[github-actions]

packages/databricks-vscode

(2026-11-05)

• Treat a bundle variable used as the value of a secret as sensitive, as part of the update to Databricks CLI v1.24.0 (Update Databricks CLI to v1.24.0 #2286) (40eb86e). If another field, such as a job parameter or the secret's comment, references that variable, bundle validate and bundle deploy fail, because the value would be used in plain text. Mark other variables that hold secrets with sensitive: true to get the same protection. If you can't change the bundle yet, stay on extension v2.23.0. Serverless SSH connections get a new default connection name, so the first connection after the update is set up again; the old connection's SSH keys and known hosts in your local .databricks folder are no longer used and can be removed. Signing in with a profile name that contains a dot, such as team.prod, no longer overwrites the host and token of the [team] profile. bundle deploy no longer redeploys an app on every run because of its config.env values. See the CLI release notes for details
• Open the remote window for a Databricks SSH tunnel when the code or cursor command is not on your PATH: the extension now finds the editor executable in its install folder (Resolve the editor executable relative to env.appRoot #2285) (004553b)

packages/databricks-vscode-types

(2026-11-05)

Curation notes

• Semver: patch (2.23.0 → 2.23.1). The only extension change is Resolve the editor executable relative to env.appRoot #2285, which is a bug fix. The bundled CLI v1.24.0 also adds bundle resources (data_quality_monitors, materialization_sets) and sensitive: true variables, and adds a stricter rule for variables used as secret values. These come from the CLI and are not extension features, so they don't drive the bump.
• Smoke-test focus: the extension runs databricks ssh connect for serverless without --environment-version or a connection name. CLI v1.24.0 (databricks/cli PR 7310) changes the default serverless connection name, so reconnecting from a Remote Explorer entry made with v2.23.0 needs a manual check before publish.
• Cleanup:
  • Removed the generated closes [#N] links. They pointed at the release's own PRs.
  • Rewrote both titles for customer impact and put the CLI entry first, because it can make existing bundles fail validation.
  • Added the CLI v1.24.0 items that extension users see: the secret-variable rule, the SSH connection name, the dotted profile name fix in databricks auth login (the extension passes --profile), and the app redeploy fix. Other CLI items are in the CLI release notes.
• Left out of the changelog: nothing.
• packages/databricks-vscode-types/CHANGELOG.md stays empty under the release header, as in recent releases.

This pull request and its description were written by Isaac.

[github-actions]

If integration tests don't run automatically, an authorized user can run them manually by following the instructions below:

Trigger:
go/deco-tests-run/vscode

Inputs:

• PR number: 2289
• Commit SHA: 32b94182cd721fcc2e84bd5feb5a5df46326792c

Checks will be approved automatically on success.

[rugpanov]

E2E run (auto-dispatched by Integration Tests): https://github.com/databricks-eng/eng-dev-ecosystem/actions/runs/42009549439

Only EMU (corporate) accounts on VPN can open this private run. The databricks-eng org has an IP allow list, so personal accounts or off-VPN access get HTTP 403.

Windows unit tests: 1 of 1494 failed (BundleVariableModel › picks up overrides saved from an editor, mocha 5000 ms timeout). The same flake happened on v2.23.0. This PR has no changes under src/bundle, and Windows unit tests passed on both included PRs, so I reran only the failed job.

This comment was written by Isaac.