- get_credentials_schema returns schemas keyed by secret type
- validate an external provider's secret against the schema for its
secret_type instead of accepting any declared schema
- reject a secret_type the provider does not declare
- Validate the secret is a JSON object before the no-schema path accepts it,
so a list/string/null cannot be persisted and fail later at {**secret}
- Add parametrized coverage for list/string/null/int payloads
- Move get_provider_type_choices into a leaf module so the provider
serializer field reuses the filters' cached list instead of recomputing
SDK provider discovery on every request
- Backfill provider_str synchronously in 0095 (single UPDATE) so the column
is populated before 0096 sets it NOT NULL, removing the Celery race
- Recreate the unique index inside 0096's transaction with a lock_timeout,
closing the duplicate-provider window left by the concurrent rebuild
- Drop migration 0097 and the now-unused backfill_provider_str task
- Reword get_class docstring: it may populate the _ep_providers cache,
rather than claiming "no global state"
- Assert ImportError specifically in the unknown-provider test to enforce
the public API contract
- Drop the unused provider_class_name left over after get_class delegation
- Compare the module's last dotted segment instead of substring
- Prevent a provider name from capturing overlapping built-ins
- Add parametrized regression test (cloud, git, work, open cases)
- Update get_bulk test mock to the real dotted module name
- Match shadowing entry point by name instead of calling ep.load()
- Prevent plug-in code from executing during a built-in run
- Update regression test to assert ep.load is never called
- Short-circuit on is_builtin_provider before loading entry points
- Prevent same-name plug-ins from flipping a built-in onto the tool-wrapper path
- Avoid executing plug-in code via ep.load() for built-in names
- Add regression test asserting ep.load is never called
- Add get_credentials_schema to the provider contract
- Validate non-built-in secrets against the declared schema; built-ins unchanged
- Accept secrets as-is when no schema is declared (validated at connection)
- Add get_scan_arguments/get_connection_arguments to the provider contract
- Route non-built-in providers through the contract; built-ins unchanged
- Cover the external dynamic path in tests
- Replace the hardcoded provider match with Provider.get_class
- Drop the closed provider-type union and TYPE_CHECKING imports
- Cover built-in and external entry-point resolution in tests
- Replace the static provider enum in filters with the SDK provider list
- Cache the provider-type choices for hot list endpoints
- Drop the dead provider enum filter override
- Drive provider validity from the SDK instead of a static enum
- Tolerate providers without a uid validator at model clean()
- Accept any SDK-exposed provider in the provider serializer field
- Promote the synced shadow column into provider, dropping the enum
- Rebuild the partial unique index concurrently after the swap
- Keep provider input validation at the serializer layer
- Add batched per-tenant backfill job for the provider_str column
- Register backfill task on the backfill queue
- Dispatch the backfill from a data-only migration
- Add nullable provider_str CharField mirroring the provider enum column
- DB trigger keeps provider_str in sync on INSERT and UPDATE
- First step of the zero-downtime migration of the provider enum to varchar
- Add okta, scaleway, stackit to known_providers so they no longer
appear as dynamically-discovered "extra" providers
- Fix missing comma in usage string (stackitvercel -> stackit,vercel)
- Move "external/custom providers" (Added) and namespaced-config unwrap
(Fixed) out of the released 5.26.0/5.25.0 blocks
- Remove the duplicated Fixed section left in 5.25.0
- Add public get_class() resolving built-in and entry-point providers
- Refactor init_global_provider to use it; collision warning stays there
- Refactor get_providers_help_text to use it
StylusFrost