Commit Graph
38141 Commits
Author SHA1 Message Date
Alex Lachance 7e6e731bce python: Fix splat parameter highlighting (#58136)
In the current Python Tree-sitter `highlights.scm`, splat parameters
(e.g., `*args`, `**kwargs`) and typed splat parameters are not
highlighted as `@variable.parameter` due to missing patterns.

This PR adds `list_splat_pattern` and `dictionary_splat_pattern` to the
function parameter rules so splat parameters are correctly colored.

| Before | After |
|
:---------------------------------------------------------------------------------------------------------------------------------:
|
:--------------------------------------------------------------------------------------------------------------------------------:
|
| <img width="688" height="482" alt="image"
src="https://github.com/user-attachments/assets/dbb04e09-51a2-401a-8239-d244a01a02f9"
/> | <img width="686" height="480" alt="image"
src="https://github.com/user-attachments/assets/f07518ec-30fd-4067-b59d-e090da8182c3"
/> |


Self-Review Checklist:

- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [ ] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable

Release Notes:

- Fixed Python splat parameters highlighting
2026-06-01 15:07:09 +00:00
Ben Brandt 94f36f54a7 terminal: Add backend-neutral terminal types (#57483)
Refactor to isolate alacritty types into the terminal crate and offers
comparable apis where needed for similar functionality. However, these
are Zed-owned types instead of the dependency leaking across multiple
crates, making alacritty an implementation detail of the terminal crate.

Self-Review Checklist:

- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable

Release Notes:

- N/A
2026-06-01 14:49:31 +00:00
Richard Feldman b259b346bf Add context compaction markers (#58089)
Adds the flat context compaction marker data model and replays persisted
markers into native agent transcripts as static dividers. This lets
compacted thread boundaries deserialize, render, and export to Markdown
without enabling automatic compaction behavior yet.

Release Notes:

- Improved agent threads to show restored context compaction dividers in
conversations
2026-06-01 14:29:15 +00:00
MartinYe1234andCole Miller 4fe71ffcc6 Load project skills through worktree buffers (#58094)
Project-local skills now load through project buffers so remote
workspaces can resolve them consistently with other project files.

Validation:
- cargo check -p agent_skills -p agent
- cargo test -p agent_skills
- cargo test -p agent skills

Closes AI-329

Closes https://github.com/zed-industries/zed/issues/57877

Release Notes:

- Improved project skills support in remote workspaces.

---------

Co-authored-by: Cole Miller <cole@zed.dev>
2026-06-01 13:23:28 +00:00
Finn Eitreim 988845da83 project: Add fuzzy search in remote projects dialogue (#54143)
Stacked on top of #54123
This is part 3 of 3 towards #51197
More details from the original PR
https://github.com/zed-industries/zed/pull/53551

This PR implements fuzzy search in the remote projects dialogue, using
the `fuzzy_nucleo::match_strings` introduced in #54123.

## remote project search

The reviews of https://github.com/zed-industries/zed/pull/51197 seemed
to indicate that performance was important here so it runs async and
cancels the previous stale request when a new character is typed.

other features:
text highlighting of what was being typed, similar to other fuzzy
searches.
reorder the projects on the list based on the maximum score from its
projects.

video of it in action:


https://github.com/user-attachments/assets/86b3ed85-fc29-46fb-b3c4-c0cbc3bf8edd

Self-Review Checklist:

- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable

Closes #53318

Release Notes:

- recent_projects: Added fuzzy search to the remote projects modal.
2026-06-01 13:14:28 +00:00
Henrique Ferreiro bc823dbbbd git_store: Coalesce refresh pathspecs (#56406)
Coalesce repo-relative paths before refreshing git status and diff
state. The worktree scanner can report both a directory and its
descendants in the same repository bucket, which makes git receive
redundant pathspecs.

This keeps refresh commands smaller for large repositories such as
Chromium, reducing git pathspec matching work and improving status
refresh performance during large worktree updates, as the initial repo
scan.

Partially fixes #43861

Release Notes:

- Reduced git CPU usage on large repos
2026-06-01 12:28:20 +00:00
Smit Barmase 0045814a0d editor: Fix newline outdent when tab size is greater than current indent size (#58221)
This fixes no-op on the newline outdent path when the settings tab size
is greater than the current indent size.

Release Notes:

- Fixed pressing Enter on an empty nested Markdown list item when the
tab size is larger than the list indentation.
2026-06-01 11:53:54 +00:00
liamanddino 86e195ba9a terminal: Enable copy and paste in edit menu (#58111)
Resolves https://github.com/zed-industries/zed/issues/57999

This diff fixes the macOS Edit menu showing Copy and Paste as disabled
when a terminal is focused. Terminal shortcuts already worked because
keybindings dispatch `terminal::Copy` and `terminal::Paste`, but the app
menu validates `editor::Copy` and `editor::Paste`, which the terminal
view did not expose.

With this change, the terminal view handles the editor Copy and Paste
actions by delegating to the existing terminal copy and paste paths.
This keeps keyboard behavior unchanged while allowing menu validation
and menu dispatch to work correctly for focused terminals.

Release Notes:
- Fixed `Copy` and `Paste` being disabled in the macOS `Edit` menu when
a terminal is focused.

---------

Co-authored-by: dino <dinojoaocosta@gmail.com>
2026-06-01 11:40:47 +00:00
Tom Houlé 95d9cf1411 agent_ui: Remove the staff-only gate on fast mode toggle (#57914)
This releases fast mode to everyone. Will cherry pick to preview.

Release Notes:

- Added "Fast mode" support in the agent panel for Anthropic and OpenAI
models that support a toggle to get faster responses (fast mode for
Anthropic and priority service tier for OpenAI) at increased per-token
cost.
2026-06-01 11:12:50 +00:00
Lena 195dca45a5 Notify on slack when new label is created (#58224)
To keep the area-to-track mapping up to date, notify the team whenever
someone creates a new `area:` or `platform:` label prompting them to
choose which Track it belongs to on the “Community PRs by area” board.

Release Notes:

- N/A
2026-06-01 11:07:40 +00:00
Danilo LealandBennet Bo Fenner 46ac5758a5 agent_ui: Add some more improvements to the draft UX (#57692)
Closes AI-313

This PR makes sure an empty draft thread is reflected in the sidebar by
an empty thread item. The main goal of this change is to make the
existence of the drafts feature more intuitive and clear. We don't only
display the draft item now when moving away from it, but rather whenever
you're focused on it.

Release Notes:

- Agent: Improved the UX of the draft feature by always displaying a
corresponding thread item in the sidebar, even if the thread was still
empty.

---------

Co-authored-by: Bennet Bo Fenner <bennetbo@gmx.de>
2026-06-01 08:05:44 +00:00
Mayank Verma 137eeea67b gpui: Allow repositioning macOS traffic lights at runtime (#58169)
Self-Review Checklist:

- [x] I've reviewed my own diff for quality, security, and reliability
- [ ] Unsafe blocks (if any) have justifying comments
- [ ] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [ ] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable

Release Notes:

- N/A

Right now we can only set the traffic light position when creating a
window. This adds a public API so that we can update the position at
runtime, such as when titlebar height or layout changes dynamically.
2026-06-01 07:21:45 +00:00
Jake Nelson 6a7b2bc1e2 workspace: Treat remote roots as directories (#54733)
## Summary

- Add a regression test covering reopening an already-open remote
workspace root inside the reused workspace path
- Use the resolved worktree entry instead of the local filesystem when
`Workspace::open_paths` decides whether a reused path is a directory
- This fixes the follow-on case where reopening an already-open SSH
workspace root could show `Error: opening project path ...` because the
remote root was being treated like a local file open

I kept this fix in `Workspace::open_paths` rather than adding another
remote-specific branch higher up, because the bug was specifically in
the generic reused-workspace directory check.

## Testing

- `cargo test -p recent_projects
test_reopen_existing_remote_root_treats_root_as_directory --
--nocapture`
- `cargo test -p recent_projects
test_reuse_existing_remote_workspace_window_with_tilde_path --
--nocapture`
- `cargo test -p recent_projects
test_reuse_existing_remote_workspace_window -- --nocapture`

Self-Review Checklist:

- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] Tests cover the new/changed behaviour
- [x] Performance impact has been considered and is acceptable

Related to #30829

Release Notes:

- Fixed reopening an already-open SSH workspace root showing an `opening
project path` error instead of treating the root as a directory
2026-06-01 07:13:03 +00:00
Tim Vermeulen 5f038c2a3a git_graph: Exclude non-standard refs (#54291)
My second take on uncluttering the git graph after #53692, this time by
simply replacing `git log --all` with `git log --ignore-missing
--branches --remotes --tags HEAD`. Thanks @JonGretar for educating me on
this 🙂

This pretty much mirrors which commits VSCode's built-in git graph shows
when selecting "All history item references" (though VSCode has an extra
`git for-each-ref` step):
https://github.com/microsoft/vscode/blob/341ef7db2e1d95f96c9f63c40a518d25bb455188/extensions/git/src/git.ts#L1280-L1344

Self-Review Checklist:

- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable

Release Notes:

- Git Graph: Now excludes commits that aren't reachable from branches or
tags.
2026-06-01 06:55:57 +00:00
Alvaro Parker 0bd41d67b9 editor: Add toggle breadcrumb action (#57970)
Self-Review Checklist:

- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable

Closes #55576

This PR adds a new `editor: toggle breadcrumb` actions that toggles the
breadcrumbs for the active item without persisting on `settings.json`.
Similar to what `editor: toggle minimap` does.


https://github.com/user-attachments/assets/7179a0c8-6a5e-4716-86b8-abde8aa61f68

A simple test was added to check that using this action doesn't change
the settings, and that changing an unrelated setting keeps the toggled
action as the source of truth for the breadcrumb visibility.

Release Notes:

- Added `editor: toggle breadcrumb` action to toggle breadcrumb of
active item without persisting on `settings.json`
2026-06-01 06:55:52 +00:00
Remco Smits 735980b158 markdown: Fix text selection position in centered/right-aligned markdown table cells (#57283)
Table header cells are always center-aligned. When selecting text in
them, the selection highlight was drawn at the left edge of the cell
instead of over the actual visible text. Clicking on a character also
mapped to the wrong source index.

The bug was that `bounds_for_source_range` and
`source_index_for_position` used raw layout x-coordinates (which start
at 0), without accounting for the horizontal offset GPUI applies when
rendering center- or right-aligned text.

The fix stores the `TextAlign` on each `RenderedLine` at flush time,
then uses it to compute an alignment offset per wrapped row segment.
That offset is:
- subtracted from the click position before resolving it to a source
index
- added to the x-coordinates when computing selection highlight bounds

**Before**:


https://github.com/user-attachments/assets/49fd7748-eb1b-4199-bc2f-23cddcb528c5

**After**:


https://github.com/user-attachments/assets/93657652-d548-4e5a-b011-be29bb0a3d9e


Self-Review Checklist:

- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [ ] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable

Release Notes:

- Markdown: Fixed text selection highlight appearing at the wrong
position when selecting text in markdown table headers.
2026-06-01 06:54:27 +00:00
954ee58c15 worktree: Fix linked worktree git dir event handling (#57782)
When a linked worktree receives fs events for its .git directory, the
event path resolves to the per-worktree git dir (e.g.
main_repo/.git/worktrees/<name>), not the .git directory itself or the
common dir. The existing match only checked common_dir_abs_path and
repository_dir_abs_path, causing the repository entry to be missed and
then removed as stale.

Add dot_git_abs_path to the match, and fix the staleness metadata check
to use dot_git_abs_path (the actual .git entry) rather than
common_dir_abs_path (which may be outside the worktree root).

Extracted from https://github.com/zed-industries/zed/pull/53453

Release Notes:

- N/A or Added/Fixed/Improved ...

---------

Co-authored-by: Kieran Freitag <kfreitag@kieran.ca>
Co-authored-by: zed-zippy[bot] <234243425+zed-zippy[bot]@users.noreply.github.com>
2026-06-01 06:52:58 +00:00
Xin Zhao 29dc988f15 editor: Fix missing background highlights in multibuffer find-all-references (#55863)
Self-Review Checklist:

- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [ ] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable

The root cause is in this part of code:

https://github.com/zed-industries/zed/blob/f5945344cc21ebff07eb7ea04dab0555fbe49007/crates/editor/src/editor.rs#L19446-L19464
The ranges across multibuffer are stored in the order of the HashMap
iterator, which is not sorted at all. They are then consumed by
`background_highlights_in_range()`, which uses a binary search that
requires the ranges to be sorted:

https://github.com/zed-industries/zed/blob/f5945344cc21ebff07eb7ea04dab0555fbe49007/crates/editor/src/editor.rs#L24127-L24135
The fix sorts the ranges by multibuffer anchor position before storing
them.

Release Notes:

- Fixed missing background highlights in "Find All References" when
results span multiple files.
2026-06-01 06:49:03 +00:00
Kyle Kelley fcf45c6dbe project: Scope terminal toolchain lookup to the terminal's worktree (#56787)
`create_terminal_task` and `create_terminal_shell_internal` previously
built their toolchain candidate list as `[active_editor_entry.path,
...visible_worktrees]` and used the first one with a persisted
toolchain. A Python toolchain persisted for worktree A would leak into a
terminal opened in worktree B of the same window: with a conda env
selected for one project, every terminal in every other project of the
window inherited that env's activation at startup.

This scopes the candidate list to the worktree that contains the
terminal's CWD. Both call sites now derive candidates from
`find_worktree(path)`, where `path` is the terminal's resolved CWD
(`spawn_task.cwd` or `active_project_directory`). If the path lives in a
worktree, lookup runs scoped to that worktree's id. If not, no toolchain
is applied.

## Design decision

The previous fallback chain (active editor's worktree, then all visible
worktrees) is removed entirely. Both fallbacks were sources of the leak:

- "Active editor's worktree" is order-dependent: opening a terminal in
worktree B picks up worktree A's toolchain because a file in A is
focused.
- "All visible worktrees" is worse, since the first worktree with any
persisted toolchain wins.

Workflows that relied on either fallback need to set the toolchain
explicitly on the worktree where the terminal is opened.

## Coverage

`cargo check -p project` is clean. There is no unit test for the
cross-worktree case; that would require a multi-worktree Project fixture
with persisted toolchains, which doesn't exist in the test suite today.
Reproduction is straightforward: open a workspace with two folders,
select a Python toolchain in one, open a terminal in the other, and
observe the leaked activation script in the spawned shell.

Release Notes:

- Fixed Python toolchains persisted for one worktree leaking into
terminals opened in other worktrees of the same workspace.
2026-06-01 06:47:50 +00:00
Mayank Verma 507d043d96 gpui: Fix stuck tooltips after mouse leaves origin (#58134)
Self-Review Checklist:

- [x] I've reviewed my own diff for quality, security, and reliability
- [ ] Unsafe blocks (if any) have justifying comments
- [ ] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable

Release Notes:

- N/A

I encountered this bug while building my app with GPUI where tooltips
were getting stuck when i move my mouse away from the origin element.

Zed kinda gets away with it because tab close buttons use
`visible_on_hover`, so when the mouse leaves the tab, close button
disappears. This triggers a redraw which makes GPUI recheck and hide the
tooltip.

In the "Before" version i had to trigger the recheck by moving my mouse
over an element with hover styles to make the tooltip disappear.

### Before


https://github.com/user-attachments/assets/f405620f-6d6d-4a24-8992-214180bc7b76

### After


https://github.com/user-attachments/assets/2e41fbca-af61-4f34-bd5d-ab288f34e73a
2026-06-01 06:47:23 +00:00
Kyle Kelley 7cb01e42ef python: Stop falling back to conda activate base for nameless toolchains (#56785)
Stops the `conda activate base` fallback in
`PythonToolchainProvider::activation_script` for two cases:

1. A Conda toolchain whose `environment.name` is `None`.
2. A Conda toolchain whose name is `Some(...)` but `shell.try_quote`
rejects it.

Previously both cases pushed `conda activate base` into the activation
script. With miniforge installed and no env explicitly selected, every
terminal silently activated `(base)`. The user didn't pick `base`;
injecting it is contamination.

Both branches now log a warning and emit no activation line. Users who
want `(base)` can select it as the toolchain explicitly.

Two unit tests cover the new behavior:
`test_conda_activation_skips_when_name_missing` (name=None) and
`test_conda_activation_skips_unquotable_name` (name=Some but unquotable,
exercised with an embedded NUL byte that `shlex::try_quote` rejects).
The existing `test_conda_activation_script_injection` still verifies
that quotable names get activated.

Release Notes:

- Fixed Zed silently injecting `conda activate base` into terminals when
a Conda manager (miniforge/miniconda) was installed but no specific
environment was selected.
2026-06-01 06:45:53 +00:00
Xin Zhao ee591c04ae python: Sync built-in highlights with Python 3.15 (#57562)
Self-Review Checklist:

- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [ ] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable

This PR updates the Python built-in functions and types in Zed's syntax
highlighting query to align with the official Python 3.15 documentation.
It also backports a few missing built-ins from earlier Python versions.

**Things added**:
- Added the newly introduced
[`sentinel`](https://docs.python.org/3.15/whatsnew/3.15.html#whatsnew315-sentinel)
built-in function.
- Added the new
[`frozendict`](https://docs.python.org/3.15/whatsnew/3.15.html#whatsnew315-frozendict)
built-in type.
- Added `aiter` and `anext` (originally introduced in Python 3.10) to
ensure the built-ins list is complete.

With this change, Zed's built-in function list is now fully aligned with
the latest [Built-in functions in
Python](https://docs.python.org/3.15/library/functions.html).

To note, Python 3.15 introduces a new [`lazy`
keyword](https://docs.python.org/3.15/whatsnew/3.15.html#whatsnew315-lazy-imports)
for explicit lazy imports. Fully supporting this requires upstream
changes in `tree-sitter-python` (tracked in
tree-sitter/tree-sitter-python#336). Therefore, support for the `lazy`
keyword is not included in this PR.

| Before | After |
| :---: | :---: |
| <img width="512" height="182" alt="before"
src="https://github.com/user-attachments/assets/d96b9128-61f3-422b-a7e0-fdb87d547474"
/> | <img width="569" height="219" alt="after"
src="https://github.com/user-attachments/assets/82702fbe-e423-47cb-9e88-d665c17be2e5"
/> |



Release Notes:

- Improved Python highlighting for built-in functions and types
2026-06-01 06:36:32 +00:00
Xin Zhao 0c8236815a diagnostics: Show source and code on related diagnostics (#56147)
Self-Review Checklist:

- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [ ] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable

Closes #47585

Release Notes:

- Improved display of related diagnostic entries in hover popovers to
include diagnostic source and code.
2026-06-01 06:36:24 +00:00
Xin Zhao 3fde4e285e project: Treat replacement literally when dealing non-ASCII text search (#56123)
Self-Review Checklist:

- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable

Closes #55503

In #28752, to support case-insensitive search for non-ASCII queries, Zed
internally falls back to a regex search. However, this also affected the
replacement behavior, as the replacement code implemented a simple match
logic:

https://github.com/zed-industries/zed/blob/dccea211edfed189db0704ef1247e446aca81150/crates/project/src/search.rs#L452-L457
Since the regex fallback is an internal implementation detail (the user
never enabled regex mode), the replacement should behave the same as a
normal text replacement. This PR fixes that.

Release Notes:

- Fixed replacement text being treated as a regex pattern when
performing case-insensitive text search with non-ASCII characters.
2026-06-01 06:34:37 +00:00
Xin Zhao 9cc78ac691 lsp: Register available LSP adapters locally when in remote development (#54915)
Self-Review Checklist:

- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable

Closes #49178

The context for this change is covered in #49178. Some language server
adapters are lazily registered; in remote development or collab
sessions, the local client fails to register these adapters, may causing
certain LSP features to function incorrectly. This PR is intended to
address that.

Release Notes:

- N/A
2026-06-01 06:32:55 +00:00
Justin Su 747c41f1cb Shorten explanation when edit predictions are disabled for a language (#54808)
The current text is a bit wordy and puts the actually important
information at the end:

<img width="607" height="120" alt="image"
src="https://github.com/user-attachments/assets/26f998dd-1801-4e6c-a40c-acb58f8f3efc"
/>

The button already shows as disabled, so the text just needs to explain
why.

I don't think this affects accessibility, because a screen reader should
be able to tell that the button is disabled.

Self-Review Checklist:

- [ ] I've reviewed my own diff for quality, security, and reliability
- [ ] Unsafe blocks (if any) have justifying comments
- [ ] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [ ] Tests cover the new/changed behavior
- [ ] Performance impact has been considered and is acceptable

Release Notes:

- N/A
2026-06-01 06:15:06 +00:00
Lukas Wirth 0711d9e42b git_ui: Fix stale loading message in git history pane (#58133)
If for some reason we do not manage to find any shas, we were showing an
incorrect loading message before despite not being in a loading state
anymore.

Release Notes:

- N/A or Added/Fixed/Improved ...
2026-06-01 06:03:13 +00:00
Bowen Xu 8982fb17bc gpui: Allow chaining flex_grow() and flex_shrink() with custom factors (#58142)
Self-Review Checklist:

- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable

Release Notes:

- Allow chaining of `flex_grow()` and `flex_shrink()` with custom
factors, following Tailwind CSS conventions.


_For example:_

<img width="509" height="308" alt="aaa"
src="https://github.com/user-attachments/assets/02094fb2-d762-4ac9-a1d9-ef06e2fb047f"
/>

Before:

``` rust
div()
        .flex()
        .flex_row()
        .size_full()
        .bg(gpui::white())
        .child(
            div()
                .map(|mut this| {
                    this.style().flex_grow = Some(1.);
                    this
                })
                .bg(gpui::blue()),
        )
        .child(
            div()
                .map(|mut this| {
                    this.style().flex_grow = Some(2.);
                    this
                })
                .bg(gpui::green()),
        )
        .child(
            div()
                .map(|mut this| {
                    this.style().flex_grow = Some(3.);
                    this
                })
                .bg(gpui::red()),
        )
```

After:

``` rust
div()
        .flex()
        .flex_row()
        .size_full()
        .bg(gpui::white())
        .child(div().flex_grow(1.).bg(gpui::blue()))
        .child(div().flex_grow(2.).bg(gpui::green()))
        .child(div().flex_grow(3.).bg(gpui::red()))
```
2026-06-01 04:40:13 +00:00
init05andChristopher Biscardi eb424af17c file_finder: Allow opening files without dismissing the finder (#57258)
Closes #4864

Adds a `file_finder::OpenWithoutDismiss` action that opens the selected
file without closing the finder, so multiple files can be opened in one
session. Pressing right arrow when the cursor is at the end of the
search query triggers it — matching VS Code and Sublime Text behaviour.
A "Keep Open" button in the footer provides mouse access and serves as a
discoverability hint.

Each opened file becomes the active tab without stealing keyboard focus
from the finder, preserving the search state between opens. Refactors
the existing `confirm` implementation into a shared `open_selected_file`
helper parameterised by `dismiss_after_open` to eliminate duplicated
file-opening logic.

## What's different from PR #38914

- Uses `right` arrow at `end_of_input` context instead of
`cmd-shift-enter` (better ergonomics, matches VS Code/Sublime — the
`end_of_input` context that was added after that PR makes this possible)
- Each opened file is activated as the current tab (`activate: true`,
`focus_item: false`), giving visual feedback on every open without
stealing focus from the modal
- Cleaner refactor: single `open_selected_file` helper instead of
duplicated logic

Release Notes:

- Added ability to open files from the file finder without dismissing
it, using right arrow at end of input or the "Keep Open" footer button

---------

Co-authored-by: Christopher Biscardi <chris@christopherbiscardi.com>
2026-06-01 04:22:11 +00:00
Henrique Ferreiro 950fd46d5c git: Prefer main over master when detecting default branch (#57398)
Many projects are switching to main as the default branch name. Prefer
it over master, in case both are present.

Self-Review Checklist:

- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [ ] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable

Closes #ISSUE

Release Notes:

- N/A or Added/Fixed/Improved ...
2026-06-01 03:21:21 +00:00
Richard BoisvertandChristopher Biscardi 6d605b393c git_ui: Add setting for custom commit message instructions (#58188)
There's currently no way to customize AI-generated commit messages on a
per-commit basis. You can put instructions in AGENTS.md or a project
rules file, but those get fed into every agent interaction, not just
commit generation. The built-in "Commit message" prompt used to be
editable in the Rules Library, but that was replaced by Skills, which
aren't used when generating commit messages.

This PR adds an `agent.commit_message_instructions` setting. Its
contents are added to the commit message prompt in their own section,
alongside any project rules, so you can ask for a specific format
(Conventional Commits, a ticket prefix, etc.) without changing how the
agent behaves elsewhere:

```json
{
  "agent": {
    "commit_message_instructions": "Use the Conventional Commits format: <type>(<scope>): <description>."
  }
}
```

Self-Review Checklist:

- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable

Addresses #26503

Release Notes:

- Added an `agent.commit_message_instructions` setting to customize
AI-generated git commit messages.

---------

Co-authored-by: Christopher Biscardi <chris@christopherbiscardi.com>
2026-06-01 03:19:28 +00:00
Alvaro Parker 83c52e3878 git: Implement compare with branch action (#57886)
Self-Review Checklist:

- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable

Closes #55880 

This improves the work on #56569 by allowing the user to choose the base
branch to compare with directly, instead of having to open the default
branch diff and only after, picking the new base branch.

Additionally, this changes the existing item finder to also match by
base (oid). This allows to have multiple branch diff open with different
base branches.

Demo: 



https://github.com/user-attachments/assets/8abdc08f-6181-4a74-a50b-e5f2b891663e



Release Notes:

- Added new `git: compare with branch` action to directly compare the
current branch with an arbitrary branch.
2026-06-01 02:29:48 +00:00
Hugh L c31ff67fa8 git_ui: Fix commit view avatar being squished when gutter line numbers are disabled (#57913)
## Self-Review Checklist:

- [ *] I've reviewed my own diff for quality, security, and reliability
- [ *] Unsafe blocks (if any) have justifying comments
- [ *] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [ *] Tests cover the new/changed behavior
- [ *] Performance impact has been considered and is acceptable

## Summary

Fixes an issue where the commit author avatar in the commit view could
be horizontally
compressed when editor gutter settings made the gutter unusually narrow.

The avatar column now keeps a minimum width based on the avatar size
plus horizontal
breathing room, while still using the editor gutter width when it is
larger. The spacing
scales with the UI rem size so the layout remains proportional under UI
scaling.

## Screenshots / Recording

- Before (default gutter)
<img width="686" height="336" alt="image"
src="https://github.com/user-attachments/assets/3474fd0b-fdfc-409d-a440-7bb54b28b42c"
/>

- Before (gutter disabled)
<img width="680" height="337" alt="image"
src="https://github.com/user-attachments/assets/66f873a2-1c98-4029-a65c-687171d2aebd"
/>

- After (default gutter)
<img width="687" height="532" alt="image"
src="https://github.com/user-attachments/assets/94ea04e2-644c-491f-8f70-9353af7003d8"
/>

- After (min_line_number_digits: 1)
<img width="685" height="535" alt="image"
src="https://github.com/user-attachments/assets/7080409c-dfa6-4ea6-8255-6de2a59f87fa"
/>

- After (gutter disabled)
<img width="683" height="529" alt="image"
src="https://github.com/user-attachments/assets/e3a5ec33-36a0-4581-8421-2676df59c859"
/>


## Testing

  - Ran `cargo check -p git_ui`

## Release Notes:

- Fixed commit author avatars being compressed in the commit view when
editor gutters are narrow.
2026-06-01 02:10:10 +00:00
liamandCole Miller 5b948e5aab git: Suppress blame errors outside Git repositories (#56348)
Resolves https://github.com/zed-industries/zed/issues/55552

Git blame can be initialized for buffers that are not backed by any Git
repository. Previously, that path still called into
`Project::blame_buffer`, which returned an error because there was no
repository for the buffer. When blame was user-triggered, that error was
surfaced as a toast even though this is an expected “not applicable”
state rather than a failed Git operation.

This diff checks whether the buffer belongs to a repository before
requesting blame data. Buffers outside Git repositories now produce no
blame entries without emitting an error, while real blame failures
inside repositories continue to use the existing error notification
path.

Release Notes:
- Improved Git blame to quietly ignore files that are not part of a Git
repository.

Co-authored-by: Cole Miller <cole@zed.dev>
2026-05-31 23:41:08 +00:00
Miguel Raz Guzmán Macedo 7f826e82c7 Fix grammatical errors throughout the documentation (#58183)
Fixes a batch of grammatical mistakes found across the `docs/` folder:
typos/misspellings, subject-verb agreement errors, missing and
duplicated words, article errors (`a`/`an`), wrong word forms, and
punctuation issues (doubled periods, unclosed parentheses).

Scope is limited to prose in `docs/src/**`; no behavior, settings, or
code changes. 33 files updated, 49 lines changed.

Representative fixes:

- `globs.md`: "features varies" -> "features"; "platforms libc" ->
"platform's libc".
- `installation.md`: "the follow macOS releases" -> "the following macOS
releases".
- `key-bindings.md`: "command pallets" -> "command palette's".
- `linux.md`: capitalization after a period; "able to the environment
variable" -> "able to set the environment variable"; "These feature also
requires" -> "This feature also requires".
- `multibuffers.md`: "Window/Linux" -> "Windows/Linux"; added a missing
closing parenthesis.
- `reference/all-settings.md`: several agreement/article/missing-word
fixes plus an unclosed parenthesis.
- `languages/*`: "partent" -> "parent", "complimentary" ->
"complementary", "setup" -> "set up", "is enabled" -> "are enabled", and
similar.

Release Notes:

- N/A
2026-05-31 22:05:41 +00:00
Xiaobo Liu 8734d01903 git_ui: Update section header checkboxes immediately on stage/unstage all (#57148)
Release Notes:

- Fixed Stash All / Unstash All checkbox UI delay issue

---------

Signed-off-by: Xiaobo Liu <cppcoffee@gmail.com>
2026-05-31 20:04:06 +00:00
315d474c2e Honor anchored patterns in .git/info/exclude (#57779)
Patterns in `.git/info/exclude` that contain a slash (e.g.
`.claude/worktrees`) are anchored: Git matches them relative to the
project root. Zed was instead matching them relative to the `.git/info/`
directory that the file lives in, so they matched nothing and had no
effect.

Self-Review Checklist:

- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable

Release Notes:

- Support anchored patterns in .git/info/exclude

---------

Co-authored-by: Cole Miller <cole@zed.dev>
Co-authored-by: zed-zippy[bot] <234243425+zed-zippy[bot]@users.noreply.github.com>
2026-05-31 19:28:18 +00:00
dfda0732ad vim: Support matching bracket motion in multibuffers (#54634)
Self-Review Checklist:

- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable

Closes #54209

Release Notes:

- Fixed vim `%` (matching bracket) motion not working in multibuffers

---------

Co-authored-by: Cole Miller <cole@zed.dev>
Co-authored-by: zed-zippy[bot] <234243425+zed-zippy[bot]@users.noreply.github.com>
2026-05-31 19:27:21 +00:00
chenmiandLukas Wirth 0b43719b8a Remove stale SSH LSP log entries after server restarts (#55299)
Self-Review Checklist:

- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable

Closes #55287

This fixes the SSH remote case where restarting a language server left a
stale entry in the LSP Logs panel.

The root cause was that the remote client learned about the replacement
language server, but never received an explicit removal update for the
previous server id. As a result, the old status and log-store entry
remained visible even though only the new server continued producing
logs.

Tested with:
- `cargo test -p collab --test collab_tests
remote_editing_collaboration_tests::test_ssh_restarting_language_server_replaces_remote_status
-- --exact`

Release Notes:

- Fixed stale duplicate entries in the LSP Logs panel after restarting
an SSH remote language server.

Co-authored-by: Lukas Wirth <lukas@zed.dev>
2026-05-31 19:17:28 +00:00
Felix SchwämmleandLukas Wirth dedb2af992 keymap_editor: Fix create keybinding button clipping out of editor (#54708)
## Summary

In the keymap editor, the search input at the top used `size_full()`
while the
adjacent button row had `min_w_96()`. On narrow panes (e.g. side-by-side
splits), this caused the action buttons — including "Create keybinding"
— to
overflow and clip out of the editor.

This change lets the search input flex and shrink (`flex_1()` +
`min_w_0()`),
and makes the button row `flex_none()` so it keeps its natural width and
stays visible at any pane size.

## Before / After

<img width="2227" height="475" alt="Screenshot 2026-04-23 215511"
src="https://github.com/user-attachments/assets/f3d79922-13e4-486b-b2b0-62ffa5d5b1a2"
/>

## Test plan

- [x] Open the keymap editor (`zed: open keymap editor`)
- [x] Confirm the "Create keybinding" and other action buttons remain
visible
- [x] Confirm the search input shrinks gracefully instead of pushing
buttons off-screen

Co-authored-by: Lukas Wirth <lukas@zed.dev>
2026-05-31 18:42:51 +00:00
saberoueslati f4f527073d Fix json! empty-string highlighting in Rust (#55126)
## Context

This fixes incorrect syntax highlighting inside Rust `json!` macros when
a JSON value is an empty string. In the current Rust tree-sitter
injection setup, most macro bodies are reparsed as nested Rust, which
works for macros like `vec!` but breaks down for JSON-shaped `json!({
... })` content. When the nested Rust parse loses sync at `""`, later
values can inherit incorrect highlighting.

Closes #54838

The fix treats `json!` as an exception to the generic nested-Rust macro
injection rule. That keeps the outer Rust layer responsible for
token-level highlighting inside the macro body, which is enough to
correctly color JSON keys, string values, and booleans without
introducing a brittle JSON-specific injection for Rust token trees.

Manual test after the fix below :

[Screencast from 2026-04-29
00-53-01.webm](https://github.com/user-attachments/assets/26453acf-1d72-4a97-9969-3f8e236dc0cd)

## How to Review

- `crates/grammars/src/rust/injections.scm`: Start here. This is the
functional fix. The generic Rust macro injection rule now excludes
`json`, so `json!` and `serde_json::json!` bodies are no longer reparsed
as nested Rust. Existing special cases like `view!`, `html!`, `sql!`,
and regex-related behavior are left unchanged.

- `crates/language/src/syntax_map/syntax_map_tests.rs`: This adds a
regression test covering the reported case. It verifies that an empty
string inside `serde_json::json!({ ... })` does not break subsequent
highlighting, and that the expected string and boolean captures still
appear for the later JSON entries.

## Self-Review Checklist

- [x] I've reviewed my own diff for quality, security, and reliability
- [ ] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the UI/UX checklist
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable

Release Notes:

- Fixed incorrect Rust syntax highlighting after empty string values
inside `json!` macros.
2026-05-31 18:42:00 +00:00
Yara 🏳️‍⚧️ 6f335c2f59 Do not play join sound in large meetings (#54337)
The join sounds get annoying in large meetings, let's not play it
anymore when the meeting get's really big. The guest joined sound is
plays regardless of group size so participants get a heads-up when
someone external joins.

Self-Review Checklist:

- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable

Closes #ISSUE

Release Notes:

- Improved join sound no longer plays in large meetings
2026-05-31 18:32:46 +00:00
Lukas Wirth 876ec5a8a0 Improve performance of create_highlight_endpoints (#58119)
This change gets rid of the tree traversal overhead by batching the
anchor resolution

> Create highlight endpoints/text_highlights/100
>                         time:   [298.43 µs 298.55 µs 298.69 µs]

> Create highlight endpoints/text_highlights/100
>                         time:   [40.347 µs 40.386 µs 40.427 µs]
> change: [-86.492% -86.481% -86.471%] (p = 0.00 < 0.05)
>                         Performance has improved.

This is especially important given that `CustomHighlightsChunks::seek`
tends to get called a lot, which re-creates highlight endpoints a lot.

Release Notes:

- N/A or Added/Fixed/Improved ...
2026-05-31 15:19:20 +00:00
Lukas Wirth fd93a53c17 Limit editor rendering to visible clipped rows (#58132)
Editor prepaint previously used the full parent content mask height when
deciding which rows to lay out, while only accounting for top clipping.
Embedded, content-sized editors in agent tool cards could therefore ask
the display map to highlight rows below the editor's visible
intersection with the list viewport. Compute the vertical intersection
between the editor bounds and the content mask instead, so highlighted
chunks and custom highlight endpoints are built only for rows that can
actually be painted.

Release Notes:

- N/A or Added/Fixed/Improved ...
2026-05-31 15:18:31 +00:00
Nathan Sobo 09165c15dc gpui: Support prompt_for_paths in TestPlatform (#58139)
Implements the previously-`unimplemented!()`
`TestPlatform::prompt_for_paths` so tests can drive the platform Open
dialog deterministically.

Adds `TestAppContext::simulate_path_prompt_response` and
`did_prompt_for_paths`, mirroring the existing `prompt_for_new_path`
test helpers (`simulate_new_path_selection`). The simulated response
validates that callers don't return multiple paths when
`PathPromptOptions::multiple` is false.

Release Notes:

- N/A
2026-05-30 20:37:39 +00:00
renovate[bot] e2e7a6769e Update dependency requests to v2.33.0 [SECURITY] (#58093)
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [requests](https://redirect.github.com/psf/requests)
([changelog](https://redirect.github.com/psf/requests/blob/master/HISTORY.md))
| `2.32.3` → `2.33.0` |
![age](https://developer.mend.io/api/mc/badges/age/pypi/requests/2.33.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/requests/2.32.3/2.33.0?slim=true)
|

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/15138) for more information.

---

### Requests vulnerable to .netrc credentials leak via malicious URLs
[CVE-2024-47081](https://nvd.nist.gov/vuln/detail/CVE-2024-47081) /
[GHSA-9hjg-9r4m-mvj7](https://redirect.github.com/advisories/GHSA-9hjg-9r4m-mvj7)

<details>
<summary>More information</summary>

#### Details
##### Impact

Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak
.netrc credentials to third parties for specific maliciously-crafted
URLs.

##### Workarounds
For older versions of Requests, use of the .netrc file can be disabled
with `trust_env=False` on your Requests Session
([docs](https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env)).

##### References

[https://github.com/psf/requests/pull/6965](https://redirect.github.com/psf/requests/pull/6965)
https://seclists.org/fulldisclosure/2025/Jun/2

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N`

#### References
-
[https://github.com/psf/requests/security/advisories/GHSA-9hjg-9r4m-mvj7](https://redirect.github.com/psf/requests/security/advisories/GHSA-9hjg-9r4m-mvj7)
-
[https://nvd.nist.gov/vuln/detail/CVE-2024-47081](https://nvd.nist.gov/vuln/detail/CVE-2024-47081)
-
[https://github.com/psf/requests/pull/6965](https://redirect.github.com/psf/requests/pull/6965)
-
[https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef](https://redirect.github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef)
-
[https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env](https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env)
-
[https://seclists.org/fulldisclosure/2025/Jun/2](https://seclists.org/fulldisclosure/2025/Jun/2)
-
[http://seclists.org/fulldisclosure/2025/Jun/2](http://seclists.org/fulldisclosure/2025/Jun/2)
-
[http://www.openwall.com/lists/oss-security/2025/06/03/11](http://www.openwall.com/lists/oss-security/2025/06/03/11)
-
[http://www.openwall.com/lists/oss-security/2025/06/03/9](http://www.openwall.com/lists/oss-security/2025/06/03/9)
-
[http://www.openwall.com/lists/oss-security/2025/06/04/1](http://www.openwall.com/lists/oss-security/2025/06/04/1)
-
[http://www.openwall.com/lists/oss-security/2025/06/04/6](http://www.openwall.com/lists/oss-security/2025/06/04/6)
-
[https://github.com/advisories/GHSA-9hjg-9r4m-mvj7](https://redirect.github.com/advisories/GHSA-9hjg-9r4m-mvj7)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-9hjg-9r4m-mvj7)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Requests has Insecure Temp File Reuse in its extract_zipped_paths()
utility function
[CVE-2026-25645](https://nvd.nist.gov/vuln/detail/CVE-2026-25645) /
[GHSA-gc5v-m9x4-r6x2](https://redirect.github.com/advisories/GHSA-gc5v-m9x4-r6x2)

<details>
<summary>More information</summary>

#### Details
##### Impact
The `requests.utils.extract_zipped_paths()` utility function uses a
predictable filename when extracting files from zip archives into the
system temporary directory. If the target file already exists, it is
reused without validation. A local attacker with write access to the
temp directory could pre-create a malicious file that would be loaded in
place of the legitimate one.

##### Affected usages
**Standard usage of the Requests library is not affected by this
vulnerability.** Only applications that call `extract_zipped_paths()`
directly are impacted.

##### Remediation
Upgrade to at least Requests 2.33.0, where the library now extracts
files to a non-deterministic location.

If developers are unable to upgrade, they can set `TMPDIR` in their
environment to a directory with restricted write access.

#### Severity
- CVSS Score: 4.4 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N`

#### References
-
[https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2](https://redirect.github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2)
-
[https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7](https://redirect.github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7)
-
[https://github.com/psf/requests/releases/tag/v2.33.0](https://redirect.github.com/psf/requests/releases/tag/v2.33.0)
-
[https://nvd.nist.gov/vuln/detail/CVE-2026-25645](https://nvd.nist.gov/vuln/detail/CVE-2026-25645)
-
[https://github.com/advisories/GHSA-gc5v-m9x4-r6x2](https://redirect.github.com/advisories/GHSA-gc5v-m9x4-r6x2)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-gc5v-m9x4-r6x2)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>psf/requests (requests)</summary>

###
[`v2.33.0`](https://redirect.github.com/psf/requests/blob/HEAD/HISTORY.md#2330-2026-03-25)

[Compare
Source](https://redirect.github.com/psf/requests/compare/v2.32.5...v2.33.0)

**Announcements**

- 📣 Requests is adding inline types. If you have a typed code base that
uses Requests, please take a look at
[#&#8203;7271](https://redirect.github.com/psf/requests/issues/7271).
Give it a try, and report
  any gaps or feedback you may have in the issue. 📣

**Security**

- CVE-2026-25645 `requests.utils.extract_zipped_paths` now extracts
  contents to a non-deterministic location to prevent malicious file
  replacement. This does not affect default usage of Requests, only
  applications calling the utility function directly.

**Improvements**

- Migrated to a PEP 517 build system using setuptools.
([#&#8203;7012](https://redirect.github.com/psf/requests/issues/7012))

**Bugfixes**

- Fixed an issue where an empty netrc entry could cause
  malformed authentication to be applied to Requests on
Python 3.11+.
([#&#8203;7205](https://redirect.github.com/psf/requests/issues/7205))

**Deprecations**

- Dropped support for Python 3.9 following its end of support.
([#&#8203;7196](https://redirect.github.com/psf/requests/issues/7196))

**Documentation**

- Various typo fixes and doc improvements.

###
[`v2.32.5`](https://redirect.github.com/psf/requests/blob/HEAD/HISTORY.md#2325-2025-08-18)

[Compare
Source](https://redirect.github.com/psf/requests/compare/v2.32.4...v2.32.5)

**Bugfixes**

- The SSLContext caching feature originally introduced in 2.32.0 has
created
a new class of issues in Requests that have had negative impact across a
number
of use cases. The Requests team has decided to revert this feature as
long term
maintenance of it is proving to be unsustainable in its current
iteration.

**Deprecations**

- Added support for Python 3.14.
- Dropped support for Python 3.8 following its end of support.

###
[`v2.32.4`](https://redirect.github.com/psf/requests/blob/HEAD/HISTORY.md#2324-2025-06-10)

[Compare
Source](https://redirect.github.com/psf/requests/compare/v2.32.3...v2.32.4)

**Security**

- CVE-2024-47081 Fixed an issue where a maliciously crafted URL and
trusted
environment will retrieve credentials for the wrong hostname/machine
from a
  netrc file.

**Improvements**

- Numerous documentation improvements

**Deprecations**

- Added support for pypy 3.11 for Linux and macOS.
- Dropped support for pypy 3.9 following its end of support.

</details>

---

### Configuration

📅 **Schedule**: (in timezone America/New_York)

- Branch creation
  - ""
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

Release Notes:

- N/A

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMDIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjIwMi4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-05-29 20:29:38 +00:00
Sathwik ChirivelliandChristopher Biscardi 5d3b9e467e git_ui: Open file diffs from git panel (#56152)
Self-Review Checklist:
- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable

Addresses https://github.com/zed-industries/zed/discussions/33773.

This changes git panel file activation so double-clicking or
secondary-opening a changed file opens a dedicated full-file diff tab
backed by a `SplittableEditor`.

The per-file diff reuses the project diff staging and restore controls,
respects the configured diff view style, and focuses an existing
per-file diff tab when one is already open instead of creating
duplicates.

Verified with `cargo run`.

Release Notes:

- Improved git panel file diff opening.

---------

Co-authored-by: Christopher Biscardi <chris@christopherbiscardi.com>
2026-05-29 19:43:26 +00:00
Joseph T. Lyons 06826ef10f Bump urllib3 to v2.7.0 (#58092)
Self-Review Checklist:

- [X] I've reviewed my own diff for quality, security, and reliability
- [ ] Unsafe blocks (if any) have justifying comments
- [ ] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [ ] Tests cover the new/changed behavior
- [ ] Performance impact has been considered and is acceptable

Release Notes:

- N/A
2026-05-29 17:55:04 +00:00
Anthony Eid 7f4a99aa95 Fix task modal fallback when LSP tasks are empty (#58090)
References
[FR-28](https://linear.app/zed-industries/issue/FR-28/task-modal-does-not-show-runnable-rust-test).

The bug this PR aims to fix is

> I can click the play button beside a rust test function, but it does
not show up in the task modal.

I wasn't able to reproduce it, but I suspect this was caused by the task
system preferring LSP code actions by default. It checked that an LSP
was queried for a task instead of checking if the queried LSP actually
returned any tasks. So the fix was just adding the below if statement as
a check.

```rust
if !new_lsp_tasks.is_empty() {
    lsp_tasks
        .entry(source_kind)
        .or_insert_with(Vec::new)
        .append(&mut new_lsp_tasks);
}
```

I also added a regression test for this

Self-Review Checklist:

- [x] I have reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the UI/UX checklist
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable


Release Notes:

- Fixed task modal failing to show language tasks in some cases
2026-05-29 17:49:11 +00:00
Bennet Bo Fenner 122619624d x_ai: Add support for specifying reasoning effort (#58078)
See
https://docs.x.ai/developers/model-capabilities/text/reasoning#the-reasoning_effort-parameter

Closes #58056

Release Notes:

- agent: Added support for specifying reasoning effort for Grok 4.3
(xAI)
2026-05-29 16:28:27 +00:00