[renovate]

This PR contains the following updates:

Package	Type	Update	Change
qodo-ai/pr-agent	action	minor	v0.48.0 → v0.49.0

---

Release Notes

qodo-ai/pr-agent

v0.49.0

Compare Source

⚠️ Upgrade notes

• GitHub polling needs an allowlist. New host-only github.polling_repositories = ["owner/repo", ...]; empty (the default) ignores every notification, so polling deployments must set it (#​4294).
• Jira project_keys = [] now disables lookups. The default is now ["*"]. If you set [] to mean "all projects", change it to ["*"] or remove it (#​4049).
• litellm.extra_headers is host-only. Repository .pr_agent.toml and comment arguments can no longer set it (#​4287).
• Default model is now gpt-6.1-sol with gpt-6-luna as fallback (was gpt-5.6 / gpt-5.6-terra). Pin config.model to keep the old one (#​4088).
• Langfuse SDK 4.18.0 needs self-hosted Langfuse 3.63.0+; use the langfuse_otel callback (#​4343).
• GitHub App token in Actions: set github.agent_login to <app-slug>[bot] so PR-Agent recognises its own comments (#​4329).

✨ Highlights

• pr-agent doctor preflights a deployment (#​4321).
• --json-output for /describe, /improve and /review (#​4265, #​4227, #​4226).
• Jira scoped API tokens (#​4250), /ask with the CI artifact as context (#​4176), globs in repo_context_files (#​4220), opt-in GitLab subgroup settings inheritance (#​4059).
• Security hardening: DNS rebinding block, repo-context path escapes, host-only config output, loguru diagnose off, more credential redaction (#​4252, #​4279, #​4293, #​4280, #​4328).

What's Changed

• Redact Stripe, Twilio and SendGrid credentials by @​IlyaKhalafi in #​4328
• ci(review): make self-hosted /improve post suggestions again by @​Yoel-qin in #​4174
• Enable automatic /review on new PRs (fixes #​4162) by @​kiranmutyala18 in #​4170

🚀 Features

• feat(artifacts): support multiple artifact files by @​utsab345 in #​4338
• feat(cli): add a doctor command to preflight the deployment by @​Yoel-qin in #​4321
• feat(describe): write the description to --json-output by @​Yoel-qin in #​4265
• feat(jira): support scoped API tokens by @​utsab345 in #​4250
• feat(repo-context): glob entries and fallback alternatives in repo_context_files by @​ira-at-work in #​4220
• feat(ask): include organizational skills in line-level answers by @​Yoel-qin in #​4225
• feat(review): list the files left out in the JSON output by @​Sajinthan in #​4226
• feat(improve): write suggestions to --json-output by @​Sajinthan in #​4227
• feat(ask): answer questions with the CI artifact as context by @​Yoel-qin in #​4176
• feat(help): prioritize a matching document in constrained prompts by @​oleksii-tumanov in #​4101
• feat(gitlab): add opt-in closest-subgroup settings inheritance by @​ashearin in #​4059
• feat(improve): retain equal summaries across files by @​oleksii-tumanov in #​4128

🐛 Bug Fixes

• fix(ask_line): defer handler setup until a diff hunk matches by @​oleksii-tumanov in #​4354
• fix(mosaico): retain tasks with bounded owner history by @​utsab345 in #​4337
• fix(add-docs): retry malformed model responses with fallback models by @​PeterDaveHello in #​4346
• fix(routing): count diff hunks without splitting patch lines by @​PeterDaveHello in #​4344
• fix: retry whitespace-only model completions by @​PeterDaveHello in #​4348
• fix(azure): reject incomplete linked work item responses by @​oleksii-tumanov in #​4173
• fix(algo): prefer exact source lines before fuzzy matching by @​PeterDaveHello in #​4340
• fix(similar_issue): use the supported Qdrant query API by @​PeterDaveHello in #​4341
• fix(azure): handle created events without a web link by @​oleksii-tumanov in #​4171
• fix(ask): answer with a note when every changed file is filtered out by @​sarankumar1325 in #​4336
• fix(gitlab): paginate repository directory listings by @​utsab345 in #​4332
• fix(github): let the operator name the agent login an app token posts as by @​sarankumar1325 in #​4329
• fix: reject boolean routing limits by @​utsab345 in #​4302
• fix: parse GitLab boolean settings by @​utsab345 in #​4303
• fix: stop Gitea changed-files pagination at the advertised total by @​fixfon in #​4306
• fix(describe): retain valid YAML file-description chunks by @​PeterDaveHello in #​4315
• fix(gitlab): preserve Git line boundaries when resolving fixed threads by @​PeterDaveHello in #​4313
• fix(improve): keep embedded fences inside summary diffs by @​PeterDaveHello in #​4312
• fix: skip generate_labels, add_docs and update_changelog when all files are filtered by @​swayamg20 in #​4307
• fix(help_docs): preserve fenced examples during cleanup by @​PeterDaveHello in #​4319
• fix: reject boolean body size limits by @​utsab345 in #​4301
• fix: normalize list settings consistently by @​utsab345 in #​4300
• fix: restrict polling to allowlisted repositories by @​utsab345 in #​4294
• fix: hide host-only configuration output by @​utsab345 in #​4293
• fix: anchor incremental reviews to agent comments by @​utsab345 in #​4292
• fix: require bot authorship for describe persistent comments by @​utsab345 in #​4291
• fix: authorize cross-project GitLab tickets by @​utsab345 in #​4290
• fix(config): keep litellm.extra_headers host-only by @​fixfon in #​4287
• fix: disable loguru diagnose and backtrace by @​utsab345 in #​4280
• fix: reject escaping repo context paths by @​utsab345 in #​4279
• fix(github): use the GraphQL endpoint on GitHub Enterprise Server by @​MaxFreedomPollard in #​4272
• fix(help_docs): preserve ranked documents that already fit by @​PeterDaveHello in #​4267
• fix(review): preserve source characters in patch-based snippets by @​PeterDaveHello in #​4268
• fix(review): resolve findings in a chunked review when none were cut by @​jadhavgaurav in #​4222
• fix(config): honor settings context selection by @​utsab345 in #​4251
• fix(ci): update uv security pin by @​utsab345 in #​4263
• fix(ignore): keep bracket expressions in string glob patterns by @​utsab345 in #​4245
• fix(skills): treat a string paths value as one path by @​utsab345 in #​4244
• fix: parse CRLF plain diffs correctly by @​strawberry-little-bear in #​4231
• fix(ignore): cap glob length by @​utsab345 in #​4259
• fix: treat scalar PR ignore settings as single values by @​kocaemre in #​4257
• fix(security): block DNS rebinding by @​utsab345 in #​4252
• fix: normalize scalar PR commands by @​utsab345 in #​4253
• fix(bitbucket): read ambiguous diff headers from patch metadata by @​utsab345 in #​4248
• fix(outputs): deliver the sinks off the event loop by @​utsab345 in #​4247
• fix(polling): avoid rerunning commands found in comment history by @​PeterDaveHello in #​4239
• fix(gitlab): publish notice for incomplete merge request diffs by @​Evhye38496 in #​4234
• fix(help): render static help without initializing an AI handler by @​PeterDaveHello in #​4241
• fix(labels): preserve label changes made during model calls by @​PeterDaveHello in #​4237
• fix(bedrock): stop sending temperature to GLM-5 by default by @​ira-at-work in #​4219
• fix(repo-context): survive a failed revision lookup by @​utsab345 in #​4246
• fix(algo): keep yaml fence stripping linear by @​utsab345 in #​4232
• fix: stop bare #N in comments, link text, colours and words becoming tickets by @​jay23606 in #​4198
• fix: prevent local config contents in log artifact while preserving PR comment by @​wjc2821296948 in #​4197
• fix(describe): fall back on unusable model responses by @​PeterDaveHello in #​4186
• fix(gitlab): avoid double-encoding submodule project paths by @​PeterDaveHello in #​4214
• fix(changelog): retry empty model responses before publishing by @​PeterDaveHello in #​4209
• fix(help_docs): recognize Unicode letters in documentation by @​PeterDaveHello in #​4206
• fix: skip review and describe when all files are filtered by @​utsab345 in #​4204
• fix(help_docs): recount tokens after cleaning documentation by @​PeterDaveHello in #​4188
• fix(review): preserve case-sensitive paths when merging chunks by @​PeterDaveHello in #​4182
• fix(gerrit): bound direct git and SSH commands by @​oleksii-tumanov in #​4177
• fix(plain-diff): decode Git-quoted file paths by @​Aling33 in #​4152
• fix(add_docs): preserve literal indentation in suggestions by @​oleksii-tumanov in #​4172
• fix(review): preserve corrected answers for the latest question by @​PeterDaveHello in #​4166
• fix(models): avoid same-model retries for authentication failures by @​PeterDaveHello in #​4167
• fix(diff): preserve non-LF characters when rebuilding patches by @​PeterDaveHello in #​4168
• fix(gitlab): pin repository settings to one revision by @​oleksii-tumanov in #​4093
• fix: require Bitbucket Server diff content by @​utsab345 in #​4111
• fix(github): read repository settings from one revision by @​oleksii-tumanov in #​4094
• fix(gitlab): retry not-ready merge request diffs with bounded backoff by @​Yoel-qin in #​4150
• fix: align Bitbucket patches by file path by @​utsab345 in #​4102
• fix(diff): split patches on newlines only so line numbers match git by @​porkedchop in #​4080
• fix(ask): parse markdown image URLs precisely by @​utsab345 in #​4087
• fix(review): merge chunked ticket entries by the real ticket by @​utsab345 in #​4139
• fix(jira): default project_keys to wildcard and empty list to disable lookups (#​3887) by @​itsvrushabh in #​4049
• fix(routing): retain displaced primary in colliding fallback chains by @​PeterDaveHello in #​4064
• fix(bitbucket): encode file paths in content reads by @​utsab345 in #​4095
• fix: preserve repeated override quote types by @​utsab345 in #​4129
• fix(review): cap merged chunk findings at num_max_findings by @​utsab345 in #​4138
• fix: keep quoted list settings as lists in parse_command by @​utsab345 in #​4070
• fix(github): scope API-URL classification to exact host + path prefix by @​depohmel in #​4143
• fix(github): refresh all PR label pages before replacement by @​PeterDaveHello in #​4083
• fix: discard stale plain diff context by @​utsab345 in #​4114
• fix: honor ignore rules in local diff providers by @​utsab345 in #​4110
• fix(gitea): skip inline comments on lines outside the diff by @​fbidu in #​4130
• fix(gitea): read renamed base from old path by @​utsab345 in #​4132
• fix(gitea): encode raw file content paths by @​jiuyueQ in #​4106
• fix: include DNS validation in URL fetch timeouts by @​oleksii-tumanov in #​4109
• fix(diff): bound context at adjacent hunks by @​utsab345 in #​4086
• fix(diff): decode UTF-16 file content correctly by @​utsab345 in #​4096
• fix(describe): preserve success when final feedback fails by @​oleksii-tumanov in #​4092
• fix(describe): skip file walkthrough entries with empty fields by @​utsab345 in #​4082
• fix(codecommit): report unreadable changed files by @​utsab345 in #​4133
• fix: avoid partial Azure incremental reviews by @​utsab345 in #​4099
• fix(bitbucket): prevent fork changelog writes by @​utsab345 in #​4098
• fix(gitlab): match ticket URLs to the configured origin by @​oleksii-tumanov in #​4097
• fix(similar_issue): retry after filtering excluded hits by @​oleksii-tumanov in #​4104
• fix: avoid invented GitLab file changes by @​utsab345 in #​4100

⚡ Performance

• perf(bitbucket): reuse the initial diffstat result by @​oleksii-tumanov in #​4356
• perf(github): avoid refetching inline question thread comments by @​PeterDaveHello in #​4345
• perf: defer unused per-file extended diff token counts by @​PeterDaveHello in #​4349
• perf(similar_issue): batch indexed issue lookups by @​PeterDaveHello in #​4339
• perf(gitlab): fetch incremental commits in larger pages by @​PeterDaveHello in #​4318
• perf(diff): release discarded extended patches before repacking by @​PeterDaveHello in #​4317
• perf(gitlab): load submodule mappings only for expandable changes by @​PeterDaveHello in #​4314
• perf(github): reuse revision-pinned configuration tree paths by @​PeterDaveHello in #​4311
• perf(context): expand repository globs only within the line budget by @​PeterDaveHello in #​4310
• perf(gitlab): reuse revision-pinned configuration tree paths by @​PeterDaveHello in #​4270
• perf(similar_issue): defer comments until an issue is indexable by @​PeterDaveHello in #​4269
• perf(gitlab): cache stable merge request changes by @​utsab345 in #​4254
• perf(gitlab): stop fetching discussions after finding the target by @​PeterDaveHello in #​4235
• perf(gitlab): count changed lines without splitting patches by @​PeterDaveHello in #​4238
• perf(improve): stop scanning comments once the summary is found by @​PeterDaveHello in #​4240
• perf(config): reuse the request-scoped git provider by @​PeterDaveHello in #​4243
• perf(review): skip ticket lookups for unchanged incremental reviews by @​PeterDaveHello in #​4236
• perf(gitlab): avoid redundant project fetches before comparisons by @​PeterDaveHello in #​4242
• perf(webhooks): release body chunks before processing requests by @​PeterDaveHello in #​4208
• perf(similar_issue): narrow LanceDB lookups to candidate issue IDs by @​PeterDaveHello in #​4211
• perf(describe): index file statistics when rendering walkthroughs by @​PeterDaveHello in #​4213
• perf(help_docs): stop the root README scan before descending by @​PeterDaveHello in #​4207
• perf(similar_issue): skip unused comments when preparing queries by @​PeterDaveHello in #​4212
• perf(review): avoid extracting code snippets that are not displayed by @​PeterDaveHello in #​4210
• perf(similar_issue): batch embeddings before individual retries by @​PeterDaveHello in #​4189
• perf(diff): normalize excluded extensions once per file batch by @​PeterDaveHello in #​4187
• perf(github): reduce API calls for paginated lists by @​PeterDaveHello in #​4184
• perf(github-action): skip unused provider initialization by @​PeterDaveHello in #​4181
• perf(changelog): skip waits when no follow-up review is needed by @​PeterDaveHello in #​4185
• perf(gitlab): skip project lookup when fetching a merge request by @​PeterDaveHello in #​4183
• perf(github): reuse revision-pinned file contents across commands by @​PeterDaveHello in #​4165
• perf(similar_issue): avoid eager issue pagination during indexing by @​PeterDaveHello in #​4169
• perf(gitlab): reduce pagination requests for commit messages by @​PeterDaveHello in #​4164
• perf(gitlab): avoid project fetch before language stats by @​PeterDaveHello in #​4163
• perf(github): fetch issue sub-issues in one GraphQL request by @​PeterDaveHello in #​4157
• perf(ask_line): avoid full PR reads for language logging by @​PeterDaveHello in #​4156
• perf: defer Gitea diff and commit fetches by @​utsab345 in #​4103
• perf(improve): avoid truncation work for required suggestion chunks by @​PeterDaveHello in #​4146
• perf(config): reuse remote extra config payloads per request by @​PeterDaveHello in #​4043
• perf(codecommit): cache completed empty file lists by @​oleksii-tumanov in #​4127
• perf(bitbucket): avoid unused Server base lookups by @​oleksii-tumanov in #​4108
• perf: batch LanceDB issue index checks by @​utsab345 in #​4115
• perf(gitlab): cache verified empty diff results by @​PeterDaveHello in #​4085
• perf(github): limit thread lookup to root comments by @​PeterDaveHello in #​4113
• perf(github): filter check-run lookups by name by @​PeterDaveHello in #​4112
• perf(github): reuse command provider for polling reactions by @​PeterDaveHello in #​4084
• perf(gitlab): skip fetching MR commits without an incremental anchor by @​PeterDaveHello in #​4147

📚 Documentation

• docs: clarify setup steps and section hierarchy across guides by @​PeterDaveHello in #​4342
• docs: clarify the uv version requirement in CONTRIBUTING.md by @​PeterDaveHello in #​4308
• docs: add review checklist by @​utsab345 in #​4298
• docs: add "Incorrect API key provided: dummy_key" to the GitHub Action troubleshooting list by @​qwist1233-cpu in #​4199
• docs: stop examples from repeating the primary model in fallback_models by @​utsab345 in #​4205
• docs: Scope agent lint fixes to changed files and preserve valid ignores by @​PeterDaveHello in #​4159
• docs: add API Route configuration example by @​DennyHo0917 in #​4153
• docs: Align AGENTS.md with repository configuration and test workflows by @​PeterDaveHello in #​4158

🧹 Maintenance

• chore(deps): Upgrade Langfuse to v4 for continued SDK and server support by @​PeterDaveHello in #​4343
• chore(docker): refresh pinned Lambda Python 3.14 base image by @​PeterDaveHello in #​4309
• chore(docker): upgrade Python base image to 3.14.9 by @​PeterDaveHello in #​4316
• chore: upgrade Ruff to 0.17.2 by @​utsab345 in #​4304
• chore: run pre-commit through uvx by @​utsab345 in #​4299
• chore(deps): Upgrade OpenTelemetry and virtualenv by @​PeterDaveHello in #​4271
• chore: add FURB ruff rules by @​even-even in #​4216
• chore: add UP ruff rule by @​even-even in #​4067
• chore(deps): update LiteLLM to 1.105.1 by @​PeterDaveHello in #​4151
• chore(models): use GPT-6.1 Sol defaults with GPT-6 Luna fallback by @​PeterDaveHello in #​4088

⬆️ Dependencies

• chore(deps): bump body-parser from 1.20.8 to 1.20.9 in /docs by @​dependabot[bot] in #​4352
• chore(deps): bump fast-uri from 3.1.8 to 3.1.9 in /docs by @​dependabot[bot] in #​4351
• chore(deps): bump undici from 7.29.1 to 7.30.1 in /docs by @​dependabot[bot] in #​4350
• chore(deps): bump launch-editor from 2.14.1 to 2.14.2 in /docs by @​dependabot[bot] in #​4218
• chore(deps): bump certifi from 2026.7.22 to 2026.10.19 by @​dependabot[bot] in #​4217
• chore(deps): bump follow-redirects from 1.16.0 to 1.16.1 in /docs by @​dependabot[bot] in #​4215
• chore(deps): bump the python-minor-and-patch group with 12 updates by @​dependabot[bot] in #​4192
• chore(ci): bump the actions-minor-and-patch group with 3 updates by @​dependabot[bot] in #​4191
• chore(deps): bump the docs-minor-and-patch group in /docs with 2 updates by @​dependabot[bot] in #​4190

Full Changelog: The-PR-Agent/pr-agent@v0.48.0...v0.49.0

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • Between 12:00 AM and 11:59 PM (* 0-23 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.