v0.49.0

⚠️ Upgrade notes

• GitHub polling needs an allowlist. New host-only github.polling_repositories = ["owner/repo", ...]; empty (the default) ignores every notification, so polling deployments must set it (#4294).
• Jira project_keys = [] now disables lookups. The default is now ["*"]. If you set [] to mean "all projects", change it to ["*"] or remove it (#4049).
• litellm.extra_headers is host-only. Repository .pr_agent.toml and comment arguments can no longer set it (#4287).
• Default model is now gpt-6.1-sol with gpt-6-luna as fallback (was gpt-5.6 / gpt-5.6-terra). Pin config.model to keep the old one (#4088).
• Langfuse SDK 4.18.0 needs self-hosted Langfuse 3.63.0+; use the langfuse_otel callback (#4343).
• GitHub App token in Actions: set github.agent_login to <app-slug>[bot] so PR-Agent recognises its own comments (#4329).

✨ Highlights

• pr-agent doctor preflights a deployment (#4321).
• --json-output for /describe, /improve and /review (#4265, #4227, #4226).
• Jira scoped API tokens (#4250), /ask with the CI artifact as context (#4176), globs in repo_context_files (#4220), opt-in GitLab subgroup settings inheritance (#4059).
• Security hardening: DNS rebinding block, repo-context path escapes, host-only config output, loguru diagnose off, more credential redaction (#4252, #4279, #4293, #4280, #4328).

What's Changed

• Redact Stripe, Twilio and SendGrid credentials by @IlyaKhalafi in #4328
• ci(review): make self-hosted /improve post suggestions again by @Yoel-qin in #4174
• Enable automatic /review on new PRs (fixes #4162) by @kiranmutyala18 in #4170

🚀 Features

• feat(artifacts): support multiple artifact files by @utsab345 in #4338
• feat(cli): add a doctor command to preflight the deployment by @Yoel-qin in #4321
• feat(describe): write the description to --json-output by @Yoel-qin in #4265
• feat(jira): support scoped API tokens by @utsab345 in #4250
• feat(repo-context): glob entries and fallback alternatives in repo_context_files by @ira-at-work in #4220
• feat(ask): include organizational skills in line-level answers by @Yoel-qin in #4225
• feat(review): list the files left out in the JSON output by @Sajinthan in #4226
• feat(improve): write suggestions to --json-output by @Sajinthan in #4227
• feat(ask): answer questions with the CI artifact as context by @Yoel-qin in #4176
• feat(help): prioritize a matching document in constrained prompts by @oleksii-tumanov in #4101
• feat(gitlab): add opt-in closest-subgroup settings inheritance by @ashearin in #4059
• feat(improve): retain equal summaries across files by @oleksii-tumanov in #4128

🐛 Bug Fixes

• fix(ask_line): defer handler setup until a diff hunk matches by @oleksii-tumanov in #4354
• fix(mosaico): retain tasks with bounded owner history by @utsab345 in #4337
• fix(add-docs): retry malformed model responses with fallback models by @PeterDaveHello in #4346
• fix(routing): count diff hunks without splitting patch lines by @PeterDaveHello in #4344
• fix: retry whitespace-only model completions by @PeterDaveHello in #4348
• fix(azure): reject incomplete linked work item responses by @oleksii-tumanov in #4173
• fix(algo): prefer exact source lines before fuzzy matching by @PeterDaveHello in #4340
• fix(similar_issue): use the supported Qdrant query API by @PeterDaveHello in #4341
• fix(azure): handle created events without a web link by @oleksii-tumanov in #4171
• fix(ask): answer with a note when every changed file is filtered out by @sarankumar1325 in #4336
• fix(gitlab): paginate repository directory listings by @utsab345 in #4332
• fix(github): let the operator name the agent login an app token posts as by @sarankumar1325 in #4329
• fix: reject boolean routing limits by @utsab345 in #4302
• fix: parse GitLab boolean settings by @utsab345 in #4303
• fix: stop Gitea changed-files pagination at the advertised total by @fixfon in #4306
• fix(describe): retain valid YAML file-description chunks by @PeterDaveHello in #4315
• fix(gitlab): preserve Git line boundaries when resolving fixed threads by @PeterDaveHello in #4313
• fix(improve): keep embedded fences inside summary diffs by @PeterDaveHello in #4312
• fix: skip generate_labels, add_docs and update_changelog when all files are filtered by @swayamg20 in #4307
• fix(help_docs): preserve fenced examples during cleanup by @PeterDaveHello in #4319
• fix: reject boolean body size limits by @utsab345 in #4301
• fix: normalize list settings consistently by @utsab345 in #4300
• fix: restrict polling to allowlisted repositories by @utsab345 in #4294
• fix: hide host-only configuration output by @utsab345 in #4293
• fix: anchor incremental reviews to agent comments by @utsab345 in #4292
• fix: require bot authorship for describe persistent comments by @utsab345 in #4291
• fix: authorize cross-project GitLab tickets by @utsab345 in #4290
• fix(config): keep litellm.extra_headers host-only by @fixfon in #4287
• fix: disable loguru diagnose and backtrace by @utsab345 in #4280
• fix: reject escaping repo context paths by @utsab345 in #4279
• fix(github): use the GraphQL endpoint on GitHub Enterprise Server by @MaxFreedomPollard in #4272
• fix(help_docs): preserve ranked documents that already fit by @PeterDaveHello in #4267
• fix(review): preserve source characters in patch-based snippets by @PeterDaveHello in #4268
• fix(review): resolve findings in a chunked review when none were cut by @jadhavgaurav in #4222
• fix(config): honor settings context selection by @utsab345 in #4251
• fix(ci): update uv security pin by @utsab345 in #4263
• fix(ignore): keep bracket expressions in string glob patterns by @utsab345 in #4245
• fix(skills): treat a string paths value as one path by @utsab345 in #4244
• fix: parse CRLF plain diffs correctly by @strawberry-little-bear in #4231
• fix(ignore): cap glob length by @utsab345 in #4259
• fix: treat scalar PR ignore settings as single values by @kocaemre in #4257
• fix(security): block DNS rebinding by @utsab345 in #4252
• fix: normalize scalar PR commands by @utsab345 in #4253
• fix(bitbucket): read ambiguous diff headers from patch metadata by @utsab345 in #4248
• fix(outputs): deliver the sinks off the event loop by @utsab345 in #4247
• fix(polling): avoid rerunning commands found in comment history by @PeterDaveHello in #4239
• fix(gitlab): publish notice for incomplete merge request diffs by @Evhye38496 in #4234
• fix(help): render static help without initializing an AI handler by @PeterDaveHello in #4241
• fix(labels): preserve label changes made during model calls by @PeterDaveHello in #4237
• fix(bedrock): stop sending temperature to GLM-5 by default by @ira-at-work in #4219
• fix(repo-context): survive a failed revision lookup by @utsab345 in #4246
• fix(algo): keep yaml fence stripping linear by @utsab345 in #4232
• fix: stop bare #N in comments, link text, colours and words becoming tickets by @jay23606 in #4198
• fix: prevent local config contents in log artifact while preserving PR comment by @wjc2821296948 in #4197
• fix(describe): fall back on unusable model responses by @PeterDaveHello in #4186
• fix(gitlab): avoid double-encoding submodule project paths by @PeterDaveHello in #4214
• fix(changelog): retry empty model responses before publishing by @PeterDaveHello in #4209
• fix(help_docs): recognize Unicode letters in documentation by @PeterDaveHello in #4206
• fix: skip review and describe when all files are filtered by @utsab345 in #4204
• fix(help_docs): recount tokens after cleaning documentation by @PeterDaveHello in #4188
• fix(review): preserve case-sensitive paths when merging chunks by @PeterDaveHello in #4182
• fix(gerrit): bound direct git and SSH commands by @oleksii-tumanov in #4177
• fix(plain-diff): decode Git-quoted file paths by @Aling33 in #4152
• fix(add_docs): preserve literal indentation in suggestions by @oleksii-tumanov in #4172
• fix(review): preserve corrected answers for the latest question by @PeterDaveHello in #4166
• fix(models): avoid same-model retries for authentication failures by @PeterDaveHello in #4167
• fix(diff): preserve non-LF characters when rebuilding patches by @PeterDaveHello in #4168
• fix(gitlab): pin repository settings to one revision by @oleksii-tumanov in #4093
• fix: require Bitbucket Server diff content by @utsab345 in #4111
• fix(github): read repository settings from one revision by @oleksii-tumanov in #4094
• fix(gitlab): retry not-ready merge request diffs with bounded backoff by @Yoel-qin in #4150
• fix: align Bitbucket patches by file path by @utsab345 in #4102
• fix(diff): split patches on newlines only so line numbers match git by @porkedchop in #4080
• fix(ask): parse markdown image URLs precisely by @utsab345 in #4087
• fix(review): merge chunked ticket entries by the real ticket by @utsab345 in #4139
• fix(jira): default project_keys to wildcard and empty list to disable lookups (#3887) by @itsvrushabh in #4049
• fix(routing): retain displaced primary in colliding fallback chains by @PeterDaveHello in #4064
• fix(bitbucket): encode file paths in content reads by @utsab345 in #4095
• fix: preserve repeated override quote types by @utsab345 in #4129
• fix(review): cap merged chunk findings at num_max_findings by @utsab345 in #4138
• fix: keep quoted list settings as lists in parse_command by @utsab345 in #4070
• fix(github): scope API-URL classification to exact host + path prefix by @depohmel in #4143
• fix(github): refresh all PR label pages before replacement by @PeterDaveHello in #4083
• fix: discard stale plain diff context by @utsab345 in #4114
• fix: honor ignore rules in local diff providers by @utsab345 in #4110
• fix(gitea): skip inline comments on lines outside the diff by @fbidu in #4130
• fix(gitea): read renamed base from old path by @utsab345 in #4132
• fix(gitea): encode raw file content paths by @jiuyueQ in #4106
• fix: include DNS validation in URL fetch timeouts by @oleksii-tumanov in #4109
• fix(diff): bound context at adjacent hunks by @utsab345 in #4086
• fix(diff): decode UTF-16 file content correctly by @utsab345 in #4096
• fix(describe): preserve success when final feedback fails by @oleksii-tumanov in #4092
• fix(describe): skip file walkthrough entries with empty fields by @utsab345 in #4082
• fix(codecommit): report unreadable changed files by @utsab345 in #4133
• fix: avoid partial Azure incremental reviews by @utsab345 in #4099
• fix(bitbucket): prevent fork changelog writes by @utsab345 in #4098
• fix(gitlab): match ticket URLs to the configured origin by @oleksii-tumanov in #4097
• fix(similar_issue): retry after filtering excluded hits by @oleksii-tumanov in #4104
• fix: avoid invented GitLab file changes by @utsab345 in #4100

⚡ Performance

• perf(bitbucket): reuse the initial diffstat result by @oleksii-tumanov in #4356
• perf(github): avoid refetching inline question thread comments by @PeterDaveHello in #4345
• perf: defer unused per-file extended diff token counts by @PeterDaveHello in #4349
• perf(similar_issue): batch indexed issue lookups by @PeterDaveHello in #4339
• perf(gitlab): fetch incremental commits in larger pages by @PeterDaveHello in #4318
• perf(diff): release discarded extended patches before repacking by @PeterDaveHello in #4317
• perf(gitlab): load submodule mappings only for expandable changes by @PeterDaveHello in #4314
• perf(github): reuse revision-pinned configuration tree paths by @PeterDaveHello in #4311
• perf(context): expand repository globs only within the line budget by @PeterDaveHello in #4310
• perf(gitlab): reuse revision-pinned configuration tree paths by @PeterDaveHello in #4270
• perf(similar_issue): defer comments until an issue is indexable by @PeterDaveHello in #4269
• perf(gitlab): cache stable merge request changes by @utsab345 in #4254
• perf(gitlab): stop fetching discussions after finding the target by @PeterDaveHello in #4235
• perf(gitlab): count changed lines without splitting patches by @PeterDaveHello in #4238
• perf(improve): stop scanning comments once the summary is found by @PeterDaveHello in #4240
• perf(config): reuse the request-scoped git provider by @PeterDaveHello in #4243
• perf(review): skip ticket lookups for unchanged incremental reviews by @PeterDaveHello in #4236
• perf(gitlab): avoid redundant project fetches before comparisons by @PeterDaveHello in #4242
• perf(webhooks): release body chunks before processing requests by @PeterDaveHello in #4208
• perf(similar_issue): narrow LanceDB lookups to candidate issue IDs by @PeterDaveHello in #4211
• perf(describe): index file statistics when rendering walkthroughs by @PeterDaveHello in #4213
• perf(help_docs): stop the root README scan before descending by @PeterDaveHello in #4207
• perf(similar_issue): skip unused comments when preparing queries by @PeterDaveHello in #4212
• perf(review): avoid extracting code snippets that are not displayed by @PeterDaveHello in #4210
• perf(similar_issue): batch embeddings before individual retries by @PeterDaveHello in #4189
• perf(diff): normalize excluded extensions once per file batch by @PeterDaveHello in #4187
• perf(github): reduce API calls for paginated lists by @PeterDaveHello in #4184
• perf(github-action): skip unused provider initialization by @PeterDaveHello in #4181
• perf(changelog): skip waits when no follow-up review is needed by @PeterDaveHello in #4185
• perf(gitlab): skip project lookup when fetching a merge request by @PeterDaveHello in #4183
• perf(github): reuse revision-pinned file contents across commands by @PeterDaveHello in #4165
• perf(similar_issue): avoid eager issue pagination during indexing by @PeterDaveHello in #4169
• perf(gitlab): reduce pagination requests for commit messages by @PeterDaveHello in #4164
• perf(gitlab): avoid project fetch before language stats by @PeterDaveHello in #4163
• perf(github): fetch issue sub-issues in one GraphQL request by @PeterDaveHello in #4157
• perf(ask_line): avoid full PR reads for language logging by @PeterDaveHello in #4156
• perf: defer Gitea diff and commit fetches by @utsab345 in #4103
• perf(improve): avoid truncation work for required suggestion chunks by @PeterDaveHello in #4146
• perf(config): reuse remote extra config payloads per request by @PeterDaveHello in #4043
• perf(codecommit): cache completed empty file lists by @oleksii-tumanov in #4127
• perf(bitbucket): avoid unused Server base lookups by @oleksii-tumanov in #4108
• perf: batch LanceDB issue index checks by @utsab345 in #4115
• perf(gitlab): cache verified empty diff results by @PeterDaveHello in #4085
• perf(github): limit thread lookup to root comments by @PeterDaveHello in #4113
• perf(github): filter check-run lookups by name by @PeterDaveHello in #4112
• perf(github): reuse command provider for polling reactions by @PeterDaveHello in #4084
• perf(gitlab): skip fetching MR commits without an incremental anchor by @PeterDaveHello in #4147

📚 Documentation

• docs: clarify setup steps and section hierarchy across guides by @PeterDaveHello in #4342
• docs: clarify the uv version requirement in CONTRIBUTING.md by @PeterDaveHello in #4308
• docs: add review checklist by @utsab345 in #4298
• docs: add "Incorrect API key provided: dummy_key" to the GitHub Action troubleshooting list by @qwist1233-cpu in #4199
• docs: stop examples from repeating the primary model in fallback_models by @utsab345 in #4205
• docs: Scope agent lint fixes to changed files and preserve valid ignores by @PeterDaveHello in #4159
• docs: add API Route configuration example by @DennyHo0917 in #4153
• docs: Align AGENTS.md with repository configuration and test workflows by @PeterDaveHello in #4158

🧹 Maintenance

• chore(deps): Upgrade Langfuse to v4 for continued SDK and server support by @PeterDaveHello in #4343
• chore(docker): refresh pinned Lambda Python 3.14 base image by @PeterDaveHello in #4309
• chore(docker): upgrade Python base image to 3.14.9 by @PeterDaveHello in #4316
• chore: upgrade Ruff to 0.17.2 by @utsab345 in #4304
• chore: run pre-commit through uvx by @utsab345 in #4299
• chore(deps): Upgrade OpenTelemetry and virtualenv by @PeterDaveHello in #4271
• chore: add FURB ruff rules by @even-even in #4216
• chore: add UP ruff rule by @even-even in #4067
• chore(deps): update LiteLLM to 1.105.1 by @PeterDaveHello in #4151
• chore(models): use GPT-6.1 Sol defaults with GPT-6 Luna fallback by @PeterDaveHello in #4088

⬆️ Dependencies

• chore(deps): bump body-parser from 1.20.8 to 1.20.9 in /docs by @dependabot[bot] in #4352
• chore(deps): bump fast-uri from 3.1.8 to 3.1.9 in /docs by @dependabot[bot] in #4351
• chore(deps): bump undici from 7.29.1 to 7.30.1 in /docs by @dependabot[bot] in #4350
• chore(deps): bump launch-editor from 2.14.1 to 2.14.2 in /docs by @dependabot[bot] in #4218
• chore(deps): bump certifi from 2026.7.22 to 2026.10.19 by @dependabot[bot] in #4217
• chore(deps): bump follow-redirects from 1.16.0 to 1.16.1 in /docs by @dependabot[bot] in #4215
• chore(deps): bump the python-minor-and-patch group with 12 updates by @dependabot[bot] in #4192
• chore(ci): bump the actions-minor-and-patch group with 3 updates by @dependabot[bot] in #4191
• chore(deps): bump the docs-minor-and-patch group in /docs with 2 updates by @dependabot[bot] in #4190

Full Changelog: v0.48.0...v0.49.0