Repository navigation
·
133 commits
to main
since this release
Immutable
release. Only release title and notes can be modified.
⚠️ Breaking Changes
Warning
This release changes several defaults and makes more settings host-only. Check each item below against your deployment before upgrading.
pip install pr-agentno longer installs the git provider SDKs (#3679): PyGithub, python-gitlab, atlassian-python-api, the Azure DevOps SDKs, boto3, giteapy, the Google Cloud SDKs and a2a-sdk moved to thegithub,gitlab,bitbucket,azure,codecommit,gitea,googleandmosaicoextras. Install the ones you use, for examplepip install "pr-agent[github]", orpr-agent[all]for the previous set. The Docker images already installall.- Docker service images run as a non-root user (#3910): the webhook, app, polling and Mosaico targets run as UID/GID
10001withHOME=/home/pragent. Mounted secrets must be readable by that user, output and database directories must be writable, and home-relative mounts should move to/home/pragent. The GitHub Action, CLI and Lambda images still run as root. - Azure DevOps and Bitbucket Server webhooks require credentials (#3911): with
azure_devops_server.webhook_username/webhook_passwordorbitbucket_server.webhook_secretunset, every webhook is rejected with HTTP 403. Set them on both the sender and PR-Agent before upgrading. - GitLab webhooks backed by a secret provider need a new token format (#3913): when GitLab credentials come from AWS Secrets Manager or Google Cloud Storage, the webhook's Secret Token must be
<secret-name>:<webhook-token>. Name-only tokens are rejected with HTTP 401, so update the webhooks when you deploy. - Namespace-wide settings are off by default (#3908): PR-Agent no longer applies
<namespace>/pr-agent-settingsto every repository automatically. Set the host-onlyconfig.global_settings_repo = "pr-agent-settings"to keep the old behaviour. [tool.pr-agent]inpyproject.tomlis no longer read (#3941): move those settings to.pr_agent.toml.- More settings are host-only (#3840, #3904, #3950, #4001, #4054): a repository's
.pr_agent.tomland comment arguments can no longer set provider endpoints (openai.api_baseand the otherapi_basekeys), keys ending inurl,endpoint,org,key,tokenorsecret, provider auth mode and TLS settings (github.deployment_type,gitlab.auth_type/ssl_verify,bitbucket.auth_type,gitea.skip_ssl_verification/ssl_ca_cert),jira.jira_site/jira_api_email/project_keys, or LiteLLM callbacks. They are ignored with a warning, so set them in host configuration instead. Comment arguments are restricted further as well (#3902). - Gitea and Gerrit read repository settings from the target branch (#3906): Gitea uses the PR base and Gerrit the default branch, so a
.pr_agent.tomlchange inside a PR no longer applies to that PR. - Cross-repository reads need an allowlist (#3922, #3897): GitHub ticket context only reads linked issues and sub-issues from the PR's own repository or same-owner repositories listed in
config.repo_context_sibling_repos.gitlab.expand_submodule_diffsonly expands submodules listed there that sit in the MR's top-level group. - Ignore rules now cover comment commands (#3943):
config.ignore_pr_authors,ignore_pr_labels,ignore_pr_title, the branch rules andignore_repositoriesnow skip manually triggered commands too, not only automatic ones. merge_recommendationvalues were renamed (#4010): withpr_reviewer.require_merge_recommendationon,safe_to_mergeis nowno_concerns_foundandmerge_with_cautionis nowneeds_review.changes_requiredis unchanged. Update anything that parses review output./describecomments no longer repeat the PR description (#4118): withpr_description.publish_description_as_comment = true, the comment leaves out the User Description section even whenadd_original_user_descriptionis on, because the PR body is left untouched.- Smaller behaviour changes: webhook servers reject request bodies over 5 MiB with HTTP 413 (
config.max_webhook_request_body_bytes, #3820). A positiveconfig.max_output_tokensbelow 4096 is raised to 4096 (#4013)./describeand/generate_labelsdrop model labels outside the PR types and enabled custom labels (#3899).
What's Changed
🚀 Features
- feat: show agent run details on /ask, /ask_line, /update_changelog, and /help answers by @ashearin in #4091
- feat(linear): add linked issue context for ticket compliance by @lkshrk in #4078
- Add support for Gemini 4 Argon by @takotakot in #4120
- feat: support CompactifAI provider credentials by @favouradesiyan in #3737
- feat(gitea): support inline key issues by @fbidu in #4131
- feat(ci): post PR-Agent output as the PR Agent GitHub App when configured by @naorpeled in #4051
- feat(ci): enable sponsored descriptions and improvements on PR open by @ofir-frd in #4002
- feat(review): honor human-resolved GitHub key issues by @erezlev13 in #4032
- feat: cache the shared skills prefix across review tools by @utsab345 in #4014
- feat: export PR reviews as JSON by @utsab345 in #4033
- feat(review): honor explicit Azure key-issue dismissals by @erezlev13 in #4025
- feat(review): add opt-in failure modes by @oleksii-tumanov in #4012
- feat(artifacts): choose which end of the file truncation keeps by @Yoel-qin in #3990
- feat(tickets): include native issue references from PR titles by @oleksii-tumanov in #3980
- feat(review): treat human-resolved inline key-issue threads as dismissed by @hkn-wt in #3925
- feat(github): stream chunk progress into in-progress check runs by @Yoel-qin in #3933
- feat(models): add OpenAI GPT-6.1 Sol support by @PeterDaveHello in #3938
- feat(describe): report chunk progress in the progress comment by @Yoel-qin in #3872
- feat(push-outputs): add Telegram channel by @noooooooookro in #3868
- feat(local): support repo context files in the local git provider by @YokoAC in #3863
- feat(gitlab): react to how a comment command ended by @PeterDaveHello in #3852
- feat(otel): export per-command token usage by @utsab345 in #3835
- feat(models): add OpenAI GPT-6 Sol and Luna support by @PeterDaveHello in #3628
- feat: report chunk progress in the progress comment by @utsab345 in #3814
- feat(review): give /review the findings of earlier reviews by @hkn-wt in #3750
🐛 Bug Fixes
- fix(describe)!: skip original user description when published as comment by @maurerle in #4118
- fix(gitlab): retry the first merge request lookup on 404 for new MR webhooks by @jadhavgaurav in #3995
- fix(bedrock): stop sending temperature to Kimi K3 and GLM-5 by default by @ira-at-work in #3752
- fix(security): redact bare provider tokens from logs and artifacts by @Yoel-qin in #4081
- fix(mosaico): consume the Eclipse registry deployment image by @ofir-frd in #4148
- fix(litellm): initialize without the optional google extra by @SzymonNastaly in #4141
- fix(tickets): deduplicate GitHub issue references by identity by @PeterDaveHello in #4072
- fix(settings): redact shared errors and retry transient fetches by @ashearin in #4071
- fix(docs): preserve Azure DevOps dismissal note during regeneration by @PeterDaveHello in #4066
- fix: preserve yaml-prefixed keys in load_yaml by @utsab345 in #4069
- fix: close file handle in bitbucket manifest handler by @utsab345 in #4063
- fix(litellm): observe detached stream cleanup failures by @PeterDaveHello in #4042
- fix: keep quoted command setting values as strings by @utsab345 in #4048
- fix: cap github suggestion body length by @utsab345 in #4053
- fix: restrict LiteLLM callbacks to deployment settings by @utsab345 in #4054
- fix(azure): surface diff collection failures by @utsab345 in #4060
- fix(improve): avoid model fallback for empty analyzable diffs by @PeterDaveHello in #4057
- fix(models): correct Claude Sonnet 4.6 and Opus 4.6 context windows by @PeterDaveHello in #4058
- fix: keep review finding location when end line is empty by @utsab345 in #4036
- fix(ci): read the comment event from GITHUB_EVENT_PATH in PR-Agent authorization by @naorpeled in #4050
- fix: merge extra config keys case-insensitively by @utsab345 in #4037
- fix: tolerate missing effort field in review labels by @utsab345 in #4047
- fix(github): avoid retrying permanent diff collection failures by @PeterDaveHello in #4045
- fix(diff): keep unreadable file notices in chunked diffs by @PeterDaveHello in #4041
- fix(openrouter): attribute model requests to PR-Agent by @PeterDaveHello in #4039
- fix: skip empty insights section in review output by @utsab345 in #4038
- fix(gerrit): skip symlink and git-metadata suggestion paths by @HarshRajSinghania in #3915
- fix: improve skills budget warnings by @karthi040506 in #3865
- fix(gitlab): load host settings before note provider lookup by @PeterDaveHello in #4023
- fix: pass CI artifact context into suggestion self-reflection by @HarshRajSinghania in #4034
- fix: account for CI in merge recommendation by @utsab345 in #4031
- fix: find suggestion fence closers without a lazy scan by @utsab345 in #4028
- fix: redact CI artifact credentials before prompt injection by @jiuyueQ in #3989
- fix(improve): fence a suggestion with more backticks when its code has a fence by @huiq777 in #3791
- fix(security): reject non-public destination address ranges by @PeterDaveHello in #4024
- fix(bitbucket): report request failures before falling back by @PeterDaveHello in #4022
- fix(gitea): keep failed guidance reads out of caches by @oleksii-tumanov in #4016
- fix: report clipped patches as partial input coverage by @oleksii-tumanov in #4019
- fix(litellm): warn on invalid config.max_output_tokens and enforce a 4096 floor by @ALN-web in #4013
- fix(review): keep url-less ticket compliance entries distinct by @utsab345 in #3999
- fix(gerrit): reset local edits after failed patch uploads by @PeterDaveHello in #4021
- fix(bitbucket-server): build line links on the canonical PR URL by @ALN-web in #4015
- fix(review): allow disabling failure comments by @oleksii-tumanov in #4011
- fix(review): render url-less ticket compliance without dead link by @utsab345 in #4000
- fix: create missing AWS secrets by @utsab345 in #3930
- fix(jira): keep jira_site and project_keys host-only by @hkn-wt in #4001
- Allow extra review fields by @utsab345 in #3998
- fix(review): escape HTML, convert newlines to <br>, and render nested YAML in unknown review keys (#3975) by @AnkitaAdvitot in #3976
- fix: mark CI artifact input as untrusted by @sb123sb123 in #3978
- fix: preserve extra instructions in suggestion reflection by @Ai-Eastern in #3987
- fix(github): resolve threads for replies after the first comment page by @oleksii-tumanov in #3979
- fix(litellm): align OpenRouter reasoning clamps and token reserves by @PeterDaveHello in #3981
- fix(bitbucket): verify the webhook JWT before parsing the request body by @Evhye38496 in #3958
- fix(context): prioritize directly linked ticket context by @oleksii-tumanov in #3967
- fix(ask): propagate final reply delivery errors by @oleksii-tumanov in #3970
- fix(gitea): reuse the PR commit snapshot for messages by @oleksii-tumanov in #3971
- fix(review): log all schema validation errors and run require checks (#3973) by @AnkitaAdvitot in #3974
- fix(review): handle non-list can_be_split values by @utsab345 in #3969
- fix: enforce PR ignore policy at the agent boundary by @erezlev13 in #3943
- fix(gitea): read diff file names with the shared parser by @utsab345 in #3964
- fix(bitbucket): handle push events without a pull request by @utsab345 in #3961
- fix(polling): preserve pulls segment in comment URLs by @utsab345 in #3962
- fix(diff): extend zero-length hunks from the right line in extend_patch by @havinash-007 in #3966
- fix(context): avoid duplicate local repository context entries by @oleksii-tumanov in #3968
- fix(local): respect the configured description token budget by @oleksii-tumanov in #3956
- fix: keep provider auth and TLS settings host-only by @1cbyc in #3950
- fix(diff): use fixed context for headerless hunks by @oleksii-tumanov in #3955
- fix(security): reject dunder section/key names in repo settings files by @SpinachDigital in #3947
- fix(bitbucket): align Connect lifecycle and JWT handling (#3877) by @AnkitaAdvitot in #3923
- fix(security): protect provider connection settings by @nightcityblade in #3904
- fix(config): stop loading [tool.pr-agent] from the checkout's pyproject.toml by @utsab345 in #3941
- fix(webhooks): Require Azure and Bitbucket Server credentials by @oleksii-tumanov in #3911
- fix: load repository settings from target refs by @nightcityblade in #3906
- fix(tickets): restrict GitHub issue reads to approved repositories by @oleksii-tumanov in #3922
- fix(gitlab): Verify stored webhook tokens before loading credentials by @oleksii-tumanov in #3913
- fix(docker): Run services as non-root and pin build images by @oleksii-tumanov in #3910
- fix(git_providers): bound HTTP requests that have no timeout by @PeterDaveHello in #3850
- fix: restrict host-only comment arguments by @nightcityblade in #3902
- fix(gerrit): keep line endings and mode when applying a suggestion by @ALN-web in #3876
- fix(tickets): Match full issue URLs on the configured GitHub origin by @oleksii-tumanov in #3907
- fix(gitea): parse PR and issue URLs of an instance served under a subpath by @ALN-web in #3937
- fix(gitea): skip the base-content fetch for added files by @PeterDaveHello in #3936
- fix(review): mark PR title/description/commits/tickets/code as untrusted in reviewer system prompt by @SpinachDigital in #3921
- fix(telemetry): configure delta aggregation temporality for prometheus counter exporter (#3871) by @Fire162 in #3873
- fix(ignore): allow globstar segments to match zero directories by @PeterDaveHello in #3855
- fix: preserve optional provider install hints in context errors by @strawberry-little-bear in #3929
- fix(servers): verify Gitea and GitLab webhooks before parsing by @utsab345 in #3912
- fix(mosaico): limit requests and isolate caller tasks by @oleksii-tumanov in #3926
- fix: propagate recorded tool failures from CLI by @abhinavrastogi2627 in #3919
- fix: restrict generated labels to the enabled vocabulary by @brown-sussy in #3899
- fix(commands): Honor disabled publication in line questions and help by @oleksii-tumanov in #3900
- fix(config): require config.global_settings_repo for namespace settings by @utsab345 in #3908
- fix(litellm): isolate request settings by @utsab345 in #3898
- fix(gitlab): authorize submodule diff targets by @utsab345 in #3897
- fix(git-providers): prevent fork changelog writes by @nightcityblade in #3905
- fix(plain-diff): keep output when stdout cannot encode it by @ALN-web in #3875
- fix(local): write description.md as UTF-8 by @ALN-web in #3874
- fix(improve): name deleted files instead of sending their lines by @utsab345 in #3866
- fix(ask): sanitize echoed question and line-question answers against quick actions (#2629) by @rishiiicreates in #3860
- fix(gitea): reject incomplete changed-file inventories by @oleksii-tumanov in #3857
- fix(ask): require https and bound redirects in image check by @utsab345 in #3847
- fix: close LiteLLM streams without interrupting cancellation by @PeterDaveHello in #3723
- fix(litellm): treat Bedrock ARN overrides as Claude for caching and cost by @utsab345 in #3844
- fix(improve): report unconfirmed persistent suggestion updates by @oleksii-tumanov in #3858
- fix(gitlab): refill ticket context after failed issue lookups by @oleksii-tumanov in #3859
- fix(security): keep provider endpoints host controlled by @sb123sb123 in #3840
- fix(servers): match the whole /ask command token by @utsab345 in #3822
- fix(improve): make the reflection-failure score configurable by @utsab345 in #3833
- fix(webhooks): cap request bodies before parsing by @sb123sb123 in #3820
- fix(litellm): skip same-model retry on length truncation by @utsab345 in #3827
- fix(gitlab): report suggestion publication failures by @teachershuang in #3129
- fix(changelog): preserve confirmed writes after feedback failure by @oleksii-tumanov in #3849
- fix(github): reject file lists collected across PR revisions by @oleksii-tumanov in #3848
- fix(litellm): scope bedrock model_id per model, fix fallback region lookup by @CodeByPeace in #3846
- fix(gerrit): validate refspec before fetching by @sb123sb123 in #3838
- fix(local): return the branch name string from get_pr_branch by @YokoAC in #3841
- fix(gitea): anchor code suggestions to the new file by @utsab345 in #3821
- fix(bitbucket): summarize sensitive webhook payload logs by @sb123sb123 in #3818
- fix(gitea): use the shared slash-command comment gate by @utsab345 in #3784
- fix(deps): declare urllib3 as a direct dependency by @PeterDaveHello in #3811
- fix(file_filter): report skipped and incomplete ignore filtering by @PeterDaveHello in #3801
- fix: include filtered changed filenames in review context by @truongbo17 in #3806
⚡ Performance
- perf(review): avoid repeated JSON serialization of previous findings by @PeterDaveHello in #4142
- perf(yaml): avoid reparsing unchanged failed input by @PeterDaveHello in #4073
- perf(diff): bound tokenization when trimming filename metadata by @PeterDaveHello in #4056
- perf(github): resolve merge base only when needed by @PeterDaveHello in #4044
- perf(routing): count diff hunks only when needed by @PeterDaveHello in #4008
- perf(diff): use set for included-file metadata checks by @PeterDaveHello in #4017
- perf(gerrit): walk the commit diff once per provider instance by @PeterDaveHello in #3935
- perf(context): load instruction files lazily by line budget by @PeterDaveHello in #3985
- perf(diff): reuse patch token counts across packing rounds by @PeterDaveHello in #3986
- perf(git_providers): memoize get_languages() across providers by @PeterDaveHello in #3934
- perf(yaml): use LibYAML for initial response parsing by @PeterDaveHello in #3759
- perf(gitlab): read the default branch once instead of per read by @PeterDaveHello in #3853
- perf(gitlab): stop fetching the project and merge request to react by @PeterDaveHello in #3851
📚 Documentation
- docs: add a Cheaper Inference section to changing_a_model by @aiapienthusiast in #3675
- Document RelaxAI OpenAI-compatible setup by @copilot-swe-agent[bot] in #4076
- docs: use a concrete DemonRoute model in example by @demonroute2 in #4075
- docs: add DemonRoute to changing_a_model by @demonroute2 in #4074
- docs: add Heabsy to changing_a_model by @kafomichev in #3755
- docs(litellm): clarify shared skills and per-tool cache breakpoints by @PeterDaveHello in #4065
- docs: narrow installation permissions by @nightcityblade in #3901
- docs: self-host README images by @utsab345 in #3839
- docs(config): align self-review knobs with the visual-marker-only note by @Yoel-qin in #3809
🧹 Maintenance
- test(aws): prevent false passes in Bedrock fallback region test by @PeterDaveHello in #4090
- chore(deps): update LiteLLM to 1.105.0 by @PeterDaveHello in #4089
- chore: remove unused JSON repair helpers by @utsab345 in #4061
- chore: up html2text to 2025.4.15 by @even-even in #4055
- chore(models): prune retired and obsolete static model entries by @PeterDaveHello in #4026
- chore: remove unused code suggestion parser by @utsab345 in #4035
- chore: rename merge_recommendation values to describe findings by @utsab345 in #4010
- chore: unskip E722 ruff rule and actualize ruff config by @even-even in #3993
- chore: unskip B023 ruff rule by @even-even in #3977
- chore: unskip B904 ruff rule by @even-even in #3951
- chore(deps): update LiteLLM to 1.104.0 by @PeterDaveHello in #3932
- ci: scope docs-ci write to the deploy job and default the other workflows to read-only by @yunaremaia in #3896
- refactor: make provider SDKs optional by @NesrineGharbi77 in #3679
- refactor(outputs): separate sink strategies from dispatch by @erezlev13 in #3854
- chore: unskip B017 ruff rule by @even-even in #3856
- refactor(prompt): standardize on sandboxed Jinja by @sb123sb123 in #3819
- refactor: remove redundant work from output processing by @PeterDaveHello in #3813
- chore(deps): bump oauthlib to 4.0.0 in uv.lock by @PeterDaveHello in #3812
⬆️ Dependencies
- chore(deps): bump the python-major group across 1 directory with 6 updates by @dependabot[bot] in #4126
- chore(docker): bump python from 3.14.7-slim to 3.14.8-slim in /docker by @dependabot[bot] in #4123
- chore(ci): bump the actions-minor-and-patch group with 8 updates by @dependabot[bot] in #4124
- chore(deps): bump the python-minor-and-patch group with 20 updates by @dependabot[bot] in #4125
- chore(deps): bump shell-quote from 1.10.0 to 1.12.0 in /docs by @dependabot[bot] in #3957
- chore(deps): bump multidict from 6.7.1 to 6.9.1 by @dependabot[bot] in #3954
- chore(deps): bump langgraph-sdk from 0.4.2 to 0.4.4 by @dependabot[bot] in #3952
- chore(deps): bump fsspec from 2025.12.0 to 2026.6.0 by @dependabot[bot] in #3953
- chore(deps): bump source-map-js in /docs and make the uv pin a floor for Dependabot by @dependabot[bot] in #3949
- chore(deps): bump proxy-addr from 2.0.7 to 2.0.8 in /docs by @dependabot[bot] in #3946
- chore(ci): bump the actions-minor-and-patch group with 2 updates by @dependabot[bot] in #3940
Full Changelog: v0.47.0...v0.48.0