[eng-dev-ecosystem-bot]

Update Databricks CLI to v1.23.0

[github-actions]

If integration tests don't run automatically, an authorized user can run them manually by following the instructions below:

Trigger:
go/deco-tests-run/vscode

Inputs:

• PR number: 2276
• Commit SHA: eab3ee4ea2414879ddd77c834eba0ccd969953a5

Checks will be approved automatically on success.

[rugpanov]

Executive summary — Databricks CLI v1.22.1 → v1.23.0

CLI

• aitools list and plugin installs no longer hit GitHub API rate limits, because skills are now pinned to 0.2.32 (#7159).
• databricks ssh connect now puts claude and codex on the PATH on dedicated clusters (#7190). On serverless it does the same in --ide sessions and for non-interactive commands (#7123).

AI Runtime

• Workloads can now use the GPU_1xRTX6000 accelerator in workspaces that have it enabled (#7214).
• databricks air run -h config.compute lists only the accelerators available in the current workspace (#6993).

Bundles

• New config:
  • workspace.sync_mode takes overwrite (default), in-place or immutable. It replaces presets.source_linked_deployment and experimental.immutable_folder, which are now deprecated and print a warning (#7183).
  • lifecycle.depends_on orders resources without referencing their fields (#7120).
• New deploy behavior:
  • bundle deploy --select can now select resources for deletion (#7023).
  • Immutable-folder deploys refuse to deploy onto a snapshot that was changed outside the bundle. bundle deploy --force moves the deployment to a fresh snapshot (#6774).
• Upload revert: file uploads go back to /workspace-files/import-file. This rolls back #6149 and #7034 from v1.21.0. It fixes notebooks being uploaded as plain files, and deploy failures such as SQL notebooks (#7216). If a remote file's type differs from the local one, the CLI now replaces it instead of blocking the deploy (#7218).
• Fixes:
  • bundle validate no longer fails with "expected a map to index" when schedule, trigger or continuous is a whole-block reference (#7225).
  • The CLI no longer prints spurious "required field is not set" warnings for those same whole-block references (#7226).
  • --include-locations no longer fails when a resource is missing a required field (#7185).

Dependency updates

• Dependencies with known vulnerabilities are bumped (#7213).
• The Go SDK moves to v0.190.0 (#7155) and then v0.191.0 (#7211).
• The ssh agent shim's Node.js moves from v24.21.0 to v24.22.2 (#7246).

What could be integrated into the VS Code extension experience

Items are ranked roughly by value for the effort.

Fixes users get just from this bump (no code change)

• Resource explorer and summary (#7185). The extension always runs bundle summary --include-locations --target <t> --force-pull (packages/databricks-vscode/src/cli/CliWrapper.ts:1072-1080). Before this fix, one resource with a missing required field broke the whole summary refresh. That fix ships with this bump.
• Validation (#7225, #7226). The extension runs bundle validate --target <t> (CliWrapper.ts:1041). Its stderr goes to the output channel at error level (CliWrapper.ts:1054-1056). Bundles with whole-block schedule/trigger/continuous references now validate cleanly, without false warnings.
• Deploy uploads (#7218). "Deploy bundle" and "Force deploy bundle" both run bundle deploy (CliWrapper.ts:1208-1217). Users stop getting notebooks uploaded as plain files and SQL-notebook deploy failures, which started in v1.21.0. I have not checked whether bundle sync (CliWrapper.ts:1291) shares this upload path.
• AI tools rate limits (#7159). The extension calls aitools install, update, uninstall and list --output json (CliWrapper.ts:836-960). The rate-limit fix applies directly to the AI Tools panel.
  • Check this before merge. The update check treats any skill whose installed version !== latest_version as outdated (packages/databricks-vscode/src/aitools/AiToolsManager.ts:76-79). With latest_version now pinned to 0.2.32, a user on a different version (higher or lower) will see "update available".
• SSH remote sessions (#7190, #7123). The extension opens remote windows with ssh connect --ide=<vscode|cursor> --auto-approve. It adds --cluster or --accelerator as needed (CliWrapper.ts:152-166). Remote windows from the extension's SSH flow now get claude/codex with no change on our side. A docs or walkthrough mention would be the only follow-up.

Cleanup: regenerate the static bundle schema types

• packages/databricks-vscode/src/bundle/BundleSchema.ts is generated by package:bundle-schema:write (packages/databricks-vscode/package.json:1994). It was last regenerated in Regenerate bundle schema #1728. It still has source_linked_deployment (BundleSchema.ts:270) and has no sync_mode or lifecycle/depends_on types.
• YAML autocomplete is not affected. It loads bundle schema from the bundled CLI at runtime (packages/databricks-vscode/src/bundle/bundleAutocompleteProvider.ts:13), so workspace.sync_mode and lifecycle.depends_on show up in completion once this bump lands.
• Regenerating only updates the TS types. Outside the generated file, no extension code reads presets.source_linked_deployment or experimental.immutable_folder, so the deprecation needs no migration.

Small, using existing plumbing: offer "Force deploy" when an immutable deploy is refused (#6774)

• The force path already passes --force-lock --force (CliWrapper.ts:1216). It is exposed as databricks.bundle.forceDeploy, titled "Force deploy bundle" (package.json:665-669, packages/databricks-vscode/src/ui/bundle-resource-explorer/BundleCommands.ts:174-176). So users can already recover from the new break-glass refusal.
• Today a failed deploy only shows a generic "Error deploying bundle." (BundleCommands.ts:159-161). The change would detect the break-glass error and add a "Force deploy" action to that popup.
• This is a few lines of new UI on existing plumbing. Note that --force also bypasses the CLI's git-branch check, so the popup text should say so.

Net-new feature: deploy only the selected resource with --select (#7023)

• The extension never passes --select. "Deploy and run" deploys the whole bundle before every run. The code marks this with // TODO: Don't deploy if there is no diff between local and remote state (BundleCommands.ts:189-190).
• bundle deploy --select could back a per-resource deploy action in the resource explorer, or make deploy-and-run faster. With #7023, deleting a resource can also be scoped to a selection.
• This is net-new work. It needs:
  • a bundleDeploy parameter (CliWrapper.ts:1196)
  • a tree-node command and menu contribution
  • telemetry
  • a UX decision on stale remote state for resources outside the selection

Net-new, optional: show workspace.sync_mode in the UI (#7183)

• The deploy flow only reads mode to decide whether to confirm (BundleCommands.ts:121-137). Nothing shows how files are synced.
• A read-only indicator could show sync_mode from the validated config (for example, "in-place: jobs run your local source"). This would need new config-model plumbing and a UI element, and the value is modest.

Not actionable now: GPU_1xRTX6000 and per-workspace accelerators (#7214, #6993)

• The SSH compute picker hard-codes GPU_1xA10 and GPU_8xH100 (packages/databricks-vscode/src/ssh/SshCommands.ts:47-62).
• Both changelog items are about databricks air workloads, not ssh connect --accelerator. The per-workspace list is only shown in -h help text, with no machine-readable output to consume.
• Do not add GPU_1xRTX6000 to the picker until ssh connect --accelerator support for it is confirmed. A dynamic, per-workspace picker would need a structured CLI or API surface, which this release does not add.

No-ops for the extension

• The Go SDK bumps (#7155, #7211), the vulnerability bumps (#7213) and the SSH-shim Node.js bump (#7246) change nothing the extension depends on.
• lifecycle.depends_on (#7120) only affects bundle config and deploy ordering. The extension gets it through the runtime schema, so no work is needed beyond the optional type regeneration above.

_{🤖 Auto-generated executive summary of the CLI v1.22.1 → v1.23.0 changelog. Integration notes are opportunities, not commitments — verify before acting.}