Bump avo from 4.1.15 to 4.3.0

[dependabot]

Bumps avo from 4.1.15 to 4.3.0.

Release notes

Sourced from avo's releases.

v4.3.0

🎸 Features

• Show the record count on array resources @​Shub3am (avo v.4.2.11 #4852)
• Add hide_if_blank field option @​Shub3am (avo v.4.2.11 #4851)
• feature: warn before leaving a form with unsaved changes @​Shub3am (avo v.4.2.11 #4847)
• Locale selector in the top navbar, stored per user @​Paul-Bob (avo v.4.2.9 #4834)
• Lightbox for image previews on file and files fields @​Paul-Bob (avo v.4.2.9 #4833)
• feat: linkable option for has_one fields @​Shub3am (avo v.4.2.9 #4830)
• feat: per_page option for has_many fields @​Shub3am (avo v.4.2.9 #4832)
• Cmd+Return submits the form in any Avo modal @​adrianthedev (avo v.4.2.8 #4824)
• feat: request interface marker, a record-title reachability seam, and LocationField#stored_as @​Paul-Bob (avo v.4.2.7 #4807)
• feat: tooltip: and label_tooltip: field options @​Paul-Bob (avo v.4.2.6 #4812)
• feat: press C on a show page to create a new record @​adrianthedev (avo v.4.2.5 #4803)
• feat: modal_width option for actions @​adrianthedev (avo v.4.2.5 #4802)
• feat(media-library): preview txt, md and csv files on the details page @​adrianthedev (avo v.4.2.5 #4801)
• feat: play a sound when picking a scheme, neutral, or accent @​adrianthedev (avo v.4.2.5 #4751)
• ci: hand the release workflow the bot credentials @​Paul-Bob (avo v.4.2.5 #4799)
• feat: policy-declared field authorization across every Avo surface @​Paul-Bob (avo-advanced_search v.4.2.1, avo-api v.4.2.7, avo-audit_logging v.4.2.2, avo-authorization v.4.2.1, avo-calendar_view v.4.2.1, avo-collaboration v.4.3.0, avo-custom_controls v.4.3.0, avo-dynamic_filters v.4.2.1, avo-http_resource v.4.2.1, avo-kanban v.4.2.1, avo-nested v.4.3.0, avo-notifications v.4.2.1, avo-record_reordering v.4.3.0, avo-scopes v.4.3.0 #289)
• feat(avo-mcp_server): expose an Avo panel as a remote MCP server (AVO-1466) @​Paul-Bob (avo-advanced_search v.4.2.1 #163)
• Export the REST API as an OpenAPI 3.1 document @​Mihai-Munteanu (avo-api v.4.3.0 #366)
• feat(avo-api, avo-mcp_server): show each credential's access level on the index @​Paul-Bob (avo-api v.4.2.8 #338)
• avo-cli: terminal-aware tables, record view and write confirmations (AVO-1828) @​Mihai-Munteanu (avo-api v.4.2.7 #304)
• Index status badges say when a token or MCP connection was revoked @​Paul-Bob (avo-api v.4.2.5 #298)
• avo-cli: a command line client for the Avo REST API, and the _schema endpoint it discovers apps through (AVO-1637) @​Mihai-Munteanu (avo-api v.4.2.5 #248)
• feat(avo-audit_logging,avo-mcp_server,avo-api,avo-ai): trace an audited change back to the connection, token or chat that made it (AVO-1779) @​Paul-Bob (avo-api v.4.2.2, avo-audit_logging v.4.2.1 #259)

✨ Enhancements

• Expose the parent record to custom controllers as @​via_record @​Paul-Bob (avo v.4.2.11 #4857)
• Let array resources opt into create, edit and delete with self.writable @​Paul-Bob (avo v.4.2.10 #4849)
• Normalize neutral theme lightness @​adrianthedev (avo v.4.2.10 #4846)
• enhancement: localize resource descriptions by convention 🤖🤖🤖 @​be-student (avo v.4.2.2 #4778)

🐛 Bug Fixes

• Align top navbar control sizing @​adrianthedev (avo v.4.3.0 #4861)
• Array and HTTP resources build their own index query, so any controller can list them @​Paul-Bob (avo v.4.2.11 #4859)
• test: wait for the nested belongs_to saves before counting records @​Shub3am (avo v.4.2.11 #4855)
• fix: restore neutral navbar text contrast @​adrianthedev (avo v.4.2.11 #4850)
• fix: preserve nested belongs-to dialogs @​adrianthedev (avo v.4.2.11 #4818)
• test: wait for the attach modal to reload between "Attach & Attach another" clicks @​Paul-Bob (avo v.4.2.11 #4845)
• fix: tags field no longer shows stale remote suggestions when typing during a search @​Paul-Bob (avo v.4.2.10 #4842)
• fix: removed tag no longer shows twice in the tags field suggestions @​Paul-Bob (avo v.4.2.10 #4840)
• Keep the default Stimulus targets on field inputs when the html option sets no input data @​Paul-Bob (avo v.4.2.10 #4839)
• fix: keep index filters after deleting a record @​Paul-Bob (avo v.4.2.10 #4841)
• Fix nested Trix editors overwriting each other's content @​Paul-Bob (avo v.4.2.10 #4838)
• Refresh the attach modal's options after "Attach & Attach another" @​Paul-Bob (avo v.4.2.10 #4837)
• Wrap long values in resource sidebars instead of overflowing @​Paul-Bob (avo v.4.2.10 #4836)
• fix: resolve plugin and aliased field types in avo_field helpers @​Shub3am (avo v.4.2.9 #4828)

... (truncated)

Commits

• ea830ed Bump avo to v4.3.0
• 40fc563 Let the resource build, save and destroy its records (#4860)
• 7354283 chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#...
• d1a6668 [js] Update all Yarn dependencies (2026-10-01) (#4864)
• 328fe31 [ruby] Update all Bundler dependencies (2026-10-01) (#4865)
• f3dd0bb 🚨 [security] [js] Update dompurify 3.4.15 → 3.4.16 (patch) (#4862)
• 9114b95 fix: align navbar control sizing (#4861)
• 3635d09 Bump avo to v4.2.11
• 216cc4f Array and HTTP resources build their own index query, so any controller can l...
• 5c461a7 Expose the parent record to custom controllers as @​via_record (#4857)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)