Skip to content

chore(deps): update qodo-ai/pr-agent action to v0.48.0 - #320

Merged
renovate[bot] merged 1 commit into
mainfrom
renovate/qodo-ai-pr-agent-0.x
Oct 17, 2026
Merged

renovate[bot] merged 1 commit into
mainfrom
renovate/qodo-ai-pr-agent-0.x

Conversation

@renovate

@renovate renovate Bot commented Oct 17, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
qodo-ai/pr-agent action minor v0.47.0 → v0.48.0

Release Notes

qodo-ai/pr-agent

v0.48.0

Compare Source

⚠️ Breaking Changes

[!WARNING]
This release changes several defaults and makes more settings host-only. Check each item below against your deployment before upgrading.

  • pip install pr-agent no longer installs the git provider SDKs (#​3679): PyGithub, python-gitlab, atlassian-python-api, the Azure DevOps SDKs, boto3, giteapy, the Google Cloud SDKs and a2a-sdk moved to the github, gitlab, bitbucket, azure, codecommit, gitea, google and mosaico extras. Install the ones you use, for example pip install "pr-agent[github]", or pr-agent[all] for the previous set. The Docker images already install all.
  • Docker service images run as a non-root user (#​3910): the webhook, app, polling and Mosaico targets run as UID/GID 10001 with HOME=/home/pragent. Mounted secrets must be readable by that user, output and database directories must be writable, and home-relative mounts should move to /home/pragent. The GitHub Action, CLI and Lambda images still run as root.
  • Azure DevOps and Bitbucket Server webhooks require credentials (#​3911): with azure_devops_server.webhook_username/webhook_password or bitbucket_server.webhook_secret unset, every webhook is rejected with HTTP 403. Set them on both the sender and PR-Agent before upgrading.
  • GitLab webhooks backed by a secret provider need a new token format (#​3913): when GitLab credentials come from AWS Secrets Manager or Google Cloud Storage, the webhook's Secret Token must be <secret-name>:<webhook-token>. Name-only tokens are rejected with HTTP 401, so update the webhooks when you deploy.
  • Namespace-wide settings are off by default (#​3908): PR-Agent no longer applies <namespace>/pr-agent-settings to every repository automatically. Set the host-only config.global_settings_repo = "pr-agent-settings" to keep the old behaviour.
  • [tool.pr-agent] in pyproject.toml is no longer read (#​3941): move those settings to .pr_agent.toml.
  • More settings are host-only (#​3840, #​3904, #​3950, #​4001, #​4054): a repository's .pr_agent.toml and comment arguments can no longer set provider endpoints (openai.api_base and the other api_base keys), keys ending in url, endpoint, org, key, token or secret, provider auth mode and TLS settings (github.deployment_type, gitlab.auth_type/ssl_verify, bitbucket.auth_type, gitea.skip_ssl_verification/ssl_ca_cert), jira.jira_site/jira_api_email/project_keys, or LiteLLM callbacks. They are ignored with a warning, so set them in host configuration instead. Comment arguments are restricted further as well (#​3902).
  • Gitea and Gerrit read repository settings from the target branch (#​3906): Gitea uses the PR base and Gerrit the default branch, so a .pr_agent.toml change inside a PR no longer applies to that PR.
  • Cross-repository reads need an allowlist (#​3922, #​3897): GitHub ticket context only reads linked issues and sub-issues from the PR's own repository or same-owner repositories listed in config.repo_context_sibling_repos. gitlab.expand_submodule_diffs only expands submodules listed there that sit in the MR's top-level group.
  • Ignore rules now cover comment commands (#​3943): config.ignore_pr_authors, ignore_pr_labels, ignore_pr_title, the branch rules and ignore_repositories now skip manually triggered commands too, not only automatic ones.
  • merge_recommendation values were renamed (#​4010): with pr_reviewer.require_merge_recommendation on, safe_to_merge is now no_concerns_found and merge_with_caution is now needs_review. changes_required is unchanged. Update anything that parses review output.
  • /describe comments no longer repeat the PR description (#​4118): with pr_description.publish_description_as_comment = true, the comment leaves out the User Description section even when add_original_user_description is on, because the PR body is left untouched.
  • Smaller behaviour changes: webhook servers reject request bodies over 5 MiB with HTTP 413 (config.max_webhook_request_body_bytes, #​3820). A positive config.max_output_tokens below 4096 is raised to 4096 (#​4013). /describe and /generate_labels drop model labels outside the PR types and enabled custom labels (#​3899).

What's Changed

🚀 Features

🐛 Bug Fixes

⚡ Performance

📚 Documentation

🧹 Maintenance

⬆️ Dependencies

Full Changelog: The-PR-Agent/pr-agent@v0.47.0...v0.48.0


Configuration

📅 Schedule: (in timezone Asia/Tokyo)

  • Branch creation
    • Between 12:00 AM and 11:59 PM (* 0-23 * * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from a5chin as a code owner October 17, 2026 02:21
@renovate renovate Bot added the renovate label Oct 17, 2026
@renovate
renovate Bot merged commit 80cec20 into main Oct 17, 2026
6 checks passed
@renovate
renovate Bot deleted the renovate/qodo-ai-pr-agent-0.x branch October 17, 2026 04:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants