### Summary
This PR sanitizes the parsed tree instead of the string:
`rehype-sanitize` runs after `rehype-raw` and before `rehype-katex`,
with one shared schema.
### Summary
The fix is one line per helper — assign the `order_by(...)` result back
so the
ordering is actually applied to the query.
Co-authored-by: rsnetworkinginc <rsnetworkinginc@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
### Summary
Complete the Go Agent OpenAI-compatible response path for `POST
/api/v1/agents/chat/completions` when `openai-compatible` is true. This
endpoint is already documented and routed, but the Go implementation
returned a placeholder response instead of executing the Agent.
### Summary
The fix turns a negative timeout into a finite 60 second wait inside
`MysqlDatabaseLock`, which both servers accept. Callers keep expressing
"block until available", and the equivalent PostgreSQL and GaussDB work
on the same `-1` semantics (#16346, #18506) is untouched. Non-negative
timeouts keep their current behaviour.
---------
Co-authored-by: Krim <git@krim.dev>
### Summary
OIDC discovery builds its URL as
`f"{issuer}/.well-known/openid-configuration"`. Providers whose issuer
carries a trailing slash therefore get asked for a URL with a double
slash in it, which 404s. authentik is one of them: its issuer is
`https://auth.example.com/application/o/<app>/`, so the request goes to
`.../o/<app>//.well-known/openid-configuration` and login fails right at
the start with `Failed to fetch OIDC metadata`.
Stripping trailing slashes off the issuer before joining the well-known
path is enough. The `issuer` used later for ID token validation still
comes from the discovery document itself, so nothing else about the flow
changes.
Co-authored-by: Krim <git@krim.dev>
### Summary
Multi-type memory prompts were assembled from sets, so their instruction
and output sections could change order across Python processes with
different hash seeds. Because the generated default prompt is persisted
and later compared as a string, a restart could make an untouched
default look custom and prevent it from being regenerated when memory
types change.
### Summary
Preserve explicitly saved `false` values for RAPTOR and GraphRAG when
hydrating the dataset Configuration form. The existing form defaults
still apply when either enable flag is absent.
Adds hook-level regression coverage for both explicit disablement and
default fallback behavior.
Fixes#17654
