mirror of
https://github.com/calibrain/shelfmark.git
synced 2026-11-10 12:08:30 +00:00
main
793
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
  Kris AndersonandClaude Sonnet 5.5
|
0d97110f01 |
fix(network): apply HTTP proxy to Anna's Archive download-count lookups (#1686)
Fixes #1685 `_fetch_download_count_inline` fetches `/dyn/md5/inline_info/<md5>` for every search result (5 workers) through a module-level `requests.Session`, with no `proxies=`. `get_proxies()` reads the app config rather than the environment, so with the proxy set in Settings → Network the search page and the bypasser used it while these requests left from the host's own IP, about 50 per search. It now passes `network.get_proxies(url)` on each request, as the Libgen fast path in the same file already does. The session stays module-level for keep-alive, and proxies are resolved per request, so a settings change applies without a restart. Verification (macOS, `uv run --frozen pytest`): - New `tests/direct_download/test_download_count_proxy.py` passes. With the source change reverted it fails (`proxies` is `None`). - `tests/direct_download`: 135 passed, including `test_download_count_reuse.py`. - `ruff check` and `ruff format --check` on the changed files pass. - Not re-run live with this branch built. The behaviour before the change was observed on a running v1.6.2 container: 5 sockets from the `ThreadPoolExecutor` threads straight to the AA mirror's IP on :443, and 1 to the proxy. 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Bug Fixes** * Anna’s Archive download counts are now retrieved using the configured network proxies. This improves access to download-count information in environments where requests need a proxy, while preserving the existing response handling and timeout behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com> |
||
 splitsec2
|
bb13fae0bb |
feat(download): sweep dead torrents and Soulseek leftovers on their own timer (#1619)
This adds two cleanups that nobody notices until they matter, and puts them on their own timer. Both do nothing until their setting and client are configured. The dead-torrent sweep removes a torrent Shelfmark added once it has been stalled, or stuck fetching metadata, for `STALE_TORRENT_HOURS` with no running download owning it, and its partial data goes with it. It only touches torrents this instance added, tracked in a ledger of hashes, whatever category they are in, and only on qBittorrent. The default is 6 hours (3 to 72, and 0 turns it off). I am not sure 6 is right for everyone, so say if you would rather ship it off. The Soulseek sweep covers what a restart leaves in slskd's downloads folder. A finished folder nothing imported gets imported, a partial folder is removed after `SLSKD_CLEAN_LEFTOVERS_DAYS`, and unfinished transfers no running download owns are picked up again when their request still waits for them. Both run from a small background thread every 15 minutes, after a 30 second startup delay. I first ran them from the Hardcover scheduler, but that only runs when Hardcover sync or auto-download is on, so anyone using neither would never get the cleanup. A separate thread keeps them independent, and the interval is fixed so there is no new setting. The new tests mock the sweeps. I also started a scratch instance, and the thread starts and the first cycle is a no-op when nothing is configured. The timer has not run against a real qBittorrent or slskd, though the two sweeps themselves have been in my fork's builds since October. Full Python suite, ruff and basedpyright pass. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **New Features** * Shelfmark periodically recovers eligible complete Soulseek downloads and reattaches unfinished transfers. It can also clean up eligible old folders while protecting active, wanted, and already-imported downloads. * Shelfmark can remove tracked qBittorrent torrents that have stalled or exceeded the configured inactivity limit, while preserving torrents associated with active tasks. Set the limit to 0 to disable cleanup. * **Bug Fixes** * Isolated Soulseek downloads reject task IDs that could produce unsafe or mismatched destination folders. * **Documentation** * Added configuration guidance for Soulseek recovery and cleanup, and qBittorrent stale-torrent cleanup, including defaults and eligibility rules. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
splitsec2
|
e575ff0fcb |
feat(activity): clearer cards, a Rejected view and Reopen for failed deliveries (#1618)
A batch of activity list changes from running it as an admin on my own
instance. They are separate commits that build on each other, so they
can be reviewed in order.
The cards read better. Every card gets a format pill (violet for audio,
orange for ebooks), the requester is named once, and finished cards say
how long a download took and how long ago it ended ("took 5m · 35m
ago"). A download that picked up work already under way shows a
Reattached pill.
Admins can tell what is automatic and what needs a person. A declined
request shows who declined it and when, anything with an `[auto]` note
reads "Declined automatically", and "Needs Review" becomes "No Match
Yet" with a line saying the search repeats on every sync.
There is a Rejected view next to History for admins, with Reopen on each
card and a way to hide the dead ones.
The part to read most carefully is the backend in `requests_service.py`
and `user_db.py`. An admin can now reopen a fulfilled request whose
download failed or was cancelled, and the reopen a failed download
triggers remembers which release failed, so the next search doesn't pick
it again.
I ran it on a scratch instance (when pulling them together to move from
my fork to upstream) as an admin with seeded requests and looked at the
pills, the durations, the wording and the Rejected view in a browser.
Reopening a fulfilled request I only exercised in the tests. The
frontend and Python suites, type check, ruff and basedpyright pass.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
<!-- coderabbit-ai-generated:v1 -->
## Summary by CodeRabbit
* **New Features**
* Admins can review rejected requests in a dedicated view, hide or
restore cards, and reopen requests.
* Fulfilled requests with failed or cancelled deliveries can be
reopened; the failed release is skipped in the next automatic search.
* Activity cards now show format badges, download timing, and when a
download resumes existing work.
* **Improvements**
* Activity views clarify automatic retries and actions, and show
reviewer names for admins.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
|
||
 CaliBrain
|
be803ed5ca |
Adding Coderabbit as a PR sponsor (#1682)
<!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Documentation** * Added a Sponsors section to the README recognizing CodeRabbit and linking to its logo. * **Chores** * Removed the automated pull-request review workflows for repository and fork pull requests. These workflows no longer trigger review runs for the pull-request events they previously handled. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
splitsec2
|
76d7df306f |
fix(requests): retrying a request after its client failed offers the same release again (#1677)
When a request's download fails in a way the queue can't resume, the request is reopened and its Retry button opens the release list. The release that just failed was drawn there as a red, disabled "Failed" button for as long as the failed task stayed in the queue status, so you couldn't pick it again even when the release was fine and the download client was the problem. A bad qBittorrent password is the easy way to hit it. Thanks @joshft91 for the report and the steps. What changes: - In the release list, a failed request download now shows Retry, the same as a failure the queue can retry already does. A direct download with nothing to retry from still shows Failed. The rule lives in one small helper used by the release modal and both button-state paths in `useDownloadTracking`. - A client that refuses the login is no longer held against the release. qbittorrent-api raises `LoginFailed` with no message for a wrong password, and only "Forbidden" or "Unauthorized" for a bad session or API key, so none of it matched the unreachable-client markers from #1655 and the release went into `failed_releases`. The qBittorrent client now says "qBittorrent authentication failed (...)" for these. - The request reopen and the auto-download retry used two copies of the same marker list. They now share one in `status_messages.py`, which also counts an explicit authentication failure as the client's fault. A bare 403 or 401 is not on it, since a dead .torrent link fails that way too and that one is the release's. Genuine release failures (no seeders, a rejected torrent, a dead .torrent link) are still remembered as #1655 intended. Tested with a scratch instance against a mock Prowlarr and a fake qBittorrent that rejects the login: before, the request's Retry opened the list with the failed release as a red X; after, it shows Retry, picking it fulfils the request again, and the request reopens without the release in `failed_releases`. New tests cover the qBittorrent messages, both reopen paths and the button state. Fixes #1674 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Bug Fixes** * Failed releases are no longer skipped after download-client connection or login failures; download failures and stall cancellations remain eligible to be skipped on the next search. * Failed requests with an associated request can now show a retry option, while direct downloads without retries remain marked as failed. * qBittorrent login and authorization errors are reported more clearly. * **Documentation** * Clarified which failures cause a release to be skipped on a later search. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
 dependabot[bot]
|
efc0f3df6b |
build(deps): bump publicsuffixlist from 1.1.2.20261101 to 1.1.2.20261105 (#1680)
Bumps [publicsuffixlist](https://github.com/ko-zu/psl) from 1.1.2.20261101 to 1.1.2.20261105. <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/ko-zu/psl/commits">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Chores** * Updated the minimum required version of a dependency. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
f9d0dbfcc4 |
build(deps): bump the python-deps group with 6 updates (#1679)
Bumps the python-deps group with 6 updates: | Package | From | To | | --- | --- | --- | | [dnspython](https://github.com/rthalley/dnspython) | `2.9.1` | `2.9.2` | | [authlib](https://github.com/authlib/authlib) | `1.9.2` | `1.9.5` | | [joserfc](https://github.com/authlib/joserfc) | `1.7.7` | `1.8.0` | | [seleniumbase](https://github.com/seleniumbase/SeleniumBase) | `4.56.5` | `4.57.1` | | [prek](https://github.com/j178/prek) | `0.5.9` | `0.5.10` | | [ruff](https://github.com/astral-sh/ruff) | `0.17.3` | `0.17.4` | Updates `dnspython` from 2.9.1 to 2.9.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/rthalley/dnspython/releases">dnspython's releases</a>.</em></p> <blockquote> <h2>dnspython 2.9.2</h2> <p>A malicious WKS record in text format can consume excessive memory and CPU when parsed, possibly causing the process to exit due to memory exhaustion. Thanks to Jace (GitHub <a href="https://github.com/manus-use"><code>@manus-use</code></a>) for discovering and reporting this issue.</p> <p>See <a href="https://dnspython.readthedocs.io/en/stable/whatsnew.html">What's New</a> for details.</p> <p>The minimum supported version of Python is 3.11.</p> <p>My thanks to the many people who have contributed to this release. Also thanks to my co-maintainers: Nicki Křížek, Petr Špaček, and Brian Wellington.</p> <p>This release was published to PyPI using Trusted Publishing.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/rthalley/dnspython/blob/main/doc/whatsnew.rst">dnspython's changelog</a>.</em></p> <blockquote> <h2>2.9.2</h2> <ul> <li>A maliciously crafted zone file could use a WKS record to consume excessive memory and CPU, possibly causing the process to exit due to memory exhaustion. Thanks to Jace (GitHub <a href="https://github.com/manus-use"><code>@manus-use</code></a>) for discovering and reporting this issue.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/rthalley/dnspython/commit/854bedd6d641cb42785d26ca674ed2c0f20131e0"><code>854bedd</code></a> bump README.md version</li> <li><a href="https://github.com/rthalley/dnspython/commit/388db14ee9923288f6e73f86e482c77706e59d73"><code>388db14</code></a> Constrain WKS bitmap size.</li> <li><a href="https://github.com/rthalley/dnspython/commit/7e1832f58a9f1583db00461ae97f7a8603c6989f"><code>7e1832f</code></a> version bump</li> <li>See full diff in <a href="https://github.com/rthalley/dnspython/compare/v2.9.1...v2.9.2">compare view</a></li> </ul> </details> <br /> Updates `authlib` from 1.9.2 to 1.9.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/authlib/authlib/releases">authlib's releases</a>.</em></p> <blockquote> <h2>v1.9.5</h2> <p>Changelog: <a href="https://docs.authlib.org/en/stable/upgrades/changelog.html#changelog-1-9-5">https://docs.authlib.org/en/stable/upgrades/changelog.html#changelog-1-9-5</a></p> <p><strong>Full Changelog</strong>: <a href="https://github.com/authlib/authlib/compare/v1.9.4...v1.9.5">https://github.com/authlib/authlib/compare/v1.9.4...v1.9.5</a></p> <h2>v1.9.4</h2> <p>Changelog: <a href="https://docs.authlib.org/en/stable/upgrades/changelog.html#changelog-1-9-4">https://docs.authlib.org/en/stable/upgrades/changelog.html#changelog-1-9-4</a></p> <p><strong>Full Changelog</strong>: <a href="https://github.com/authlib/authlib/compare/v1.9.3...v1.9.4">https://github.com/authlib/authlib/compare/v1.9.3...v1.9.4</a></p> <h2>v1.9.3</h2> <p>Changelog: <a href="https://docs.authlib.org/en/stable/upgrades/changelog.html#changelog-1-9-3">https://docs.authlib.org/en/stable/upgrades/changelog.html#changelog-1-9-3</a></p> <p><strong>Full Changelog</strong>: <a href="https://github.com/authlib/authlib/compare/v1.9.2...v1.9.3">https://github.com/authlib/authlib/compare/v1.9.2...v1.9.3</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/authlib/authlib/commit/42607cbc2135252a641a845e4ed7f94e3a922c47"><code>42607cb</code></a> chore: release 1.9.5</li> <li><a href="https://github.com/authlib/authlib/commit/ce5bb0d0413765a638a623b1332a32feca142dcc"><code>ce5bb0d</code></a> fix(jose): refuse SSH keys with a tab and SSH certificates as HMAC secrets</li> <li><a href="https://github.com/authlib/authlib/commit/9dffddfaea643835b92caefe05f1548f57bd1433"><code>9dffddf</code></a> chore: release 1.9.4</li> <li><a href="https://github.com/authlib/authlib/commit/67db2aa36a9c5372efc3a31e441d315504dc1915"><code>67db2aa</code></a> fix(oauth): let IDJAGGrant resolve users by issuer and subject</li> <li><a href="https://github.com/authlib/authlib/commit/e90d1b19bf216e1359058b4cdb86ab557fb0a9f3"><code>e90d1b1</code></a> chore: release 1.9.3</li> <li><a href="https://github.com/authlib/authlib/commit/ec4c7a16c5dadbc6c51a868456aba527785f8637"><code>ec4c7a1</code></a> Merge commit from fork</li> <li>See full diff in <a href="https://github.com/authlib/authlib/compare/v1.9.2...v1.9.5">compare view</a></li> </ul> </details> <br /> Updates `joserfc` from 1.7.7 to 1.8.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/authlib/joserfc/releases">joserfc's releases</a>.</em></p> <blockquote> <h2>1.8.0</h2> <h3> 🐞 Bug Fixes</h3> <ul> <li>Use python>=3.11, improve type hints - by <a href="https://github.com/lepture"><code>@lepture</code></a> <a href="https://github.com/authlib/joserfc/commit/7c6de8c"><!-- raw HTML omitted -->(7c6de)<!-- raw HTML omitted --></a></li> <li>Replace typing as t syntax - by <a href="https://github.com/lepture"><code>@lepture</code></a> <a href="https://github.com/authlib/joserfc/commit/7422af8"><!-- raw HTML omitted -->(7422a)<!-- raw HTML omitted --></a></li> <li>Treat claims option "value" as the expected claim value - by <a href="https://github.com/choksi2212"><code>@choksi2212</code></a> <a href="https://github.com/authlib/joserfc/commit/232d647"><!-- raw HTML omitted -->(232d6)<!-- raw HTML omitted --></a></li> <li><strong>jwe</strong>: Refresh ECDH ephemeral keys per encryption - by <a href="https://github.com/lepture"><code>@lepture</code></a> <a href="https://github.com/authlib/joserfc/commit/cc6ec3f"><!-- raw HTML omitted -->(cc6ec)<!-- raw HTML omitted --></a></li> <li><strong>jwe</strong>: Reject explicitly empty AAD - by <a href="https://github.com/lepture"><code>@lepture</code></a> <a href="https://github.com/authlib/joserfc/commit/96ef53a"><!-- raw HTML omitted -->(96ef5)<!-- raw HTML omitted --></a></li> <li><strong>jwk</strong>: Reject certificates and prefixed public keys as oct - by <a href="https://github.com/lepture"><code>@lepture</code></a> <a href="https://github.com/authlib/joserfc/commit/bf66415"><!-- raw HTML omitted -->(bf664)<!-- raw HTML omitted --></a></li> <li><strong>jws</strong>: Protect critical JSON headers and b64 mode - by <a href="https://github.com/lepture"><code>@lepture</code></a> <a href="https://github.com/authlib/joserfc/commit/04cb5d8"><!-- raw HTML omitted -->(04cb5)<!-- raw HTML omitted --></a></li> <li><strong>jwt</strong>: Reject tokens whose exp equals the current time - by <a href="https://github.com/carlok"><code>@carlok</code></a> and <strong>Claude Sonnet 5.5</strong> <a href="https://github.com/authlib/joserfc/commit/e2e3a29"><!-- raw HTML omitted -->(e2e3a)<!-- raw HTML omitted --></a></li> <li><strong>jwt</strong>: Reject NaN and Infinity in exp, nbf and iat - by <a href="https://github.com/carlok"><code>@carlok</code></a> and <strong>Claude Sonnet 5.5</strong> <a href="https://github.com/authlib/joserfc/commit/b8a2394"><!-- raw HTML omitted -->(b8a23)<!-- raw HTML omitted --></a></li> <li><strong>jwt</strong>: Reject True/False in exp/nbf/iat - by <a href="https://github.com/lepture"><code>@lepture</code></a> <a href="https://github.com/authlib/joserfc/commit/953e509"><!-- raw HTML omitted -->(953e5)<!-- raw HTML omitted --></a></li> <li><strong>mypy</strong>: Use NotRequired in TypedDict - by <a href="https://github.com/lepture"><code>@lepture</code></a> <a href="https://github.com/authlib/joserfc/commit/351c1b3"><!-- raw HTML omitted -->(351c1)<!-- raw HTML omitted --></a></li> </ul> <h5> <a href="https://github.com/authlib/joserfc/compare/1.7.7...1.8.0">View changes on GitHub</a></h5> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/authlib/joserfc/blob/main/docs/changelog.rst">joserfc's changelog</a>.</em></p> <blockquote> <h2>1.8.0</h2> <p><strong>Released on November 3, 2026</strong></p> <ul> <li><strong>JWT</strong>: Reject non-finite and boolean NumericDate claims, and reject JWT payloads that are not JSON objects.</li> <li><strong>JWK</strong>: Reject X.509 certificates and prefixed asymmetric public keys as oct keys.</li> <li><strong>JWS</strong>: Require critical headers and RFC 7797 <code>b64</code> parameters to be protected, and require a consistent <code>b64</code> value across General JSON signatures.</li> <li><strong>JWE</strong>: Generate fresh ECDH ephemeral keys for each encryption and reject an explicitly empty AAD member.</li> <li>Drop Python 3.10 support; Python 3.11 or newer is required.</li> <li>Preserve key subclasses in factory return types with <code>typing.Self</code>.</li> <li>Improve claim validation type narrowing with <code>typing.TypeGuard</code> and refine password, native key, and equality annotations.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/authlib/joserfc/commit/f345ff71cd6c36452a4e11e47b805ad450a95dd8"><code>f345ff7</code></a> chore: release 1.8.0</li> <li><a href="https://github.com/authlib/joserfc/commit/f1a3e436439c43905c96ddfb1abad54c38b40f2c"><code>f1a3e43</code></a> chore: update deps</li> <li><a href="https://github.com/authlib/joserfc/commit/96ef53afe0f1af4904fa9c20d7a0f757518751ae"><code>96ef53a</code></a> fix(jwe): reject explicitly empty AAD</li> <li><a href="https://github.com/authlib/joserfc/commit/cc6ec3fdf5ebe144f7d9f7d7cdfed8c82f51b4d4"><code>cc6ec3f</code></a> fix(jwe): refresh ECDH ephemeral keys per encryption</li> <li><a href="https://github.com/authlib/joserfc/commit/04cb5d8bf7feff8d96fe804fe89cd531e8a3af25"><code>04cb5d8</code></a> fix(jws): protect critical JSON headers and b64 mode</li> <li><a href="https://github.com/authlib/joserfc/commit/bf664155d1d057779c0db93ac2e677dba75c86e5"><code>bf66415</code></a> fix(jwk): reject certificates and prefixed public keys as oct</li> <li><a href="https://github.com/authlib/joserfc/commit/953e509ebea1ef98636d2dcd2eec720ac64721c8"><code>953e509</code></a> fix(jwt): reject True/False in exp/nbf/iat</li> <li><a href="https://github.com/authlib/joserfc/commit/6ec88f2bbbc89a46c7e62821f964df1792364040"><code>6ec88f2</code></a> Merge pull request <a href="https://redirect.github.com/authlib/joserfc/issues/109">#109</a> from carlok/fix/exp-boundary</li> <li><a href="https://github.com/authlib/joserfc/commit/b8a23948eca85ebbc713a1f804bcd1508defa060"><code>b8a2394</code></a> fix(jwt): reject NaN and Infinity in exp, nbf and iat</li> <li><a href="https://github.com/authlib/joserfc/commit/e2e3a29e58ae67127193286317bc23513720b5bd"><code>e2e3a29</code></a> fix(jwt): reject tokens whose exp equals the current time</li> <li>Additional commits viewable in <a href="https://github.com/authlib/joserfc/compare/1.7.7...1.8.0">compare view</a></li> </ul> </details> <br /> Updates `seleniumbase` from 4.56.5 to 4.57.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/seleniumbase/SeleniumBase/releases">seleniumbase's releases</a>.</em></p> <blockquote> <h2>4.57.1 - Linux <code>aarch64</code> driver support (and more)</h2> <h2>Linux <code>aarch64</code> driver support (and more)</h2> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/c737901b527516e569ba4ce66c919b5f69e2865f">Add support for "aarch64" drivers on Linux</a> --> This resolves <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4546">seleniumbase/SeleniumBase#4546</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/8504f66f0095188cc53f580cd890367ea1b09e42">Update the default geckodriver version</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/ebebbc92b288cd77b84131b2cb38a34d065fd483">Refresh Python dependencies</a></li> </ul> <h2>What's Changed</h2> <ul> <li>Linux <code>aarch64</code> driver support (and more) by <a href="https://github.com/mdmintz"><code>@mdmintz</code></a> in <a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4547">seleniumbase/SeleniumBase#4547</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.57.0...v4.57.1">https://github.com/seleniumbase/SeleniumBase/compare/v4.57.0...v4.57.1</a></p> <h2>4.57.0 - CDP and MCP updates (and dependencies)</h2> <h2>CDP and MCP updates (and dependencies)</h2> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/aa7cdcd84470d2ae7c6670ff2da34696ce15d0da">Add timeout arg to CDP Mode's get_attribute() method</a> --> This resolves <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4542">seleniumbase/SeleniumBase#4542</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/737093e6130102351efb3cdb0b963b6f2e323540">Auto-detect when evaluate() needs to await a Promise</a> --> This resolves <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4543">seleniumbase/SeleniumBase#4543</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/5a2b40fc85fcb46ae36a2bc2a305879568ec8ba5">Update the default Chromium config</a> --> More stealth</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/d4072a4b3848a166983cd0fc5762d3af3e31a9df">Refresh Python dependencies</a> --> <code>pip</code> --> <code>websockets</code> --> <code>filelock</code> --> <code>trio</code> --> <code>selenium</code> --> <code>uv</code> (optional dependency)</li> </ul> <h2>What's Changed</h2> <ul> <li>CDP and MCP updates (and dependencies) by <a href="https://github.com/mdmintz"><code>@mdmintz</code></a> in <a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4545">seleniumbase/SeleniumBase#4545</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.56.5...v4.57.0">https://github.com/seleniumbase/SeleniumBase/compare/v4.56.5...v4.57.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/d98668b152f79a09c3f348af5173e67cccd8232d"><code>d98668b</code></a> Merge pull request <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4547">#4547</a> from seleniumbase/linux-aarch64-driver-support</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/2c46b3bd8cb957c4577f79a279ed24d33e4d2906"><code>2c46b3b</code></a> Version 4.57.1</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/c30c9b4b6a53eda06e445fa2b8021012251d89d0"><code>c30c9b4</code></a> Update MCP versioning</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/ff6b226c597db9b8af4e6e8a686cf324f6552b63"><code>ff6b226</code></a> Update the ReadMe</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/ebebbc92b288cd77b84131b2cb38a34d065fd483"><code>ebebbc9</code></a> Refresh Python dependencies</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/d71ca0ca298e621f3898b032a3e827d569c8193d"><code>d71ca0c</code></a> Update the docs</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/8504f66f0095188cc53f580cd890367ea1b09e42"><code>8504f66</code></a> Update the default geckodriver version</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/c737901b527516e569ba4ce66c919b5f69e2865f"><code>c737901</code></a> Add support for "aarch64" drivers on Linux</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/5b87e78f577c1c57f033a3f98543e04f59fef4d6"><code>5b87e78</code></a> Update examples and the ReadMe</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/b0e0a33aaf0e166dd2791bafcad29a688d197998"><code>b0e0a33</code></a> Update the ReadMe</li> <li>Additional commits viewable in <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.56.5...v4.57.1">compare view</a></li> </ul> </details> <br /> Updates `prek` from 0.5.9 to 0.5.10 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/j178/prek/releases">prek's releases</a>.</em></p> <blockquote> <h2>0.5.10</h2> <h2>Release Notes</h2> <p>Released on 2026-11-04.</p> <h3>Enhancements</h3> <ul> <li>Add a builtin <code>replace-pattern</code> hook (<a href="https://redirect.github.com/j178/prek/pull/2981">#2981</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Avoid downloading Node prereleases by default (<a href="https://redirect.github.com/j178/prek/pull/2995">#2995</a>)</li> <li>Keep file checks out of rayon's recursive frames (<a href="https://redirect.github.com/j178/prek/pull/2999">#2999</a>)</li> <li>Skip Node releases without a compatible archive (<a href="https://redirect.github.com/j178/prek/pull/2996">#2996</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Add equivalent prek.toml examples throughout the documentation (<a href="https://redirect.github.com/j178/prek/pull/2979">#2979</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/connorbrinton"><code>@connorbrinton</code></a></li> <li><a href="https://github.com/j178"><code>@j178</code></a></li> </ul> <h2>Install prek 0.5.10</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.10/prek-installer.sh | sh </code></pre> <h3>Install prebuilt binaries via powershell script</h3> <pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.10/prek-installer.ps1 | iex" </code></pre> <h3>Install prebuilt binaries via Homebrew</h3> <pre lang="sh"><code>brew install prek </code></pre> <h2>Download prek 0.5.10</h2> <table> <thead> <tr> <th>File</th> <th>Platform</th> <th>Checksum</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/j178/prek/releases/download/v0.5.10/prek-aarch64-apple-darwin.tar.gz">prek-aarch64-apple-darwin.tar.gz</a></td> <td>Apple Silicon macOS</td> <td><a href="https://github.com/j178/prek/releases/download/v0.5.10/prek-aarch64-apple-darwin.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://github.com/j178/prek/releases/download/v0.5.10/prek-x86_64-apple-darwin.tar.gz">prek-x86_64-apple-darwin.tar.gz</a></td> <td>Intel macOS</td> <td><a href="https://github.com/j178/prek/releases/download/v0.5.10/prek-x86_64-apple-darwin.tar.gz.sha256">checksum</a></td> </tr> </tbody> </table> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/j178/prek/blob/main/CHANGELOG.md">prek's changelog</a>.</em></p> <blockquote> <h2>0.5.10</h2> <p>Released on 2026-11-04.</p> <h3>Enhancements</h3> <ul> <li>Add a builtin <code>replace-pattern</code> hook (<a href="https://redirect.github.com/j178/prek/pull/2981">#2981</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Avoid downloading Node prereleases by default (<a href="https://redirect.github.com/j178/prek/pull/2995">#2995</a>)</li> <li>Keep file checks out of rayon's recursive frames (<a href="https://redirect.github.com/j178/prek/pull/2999">#2999</a>)</li> <li>Skip Node releases without a compatible archive (<a href="https://redirect.github.com/j178/prek/pull/2996">#2996</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Add equivalent prek.toml examples throughout the documentation (<a href="https://redirect.github.com/j178/prek/pull/2979">#2979</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/connorbrinton"><code>@connorbrinton</code></a></li> <li><a href="https://github.com/j178"><code>@j178</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/j178/prek/commit/516f5bdce9eab921021edb1c22305ad569605d50"><code>516f5bd</code></a> Bump version to 0.5.10 (<a href="https://redirect.github.com/j178/prek/issues/3001">#3001</a>)</li> <li><a href="https://github.com/j178/prek/commit/6201a32db79e732b1beff563715751e7077f4510"><code>6201a32</code></a> Upgrade serde-saphyr to 2.1.0 (<a href="https://redirect.github.com/j178/prek/issues/2877">#2877</a>)</li> <li><a href="https://github.com/j178/prek/commit/d08703e86427a7c1e593e526f4cbd18a92f4b085"><code>d08703e</code></a> Infer the release version from Cargo metadata (<a href="https://redirect.github.com/j178/prek/issues/3000">#3000</a>)</li> <li><a href="https://github.com/j178/prek/commit/f03096afd4fd8f00847a6618e8e31e6397b336f1"><code>f03096a</code></a> Keep file checks out of rayon's recursive frames (<a href="https://redirect.github.com/j178/prek/issues/2999">#2999</a>)</li> <li><a href="https://github.com/j178/prek/commit/c88a1ccc522e24546d348b55aa83332022a6fae9"><code>c88a1cc</code></a> Skip Node releases without a compatible archive (<a href="https://redirect.github.com/j178/prek/issues/2996">#2996</a>)</li> <li><a href="https://github.com/j178/prek/commit/10e7648e55e1c34e7b10118d4e5aa2acc1933c8d"><code>10e7648</code></a> Avoid downloading Node prereleases by default (<a href="https://redirect.github.com/j178/prek/issues/2995">#2995</a>)</li> <li><a href="https://github.com/j178/prek/commit/f1bfe9d6ea38503c9880d097c1c937d2141fc187"><code>f1bfe9d</code></a> Update prek hooks (<a href="https://redirect.github.com/j178/prek/issues/2993">#2993</a>)</li> <li><a href="https://github.com/j178/prek/commit/71e02db63b6d42e21f83744c3580bf8685b6fc9b"><code>71e02db</code></a> Make release publishing resumable (<a href="https://redirect.github.com/j178/prek/issues/2992">#2992</a>)</li> <li><a href="https://github.com/j178/prek/commit/84c3c67ad0c076848ddfbac4823bf164a696f7ce"><code>84c3c67</code></a> Update CI tools (<a href="https://redirect.github.com/j178/prek/issues/2983">#2983</a>)</li> <li><a href="https://github.com/j178/prek/commit/e4a4b4d7d247e89b26da118329ac11bb3da58ef5"><code>e4a4b4d</code></a> Group CI tools and compatible Rust dependencies (<a href="https://redirect.github.com/j178/prek/issues/2991">#2991</a>)</li> <li>Additional commits viewable in <a href="https://github.com/j178/prek/compare/v0.5.9...v0.5.10">compare view</a></li> </ul> </details> <br /> Updates `ruff` from 0.17.3 to 0.17.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/releases">ruff's releases</a>.</em></p> <blockquote> <h2>0.17.4</h2> <h2>Release Notes</h2> <p>Released on 2026-11-05.</p> <h3>Preview features</h3> <ul> <li>[<code>flake8-logging-format</code>] Avoid behavior changes and syntax errors in fixes (<code>G004</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27419">#27419</a>)</li> <li>[<code>security</code>] Implement <code>tarfile-ignore-zeros-true</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28680">#28680</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Accept a bare raise before a semicolon (<a href="https://redirect.github.com/astral-sh/ruff/pull/29761">#29761</a>)</li> <li>Allow match identifiers after a semicolon (<a href="https://redirect.github.com/astral-sh/ruff/pull/29760">#29760</a>)</li> <li>Fix panic on BOM-prefixed files in diagnostic renderer (<a href="https://redirect.github.com/astral-sh/ruff/pull/30017">#30017</a>)</li> <li>[<code>flake8-simplify</code>] Report collapsible <code>elif</code> clauses after a multi-statement <code>if</code> branch (<code>SIM102</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/29814">#29814</a>)</li> </ul> <h3>Rule changes</h3> <ul> <li>Show more nonprinting characters in diagnostic fix diffs (<a href="https://redirect.github.com/astral-sh/ruff/pull/30062">#30062</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Coalesce source slices when formatting attributes (<a href="https://redirect.github.com/astral-sh/ruff/pull/29841">#29841</a>)</li> <li>Collect return statements with a statement-only visitor (<a href="https://redirect.github.com/astral-sh/ruff/pull/29911">#29911</a>)</li> <li>[<code>pyflakes</code>] Defer value comparisons for repeated dictionary keys (<code>F601</code>, <code>F602</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/29739">#29739</a>)</li> <li>Format node fields directly when comment handling is unnecessary (<a href="https://redirect.github.com/astral-sh/ruff/pull/29853">#29853</a>)</li> <li>Reduce formatter source-slice overhead (<a href="https://redirect.github.com/astral-sh/ruff/pull/29855">#29855</a>)</li> <li>Reuse a callee's qualified name across lint rules (<a href="https://redirect.github.com/astral-sh/ruff/pull/29916">#29916</a>)</li> <li>Skip invalid string character checks when the source contains none (<a href="https://redirect.github.com/astral-sh/ruff/pull/29883">#29883</a>)</li> <li>Use a Bloom filter for formatter comment lookups (<a href="https://redirect.github.com/astral-sh/ruff/pull/29852">#29852</a>)</li> <li>Use a concrete buffer for ordinary writes (<a href="https://redirect.github.com/astral-sh/ruff/pull/29819">#29819</a>)</li> </ul> <h3>CLI</h3> <ul> <li>Give <code>NO_COLOR</code> precedence in Ruff and ty diagnostics (<a href="https://redirect.github.com/astral-sh/ruff/pull/29898">#29898</a>)</li> <li>Honor <code>CLICOLOR=0</code> in Ruff and ty diagnostics (<a href="https://redirect.github.com/astral-sh/ruff/pull/29910">#29910</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Correct the documented <code>version</code> and <code>src</code> defaults for <code>ruff-action</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/29880">#29880</a>)</li> <li>[<code>flake8-bugbear</code>] Make <code>B014</code> example error out-of-the-box (<a href="https://redirect.github.com/astral-sh/ruff/pull/29941">#29941</a>)</li> <li>[<code>flake8-no-pep420</code>] Document preview behavior (<code>INP001</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/29764">#29764</a>)</li> <li>[<code>isort</code>] Expand <code>I001</code> documentation (<a href="https://redirect.github.com/astral-sh/ruff/pull/29843">#29843</a>)</li> </ul> <h3>Other changes</h3> <ul> <li>[syntax-errors] Extend <code>__debug__</code> write check to attribute targets (<a href="https://redirect.github.com/astral-sh/ruff/pull/27908">#27908</a>)</li> </ul> <h3>Contributors</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md">ruff's changelog</a>.</em></p> <blockquote> <h2>0.17.4</h2> <p>Released on 2026-11-05.</p> <h3>Preview features</h3> <ul> <li>[<code>flake8-logging-format</code>] Avoid behavior changes and syntax errors in fixes (<code>G004</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27419">#27419</a>)</li> <li>[<code>security</code>] Implement <code>tarfile-ignore-zeros-true</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28680">#28680</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Accept a bare raise before a semicolon (<a href="https://redirect.github.com/astral-sh/ruff/pull/29761">#29761</a>)</li> <li>Allow match identifiers after a semicolon (<a href="https://redirect.github.com/astral-sh/ruff/pull/29760">#29760</a>)</li> <li>Fix panic on BOM-prefixed files in diagnostic renderer (<a href="https://redirect.github.com/astral-sh/ruff/pull/30017">#30017</a>)</li> <li>[<code>flake8-simplify</code>] Report collapsible <code>elif</code> clauses after a multi-statement <code>if</code> branch (<code>SIM102</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/29814">#29814</a>)</li> </ul> <h3>Rule changes</h3> <ul> <li>Show more nonprinting characters in diagnostic fix diffs (<a href="https://redirect.github.com/astral-sh/ruff/pull/30062">#30062</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Coalesce source slices when formatting attributes (<a href="https://redirect.github.com/astral-sh/ruff/pull/29841">#29841</a>)</li> <li>Collect return statements with a statement-only visitor (<a href="https://redirect.github.com/astral-sh/ruff/pull/29911">#29911</a>)</li> <li>[<code>pyflakes</code>] Defer value comparisons for repeated dictionary keys (<code>F601</code>, <code>F602</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/29739">#29739</a>)</li> <li>Format node fields directly when comment handling is unnecessary (<a href="https://redirect.github.com/astral-sh/ruff/pull/29853">#29853</a>)</li> <li>Reduce formatter source-slice overhead (<a href="https://redirect.github.com/astral-sh/ruff/pull/29855">#29855</a>)</li> <li>Reuse a callee's qualified name across lint rules (<a href="https://redirect.github.com/astral-sh/ruff/pull/29916">#29916</a>)</li> <li>Skip invalid string character checks when the source contains none (<a href="https://redirect.github.com/astral-sh/ruff/pull/29883">#29883</a>)</li> <li>Use a Bloom filter for formatter comment lookups (<a href="https://redirect.github.com/astral-sh/ruff/pull/29852">#29852</a>)</li> <li>Use a concrete buffer for ordinary writes (<a href="https://redirect.github.com/astral-sh/ruff/pull/29819">#29819</a>)</li> </ul> <h3>CLI</h3> <ul> <li>Give <code>NO_COLOR</code> precedence in Ruff and ty diagnostics (<a href="https://redirect.github.com/astral-sh/ruff/pull/29898">#29898</a>)</li> <li>Honor <code>CLICOLOR=0</code> in Ruff and ty diagnostics (<a href="https://redirect.github.com/astral-sh/ruff/pull/29910">#29910</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Correct the documented <code>version</code> and <code>src</code> defaults for <code>ruff-action</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/29880">#29880</a>)</li> <li>[<code>flake8-bugbear</code>] Make <code>B014</code> example error out-of-the-box (<a href="https://redirect.github.com/astral-sh/ruff/pull/29941">#29941</a>)</li> <li>[<code>flake8-no-pep420</code>] Document preview behavior (<code>INP001</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/29764">#29764</a>)</li> <li>[<code>isort</code>] Expand <code>I001</code> documentation (<a href="https://redirect.github.com/astral-sh/ruff/pull/29843">#29843</a>)</li> </ul> <h3>Other changes</h3> <ul> <li>[syntax-errors] Extend <code>__debug__</code> write check to attribute targets (<a href="https://redirect.github.com/astral-sh/ruff/pull/27908">#27908</a>)</li> </ul> <h3>Contributors</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/ruff/commit/05cdc36a45a29e078c2af9358969d0f576408bef"><code>05cdc36</code></a> Bump version to 0.17.4 (<a href="https://redirect.github.com/astral-sh/ruff/issues/30073">#30073</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/c6b17c2b0bd1a0ffe6cd562c6dfaeece2a65f742"><code>c6b17c2</code></a> [ty] Freshen method typevars before owner specialization (<a href="https://redirect.github.com/astral-sh/ruff/issues/29543">#29543</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/4b0b407bfccff1d6aa46e2f26112f334bfab3140"><code>4b0b407</code></a> [ty] Preserve unions inferred during fixpoint iteration (<a href="https://redirect.github.com/astral-sh/ruff/issues/29927">#29927</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/1dd3e9ec7eb8da6b39318ef1084bc070a53ae272"><code>1dd3e9e</code></a> Show more nonprinting characters in diagnostic fix diffs (<a href="https://redirect.github.com/astral-sh/ruff/issues/30062">#30062</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/32be8e7258782da94b18752249971be4708d485c"><code>32be8e7</code></a> [ty] Skip fixpoint iteration for simple generic calls (<a href="https://redirect.github.com/astral-sh/ruff/issues/30054">#30054</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/926ccc883c5cf3d54b1dea610603acd2aae93c19"><code>926ccc8</code></a> [ty] Handle output errors when generating shell completions (<a href="https://redirect.github.com/astral-sh/ruff/issues/29997">#29997</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/c86652abceafe81457858c75c9233eadf1d39912"><code>c86652a</code></a> [ty] Skip active Conda and Pixi environments during discovery if the environm...</li> <li><a href="https://github.com/astral-sh/ruff/commit/c9150f008303c86ad49675f73b75b923f0013bdf"><code>c9150f0</code></a> Add project walltime benchmarks for Ruff (<a href="https://redirect.github.com/astral-sh/ruff/issues/30061">#30061</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/64989ec2a42c65dabb471e20976f4f014c966f27"><code>64989ec</code></a> [ty] Report invalid module globs once per override pattern (<a href="https://redirect.github.com/astral-sh/ruff/issues/30031">#30031</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/367a5639d2bbd4a641e5fb4a1aaa6a41beab9711"><code>367a563</code></a> [ty] Fix conditional type and tuple annotations (<a href="https://redirect.github.com/astral-sh/ruff/issues/29987">#29987</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/ruff/compare/0.17.3...0.17.4">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Chores** * Updated internal project configuration. No user-facing changes are included in this update. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
splitsec2
|
e828bdbe9c |
feat(slskd): answer anti-leech chat challenges from uploaders, off by default (#1591)
Some Soulseek uploaders run a bot that blocks your downloads until you
type a word to them in a private message ("please type 'download' in
this chat"). The files sit queued until someone answers, and nobody
looking at Shelfmark would know why.
While a slskd download is polling, this checks slskd's unacknowledged
private messages about once a minute, replies with the word the message
asks for and marks the conversation read. It only matches three known
phrasings, the word has to fit `[A-Za-z0-9_-]{1,24}`, and each user gets
at most one reply per 12 hours (recorded after a successful send). Every
reply is logged at INFO.
The challenge patterns and the one-reply-per-12-hours idea come from
@Nezreka's [SoulSync](https://github.com/Nezreka/SoulSync)
(`core/chat_autoprove.py`, commit 445473b, MIT). I reworked it for
slskd's client and this download handler. The credit is in the module
docstring and the commit message too.
This sends messages to other people on your behalf without asking, so
the setting `SLSKD_CHAT_AUTOPROVE` is off by default here. Say if you'd
rather it not exist at all, or want it somewhere other than the slskd
settings.
It has run on my instance since October 22 without seeing a real
challenge, so the reply path is covered by tests but not by a live one.
The same code works in nezreka/soulsync with the same slskd client so I
am confident in it. Ruff, basedpyright and the slskd tests pass, and
`docs/environment-variables.md` and the readme line for slskd are
updated.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
<!-- coderabbit-ai-generated:v1 -->
## Summary by CodeRabbit
* **New Features**
* Added an optional setting to automatically answer supported Soulseek
private-message challenges while a download is running. When enabled,
Shelfmark checks unread messages, replies to each person at most once
every 12 hours, logs replies, and marks answered conversations as read.
The setting is off by default.
* **Documentation**
* Updated the environment-variable and Soulseek setup documentation with
details about the setting and its behavior, including a reminder to
leave it off if you read slskd messages yourself.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
|
||
|
splitsec2
|
a01e700c81 |
fix(auto-download): only fulfil requests the owner could download directly (#1676)
Automatic downloads fulfil pending Hardcover requests as an admin, and they picked up every pending request with provider `hardcover`. A request a user makes from the search UI carries that provider too, so with automatic downloads on, a request from a user whose policy needs approval was approved by the pass instead of waiting for an admin. I added that behaviour in #1516 and #1535 and missed this case. The pass now runs the same check the download route makes. A request is searched only on the release sources where its owner's resolved policy (global settings plus their own overrides) is Download. Requests owned by an admin, installs without login, and users with requests turned off are not limited, since all of them can already download directly. A request left with no source stays pending and untouched: no search, no backoff state, no note. The 7-day and quick retries only reopen a failed download on the same terms, so a request the pass can't fulfil isn't moved back to pending for nothing. The pass summary gains an `awaiting_approval` count. The `AUTO_DOWNLOAD_ENABLED` description, the env var reference and the Hardcover sync docs say which requests it approves. Tests cover approval needed, direct download allowed, admin owned, blocked, a per-source rule, a per-user override, requests turned off, no login, and the retry reopen. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Bug Fixes** * Automatic downloads now respect each request owner’s policy and permitted sources. Requests that require approval or are blocked by policy remain pending rather than being searched. * Failed downloads are reopened for retry only when the owner’s policy allows direct fulfillment. * Admin-owned requests and requests in unauthenticated mode retain their existing automatic fulfillment behavior. * **Documentation** * Clarified how request ownership, download policies, approval requirements, and retries affect automatic downloads. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
splitsec2
|
8c06862ec7 |
feat(requests): let a book be requested alongside downloads (#1579)
In Download mode there is no way to ask for a book that has nothing to download yet. The release modal has an "Add to requests" chip for admins, which sends a book-level request, and when the default mode is Download the server answers it with "Download policy requires a concrete release". That is #995, where @expostarv2 used to bookmark unreleased books this way. #1019 is the other side of it: @punkincognito wants a less technical user to be able to download from one source and, when that fails, ask for the book without choosing a release. A book-level request in Download mode now becomes a normal pending book request, stored with the mode `request_book`, when the actor is an admin or when a new setting allows it: **Allow book requests alongside downloads** (`REQUESTS_ALLOW_BOOK_REQUEST_WITH_DOWNLOAD`, off by default, per-user overridable). A request that names a release still goes straight to the download queue as before, and with the setting off a non-admin gets the same error as today, so nothing changes for an existing install unless it turns the setting on. The policy endpoint reports the setting, and the release modal shows "Add to requests" to a non-admin when requests are on and the setting allows it (admins keep it as before, and it stays off while fulfilling a request). The small `canRequestBookFromReleaseModal` helper holds that rule so it can be tested. I chose a setting over making this the default for everyone because it changes what Download mode means, which is yours to decide. The other way to read #1019 is a per-source rule, "Request Book" for Prowlarr and Download for the direct sources. That is not here: the rules matrix excludes Request Book today, the release modal shows such a source as unavailable, and it needs more UI work than I can check without trying it in a browser. This PR covers the half that works with the existing flow, and the rule version can follow if you want it. Tests: four route tests (a user with the setting on, an admin with it off, a release request that must still queue a download, and the policy endpoint reporting the setting), and a frontend test for the helper. The route tests that depend on the change fail on current main. Full backend and frontend suites pass, with ruff, oxlint and tsc clean. I have not tried it in a browser, so this is a draft until someone has looked at the modal. Closes #995. #1019 stays open for the per-source rule. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **New Features** * Added an off-by-default, user-overridable setting that lets users with download access request a book without selecting a release. These requests remain pending for admin action, and admins can always make book-level requests. * Eligible users can make book-level requests under the download policy when the setting is enabled. This option is unavailable in browse-fulfil mode. * Requests that include release details continue to queue downloads rather than create book-level requests. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
splitsec2
|
c38f4c6522 |
feat(activity): Clear Completed also clears finished requests with no download (#1650)
A request that auto-download closes because the book is already in the library never gets a download, so Clear Completed skipped it and those requests piled up under Complete. The button also disappeared once the last finished download was cleared, leaving no way to clear them. ActivitySidebar.tsx: hasTerminalDownloadItems is dropped; the button shows whenever getClearCompletedTargets returns anything, and on the Requests tab as well as Downloads and All. clearCompleted.ts: a request card with no download of its own is a target when its request is fulfilled with no active delivery_state (queued, resolving, locating, downloading), or cancelled. Pending and rejected requests are left alone. The server already treats any fulfilled request as terminal in _request_terminal_status, so the client rule is the stricter of the two. docs/users-and-requests.md: a line under Clearing the activity list saying what the button clears. Tests: two new cases in clearCompleted.test.ts, one for a closed request and a cancelled one with no download, one that pending, rejected and still-downloading requests are not touched. Builds on #1438. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **New Features** * **Clear Completed** can appear on the Requests tab, as well as Downloads and All, when there are items to clear. * Clearing completed items removes finished downloads and their requests, fulfilled requests that are no longer in progress, and cancelled requests without downloads. Pending and rejected requests remain. * **Documentation** * Updated the help documentation to explain what **Clear Completed** removes. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
splitsec2
|
371ac75954 |
feat(activity): say in plain words what a failed download means and what happens next (#1617)
A failed or cancelled card showed the log line, things like `Peer transfer failed: Errored` or a 500 with a URL in it, so a red card meant going to the logs to find out whether anything was coming next. They now say what happened and what happens next. For a download that belongs to a request, the card says another copy will be tried in about N minutes when the quick retry from #1535 is on, and points at Retry or reopening the request when it isn't. A manual download is never promised an automatic retry. The Soulseek cases each get their own sentence: the peer dropped the transfer, the peer could not be reached, slskd refused to queue it, and the peer never answered. The "tried twice" wording leans on the retry from #1590. The saved message is left alone because auto-download reads it to tell a failed release from an interrupted one. Only what the activity list shows is reworded, on a copy, and anything the new code doesn't recognise comes back as it was. It matches on how the message starts, so it is only as current as the wording the rest of the code uses. A message that gets reworded elsewhere falls back to the original line instead of breaking, which seemed fine for something that only changes the display, but it is the part I would look at first. It has been running on my instance since mid-October. Ten new tests cover each message and the next step, and the activity route tests still pass. Ruff and basedpyright are clean on the changed files. |
||
|
dependabot[bot]
|
318b7483fe |
build(deps): bump the gh-actions group with 4 updates (#1671)
Bumps the gh-actions group with 4 updates: [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv), [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/autobuild](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action). Updates `astral-sh/setup-uv` from 10.3.2 to 10.3.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/setup-uv/releases">astral-sh/setup-uv's releases</a>.</em></p> <blockquote> <h2>v10.3.3 🌈 Use Astral mirror for version manifests with GitHub fallback</h2> <h2>Changes</h2> <p>This release contains something that should have been included a very long time ago. Sorry for sleeping on that.</p> <p>This action now retrieves the release manifest that contains the available versions, their download links and checksums from the Astral mirror, rather than trying GitHub first. This should present much more stable. (Known checksums are still checked, so the security impact does not change)</p> <p>Also a big thank you to <a href="https://github.com/soujasK"><code>@soujasK</code></a> for a set of bugfixes 👏</p> <h2>🐛 Bug fixes</h2> <ul> <li>Use Astral mirror for version manifests with GitHub fallback <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1119">#1119</a>)</li> <li>fix: allow whitespace in uv requirement specifiers <a href="https://github.com/soujasK"><code>@soujasK</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1112">#1112</a>)</li> <li>fix: resolve ~= specifiers with PEP 440 semantics <a href="https://github.com/soujasK"><code>@soujasK</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1111">#1111</a>)</li> <li>fix: only report a saved cache when saving succeeded <a href="https://github.com/soujasK"><code>@soujasK</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1110">#1110</a>)</li> </ul> <h2>🧰 Maintenance</h2> <ul> <li>chore: update known checksums for 0.13.6 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1117">#1117</a>)</li> </ul> <h2>📚 Documentation</h2> <ul> <li>docs: use JSDoc for compatible release specifier comment <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1113">#1113</a>)</li> <li>docs: update version references to v10.3.2 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1104">#1104</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/setup-uv/commit/68559e99cc807c1eb7e9238fd43a15bba460eec2"><code>68559e9</code></a> Use Astral mirror for version manifests with GitHub fallback (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1119">#1119</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/0192b6951893e558e24cfbd971d641a8cd336a95"><code>0192b69</code></a> chore: update known checksums for 0.13.6 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1117">#1117</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/2f29784424ba0f5755e2d0bbc18227082a5daff1"><code>2f29784</code></a> docs: use JSDoc for compatible release specifier comment (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1113">#1113</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/9c7332190cf7291329c770bedb2ba1b3e441b37c"><code>9c73321</code></a> fix: allow whitespace in uv requirement specifiers (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1112">#1112</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/80fbe0140ccf08d50eff5eeb98dff9021c415a21"><code>80fbe01</code></a> fix: resolve ~= specifiers with PEP 440 semantics (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1111">#1111</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/36b7b57007634b5d947fd73fcd85c7b44863efec"><code>36b7b57</code></a> fix: only report a saved cache when saving succeeded (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1110">#1110</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/56618cab7a58e3efc9b282dd3de75bbf1075db9b"><code>56618ca</code></a> docs: update version references to v10.3.2 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1104">#1104</a>)</li> <li>See full diff in <a href="https://github.com/astral-sh/setup-uv/compare/07a047e608db84b3d8c06cd9a7c7dcc9c355c18e...68559e99cc807c1eb7e9238fd43a15bba460eec2">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/init` from 4.39.1 to 4.39.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/init's releases</a>.</em></p> <blockquote> <h2>v4.39.2</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.4">2.27.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4284">#4284</a></li> <li><em>Upcoming breaking change</em>: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. <a href="https://redirect.github.com/github/codeql-action/pull/4266">#4266</a></li> <li>Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See <a href="https://github.blog/changelog/2026-10-19-codeql-changes-for-macos-27-xcode-27-and-swift-6-4/">this blog post for more information</a>. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the <a href="https://docs.github.com/en/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/use-the-tools-status-page-for-code-scanning">Tool Status Page</a>. This check will be rolled out following this release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/4221">#4221</a></li> <li>The undocumented TRAP cache cleanup feature that could be enabled using the <code>CODEQL_ACTION_CLEANUP_TRAP_CACHES</code> environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The <code>analyze</code> Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the <code>trap-caching: false</code> input to the <code>init</code> Action. <a href="https://redirect.github.com/github/codeql-action/pull/4243">#4243</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/init's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.39.3 - 04 Nov 2026</h2> <ul> <li>Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. <a href="https://redirect.github.com/github/codeql-action/pull/4283">#4283</a></li> </ul> <h2>4.39.2 - 03 Nov 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.4">2.27.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4284">#4284</a></li> <li><em>Upcoming breaking change</em>: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. <a href="https://redirect.github.com/github/codeql-action/pull/4266">#4266</a></li> <li>Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See <a href="https://github.blog/changelog/2026-10-19-codeql-changes-for-macos-27-xcode-27-and-swift-6-4/">this blog post for more information</a>. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the <a href="https://docs.github.com/en/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/use-the-tools-status-page-for-code-scanning">Tool Status Page</a>. This check will be rolled out following this release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/4221">#4221</a></li> <li>The undocumented TRAP cache cleanup feature that could be enabled using the <code>CODEQL_ACTION_CLEANUP_TRAP_CACHES</code> environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The <code>analyze</code> Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the <code>trap-caching: false</code> input to the <code>init</code> Action. <a href="https://redirect.github.com/github/codeql-action/pull/4243">#4243</a></li> </ul> <h2>4.39.1 - 21 Oct 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3">2.27.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4256">#4256</a></li> </ul> <h2>4.39.0 - 15 Oct 2026</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.20.7. <a href="https://redirect.github.com/github/codeql-action/pull/4205">#4205</a></li> <li>The <code>codeql-action/analyze</code> step now validates that a correct argument for the <code>checkout_path</code> input has been provided. The <code>checkout_path</code> input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by <code>codeql-action/init</code>, then the CodeQL Action now produces a warning. <a href="https://redirect.github.com/github/codeql-action/pull/4148">#4148</a></li> <li>Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. <a href="https://redirect.github.com/github/codeql-action/pull/4206">#4206</a></li> <li>The <code>codeql-action/start-proxy</code> step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as <code>codeql-action/init</code>. This primarily benefits customers who are using GitHub instances other than <code>github.com</code> where the <code>codeql-action/start-proxy</code> step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. <a href="https://redirect.github.com/github/codeql-action/pull/4198">#4198</a></li> </ul> <h2>4.38.3 - 08 Oct 2026</h2> <ul> <li><em>Upcoming breaking change</em>: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. <a href="https://redirect.github.com/github/codeql-action/pull/4188">#4188</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2">2.27.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4203">#4203</a></li> <li>Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/4184">#4184</a></li> </ul> <h2>4.38.2 - 24 Sept 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1">2.27.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4160">#4160</a></li> </ul> <h2>4.38.1 - 18 Sept 2026</h2> <ul> <li>The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/4146">#4146</a></li> </ul> <h2>4.38.0 - 09 Sept 2026</h2> <ul> <li>On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. <a href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li> <li>The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native <code>linux-arm64</code> CodeQL bundle when available. <a href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/1fc58d04a4d4374f921bdac573c3811c240f9c26"><code>1fc58d0</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4286">#4286</a> from github/update-v4.39.2-c05042115</li> <li><a href="https://github.com/github/codeql-action/commit/d9984814e484244a9abd81ad96a4646ca1c4122a"><code>d998481</code></a> Update changelog for v4.39.2</li> <li><a href="https://github.com/github/codeql-action/commit/c050421152f5bd3d7e4d8ece8dbd46d93ca0f926"><code>c050421</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4284">#4284</a> from github/update-bundle/codeql-bundle-v2.27.4</li> <li><a href="https://github.com/github/codeql-action/commit/750fe8feea49cd7d09db1a11def08c3bd812d810"><code>750fe8f</code></a> Merge branch 'main' into update-bundle/codeql-bundle-v2.27.4</li> <li><a href="https://github.com/github/codeql-action/commit/adfcd5ffb8f15a420edbc24cce8056e2626d76bd"><code>adfcd5f</code></a> Add changelog note</li> <li><a href="https://github.com/github/codeql-action/commit/2ef3b622017573270975effb6820567f855245aa"><code>2ef3b62</code></a> Update default bundle to codeql-bundle-v2.27.4</li> <li><a href="https://github.com/github/codeql-action/commit/b35c6c6aaefc0489db8249a1adea322ed8011094"><code>b35c6c6</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4251">#4251</a> from github/mbg/refactor-util/errors</li> <li><a href="https://github.com/github/codeql-action/commit/ac9f25761184d85ea2864c1e40de96afc64337bb"><code>ac9f257</code></a> Merge remote-tracking branch 'origin/main' into mbg/refactor-util/errors</li> <li><a href="https://github.com/github/codeql-action/commit/52cf1852265d99e9bea071b03366fc777a602909"><code>52cf185</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4278">#4278</a> from github/mbg/macos27/xcode-detection</li> <li><a href="https://github.com/github/codeql-action/commit/95dd6bfbc42487e3e3695e9c9cb52f3a4b3fcd4f"><code>95dd6bf</code></a> Fix new test not providing typical input</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/9b3254085494b55a0f7c4c2b3d2d52cc712ce370...1fc58d04a4d4374f921bdac573c3811c240f9c26">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/autobuild` from 4.39.1 to 4.39.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/autobuild's releases</a>.</em></p> <blockquote> <h2>v4.39.2</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.4">2.27.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4284">#4284</a></li> <li><em>Upcoming breaking change</em>: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. <a href="https://redirect.github.com/github/codeql-action/pull/4266">#4266</a></li> <li>Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See <a href="https://github.blog/changelog/2026-10-19-codeql-changes-for-macos-27-xcode-27-and-swift-6-4/">this blog post for more information</a>. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the <a href="https://docs.github.com/en/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/use-the-tools-status-page-for-code-scanning">Tool Status Page</a>. This check will be rolled out following this release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/4221">#4221</a></li> <li>The undocumented TRAP cache cleanup feature that could be enabled using the <code>CODEQL_ACTION_CLEANUP_TRAP_CACHES</code> environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The <code>analyze</code> Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the <code>trap-caching: false</code> input to the <code>init</code> Action. <a href="https://redirect.github.com/github/codeql-action/pull/4243">#4243</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/autobuild's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.39.3 - 04 Nov 2026</h2> <ul> <li>Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. <a href="https://redirect.github.com/github/codeql-action/pull/4283">#4283</a></li> </ul> <h2>4.39.2 - 03 Nov 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.4">2.27.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4284">#4284</a></li> <li><em>Upcoming breaking change</em>: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. <a href="https://redirect.github.com/github/codeql-action/pull/4266">#4266</a></li> <li>Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See <a href="https://github.blog/changelog/2026-10-19-codeql-changes-for-macos-27-xcode-27-and-swift-6-4/">this blog post for more information</a>. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the <a href="https://docs.github.com/en/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/use-the-tools-status-page-for-code-scanning">Tool Status Page</a>. This check will be rolled out following this release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/4221">#4221</a></li> <li>The undocumented TRAP cache cleanup feature that could be enabled using the <code>CODEQL_ACTION_CLEANUP_TRAP_CACHES</code> environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The <code>analyze</code> Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the <code>trap-caching: false</code> input to the <code>init</code> Action. <a href="https://redirect.github.com/github/codeql-action/pull/4243">#4243</a></li> </ul> <h2>4.39.1 - 21 Oct 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3">2.27.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4256">#4256</a></li> </ul> <h2>4.39.0 - 15 Oct 2026</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.20.7. <a href="https://redirect.github.com/github/codeql-action/pull/4205">#4205</a></li> <li>The <code>codeql-action/analyze</code> step now validates that a correct argument for the <code>checkout_path</code> input has been provided. The <code>checkout_path</code> input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by <code>codeql-action/init</code>, then the CodeQL Action now produces a warning. <a href="https://redirect.github.com/github/codeql-action/pull/4148">#4148</a></li> <li>Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. <a href="https://redirect.github.com/github/codeql-action/pull/4206">#4206</a></li> <li>The <code>codeql-action/start-proxy</code> step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as <code>codeql-action/init</code>. This primarily benefits customers who are using GitHub instances other than <code>github.com</code> where the <code>codeql-action/start-proxy</code> step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. <a href="https://redirect.github.com/github/codeql-action/pull/4198">#4198</a></li> </ul> <h2>4.38.3 - 08 Oct 2026</h2> <ul> <li><em>Upcoming breaking change</em>: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. <a href="https://redirect.github.com/github/codeql-action/pull/4188">#4188</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2">2.27.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4203">#4203</a></li> <li>Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/4184">#4184</a></li> </ul> <h2>4.38.2 - 24 Sept 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1">2.27.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4160">#4160</a></li> </ul> <h2>4.38.1 - 18 Sept 2026</h2> <ul> <li>The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/4146">#4146</a></li> </ul> <h2>4.38.0 - 09 Sept 2026</h2> <ul> <li>On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. <a href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li> <li>The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native <code>linux-arm64</code> CodeQL bundle when available. <a href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/1fc58d04a4d4374f921bdac573c3811c240f9c26"><code>1fc58d0</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4286">#4286</a> from github/update-v4.39.2-c05042115</li> <li><a href="https://github.com/github/codeql-action/commit/d9984814e484244a9abd81ad96a4646ca1c4122a"><code>d998481</code></a> Update changelog for v4.39.2</li> <li><a href="https://github.com/github/codeql-action/commit/c050421152f5bd3d7e4d8ece8dbd46d93ca0f926"><code>c050421</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4284">#4284</a> from github/update-bundle/codeql-bundle-v2.27.4</li> <li><a href="https://github.com/github/codeql-action/commit/750fe8feea49cd7d09db1a11def08c3bd812d810"><code>750fe8f</code></a> Merge branch 'main' into update-bundle/codeql-bundle-v2.27.4</li> <li><a href="https://github.com/github/codeql-action/commit/adfcd5ffb8f15a420edbc24cce8056e2626d76bd"><code>adfcd5f</code></a> Add changelog note</li> <li><a href="https://github.com/github/codeql-action/commit/2ef3b622017573270975effb6820567f855245aa"><code>2ef3b62</code></a> Update default bundle to codeql-bundle-v2.27.4</li> <li><a href="https://github.com/github/codeql-action/commit/b35c6c6aaefc0489db8249a1adea322ed8011094"><code>b35c6c6</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4251">#4251</a> from github/mbg/refactor-util/errors</li> <li><a href="https://github.com/github/codeql-action/commit/ac9f25761184d85ea2864c1e40de96afc64337bb"><code>ac9f257</code></a> Merge remote-tracking branch 'origin/main' into mbg/refactor-util/errors</li> <li><a href="https://github.com/github/codeql-action/commit/52cf1852265d99e9bea071b03366fc777a602909"><code>52cf185</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4278">#4278</a> from github/mbg/macos27/xcode-detection</li> <li><a href="https://github.com/github/codeql-action/commit/95dd6bfbc42487e3e3695e9c9cb52f3a4b3fcd4f"><code>95dd6bf</code></a> Fix new test not providing typical input</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/9b3254085494b55a0f7c4c2b3d2d52cc712ce370...1fc58d04a4d4374f921bdac573c3811c240f9c26">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/analyze` from 4.39.1 to 4.39.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/analyze's releases</a>.</em></p> <blockquote> <h2>v4.39.2</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.4">2.27.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4284">#4284</a></li> <li><em>Upcoming breaking change</em>: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. <a href="https://redirect.github.com/github/codeql-action/pull/4266">#4266</a></li> <li>Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See <a href="https://github.blog/changelog/2026-10-19-codeql-changes-for-macos-27-xcode-27-and-swift-6-4/">this blog post for more information</a>. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the <a href="https://docs.github.com/en/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/use-the-tools-status-page-for-code-scanning">Tool Status Page</a>. This check will be rolled out following this release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/4221">#4221</a></li> <li>The undocumented TRAP cache cleanup feature that could be enabled using the <code>CODEQL_ACTION_CLEANUP_TRAP_CACHES</code> environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The <code>analyze</code> Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the <code>trap-caching: false</code> input to the <code>init</code> Action. <a href="https://redirect.github.com/github/codeql-action/pull/4243">#4243</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/analyze's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.39.3 - 04 Nov 2026</h2> <ul> <li>Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. <a href="https://redirect.github.com/github/codeql-action/pull/4283">#4283</a></li> </ul> <h2>4.39.2 - 03 Nov 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.4">2.27.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4284">#4284</a></li> <li><em>Upcoming breaking change</em>: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. <a href="https://redirect.github.com/github/codeql-action/pull/4266">#4266</a></li> <li>Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See <a href="https://github.blog/changelog/2026-10-19-codeql-changes-for-macos-27-xcode-27-and-swift-6-4/">this blog post for more information</a>. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the <a href="https://docs.github.com/en/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/use-the-tools-status-page-for-code-scanning">Tool Status Page</a>. This check will be rolled out following this release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/4221">#4221</a></li> <li>The undocumented TRAP cache cleanup feature that could be enabled using the <code>CODEQL_ACTION_CLEANUP_TRAP_CACHES</code> environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The <code>analyze</code> Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the <code>trap-caching: false</code> input to the <code>init</code> Action. <a href="https://redirect.github.com/github/codeql-action/pull/4243">#4243</a></li> </ul> <h2>4.39.1 - 21 Oct 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3">2.27.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4256">#4256</a></li> </ul> <h2>4.39.0 - 15 Oct 2026</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.20.7. <a href="https://redirect.github.com/github/codeql-action/pull/4205">#4205</a></li> <li>The <code>codeql-action/analyze</code> step now validates that a correct argument for the <code>checkout_path</code> input has been provided. The <code>checkout_path</code> input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by <code>codeql-action/init</code>, then the CodeQL Action now produces a warning. <a href="https://redirect.github.com/github/codeql-action/pull/4148">#4148</a></li> <li>Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. <a href="https://redirect.github.com/github/codeql-action/pull/4206">#4206</a></li> <li>The <code>codeql-action/start-proxy</code> step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as <code>codeql-action/init</code>. This primarily benefits customers who are using GitHub instances other than <code>github.com</code> where the <code>codeql-action/start-proxy</code> step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. <a href="https://redirect.github.com/github/codeql-action/pull/4198">#4198</a></li> </ul> <h2>4.38.3 - 08 Oct 2026</h2> <ul> <li><em>Upcoming breaking change</em>: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. <a href="https://redirect.github.com/github/codeql-action/pull/4188">#4188</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2">2.27.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4203">#4203</a></li> <li>Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/4184">#4184</a></li> </ul> <h2>4.38.2 - 24 Sept 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1">2.27.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4160">#4160</a></li> </ul> <h2>4.38.1 - 18 Sept 2026</h2> <ul> <li>The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/4146">#4146</a></li> </ul> <h2>4.38.0 - 09 Sept 2026</h2> <ul> <li>On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. <a href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li> <li>The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native <code>linux-arm64</code> CodeQL bundle when available. <a href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/1fc58d04a4d4374f921bdac573c3811c240f9c26"><code>1fc58d0</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4286">#4286</a> from github/update-v4.39.2-c05042115</li> <li><a href="https://github.com/github/codeql-action/commit/d9984814e484244a9abd81ad96a4646ca1c4122a"><code>d998481</code></a> Update changelog for v4.39.2</li> <li><a href="https://github.com/github/codeql-action/commit/c050421152f5bd3d7e4d8ece8dbd46d93ca0f926"><code>c050421</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4284">#4284</a> from github/update-bundle/codeql-bundle-v2.27.4</li> <li><a href="https://github.com/github/codeql-action/commit/750fe8feea49cd7d09db1a11def08c3bd812d810"><code>750fe8f</code></a> Merge branch 'main' into update-bundle/codeql-bundle-v2.27.4</li> <li><a href="https://github.com/github/codeql-action/commit/adfcd5ffb8f15a420edbc24cce8056e2626d76bd"><code>adfcd5f</code></a> Add changelog note</li> <li><a href="https://github.com/github/codeql-action/commit/2ef3b622017573270975effb6820567f855245aa"><code>2ef3b62</code></a> Update default bundle to codeql-bundle-v2.27.4</li> <li><a href="https://github.com/github/codeql-action/commit/b35c6c6aaefc0489db8249a1adea322ed8011094"><code>b35c6c6</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4251">#4251</a> from github/mbg/refactor-util/errors</li> <li><a href="https://github.com/github/codeql-action/commit/ac9f25761184d85ea2864c1e40de96afc64337bb"><code>ac9f257</code></a> Merge remote-tracking branch 'origin/main' into mbg/refactor-util/errors</li> <li><a href="https://github.com/github/codeql-action/commit/52cf1852265d99e9bea071b03366fc777a602909"><code>52cf185</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4278">#4278</a> from github/mbg/macos27/xcode-detection</li> <li><a href="https://github.com/github/codeql-action/commit/95dd6bfbc42487e3e3695e9c9cb52f3a4b3fcd4f"><code>95dd6bf</code></a> Fix new test not providing typical input</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/9b3254085494b55a0f7c4c2b3d2d52cc712ce370...1fc58d04a4d4374f921bdac573c3811c240f9c26">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Chores** * Updated the tools used by automated quality checks, type checks, tests, end-to-end checks, and security analysis. The workflows’ configurations and behavior remain unchanged, so there are no new user-facing features or changes to how the product works. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
68165e1730 |
build(deps): bump publicsuffixlist from 1.1.2.20261029 to 1.1.2.20261101 (#1666)
Bumps [publicsuffixlist](https://github.com/ko-zu/psl) from 1.1.2.20261029 to 1.1.2.20261101. <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/ko-zu/psl/commits">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Chores** * Updated the minimum required version of a dependency. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
b1a1f46096 |
build(deps): bump astral-sh/uv from 0.13.6 to 0.13.7 in the docker-base-image-digests group (#1670)
> [!WARNING] > Cooldown could not be applied because no publication date was available from the registry. > Bumps the docker-base-image-digests group with 1 update: [astral-sh/uv](https://github.com/astral-sh/uv). Updates `astral-sh/uv` from 0.13.6 to 0.13.7 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/releases">astral-sh/uv's releases</a>.</em></p> <blockquote> <h2>0.13.7</h2> <h2>Release Notes</h2> <p>Released on 2026-11-03.</p> <h3>Preview features</h3> <ul> <li>Add <code>--output-version</code> to <code>uv workspace metadata</code> for requesting a specific schema version (<a href="https://redirect.github.com/astral-sh/uv/pull/22958">#22958</a>)</li> <li>Report aliased OSV records as a single vulnerability in <code>uv audit</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/22990">#22990</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Treat workspace member paths added by <code>uv init</code> or <code>uv add</code> as literals instead of glob patterns (<a href="https://redirect.github.com/astral-sh/uv/pull/23008">#23008</a>)</li> <li>Prevent uv's Windows trampolines from closing handles they did not inherit (<a href="https://redirect.github.com/astral-sh/uv/pull/22977">#22977</a>)</li> <li>Allow <code>uvx</code> to run tools with CPython builds whose versions contain local identifiers (<a href="https://redirect.github.com/astral-sh/uv/pull/23013">#23013</a>)</li> <li>Generate valid module names when <code>uv init</code> creates packaged projects whose names start with a digit (<a href="https://redirect.github.com/astral-sh/uv/pull/23022">#23022</a>)</li> <li>Preserve comments around existing inline dependency groups when <code>uv add</code> updates a group (<a href="https://redirect.github.com/astral-sh/uv/pull/23017">#23017</a>)</li> <li>Allow <code>uv remove</code> with an empty inline <code>tool.uv.sources</code> table (<a href="https://redirect.github.com/astral-sh/uv/pull/23012">#23012</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Correct the <code>cache-keys</code> inline table example (<a href="https://redirect.github.com/astral-sh/uv/pull/22984">#22984</a>)</li> </ul> <h2>Install uv 0.13.7</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-installer.sh | sh </code></pre> <h3>Install prebuilt binaries via powershell script</h3> <pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-installer.ps1 | iex" </code></pre> <h2>Download uv 0.13.7</h2> <table> <thead> <tr> <th>File</th> <th>Platform</th> <th>Checksum</th> </tr> </thead> <tbody> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-aarch64-apple-darwin.tar.gz">uv-aarch64-apple-darwin.tar.gz</a></td> <td>Apple Silicon macOS</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-aarch64-apple-darwin.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-x86_64-apple-darwin.tar.gz">uv-x86_64-apple-darwin.tar.gz</a></td> <td>Intel macOS</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-x86_64-apple-darwin.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-aarch64-pc-windows-msvc.zip">uv-aarch64-pc-windows-msvc.zip</a></td> <td>ARM64 Windows</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-aarch64-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-i686-pc-windows-msvc.zip">uv-i686-pc-windows-msvc.zip</a></td> <td>x86 Windows</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-i686-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-x86_64-pc-windows-msvc.zip">uv-x86_64-pc-windows-msvc.zip</a></td> <td>x64 Windows</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-x86_64-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-aarch64-unknown-linux-gnu.tar.gz">uv-aarch64-unknown-linux-gnu.tar.gz</a></td> <td>ARM64 Linux</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-aarch64-unknown-linux-gnu.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-i686-unknown-linux-gnu.tar.gz">uv-i686-unknown-linux-gnu.tar.gz</a></td> <td>x86 Linux</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-i686-unknown-linux-gnu.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-powerpc64le-unknown-linux-gnu.tar.gz">uv-powerpc64le-unknown-linux-gnu.tar.gz</a></td> <td>PPC64LE Linux</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-powerpc64le-unknown-linux-gnu.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-riscv64gc-unknown-linux-gnu.tar.gz">uv-riscv64gc-unknown-linux-gnu.tar.gz</a></td> <td>RISCV Linux</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-riscv64gc-unknown-linux-gnu.tar.gz.sha256">checksum</a></td> </tr> </tbody> </table> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/blob/main/CHANGELOG.md">astral-sh/uv's changelog</a>.</em></p> <blockquote> <h2>0.13.7</h2> <p>Released on 2026-11-03.</p> <h3>Preview features</h3> <ul> <li>Add <code>--output-version</code> to <code>uv workspace metadata</code> for requesting a specific schema version (<a href="https://redirect.github.com/astral-sh/uv/pull/22958">#22958</a>)</li> <li>Report aliased OSV records as a single vulnerability in <code>uv audit</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/22990">#22990</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Treat workspace member paths added by <code>uv init</code> or <code>uv add</code> as literals instead of glob patterns (<a href="https://redirect.github.com/astral-sh/uv/pull/23008">#23008</a>)</li> <li>Prevent uv's Windows trampolines from closing handles they did not inherit (<a href="https://redirect.github.com/astral-sh/uv/pull/22977">#22977</a>)</li> <li>Allow <code>uvx</code> to run tools with CPython builds whose versions contain local identifiers (<a href="https://redirect.github.com/astral-sh/uv/pull/23013">#23013</a>)</li> <li>Generate valid module names when <code>uv init</code> creates packaged projects whose names start with a digit (<a href="https://redirect.github.com/astral-sh/uv/pull/23022">#23022</a>)</li> <li>Preserve comments around existing inline dependency groups when <code>uv add</code> updates a group (<a href="https://redirect.github.com/astral-sh/uv/pull/23017">#23017</a>)</li> <li>Allow <code>uv remove</code> with an empty inline <code>tool.uv.sources</code> table (<a href="https://redirect.github.com/astral-sh/uv/pull/23012">#23012</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Correct the <code>cache-keys</code> inline table example (<a href="https://redirect.github.com/astral-sh/uv/pull/22984">#22984</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/uv/commit/316c827e058c16b71d5c507a20729c2995a7bcce"><code>316c827</code></a> Bump version to 0.13.7 (<a href="https://redirect.github.com/astral-sh/uv/issues/23068">#23068</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/917b4c31531e6933c20596b65b49e75c83ff7d93"><code>917b4c3</code></a> Update Rust crate tokio-rustls to v0.26.6 (<a href="https://redirect.github.com/astral-sh/uv/issues/23048">#23048</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/baec6ce829bea457e5452906144115940e1ea896"><code>baec6ce</code></a> Update conda-incubator/setup-miniconda action to v4.1.0 (<a href="https://redirect.github.com/astral-sh/uv/issues/23032">#23032</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/da8bbd3365161177fc30909aa0b84d45e8811f09"><code>da8bbd3</code></a> Update fedora Docker tag to v46 (<a href="https://redirect.github.com/astral-sh/uv/issues/23033">#23033</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/3db723cf104c685b9f2f31a26834b7d417db652f"><code>3db723c</code></a> Update Rust crate cargo-util to v0.2.32 (<a href="https://redirect.github.com/astral-sh/uv/issues/23045">#23045</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/28c0c65cd01ba9430787eef2f933740095609e09"><code>28c0c65</code></a> Update Rust crate uuid to v1.27.0 (<a href="https://redirect.github.com/astral-sh/uv/issues/23052">#23052</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/77168783ec37c93a786fce4bbaabe58d1255c22f"><code>7716878</code></a> Update Rust crate insta to v1.49.0 (<a href="https://redirect.github.com/astral-sh/uv/issues/23051">#23051</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/3be10e3890b942cb7509e656245b46e7ad63d650"><code>3be10e3</code></a> Update dependency <code>@openai/codex</code> to v0.160.0 (<a href="https://redirect.github.com/astral-sh/uv/issues/23050">#23050</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/8eb756a2e7a4a8380d49a3edd6224da4c5af4cea"><code>8eb756a</code></a> Update CodSpeedHQ/action action to v5.4.0 (<a href="https://redirect.github.com/astral-sh/uv/issues/23049">#23049</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/632df30b8e8c8ed1dbba309cc79c2608a63da155"><code>632df30</code></a> Update Rust crate spdx to v0.13.6 (<a href="https://redirect.github.com/astral-sh/uv/issues/23047">#23047</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/uv/compare/0.13.6...0.13.7">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Chores** * Updated the build environment’s `uv` version. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
149f32b955 |
build(deps): bump flask-socketio from 5.7.1 to 5.7.2 in the python-deps group (#1669)
Bumps the python-deps group with 1 update: [flask-socketio](https://code.miguelgrinberg.com/miguelgrinberg/flask-socketio). Updates `flask-socketio` from 5.7.1 to 5.7.2 [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
  Matt Van HornandMatt Van Horn
|
0bb54ac8f8 |
fix(clients): use port 443 for HTTPS Transmission URLs that omit a port (#1673)
## Why Saving a Transmission address as HTTPS and leaving the port blank makes the connection test fail. The client opens port 9091 and reports an SSL wrong-version error, so a daemon published through a reverse proxy on the usual HTTPS port never answers. parse_transmission_url filled in 9091 whenever the URL omitted a port, and that default ignored the scheme. An https address therefore started TLS against 9091, where the peer is not speaking TLS. ## Summary An omitted port now follows the scheme: 443 for https, and 9091 for http, which still covers the empty-URL default. A port written in the URL is left as given. The parser tests cover https://transmission.myserver.org and expect https, that host, port 443, and the path /transmission/rpc. ## Testing The targeted tests for the shelfmark parse_transmission_url change pass locally. The tests passed with the shelfmark parse_transmission_url change applied; a run with it reverted gave no clear result, so no test is shown to catch this bug. Closes #1667 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Bug Fixes** * HTTPS Transmission URLs without an explicitly specified port now use port 443. HTTP URLs continue to default to port 9091, and the default RPC path is unchanged. * **Documentation** * Clarified the default ports for each URL scheme and noted that HTTPS instances on port 9091 require `:9091` in the URL. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> |
||
|
dependabot[bot]
|
985a54765d |
build(deps): bump oauthlib from 4.0.0 to 4.0.1 (#1668)
Bumps [oauthlib](https://github.com/oauthlib/oauthlib) from 4.0.0 to 4.0.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/oauthlib/oauthlib/releases">oauthlib's releases</a>.</em></p> <blockquote> <h2>4.0.1</h2> <h2>Security</h2> <ul> <li><strong>CVE-2026-49272</strong> / GHSA-3jp2-3mrg-2vxc: The device code flow token endpoint did not validate the <code>device_code</code> parameter. A request with a known <code>client_id</code> and a bogus <code>device_code</code> could obtain a bearer token. <code>DeviceCodeGrant.validate_token_request</code> now calls <code>DeviceCodeGrant.validate_device_code()</code>, which rejects missing or unknown device codes (<code>invalid_request</code> / <code>invalid_grant</code>) and delegates the code's authorization status to the new <code>RequestValidator.validate_device_code()</code> hook, per RFC 8628 Section 3.5. (cherry-picked from <a href="https://redirect.github.com/oauthlib/oauthlib/issues/954">#954</a>)</li> </ul> <h2>Upgrade note for device flow integrators</h2> <p>Custom <code>RequestValidator</code> implementations using the device flow must now implement <code>validate_device_code(client_id, code, request)</code>. Return one of the <code>DeviceCodeGrant.DEVICE_CODE_*</code> statuses for known codes, or <code>None</code> for an unknown code. When returning <code>AUTHORIZED</code>, the validator must also populate <code>request.user</code> and <code>request.scopes</code> from the stored authorization.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/oauthlib/oauthlib/blob/v4.0.1/CHANGELOG.rst">oauthlib's changelog</a>.</em></p> <blockquote> <h2>4.0.1 (2026-11-04):</h2> <p>OAuth2.0 Provider (Security):</p> <ul> <li> <p><strong>Security</strong>: CVE-2026-49272 / GHSA-3jp2-3mrg-2vxc: The device code flow token endpoint did not validate the <code>device_code</code> parameter. A request with a known <code>client_id</code> and a bogus <code>device_code</code> could obtain a bearer token. <code>DeviceCodeGrant.validate_token_request</code> now calls a new <code>DeviceCodeGrant.validate_device_code()</code> which rejects missing or unknown device codes (<code>400 invalid_request</code> / <code>400 invalid_grant</code>) and delegates the code's authorization status to a new required <code>RequestValidator.validate_device_code()</code> hook, per RFC 8628 Section 3.5. (cherry-picked from <a href="https://redirect.github.com/oauthlib/oauthlib/issues/954">#954</a>, merged as 1c91d64)</p> <p><strong>Upgrade note for device flow integrators</strong>: custom <code>RequestValidator</code> implementations using the device flow must now implement <code>validate_device_code(client_id, code, request)</code>. Return one of the <code>DeviceCodeGrant.DEVICE_CODE_*</code> statuses (<code>AUTHORIZED</code>, <code>PENDING</code>, <code>SLOW_DOWN</code> or <code>EXPIRED</code>) for known codes, or <code>None</code> for an unknown code. When returning <code>AUTHORIZED</code>, the validator must also populate <code>request.user</code> and <code>request.scopes</code> from the stored authorization.</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/oauthlib/oauthlib/commit/6e3aa05af92978755939a18cb4dd655ced156c1e"><code>6e3aa05</code></a> Release 4.0.1: fix CVE-2026-49272 (device_code validation in device flow)</li> <li><a href="https://github.com/oauthlib/oauthlib/commit/77a5f1c8ce00da2b0b8c5f6e9cc129920085f114"><code>77a5f1c</code></a> Merge pull request <a href="https://redirect.github.com/oauthlib/oauthlib/issues/954">#954</a> from hekhuisk/improve-device-workflow</li> <li>See full diff in <a href="https://github.com/oauthlib/oauthlib/compare/v4.0.0...v4.0.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/calibrain/shelfmark/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
afb9bf1670 |
build(deps): bump the python-deps group with 3 updates (#1665)
Bumps the python-deps group with 3 updates: [flask-socketio](https://code.miguelgrinberg.com/miguelgrinberg/flask-socketio), [python-socketio](https://github.com/sponsors/miguelgrinberg) and [authlib](https://github.com/authlib/authlib). Updates `flask-socketio` from 5.7.0 to 5.7.1 Updates `python-socketio` from 5.17.1 to 5.18.1 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/sponsors/miguelgrinberg/commits">compare view</a></li> </ul> </details> <br /> Updates `authlib` from 1.9.1 to 1.9.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/authlib/authlib/releases">authlib's releases</a>.</em></p> <blockquote> <h2>v1.9.2</h2> <p>Changelog: <a href="https://docs.authlib.org/en/stable/upgrades/changelog.html#changelog-1-9-2">https://docs.authlib.org/en/stable/upgrades/changelog.html#changelog-1-9-2</a></p> <p><strong>Full Changelog</strong>: <a href="https://github.com/authlib/authlib/compare/v1.9.1...v1.9.2">https://github.com/authlib/authlib/compare/v1.9.1...v1.9.2</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/authlib/authlib/commit/d74dc90ea0de493858f987ddba47e1fccfb0c2f3"><code>d74dc90</code></a> chore: release 1.9.2</li> <li><a href="https://github.com/authlib/authlib/commit/44c96176dc903d21efea5fcafe9dc18cb3eb0517"><code>44c9617</code></a> fix(oauth): limit ID-JAG access tokens to the scope claim</li> <li>See full diff in <a href="https://github.com/authlib/authlib/compare/v1.9.1...v1.9.2">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Release Notes** * No end-user-facing changes are included in this update. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
splitsec2
|
4c3ce3355a |
fix(ui): give release source tabs their own row on phones (#1663)
Fixes #1662, thanks @mietu111 for the report and the screenshot. The source tabs share a row with up to five icons, which take 240px on a phone. On a 393px screen that leaves 113px for the tabs, so Prowlarr fits and Direct Download is down to a sliver. On a 360px screen not even Prowlarr fits. The scrollbar is hidden, so there is also nothing to tell you there is more to scroll to. With more than one source, the tabs now get their own row below the sm breakpoint and the icons sit on a row beneath them. Picking a tab also scrolls it into view, for when there are too many sources to fit. This does make the sticky header 36px taller on phones. One source and anything sm or wider stay on a single row, with the same tab positions and row height as before. I checked this with screenshots of the dialog using mocked search results, at 360 and 393px with two sources, 360px with five, 393px with one, and at 640 and 1280px with two. The filter menu and manual query panel still open correctly from the new row at 393px. There are no layout tests for this dialog, so I did not add one. Before, with Direct Download selected. The tab has 113px of space and its label is cut off. <img width="786" height="1704" alt="download" src="https://github.com/user-attachments/assets/7fc46034-4faf-438b-aed3-7d9adbd41ac9" /> After, with Direct Download selected. Both tabs fit and the icons sit on the row beneath. <img width="786" height="1704" alt="download" src="https://github.com/user-attachments/assets/e9e961e8-5f04-4b24-9483-89482891252a" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Improvements** * The active source tab is centered in the tab strip when selected. * On narrow screens, multiple source tabs wrap onto their own row, and the result count is hidden. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
splitsec2
|
7c90afca9e |
docs(core): docstrings for the functions the route moves left without one (#1660)
Follow-up to the route moves out of main.py. CodeRabbit's docstring coverage check flagged #1637 to #1639 at 63%, so I went back over the modules the moves created and filled in the 19 functions and nested helpers that had none, in queue_routes, release_routes, download_recording, system_routes, metadata_routes and auth_middleware. Comments only, nothing else changes. The route modules that were split out earlier (request_routes, activity_routes and a few others) have more without docstrings, but I left those alone since that code was not part of the moves. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Documentation** * Expanded and clarified descriptions of error responses, download and queue statuses, notification handling, queue ownership and visibility, release-policy checks, and administrative access. * No user-facing behavior changes are included in this update. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
splitsec2
|
e8ec6cc715 |
fix(requests): reopening after a failed download remembers the release that failed (#1655)
When a download fails, the terminal hook reopens its request through reopen_failed_request straight away, with no admin involved. That path cleared the release without noting that it had failed, so the next search could pick the same release again. Only the admin reopen and the status sync remembered it. Both paths now add the release to failed_releases before the reopen clears it, the same list the unattended retry already skips, and a release that is already listed is not added twice. A download that failed because its client could not be reached (the same four markers auto_download uses) is not held against the release, since the same one is fine once the client is back. This is the upstream shape of something I have been running on my own instance since mid October. ruff, basedpyright and the requests_service tests (87) pass, with five new tests for the two paths, the dedupe and the unreachable client. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Bug Fixes** * Failed requests are reopened after non-retryable delivery failures, with the failed release recorded when appropriate. * Connection failures caused by an unreachable client no longer mark the release as failed. * Reopening a request does not record the same release more than once or alter book details when no new release can be recorded. * Queue status updates apply the same release-tracking behavior, while requests that are not failed remain unchanged. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
splitsec2
|
eb9ee093de |
fix(auth): don't fail the lockout cleanup when a login clears the entry first (#1658)
cleanup_old_lockouts collects the expired usernames, logs each one and then deletes it. Under gevent the log write can yield, and a successful login for the same user in that gap clears the entry first, so the del raises KeyError in whatever request ran the cleanup. Both removals now use pop(username, None), and the new test reproduces the KeyError on main. While in there I dropped the if db_user check in the builtin login path. It is always true after the not db_user return just above it, and the failed response after it could never be reached. The diff looks bigger than it is because the block moves out one indent. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Bug Fixes** * Login failures now follow a consistent response path when an account is unavailable or its password data is invalid. * Expired login lockouts can be cleaned up safely even if they are cleared at the same time. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
splitsec2
|
b246c6617b |
fix(app_setup): create the secret key file private instead of tightening it after the write (#1659)
load_or_create_secret_key writes the Flask secret with write_bytes and then chmods it to 0600. Until the chmod the key sits in a file with whatever the umask allows, and if the chmod fails it stays that way and only a warning is logged. The file is now opened with mode 0600, an existing one is fchmod'ed before anything is written, and then the key goes in. The new test makes chmod fail and checks the file still ends up private, which fails on main. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Bug Fixes** * Secret-key files now receive restrictive permissions when created or replaced, helping prevent unauthorized access to the stored key. * Key creation maintains these permissions even when a later permission-setting operation fails. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
dependabot[bot]
|
95e01913b4 |
build(deps): bump the python-deps group with 2 updates (#1652)
Bumps the python-deps group with 2 updates: [python-socketio](https://github.com/sponsors/miguelgrinberg) and [prek](https://github.com/j178/prek). Updates `python-socketio` from 5.17.0 to 5.17.1 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/sponsors/miguelgrinberg/commits">compare view</a></li> </ul> </details> <br /> Updates `prek` from 0.5.7 to 0.5.9 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/j178/prek/releases">prek's releases</a>.</em></p> <blockquote> <h2>0.5.9</h2> <h2>Release Notes</h2> <p>Released on 2026-10-30.</p> <h3>Enhancements</h3> <ul> <li>Add <code>normalize-indentation</code> builtin hook (<a href="https://redirect.github.com/j178/prek/pull/2967">#2967</a>)</li> <li>Allow overriding the uv install version (<a href="https://redirect.github.com/j178/prek/pull/2923">#2923</a>)</li> <li>Embed dependency metadata in release binaries (<a href="https://redirect.github.com/j178/prek/pull/2976">#2976</a>)</li> <li>Select musl Bun builds when glibc is unavailable (<a href="https://redirect.github.com/j178/prek/pull/2972">#2972</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Improve workspace discovery performance (<a href="https://redirect.github.com/j178/prek/pull/2936">#2936</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Preserve clean-filtered files during stashing (<a href="https://redirect.github.com/j178/prek/pull/2915">#2915</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/j178"><code>@j178</code></a></li> <li><a href="https://github.com/tchernobog"><code>@tchernobog</code></a></li> </ul> <h2>Install prek 0.5.9</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.9/prek-installer.sh | sh </code></pre> <h3>Install prebuilt binaries via powershell script</h3> <pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.9/prek-installer.ps1 | iex" </code></pre> <h3>Install prebuilt binaries via Homebrew</h3> <pre lang="sh"><code>brew install prek </code></pre> <h2>Download prek 0.5.9</h2> <table> <thead> <tr> <th>File</th> <th>Platform</th> <th>Checksum</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/j178/prek/releases/download/v0.5.9/prek-aarch64-apple-darwin.tar.gz">prek-aarch64-apple-darwin.tar.gz</a></td> <td>Apple Silicon macOS</td> <td><a href="https://github.com/j178/prek/releases/download/v0.5.9/prek-aarch64-apple-darwin.tar.gz.sha256">checksum</a></td> </tr> </tbody> </table> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/j178/prek/blob/main/CHANGELOG.md">prek's changelog</a>.</em></p> <blockquote> <h2>0.5.9</h2> <p>Released on 2026-10-30.</p> <h3>Enhancements</h3> <ul> <li>Add <code>normalize-indentation</code> builtin hook (<a href="https://redirect.github.com/j178/prek/pull/2967">#2967</a>)</li> <li>Allow overriding the uv install version (<a href="https://redirect.github.com/j178/prek/pull/2923">#2923</a>)</li> <li>Embed dependency metadata in release binaries (<a href="https://redirect.github.com/j178/prek/pull/2976">#2976</a>)</li> <li>Select musl Bun builds when glibc is unavailable (<a href="https://redirect.github.com/j178/prek/pull/2972">#2972</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Improve workspace discovery performance (<a href="https://redirect.github.com/j178/prek/pull/2936">#2936</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Preserve clean-filtered files during stashing (<a href="https://redirect.github.com/j178/prek/pull/2915">#2915</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/j178"><code>@j178</code></a></li> <li><a href="https://github.com/tchernobog"><code>@tchernobog</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/j178/prek/commit/48c8a3ec465a8e98bb8b5b88c8bfacaca84cf84b"><code>48c8a3e</code></a> Bump version to 0.5.9</li> <li><a href="https://github.com/j178/prek/commit/9f23bb8204f8a9be707966c5803e5c16d65b0f80"><code>9f23bb8</code></a> Bump version to 0.5.8 (<a href="https://redirect.github.com/j178/prek/issues/2978">#2978</a>)</li> <li><a href="https://github.com/j178/prek/commit/b209d5399481cac5385c2895df8d4df56d534790"><code>b209d53</code></a> Bump dependencies (<a href="https://redirect.github.com/j178/prek/issues/2977">#2977</a>)</li> <li><a href="https://github.com/j178/prek/commit/e935fd611556a708c30429c2762dd97af2b08ca8"><code>e935fd6</code></a> Embed dependency metadata in release binaries (<a href="https://redirect.github.com/j178/prek/issues/2976">#2976</a>)</li> <li><a href="https://github.com/j178/prek/commit/7ca1efa86853c0b2124cef23dd7921cfba61a3ee"><code>7ca1efa</code></a> Select musl Bun builds when glibc is unavailable (<a href="https://redirect.github.com/j178/prek/issues/2972">#2972</a>)</li> <li><a href="https://github.com/j178/prek/commit/69b23d8c04c9c42ca0d93bf39140b0b9403fa62d"><code>69b23d8</code></a> Detect available glibc and musl runtimes (<a href="https://redirect.github.com/j178/prek/issues/2975">#2975</a>)</li> <li><a href="https://github.com/j178/prek/commit/08098ac39c258bf582c3458eba9378dbe0f1d8e4"><code>08098ac</code></a> Add <code>normalize-indentation</code> builtin hook (<a href="https://redirect.github.com/j178/prek/issues/2967">#2967</a>)</li> <li><a href="https://github.com/j178/prek/commit/aa757d3871eccf0acc6113c4ee296f3120b0889f"><code>aa757d3</code></a> Revert "Add expand-tabs builtin hook (<a href="https://redirect.github.com/j178/prek/issues/2918">#2918</a>)" (<a href="https://redirect.github.com/j178/prek/issues/2968">#2968</a>)</li> <li><a href="https://github.com/j178/prek/commit/310a66f0b2e7c4174bfd71281a02132356b9ce2e"><code>310a66f</code></a> Lock mise development tool versions (<a href="https://redirect.github.com/j178/prek/issues/2965">#2965</a>)</li> <li><a href="https://github.com/j178/prek/commit/36f4502f808c69ddd3729440db82e045cf2fb600"><code>36f4502</code></a> Report precise cargo-bloat sizes and symbol changes (<a href="https://redirect.github.com/j178/prek/issues/2963">#2963</a>)</li> <li>Additional commits viewable in <a href="https://github.com/j178/prek/compare/v0.5.7...v0.5.9">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
splitsec2
|
eb93a32f4b |
fix(ui): show Debug and Restart in the menu to admins only (#1653)
The Debug and Restart items in the menu show for every signed-in user whenever Debug Mode is on, but `/api/debug` and `/api/restart` both need an admin, so a regular user who clicks one gets a 403 page. The menu now hides them unless the user is an admin. It uses the auth check's `is_admin`, which is true when auth is off, so a no-auth install keeps both items. The Debug chip in the footer is a label and stays. Frontend typecheck passes. I also ran a scratch instance with Debug Mode on: the admin account sees Debug and Restart, a regular user sees only Report a Bug and Settings, and with auth off both items are still there. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Bug Fixes** * Debug information in the header is now shown only when debugging is configured and the signed-in user is an administrator. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
CaliBrain
|
2cb1fb4ac6 |
fix(tooltip): ignore sub-pixel overflow in the viewport clamp (#1651)
Closes #1646. In Firefox, hovering the Stop download button on an in-progress download blanked the page with React error #185. The Tooltip's layout effect moves a tooltip back inside the viewport and then runs again on the new position, expecting to measure no overflow. The Stop download tooltip runs about 10px past the right edge of the unpinned Activity sidebar. After the move, Firefox measures its right edge 0.0000153px past the limit (1594.0000153 against 1594), because it works out a transformed box in single precision. The effect moves it by that much, which is below what layout can represent, so the box stays put and the next pass measures the same overflow. After 50 passes React throws #185 and unmounts the app. Chromium lands at 1017.996 against 1018 and stops after one pass. The clamp now lives in getTooltipViewportNudge and treats overflow under half a pixel as none. Tooltip calls it with the same inputs as before. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Bug Fixes** * Tooltips are repositioned to stay within the viewport, including when they are wider or taller than the available space. * Minor overflow of less than half a pixel no longer triggers unnecessary repositioning. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
dependabot[bot]andsplitsec2
|
fe7073fdf6 |
build(deps): bump the python-deps group with 2 updates (#1644)
Bumps the python-deps group with 2 updates: [dnspython](https://github.com/rthalley/dnspython) and [seleniumbase](https://github.com/seleniumbase/SeleniumBase). Updates `dnspython` from 2.9.0 to 2.9.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/rthalley/dnspython/releases">dnspython's releases</a>.</em></p> <blockquote> <h2>dnspython 2.9.1</h2> <p>See <a href="https://dnspython.readthedocs.io/en/stable/whatsnew.html">What's New</a> for details.</p> <p>The minimum supported version of Python is 3.11.</p> <p>My thanks to the many people who have contributed to this release. Also thanks to my co-maintainers: Nicki Křížek, Petr Špaček, and Brian Wellington.</p> <p>This release was published to PyPI using Trusted Publishing.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/rthalley/dnspython/blob/main/doc/whatsnew.rst">dnspython's changelog</a>.</em></p> <blockquote> <h2>2.9.1 (in development)</h2> <ul> <li> <p>LOC text parsing now converts the altitude, size, horizontal precision, and vertical precision fields to centimeters exactly, and requires them to be decimal numbers of meters with at most two fractional digits, as RFC 1876 section 3 specifies. They were converted with <code>float()</code>, so <code>9.29m</code> became 928 cm rather than 929 cm and the text and wire forms of the record disagreed, forms such as <code>1e3m</code>, <code>1_000m</code>, <code>+10m</code>, <code>nanm</code>, and <code>infm</code> were accepted, extra fractional digits were silently dropped, and an altitude outside the representable range was accepted and then failed in <code>to_wire()</code> with a non-DNS exception. <code>dns.exception.SyntaxError</code> is now raised for all of these.</p> </li> <li> <p>The resolver now assigns a new random query id to every query.</p> </li> <li> <p>For transports that require a 0 query id, set it in a way that does not break TSIG.</p> </li> <li> <p><code>dns.message.QueryMessage.resolve_chaining()</code> now caps the minimum TTL of a negative response with no SOA record at 300 seconds (<code>dns.message.NEGATIVE_TTL_WITHOUT_SOA</code>). Previously the TTL was left at its initial value of 2^32 - 1, so a single NXDOMAIN or NODATA response with no SOA, e.g. a spoofed one, stayed in the resolver cache for the life of the process.</p> </li> <li> <p>DNSSEC validation now rejects an RRSIG whose type covered or class does not match the RRset, as RFC 4035 section 5.3.1 requires. This was not checked, so a revoked DNSKEY, which may only validate the DNSKEY RRset, still validated any RRset signed with its private key if the RRSIG claimed to cover DNSKEY.</p> </li> <li> <p><code>dns.tokenizer.Tokenizer</code> now ends a line at a carriage return, or at a carriage return followed by a line feed, unless the carriage return is in a quoted string. The carriage return of CRLF line ends used to stay in the last token of each line and in the text of a comment, so e.g. <code>dns.zone.from_text()</code> rejected a zone with CRLF line ends.</p> </li> <li> <p>DNSSEC validation no longer uses a DNSKEY with the REVOKE flag set to validate anything other than the DNSKEY RRset. RFC 5011 section 2.1 says a revoked key must not be used for any other purpose, but it was a candidate key like any other, so as long as the revoked key was still published, data signed with its private key, e.g. by whoever compromised it, validated.</p> </li> <li> <p><code>dns.ttl.from_text()</code> now rejects a BIND-style TTL that ends in a 0 without a unit, e.g. <code>1h0</code>, as it already did for other numbers, e.g. <code>1h5</code>, and as BIND does. The check for a trailing number tested its value instead of whether there was one, so <code>1h0</code> was read as one hour.</p> </li> <li> <p><code>dns.dnssec.sign_zone()</code> now adds the apex NSEC record when the origin is</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/rthalley/dnspython/commit/dddd69c1ca32a94d18d2662a2dc6085c8750dd6d"><code>dddd69c</code></a> black lint</li> <li><a href="https://github.com/rthalley/dnspython/commit/185cc38a0ab2d2ca1837b53d91b915e0f020b895"><code>185cc38</code></a> release prep</li> <li><a href="https://github.com/rthalley/dnspython/commit/cf22838ab0c64f3c6a4d157278ae7e9fb707de8d"><code>cf22838</code></a> Randomize the id of every message the resolver sends. (<a href="https://redirect.github.com/rthalley/dnspython/issues/1395">#1395</a>)</li> <li><a href="https://github.com/rthalley/dnspython/commit/e0fce7f5a9962325d64873c31103fb33dae55112"><code>e0fce7f</code></a> use a short negative TTL for a negative answer with no SOA in resolve_chainin...</li> <li><a href="https://github.com/rthalley/dnspython/commit/ad0803c88d90fbba86ee20de747fcc676ce769ec"><code>ad0803c</code></a> check the RRSIG type covered and class against the RRset (<a href="https://redirect.github.com/rthalley/dnspython/issues/1388">#1388</a>)</li> <li><a href="https://github.com/rthalley/dnspython/commit/8c38a048424b7f44b46b0e4b4318c08de00e0457"><code>8c38a04</code></a> Strictly apply RFC 3597 compression rules when decompressing. (<a href="https://redirect.github.com/rthalley/dnspython/issues/1383">#1383</a>)</li> <li><a href="https://github.com/rthalley/dnspython/commit/ab5ade8af1b0cd3ecd1e38410df07f38da67841e"><code>ab5ade8</code></a> end a line at a carriage return in the tokenizer (<a href="https://redirect.github.com/rthalley/dnspython/issues/1387">#1387</a>)</li> <li><a href="https://github.com/rthalley/dnspython/commit/d9d259d2bfd04ece71e039bae1f9521d2cd6d337"><code>d9d259d</code></a> only use a revoked DNSKEY to validate the DNSKEY RRset (<a href="https://redirect.github.com/rthalley/dnspython/issues/1385">#1385</a>)</li> <li><a href="https://github.com/rthalley/dnspython/commit/6d436b82b56afa988d510bc9e4bf17449ba42917"><code>6d436b8</code></a> reject BIND-style TTLs that end in a 0 without a unit (<a href="https://redirect.github.com/rthalley/dnspython/issues/1384">#1384</a>)</li> <li><a href="https://github.com/rthalley/dnspython/commit/d8fcf2dc3294e96ac08488a621a7d66a819e52a1"><code>d8fcf2d</code></a> bound $GENERATE width and parse text labels in linear time (<a href="https://redirect.github.com/rthalley/dnspython/issues/1382">#1382</a>)</li> <li>Additional commits viewable in <a href="https://github.com/rthalley/dnspython/compare/v2.9.0...v2.9.1">compare view</a></li> </ul> </details> <br /> Updates `seleniumbase` from 4.56.4 to 4.56.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/seleniumbase/SeleniumBase/releases">seleniumbase's releases</a>.</em></p> <blockquote> <h2>4.56.5 - A few bug fixes and more</h2> <h2>A few bug fixes and more</h2> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/740990ea23d4e8fe9a79aa5d53199b332f3ac9f8">Suppress exceptions caused by cdp.dom.enable()</a> --> This resolves <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4537">seleniumbase/SeleniumBase#4537</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/f39fa56c8e038054890945382134bb24b0152126">Use verify=True by default when calling requests.head()</a> --> This resolves <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4539">seleniumbase/SeleniumBase#4539</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/7fb67bf450a074fde72d0332f5502bad45e8414f">Simplify "headless" mode in the docs</a> --> This resolves <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4536">seleniumbase/SeleniumBase#4536</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/164c36da8bb90673563a7f0aaa3fe320e63fcaae">Update examples</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/9786d7bf8b5039769b61b9fd0bbc945f9a160241">Update the mkdocs prepare script</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/835cb808c0094e098b817e2dc1141282a672df40">Refresh Python dependencies</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/821d87f4372cb9059bc80349c77b976eb1fd4c4e">Update the method_summary</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/18a808c9f9c9efcaa66904e118ef0f25c5151f74">Update the docs</a></li> </ul> <h2>What's Changed</h2> <ul> <li>A few bug fixes and more by <a href="https://github.com/mdmintz"><code>@mdmintz</code></a> in <a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4540">seleniumbase/SeleniumBase#4540</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.56.4...v4.56.5">https://github.com/seleniumbase/SeleniumBase/compare/v4.56.4...v4.56.5</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/91d15446cdb6574b8eb1a812e1e77367e3525307"><code>91d1544</code></a> Merge pull request <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4540">#4540</a> from seleniumbase/a-few-bug-fixes-and-more</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/fa2b7989527371569cf9689e58bf443c0c9342f4"><code>fa2b798</code></a> Version 4.56.5</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/36125f29a48e7cc863b856f477602ef107491f78"><code>36125f2</code></a> Update MCP server versioning</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/18a808c9f9c9efcaa66904e118ef0f25c5151f74"><code>18a808c</code></a> Update the docs</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/821d87f4372cb9059bc80349c77b976eb1fd4c4e"><code>821d87f</code></a> Update the method_summary</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/835cb808c0094e098b817e2dc1141282a672df40"><code>835cb80</code></a> Refresh Python dependencies</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/9786d7bf8b5039769b61b9fd0bbc945f9a160241"><code>9786d7b</code></a> Update the mkdocs prepare script</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/164c36da8bb90673563a7f0aaa3fe320e63fcaae"><code>164c36d</code></a> Update examples</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/7fb67bf450a074fde72d0332f5502bad45e8414f"><code>7fb67bf</code></a> Simplify "headless" mode in the docs</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/f39fa56c8e038054890945382134bb24b0152126"><code>f39fa56</code></a> Use <code>verify=True</code> by default when calling <code>requests.head()</code></li> <li>Additional commits viewable in <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.56.4...v4.56.5">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Chores** * Updated browser automation support to a newer patch release. No user-facing behavior changes are included in this update. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: splitsec2 <35583321+splitsec2@users.noreply.github.com> |
||
|
dependabot[bot]andsplitsec2
|
3af8df177a |
build(deps): bump publicsuffixlist from 1.1.2.20261023 to 1.1.2.20261029 (#1645)
Bumps [publicsuffixlist](https://github.com/ko-zu/psl) from 1.1.2.20261023 to 1.1.2.20261029. <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/ko-zu/psl/commits">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Chores** * Updated project configuration. This maintenance update does not add or remove visible features, controls, or workflows. Existing behavior remains unchanged, and no new user actions are required. No other user-facing changes are included in this release. These notes cover the changes with a direct impact on the experience; no additional visible updates are reported. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: splitsec2 <35583321+splitsec2@users.noreply.github.com> |
||
|
splitsec2
|
99d842b381 |
build(docker): install Chromium from trixie-security without the snapshot pin (#1648)
Following the discussion on #1635, this drops the Chromium snapshot pin and the apt preference, and installs whatever trixie-security currently ships. Thanks @calibrain for suggesting we try it. With no pin there is nothing left to go stale, so the scheduled check that issue asked for isn't needed. Closes #1635. I built the image from this branch and ran it as a scratch container. It has Chromium 156.0.8078.79, and the bypass cleared DDoS-Guard on Anna's Archive and returned search results. That challenge cleared on the auto-wait step, so the click path wasn't exercised, same as the open question in #1635. One thing to know: the build cache is keyed on the Dockerfile text, so a newer Debian Chromium only lands when that layer rebuilds, for example on a base image bump. |
||
|
splitsec2
|
fa42f357d2 |
fix(types): type download_url's return by spool_to_disk (#1649)
The Python Typechecks job fails on main since #1632, which is why #1644 shows red too. `download_url` returns a `BytesIO`, or a `SpooledTemporaryFile` when `spool_to_disk` is set, and both were typed as `BinaryIO`. That has no `getbuffer()`, which four direct-download callers use. Two overloads on `spool_to_disk` give each caller the type it actually gets, so nothing changes at runtime. Thanks @29rdx for the spooling work, this only tightens the types around it. basedpyright (source and tests), ruff and vulture are clean, and the tests for the download, direct download and libgen code pass. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Developer Experience** * Updated download API type information to distinguish between in-memory buffers and disk-spooled buffers. The return type now reflects the selected spooling option, making the API’s possible results clearer to developers and improving type checking when working with downloaded content. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
splitsec2
|
9d8e7eaad2 |
fix: keep exception text out of the queue, release, metadata and debug responses (#1643)
Now that the route moves have landed, this takes care of the code scanning alerts they brought along. Sixteen places in `queue_routes.py`, `release_routes.py`, `metadata_routes.py` and `system_routes.py` handed `str(e)` of an unexpected OSError, RuntimeError, TypeError or sqlite3 error back as the 500 body. It can carry file paths, URLs with tokens or driver text. Same idea as #1558 and #1562. Each now returns one fixed sentence ("Could not cancel the download", "Could not read the queue order", "Metadata search failed" and so on) and the full error and trace stay in the log. The routes covered are the cover proxy, cancel, retry, priority, reorder, queue order and active downloads; release download, search, source list and source record; the metadata providers, config, search and book routes; and the debug endpoint. I left alone the messages that are written for the person using the app: what a metadata provider raises as a ValueError or RuntimeError ("Hardcover API key is invalid"), `SourceUnavailableError`, and the reason `queue_release` gives. CodeQL still flags those, as I read it those are the ones that should be dismissed as intended, but that is your call. The same pattern is in the settings and onboarding routes, which aren't flagged, so I didn't touch them. There are 15 new tests, one per fixed route except the debug endpoint, which only exists in debug mode. All 15 fail without the change. Two queue tests that asserted the old text now assert the fixed message. The full suite, ruff and basedpyright are clean. @calibrain I pushed through the refactors keeping them the same functionality, this addresses "issues" flagged in them, I think some of these were dismissed before, but I gathered them all up here in a PR that you should have a say on as it is changing long standing code. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Bug Fixes** * Error responses now show generic messages instead of operational exception details across metadata, queue, release, and debug endpoints. HTTP status codes and error logging remain unchanged. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
 Rupraj Datta
|
ed0777a2e0 |
Spool large debrid downloads to disk (#1632)
Fixes #1630. Debrid downloads currently buffer entire files in RAM. The four clients now opt into a spooled temporary file: downloads up to 8 MiB stay in memory, and larger downloads roll to disk. The clients copy from the file in chunks and close it after use. Other download_url callers retain the existing BytesIO behavior. Temporary files are closed on unsuccessful attempts and cancellation; successful resumed downloads remain open for their caller. Added offline coverage for disk rollover, timeout cleanup, and resumed content. Updated the Debrid-Link test doubles for the new opt-in argument. Validation: 113 tests passed across test_http_download_url, test_debridlink_client, and test_torbox_client; Ruff check and format check passed for changed files; git diff --check passed. No live debrid services were exercised. AI assistance was used in implementing this change. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Improvements** * Large downloads are handled more efficiently, reducing memory use while preserving download and resume behavior. * **Bug Fixes** * Temporary download data is cleaned up when a download is cancelled or fails, helping prevent unnecessary resource usage. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
splitsec2
|
622f6ac677 |
refactor: move the download recording into core/download_recording.py (#1642)
Last of the planned moves is the download recording (row 9 in Discussion #1536). The queue hooks that write a download to the history when it is queued, finalize it on a terminal status, notify, push the activity update and reopen a failed request move from `main.py` to `core/download_recording.py`, registered with `register_download_recording(...)`. None of it was tested directly, so the first commit adds 38 tests: the queued record for direct and request linked downloads, the terminal snapshot for complete, error and cancelled, ignoring non terminal statuses, who gets notified, reopening a failed request, and what happens when a service is missing or a call fails. They pass on current `main`. The second commit is the move. `_resolve_status_scope` and the request update emitter stay in `main.py` because other code uses them, so the emitter is passed in, and the user database and history service are looked up per call as before. The hooks are registered at the same spot. Some existing test lines changed with the move and no assertion did: the `notify_admin`, `notify_user` and `reopen_failed_request` patches point at the new module, the direct calls to `_record_download_queued` go through the queue's hook, and two tests import `QueueStatus` and `viewer_download_id` themselves now that `main.py` no longer imports them. The URL map is identical, all 77 rules, and the full suite, ruff and basedpyright are clean. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Improvements** * Download history and activity updates reflect queued downloads and their completion statuses; activity updates are emitted after successful finalization. * Admins and eligible download owners receive notifications when downloads reach a terminal status. * Requests linked to downloads that fail and cannot be retried are reopened with a failure reason. * Activity updates use an opaque download identifier rather than exposing the underlying task identifier. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
splitsec2
|
fa28bc2185 |
refactor: move the release routes into core/release_routes.py (#1640)
The release routes are the largest piece left in `main.py`. `/api/releases`, `/api/releases/download`, `/api/release-sources` and the source record route move to `core/release_routes.py`, registered with `register_release_routes(app, login_required, ...)`. They take the content type inference, the request policy checks that gate listing and download, and the release serializers with them. The inspect route is registered from the same function since it shares the policy gate. `main.py` is about 700 lines shorter. The first commit adds 34 tests for what the policy, budget, direct provider and title tests did not cover: content type inference on download, the policy refusal on download, the error statuses of the listing route, the source list and the record route. They pass on current `main`. The second commit is the move. The policy checks need the auth mode, the user database and the request policy settings, so they come in as callables that `main.py` resolves lazily, which keeps the existing tests that patch those on `shelfmark.main` working. One test line changed, the patch of `get_source_content_type_capabilities`, which now points at the new module. Log lines from these routes now name `shelfmark.core.release_routes`. The URL map is identical, all 77 rules. The full suite, ruff and basedpyright are clean, and I ran the app from the branch with the other two route PRs merged in and hit the source list, the listing route's validation, the record route and the download route, which answer as before. The exception text a few of them return in a 500 is unchanged, that is for the follow-up on exception text. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Release Discovery** * Release searches can use metadata providers, manual searches, or direct source browsing, with results and source details returned together. * Searches respect request policies and report unavailable sources or partial-search errors. * **Downloads** * Download requests validate submitted details, infer a content type when possible, and report whether the request was queued successfully. * **Source Browsing** * Available sources and individual source records can be retrieved, subject to applicable access policies. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
splitsec2
|
2254e2bf93 |
refactor: move the proxy-auth and API-key middleware into core/auth_middleware.py (#1641)
Row 8 of the plan in Discussion #1536 is the auth middleware. The API key `before_request` hook, the proxy auth hook, the hook that strips the session cookie from API key requests and `_proxy_default_is_admin` move from `main.py` to `core/auth_middleware.py`, registered with `register_auth_middleware(app, resolve_auth_mode=..., get_user_db=...)`. This is the code that decides who a request is, so the first commit adds 41 tests before anything moves. They cover the hook order, the admin group mapping (comma and pipe delimiters, a custom group header, the WSGI fallback), proxy header handling in each auth mode, provisioning once per session, the API key scope (exempt paths, a read only key only on GET `/api/stats`, a wrong key) and the cookie stripping. They pass on current `main`. The second commit is the move. The call is made right after `register_security_headers`, so the `before_request` and `after_request` order is the same as before. The existing tests called `proxy_auth_middleware()` and `api_key_auth_middleware()` on `shelfmark.main` directly, and those names are gone, so 18 call lines in three test files now find the registered hook by name through a small helper. No patch targets changed since the auth mode and user database are still read from `main` at request time. The URL map and hook order are identical, and the full suite, ruff and basedpyright are clean. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Authentication** * API-key authentication supports admin and read-only access, with read-only keys limited to statistics requests. * Reverse-proxy authentication recognizes configured identity and group information, and applies admin access according to the configured role settings. * Requests with invalid credentials, missing proxy identities, or authentication errors receive appropriate error responses. * API-key requests no longer retain session cookies. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
splitsec2
|
384adc4c75 |
refactor: move the queue routes into core/queue_routes.py (#1637)
Next from the route plan in Discussion #1536 are the queue routes: status, cancel, retry, priority, reorder, queue order, active downloads, the local file download and the cover proxy. They move from `main.py` to `core/queue_routes.py`, registered with `register_queue_routes(app, login_required, ...)`, and `main.py` is about 600 lines shorter. The first commit adds 33 tests for what the guardrail tests did not cover, mostly the local download in each shape, the admin paths, the validation errors and the failure responses. They pass on current `main`. The second commit is the move. `resolve_status_scope` and the request update emitter stay in `main.py` because the release routes and the request code still use them, so they come in as parameters, with the user database and the history service as callables evaluated per request. Two test lines changed: the patches of `send_file` and of the delivery state sync now point at `queue_routes`, since that is where they get looked up. Log lines from these routes now name `shelfmark.core.queue_routes`. The URL map is identical, all 77 rules. The full suite, ruff and basedpyright are clean, and I ran the app from the branch and hit status, queue order, active downloads, the local download and the cover route, which answer as before. The exception text a few of them return in a 500 is unchanged, that is for the follow-up on exception text. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Improvements** * Queue status, downloads, and queue controls respect account ownership, with administrative access retained. * More specific errors clarify when queue items or files are missing or unavailable. * Queue actions support cancellation, retrying, prioritization, and reordering. * Cover requests can use cached images when caching is enabled. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
splitsec2
|
f06585aa01 |
refactor: move the secret key, session cookie, security headers and log filter into core/app_setup.py (#1639)
`main.py` also builds the app itself, and this moves the parts of that which need no route into `core/app_setup.py`: the persisted secret key and the session cookie settings, the security headers, and the filter that keeps status polling and the WebSocket upgrade noise out of the log. It is the app setup item in the plan from Discussion #1536. The first commit adds 14 tests for them, since none existed: the key reused, created with mode 600, replaced when too short, and still returned when the config directory cannot be written, the cookie settings, the headers on a real response and that a header a route set itself is kept, and each case the log filter drops or keeps. They pass on current `main`. The second commit is the move. The security headers hook is registered from the same spot in `main.py` as before, so the `after_request` order is unchanged. The secret key function takes the config directory as a parameter instead of reading `CONFIG_DIR`, which is the one change in the move, and the key tests call it with a temp directory. The URL map and the hook order are identical, and the full suite, ruff and basedpyright are clean. I also ran the app from the branch: the secret file is created with mode 600 and the four security headers come back on a normal response. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Bug Fixes** * Sessions now remain consistent across app restarts, and session cookies use more protective browser settings, including HTTP-only access and a seven-day lifetime. * Responses include baseline security headers while preserving any headers already set by the app. * Routine status-polling and connection-upgrade messages are filtered from application logs, reducing unrelated log noise. * If saving a session key fails, the app can still start with a generated key. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
splitsec2
|
9ca1981d00 |
refactor: move the Socket.IO handlers into core/socket_handlers.py (#1638)
This one is small. The three Socket.IO handlers, connect, disconnect and request_status, move from `main.py` to `core/socket_handlers.py`, registered with `register_socket_handlers(socketio, ...)`. It is the Socket.IO item in the plan from Discussion #1536. They had no tests, so the first commit adds 9 that go through Flask-SocketIO's test client: what a client gets on connect with no auth, as an admin, as a user and as a visitor with no session, a failure reading the status, the manual status request, and the room bookkeeping on disconnect. They pass on current `main`. The second commit is the move. `resolve_status_scope` stays in `main.py` since the HTTP routes use it too, so it is passed in. One test line changed, the patch of `redact_status`, which now points at the new module. Log lines from the handlers now name `shelfmark.core.socket_handlers`. The URL map and the registered socket events are identical before and after, and the full suite, ruff and basedpyright are clean. I also started the app from the branch and the Socket.IO handshake answers. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Bug Fixes** * Status requests now return a consistent empty update when access is denied and an error message when status retrieval fails. * Status visibility follows the requester’s access level, with non-admin results redacted. * **Refactor** * Connection, disconnection, and status-request handling now follows consistent room and connection-tracking behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
splitsec2
|
c6685feba5 |
fix(docker): drop ffmpeg from the default image; install on demand in Debug mode (#1631)
ffmpeg is in the default image for one thing, the Debug mode screen recording (`_start_ffmpeg_recording`). Nothing else calls it, SeleniumBase included, and it brings 93 packages with it. On real builds that's 406 Trivy findings (149 High) and 78 MB of the gzipped amd64 image. This takes it out of the image and installs it when Debug mode needs it. It came out of the base image discussion on #1616 and helps on any base, though on Wolfi the install line would need `apk`. ## What changed - **Dockerfile:** ffmpeg is gone from the full image's install. - **Guard:** `_start_ffmpeg_recording` checks `shutil.which("ffmpeg")` first. If it's missing it logs a warning and returns, and the bypass carries on. Without this, Debug on with no ffmpeg fails every bypass with `FileNotFoundError`. There's a new test for it. - **Entrypoint:** when Debug is on, the internal bypasser is in use and ffmpeg isn't already there, it installs ffmpeg in the background so the app doesn't wait for it. The download and the install each run under a 120 s `timeout` with `DEBIAN_FRONTEND=noninteractive`. Downloading first means a hung mirror can only be killed before dpkg starts, and the next start runs `dpkg --configure -a` in case a restart cut dpkg off. It logs when it starts, succeeds, times out or fails. - **Docs:** a short paragraph in `docs/troubleshooting.md` covering the install and the non-root limit. ## Debug has two sources Debug can come from the `DEBUG` env var or from the Debug Mode setting in the UI, which is saved to `/config/plugins/advanced.json`. The existing block in `entrypoint.sh` only reads the env var, so an install keyed on `$DEBUG` would miss anyone who turned it on in the UI. The new check asks the app instead (`shelfmark.config.env.DEBUG`), which reads both. The UI setting is `requires_restart`, so the restart it already asks for is what brings it through the entrypoint. ## Non-root mode A container started as `1000:1000` can't run `apt-get`, so the entrypoint logs that it can't install ffmpeg, the guard warns on each bypass, and there's no recording. Everything else works. The workaround for a debugging session is to start as root with `PUID`/`PGID`. ## Startup cost None that I could measure. With Debug on, `/api/health` answers in the same time as main (3-4 s with Debug only in config, 9-10 s from env), and ffmpeg was ready 6-8 s later on the runners. The trade-off is that the first bypass after startup may be unrecorded while the install runs. It logs the warning and passes. I saw both outcomes on a bypass started right after health. From reading the code: the install lives in the container, so recreating the container installs it again. It also runs after `tor.sh` and `wireguard.sh`, so apt goes through whichever egress is active. ## Testing Real Docker builds on GitHub Actions on my fork, amd64 and arm64, with the same result on both for every case below. | Case | Result | |---|---| | Debug off | No install, `/api/health` in 3-4 s, same as main | | Debug only in config | Health in 3-4 s, ffmpeg ready 6-8 s later, real mp4 after a bypass | | Debug from env | Health in 9-10 s (same as main), real mp4 after a bypass | | Started as root, app dropped to uid 1000 | Smoke and bypass pass | | Started with `--user 1000`, Debug on | Logs both messages, bypass passes, no mp4 | | apt blocked (closed proxy) | Logs `Could not install ffmpeg`, bypass passes, no mp4 | | apt's proxy on a dropped address, so no TCP reply at all | Health in 9-10 s, a bypass during the install passes with the warning and no mp4. apt gives up by itself in under a minute. Nothing left running, `dpkg --audit` clean | | DNS server on a dropped address | Health in 9-10 s, `Timed out installing ffmpeg after 120s`. Nothing left running, `dpkg --audit` clean | | `--network none`, Debug on | No hang, health 200 from inside the container | | Container restarted while dpkg was running | Next start finishes the install, `dpkg --audit` clean, real mp4 | | Fresh named volume, Debug only in config | Recording made, uid 1000 can write | | Existing uid-1000 volume, Debug only in config | Same, nothing root-owned afterwards | | `find /config /var/log/shelfmark -user root` | 0 files, same as main | | `find /app -user root` | 245, same count as main | | `tests/e2e/platform/run-e2e.sh` with `dns-blocked` and `baseline` | Pass | The bypass checks ran against example.com. A real Cloudflare challenge was served by a demo page in the same runs, and no build solved it, including main, so that part doesn't say anything about this change. Locally: 5494 Python tests pass, and `ruff`, `basedpyright`, `vulture` and `shellcheck` are clean. The full results are in [the base image report](https://github.com/splitsec2/shelfmark/blob/7afcecfb76727724a71561cbc078f091569b58dc/docs/research/2026-11-01-base-image-report.md). |
||
|
splitsec2
|
34c9e6dbd7 |
refactor: move the auth routes into core/auth_routes.py (#1625)
The auth routes are the next group from the plan in Discussion #1536: `/api/auth/login`, `/logout` and `/check`, plus the login lockout helpers, move from `main.py` to `core/auth_routes.py`, registered with `register_auth_routes(app, ...)`. `main.py` is about 370 lines shorter. This is the login path, so I kept it strictly to a move. Two commits. The first adds 59 tests that pin the current behaviour before anything moves: login in each mode (builtin, none, CWA and the OIDC password fallback), wrong passwords, the lockout (the warning when five attempts are left, the 429 and its text on the tenth failure, per-user isolation, expiry), the local-auth switches, logout in each mode and `/check`. They pass on current `main`, and I ran the same file against `main` and against this branch. The second commit is the move, and no existing test changed. The lockout state is one dict, now living in `auth_routes`, and `main.py` imports the same object so its other users (the password-attempt limiter for the self-user routes, and the tests) see it. Everything else that comes from `main` (the user database, the auth mode, the client IP, the CWA database path, the local-auth settings and the password check) is passed in as a callable evaluated per request, so patches on `main` still apply. Two things to know. `main.py` re-exports the lockout names and keeps three lines assigning the view functions (`api_login = app.view_functions["api_login"]` and the other two), because the e2e tests call `main_module.api_login()` directly and I did not change tests in this PR. If you would rather drop both, I can edit those e2e tests instead. The other is that the lockout dict is no longer reset by a reload of `main`, which only matters in tests, and they clear it themselves. The URL map is identical, all 77 rules, and the full suite, ruff and basedpyright are clean. I also ran the app with builtin auth on a scratch instance and went through it over HTTP: a wrong password gets a 401, login works and `/check` shows the session, logout clears it, the tenth failed attempt gets the 429, and the right password is refused while the account is locked. |
||
|
splitsec2
|
d1e959758d |
refactor: move the system routes into core/system_routes.py (#1624)
The system routes are the next group from the plan in Discussion #1536: `/api/config`, `/api/health`, `/api/debug`, `/api/restart` and the routes that serve the frontend (`/`, the SPA catch-all, `/assets/...`, the logo, the favicons and `theme-init.js`) move from `main.py` to `core/system_routes.py`, registered with `register_system_routes(app, login_required, ...)`. `main.py` is about 250 lines shorter. Same two-commit layout as before. The first commit adds 14 tests for the frontend-serving routes and the `/api/config` error paths, which had none, and they pass on current `main`. The second commit is the move, and no existing test changed. The helpers only these routes use moved with them (`admin_required`, built on the `login_required` that is passed in, plus `_base_href` and `_serve_index_html`). What `main.py` still owns, the base path, the frontend folder, the auth mode and the session user id, is passed in as callables evaluated per request, so the tests that patch them on `main` still work. The debug routes are only registered when debug is on, as before, with the stop-GUI and run-script hooks handed in. The thing to look at is the SPA catch-all, which is now registered earlier in `main.py` than it used to be (the old comment said it must be last). Werkzeug picks the most specific rule whatever the registration order, and I checked it: all 76 rule and method pairs in the URL map still match their own endpoint, on `main` and on this branch, and an unknown `/api/...` path still gets the JSON 404. The Flask URL map is identical before and after, all 77 rules, and with debug on (79). The full suite, ruff and basedpyright are clean. I also ran the app from this branch: health, config, the logo, the favicon and the theme script answer as before, a client-side path like `/library/books` gets the index page, an unknown `/api/` path gets the JSON 404, and the page loads in a browser. I did not exercise `/api/restart` or a real debug script run, since nothing tests them. |
||
|
splitsec2
|
d41fa98749 |
refactor: move the metadata routes into core/metadata_routes.py (#1623)
The metadata routes are the next group from the plan in Discussion #1536: the eight `/api/metadata/...` handlers (providers, config, search, field-options, book and the three targets routes) move from `main.py` to `core/metadata_routes.py`, registered with `register_metadata_routes(app, ...)`. `main.py` is about 490 lines shorter. Same two-commit layout as the settings move (#1595). The first commit adds 39 tests that pass on current `main` before anything moves. They cover the 401 on all eight routes, the shape of the providers list and the config, the search errors, the book lookup (200, 404, 400 and 503), and how target errors map to 400, 502 and 500. The second commit is the move, and no test changed in it. Three helpers moved with the routes because nothing else uses them. `_attach_library_ownership` stays in `main.py` since the releases routes need it too, and is passed in along with the login decorator and the auth mode, the way `activity_routes` takes them. The auth mode is a callable evaluated per request, so the one test that patches it on `main` still works. The Flask URL map (every rule, its methods and its endpoint name) is identical before and after, all 77 rules. The full suite, ruff and basedpyright are clean. I also ran the app from this branch and hit the routes over HTTP: providers and config answer 200, a book that doesn't exist gets a 404, and search answers 503 with the "no metadata provider configured" message on an instance with none enabled. I did not look at it in a browser or run the e2e tests. Log lines for these routes now come from `shelfmark.core.metadata_routes`, and the error tuples are local copies so the module doesn't import `main`. One thing to know when reading the diff: the register call sits just after `_attach_library_ownership` and not where the first route used to be, because that function has to be defined before it can be passed in. |
||
|
splitsec2
|
0a7e114681 |
docs(dev): new routes go in a register_<group>_routes module (#1622)
Nothing in the developer docs says where a new route goes, so the next contributor adds it to `main.py` again. This writes down the convention from Discussion #1536: a new route group gets its own `register_<group>_routes` module under `shelfmark/core/`, and `main.py` calls it once. It is one paragraph on a new page, `docs/dev/routes.md`, with a line in the developer index. It also says that a few older routes are still in `main.py` and are being moved out one group at a time. The route moves in that discussion will follow what this says, so this goes first. |
||
|
splitsec2
|
9bd6c51388 |
fix(hardcover): read the featured series from a search result (#1589)
Closes #1585. @joeRob2468 traced this one to the parser, and the answer turned out to be sitting in the search response already. A Hardcover search hit carries the book's featured series as `featured_series`, with the same shape as the `featured_book_series` of a full record: the position and a nested series with its id, name and book count. `_parse_search_result` never read it, so a book requested from a search card was stored with `series_name: null` and the `{Series}` folder and the custom script payload came out empty. It now reads it, through a small helper that `_parse_book` uses too, so there is no extra Hardcover call per request (the issue's other option was fetching the full record, which costs one against the rate limit). I checked it against a live search for "Mistborn The Final Empire". The top hit parses to series "The Mistborn Saga: The Original Trilogy", position 1, id 10001, and its search title is still "Mistborn". That last part is on purpose. I left `_compute_search_title` alone, since passing it the series would change what gets searched for everyone and the series name here doesn't equal the "Mistborn" prefix anyway. Two things that behave differently. A search result now has `series_name` set, so anything in the UI that shows it for a full record (the series link, the bigger cover in the release modal) will show it on search results too. I ran the branch and looked at the release modal for the top Mistborn result: it shows "#1 of 3 in The Mistborn Saga: The Original Trilogy" with the View series link. The modal fetches the full record when it opens, so I can't say how much of that is new on this path. Requests already stored keep the empty series they were saved with. Tests: four in a new file (a hit with a series, hits with none or an incomplete one, a hit nested in a `document`, and the search title staying the same), the first and third fail on current main. The metadata and core suites, ruff and basedpyright are clean.v1.6.0 |
||
|
dependabot[bot]
|
d95f663a92 |
build(deps): bump the gh-actions group with 5 updates (#1612)
Bumps the gh-actions group with 5 updates: | Package | From | To | | --- | --- | --- | | [docker/login-action](https://github.com/docker/login-action) | `4.6.0` | `4.7.0` | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `10.3.0` | `10.3.2` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.39.0` | `4.39.1` | | [github/codeql-action/autobuild](https://github.com/github/codeql-action) | `4.39.0` | `4.39.1` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.39.0` | `4.39.1` | Updates `docker/login-action` from 4.6.0 to 4.7.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/docker/login-action/releases">docker/login-action's releases</a>.</em></p> <blockquote> <h2>v4.7.0</h2> <ul> <li>Preserve explicit ECR settings in <code>registry-auth</code> by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/login-action/pull/1089">docker/login-action#1089</a></li> <li>Use registry hosts for scoped credentials by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/login-action/pull/1088">docker/login-action#1088</a></li> <li>Raise Docker Hub OIDC max expiry to 6 hours by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/login-action/pull/1068">docker/login-action#1068</a></li> <li>Log Docker Hub OIDC token exchange progress by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/login-action/pull/1061">docker/login-action#1061</a></li> <li>Bump <code>@aws-sdk/client-ecr</code> and <code>@aws-sdk/client-ecr-public</code> to 3.1154.0 in <a href="https://redirect.github.com/docker/login-action/pull/1093">docker/login-action#1093</a></li> <li>Bump <code>@docker/actions-toolkit</code> from 0.94.0 to 0.107.0 in <a href="https://redirect.github.com/docker/login-action/pull/1100">docker/login-action#1100</a></li> <li>Bump <code>@humanfs/node</code> from 0.16.7 to 0.16.8 in <a href="https://redirect.github.com/docker/login-action/pull/1077">docker/login-action#1077</a></li> <li>Bump csv-parse from 7.0.1 to 7.0.3 in <a href="https://redirect.github.com/docker/login-action/pull/1078">docker/login-action#1078</a></li> <li>Bump handlebars from 4.7.9 to 4.7.10 in <a href="https://redirect.github.com/docker/login-action/pull/1091">docker/login-action#1091</a></li> <li>Bump js-yaml from 5.2.2 to 5.5.0 in <a href="https://redirect.github.com/docker/login-action/pull/1066">docker/login-action#1066</a></li> <li>Bump postcss from 8.5.22 to 8.5.26 in <a href="https://redirect.github.com/docker/login-action/pull/1071">docker/login-action#1071</a></li> <li>Bump postcss-selector-parser from 7.1.1 to 7.1.6 in <a href="https://redirect.github.com/docker/login-action/pull/1092">docker/login-action#1092</a></li> <li>Bump source-map-js from 1.2.1 to 1.2.2 in <a href="https://redirect.github.com/docker/login-action/pull/1090">docker/login-action#1090</a></li> <li>Bump undici from 6.27.0 to 6.29.1 in <a href="https://redirect.github.com/docker/login-action/pull/1085">docker/login-action#1085</a></li> <li>Bump uuid from 14.0.1 to 14.0.3 in <a href="https://redirect.github.com/docker/login-action/pull/1096">docker/login-action#1096</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/login-action/compare/v4.6.0...v4.7.0">https://github.com/docker/login-action/compare/v4.6.0...v4.7.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/docker/login-action/commit/81c6f93d4bc991e510b342a00b419b3bb4efc5c6"><code>81c6f93</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1100">#1100</a> from docker/dependabot/npm_and_yarn/docker/actions-t...</li> <li><a href="https://github.com/docker/login-action/commit/1b16c8d1815e1d951d87a3522ff48a76d073735a"><code>1b16c8d</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1096">#1096</a> from docker/dependabot/npm_and_yarn/uuid-14.0.3</li> <li><a href="https://github.com/docker/login-action/commit/ac86b5e9e9d2db43b12b2d3afb9140a427d69d65"><code>ac86b5e</code></a> [dependabot skip] chore: update generated content</li> <li><a href="https://github.com/docker/login-action/commit/1476d845f08dd8309a938959a280f2e23c0cba14"><code>1476d84</code></a> build(deps): bump <code>@docker/actions-toolkit</code> from 0.94.0 to 0.107.0</li> <li><a href="https://github.com/docker/login-action/commit/503cee68d85e94275776fcc6f5315f19207f7567"><code>503cee6</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1095">#1095</a> from docker/dependabot/github_actions/actions/create...</li> <li><a href="https://github.com/docker/login-action/commit/f0935357f5c539aeb7ff6b886ba5434ab76e9de3"><code>f093535</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1099">#1099</a> from docker/dependabot/github_actions/codecov/codeco...</li> <li><a href="https://github.com/docker/login-action/commit/d5ae7f188776587b12b77b45e29ea21332462da9"><code>d5ae7f1</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1098">#1098</a> from docker/dependabot/github_actions/docker/bake-ac...</li> <li><a href="https://github.com/docker/login-action/commit/6f9750797f6e7186f18c069a7e97abc1dcf1006b"><code>6f97507</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1097">#1097</a> from docker/dependabot/github_actions/docker/bake-ac...</li> <li><a href="https://github.com/docker/login-action/commit/006d61fa598847d65f6670d1569545fa2af9cf02"><code>006d61f</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1094">#1094</a> from docker/dependabot/github_actions/codeql-actions...</li> <li><a href="https://github.com/docker/login-action/commit/93f5f522eea5eacabf35cc89b9d19ec23e742471"><code>93f5f52</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1093">#1093</a> from docker/dependabot/npm_and_yarn/aws-sdk-dependen...</li> <li>Additional commits viewable in <a href="https://github.com/docker/login-action/compare/dbcb813823bdd20940b903addbd779551569679f...81c6f93d4bc991e510b342a00b419b3bb4efc5c6">compare view</a></li> </ul> </details> <br /> Updates `astral-sh/setup-uv` from 10.3.0 to 10.3.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/setup-uv/releases">astral-sh/setup-uv's releases</a>.</em></p> <blockquote> <h2>v10.3.2 🌈 update known checksums for 0.13.5</h2> <h2>Changes</h2> <h2>🧰 Maintenance</h2> <ul> <li>chore: update known checksums for 0.13.5 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1103">#1103</a>)</li> </ul> <h2>📚 Documentation</h2> <ul> <li>docs: update version references to v10.3.1 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1102">#1102</a>)</li> </ul> <h2>v10.3.1 🌈 preserve cache error class names in save-cache bundle</h2> <h2>Changes</h2> <p>This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn</p> <p><code>##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.</code></p> <h2>🐛 Bug fixes</h2> <ul> <li>fix: preserve cache error class names in save-cache bundle <a href="https://github.com/dannyward630"><code>@dannyward630</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1093">#1093</a>)</li> </ul> <h2>🧰 Maintenance</h2> <ul> <li>chore: update known checksums for 0.13.4 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1099">#1099</a>)</li> <li>chore: update known checksums for 0.13.2/0.13.3 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1098">#1098</a>)</li> <li>chore: update known checksums for 0.13.1 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1094">#1094</a>)</li> <li>Verify npm dependency signatures before builds <a href="https://github.com/zaniebot"><code>@zaniebot</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1027">#1027</a>)</li> </ul> <h2>📚 Documentation</h2> <ul> <li>docs: cache-dependency-glob matches relative to the working directory <a href="https://github.com/flange-ipb"><code>@flange-ipb</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1092">#1092</a>)</li> <li>docs: update version references to v10.3.0 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1090">#1090</a>)</li> </ul> <h2>⬆️ Dependency updates</h2> <ul> <li>chore(deps): roll up Dependabot updates <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1101">#1101</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/setup-uv/commit/07a047e608db84b3d8c06cd9a7c7dcc9c355c18e"><code>07a047e</code></a> chore: update known checksums for 0.13.5 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1103">#1103</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/e1b85369e72750369c935b004eccf97311bdf5dc"><code>e1b8536</code></a> docs: update version references to v10.3.1 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1102">#1102</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/18d369b23da25a81e9458561248e1aafff6a70fa"><code>18d369b</code></a> chore(deps): roll up Dependabot updates (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1101">#1101</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/4ad2329c1e377d882fcae221cd1d17e7c0ad788e"><code>4ad2329</code></a> chore: update known checksums for 0.13.4 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1099">#1099</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/4bc6759c82322ff7efa28de54a45404ca6869912"><code>4bc6759</code></a> chore: update known checksums for 0.13.2/0.13.3 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1098">#1098</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/c97f06e356bcca1b426f396ef93ec35ce149ce7b"><code>c97f06e</code></a> fix: preserve cache error class names in save-cache bundle (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1093">#1093</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/8ca4be000bfa5f8e6aaa01d8470878c90aa728d3"><code>8ca4be0</code></a> chore: update known checksums for 0.13.1 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1094">#1094</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/b627d85691ead579b598a36169571b1c7123526f"><code>b627d85</code></a> docs: cache-dependency-glob matches relative to the working directory (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1092">#1092</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/f8c88970fcd8fff8e97bc62edc5f5c073a0527fe"><code>f8c8897</code></a> Verify npm dependency signatures before builds (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1027">#1027</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/f64d32b1cd6cc11405a74665b3dfb7bb86fea9f0"><code>f64d32b</code></a> docs: update version references to v10.3.0 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1090">#1090</a>)</li> <li>See full diff in <a href="https://github.com/astral-sh/setup-uv/compare/1c37ad07a6a961277cf70c0d37d6f313000f5884...07a047e608db84b3d8c06cd9a7c7dcc9c355c18e">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/init` from 4.39.0 to 4.39.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/init's releases</a>.</em></p> <blockquote> <h2>v4.39.1</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3">2.27.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4256">#4256</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/init's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.39.1 - 21 Oct 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3">2.27.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4256">#4256</a></li> </ul> <h2>4.39.0 - 15 Oct 2026</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.20.7. <a href="https://redirect.github.com/github/codeql-action/pull/4205">#4205</a></li> <li>The <code>codeql-action/analyze</code> step now validates that a correct argument for the <code>checkout_path</code> input has been provided. The <code>checkout_path</code> input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by <code>codeql-action/init</code>, then the CodeQL Action now produces a warning. <a href="https://redirect.github.com/github/codeql-action/pull/4148">#4148</a></li> <li>Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. <a href="https://redirect.github.com/github/codeql-action/pull/4206">#4206</a></li> <li>The <code>codeql-action/start-proxy</code> step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as <code>codeql-action/init</code>. This primarily benefits customers who are using GitHub instances other than <code>github.com</code> where the <code>codeql-action/start-proxy</code> step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. <a href="https://redirect.github.com/github/codeql-action/pull/4198">#4198</a></li> </ul> <h2>4.38.3 - 08 Oct 2026</h2> <ul> <li><em>Upcoming breaking change</em>: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. <a href="https://redirect.github.com/github/codeql-action/pull/4188">#4188</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2">2.27.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4203">#4203</a></li> <li>Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/4184">#4184</a></li> </ul> <h2>4.38.2 - 24 Sept 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1">2.27.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4160">#4160</a></li> </ul> <h2>4.38.1 - 18 Sept 2026</h2> <ul> <li>The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/4146">#4146</a></li> </ul> <h2>4.38.0 - 09 Sept 2026</h2> <ul> <li>On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. <a href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li> <li>The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native <code>linux-arm64</code> CodeQL bundle when available. <a href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li> </ul> <h2>4.37.9 - 26 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li> </ul> <h2>4.37.8 - 21 Aug 2026</h2> <p>No user facing changes.</p> <h2>4.37.7 - 13 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/9b3254085494b55a0f7c4c2b3d2d52cc712ce370"><code>9b32540</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4257">#4257</a> from github/update-v4.39.1-c5a2f4b0f</li> <li><a href="https://github.com/github/codeql-action/commit/b5e1ed9574dcfa81c88c318140f3b3e5c199bfb3"><code>b5e1ed9</code></a> Trigger workflows</li> <li><a href="https://github.com/github/codeql-action/commit/20f5ec39109073afe1789b098456b2be0164f4ee"><code>20f5ec3</code></a> Update changelog for v4.39.1</li> <li><a href="https://github.com/github/codeql-action/commit/c5a2f4b0fe28ca06eaaeb86fb05a5f612ae293f9"><code>c5a2f4b</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4245">#4245</a> from github/henrymercer/graduate-overlay-trap-caching</li> <li><a href="https://github.com/github/codeql-action/commit/61a5a80dd98ad1b9679010141a46cace51065761"><code>61a5a80</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4256">#4256</a> from github/update-bundle/codeql-bundle-v2.27.3</li> <li><a href="https://github.com/github/codeql-action/commit/3dd33f8b69588bd9591684b2dca169eb612f5ed5"><code>3dd33f8</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4249">#4249</a> from github/mbg/upload-improvements-for-4223</li> <li><a href="https://github.com/github/codeql-action/commit/b96e3390db93dc46c2c3753a94b87c0d734b0b61"><code>b96e339</code></a> Change comment for <code>getConfig</code> call in <code>upload-sarif</code></li> <li><a href="https://github.com/github/codeql-action/commit/7fa45180db8d657b23ded3636b5d8583aec6ddfe"><code>7fa4518</code></a> Use <code>shouldSkipSarifUpload</code> in <code>analyze-action.ts</code></li> <li><a href="https://github.com/github/codeql-action/commit/a69c7cb332d56f616fcadef002884523c71e8d1c"><code>a69c7cb</code></a> Document that setting the env vars to <code>false</code> takes precedence</li> <li><a href="https://github.com/github/codeql-action/commit/74ddcd9f65683791ab07eccd074b4ba145d89ea6"><code>74ddcd9</code></a> Fix typo in comment</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee...9b3254085494b55a0f7c4c2b3d2d52cc712ce370">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/autobuild` from 4.39.0 to 4.39.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/autobuild's releases</a>.</em></p> <blockquote> <h2>v4.39.1</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3">2.27.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4256">#4256</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/autobuild's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.39.1 - 21 Oct 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3">2.27.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4256">#4256</a></li> </ul> <h2>4.39.0 - 15 Oct 2026</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.20.7. <a href="https://redirect.github.com/github/codeql-action/pull/4205">#4205</a></li> <li>The <code>codeql-action/analyze</code> step now validates that a correct argument for the <code>checkout_path</code> input has been provided. The <code>checkout_path</code> input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by <code>codeql-action/init</code>, then the CodeQL Action now produces a warning. <a href="https://redirect.github.com/github/codeql-action/pull/4148">#4148</a></li> <li>Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. <a href="https://redirect.github.com/github/codeql-action/pull/4206">#4206</a></li> <li>The <code>codeql-action/start-proxy</code> step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as <code>codeql-action/init</code>. This primarily benefits customers who are using GitHub instances other than <code>github.com</code> where the <code>codeql-action/start-proxy</code> step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. <a href="https://redirect.github.com/github/codeql-action/pull/4198">#4198</a></li> </ul> <h2>4.38.3 - 08 Oct 2026</h2> <ul> <li><em>Upcoming breaking change</em>: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. <a href="https://redirect.github.com/github/codeql-action/pull/4188">#4188</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2">2.27.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4203">#4203</a></li> <li>Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/4184">#4184</a></li> </ul> <h2>4.38.2 - 24 Sept 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1">2.27.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4160">#4160</a></li> </ul> <h2>4.38.1 - 18 Sept 2026</h2> <ul> <li>The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/4146">#4146</a></li> </ul> <h2>4.38.0 - 09 Sept 2026</h2> <ul> <li>On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. <a href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li> <li>The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native <code>linux-arm64</code> CodeQL bundle when available. <a href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li> </ul> <h2>4.37.9 - 26 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li> </ul> <h2>4.37.8 - 21 Aug 2026</h2> <p>No user facing changes.</p> <h2>4.37.7 - 13 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/9b3254085494b55a0f7c4c2b3d2d52cc712ce370"><code>9b32540</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4257">#4257</a> from github/update-v4.39.1-c5a2f4b0f</li> <li><a href="https://github.com/github/codeql-action/commit/b5e1ed9574dcfa81c88c318140f3b3e5c199bfb3"><code>b5e1ed9</code></a> Trigger workflows</li> <li><a href="https://github.com/github/codeql-action/commit/20f5ec39109073afe1789b098456b2be0164f4ee"><code>20f5ec3</code></a> Update changelog for v4.39.1</li> <li><a href="https://github.com/github/codeql-action/commit/c5a2f4b0fe28ca06eaaeb86fb05a5f612ae293f9"><code>c5a2f4b</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4245">#4245</a> from github/henrymercer/graduate-overlay-trap-caching</li> <li><a href="https://github.com/github/codeql-action/commit/61a5a80dd98ad1b9679010141a46cace51065761"><code>61a5a80</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4256">#4256</a> from github/update-bundle/codeql-bundle-v2.27.3</li> <li><a href="https://github.com/github/codeql-action/commit/3dd33f8b69588bd9591684b2dca169eb612f5ed5"><code>3dd33f8</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4249">#4249</a> from github/mbg/upload-improvements-for-4223</li> <li><a href="https://github.com/github/codeql-action/commit/b96e3390db93dc46c2c3753a94b87c0d734b0b61"><code>b96e339</code></a> Change comment for <code>getConfig</code> call in <code>upload-sarif</code></li> <li><a href="https://github.com/github/codeql-action/commit/7fa45180db8d657b23ded3636b5d8583aec6ddfe"><code>7fa4518</code></a> Use <code>shouldSkipSarifUpload</code> in <code>analyze-action.ts</code></li> <li><a href="https://github.com/github/codeql-action/commit/a69c7cb332d56f616fcadef002884523c71e8d1c"><code>a69c7cb</code></a> Document that setting the env vars to <code>false</code> takes precedence</li> <li><a href="https://github.com/github/codeql-action/commit/74ddcd9f65683791ab07eccd074b4ba145d89ea6"><code>74ddcd9</code></a> Fix typo in comment</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee...9b3254085494b55a0f7c4c2b3d2d52cc712ce370">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/analyze` from 4.39.0 to 4.39.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/analyze's releases</a>.</em></p> <blockquote> <h2>v4.39.1</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3">2.27.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4256">#4256</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/analyze's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.39.1 - 21 Oct 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3">2.27.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4256">#4256</a></li> </ul> <h2>4.39.0 - 15 Oct 2026</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.20.7. <a href="https://redirect.github.com/github/codeql-action/pull/4205">#4205</a></li> <li>The <code>codeql-action/analyze</code> step now validates that a correct argument for the <code>checkout_path</code> input has been provided. The <code>checkout_path</code> input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by <code>codeql-action/init</code>, then the CodeQL Action now produces a warning. <a href="https://redirect.github.com/github/codeql-action/pull/4148">#4148</a></li> <li>Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. <a href="https://redirect.github.com/github/codeql-action/pull/4206">#4206</a></li> <li>The <code>codeql-action/start-proxy</code> step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as <code>codeql-action/init</code>. This primarily benefits customers who are using GitHub instances other than <code>github.com</code> where the <code>codeql-action/start-proxy</code> step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. <a href="https://redirect.github.com/github/codeql-action/pull/4198">#4198</a></li> </ul> <h2>4.38.3 - 08 Oct 2026</h2> <ul> <li><em>Upcoming breaking change</em>: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. <a href="https://redirect.github.com/github/codeql-action/pull/4188">#4188</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2">2.27.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4203">#4203</a></li> <li>Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/4184">#4184</a></li> </ul> <h2>4.38.2 - 24 Sept 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1">2.27.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4160">#4160</a></li> </ul> <h2>4.38.1 - 18 Sept 2026</h2> <ul> <li>The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/4146">#4146</a></li> </ul> <h2>4.38.0 - 09 Sept 2026</h2> <ul> <li>On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. <a href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li> <li>The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native <code>linux-arm64</code> CodeQL bundle when available. <a href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li> </ul> <h2>4.37.9 - 26 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li> </ul> <h2>4.37.8 - 21 Aug 2026</h2> <p>No user facing changes.</p> <h2>4.37.7 - 13 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/9b3254085494b55a0f7c4c2b3d2d52cc712ce370"><code>9b32540</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4257">#4257</a> from github/update-v4.39.1-c5a2f4b0f</li> <li><a href="https://github.com/github/codeql-action/commit/b5e1ed9574dcfa81c88c318140f3b3e5c199bfb3"><code>b5e1ed9</code></a> Trigger workflows</li> <li><a href="https://github.com/github/codeql-action/commit/20f5ec39109073afe1789b098456b2be0164f4ee"><code>20f5ec3</code></a> Update changelog for v4.39.1</li> <li><a href="https://github.com/github/codeql-action/commit/c5a2f4b0fe28ca06eaaeb86fb05a5f612ae293f9"><code>c5a2f4b</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4245">#4245</a> from github/henrymercer/graduate-overlay-trap-caching</li> <li><a href="https://github.com/github/codeql-action/commit/61a5a80dd98ad1b9679010141a46cace51065761"><code>61a5a80</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4256">#4256</a> from github/update-bundle/codeql-bundle-v2.27.3</li> <li><a href="https://github.com/github/codeql-action/commit/3dd33f8b69588bd9591684b2dca169eb612f5ed5"><code>3dd33f8</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4249">#4249</a> from github/mbg/upload-improvements-for-4223</li> <li><a href="https://github.com/github/codeql-action/commit/b96e3390db93dc46c2c3753a94b87c0d734b0b61"><code>b96e339</code></a> Change comment for <code>getConfig</code> call in <code>upload-sarif</code></li> <li><a href="https://github.com/github/codeql-action/commit/7fa45180db8d657b23ded3636b5d8583aec6ddfe"><code>7fa4518</code></a> Use <code>shouldSkipSarifUpload</code> in <code>analyze-action.ts</code></li> <li><a href="https://github.com/github/codeql-action/commit/a69c7cb332d56f616fcadef002884523c71e8d1c"><code>a69c7cb</code></a> Document that setting the env vars to <code>false</code> takes precedence</li> <li><a href="https://github.com/github/codeql-action/commit/74ddcd9f65683791ab07eccd074b4ba145d89ea6"><code>74ddcd9</code></a> Fix typo in comment</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee...9b3254085494b55a0f7c4c2b3d2d52cc712ce370">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
splitsec2
|
d04268c639 |
fix(docker): drop the unused selenium-manager binaries from the image (#1615)
Came out of looking at what is in the image after @wrycu's #1606. The selenium package ships prebuilt `selenium-manager` binaries for four platforms (about 22MB uncompressed), and none of them are used here. They only run when selenium has to find a webdriver, and the bypasser drives the browser through SeleniumBase's Pure-CDP driver, which doesn't use one. This deletes them (and their SBOM file) in the same `RUN` as `uv sync`, so the layer doesn't carry them. As a side effect image scanners stop reporting on the Rust crates compiled into those binaries. To check nothing needs them, I deleted the files in a throwaway container from the current `dev` image and ran `internal_bypasser.get()` against example.com. It started the browser, loaded the page and returned it, same as without the deletion. I haven't run a full image build of this branch, so CI is the first time that exact `RUN` line gets executed. TL;DR dropping an unused feature from an included package lowering size and eliminating flags for security vulnerabilities that don't get exercised. @calibrain this one is optional too, but I don't see a downside, your call. |
||
|
splitsec2
|
3d7d04256f |
fix(docker): bump Chromium pin to 156.0.8078.73 (#1614)
Debian has a newer Chromium in trixie-security (156.0.8078.73), so this moves the pin from .47 to .73 and the snapshot to 20261029T020000Z, the first one that has it for both amd64 and arm64. Same shape as #1601. To check the bypasser still works on it, I started a throwaway container from the current `dev` image, upgraded Chromium to .73 the way the Dockerfile does, and ran `internal_bypasser.get()` against example.com. It starts, loads the page and returns it, the same as on .47. I also pointed both versions at the Cloudflare demo challenge page at scrapingcourse.com. They behave the same there, but neither one solves it from where I ran it (same challenge detected 4 times, then abort), so that only shows no difference, not a working solve. I also ran it against an Anna's Archive search page on both versions. Both returned the full results page, but the log shows no bypass attempts, so that mirror didn't serve a challenge from where I ran it and the solver itself wasn't exercised. @calibrain your call on if we should update to this, it is minor bump to what has already been pushed. |
||
|
splitsec2
|
cd5a478831 |
refactor: move the onboarding routes into core/onboarding_routes.py (#1594)
First of the route moves from Discussion #1536, following the plan table there: the three onboarding routes (`GET` and `POST /api/onboarding`, `POST /api/onboarding/skip`) leave `main.py` for `core/onboarding_routes.py`, registered with `register_onboarding_routes(app, login_required)` the way `release_inspect_routes` takes it. `main.py` goes down by 72 lines and the handler bodies are the same code (I diffed them after de-indenting: the only difference is the local name of the error tuple). There are two commits so the move can be reviewed on its own. The first adds 15 tests for these routes, which had none, and they pass on current `main` before anything moves. They pin the behaviour I most wanted to keep: a 401 without a session when auth is on, a 403 for a signed-in non-admin (that check lives in `login_required` and goes by path, which is why the same decorator has to be passed in), the 400 on an empty body, the result passed through on success and failure, the 500 with the error text on an operational error, and open access when no auth is configured. The second commit is the move, and no test changed in it. What I checked on the move: - The Flask URL map (every rule, its methods and its endpoint name) is identical before and after: 77 rules, the three onboarding ones included. - Full suite, ruff and basedpyright are clean. - I ran the app from this branch and stepped through the setup wizard in a browser. It loads its steps from the moved route and goes from Search Mode to Metadata Provider, and `POST /api/onboarding/skip` and the empty-body 400 answer as before. Two small things that do change. The log lines for these routes now come from `shelfmark.core.onboarding_routes` instead of `main`, and the error tuple is a local copy (`_ONBOARDING_ERRORS`, the same classes as `_IMPORT_OPERATIONAL_ERRORS`) so the module does not import `main`. Nothing else is different. |
||
|
splitsec2
|
69cbf72698 |
refactor: move the settings routes into core/settings_routes.py (#1595)
Second route move from the plan in Discussion #1536: the four settings routes (`GET /api/settings`, `GET` and `PUT /api/settings/<tab>`, and `POST /api/settings/<tab>/action/<key>`) go from `main.py` to `core/settings_routes.py`, registered with `register_settings_routes(app, login_required)`. `main.py` is 143 lines shorter. These handlers call `settings_registry` directly, so nothing else has to be passed in. The handler bodies are the same code, and the only difference I found after de-indenting them is that `ruff format` wrapped one signature that no longer fits on a line. Same two-commit layout as the onboarding one (#1594). The first commit adds 27 tests for these routes and they pass on current `main` before anything moves. They pin the 404 for an unknown tab, the 400 when a `PUT` body is not a JSON object (a list, a string, a number, or no body at all), the "No changes to save" answer for an empty object, the unsaved form values reaching an action, the result passed through with a 400 on failure, the 500 with the error text on an operational error, a 401 without a session, a 403 for a signed-in non-admin on all four routes, and open access with no auth. The second commit is the move and no test changed in it. The admin check for these paths lives in `login_required`, so the same decorator is passed in. What I checked: - The Flask URL map (every rule, its methods and its endpoint name) is identical before and after, all 77 rules. - Full suite, ruff and basedpyright are clean. - I ran the app from this branch and opened Settings in a browser: the modal lists every tab and the General tab shows its values, which come from the moved `GET`. Over HTTP, a `PUT` of a new search page title saved and read back, a list body got the 400 and an unknown tab the 404. As with #1594, log lines for these routes now come from `shelfmark.core.settings_routes`, and the error tuple is a local copy (`_SETTINGS_ERRORS`) so the module does not import `main`. The two PRs touch neighbouring lines of `main.py` and I checked that they merge together without a conflict, in either order. |