v2.263.0

Features

• CDC: download chunks in parallel in cache proxy (#11928) #11928 (Tyler French)

Bug Fixes

• clean up proxy chunked read (#11969) #11969 (Tyler French)
• CDC: CLI needs to forward Split/Splice (#11972) #11972 (Tyler French)
• website: clean up linebreak in changelog (#11986) #11986 (Tyler French)

Commits

• a136cee: Attempt 2: don't propagate client-identity header through the cache proxy (#11944) (Iain Macdonald) #11944
• a5eb532: Fix flaky TestCLILoginWebFlow_* tests and unquarantine (#11963) (Dan Stowell) #11963
• 26487f5: turn off remote repo contents cache (#11974) (Dan Stowell) #11974
• 5b25c85: Add CDC support to changelog (#11970) (Tyler French) #11970
• rename cache_proxy to cli/sidecar_proxy (#11975) #11975 (Tyler French)
• 1493c27: [FC] Eagerly unmap chunks in COWStores that expect sequential access (#11959) (Maggie Lou) #11959
• 64cae35: Clean up legacy CDC logic (#11471) (Tyler French) #11471
• 0d6fd90: Fix flaky TestLRU by flushing atime updates before GC (#11629) (Vanja Pejovic)
• 91fc0bc: Upgrade cadvisor to not depend on an old vulnerable docker version (#11965) (Zoey Greer) #11965
• e44698c: Upgrade @xmldom/xmldom for dependabot (#11983) (Zoey Greer) #11983
• 01a97c4: Upgrade sharp, removing our dep on a vulnerable version of tar-fs for dependabot (#11990) (Zoey Greer) #11990
• 3c4d096: Upgrade lodash for dependabot (#11991) (Zoey Greer) #11991
• 18f741c: Upgrade path-to-regexp for dependabot (#11993) (Zoey Greer) #11993
• 252bb38: [FC] Support writing diff snapshots directly on top of the memory snapshot (#11971) (Maggie Lou) #11971
• 15d19cd: Make /dev/shm size configurable (#11987) (Brandon Duffany) #11987
• f8e0da6: In sync mode, don't use async BES proxy (#11976) (Brandon Duffany) #11976
• cb27c7b: Remove race in testport on unix (#11992) (Vanja Pejovic) #11992
• load sh_binary / sh_test from @rules_shell (prep for Bazel 9) (#11996) #11996 (Dan Stowell)
• 4059d3e: Allow enabling EC2 and EKS detectors for tracing (#11985) (Brandon Duffany) #11985
• handle empty symlink targets (#11989) #11989 (Son Luong Ngoc)
• b660ca1: Fix errant double migration in testing (#11981) (Zoey Greer) #11981
• c735534: Skip registering task sizer if RBE is disabled (#12003) (Brandon Duffany) #12003
• 2daed19: Fix time units in new clickhouse usage table (#12002) (Brandon Duffany) #12002
• 5075e2a: Revert "[CLI] Fix late --bazelrc additions (#11658)" (#12006) (Maggie Lou) #12006
• 474afb9: Build the cache proxy image as multi-arch, like the executor (#11997) (Iain Macdonald) #11997
• a93db4c: Make the capability disabled state more obvious in Firefox. (#12001) (Vadim Berezniker) #12001
• 4a7efa5: Bump github.com/jackc/pgx/v5 from 5.9.0 to 5.9.2 (#11967) (dependabot[bot]) #11967
• fd111e4: Upgrade klauspost/compress to v1.18.5 (#12008) (Zoey Greer) #12008
• d2b1e6d: Fix bugs with delete_filecache_on_unclean_shutdown (#11998) (Brandon Duffany) #11998
• 5332bd9: Bump postcss from 8.4.31 to 8.5.10 in /website (#11994) (dependabot[bot]) #11994
• 5ec10c5: Bump uuid from 8.3.2 to 14.0.0 (#11968) (dependabot[bot]) #11968
• 7f16472: Add new columns derived from execution_id in clickhouse; and populate them (#11982) (Lulu Zhang) #11982
• 131841b: Fix 'n' value returned by filecache.Write (#12012) (Brandon Duffany) #12012
• 1aa827c: Don't alert on unix peers in client IP interceptor. (#11977) (Vadim Berezniker) #11977
• 5b69329: Rename action_digest to action_digest_hash (#12016) (Brandon Duffany)

v2.262.0

Features

• CDC: download large chunks in parallel (#11874) #11874 (Tyler French)

Commits

• 5a3203b: Address another edge case in exponentialBucketRange (#11932) (Brandon Duffany) #11932
• 49b888d: Add execution metadata size metrics (#11930) (Brandon Duffany) #11930
• f23516e: Flip --cache_proxy.cache_action_results default to true (#11934) (Iain Macdonald) #11934
• 2d493ab: Upgrade to bazel 9.1 and turn on R2C2 (#11935) (Tyler French) #11935
• support windows 386 release builds (#11870) #11870 (Son Luong Ngoc)
• disable Bazel idle shutdown (#11871) #11871 (Son Luong Ngoc)
• upgrade to 1.26.2 (#11937) #11937 (Son Luong Ngoc)
• bb02393: Put input fetch bitmap behind an experiment (#11933) (Brandon Duffany) #11933
• c094ebf: Upgrade rules_js and rules_ts (#11923) (Zoey Greer) #11923
• a5e3bbf: Add and use a shared breadcrumbs component (#11941) (Brandon Duffany) #11941
• 9532384: [CLI] Print run logs in bb view if they exist (#11896) (Maggie Lou) #11896
• 2eb3ff0: Revert "Stop propagating the client-identity header through the proxy" (#11943) (Iain Macdonald) #11943
• 7cbfcbf: Store ext4 images in filecache (#11890) (Brandon Duffany) #11890
• 3a21988: Allow disabling org join requests (#11939) (Brandon Duffany) #11939
• 7304b8d: [FC] By default, enable PCI for all executors (#11940) (Maggie Lou) #11940
• b7fe656: Propagate impersonation bit for api keys. (#11833) (Vadim Berezniker) #11833
• 21078c4: Enforce a timeout on distributed cache peer write stream operations (#11523) (Iain Macdonald) #11523
• 92f25b1: Upgrade yarn (#11942) (Zoey Greer) #11942
• e2c7e53: Bump tar-fs from 2.1.3 to 2.1.4 in /website (#11949) (dependabot[bot]) #11949
• 643c4cd: Bump ajv from 6.12.6 to 6.14.0 in /website (#11952) (dependabot[bot]) #11952
• 1897627: Bump js-yaml from 3.14.1 to 3.14.2 in /website (#11956) (dependabot[bot]) #11956
• 5ad285d: [FC] Support exporting full snapshots straight to a COWstore (#11882) (Maggie Lou) #11882
• ee36704: Bump path-to-regexp from 0.1.12 to 0.1.13 in /website (#11950) (dependabot[bot]) #11950
• fbb9c5b: Fix ext4 conversion logs (#11954) (Brandon Duffany) #11954
• 4e310b9: "Add changelog entry for run log streaming" (#11945) (Maggie Lou) #11945
• a5564a6: Record image pull cancelations, timeouts, and errors separately (#11951) (Dan Stowell) #11951
• d2175a7: Use strings.Builder instead of += (#11960) (Zoey Greer) #11960
• address comment on CopyFileRange (#11961) #11961 (Tyler French)
• 54d6832: Use strings.Builder instead of += (#11962) (Zoey Greer) #11962
• 411e5f8: Allow cache proxy to access restricted AC prefixes (#11957) (Dan Stowell) #11957
• a0a2a80: [WF] Add grafana graphs for new metrics (#11946) (Maggie Lou) #11946
• ce53d51: Add more info to executor card (#11964) (Siggi Simonarson) #11964

v2.261.0

Features

• show top inputs fetched by size (#11853) #11853 (Brandon Duffany)
• CDC: download executor inputs in chunks (#11884) #11884 (Tyler French)

Bug Fixes

• add ZSTD overhead to cdc buffers (#11889) #11889 (Tyler French)

Chores

• remove v2 manifest (#11916) #11916 (Tyler French)

Commits

• 0f6274f: Clean up some spurious dual-writer error logging (#11880) (Iain Macdonald) #11880
• 099a39d: Stop propagating the client-identity header through the proxy (#11888) (Iain Macdonald) #11888
• a3e0e99: Bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.96.0 to 1.97.3 (#11815) (dependabot[bot]) #11815
• 4fe10e9: Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.38.0 to 1.43.0 (#11825) (dependabot[bot]) #11825
• 30b4aaa: Pass blob metadata through singleflight to avoid AC lookup for waiters (#11891) (Dan Stowell) #11891
• 1d1acfe: Show warning/error level suggestions at the top of the page (#11893) (Brandon Duffany) #11893
• 808166f: Bump yaml from 1.10.2 to 1.10.3 in /website (#11686) (dependabot[bot]) #11686
• 50a5da9: Upgrade docusaurus to v3.10.0 (#11877) (Zoey Greer) #11877
• 3139a39: Add support for github webhook secret rotation (#11894) (Brandon Duffany) #11894
• ecf5e11: Increase vm log tail buffer size (#11901) (Brandon Duffany) #11901
• 1341c01: Add support for 'shared' filecache directories (#11895) (Brandon Duffany) #11895
• 3597e2f: Don't ignore errors initializing filecache (#11903) (Brandon Duffany) #11903
• 75ba58c: partition invocation CH table (#11905) (Lulu Zhang) #11905
• a0d759d: Include axe and experimental workflows executors in the dashboard (#11902) (Vanja Pejovic) #11902
• 247f80f: [FC] Support enabling PCI (#11829) (Maggie Lou) #11829
• 33517d5: Use test.no-sandbox exec property (#11911) (Zoey Greer) #11911
• b42478f: Allow server admins to update SAML IdP metadata URL. (#11907) (Vadim Berezniker) #11907
• 35ae6aa: Serialize rpcutil.Sender Send and CloseAndRecv on the underlying stream (#11892) (Iain Macdonald) #11892
• d4c3093: Bump github.com/jackc/pgx/v5 from 5.5.5 to 5.9.0 (#11904) (dependabot[bot]) #11904
• d70f7b4: Bump protobufjs from 7.4.0 to 7.5.5 (#11906) (dependabot[bot]) #11906
• 94bc437: Add Disk performance dashboard. (#11861) (Vadim Berezniker) #11861
• 635e79d: Bump requests from 2.32.4 to 2.33.0 (#11699) (dependabot[bot]) #11699
• b78ad88: Convert baremetal networking dashboard to Go. (#11913) (Vadim Berezniker) #11913
• 73de2e7: Skip AC lookup for in-progress executions in GetExecution (#11899) (Dan Stowell) #11899
• 0de85ad: Fix Mac Metrics dashboard (#11912) (Iain Macdonald) #11912
• f7bfa8c: Generate baremetal power dashboard using Go (#11914) (Brandon Duffany) #11914
• 51b0b88: [SS] Ensure all chunks exist remotely, even untouched chunks (#11908) (Maggie Lou) #11908
• 6446354: Use the new LRU configs for the lookaside cache (#11910) (Vanja Pejovic) #11910
• 78eb184: Bump node-exporter-full dashboard to upstream rev 45. (#11917) (Vadim Berezniker) #11917
• 07aae7f: Add an error rate graph to the networking dashboard. (#11915) (Vadim Berezniker) #11915
• 8211fd1: Bump github.com/go-git/go-git/v5 from 5.16.5 to 5.18.0 (#11919) (dependabot[bot]) #11919
• e0bcb8d: Allow setting arbitrary trace resource attributes (#10625) (Brandon Duffany) #10625
• b36efab: [SS] Add more verbose logs during snapshot writes (#11909) (Maggie Lou) #11909
• 26acd7f: [FC] Stop cloning SnapshotKeySet (#11925) (Maggie Lou) #11925
• 238d513: Enable chunking in proxy by default (#11924) (Tyler French) #11924

v2.260.0

Commits

• 95d42c3: Remove GitHub Actions cache steps from all workflows (#11865) (Dan Stowell) #11865
• 46f4a0f: Unquarantine TestServerBypassRegistry and fix gRPC server stop race (#11866) (Dan Stowell) #11866
• fb66650: add a test to repro the idempotency issue (#11860) (Lulu Zhang) #11860
• deac12f: dedupe FetchBlob requests in cache proxy (#11856) (Dan Stowell) #11856
• 28c870c: [RB] Improve remote bazel default commit logic (#11838) (Keith Smiley) #11838
• d617af1: [SS] Add docs for reducing disk snapshot size (#11820) (Maggie Lou) #11820
• 36bf8c2: Pass bazel workspace subdirectory to remote runner (#11858) (Keith Smiley) #11858
• b8d209f: Unquarantine TestCreateFailureHasStderr (#11867) (Dan Stowell) #11867
• c5e5c13: Fix TestTerminalOutput flake (#11873) (Dan Stowell) #11873
• ef610f8: Add default URLs for local testing (#11842) (Keith Smiley) #11842
• 02dfa1b: Link to target when spawn doesn't have digest (#11857) (Keith Smiley) #11857
• 2e417d7: Add mnemonic filter on executions page (#11855) (Keith Smiley) #11855
• 740d339: Handle missing 'latest' tag in release.py for first-time image pushes (#11876) (Dan Stowell) #11876
• f75d3f2: Clarify gateway log messages and remove unused files (#11878) (Tyler Williams) #11878
• 1c21c7a: Bump brace-expansion from 1.1.12 to 1.1.13 in /website (#11719) (dependabot[bot]) #11719
• 7417a2d: [cli] fix race in plugin output handler that drops final output (#11875) (Dan Stowell) #11875
• 4177013: Bump lodash from 4.17.23 to 4.18.1 in /website (#11786) (dependabot[bot]) #11786
• 6558638: Bump follow-redirects from 1.15.6 to 1.16.0 in /website (#11868) (dependabot[bot]) #11868
• 0789c2c: Suppress benign Canceled errors when closing distributed peer writers (#11879) (Iain Macdonald) #11879
• 9929e7c: Tweak globalstatus executor graphs (#11881) (Iain Macdonald) #11881
• 709eefe: Bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.43.0 (#11826) (dependabot[bot]) #11826
• 431629c: Add docs and changelog entry for MCP (#11885) (Brandon Duffany) #11885
• 4d6a02f: Track /mcp in HTTP route metrics (#11886) (Brandon Duffany) #11886
• d41b493: Tweak MCP docs title / sidebar label (#11887) (Brandon Duffany) #11887
• 73bfba0: Bump node-forge from 1.3.3 to 1.4.0 in /website (#11720) (dependabot[bot]) #11720
• e5cc7a6: Bump picomatch from 2.3.1 to 2.3.2 in /website (#11689) (dependabot[bot]) #11689
• a63854a: Bump path-to-regexp from 0.1.12 to 0.1.13 in /website (#11723) (dependabot[bot]) #11723
• 8db861e: Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (#11785) (dependabot[bot]) #11785
• 43715b5: Pass blob metadata through singleflight to avoid AC lookup for waiters (#11891) (Dan Stowell)

v2.259.0

Chores

• upgrade to 9.1.0rc1 and enable chunking (#11862) #11862 (Tyler French)

Commits

• remove serial upload path (#11747) #11747 (Tyler French)
• d90dd3d: add a partition clause to TestTargetStatuses (#11832) (Lulu Zhang) #11832
• check local BS cache before upstream, write on miss (#11782) #11782 (Dan Stowell)
• 1af69f2: document secret-env-overrides[-base64] platform properties (#11836) (Dan Stowell) #11836
• ef0758b: Fix a bug where missing metadata was treated like an error (#11835) (Vanja Pejovic) #11835
• 1a4143a: In local setup, make metadata servers wait for the app to run (#11837) (Vanja Pejovic) #11837
• 1f44573: Allow storing devbox snapshots remotely (#11834) (Tyler Williams) #11834
• 40b238d: fix typo in txn.go (#11847) (Lulu Zhang) #11847
• 5f0b779: [FC] Upgrade x86 to v1.15.1 (#11840) (Maggie Lou) #11840
• 502486f: [cli] Improve help with rc parsing (#11844) (Keith Smiley) #11844
• 68fe534: Extract NewBlobFetchKey for consistent deduping (#11839) (Dan Stowell) #11839
• 5a9d466: Prevent URL secret regex from matching across newlines (#11849) (Dan Stowell) #11849
• 8f1208b: make Container Image Pulls dash default to past 6 hours (#11852) (Dan Stowell) #11852
• 03a6a31: [cli] Add flags to 'bb help subcommand' (#11845) (Keith Smiley) #11845
• aada2b3: [CLI] Finalize invocation with executable status even if run log streaming fails (#11810) (Maggie Lou) #11810
• a60d47f: changelog for secret-env-overrides[-base64] platform props (#11854) (Dan Stowell) #11854
• 26d0b7c: remove chunking CI (#11864) (Tyler French) #11864
• b24d388: Add a public release of the Cache Proxy (#11756) (Iain Macdonald) #11756

v2.258.0

Commits

• da4fcda: [FC] Fix some snapshot logic (#11769) (Maggie Lou) #11769
• 5a23617: Don't check if filecache is closed unless unclean shutdown detection is enabled (#11801) (Tyler Williams) #11801
• ed55297: Add usermode wireguard SSH support to the CLI (#11792) (Tyler Williams) #11792
• ecf147f: Remove .internal because it's confusing (#11802) (Tyler Williams) #11802
• add tag->digest cache. (#11800) #11800 (Vadim Berezniker)
• 93477b6: [SS] By default, limit writes to default snapshot (#11778) (Maggie Lou) #11778
• 512973f: Provide better help (include flags) for ssh and ssh-server (#11804) (Tyler Williams) #11804
• enable R2C (#11655) #11655 (Son Luong Ngoc)
• honor RBE build metadata (#11788) #11788 (Son Luong Ngoc)
• 45e932c: Normalize github url when fetching token (#11803) (Maggie Lou) #11803
• e672aa4: Use fully qualified RPC names for capabilities_filter (#11766) (Brandon Duffany) #11766
• 177c72d: Extract tag->digest resolution code to separate function. (#11805) (Vadim Berezniker) #11805
• da1b66e: Set a TTL on the API key-to-JWT cache (#11806) (Iain Macdonald) #11806
• c7e20c2: Bump default value of --auth.ip_rules.cache_ttl from 5m to 2m (#11809) (Iain Macdonald) #11809
• 26e4e6b: [WF] Emit more detailed metrics (#11799) (Maggie Lou) #11799
• 26c51d5: Add 'bb box create' command (#11811) (Tyler Williams) #11811
• 3470a77: Compute a bitmap of downloaded files (#11795) (Brandon Duffany) #11795
• set instance name for CAS artifacts (#11814) #11814 (Vadim Berezniker)
• f326170: Slightly simplify manifest tag requests by digests. (#11812) (Vadim Berezniker) #11812
• 7200ef0: Allow the UI to call GetTree (#11807) (Brandon Duffany) #11807
• b26ecc7: Fix error handling in goinit wait4 (#11818) (Brandon Duffany) #11818
• 2b2c583: Remove warning log for expected errors when fetching github tokens (#11819) (Maggie Lou) #11819
• 32a4642: Add CAS write capability to impersonation keys. (#11808) (Vadim Berezniker) #11808
• dedupe digest fetches from upstream (#11813) #11813 (Vadim Berezniker)
• 2c83fec: Suppress usage for impersonation keys. (#11824) (Vadim Berezniker) #11824
• 7ce16ff: Add a reusable timing profile drop target (#11821) (Siggi Simonarson) #11821
• 6688683: Revert "bazel: enable R2C" (#11828) (Dan Stowell) #11828
• 560df15: Add a standalone timing profile page (#11823) (Siggi Simonarson) #11823
• 46f3dec: Allow dropping local timing profiles on invocation pages (#11822) (Siggi Simonarson) #11822
• infer unknown counter series (#11791) #11791 (Son Luong Ngoc)

v2.257.0

Bug Fixes

• CDC: bound the global concurrency (#11748) #11748 (Tyler French)

Chores

• cache_proxy: increase and bound CDC concurrency (#11762) #11762 (Tyler French)

Commits

• ee29bca: Simplify "OCI Image Fetches" dashboard (#11765) (Dan Stowell) #11765
• d1a88b4: Extend ociregistry to support multiple mirrors. (#11764) (Vadim Berezniker) #11764
• 1cb8f80: Strip port in ociregistry when matching domain. (#11771) (Vadim Berezniker) #11771
• 3f99c77: Add duration logging to linearizability test and fix BUILD comment (#11736) (Lulu Zhang) #11736
• f7e62f3: Toggle powerloss protection off (#11775) (Tyler Williams) #11775
• c8f1d4a: Add registry egress stats. (#11774) (Vadim Berezniker) #11774
• e443a17: Downgrade jwt_reparse from alert to debug log (#11759) (Iain Macdonald) #11759
• f90b24d: Add docs for GPU setup on kubernetes (#11697) (Brandon Duffany) #11697
• cbd75a8: Add changelog entry for improved GPU support (#11732) (Brandon Duffany) #11732
• 0f31baa: Add secret-env-overrides and secret-env-overrides-base64 platform properties (#11779) (Dan Stowell) #11779
• 5d490ee: add victoriametrics dashboard (#11777) (Lulu Zhang) #11777
• 7892450: Add a unary GetFileRange RPC to the API (#11739) (Brandon Duffany) #11739
• 4de1b84: Attempt 3: Register client identity in the cache proxy and provide it on remoteauth RPCs (#11753) (Iain Macdonald) #11753
• 7fd4738: add a "Peak External Registry Bytes Read / Sec" panel to the Container Image Pulls dash (#11781) (Dan Stowell) #11781
• 1ee68d6: Add flag to rewrite container image names. (#11783) (Vadim Berezniker) #11783
• bbf27cf: Introduce replication lag in porcupine tests (#11784) (Lulu Zhang) #11784
• 8ec73f1: shared.bazelrc: disable runfile links with remote_download_minimal (#11761) (Son Luong Ngoc) #11761
• 847e5c5: Experiment to rewrite container image name in the app. (#11789) (Vadim Berezniker) #11789
• 220c50b: [ocifetcher] Retry all HTTP requests inside FetchBlob* (#11793) (Dan Stowell) #11793
• f69b8fa: Don't return IP rules from GetIPRules RPC when enforcement is disabled (#11796) (Iain Macdonald) #11796
• 7885f6b: Add a test to consistent hash for adding and removing items (#11613) (Vanja Pejovic) #11613
• dbfc4a9: Speed up ociregistry test. (#11797) (Vadim Berezniker) #11797
• d0f3c2f: Add a basic wireguard gateway server (#11773) (Tyler Williams) #11773
• c24e791: Don't check if filecache is closed unless unclean shutdown detection is enabled (#11801) (Tyler Williams)
• add tag->digest cache. (#11800) (Vadim Berezniker)
• 19aa7c1: Normalize github url when fetching token (#11803) (Maggie Lou)

v2.256.0

Features

• CDC: upload executor outputs in parallel (#11743) #11743 (Tyler French)

Commits

• 1310350: Attempt to guard against powerloss in filecache (#11712) (Tyler Williams) #11712
• 6b6b895: update the test so that we are doing multiple rounds of stopping and restarting stores at random intervals (#11735) (Lulu Zhang) #11735
• 32f28d4: Auto example directories with only 1 child (#11737) (Keith Smiley) #11737
• 55e6721: Consolidate logic around fetching installation tokens (#11709) (Maggie Lou) #11709
• 144a7b2: Use t.Context() instead of context.Background() in clientidentity_test.go (#11738) (Iain Macdonald) #11738
• 79ed48d: [WF] Refresh GH token for remote runners at lease time (#11583) (Maggie Lou) #11583
• 8f81fc6: Use prebuilt bb CLI binary in //tools/lint (#11742) (Dan Stowell) #11742
• 45e2fd7: Revert "Attempt 2: Register client identity in the cache proxy and provide it on remoteauth RPCs (#11716)" (#11749) (Iain Macdonald) #11749
• 9f3d3f2: Add a gateway service definition for wireguard tunneling (#11757) (Tyler Williams) #11757
• ca5e1e1: Don't try to reparse JWTs if there's an auth error in the context (#11754) (Iain Macdonald) #11754
• 8dc495e: set limit on concurrent prom queries (#11755) (Lulu Zhang) #11755
• 4249063: Register KMS and crypter before caches to fix encryption errors from distributed cache peers (#11760) (Iain Macdonald) #11760
• 49b636d: Fix bb login allow_existing arg (#11758) (Brandon Duffany) #11758
• f90f3bd: Redact env vars with sensitive names in workflow logs (#11746) (Dan Stowell) #11746
• 85c0896: [buildfix] try bb, then bazel, then bazelisk (#11751) (Dan Stowell) #11751
• 23561a4: Remove Referer headers from redirects (#11763) (Keith Smiley) #11763
• 0b883a3: Better document.title behavior (#11767) (Siggi Simonarson) #11767
• 5606991: Toggle powerloss protection off (#11775) (Tyler Williams)
• 36c1590: Extend ociregistry to support multiple mirrors. (#11764) (Vadim Berezniker)
• 8fae545: Add registry egress stats. (#11774) (Vadim Berezniker)
• 07e483f: Downgrade jwt_reparse from alert to debug log (#11759) (Iain Macdonald)

v2.255.0

Features

• cache_proxy: add GroupID to read metrics (#11684) #11684 (Tyler French)
• add minimal MCP server (#11657) #11657 (Brandon Duffany)
• add CDI support to OCI runtime (#11687) #11687 (Brandon Duffany)
• CDC: enable executor uploads if the header is used (#11710) #11710 (Tyler French)

Performance Improvements

• add FS lookup fallback during filecache initial directory scan (#11708) #11708 (Brandon Duffany)

Commits

• b078f5a: Rename IP rules enforcement metadata to bypass semantics (#11685) (Iain Macdonald) #11685
• 97c2023: Allow distributed cache to use k8s APIs to discover peers (#11627) (Vanja Pejovic) #11627
• 3c1e713: Split flags to enable codesearch / kythe (#11693) (Tyler Williams) #11693
• f84a094: Bypass IP rule enforcement for outgoing atime-updater RPCs (#11692) (Iain Macdonald) #11692
• 93419f9: Bypass IP rule enforcement on outgoing auth RPCs (#11691) (Iain Macdonald) #11691
• 1aa4b0c: Bypass IP rule enforcement on outgoing hit tracker RPCs (#11690) (Iain Macdonald) #11690
• 49fe1ba: Better handle rollouts in distributed cache with kubediscovery (#11696) (Vanja Pejovic) #11696
• 74f6fb1: Extract cloud provider IP range fetching into a library (#11703) (Vanja Pejovic) #11703
• 55732c5: Add nvidia-cdi-hook to executor image (#11698) (Brandon Duffany) #11698
• 260ff86: Fix visibility for providerips package (#11706) (Vanja Pejovic) #11706
• f7c67c6: Fix auth headers not propagating through async atime updates (#11677) (Iain Macdonald) #11677
• e79484c: Allow kubediscovery to use node name instead of pod name as the key (#11705) (Vanja Pejovic) #11705
• f55a72d: Enable cache_proxy_test.TestIPRules (#11675) (Iain Macdonald) #11675
• apply platform transition (#11694) #11694 (Son Luong Ngoc)
• ca70257: Read firecracker's resolv.conf from host if possible (#11688) (Tyler Williams) #11688
• ff04188: Register client identity in the cache proxy and provide client identity on remoteauth RPCs (#11713) (Iain Macdonald) #11713
• 660a7f0: Revert "Register client identity in the cache proxy and provide client identity on remoteauth RPCs" (#11715) (Iain Macdonald) #11715
• 0e1dffa: Default to not warming up executor images (#11714) (Tyler Williams) #11714
• 510d1d7: Revert "Read firecracker's resolv.conf from host if possible" (#11717) (Maggie Lou) #11717
• 242eb3b: Add porcupine-based linearizability tests for metadata server (#11637) (Lulu Zhang) #11637
• fbe45db: Use host resolv.conf, specified by flag (#11721) (Tyler Williams) #11721
• 7fd0277: Correct workflow metal name (#11722) (Tyler Williams) #11722
• 46c6ced: Allow specifying which secrets to expand via platform props (#11718) (Tyler Williams) #11718
• 760bffa: Unquarantine passing tests, leave TODOs for remaining flaky tests (#11630) (Dan Stowell) #11630
• c39ed65: add a zookeeper dashboard (#11724) (Lulu Zhang) #11724
• 2f60e3f: Enable a few more guest configs needed for docker-in-firecracker (#11726) (Brandon Duffany) #11726
• 2fea599: Fix DefaultKeyProvider to include ES256 public keys for JWT verification (#11711) (Iain Macdonald) #11711
• 4130547: Bump rules_docker to d4d9234dfec0c4b24542d0c7f8184a858fa7c52f (#11727) (Dan Stowell) #11727
• 144d29a: Fix anon Build Website workflow (#11728) (Brandon Duffany) #11728
• 1d4ee31: Enable wireguard in firecracker kernels (#11725) (Tyler Williams) #11725
• dd95870: Add tests for githubapp (#11702) (Maggie Lou) #11702
• 9940dda: Attempt 2: Register client identity in the cache proxy and provide it on remoteauth RPCs (#11716) (Iain Macdonald) #11716
• 273f0e7: save the file into zookeeper.json instead of zookeeper (#11731) (Lulu Zhang) #11731
• 29c1e02: Add de-duplication metrics to executors (#11729) (Tyler French) #11729
• 2effec9: [CLI] Add startup option validation to parser (#11670) (Maggie Lou) #11670

v2.254.0

Bug Fixes

• increase bazelrc scanner buffer to handle long lines (#11612) #11612 (Sujay Biradar)
• CDC: BatchRead should read chunked blobs (#11678) #11678 (Tyler French)

Chores

• verbose grpc client-transport logging (#11659) #11659 (Tyler French)

Commits

• 99e9d8d: Revert "[WF] Don't recursively invoke the CLI" (#11660) (Maggie Lou) #11660
• ddcbadc: [FC] Limit syncing snapshot chunks to disk to running serially (#11661) (Maggie Lou) #11661
• d362960: [FC] Limit concurrency for writing snapshot chunks (#11662) (Maggie Lou) #11662
• 11e826a: show transfer savings in the CDC metrics (#11667) (Tyler French) #11667
• 88432e1: Remove client identity requirement from GetIPRules RPC (#11664) (Iain Macdonald) #11664
• 85e65cf: Revert "Remove client identity requirement from GetIPRules RPC" (#11669) (Iain Macdonald) #11669
• 9dc720b: [CLI] Fix late --bazelrc additions (#11658) (Maggie Lou) #11658
• 446b95e: Remove stale certs from ssh agent (#11354) (Brandon Duffany) #11354
• 0c6d84d: Build guest kernels with bazel (#11643) (Brandon Duffany) #11643
• e559534: Allow cache proxies to bypass IP rules when they attest enforcement (#11665) (Iain Macdonald) #11665
• afdf5fe: In traffic stats, only alert if RPC err is nil (#11671) (Vanja Pejovic) #11671
• 2421f7d: Create traffic stats dashboard (#11672) (Vanja Pejovic) #11672
• 091832a: Make more breadcrumbs right-clickable (#11674) (Siggi Simonarson) #11674
• 1e6f742: [WF] Support configuring bazel command in remote runners with workflow name (#11676) (Maggie Lou) #11676
• 51e5fd2: Clean up Okta SAML instructions. (#11680) (Vadim Berezniker) #11680
• 7ffc035: Update Okta SCIM instructions to cover Group sync. (#11682) (Vadim Berezniker) #11682
• f101923: Fix OCI image layer disk usage calculation (#11681) (Brandon Duffany) #11681
• 457a865: Revert "chore: verbose grpc client-transport logging" (#11683) (Tyler French) #11683
• 7b13985: Set x-buildbuddy-ip-rules-enforced bit on outgoing proxy requests (#11673) (Iain Macdonald) #11673
• 00555f3: [FC] Throttle more snapshot save operations (#11679) (Maggie Lou) #11679