Merge branch 'main' into fix/gitattributes-nested-patterns

Author: brendan-kellam

.github/images/askSourcebot.gif

@@ -14,7 +14,23 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
+  # The image tags below are only enabled for `v*` tag refs. Fail fast with a
+  # clear error when dispatched from a branch rather than letting buildx fail
+  # with "tag is needed when pushing to registry".
+  validate-ref:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require a release tag ref
+        env:
+          REF: ${{ github.ref }}
+        run: |
+          if [[ "$REF" != refs/tags/v* ]]; then
+            echo "::error::Cloud production releases must run against a release tag (got '$REF'). Re-run with: gh workflow run release-cloud-prod.yml --ref v<version>"
+            exit 1
+          fi
+
   build:
+    needs: validate-ref
     uses: ./.github/workflows/_build-cloud.yml
     with:
       environment: prod

.github/images/code-context.svg

@@ -145,7 +145,7 @@ jobs:
       - name: Commit changes
         run: |
           git add CHANGELOG.md packages/shared/src/version.ts docs/api-reference/sourcebot-public.openapi.json
-          git commit -m "[skip ci] Release v$VERSION"
+          git commit -m "Release v$VERSION"
 
       - name: Push to temporary branch
         id: push_temp_branch

.github/images/codeSearch.gif

@@ -7,8 +7,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+- Silenced a false-positive `MaxListenersExceededWarning` logged on every request proxied through an external rewrite. [#1697](https://github.com/sourcebot-dev/sourcebot/pull/1697)
+- Upgraded `brace-expansion` to `^1.1.21`, `^2.1.7`, and `^5.0.12`. [#1700](https://github.com/sourcebot-dev/sourcebot/pull/1700)
+- Upgraded `fast-uri` to `^3.1.8`. [#1701](https://github.com/sourcebot-dev/sourcebot/pull/1701)
+- Upgraded `nodemailer` to `^10.0.2`. [#1703](https://github.com/sourcebot-dev/sourcebot/pull/1703)
+- Upgraded `markdown-it` to `^14.3.2`. [#1702](https://github.com/sourcebot-dev/sourcebot/pull/1702)
+- Fixed Ask model selections reverting to a stale default after the model configuration changed during a browser session. [#1710](https://github.com/sourcebot-dev/sourcebot/pull/1710)
+- Upgraded `next` to `^16.3.8`. [#1709](https://github.com/sourcebot-dev/sourcebot/pull/1709)
+- Upgraded `seroval` to `^1.6.8`, `proxy-addr` to `^2.0.8`, `shell-quote` to `^1.12.0`, and `@grpc/grpc-js` to `^1.14.6`. [#1713](https://github.com/sourcebot-dev/sourcebot/pull/1713)
+- Upgraded `katex` to `^0.18.2` and `postcss-selector-parser` to `^7.1.6`. [#1717](https://github.com/sourcebot-dev/sourcebot/pull/1717)
+- Upgraded `engine.io` to `^6.6.11`, `source-map-js` to `^1.2.2`, `smol-toml` to `^1.9.0`, `fast-copy` to `^3.1.0`, and `dompurify` to `^3.4.16`. [#1714](https://github.com/sourcebot-dev/sourcebot/pull/1714)
+- Upgraded `golang.org/x/crypto` to `v0.56.0` and OpenTelemetry-Go exporters and SDK to `v1.45.0` in Zoekt. [#1716](https://github.com/sourcebot-dev/sourcebot/pull/1716)
+- Upgraded `@modelcontextprotocol/sdk` to `^1.32.1`. [#1719](https://github.com/sourcebot-dev/sourcebot/pull/1719)
+- Fixed `.gitattributes` `linguist-language` overrides being ignored for files in subdirectories. [#1692](https://github.com/sourcebot-dev/sourcebot/pull/1692)
+
+## [5.1.15] - 2026-09-29
+
 ### Added
 - Added login wall for code search for Ask GitHub. [#1680](https://github.com/sourcebot-dev/sourcebot/pull/1680)
+- [EE] Added support for promoting pending members to owner from the members table. [#1694](https://github.com/sourcebot-dev/sourcebot/pull/1694)
 
 ### Removed
 - Removed the Ask Sourcebot first-visit tutorial banner. [#1675](https://github.com/sourcebot-dev/sourcebot/pull/1675)
@@ -17,7 +35,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Fixed
 - Made the default home page configurable with `DEFAULT_HOME_VIEW_PAGE`, defaulting to Code Search and supporting Ask. [#1677](https://github.com/sourcebot-dev/sourcebot/pull/1677)
 - Require authentication for the streaming and blocking Ask APIs in Public SaaS deployments. [#1679](https://github.com/sourcebot-dev/sourcebot/pull/1679)
-- Fixed `.gitattributes` `linguist-language` overrides being ignored for files in subdirectories. [#1692](https://github.com/sourcebot-dev/sourcebot/pull/1692)
+- Bounded BullMQ job retention to keep Redis memory from growing with repo count, retaining only the latest job per repo, connection, and account. [#1693](https://github.com/sourcebot-dev/sourcebot/pull/1693)
+- Upgraded `ip-address` to `^10.7.2`. [#1695](https://github.com/sourcebot-dev/sourcebot/pull/1695)
 
 ## [5.1.14] - 2026-09-17
 

.github/workflows/release-cloud-prod.yml

@@ -14,7 +14,7 @@ ARG NEXT_PUBLIC_SENTRY_BACKEND_DSN
 ARG NEXT_PUBLIC_BUILD_COMMIT_SHA
 
 FROM node:24-alpine3.23 AS node-alpine
-FROM golang:1.25-alpine AS go-alpine
+FROM golang:1.26-alpine AS go-alpine
 # ----------------------------------
 
 # ------ Build Zoekt ------