This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [rsa](https://redirect.github.com/RustCrypto/RSA) |
workspace.dependencies | patch | `0.9.9` → `0.9.10` |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency
Dashboard for more information.

### GitHub Vulnerability Alerts

####
[GHSA-9c48-w39g-hm26](https://redirect.github.com/RustCrypto/RSA/security/advisories/GHSA-9c48-w39g-hm26)

When creating a RSA private key from its components, the construction
panics, instead of returning an error, when one of the primes is `1`.

Discovered by Christian Reitter from [Radically Open
Security](https://www.radicallyopensecurity.com/) during a security
review for [Proton AG](https://proton.me/).

---

### Release Notes

<details>
<summary>RustCrypto/RSA (rsa)</summary>

###
[`v0.9.10`](https://redirect.github.com/RustCrypto/RSA/compare/v0.9.9...v0.9.10)

[Compare
Source](https://redirect.github.com/RustCrypto/RSA/compare/v0.9.9...v0.9.10)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" in timezone America/New_York,
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

Release Notes:

- N/A

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi42OS4xIiwidXBkYXRlZEluVmVyIjoiNDIuNjkuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

This PR updates the test database schema for the Collab tests.

These recently-added columns got missed in the last schema dump.

Release Notes:

- N/A

This fixes the auto-update failure by ensuring cargo-bundle picks 'zed'
as the first binary.

**Problem:** `cargo metadata` returns binaries alphabetically, so
`visual_test_runner` was coming before `zed`. When cargo-bundle looks
for the first binary to bundle (without `--bin`), it was picking
`visual_test_runner` - which doesn't exist in release builds because it
requires the `visual-tests` feature.

The previous fix (#46163) added `--bin zed` to explicitly select the
binary, but this caused cargo-bundle to use the binary name ('zed')
instead of the bundle metadata name ('Zed Nightly'), breaking
auto-updates.

**Fix:** Rename the binary to `zed_visual_test_runner` so it comes after
`zed` alphabetically. This restores the original bundle script behavior
that has worked for years.

Also reverts the `--bin zed` workaround from #46163.

Release Notes:

- N/A

Release Notes:

- N/A

Co-authored-by: Max Brunsfeld <maxbrunsfeld@gmail.com>
Co-authored-by: Oleksiy Syvokon <oleksiy.syvokon@gmail.com>

Release Notes:

- N/A

Co-authored-by: Max Brunsfeld <maxbrunsfeld@gmail.com>
Co-authored-by: Oleksiy Syvokon <oleksiy.syvokon@gmail.com>

Closes #45340

Release Notes:

- Fixed $ motion in vim mode to stay at end of the line when moving
vertically

---------

Co-authored-by: dino <dinojoaocosta@gmail.com>

Closes #45058

Release Notes:

- Fixed implicit dependency on a system `node` for running
devcontainers.

Closes #37307
Follow up to #40042

This will allow users to see the tool input before accepting a tool
call.

<img width="616" height="99" alt="image"
src="https://github.com/user-attachments/assets/3bcfda1e-bf84-4810-859d-ea53b3b33349"
/>

After clicking on "View Raw Input":
<img width="606" height="199" alt="image"
src="https://github.com/user-attachments/assets/cd89344a-80c4-41c7-a9d9-61c8671a6355"
/>


Release Notes:

- agent: Show tool call parameters when agent asks for confirmation to
run tool

---------

Co-authored-by: Danilo Leal <daniloleal09@gmail.com>

1. Handle diffs with no trailing new lines 
2. ep: Don't assume workdir name in edit history paths
3. Fix `imitate_human_edits()` for pure insertions

Release Notes:

- N/A

---------

Co-authored-by: Agus Zubiaga <agus@zed.dev>

Closes https://github.com/zed-industries/zed/issues/42140

Changes:

- Add show_view_release_notes_locally_error to prompt users when the
operation fails.

<img width="1536" height="864" alt="image"
src="https://github.com/user-attachments/assets/265bbf7e-6931-4559-99b2-7c1d8fbcd6cc"
/>

Release Notes:

- Added a notification with a link to view release notes online when Zed
can’t load them locally.

---------

Co-authored-by: Smit Barmase <heysmitbarmase@gmail.com>

in release mode: found many log error as `ERROR [rope::chunk] byte index
48 is not a char boundary; it is inside '，' (bytes 46..49)`

This is easy testing,
- enable signature help
- typing any CJK character
- crash in debug mode

Release Notes:

- N/A

Release Notes:

- Fixed an issue on macOS where audio playback would become temporarily
scrambled when doing lots of IO operations, such as when running `git
pull` or `git checkout` while in a call.

The visual_test_runner binary (added in #45259) has `required-features =
["visual-tests"]`, so it doesn't get built in release builds. However,
`cargo bundle` was trying to bundle all binaries defined in the zed
crate's Cargo.toml, causing it to fail when visual_test_runner doesn't
exist.

Adding `--bin zed` tells cargo bundle to only bundle the main zed
binary.

**Note:** The `cli` binary is unaffected by this change - it's a
separate package (`crates/cli`) that's built separately via `cargo build
--package cli` and manually copied into the app bundle afterward (line
337). It was never part of `cargo bundle`'s scope.

Fixes the nightly build failure:
https://github.com/zed-industries/zed/actions/runs/20740971838

Release Notes:

- N/A

Closes #36359

Release Notes:

- Fixes bug where `:g/pattern/norm commands` would only apply on the
last match

---------

Co-authored-by: dino <dinojoaocosta@gmail.com>

Partially addresses #38151

Release Notes:

- Added Helix match surround operations

Holding control while dragging text to copy it was being blocked by link
handling stopping the propogation of the mouse event; solution: don't
handle link clicks when selection_drag_state is Dragging.

Issue found & fix tested on Linux (since the modifier key on mac is
apparently different, the issue likely doesn't occur there, but I'm
assuming it does apply to Windows).

I didn't see an issue open for it, and since I fixed it myself I'm
unsure whether it needs one or if the PR is enough.

Release Notes:

- Fix an issue where Ctrl+drag to duplicate selected text on Linux and
Windows when the selection is inside a link.

1. `apply_diff` will create a file if the diff says so (by starting with
`--- /dev/null`)
2. Update examples format to match recent changes
3. `ep split-commits` can work with a stream of inputs and generate `n`
samples per input
4. Unicode handling fixes

Release Notes:

- N/A

Previously, `detail` was not included in resolvable properties, which
prevented LSP-compliant servers from lazily resolving it.

In relation to this, I also investigated vtsls issues:
- https://github.com/yioneko/vtsls/issues/213
- https://github.com/zed-industries/zed/pull/21521

My conclusion is that regardless of whether Zed registers `detail` in
resolvable properties, vtsls always lazily resolves `detail`. However, I
understand that Zed's `resolve_completions` has been improved to handle
such "misbehaving" servers gracefully already, so I expect that adding
`detail` to resolvable properties will not cause any issues.

In fact, since Zed can lazy update all properties of completion items,
it might be appropriate to include all properties as resolvable except
for `label` (which is explicitly tested for consistency) and `data`
(which is used for resolution itself once).
However, since I'm uncertain if this is entirely correct, this commit
only adds `detail` to resolvable properties, as it was required to be
supported by LSP clients up to version 3.16.

Closes #ISSUE

Release Notes:

- N/A

Closes #46119

Release Notes:

- Fixed git push to respect the upstream branch name instead of defaulting to the local branch name.

Closes https://github.com/zed-industries/zed/issues/45928

Release Notes:

- Fixed builtin python language servers not correctly working on ssh
remotes

Release Notes:

- N/A

Breadcrumb visual reorchestration which makes a couple of key changes:
- Breadcrumbs are now displayed in file headers for multibuffer views.
Singleton buffers are unchanged.
- Multibuffer views now have collapse/expand all buttons available in
the toolbar
- Search in multibuffer views now takes up less space, by occupying the
primary toolbar location erstwhile taken up by breadcrumbs

<img width="1721" height="823" alt="Screenshot 2025-12-22 at 4 15 41 PM"
src="https://github.com/user-attachments/assets/38e924f7-fe9e-4c83-84fb-2eee98137f43"
/>

<img width="1722" height="762" alt="Screenshot 2025-12-22 at 4 15 51 PM"
src="https://github.com/user-attachments/assets/ccc98ca3-75ce-4aca-bceb-890817b0f04d"
/>


Release Notes:

- Moved breadcrumbs to file headers in multibuffer views
- Added collapse/expand all options for multibuffer views
- Improved use of space for multibuffer search by taking the place of
the former breadcrumb toolbar location

---------

Co-authored-by: Danilo Leal <daniloleal09@gmail.com>
Co-authored-by: Zed Zippy <234243425+zed-zippy[bot]@users.noreply.github.com>

As reported in
https://github.com/zed-industries/zed/pull/44749#issuecomment-3712881279

Release Notes:

- N/A

When the UI font size changes, the settings window's scrollbar would
break because list item measurements were cached and not invalidated.

We're using `ListState.measure_all()` to pre-measure all items for an
accurate scrollbar. When font size changes, these cached measurements
become stale but weren't being refreshed.

This commit fixes the issue by calling `ListState.measure_all()` when
settings change, ensuring items are re-measured on the next layout
without affecting scroll position.

Closes #43683

Release Notes:

- Fixed bug where changing the UI Font Size in the Settings UI would
break the scrollbar for the "Appearance" page

---------

Co-authored-by: Zed Zippy <234243425+zed-zippy[bot]@users.noreply.github.com>

Closes https://github.com/zed-industries/zed/issues/45555

Refer https://github.com/zed-industries/zed/pull/20859 for more.

Release Notes:

- Fixed a project panel drag-and-drop issue where selecting both a
folder and its children could result in files being silently lost in
some cases.

---------

Co-authored-by: Smit Barmase <heysmitbarmase@gmail.com>

Closes #36503

Release Notes:

- Improved readability of long paths in remote project picker

Closes #45635

Release Notes:

- Fixed context menu in project panel targeting the wrong folder when
right-clicking on folded directory paths.
- Added hover feedback to folded path folders to indicate which folder
will be targeted.

Recording:


https://github.com/user-attachments/assets/3209921a-b791-4eef-8eb7-1b5dc68374da

---------

Co-authored-by: Smit Barmase <heysmitbarmase@gmail.com>

Closes https://github.com/zed-industries/zed/issues/35698

Release Notes:

- Fixed default zed terminal environment vars not being set in remote
terminal shells

Renames a bunch of ssh things to remote when its actually about remotes
in general

Release Notes:

- N/A *or* Added/Fixed/Improved ...

Subpixel text rendering is now implemented on Windows and Linux.

Comparison screenshots:

|Before|After|
| ------------- | ------------- |
| <img width="400"
src="https://github.com/user-attachments/assets/9d720d2c-2ec4-4adf-a83f-7c2d81d30025"
/> | <img width="400"
src="https://github.com/user-attachments/assets/8fd7dc2a-8ca0-4f71-86cd-55460f568f7a"
/> |


Release Notes:

- Added support for subpixel (ClearType-style) text rendering. This
improves the legibility of text on standard DPI displays. Subpixel
rendering is enabled by default on Windows and Linux and can be
configured using the `text_rendering_mode` setting.

---------

Co-authored-by: Max Brunsfeld <maxbrunsfeld@gmail.com>

as per its documentation:

`Async` supports all networking types, as well as some OS-specific file
descriptors like timerfd and inotify.

However, do not use `Async` with types like File, Stdin, Stdout, or
Stderr because all operating systems have issues with them when put in
non-blocking mode.

Release Notes:

- N/A *or* Added/Fixed/Improved ...

Before:
<img width="901" height="247" alt="before"
src="https://github.com/user-attachments/assets/95467f0a-e464-44ea-a8f3-bedccf57c6a9"
/>

After:
<img width="967" height="256" alt="after"
src="https://github.com/user-attachments/assets/5eb43918-4348-42d2-9174-3fafd82919d0"
/>

Release Notes:

- Added highlighting for escape sequences for C and C++.

Closes #ISSUE

Related discussion #44629 

Release Notes:

- Added simple `g g`, `G`, `j` and `k` motions for the file history view
on vim mode.

Release Notes:

- N/A

Found while profiling #38927

When the query is not a regex, the same replacement can be applied to
all matches. Previously, `replacement_for` allocated a new String on
every call, while `replacement` returns a reference.

Release Notes:

- N/A

---------

Signed-off-by: Marco Mihai Condrache <52580954+marcocondrache@users.noreply.github.com>

Missing required extension files or directories currently result in
opaque "Directory not found" errors being logged during the update index
phase. This can be frustrating to those developing extensions. Add some
context so folks know where to start looking.

Release Notes:

- N/A

---------

Co-authored-by: Kirill Bulatov <mail4score@gmail.com>
Co-authored-by: Kirill Bulatov <kirill@zed.dev>

## Screenshot testing

Adds visual testing infrastructure for GPUI that captures screenshots by
rendering directly to Metal textures. The

The screenshots end up in `target/visual_tests/` and look like this:

<img width="2560" height="1600" alt="workspace_with_editor2"
src="https://github.com/user-attachments/assets/54112343-4af1-4347-9bab-f099de97dd29"
/>
<img width="2560" height="1600" alt="project_panel2"
src="https://github.com/user-attachments/assets/0cd54b61-dace-4398-a28e-0b4d7c2968f6"
/>


### Key Features

- **Direct texture capture**: Screenshots are captured by rendering the
scene to a Metal texture and reading pixels directly from GPU memory,
rather than using ScreenCaptureKit
- **No visibility requirements**: Windows don't need to be visible on
screen since we read directly from the render pipeline
- **Deterministic output**: Captures exactly what GPUI renders, not what
the OS compositor displays
- **No permissions needed**: Doesn't require Screen Recording permission
like ScreenCaptureKit would

### Running the Visual Tests

```bash
# Run visual tests (compares against baselines)
cargo run -p zed --bin visual_test_runner --features visual-tests

# Update baseline images (when UI intentionally changes)
UPDATE_BASELINE=1 cargo run -p zed --bin visual_test_runner --features visual-tests

# View the captured screenshots
open target/visual_tests/
```

### Implementation

- `Window::render_to_image()` - Renders the current scene to a texture
and returns an `RgbaImage`
- `MetalRenderer::render_to_image()` - Core implementation that renders
to a non-framebuffer-only texture
- `VisualTestAppContext` - Test context that uses real macOS platform
rendering
- `VisualTestAppContext::capture_screenshot()` - Synchronous screenshot
capture using direct texture rendering

### Usage

```rust
let mut cx = VisualTestAppContext::new();
let window = cx.open_window(...)?;
let screenshot: RgbaImage = cx.capture_screenshot(window.into())?;
```

Release Notes:

- N/A

---------

Co-authored-by: Amp <amp@ampcode.com>

Additionally, fix a race condition where we'd still insert diagnostics
from a document or workspace pull even if the registration had been
unregistered in the time since the request was issued.

And, as a bonus: when a new pull diagnostics registration is added,
issue document pulls immediately.

This should fix regressions with basedpyright caused by
https://github.com/zed-industries/zed/pull/43703.

Release Notes:

- N/A

Before: 

<img width="389" height="147" alt="image"
src="https://github.com/user-attachments/assets/5412bde6-2f1b-4bb4-a06f-111724597372"
/>

After:
<img width="404" height="139" alt="image"
src="https://github.com/user-attachments/assets/8f906245-4c6e-4cf0-bb32-1b47048f46c0"
/>


Release Notes:

- Include namespace symbol in the outline view for C++.

Before:

<img width="665" height="116" alt="image"
src="https://github.com/user-attachments/assets/3c0b6ea4-f030-4fef-a0eb-8251ce16a651"
/>

After:

<img width="601" height="104" alt="image"
src="https://github.com/user-attachments/assets/31659c75-6f73-40e7-9d3b-c4ae99357b12"
/>

The fix is similar to https://github.com/zed-industries/zed/pull/36076.

Release Notes:

- Fix outline nesting issue for variable declarations in C++

This PR updates the `bump_patch_version.yml` to also be generated by
`cargo xtask workflows` and updates this to use the `zed-zippy` identity
instead of the `ConradIrwin` identity.

Release Notes:

- N/A

Release Notes:

- N/A

---------

Co-authored-by: Zed Zippy <234243425+zed-zippy[bot]@users.noreply.github.com>

Closes #ISSUE

Release Notes:

- N/A *or* Added/Fixed/Improved ...

### Closes 
- Maybe https://github.com/zed-industries/zed/issues/38252 (there might
be something going on with NPX too)
- Also addresses
https://github.com/zed-industries/zed/pull/39021#issuecomment-3644818347



### Why
Some more involved MCP servers timeout often, especially on first setup.
I got tired of having to set timeouts manually per server. I also
noticed a timeout could not be set for http context servers, which
causes Context7 or GitHub's remote servers to timeout at 60s sometimes.

### Overview

MCP Timeout Configuration Feature

This PR adds additional configurable timeout settings for Model Context
Protocol servers including a global timeout and the addition of timeouts
for http servers, addressing issues where servers were timing out after
a fixed 60 seconds regardless of user needs.

**Key Features:**
- **Global timeout setting** (`context_server_timeout`) - default
timeout for all MCP servers (default: 60s, max: 10min)
- **Per-server timeout overrides** - individual servers can specify
custom timeouts via `timeout` field
- **Precedence hierarchy** - per-server timeout > global timeout >
default (60s)
- **Automatic bounds checking** - enforces 10-minute maximum to prevent
resource exhaustion
- **Support for both transports** - works with stdio and HTTP-based
context servers
- **Comprehensive test coverage** - 3 new tests validating global,
override, and stdio timeout behavior
- **Full backward compatibility** - existing configurations work
unchanged with sensible defaults


### Release Notes:

- Added the ability to configure timeouts for context server tool calls.
The new global `context_server_timeout` setting controls the default
timeout (default is 60s, max: 10min). Additionally, per-server timeouts
can be configured using the `timeout` field within servers defined in
the `"context_servers" setting

---------

Co-authored-by: Ben Kunkle <ben@zed.dev>

Embeddings have neither been used nor maintained in over a year and
there are currently no plans to use these again any time soon. Hence,
remove support for these here to more clearly indicate that these are
actually not used.

Release Notes:

- N/A

This seemed to fix a bug where our winget release was not automatically
published.

Release Notes:

- N/A

Add support for OpenAI's /responses endpoint for models that don't
support /chat/completions API. This enables compatibility with newer
model variants (`gpt-5-codex`, `gpt-5-pro`, `o3-pro`, etc) while
maintaining compatibility with existing configs

Changes:
- Add `supports_chat_completions` flag to model capabilities that
defaults to true for existing behavior
- Implement responses API client with streaming support as per [OpenAI
documentation](https://app.stainless.com/api/spec/documented/openai/openapi.documented.yml).
- Add `ResponseEventMapper` to convert responses events to completion
events for maintainer simplicity
- Update UI to allow toggling `chat_completions` capability
- Add `gpt-5-codex` model

Closes #38858

Release Notes:
- Added support for `gpt-5-codex` model

---------

Co-authored-by: Bennet Bo Fenner <bennet@zed.dev>

Release Notes:

- Fixed Zed stealing element focus away briefly after startup,
interrupting user workflows

Closes #42217 

Release Notes:
- Added/Fixed/Improved ...
added "Create Pull Request" Command when searching on the command
Palette

For more details, please refer to the issue, thank you.

---------

Co-authored-by: dino <dinojoaocosta@gmail.com>

Closes #44251

## Context

Commands like `2daw` or `c2iw` were ignoring the count multiplier
because the word text object functions (`in_word`, `around_word`)
weren't using the `times` parameter. This fix propagates the count
through these functions so all operators correctly handle multiple
words.

## Before


https://github.com/user-attachments/assets/d5effa8a-4c04-4d70-a6b5-389cba730ca9

## After


https://github.com/user-attachments/assets/c50e4c0c-ea5c-4673-9c98-3d924b448025


Release Notes:

- Fixed vim mode count multiplier for word text objects (`2aw`, `2iw`,
`2aW`, `2iW`)