March 24, 2026

Sourcegraph 7.1.0

A newer patch release is available: 7.1.2426. See all changes in Sourcegraph 7.1.

Highlights

A new Command Palette is born...

Jump to anything at lightning speed.

We're introducing a full-blown command palette for Sourcegraph. Hit Cmd + K (or Ctrl + K on Windows) from anywhere to search for files, repositories, symbols, pages, and more — all in one place.

preview of the new command palette in sourcegraph

It lets you jump to anything at lightning speed. Navigate to a page buried deep in the admin panel, pull up a recently visited repository, or kick off a global code search — without ever reaching for the mouse.

We all know the feeling:

Click, click, click...

"Where did that setting go? I swear it was right here..."

Click. Scroll. Click. Scroll.

"OK, found it. Wait — wrong page. Let me go back..."

No more! Just Cmd + K and start typing.

What's included?

Search for files, repositories, symbols, page names and more. Want to jump to a page deep in the administration panel? Cmd + K and start typing.
Global keybindings to jump to certain actions or pages. Use Cmd + . to start a conversation from anywhere (only available for those who have Deep Search), or Cmd + Shift + F for global code search.
Recently navigated. Jump to recently navigated to repositories, files and symbols with ease. If you've been there before, it's easier to get there again.

This is just the first iteration to making all parts of Sourcegraph more accessible and easier to discover. Stay tuned for more!

Deep Search reads Deep Search

Deep Search can now load prior Deep Search investigations from a URL or read token so you can continue and extend earlier research.

Paste a Deep Search URL or read token into your message, and the agent will load that investigation as context for your new prompt. For example:

Read https://sourcegraph.com/deepsearch/b875dd16-a58f-4c27-84b8-4b4306e49df7 and tell me what else we should investigate about our flaky tests
Based on the findings in https://sourcegraph.com/deepsearch/shared/e3c0150a-b7ef-4955-bed4-d5820ca7a70d, investigate whether the same logging patterns appear in our other microservices
What did we learn about authentication in https://sourcegraph.com/deepsearch/71a48f28-d241-4efa-bc62-4afde5499b00? Are there similar issues in the authorization code?
Continue the investigation from https://sourcegraph.com/deepsearch/7347ddaa-d579-4b91-b152-ca27e4ddb656 by checking if those dead code patterns exist in our newer repositories
Compare what we found in https://sourcegraph.com/deepsearch/e782c115-2dfa-44a5-8a88-2fad218a2fe1 with the current state of the codebase - has the performance issue been addressed?
Look at https://sourcegraph.com/deepsearch/shared/3f1beb2b-bded-4fda-96cc-1af7192f24b6 and investigate whether those security concerns apply to our newer API endpoints

Deep Search pulls in the conversation making prior investigations available as context for new questions. This lets you build on previous research, cross-reference findings, and continue investigations where teammates left off.

Improved token efficiency in agentic Sourcegraph tools

Deep Search and MCP tools are now more token-efficient.

We've improved the set of tools available for agents inside Sourcegraph to emit more token-efficient outputs. This includes tools that Deep Search uses under the hood, as well as tools available in our MCP server.

Instead of JSON, the tools now emit a more compact plaintext format, saving tokens on every execution. A lower token count also leads to lower latency and costs. The new format is also more selective about which pieces of information it shows to the agent.

In practice, we've observed a reduction of around 30% in the number of tokens our search tools emit with no loss in output relevancy. This means that agents working with our tools can now run for longer before filling up their context window - whether you're using MCP or Deep Search, you'll be able to get more done.

OAuth login for `src`

OAuth login is now supported in src, and src auth token allows you to easily use your active token in scripts.

You can now log in to src with OAuth, making it faster to connect src to your Sourcegraph instance without manually managing an access token.

We’ve also added src auth token, which prints the token for your current authenticated session. That makes it easier to use src in scripts and shell workflows, for example by passing $(src auth token) to other commands when needed.

Want to install and use src? Open the integrations page from your user menu to view instructions.

For more information on how to use src, see the docs.

One-click MCP setup for VS Code and Cursor

Set up Sourcegraph MCP in VS Code and Cursor with one click from the integrations page.

You can now add Sourcegraph MCP to VS Code and Cursor directly from the integrations page using editor deep links.

Select Add to VS Code or Add to Cursor, and Sourcegraph opens the editor with your Sourcegraph MCP server configuration prefilled for your instance URL.

You can still use command-line or manual config setup if you prefer.

View git notes

Reference git notes attached to commits.

You can now view git notes attached to commits directly in Sourcegraph. This includes notes added manually, or via tools like Git AI.

Notes attached to a commit are shown on the commit page, and various UI elements throughout Sourcegraph will hint at whether a commit has any associated notes.

This is our first step towards broader support for git notes. If you're interested in more capabilities around git notes, please reach out to [email protected].

Weekly updates for Sourcegraph Cloud

Starting today, the latest features, improvements, and fixes will be applied on weekly basis.

As promised, we are starting to apply Sourcegraph Cloud updates every week. Weekly updates are rolled out gradually over several days, and customers can generally expect to see the new features, improvements, and fixes by Thursday of each week. You can learn more about what has changed directly in Sourcegraph, or in our Changelog.

In the past, Sourcegraph Cloud has received the same releases as our self-hosted customers, at the same monthly cadence. We strongly believe that weekly updates will not only enable Sourcegraph to stay at the cutting edge of the latest technologies, but also to work more closely with our customers to address feedback and iterate on new capabilities.

Our customers’ Sourcegraph Cloud experience will remain our top priority:

Stability and user experience will continue to come first
This will not affect any SOC2 and ISO27001 controls
We will still retain the same internal safeguards around testing, quality assurance, and staggered rollouts that you know from today

Sourcegraph self-hosted customers are not affected by this change and we will continue to publish releases on the existing monthly schedule. Updates for Sourcegraph self-hosted are available in the "Releases" tab in our Changelog.

Deep Search usage pacing charts in Sourcegraph Analytics

See how Deep Search usage trends month over month with new pacing charts.

Sourcegraph Analytics now includes pacing charts for Deep Search, making it easy for admins to track usage against their purchased quota as the month progresses. The charts show both burndown and cumulative views for the current month, mapped against the previous month so you can spot trends at a glance.

The burndown view tracks usage against your purchased amount, helping you know when it’s time to top up.

New to Sourcegraph Analytics? Check out the docs and enable it to start exploring usage across your organization.

Details

Improvements

Deep Search Render deepsearch_read tool calls

Deep Search now displays deepsearch_read tool calls with a dedicated UX.
Deep Search Add deepsearch_read to tools

Deep Search can now read other Deep Search threads when you include a URL in your conversation.
Deep Search Add question categorization for analytics
Deep Search Get repo name as context when opened on the repo's root page

When Deep Search sidebar is opened from a repository's root page, the conversation now includes the repository name as context.
Deep Search Prioritize file suggestions from current repo

Improved ranking of file suggestions in @-mention of the Deep Search sidebar in the blob view. Results from the repository the user is currently browsing are prioritized.
Deep Search Add shareable URL to Deep Search API responses

Added shareable URL field to Deep Search API responses
Deep Search Scroll to active conversation in history sidebar
Deep Search Gracefully hide failed questions on retry

Failed questions are now automatically hidden after a successful retry or follow-up question
Deep Search Switch Deep Search to use Sonnet 4.6

Deep Search now uses Claude Sonnet 4.6 as the main agent model.
Deep Search Persist unsubmitted Deep Search queries

Persist unsubmitted Deep Search queries in sessionStorage, preventing loss of unsaved queries during accidental navigation.
Deep Search Add search bar to history panel

Added a search bar to the history panel of Deep Search
Code Search Show git notes count in commit results

Commit search results now display a count of git notes attached to each commit.
Code Search Compact output format for all tools

Deep Search and MCP tools now return outputs in a more compact format, reducing token usage.
Code Search Search redirects to the file view if only one result is returned

Search now automatically redirects to the file view when only one result is returned, with an info toast notification. Back navigation returns to search results without re-triggering the redirect.
Code Nav Add JSONC syntax highlighting support

Added syntax highlighting support for JSONC files.
Code Intel Add error max age filter UI to code intelligence dashboards

Code intelligence dashboards now allow filtering indexing errors by time range (last 7 days, 30 days, 90 days, last year, or all time).
Code Intel Hide Smart Summary title until generation completes

The Smart Summary label is now hidden in the symbol tooltip until summary generation completes, improving layout stability.
Administration Add network diagnostics tooling to debug page

Added admin-only network diagnostic endpoints (/netdiag) for testing proxy and load balancer compatibility, including upload, download, timeout, SSE streaming, and latency tests to verify ingress reverse proxy configuration.
Administration Migrate highlighting invalid config to svelte app

Invalid keys that are not in the advanced configuration schema are now highlighted in the configuration editor.
Administration Move "report a bug" page to user settings

The "Report a bug" page is now available to all authenticated users in user settings, instead of only to site admins in the site admin area.
Analytics Notify site admins when telemetry export fails

Site admins on self-hosted instances now see a warning notification on the admin dashboard when telemetry export has failed persistently, including the target address and last error. The notification auto-clears once export recovers.
Authentication Disable already registered DCR clients and tokens if DCR is disabled

When the site configuration auth.idpDynamicClientRegistrationEnabled is set to false, existing DCR registered clients and tokens are disabled.
Cody Add ChatGPT 5.2 and Gemini 3.1 to Cody model selector
Database Improve performance of assigning pending repository permissions at sign up

Optimised assigning pending permissions to newly created users
MCP Deep links for VS Code and Cursor

Integrations page now includes "Add to Cursor" and "Add to VS Code" buttons for Sourcegraph MCP.
RBAC Add RBAC permission for accessing global search contexts

Added a new RBAC permission SEARCH_CONTEXTS#WRITE_GLOBAL for managing global search contexts. Users with this permission can manage global search contexts independently of site-admin status.
Repositories Allow sync and reclone on cloned repos with errors
Repositories Add support for syncing repository avatars
Repositories Fetch git notes refs from remotes
Repositories Add repo activity background analyzer job

Added background worker jobs that compile repository activity data.
Security Convert filesystem operations to be path-traversal resistant

Filesystem operations in gitserver and archive extraction use Go 1.24's os.OpenRoot API, replacing manual path-traversal checks.
Slack Add multi-workspace support

Multiple Slack workspaces can now be connected to the same Sourcegraph instance. Visit the Administration > Slack integration page for setup.
Slack Add configurable toggle to allow/disallow Deep Search in Slack integration

Site admins can now set up the Slack integration for link unfurling independently of Deep Search, and control whether Deep Search is allowed in Slack via a new "Allow Deep Search" toggle on the Slack integration admin page.
Slack Simplify truncated Deep Search response prompt

Truncated deep search responses now show a rich preview card automatically via link unfurl, with a single "Send full response to thread" button replacing the previous prompt with two buttons.
Slack Add deepSearch.slackCta.disable user settings option

Added a user setting to disable the Deep Search Slack integration CTA. This can be set globally for all users under Administration > Global Settings by adding "deepSearch.slackCta.disable": true,
Slack Enable Slack agent mode for Sourcegraph Slack Integration

Enable Slack agent mode, allowing users to interact with Sourcegraph via the split-view pane in Slack's top bar
UI Show warning when GitHub App URL contains a path

Show a warning when entering a GitHub App base URL that contains a path
UI Update resizable panel UI with accessibility and fixed-size support
- Added support for fixed-size panels (px, rem, em)
- Added keyboard navigation support
- Added ARIA window splitter specification compliance
- Migrated implementation to Svelte 5
UI Display reclone and fetch scheduling failure messages on repository settings page

Error messages now appear on the repository settings page when reclone or fetch scheduling operations fail, improving visibility into repository synchronization issues.
UI Show error state if error occurs when requesting a reclone or sync for a repo

Show error state when requesting a manual reclone or sync fails for a repository
UI Introduce Command Palette

Expanded fuzzy finder into a command palette. Click, click, click. "Wait? Where's that option gone...? Damn, they changed the UI again!" Say no more, we've got you. We've upgraded our fuzzy finder into a full-blown command palette.

Jump to parts of Sourcegraph you need quickly and easily. Search files, repositories and symbols in flash. Just CMD/Ctrl + K.

This is just a starting point to making all parts of Sourcegraph more accessible, and if we're lucky, maybe even reduce some RSI.
Access Tokens Show last 5 characters of access tokens

Access tokens now display their last 5 characters in the UI, making it easier to identify which token corresponds to credentials stored in configuration files or environment variables.
Access Tokens Expose expired access tokens in UI

Expired access tokens are now visible in the UI and marked as expired, allowing users to identify and delete them for easier token management.
Changelog Add deep links and footer link to changelog modal

The changelog modal now includes deep links: the header 'Changelog ↗' link navigates to the specific changelog post, and a new footer link 'View all changes in this update' directs users to the release page's details section.
Changelog Add date section headers to modal sidebar
Commits Display git notes on commit elements and pages

Git notes are now displayed on commit pages and in commit elements throughout the UI. On commit pages, full notes are shown, while other views display a count of notes.
Entitlements View entitlement usage in user settings

Users can now view their own entitlement usage under the new "Entitlements" tab on the user settings page (/settings).
Feature Flags Delete overrides when deleting a feature flag

Deleting a feature flag now automatically removes its per-user and per-org overrides.
Integrations Add src-cli card

Add src CLI usage guidance to the integrations page

Fixes

Deep Search Fix Deep Search UI entitlement warning state

Entitlement warnings and errors now display correctly when entitlement limits are reached.
Deep Search Fix Deep Search UI quota warning state

Quota warnings and errors now display correctly in the Deep Search UI when quota limits are reached.
Deep Search Switch Gemini 3 Flash to low reasoning effort

Improve reliability of conversation title generation by reducing reasoning overhead for simple tasks.
Deep Search Preserve truncated responses on follow-up questions
Deep Search Validate image content type

Harden Deep Search image upload validation to verify content type matches declared MIME type.
Deep Search Fix citation UI header styling in dark mode

Fixed citation UI header styling in Deep Search to match search result page appearance in dark mode.
Deep Search Fix UI papercuts in citations, tooltips, and code preview
- Fixed citation block overflow issues with file names and paths using right-to-left text layout
- Added tooltips to display full file paths when truncated
- Fixed line number background in code preview
- Added dynamic border in code preview when scrolling horizontally
- Fixed star and delete button styling on selected items
Deep Search Fix @-anchor detection causing incorrect suggestion insertion

Fixed a bug in @-anchor detection that could cause the selected suggestion to be inserted at an incorrect position in the prompt, particularly when line breaks were involved.
Deep Search Fix recent conversations flashing on sidebar toggle

Fixed recent conversations flashing when toggling the sidebar and ensured conversation deletes sync across components.
Deep Search Prevent image decompression bomb DoS in Deep Search image pipeline

Prevented memory exhaustion from crafted images by limiting decompressed image size to 25MP.
Deep Search Fix scroll to answer in Deep Search sidebar

Fixed Deep Search in the repository sidebar so follow-up responses now stay auto-scrolled as results stream in.
Deep Search Strip formatting from pasted text in prompt editor

Fix pasted text formatting in the Deep Search input
Deep Search Remove user info from prompt, avoid emojis in outputs

Remove user info from Deep Search prompt to improve handling of codebase-wide questions.
Deep Search Fix notification cutoff when sidebar is collapsed

Fixed "Markdown copied" and "JSON copied" notifications being cut off when the sidebar is collapsed.
Deep Search Fix scroll to answer

Fix deep link detection in deep search conversation URLs.
Deep Search Fix copy buttons on Deep Search answers

Fixed copy buttons in Deep Search answers to show green check marks and updated tooltips.
Deep Search Address some incorrectly generated repository links in markdown
Deep Search Limit width of DS sidebar, align prompt and answer

Limited the maximum width of the Deep Search sidebar to 920px for better readability while maintaining full width on mobile devices. Prompt and answer sections now use the full available sidebar width.
Deep Search Avoid sending duplicate context in conversations

Optimized context handling in Deep Search sidebar conversations to avoid resending identical source reference context from previous questions.
Deep Search Add gap between horizontal divider and first item
Code Search Fix expand/collapse state of bottom file view panel

Fixed incorrect panel state when navigating between search results and file views
Code Search Text overlaps in search result counter display

Search results toolbar is now more responsive, keeping result stats and action buttons stable and readable across screen sizes.
Code Search Adjust CodeMirror selection color mixes

Improved selection visibility in CodeMirror for pre-selected and cursor-selected lines
Code Search Fix code mirror search panel UI
Code Search Copy full commit SHA instead of abbreviated SHA

On the commit page, the copy button next to the abbreviated commit SHA now copies the full SHA instead of the abbreviated SHA to the clipboard
Code Search Normalize whitespace in NLS suggestion deduplication
Code Search Fix broken find references button in the search file preview

Fixed "Find references", "Go to definition", and "Find implementations" buttons in the search results file preview panel, which previously had no effect when clicked.
Code Nav Optimize StreamRangesQuery for improved Precise code navigation performance

Significantly improved Precise code navigation performance by optimizing symbol ranking and query ordering, reducing lookup times from timeouts to seconds.
Code Nav Do not report oversized files as unexpected error
Code Intel Prevent panic from concurrent map access in rockskip

Fixed a data race in the search method that could cause panics when concurrent goroutines modified the thread status map. The search method now safely retrieves a snapshot of thread statuses while holding the appropriate lock.
Code Intel Move enqueue auto-indexing form below tab picker

Moved the enqueue auto-indexing form to appear only when viewing the auto-indexing jobs tab.
Code Intel Fix bottleneck in upload discovery phase

Optimized upload discovery query by reversing join order and preventing full upload table scans, eliminating timeouts on large instances
Code Intel Fix pagination when fetching precise indexes

Fixed pagination bug that caused missing results and infinite loops when one data source (uploads or indexes) was exhausted before the other
Code Intel Return forbidden instead of unauthorized for permission errors in upload API

Error codes returned by codeintel upload API are now consistent: 401 is used for token problems and 403 for permission problems
Batch Changes Update code host link to correct docs page

Fixed broken documentation link in Batch Changes settings page that previously returned a 404 error
Batch Changes Remove GH App team_discussions permission

Fixed an issue where creating a GitHub App through the Batch Changes settings interface would fail.
Administration Purge external URL cache on site config save

Fixed a bug where password reset links generated immediately after updating the external URL in site config could use the previous (or default unconfigured.sourcegraph.com) URL due to a stale cache. The external URL cache is now invalidated whenever site config is saved.
Administration Exclude service accounts on admin dashboard
Analytics Add default description for env-var-configured telemetry allowlist entries

Fixed panic when telemetry allowlist entries are configured via environment variable
Authentication Fix checkmark style on device flow page
Authentication Unescape HTML entities in M2M credentials

Fixed M2M credential names and descriptions containing apostrophes or other special characters being displayed with raw HTML entities (e.g., ' instead of ').
Authentication Handle empty publicAccountData

Fixed account security page to correctly show SAML connection status when the SAML provider does not provide standard attribute statements.
Authentication Soften DCR client warning to avoid discouraging MCP users

Changed the OAuth consent screen messaging for third-party MCP clients from "has not been verified by Sourcegraph administrators" with an "Unverified" badge to "Third-party" badge with simpler trust guidance.
Authentication Exclude service accounts from users count

Service accounts are now excluded from the registered users count on the administration users page and license page, and shown separately with their own count.
Cody Disable completion request count quota system if Cody is disabled

Remove the option to configure completion quotas when Cody is disabled. Unless Cody is enabled, this configuration no longer has any effect.
Executors Set HOME on the executor pod spec to avoid defaulting to /

Set the HOME environment variable in executor job pods to ensure processes running in the pod containers use the mounted volume instead of falling back to /.
Executors Propagate FSGroup from the executor's environment to the job's security context

Propagated KUBERNETES_FS_GROUP environment variable to the executor job pod's security context.
Executors Improve handling of very large lines from command outputs

Improved handling of extremely large outputs when a worker executes commands
GitHub Failing to load GHApp connections are no longer fatal to frontend

Loading GitHub App code host connections from a declarative config file no longer prevents frontend pods from starting when failures occur.
GitLab Fix GitLab allowGroups membership check rate limiting

Fixed GitLab OAuth login failures caused by API rate limiting when allowGroups is configured and the user belongs to a large number of groups. Group membership is now verified with a single targeted API call per allowed group instead of paginating through all user groups.
GraphQL Set the max page size for permissions sync jobs to 500 as documented

Fixed a bug where the permissionsSyncJobs GraphQL resolver would only return a maximum of 100 results, despite it being documented as 500.
Inference Increase timeout from 2m to 10m

This increases the timeout on SMP from 2 to 10 minutes and also removes the capability to override the timeout by setting the header "X-Timeout-Ms".
Inference Preserve Gemini thinking signature if thinking text is empty

Preserve Gemini thinking signature when thinking text is empty to prevent inference failures on tool calls
Observability Set 'sampling.retain' only when request explicitly requests tracing in 'sampling: all' mode

sampling.retain trace attribute is now only set when tracing is explicitly requested via ?trace=1 query parameter or X-Sourcegraph-Request-Trace header, rather than being set for all requests when observability.tracing: { sampling: all } is configured. Behaviour in other sampling modes (selective, none) is unchanged.
Permissions Remove stale jobs

Removed redundant permission sync jobs to prevent queue growth
Repositories Don't mark cloning repos as not_cloned

Fixed incorrect status reporting for long-running repository clones
Repositories Exclude soft deleted when calculating queue rank

Fixed queue position calculation for repository optimization to exclude soft-deleted repositories
Repositories Treat git auth failures as external errors for SLO purpose
Slack Improve error message on email mismatch

Improved Slack integration error messages when an associated Sourcegraph account email could not be found, informing the user how to resolve the issue themselves.
Slack Always display app manifest on admin setup page

Slack app manifest now always displayed on the Administration > Slack integration page for reference, irrespective of integration status.
UI Move button chrome to variant level

Icon and link button variants no longer incorrectly display borders, shadows, or push-down effects when used in expandable sections and tree nodes.
UI Fix Overview UI and hover view card layout issues
UI Remove stale global sourcegraph-mark preload

Removed stale preload for sourcegraph-mark.svg that was causing browser warnings on SvelteKit pages where the asset is not used.
UI Increase background contrast in dark mode

Improved contrast for raised and muted backgrounds in dark mode. Fixed code insight centered legend button styling.
UI Specify content-type in example curl requests

Fixed curl request examples to include required content-type header for GraphQL queries.
UI Fix 'no conversations' flashing when opening mobile nav
Blame Fix "View blame prior to this change" to preserve blame view
Blame Use muted background for blame gutter

Blame gutter now uses a muted background color for reduced visual contrast.
Integrations Add missing endpoint handler for /integrations page

Added /integrations to the frontend Go router static page entries so requests are served by the Svelte-backed UI page instead of returning 404.
Migrations Enable BestEffortTerminateBlockingTransactions by default

Schema migrations now terminate blocking transactions by default to prevent upgrades from stalling on long-running queries.

Removed

Deep Search Remove dropdown previews of steps

Remove expandable step previews in Deep Search.
Code Search Remove auto-navigate to single search result feature
Code Intel Remove "Mark as replaceable by auto-indexing" button from indexes view

Removed feature to replace manual uploads with auto-indexing.
Administration Remove update.channel setting

The update.channel site-config setting no longer has any effect. Pings and update checks are now controlled by license features.
Inference Remove Gemini 2.0 Flash and Flash Lite models

Removed Gemini 2.0 Flash and Flash Lite models, redirecting usage to Gemini 2.5 Flash
Inference Remove deprecated Claude models
Observability Remove 'observability.tracing.type: jaeger' option

The deprecated native Jaeger export option has been removed. To set up a tracing backend, refer to our documentation.

Other

Deep Search Migrate settings out of experimentalFeatures

The advanced settings experimentalFeatures.deepSearch.enabled and experimentalFeatures.deepSearch.sharing.enabled are now deprecated. Please use the new top-level fields deepSearch.enabled and deepSearch.sharing.enabled instead. To give customers time to migrate, we will support both the old and new fields for several releases. The precedence is: top-level > experimentalFeatures > default.
Batch Changes Replace native-ssbc-execution FF with site config

The site config batchChanges.nativeServerSideExecution replaces the feature flag native-ssbc-execution. Support for native-ssbc-execution will be removed in a future release.
Administration Clarify between roles and permissions

Renamed sidebar entries from "Permissions" and "Roles" to "Repository permissions" and "Role-based access control" for clarity.
Administration Move 'OAuth clients' under 'Integrations' category
Analytics Enable collection of userIds in admin user deletion events

Enabled collection of user IDs in telemetry when admins delete users to improve user deduplication.
Authentication Rename Account security to Security in settings

Renamed the "Account security" settings menu item and page heading to "Security".
Security Update apko and edwards25519 to resolve CVEs

Resolved security vulnerabilities CVE-2026-25121, CVE-2026-25122, and CVE-2026-26958 by updating apko and edwards25519 dependencies.