f7fe34ab2d230667269b7fd9ee6ac2677faa4a6" ], "author": { "name": "Rolly Calma", "email": "115199279+Ghraven@users.noreply.github.com", "time": "Thu Jul 23 23:05:24 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jul 23 15:05:24 2026 +0000" }, "message": "fix: use utf-8 in CI smoke server script (#843)" }, { "commit": "7f7fe34ab2d230667269b7fd9ee6ac2677faa4a6", "tree": "9c98526fb85ad071133404b52a6bf7f311cd8617", "parents": [ "d887c2fe6d4be6ec5693bf5b784995f829df0a31" ], "author": { "name": "Hemanth Savasere", "email": "hemanth.savasere@gmail.com", "time": "Thu Jul 23 20:07:50 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jul 23 07:37:50 2026 -0700" }, "message": "Feature : Migrate telemetry UI from Create React App to Vite (#793)\n\n* feat(ui): add Vite configuration\n\n* feat(ui): add Vitest configuration\n\n* feat(ui): add tsconfig.node.json for Vite config\n\n* feat(ui): update tsconfig.json for Vite compatibility\n\n* feat(ui): add root index.html for Vite\n\n* feat(ui): replace react-app-env.d.ts with vite-env.d.ts\n\n* feat(ui): replace Jest setupTests.ts with Vitest setup\n\n* fix(ui): replace broken CRA smoke test with render-without-crashing test\n\n* feat(ui): remove CRA reportWebVitals and its usage\n\n* feat(ui): remove CRA public/index.html template (replaced by root index.html)\n\n* feat(ui): swap CRA deps for Vite/Vitest, update scripts\n\n* feat(ui): regenerate package-lock.json with Vite deps\n\n* feat(server): update asset mount from /static to /assets for Vite\n\n* ci: update Node.js version from 16.x to 18.x for Vite\n\n* docs(ui): replace CRA README with Vite content\n\n* docs: update proxy configuration reference from package.json to vite.config.ts\n\n* docs: fix UI directory path from burr/ui to telemetry/ui\n\n* fix(ui): correct .eslintrc.js typo in .prettierignore\n\n* fix(ui): add postcss.config.js and autoprefixer for Tailwind CSS v3 with Vite\n\n* fix(ui): add build config files to .eslintignore and apply prettier formatting\n\n- Add postcss.config.js, vite.config.ts, vitest.config.ts to .eslintignore\n (these use Node.js globals but ESLint env only has browser:true)\n- Apply prettier formatting fixes from npm run format:fix\n- Ensures CI workflow (ui.yml) passes cleanly with Node.js 18.x\n\n* chore: format model_costs.json with prettier\n\n* changes to resolve npm warnings\n\n* Changes in the tracking server to be running on port 7241\n\n* ci: bump Node.js from 18.x to 22.x in ui.yml\n\n* chore: pin @types/node to ^20 to match supported Node floor\n\n* chore(ui): add ASF license headers to 5 new Vite config files\n\n---------\n\nCo-authored-by: Elijah Ben Izzy \u003celijahbenizzy@users.noreply.github.com\u003e" }, { "commit": "d887c2fe6d4be6ec5693bf5b784995f829df0a31", "tree": "96c0f39c381448b791d11bf8bb8fa723a25f305e", "parents": [ "4a419f18ce34831a47f1fc377800812d0f0c04db" ], "author": { "name": "Shabbir Hussain", "email": "72.shabbir@gmail.com", "time": "Mon Jul 20 21:11:50 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jul 20 21:11:50 2026 -0700" }, "message": "feat: add milestone management workflow (#750)" }, { "commit": "4a419f18ce34831a47f1fc377800812d0f0c04db", "tree": "4f1bcc2c58bddb061c1e6f70674d1cefd3ac1478", "parents": [ "0f0a1d12460252402060e80ef4769260a1867904" ], "author": { "name": "Ethan Lin", "email": "103916325+ethanlin01x@users.noreply.github.com", "time": "Sun Jul 19 05:12:40 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Jul 18 21:12:40 2026 +0000" }, "message": "docs: fix broken CODE_OF_CONDUCT and developer setup links in README (#838)" }, { "commit": "0f0a1d12460252402060e80ef4769260a1867904", "tree": "31071c115da7702b2843314c4ce13544d7a2900b", "parents": [ "22b6f4a0b876441ab6948bd67e90d7afebe296bc" ], "author": { "name": "André Ahlert", "email": "andre@aex.partners", "time": "Sat Jul 18 18:08:20 2026 -0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Jul 18 14:08:20 2026 -0700" }, "message": "ci: base stale-assignment clock on human activity, not updated_at (#823)\n\nThe stale-assignment workflow measured inactivity from issue.updated_at.\nThat field is bumped by *any* change to the issue, including the bot\u0027s own\nwarning comment and label edits. Each weekly warn therefore reset the clock,\ncapping daysSinceUpdate at the warn interval so the 21-day unassign branch\nwas never reached: the bot warned forever and never removed an assignee.\n\nObserved on apache/burr#400: warnings at 17 then exactly 14 days later 14,\nagain 16 then 20 days, while the assignee was never unassigned.\n\nCompute inactivity from the most recent of: last non-bot comment, the\nassignment event for a current assignee (so a freshly assigned issue is not\ninstantly stale), and issue creation time. Bot comments no longer pollute the\nsignal, so the clock accumulates and the unassign threshold is reachable.\nReuse the paginated comments for the recent-warn spam guard.\n\nSigned-off-by: André Ahlert \u003candre@aex.partners\u003e" }, { "commit": "22b6f4a0b876441ab6948bd67e90d7afebe296bc", "tree": "8567cc9979b32e914650759815671f1cf4e14d36", "parents": [ "6294847aaeecd31243d221679900f3f868662d1f" ], "author": { "name": "Vaquar Khan", "email": "vaquar.cna@gmail.com", "time": "Sat Jul 18 16:07:51 2026 -0500" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Jul 18 14:07:51 2026 -0700" }, "message": "feat(ui): add dark mode support with system preference and toggle (#209) (#830)\n\nPhase 1: enable the dark mode mechanism and apply it to the app shell.\n\n- tailwind.config.js: change darkMode from invalid \u0027false\u0027 to \u0027class\u0027\n- Add useTheme hook: respects system preference via prefers-color-scheme,\n allows manual override, persists choice to localStorage, reacts to OS changes\n- Add ThemeToggle component (sun/moon button) replacing the previously broken radio\n- Apply dark: variants to the app shell: container, desktop + mobile sidebar,\n nav links, disclosure menus, breadcrumb, and project list table\n- Mount theme initialization at App root to apply the dark class on load\n\nLight mode is unchanged (all changes are additive dark: variants). Remaining\nper-view component coverage will follow in subsequent PRs.\n\nCo-authored-by: vaquarkhan \u003cvaquarkhan@users.noreply.github.com\u003e" }, { "commit": "6294847aaeecd31243d221679900f3f868662d1f", "tree": "30abe71f7de669c46706e8811cd419fb0fcbb517", "parents": [ "19d3fcfcf00015039a94463158fe40d22a2a2c89" ], "author": { "name": "Elijah ben Izzy", "email": "elijahbenizzy@users.noreply.github.com", "time": "Sun Jul 12 08:41:47 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jul 12 08:41:47 2026 -0700" }, "message": "Add Condition.safe_expr for opt-in restricted AST evaluation (#820)\n\n* feat: add Condition.safe_expr for opt-in restricted AST evaluation (#817)\n\nIntroduce Condition.safe_expr() as the opt-in safe sibling of Condition.expr().\nWhere expr() uses eval() (acceptable for developer-authored strings, unsafe\nfor less-trusted input), safe_expr() parses the expression, validates every\nAST node against a tight allowlist at call time, and then interprets the\nvalidated tree directly. eval()/compile() are never invoked on the parsed\ntree -- the safety argument depends on this.\n\nAllowed grammar: constants, Name lookup (resolved against state), Attribute\naccess (dunder names rejected -- closes __class__.__bases__.__subclasses__()),\nSubscript, Compare, BoolOp, UnaryOp, arithmetic BinOp, literal containers,\nand Call only to a whitelist of safe builtins (len/abs/min/max/sum/all/any/\nstr/int/float/bool). Everything else -- lambdas, comprehensions, IfExp,\nwalrus, f-strings, bitwise ops, arbitrary calls, bytes/Ellipsis constants --\nraises ValueError at safe_expr() call time, before the Condition is built.\n\nBackward compatible: Condition.expr is unchanged. safe_expr is exported as\nburr.core.safe_expr alongside expr. expr\u0027s docstring now cross-references\nsafe_expr for the untrusted-input use case.\n\nCo-Authored-By: Claude Opus 4.7 \u003cnoreply@anthropic.com\u003e\n\n* style: apply black to tests/core/test_action.py\n\n---------\n\nCo-authored-by: Claude Opus 4.7 \u003cnoreply@anthropic.com\u003e" }, { "commit": "19d3fcfcf00015039a94463158fe40d22a2a2c89", "tree": "24584694b7ed6fe00590df32173692fe6adddc69", "parents": [ "2e021569e17ef60a06d11be9f222522431e7d316" ], "author": { "name": "Timothy Lee", "email": "tnln3rd@gmail.com", "time": "Sun Jul 12 08:30:59 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jul 12 08:30:59 2026 -0700" }, "message": "ci: release CI follow-ups: tighter coverage (#832)\n\n* ci: add files/scripts\n\nRename examples/deep-researcher/utils.py to deep_researcher_utils.py to\navoid basename collision with four other ASF-owned utils.py files that\nApache RAT skips. Update .rat-excludes and the application import accordingly.\n\nThread --skip-signing through cmd_verify in scripts/apache_release.py so\nCI can run full artifact verification without GPG keys present.\n\nExtend Apache RAT scanning to wheel (.whl) artifacts in addition to source\nand sdist tarballs, so license header regressions in packaged files are\ncaught before the release vote.\n\nCloses #747 (partial)\n\n* ci: add smoke test improvements\n\nReplace fixed time.sleep(2) with a polling loop on /api/v0/projects so\nthe smoke test waits only as long as necessary and fails fast if the\nserver process exits unexpectedly.\n\nLaunch the server in its own process group (start_new_session\u003dTrue) and\nsend SIGTERM to the whole group on teardown so uvicorn child processes\nare not orphaned.\n\nAdd GET / check to verify the UI is being served by the installed wheel.\n\nAdd --cleanup / --no-cleanup flag; defaults to cleanup locally but\npreserves the workspace in GITHUB_ACTIONS so artifacts are available\nfor upload on failure.\n\nAdd tests/test_ci_smoke_server.py covering all new testable helpers.\n\nCloses #747 (partial)\n\n* ci: add CI coverage gaps\n\nAdd _wheel_content_hashes and _compare_wheel_contents to\nverify_apache_artifacts.py to compare wheels by file content hashes\nrather than binary equality (zip timestamps make byte-for-byte\ncomparison unreliable). Add compare-wheels subcommand exposing this\nfrom the CLI.\n\nAdd bare-install job: installs the wheel without optional extras and\nimports core symbols to catch accidental leakage of optional\ndependencies into core code.\n\nAdd sdist-wheel-equivalence job: extracts the sdist tarball, rebuilds\nthe wheel from it (including the npm frontend build), and compares\ncontent hashes against the CI-built wheel to catch files missing from\nthe sdist.\n\nPin the Apache RAT JAR download with a SHA256 checksum to guard\nagainst supply-chain tampering.\n\nCloses #747 (partial)\n\n* ci: add hygiene improvements\n\nAdd scripts/check_asf_headers.py: checks that Python, YAML, and shell\nfiles carry the ASF license header. Reads .rat-excludes at runtime so\nknown third-party files are automatically respected without duplicating\nthe exclusion list.\n\nWire the script into .pre-commit-config.yaml as a local hook so missing\nheaders are caught before a commit lands.\n\nAdd weekly cron schedule (Monday 09:00 UTC) to release-validation.yml\nso dependency drift against main is detected between releases.\n\nAdd tests/test_check_asf_headers.py with 15 tests covering all helper\nfunctions and the main entry point.\n\nCloses #747\n\n* style: apply black + fix RAT excludes for wheel dist-info\n\nTwo small fixes on top of t1mato/burr@ci/release-ci-followups so CI goes\ngreen:\n\n* Black formatting on the four new/modified files (auto-fix; contributor\n can pull this back locally, or maintainers can just squash-in on\n merge).\n\n* Wheel RAT scan: sdist and src tarball RAT scans pass, but the\n newly-added wheel scan fails because auto-generated dist-info metadata\n files (METADATA, WHEEL, RECORD) have no source and no ASF header.\n Added those three basename globs to .rat-excludes.\n\nVerified locally: black + flake8 + isort clean on the touched files.\nRAT reproduction not possible without the jar, but the failure signature\nin CI matches this class of file exactly and the excludes are the\nminimum-necessary additions.\n\n* ci: exclude bundled UI assets from RAT; apply isort\n\nFollow-up fixes on top of the black + METADATA/WHEEL/RECORD change:\n\n* RAT was still finding 6 unapproved files in the wheel: the bundled\n tracking-UI static assets (index.html, minified CSS/JS bundles and\n their source maps). These are generated by the telemetry/ui build\n and shipped inside the wheel so the tracking server can serve them\n at runtime; they have no ASF headers, and their sources\n (telemetry/ui/src/**/*.tsx) carry their own headers checked against\n the source release. Added burr/tracking/server/build/** to\n .rat-excludes.\n\n* isort was failing on two files not part of this PR\n (burr/integrations/persisters/b_mongodb.py and\n tests/integrations/persisters/test_b_pymongo_driver_info.py) --\n the current pre-commit config wants the imports collapsed to a\n single line. Applied.\n\nLocal RAT run against the extracted wheel now shows 0 unapproved\nfiles (the CI wheel will not contain the stale\nexamples/deep-researcher/utils.py that my local one had -- that\nfile was renamed to deep_researcher_utils.py earlier in the PR).\n\n* style: drop unused \u0027import pytest\u0027 in two new test files (flake8 F401)\n\n* fix(release): honor --output-dir in wheel subcommand\n\n_build_wheel_from_current_dir was hardcoded to leave the wheel at\ndist/apache_burr-*.whl regardless of the --output-dir argument\n(flit build always writes to dist/). The Release Validation\nsdist-wheel-equivalence job (added in this PR) discovered this\nby extracting the sdist, cd-ing in, and running\n\n python scripts/apache_release.py wheel VERSION 0 \\\n --skip-signing --output-dir /tmp/sdist-wheel\n\nthen comparing that wheel against the release wheel. The wheel was\ncreated but sat in \u003cextracted-sdist\u003e/dist/ instead of /tmp/sdist-wheel,\nso the compare step failed with \u0027Wheel not found: /tmp/sdist-wheel/...\u0027.\n\nAfter flit build writes to dist/, move the wheel to output_dir if\nthe caller specified a different location. No-op for the standard\nin-place build (output_dir defaults to \u0027dist\u0027).\n\n---------\n\nCo-authored-by: Elijah Ben Izzy \u003celijahbenizzy@users.noreply.github.com\u003e" }, { "commit": "2e021569e17ef60a06d11be9f222522431e7d316", "tree": "a8225f7f88fc122b7afdf8cd383461b657c12db4", "parents": [ "30fa494a278b5e22b978f91ac7ce5612d6da65d6" ], "author": { "name": "Elijah ben Izzy", "email": "elijahbenizzy@users.noreply.github.com", "time": "Sun Jul 12 08:30:54 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jul 12 08:30:54 2026 -0700" }, "message": "docs: tighten Condition.expr documentation; remove misleading empty globals dict (#819)" }, { "commit": "30fa494a278b5e22b978f91ac7ce5612d6da65d6", "tree": "bef81f0a9142a86c6564bc77cf652ce122dac87d", "parents": [ "378ba7d1b5fb9d507011b20c7a048517bc00ebe8" ], "author": { "name": "Alex Bevilacqua", "email": "alex@alexbevi.com", "time": "Fri Jul 10 20:33:22 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Jul 11 00:33:22 2026 +0000" }, "message": "feat: add MongoDB driver handshake metadata (#821)\n\nIdentify Burr in the MongoDB handshake so server-side telemetry can\ndistinguish Burr traffic. A module-level constant\n_DRIVER_INFO \u003d DriverInfo(name\u003d\"Burr\", version\u003d_VERSION) is defined\nonce in b_pymongo.py and used at every client construction site.\n\nb_pymongo.MongoDBBasePersister has three patterns:\n\n Pattern A – from_values() constructs MongoClient:\n mongo_client_kwargs.setdefault(\"driver\", _DRIVER_INFO) guards against\n overriding a caller-supplied driver value.\n\n Pattern B – __init__() receives an existing client:\n if hasattr(client, \"append_metadata\"): client.append_metadata(_DRIVER_INFO)\n append_metadata is idempotent; the hasattr guard keeps this safe with\n older pymongo versions that predate the API.\n\n Pattern A – __setstate__() reconstructs MongoClient after unpickling:\n driver\u003d_DRIVER_INFO passed directly.\n\nb_mongodb.py is a deprecated shim that constructs its own MongoClient\ninstances in from_values() and __init__(). Both receive the same\nsetdefault guard, importing _DRIVER_INFO from b_pymongo.py.\n\nVersion is read via importlib.metadata(\"apache-burr\") with a try/except\nfallback so it works whether or not the package is pip-installed.\n\nAdds tests/integrations/persisters/test_b_pymongo_driver_info.py\n(no live DB required) verifying all five behaviours:\n- _DRIVER_INFO has name\u003d\"Burr\" and matches the installed version\n- from_values() passes driver\u003d_DRIVER_INFO to MongoClient\n- from_values() does not override a caller-supplied driver\n- __init__() calls append_metadata(_DRIVER_INFO) when the client supports it\n- __init__() does not raise when client lacks append_metadata\n\nCo-authored-by: Claude Sonnet 4.6 (1M context) \u003cnoreply@anthropic.com\u003e" }, { "commit": "378ba7d1b5fb9d507011b20c7a048517bc00ebe8", "tree": "49321dab002816fcee2a583b6b4c091a93da4659", "parents": [ "3df3b51eb2f10f5f0bbe8f1a29a020f25f297533" ], "author": { "name": "Elijah ben Izzy", "email": "elijahbenizzy@users.noreply.github.com", "time": "Fri Jul 10 17:23:15 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Jul 11 10:23:15 2026 +1000" }, "message": "add burr-redirect package for legacy burr PyPI name (#827)\n\nBurr\u0027s PyPI listing under the legacy name \u0027burr\u0027 is at 0.40.2 and was\nsuperseded by \u0027apache-burr\u0027 at the Apache donation. Mirror the Hamilton\nsf-hamilton-redirect/ playbook: ship a thin metadata-only \u0027burr\u0027 wheel\nthat just pins apache-burr\u003d\u003d\u003cversion\u003e (plus every extra), so that users\non pip install burr / pip install burr[start] / etc. keep working and\nget the current apache-burr release transitively.\n\nFiles:\n- burr-redirect/pyproject.toml.template: setuptools-based, name\u003d\u0027burr\u0027,\n dependencies\u003d[\u0027apache-burr\u003d\u003dVERSION\u0027], all 28 extras mirrored.\n- burr-redirect/build.sh: stamps VERSION into the template, builds wheel\n + sdist, runs twine check, prints TestPyPI and PyPI upload commands.\n- burr-redirect/README.md: \u0027this package has moved\u0027 note, points users at\n apache-burr.\n- burr-redirect/.gitignore: ignores generated pyproject.toml, dist/,\n build/, *.egg-info/.\n\nExcludes:\n- .rat-excludes: adds burr-redirect/** so RAT does not scan the\n metadata-only redirect package.\n- pyproject.toml: adds burr-redirect/** to [tool.flit.sdist].exclude so\n the redirect package is NOT bundled into the apache-burr source\n tarball (the redirect is a non-ASF artifact and must not appear in any\n IPMC-voted release).\n\nThis PR is infrastructure only -- it does not produce or upload any\nrelease artifacts. The legacy burr 0.42.0 wheel is built and uploaded\nmanually after the apache-burr 0.42.0 wheel is live on PyPI (so the\n\u003d\u003d-pin resolves)." }, { "commit": "3df3b51eb2f10f5f0bbe8f1a29a020f25f297533", "tree": "004af3561ab3c06f1e47222fa928c6060906f213", "parents": [ "a6bda44e72e1d5047ef2637e58e1073bf751be83" ], "author": { "name": "Adam Munawar Rahman", "email": "msrahmanadam@gmail.com", "time": "Fri Jul 10 20:13:16 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Jul 11 00:13:16 2026 +0000" }, "message": "fix: tracking UI graph view freezes on state machines with dense transitions (#834)\n\n* fix: stop smart-edge pathfinding from rerunning on every graph interaction\n\nThe graph view reran A* pathfinding for every edge on every render.\nHighlight state arrives via a context whose value object was rebuilt\ninline, so every click and hover re-rendered all nodes and edges, each\nedge re-running pathfinding over a grid sized to the whole layout.\n\n- memoize the smart-edge path per edge on geometry and node set\n- skip A* above 100 nodes and fall back to bezier so large graphs render\n- memoize the highlight context value\n- key the relayout effect on graph structure instead of object identity,\n so identity churn without a structural change (focus switches,\n responses that are not reference-stable) no longer forces a full\n relayout and fitView\n- create a fresh dagre graph per layout instead of reusing a module-level\n instance that accumulates stale nodes across applications\n- remove leftover debug edge label\n\nMeasured with production builds: clicks on a 150-action application went\nfrom 11s+ on the 0.40.2 release (the same benchmark hung outright on a\nbuild of this source) to ~31ms; a 300-action application previously never\nfinished its initial render and now renders with ~75ms interactions.\n\nFixes #833\n\n* fix: derive relayout key from the rendered graph; store only labels in node data\n\nThe relayout key now comes from the same conversion the renderer uses\n(node ids and types plus edge source/target/condition), so it matches\nrendering by construction: hidden __-prefixed inputs and non-rendered\nmodel fields can neither trigger nor miss a relayout, and showInputs is\ncovered by the key because input nodes have their own ids. Node data\ncarries only the rendered label instead of the whole ActionModel, so\nreplacing the model object cannot leave stale data in nodes." }, { "commit": "a6bda44e72e1d5047ef2637e58e1073bf751be83", "tree": "7ffbd8dcf08c7579e1acb76618afc30d7cff5944", "parents": [ "ce297d2181493f99e19608113d70d88587bf9915" ], "author": { "name": "Vaquar Khan", "email": "vaquar.cna@gmail.com", "time": "Mon Jun 22 15:25:09 2026 -0500" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 22 20:25:09 2026 +0000" }, "message": "docs: fix docs typos and example issues for issue 725 (#764)\n\nCorrect broken snippets and grammar, fix RST formatting issues, and remove decorative emoji from documentation headers for consistency with project standards.\n\nCo-authored-by: vaquarkhan \u003cvaquarkhan@users.noreply.github.com\u003e" }, { "commit": "ce297d2181493f99e19608113d70d88587bf9915", "tree": "99d515a340fcefe1a1a76961d28aa3a35e58ce42", "parents": [ "d3278d20e720e7d95ff0f946ef3a64ff70e8263f" ], "author": { "name": "Timothy Lee", "email": "tnln3rd@gmail.com", "time": "Mon Jun 22 13:05:49 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jun 23 06:05:49 2026 +1000" }, "message": "docs: restructure Burr UI documentation into dedicated section (#411) (#815)\n\n* docs: add dedicated Burr UI section to documentation (#411)\n\n* Adds docs/ui.rst as a top-level \u0027Burr UI\u0027 entry in the Sphinx sidebar,\n mirroring how Hamilton surfaces their UI\n* Covers quickstart, data model, notebook/Colab usage, FastAPI embedding,\n and See Also links to the tracking reference and monitoring deployment guides\n\n* docs: restructure Burr UI documentation into dedicated section for issue 411\n\n* docs: restructure Burr UI documentation into dedicated section (#411)\n\nAdd a dedicated docs/ui/ section covering the Burr UI from installation\nthrough notebook usage and production deployment, with focused pages for\ngetting-started, notebook/Colab, and deployment." }, { "commit": "d3278d20e720e7d95ff0f946ef3a64ff70e8263f", "tree": "110e302b31a7f9575b43bec5805b8ea4be3fe0cb", "parents": [ "38f49b61d84a71d593d18d2376852f3dfcc9f287" ], "author": { "name": "Rolly Calma", "email": "115199279+Ghraven@users.noreply.github.com", "time": "Sun Jun 21 04:01:26 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Jun 20 20:01:26 2026 +0000" }, "message": "fix: use aware UTC for S3 log partitions (#811)" } ], "next": "38f49b61d84a71d593d18d2376852f3dfcc9f287" }